use external oauth api clients in oauthserver

hack/import-restrictions.json

@@ -361,8 +361,7 @@
       "vendor/github.com/openshift/client-go",
 
       "github.com/openshift/origin/pkg/oauthserver",
-      "github.com/openshift/origin/pkg/route/generated",
-      "github.com/openshift/origin/pkg/oauth/generated"
+      "github.com/openshift/origin/pkg/route/generated"
     ],
     "allowedImportPackages": [
       "vendor/github.com/golang/glog",
@@ -373,7 +372,6 @@
       "github.com/openshift/origin/pkg/authorization/authorizer/scope",
       "github.com/openshift/origin/pkg/oauth/apis/oauth/validation",
       "github.com/openshift/origin/pkg/oauth/scope",
-      "github.com/openshift/origin/pkg/oauth/apis/oauth",
       "github.com/openshift/origin/pkg/oauth/registry/oauthclientauthorization",
       "github.com/openshift/origin/pkg/cmd/server/api",
       "github.com/openshift/origin/pkg/cmd/server/api/latest",

pkg/authorization/authorizer/scope/converter.go

@@ -14,9 +14,9 @@ import (
 	rbaclisters "k8s.io/kubernetes/pkg/client/listers/rbac/internalversion"
 	authorizerrbac "k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac"
 
+	oauthapi "github.com/openshift/api/oauth/v1"
 	authorizationapi "github.com/openshift/origin/pkg/authorization/apis/authorization"
 	imageapi "github.com/openshift/origin/pkg/image/apis/image"
-	oauthapi "github.com/openshift/origin/pkg/oauth/apis/oauth"
 	projectapi "github.com/openshift/origin/pkg/project/apis/project"
 	userapi "github.com/openshift/origin/pkg/user/apis/user"
 )
@@ -486,7 +486,7 @@ func validateScopeRestrictions(client *oauthapi.OAuthClient, scope string) error
 
 	for _, restriction := range client.ScopeRestrictions {
 		if len(restriction.ExactValues) > 0 {
-			if err := ValidateLiteralScopeRestrictions(scope, restriction.ExactValues); err != nil {
+			if err := validateLiteralScopeRestrictions(scope, restriction.ExactValues); err != nil {
 				errs = append(errs, err)
 				continue
 			}
@@ -497,7 +497,7 @@ func validateScopeRestrictions(client *oauthapi.OAuthClient, scope string) error
 			if !clusterRoleEvaluatorInstance.Handles(scope) {
 				continue
 			}
-			if err := ValidateClusterRoleScopeRestrictions(scope, *restriction.ClusterRole); err != nil {
+			if err := validateClusterRoleScopeRestrictions(scope, *restriction.ClusterRole); err != nil {
 				errs = append(errs, err)
 				continue
 			}
@@ -513,7 +513,7 @@ func validateScopeRestrictions(client *oauthapi.OAuthClient, scope string) error
 	return kutilerrors.NewAggregate(errs)
 }
 
-func ValidateLiteralScopeRestrictions(scope string, literals []string) error {
+func validateLiteralScopeRestrictions(scope string, literals []string) error {
 	for _, literal := range literals {
 		if literal == scope {
 			return nil
@@ -523,7 +523,7 @@ func ValidateLiteralScopeRestrictions(scope string, literals []string) error {
 	return fmt.Errorf("%v not found in %v", scope, literals)
 }
 
-func ValidateClusterRoleScopeRestrictions(scope string, restriction oauthapi.ClusterRoleScopeRestriction) error {
+func validateClusterRoleScopeRestrictions(scope string, restriction oauthapi.ClusterRoleScopeRestriction) error {
 	role, namespace, escalating, err := clusterRoleEvaluatorInstance.parseScope(scope)
 	if err != nil {
 		return err

pkg/authorization/authorizer/scope/validate_test.go

@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"
 
-	oauthapi "github.com/openshift/origin/pkg/oauth/apis/oauth"
+	oauthapi "github.com/openshift/api/oauth/v1"
 )
 
 func TestValidateScopeRestrictions(t *testing.T) {

pkg/oauth/apiserver/apiserver.go

@@ -13,9 +13,8 @@ import (
 	coreclient "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset/typed/core/internalversion"
 
 	oauthapiv1 "github.com/openshift/api/oauth/v1"
+	oauthclient "github.com/openshift/client-go/oauth/clientset/versioned/typed/oauth/v1"
 	configapi "github.com/openshift/origin/pkg/cmd/server/api"
-	oauthapi "github.com/openshift/origin/pkg/oauth/apis/oauth"
-	oauthclient "github.com/openshift/origin/pkg/oauth/generated/internalclientset/typed/oauth/internalversion"
 	accesstokenetcd "github.com/openshift/origin/pkg/oauth/registry/oauthaccesstoken/etcd"
 	authorizetokenetcd "github.com/openshift/origin/pkg/oauth/registry/oauthauthorizetoken/etcd"
 	clientetcd "github.com/openshift/origin/pkg/oauth/registry/oauthclient/etcd"
@@ -109,10 +108,10 @@ func (c *completedConfig) newV1RESTStorage() (map[string]rest.Storage, error) {
 	}
 
 	// If OAuth is disabled, set the strategy to Deny
-	saAccountGrantMethod := oauthapi.GrantHandlerDeny
+	saAccountGrantMethod := oauthapiv1.GrantHandlerDeny
 	if len(c.ExtraConfig.ServiceAccountMethod) > 0 {
 		// Otherwise, take the value provided in master-config.yaml
-		saAccountGrantMethod = oauthapi.GrantHandlerType(c.ExtraConfig.ServiceAccountMethod)
+		saAccountGrantMethod = oauthapiv1.GrantHandlerType(c.ExtraConfig.ServiceAccountMethod)
 	}
 
 	oauthClient, err := oauthclient.NewForConfig(c.GenericConfig.LoopbackClientConfig)

pkg/oauth/registry/oauthclient/registry.go

@@ -3,7 +3,7 @@ package oauthclient
 import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
-	oauthapi "github.com/openshift/origin/pkg/oauth/apis/oauth"
+	oauthapi "github.com/openshift/api/oauth/v1"
 )
 
 // Getter exposes a way to get a specific client.  This is useful for other registries to get scope limitations

pkg/oauth/registry/oauthclientauthorization/strategy_test.go

@@ -5,8 +5,8 @@ import (
 
 	"k8s.io/apimachinery/pkg/apis/meta/v1"
 
+	oauth "github.com/openshift/api/oauth/v1"
 	"github.com/openshift/origin/pkg/authorization/authorizer/scope"
-	"github.com/openshift/origin/pkg/oauth/apis/oauth"
 	oauthapi "github.com/openshift/origin/pkg/oauth/apis/oauth"
 )
 

pkg/oauthserver/oauth/handlers/default_auth_handler.go

@@ -9,7 +9,7 @@ import (
 	kerrors "k8s.io/apimachinery/pkg/util/errors"
 	"k8s.io/apiserver/pkg/endpoints/request"
 
-	oauthapi "github.com/openshift/origin/pkg/oauth/apis/oauth"
+	oauthapi "github.com/openshift/api/oauth/v1"
 	authapi "github.com/openshift/origin/pkg/oauthserver/api"
 )
 

pkg/oauthserver/oauth/handlers/default_auth_handler_test.go

@@ -10,7 +10,7 @@ import (
 
 	"k8s.io/apiserver/pkg/endpoints/request"
 
-	oauthapi "github.com/openshift/origin/pkg/oauth/apis/oauth"
+	oauthapi "github.com/openshift/api/oauth/v1"
 )
 
 type testClient struct {

pkg/oauthserver/oauth/handlers/grant.go

@@ -14,8 +14,8 @@ import (
 	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/apiserver/pkg/authentication/user"
 
+	oauthapi "github.com/openshift/api/oauth/v1"
 	scopeauthorizer "github.com/openshift/origin/pkg/authorization/authorizer/scope"
-	oauthapi "github.com/openshift/origin/pkg/oauth/apis/oauth"
 	"github.com/openshift/origin/pkg/oauth/apis/oauth/validation"
 	"github.com/openshift/origin/pkg/oauth/scope"
 	"github.com/openshift/origin/pkg/oauthserver/api"

pkg/oauthserver/oauth/registry/grantchecker.go

@@ -8,8 +8,8 @@ import (
 	kuser "k8s.io/apiserver/pkg/authentication/user"
 	"k8s.io/client-go/util/retry"
 
-	"github.com/openshift/origin/pkg/oauth/apis/oauth"
-	oauthclient "github.com/openshift/origin/pkg/oauth/generated/internalclientset/typed/oauth/internalversion"
+	oauth "github.com/openshift/api/oauth/v1"
+	oauthclient "github.com/openshift/client-go/oauth/clientset/versioned/typed/oauth/v1"
 	"github.com/openshift/origin/pkg/oauth/registry/oauthclientauthorization"
 	"github.com/openshift/origin/pkg/oauth/scope"
 	"github.com/openshift/origin/pkg/oauthserver/api"

pkg/oauthserver/oauth/registry/registry_test.go

@@ -12,8 +12,8 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apiserver/pkg/authentication/user"
 
-	oapi "github.com/openshift/origin/pkg/oauth/apis/oauth"
-	oauthfake "github.com/openshift/origin/pkg/oauth/generated/internalclientset/fake"
+	oapi "github.com/openshift/api/oauth/v1"
+	oauthfake "github.com/openshift/client-go/oauth/clientset/versioned/fake"
 	"github.com/openshift/origin/pkg/oauthserver/api"
 	"github.com/openshift/origin/pkg/oauthserver/oauth/handlers"
 	"github.com/openshift/origin/pkg/oauthserver/osinserver"

pkg/oauthserver/oauth/registry/userconversion.go

@@ -5,7 +5,7 @@ import (
 
 	kuser "k8s.io/apiserver/pkg/authentication/user"
 
-	oapi "github.com/openshift/origin/pkg/oauth/apis/oauth"
+	oapi "github.com/openshift/api/oauth/v1"
 )
 
 type UserConversion struct{}

pkg/oauthserver/oauthserver/auth.go

@@ -25,10 +25,10 @@ import (
 	"k8s.io/apiserver/pkg/endpoints/request"
 	"k8s.io/client-go/util/retry"
 
+	oauthapi "github.com/openshift/api/oauth/v1"
+	oauthclient "github.com/openshift/client-go/oauth/clientset/versioned/typed/oauth/v1"
 	configapi "github.com/openshift/origin/pkg/cmd/server/api"
 	cmdutil "github.com/openshift/origin/pkg/cmd/util"
-	oauthapi "github.com/openshift/origin/pkg/oauth/apis/oauth"
-	oauthclient "github.com/openshift/origin/pkg/oauth/generated/internalclientset/typed/oauth/internalversion"
 	clientregistry "github.com/openshift/origin/pkg/oauth/registry/oauthclient"
 	oauthutil "github.com/openshift/origin/pkg/oauth/util"
 	"github.com/openshift/origin/pkg/oauthserver/authenticator/challenger/passwordchallenger"

pkg/oauthserver/oauthserver/oauth_apiserver.go

@@ -20,11 +20,11 @@ import (
 	"k8s.io/kubernetes/pkg/api/legacyscheme"
 	kclientset "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset"
 
+	oauthapi "github.com/openshift/api/oauth/v1"
+	oauthclient "github.com/openshift/client-go/oauth/clientset/versioned/typed/oauth/v1"
 	userclient "github.com/openshift/client-go/user/clientset/versioned/typed/user/v1"
 	configapi "github.com/openshift/origin/pkg/cmd/server/api"
 	"github.com/openshift/origin/pkg/cmd/server/api/latest"
-	oauthapi "github.com/openshift/origin/pkg/oauth/apis/oauth"
-	oauthclient "github.com/openshift/origin/pkg/oauth/generated/internalclientset/typed/oauth/internalversion"
 	oauthutil "github.com/openshift/origin/pkg/oauth/util"
 	"github.com/openshift/origin/pkg/oauthserver/server/session"
 	routeclient "github.com/openshift/origin/pkg/route/generated/internalclientset"

pkg/oauthserver/osinserver/registrystorage/storage.go

@@ -9,9 +9,9 @@ import (
 	kerrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
+	oauthapi "github.com/openshift/api/oauth/v1"
+	oauthclient "github.com/openshift/client-go/oauth/clientset/versioned/typed/oauth/v1"
 	scopeauthorizer "github.com/openshift/origin/pkg/authorization/authorizer/scope"
-	oauthapi "github.com/openshift/origin/pkg/oauth/apis/oauth"
-	oauthclient "github.com/openshift/origin/pkg/oauth/generated/internalclientset/typed/oauth/internalversion"
 	oauthclientregistry "github.com/openshift/origin/pkg/oauth/registry/oauthclient"
 	"github.com/openshift/origin/pkg/oauth/scope"
 	"github.com/openshift/origin/pkg/oauthserver/oauth/handlers"

pkg/oauthserver/server/grant/grant.go

@@ -15,9 +15,9 @@ import (
 	"k8s.io/apiserver/pkg/authentication/serviceaccount"
 	"k8s.io/apiserver/pkg/authentication/user"
 
+	oapi "github.com/openshift/api/oauth/v1"
+	oauthclient "github.com/openshift/client-go/oauth/clientset/versioned/typed/oauth/v1"
 	scopeauthorizer "github.com/openshift/origin/pkg/authorization/authorizer/scope"
-	oapi "github.com/openshift/origin/pkg/oauth/apis/oauth"
-	oauthclient "github.com/openshift/origin/pkg/oauth/generated/internalclientset/typed/oauth/internalversion"
 	oauthclientregistry "github.com/openshift/origin/pkg/oauth/registry/oauthclient"
 	"github.com/openshift/origin/pkg/oauth/registry/oauthclientauthorization"
 	"github.com/openshift/origin/pkg/oauth/scope"

pkg/oauthserver/server/grant/grant_test.go

@@ -16,8 +16,8 @@ import (
 	"k8s.io/apiserver/pkg/authentication/user"
 	clienttesting "k8s.io/client-go/testing"
 
-	oapi "github.com/openshift/origin/pkg/oauth/apis/oauth"
-	oauthfake "github.com/openshift/origin/pkg/oauth/generated/internalclientset/fake"
+	oapi "github.com/openshift/api/oauth/v1"
+	oauthfake "github.com/openshift/client-go/oauth/clientset/versioned/fake"
 	oauthclientregistry "github.com/openshift/origin/pkg/oauth/registry/oauthclient"
 	"github.com/openshift/origin/pkg/oauthserver/server/csrf"
 )

pkg/serviceaccounts/oauthclient/oauthclientregistry.go

@@ -21,8 +21,8 @@ import (
 	kcoreclient "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset/typed/core/internalversion"
 	"k8s.io/kubernetes/pkg/serviceaccount"
 
+	oauthapi "github.com/openshift/api/oauth/v1"
 	scopeauthorizer "github.com/openshift/origin/pkg/authorization/authorizer/scope"
-	oauthapi "github.com/openshift/origin/pkg/oauth/apis/oauth"
 	"github.com/openshift/origin/pkg/oauth/registry/oauthclient"
 	routeapi "github.com/openshift/origin/pkg/route/apis/route"
 	routeclient "github.com/openshift/origin/pkg/route/generated/internalclientset/typed/route/internalversion"

pkg/serviceaccounts/oauthclient/oauthclientregistry_test.go

@@ -18,7 +18,6 @@ import (
 	"k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset/fake"
 
 	oauthapiv1 "github.com/openshift/api/oauth/v1"
-	oauthapi "github.com/openshift/origin/pkg/oauth/apis/oauth"
 	_ "github.com/openshift/origin/pkg/oauth/apis/oauth/install"
 	routeapi "github.com/openshift/origin/pkg/route/apis/route"
 	routefake "github.com/openshift/origin/pkg/route/generated/internalclientset/fake"
@@ -44,7 +43,7 @@ func TestGetClient(t *testing.T) {
 		expectedDelegation  bool
 		expectedErr         string
 		expectedEventMsg    string
-		expectedClient      *oauthapi.OAuthClient
+		expectedClient      *oauthapiv1.OAuthClient
 		expectedKubeActions []clientgotesting.Action
 		expectedOSActions   []clientgotesting.Action
 	}{
@@ -147,12 +146,12 @@ func TestGetClient(t *testing.T) {
 					Data: map[string][]byte{kapi.ServiceAccountTokenKey: []byte("foo")},
 				}),
 			routeClient: routefake.NewSimpleClientset(),
-			expectedClient: &oauthapi.OAuthClient{
+			expectedClient: &oauthapiv1.OAuthClient{
 				ObjectMeta:        metav1.ObjectMeta{Name: "system:serviceaccount:ns-01:default"},
 				ScopeRestrictions: getScopeRestrictionsFor("ns-01", "default"),
 				AdditionalSecrets: []string{"foo"},
 				RedirectURIs:      []string{"http://anywhere"},
-				GrantMethod:       oauthapi.GrantHandlerPrompt,
+				GrantMethod:       oauthapiv1.GrantHandlerPrompt,
 			},
 			expectedKubeActions: []clientgotesting.Action{
 				clientgotesting.NewGetAction(serviceAccountsResource, "ns-01", "default"),
@@ -205,12 +204,12 @@ func TestGetClient(t *testing.T) {
 					},
 				},
 			),
-			expectedClient: &oauthapi.OAuthClient{
+			expectedClient: &oauthapiv1.OAuthClient{
 				ObjectMeta:        metav1.ObjectMeta{Name: "system:serviceaccount:ns-01:default"},
 				ScopeRestrictions: getScopeRestrictionsFor("ns-01", "default"),
 				AdditionalSecrets: []string{"foo"},
 				RedirectURIs:      []string{"http://anywhere", "https://example1.com/defaultpath"},
-				GrantMethod:       oauthapi.GrantHandlerPrompt,
+				GrantMethod:       oauthapiv1.GrantHandlerPrompt,
 			},
 			expectedKubeActions: []clientgotesting.Action{
 				clientgotesting.NewGetAction(serviceAccountsResource, "ns-01", "default"),
@@ -268,12 +267,12 @@ func TestGetClient(t *testing.T) {
 					},
 				},
 			),
-			expectedClient: &oauthapi.OAuthClient{
+			expectedClient: &oauthapiv1.OAuthClient{
 				ObjectMeta:        metav1.ObjectMeta{Name: "system:serviceaccount:ns-01:default"},
 				ScopeRestrictions: getScopeRestrictionsFor("ns-01", "default"),
 				AdditionalSecrets: []string{"foo"},
 				RedirectURIs:      []string{"http://anywhere"},
-				GrantMethod:       oauthapi.GrantHandlerPrompt,
+				GrantMethod:       oauthapiv1.GrantHandlerPrompt,
 			},
 			expectedKubeActions: []clientgotesting.Action{
 				clientgotesting.NewGetAction(serviceAccountsResource, "ns-01", "default"),
@@ -326,12 +325,12 @@ func TestGetClient(t *testing.T) {
 					},
 				},
 			),
-			expectedClient: &oauthapi.OAuthClient{
+			expectedClient: &oauthapiv1.OAuthClient{
 				ObjectMeta:        metav1.ObjectMeta{Name: "system:serviceaccount:ns-01:default"},
 				ScopeRestrictions: getScopeRestrictionsFor("ns-01", "default"),
 				AdditionalSecrets: []string{"foo"},
 				RedirectURIs:      []string{"http://anywhere"},
-				GrantMethod:       oauthapi.GrantHandlerPrompt,
+				GrantMethod:       oauthapiv1.GrantHandlerPrompt,
 			},
 			expectedKubeActions: []clientgotesting.Action{
 				clientgotesting.NewGetAction(serviceAccountsResource, "ns-01", "default"),
@@ -412,12 +411,12 @@ func TestGetClient(t *testing.T) {
 					},
 				},
 			),
-			expectedClient: &oauthapi.OAuthClient{
+			expectedClient: &oauthapiv1.OAuthClient{
 				ObjectMeta:        metav1.ObjectMeta{Name: "system:serviceaccount:ns-01:default"},
 				ScopeRestrictions: getScopeRestrictionsFor("ns-01", "default"),
 				AdditionalSecrets: []string{"foo"},
 				RedirectURIs:      []string{"http://anywhere", "https://a.com/defaultpath", "https://a.com/path2", "https://b.com/defaultpath", "https://b.com/path2"},
-				GrantMethod:       oauthapi.GrantHandlerPrompt,
+				GrantMethod:       oauthapiv1.GrantHandlerPrompt,
 			},
 			expectedKubeActions: []clientgotesting.Action{
 				clientgotesting.NewGetAction(serviceAccountsResource, "ns-01", "default"),
@@ -491,12 +490,12 @@ func TestGetClient(t *testing.T) {
 					},
 				},
 			),
-			expectedClient: &oauthapi.OAuthClient{
+			expectedClient: &oauthapiv1.OAuthClient{
 				ObjectMeta:        metav1.ObjectMeta{Name: "system:serviceaccount:ns-01:default"},
 				ScopeRestrictions: getScopeRestrictionsFor("ns-01", "default"),
 				AdditionalSecrets: []string{"foo"},
 				RedirectURIs:      []string{"https://google.com/otherpath", "https://redhat.com/defaultpath"},
-				GrantMethod:       oauthapi.GrantHandlerPrompt,
+				GrantMethod:       oauthapiv1.GrantHandlerPrompt,
 			},
 			expectedKubeActions: []clientgotesting.Action{
 				clientgotesting.NewGetAction(serviceAccountsResource, "ns-01", "default"),
@@ -552,12 +551,12 @@ func TestGetClient(t *testing.T) {
 					},
 				},
 			),
-			expectedClient: &oauthapi.OAuthClient{
+			expectedClient: &oauthapiv1.OAuthClient{
 				ObjectMeta:        metav1.ObjectMeta{Name: "system:serviceaccount:ns-01:default"},
 				ScopeRestrictions: getScopeRestrictionsFor("ns-01", "default"),
 				AdditionalSecrets: []string{"foo"},
 				RedirectURIs:      []string{"https://woot.com/awesomepath", "https://woot.com:8000"},
-				GrantMethod:       oauthapi.GrantHandlerPrompt,
+				GrantMethod:       oauthapiv1.GrantHandlerPrompt,
 			},
 			expectedKubeActions: []clientgotesting.Action{
 				clientgotesting.NewGetAction(serviceAccountsResource, "ns-01", "default"),
@@ -578,7 +577,7 @@ func TestGetClient(t *testing.T) {
 			eventRecorder: fakerecorder,
 			routeClient:   tc.routeClient.Route(),
 			delegate:      delegate,
-			grantMethod:   oauthapi.GrantHandlerPrompt,
+			grantMethod:   oauthapiv1.GrantHandlerPrompt,
 			decoder:       legacyscheme.Codecs.UniversalDecoder(),
 		}
 		client, err := getter.Get(tc.clientName, metav1.GetOptions{})
@@ -628,7 +627,7 @@ type fakeDelegate struct {
 	called bool
 }
 
-func (d *fakeDelegate) Get(name string, options metav1.GetOptions) (*oauthapi.OAuthClient, error) {
+func (d *fakeDelegate) Get(name string, options metav1.GetOptions) (*oauthapiv1.OAuthClient, error) {
 	d.called = true
 	return nil, nil
 }