feat(auth/github): add organization membership check to GitHub

[erka]

add organization membership check to GitHub authentication method

fixes #2065

[github-actions]

Uffizzi Ephemeral Environment deployment-42486

☁️ https://app.uffizzi.com/github.com/flipt-io/flipt/pull/2508

📄 View Application Logs etc.

⏰ This Preview will be destroyed in 1 hours at: Sun Dec 10 19:02:54 UTC 2023

What is Uffizzi? Learn more!

[codecov]

Codecov Report

Attention: 6 lines in your changes are missing coverage. Please review.

Comparison is base (37f13e8) 70.71% compared to head (8edeac5) 70.87%.

Files	Patch %	Lines
internal/server/auth/method/github/server.go	83.33%	4 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2508      +/-   ##
==========================================
+ Coverage   70.71%   70.87%   +0.15%     
==========================================
  Files          81       81              
  Lines        8134     8168      +34     
==========================================
+ Hits         5752     5789      +37     
+ Misses       2035     2033       -2     
+ Partials      347      346       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[erka]

@markphelps I believe there could be something missing. It requires read:org scope to get user's organizations. Maybe there should be some configuration check but it's an open question for me. Please take a look and provide the feedback.

[markphelps]

@markphelps I believe there could be something missing. It requires read:org scope to get user's organizations. Maybe there should be some configuration check but it's an open question for me. Please take a lot and provide the feedback.

Cheers @erka ! Thanks for taking this on! I have a proposed solution to ^, erka#4

I still need to add tests however, but can do that in the fork PR or this one

[markphelps]

looking great, couple suggestions

[markphelps]

Looks and works great!

I tried it out by setting up our test OAuth app on Github

When I configured it to check:
allowed_organizations: flipt-io

It let me in. But when I changed it to allowed_organizations: flip-io purposefully misspelled, it gave me a 401 response!

[markphelps]

also checked that it errors if you don't request the read:org scope when setting allowed_organizations !

Error: loading configuration scopes must contain read:org when allowed_organizations is not empty

thanks @erka ! I will work on docs updates and get this out probably tomorrow in a release!