added fetching groups of user if the scope includes 'api', extended and refactored tests

README.md

@@ -113,6 +113,12 @@ app.get('/auth/gitlab',
   }));
 ```
 
+##### How can I fetch the groups of the logged-in user?
+
+If the OAuth2-scope is set to `read_user api`, the user's groups are also
+requested and included in the `groups` property of the returned object.
+Groups are saved as an array of the group names represented as strings. 
+
 More information can be found in the [official GitLab documentation](https://docs.gitlab.com/ce/integration/oauth_provider.html#authorized-applications).
 
 ## Contributing

lib/strategy.js

@@ -49,6 +49,7 @@ function Strategy(options, verify) {
   OAuth2Strategy.call(this, options, verify);
   this.name = 'gitlab';
   this._profileURL = options.profileURL || url.resolve(this._baseURL, 'api/v4/user');
+  this._groupsURL = options.groupsURL || url.resolve(this._baseURL, 'api/v4/groups?min_access_level=10');
   this._oauth2.useAuthorizationHeaderforGET(true);
 }
 
@@ -65,6 +66,7 @@ util.inherits(Strategy, OAuth2Strategy);
  *   - `username`         the user's GitLab username
  *   - `displayName`      the user's full name
  *   - `emails`           the proxied or contact email address granted by the user
+ *   - `groups`           the user's groups
  *   - `avatarUrl`        the URL of the GitLab profile picture
  *   - `profileUrl`       the URL to the GitLab profile of the user
  *
@@ -105,7 +107,27 @@ Strategy.prototype.userProfile = function(accessToken, done) {
     profile._raw = body;
     profile._json = json;
 
-    done(null, profile);
+    if (self._scope.includes('api')) {
+      self._oauth2.get(self._groupsURL, accessToken, function(err, body) {
+        let jsonGroups;
+
+        if (err) {
+          return done(new InternalOAuthError('Failed to fetch groups of user', err));
+        }
+
+        try {
+          jsonGroups = JSON.parse(body);
+        } catch (ex) {
+          return done(new Error('Failed to parse groups of user'));
+        }
+
+        profile.groups = jsonGroups.map((g) => g.name);
+
+        done(null, profile);
+      });
+    } else {
+      done(null, profile);
+    }
   });
 };