batch group requests (#14)

Author: dskatz

go.mod

@@ -53,7 +53,7 @@ require (
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/klog/v2 v2.90.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f // indirect
-	k8s.io/utils v0.0.0-20230209194617-a36077c30491 // indirect
+	k8s.io/utils v0.0.0-20250321185631-1f6e0b77f77e // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
 )

go.sum

@@ -531,8 +531,8 @@ k8s.io/klog/v2 v2.90.1 h1:m4bYOKall2MmOiRaR1J+We67Do7vm9KiQVlT96lnHUw=
 k8s.io/klog/v2 v2.90.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
 k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f h1:2kWPakN3i/k81b0gvD5C5FJ2kxm1WrQFanWchyKuqGg=
 k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f/go.mod h1:byini6yhqGC14c3ebc/QwanvYwhuMWF6yz2F8uwW8eg=
-k8s.io/utils v0.0.0-20230209194617-a36077c30491 h1:r0BAOLElQnnFhE/ApUsg3iHdVYYPBjNSSOMowRZxxsY=
-k8s.io/utils v0.0.0-20230209194617-a36077c30491/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+k8s.io/utils v0.0.0-20250321185631-1f6e0b77f77e h1:KqK5c/ghOm8xkHYhlodbp6i6+r+ChV2vuAuVRdFbLro=
+k8s.io/utils v0.0.0-20250321185631-1f6e0b77f77e/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=

providers/okta/okta.go

@@ -76,20 +76,66 @@ func (c *Client) ListGroupUsers(ctx context.Context, groupId string, opts ...Lis
 	return users, nil
 }
 
-func (c *Client) GroupByName(ctx context.Context, groupName string) (*okta.Group, error) {
+func (c *Client) GroupByName(ctx context.Context, groupName string) (okta.Group, error) {
+
 	query := c.GroupAPI.ListGroups(ctx).Q(groupName)
 	oktaGroups, _, err := query.Execute()
 	if err != nil {
-		return nil, fmt.Errorf("failed to query okta group: %w", err)
+		return okta.Group{}, fmt.Errorf("failed to query okta group: %w", err)
 	}
 
 	for _, group := range oktaGroups {
 		if group.Profile != nil && group.Profile.Name != nil && *group.Profile.Name == groupName {
-			return &group, nil
+			return group, nil
+		}
+	}
+
+	return okta.Group{}, fmt.Errorf("unable to find okta group %q", groupName)
+}
+
+func (c *Client) GroupsByName(ctx context.Context, groupNames []string, batchsize int) ([]okta.Group, error) {
+	groups := []okta.Group{}
+
+	batches := buildFilterNameBatches(groupNames, batchsize)
+
+	for _, filter := range batches {
+		// expanding stats to get the number of users in the group
+		query := c.GroupAPI.ListGroups(ctx).Search(filter).Expand("stats")
+		oktaGroups, resp, err := query.Execute()
+		for {
+			if err != nil {
+				return nil, fmt.Errorf("failed to query okta group: %w", err)
+			}
+
+			groups = append(groups, oktaGroups...)
+
+			if !resp.HasNextPage() {
+				break
+			}
+			oktaGroups = []okta.Group{}
+			resp, err = resp.Next(&oktaGroups)
+		}
+	}
+	return groups, nil
+}
+
+func buildFilterNameBatches(groupNames []string, batchsize int) []string {
+	batches := []string{}
+	for i := 0; i < len(groupNames); i += batchsize {
+		end := i + batchsize
+		if end > len(groupNames) {
+			end = len(groupNames)
 		}
+		batches = append(batches, toFilterString(groupNames[i:end]))
 	}
+	return batches
+}
 
-	return nil, fmt.Errorf("unable to find okta group %q", groupName)
+func toFilterString(groupNames []string) string {
+	if len(groupNames) == 0 {
+		return ""
+	}
+	return fmt.Sprintf("profile.name eq \"%s\"", strings.Join(groupNames, "\" or profile.name eq \""))
 }
 
 func jwkFromBytes(bytes []byte) (*jose.JSONWebKey, error) {

providers/okta/okta_test.go

@@ -0,0 +1,63 @@
+package okta
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestToFilterStringWithGroupNames(t *testing.T) {
+
+	tests := []struct {
+		name   string
+		input  []string
+		output string
+	}{
+		{
+			name:   "single group name",
+			input:  []string{"group1"},
+			output: "profile.name eq \"group1\"",
+		},
+		{
+			name:   "multiple group names",
+			input:  []string{"group1", "group2"},
+			output: "profile.name eq \"group1\" or profile.name eq \"group2\"",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			result := toFilterString(test.input)
+			assert.Equal(t, test.output, result, "Expected filter string does not match the result")
+		})
+	}
+}
+
+func TestBuildFilterNameBatches(t *testing.T) {
+	tests := []struct {
+		name      string
+		input     []string
+		batchSize int
+		expected  []string
+	}{
+		{
+			name:      "single batch",
+			input:     []string{"group1", "group2", "group3"},
+			batchSize: 3,
+			expected:  []string{"profile.name eq \"group1\" or profile.name eq \"group2\" or profile.name eq \"group3\""},
+		},
+		{
+			name:      "multiple batches",
+			input:     []string{"group1", "group2", "group3", "group4", "group5"},
+			batchSize: 2,
+			expected:  []string{"profile.name eq \"group1\" or profile.name eq \"group2\"", "profile.name eq \"group3\" or profile.name eq \"group4\"", "profile.name eq \"group5\""},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			result := buildFilterNameBatches(test.input, test.batchSize)
+			assert.Equal(t, test.expected, result, "Expected batches do not match the result")
+		})
+	}
+}