
    8                     b   S r SSKrSSKrSSKrSSKJr  SSKJr  SSKJr  SSKJr  SSKJ	r	  SSK
Jr  SS	KJr  SSKrSS
KJrJr  \" \" SSS5      5        SSKJr  SrSr\R,                  " SS\" \5      S.5      r " S S\R2                  5      r " S S\5      r " S S\R:                  5      rg)z!Tests for wrapped_credentials.py.    N)aws)external_account) external_account_authorized_user)identity_pool)	pluggable)testcase)WrappedCredentials)add_moveMovedModulemockzunittest.mock)r   foocontentz
text/plain200)zcontent-typestatuszcontent-lengthc                   2   ^  \ rS rSrSU 4S jjrS rSrU =r$ )MockCredentials,   c                    >^ ^ [         TT ]  " U0 UD6  S T l        UT l        S T l        U U4S jn[
        R                  " US9T l        g )Nc                     > A ATTl         g Ntoken)argskwargsselfr   s     7platform/gsutil/gslib/tests/test_wrapped_credentials.pyside_effect-MockCredentials.__init__.<locals>.side_effect4   s    
dj    r   )super__init__	_audienceexpiryr   r   Mockrefresh)r   r   r$   r   r   r   	__class__s   ``    r   r"   MockCredentials.__init__.   sA    	Gd%f%DNDKDJ 995DLr   c                      g r    r*   r   r   retrieve_subject_token&MockCredentials.retrieve_subject_token:   s    r   )r#   r$   r&   r   )NN)__name__
__module____qualname____firstlineno__r"   r+   __static_attributes____classcell__)r'   s   @r   r   r   ,   s    
6	 	r   r   c                   $    \ rS rSrSrS rS rSrg)HeadersWithAuth>   zUA utility class to use to make sure a set of headers includes specific authenticationc                 $    U=(       d    SU l         g )N r   )r   r   s     r   r"   HeadersWithAuth.__init__A   s    "DJr   c                 @    US   [        SU R                  -   S5      :H  $ )Ns   AuthorizationzBearer zutf-8)bytesr   )r   headerss     r   __eq__HeadersWithAuth.__eq__D   s#    #$i$**.Dg(NNNr   r   N)r-   r.   r/   r0   __doc__r"   r<   r1   r*   r   r   r4   r4   >   s    ]Or   r4   c                       \ rS rSrSr\R                  R                  \SSS9S 5       r	S r
S r\R                  R                  \SSS9S	 5       rS
 rS rS rS rS rSrg)TestWrappedCredentialsH   zRTest logic for interacting with Wrapped Credentials the way we intend to use them.HttpT)autospecc           
      :   [         [        4UR                  R                  l        UR                  R                  n[	        [        [        SSSSS95      n[        R                  R                  5       nUR                  U5        UR                  SS9u  pEU R                  U[        5        UR                  R                  R                  [        R                   5        UR                  SS[#        [        5      S [        R                   [        R                   S	9  g )
Nr   barhttps://sts.googleapis.comqux)r   audiencesubject_token_type	token_urlcredential_source
google.comuriGETmethodr;   bodyconnection_typeredirections)RESPONSECONTENTreturn_valuerequestr	   r   ACCESS_TOKENoauth2client	transportget_http_object	authorizeassertEqual_baser&   assert_called_once_withr   ANYr4   )r   httpreqcreds_r   s         r   testWrappedCredentialUsage1TestWrappedCredentials.testWrappedCredentialUsageK   s    .6-@D*



#
#Cl!&+0">*/		12E !!113D	OOD,/JAWg&	KK//9 ',(7(E%)04-1XX   7r   c           	         [        [        R                  " SSSSS0S95      n[        Ul        [
        R
                  " SSS	S
S
5      Ul        UR                  5       n[        R                  " U5      nU R                  US   S5        U R                  US   [        5        U R                  US   S5        U R                  US   S   S5        U R                  US   S   S5        U R                  US   S   S5        U R                  US   S   S   S5        [         R                  " U5      nU R                  U[         5        U R                  UR                  [        R                  5        U R                  UR                  S5        U R                  UR                  [        5        U R                  UR                  UR                  5        g)QTest logic for converting Wrapped Credentials to and from JSON for serialization.r   rE   rF   urlrL   )rH   rI   rJ   rK           r   	client_idaccess_tokentoken_expiry2001-12-05T00:00:00Zr_   rH   rI   rJ   rK   N)r	   r   CredentialsrY   ro   datetimerp   to_jsonjsonloadsr^   	from_jsonassertIsInstancer_   rn   )r   rd   
creds_jsonjson_valuescreds2s        r   "testWrappedCredentialSerialization9TestWrappedCredentials.testWrappedCredentialSerializatione   s   !!55:,H5:L4I	KLE
 &E!**4Q1=EJ**Z(K[-u5[0,?[02HI[)*5u=[)*>?G[)+613[)*=>uE!#  ))*5F&"45&,,(A(ABV%%u-V((,7V((%*<*<=r   c                     [         R                  " [        R                  " S[        SSSSSSSS.S	.S
.5      5      nU R                  U[         5        U R                  UR                  [        R                  5        g)zdTest logic for creating a Wrapped Credentials using keywords that exist in IdentityPool but not AWS.r   rq   r   rE   rF   rL   
1234567890)rj   workforce_pool_user_project)typerH   rI   rJ   rK   )rn   ro   rp   r_   N)	r	   rw   ru   dumpsrY   rx   r_   r   rr   r   rd   s     r   1testWrappedCredentialSerializationMissingKeywordsHTestWrappedCredentials.testWrappedCredentialSerializationMissingKeywords   su    ((

(2*!&+9'3?&		
 	E" 	%!34%++}'@'@Ar   c                   ^ [         [        4UR                  R                  l        UR                  R                  n[	        [
        R                  " SSSSSSS95      mU4S jn[        R                  " US	9TR                  l
        [        R                  R                  5       nTR                  U5        UR                  S
S9u  pEU R                  U[        5        TR                  R                  R!                  [        R"                  5        UR!                  S
S[%        [&        5      S [        R"                  [        R"                  S9  g )N^//iam.googleapis.com/locations/global/workforcePools/$WORKFORCE_POOL_ID/providers/$PROVIDER_IDrefreshToken)https://sts.googleapis.com/v1/oauth/token)https://sts.googleapis.com/v1/instrospectclientIdclientSecretrH   refresh_tokenrJ   token_info_urlrn   client_secretc                  4   > A A[         TR                  l        g r   )rY   r_   r   )r   r   rd   s     r   _refresh_token_side_effectrTestWrappedCredentials.testWrappedCredentialUsageExternalAccountAuthorizedUser.<locals>._refresh_token_side_effect   s    
&ekkr   r    rL   rM   rO   rP   )rU   rV   rW   rX   r	   r   rr   r   r%   r_   r&   rZ   r[   r\   r]   r^   r`   ra   r4   rY   )r   rb   rc   r   re   r   rd   s         @r   7testWrappedCredentialUsageExternalAccountAuthorizedUserNTestWrappedCredentials.testWrappedCredentialUsageExternalAccountAuthorizedUser   s   .6-@D*



#
#C(44l(AF (	*+E' ))0JKEKK!!113D	OOD,/JAWg&	KK//9 ',(7(E%)04-1XX   7r   c                 ~   [        [        R                  " SSSSSSS95      n[        Ul        [
        R
                  " SS	S
SS5      Ul        UR                  5       n[        R                  " U5      n0 SS_SS_SS_S[        _SS_SS_SS_SS_SS_SS_SS_S/ _SS_SS_SS_S S_S!S"S[        SSSSSSS#S$.
_nU R                  X45        [         R                  " U5      nU R                  U[         5        U R                  UR                  [        R                  5        U R                  UR                  S5        g)%ri   r   r   r   r   r   r   r   rk   rl   rm   r   _classr	   _modulezgslib.utils.wrapped_credentialsrn   ro   rp   rq   r   r   id_tokenNid_token_jwtinvalidF
revoke_uriscopestoken_info_uritoken_response	token_uri
user_agentr_   r   zgoogleapis.com)
r   rH   r   r$   rJ   r   r   rn   r   universe_domain)r	   r   rr   rY   ro   rs   rp   rt   ru   rv   r^   rw   rx   r_   rn   )r   rd   ry   rz   expected_json_valuesr{   s         r   ?testWrappedCredentialSerializationExternalAccountAuthorizedUserVTestWrappedCredentials.testWrappedCredentialSerializationExternalAccountAuthorizedUser   s   (44l(AF (	*+E &E!**4Q1=EJ**Z(K'&'4' 	Z' 		'
 	.' 	' 	' 	D' 	' 	5' 	d' 	"' 	$' 	$' 	T'  	d!'" 	2p&;; )
#'P 	[7))*5F&"45&,,:FFHV%%z2r   c                 H   [         R                  " [        R                  " SSSSSSS.SS	S
SS.05      5      nU R	                  U[         5        U R	                  UR
                  [        R                  5        U R	                  UR
                  [        R                  5        g )Nr_   i//iam.googleapis.com/projects/123456/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_IDaws1zChttp://169.254.169.254/latest/meta-data/placement/availability-zonezNhttps://sts.{region}.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15z@http://169.254.169.254/latest/meta-data/iam/security-credentials)environment_id
region_urlregional_cred_verification_urlrj   https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/service-1234@service-name.iam.gserviceaccount.com:generateAccessTokenz+urn:ietf:params:aws:token-type:aws4_request#https://sts.googleapis.com/v1/tokenr   rH   rK   !service_account_impersonation_urlrI   rJ   r   )	r	   rw   ru   r   rx   r_   r   rr   r   r   s     r   testFromJsonAWSCredentials1TestWrappedCredentials.testFromJsonAWSCredentials   s    ((

 ]hZ	& `A9&)
 	E4 	%!34%++'7'C'CD%++s7r   c                 B   [         R                  " [        R                  " SSSS0SSSSS	.05      5      nU R	                  U[         5        U R	                  UR
                  [        R                  5        U R	                  UR
                  [        R                  5        g )
Nr_   r   filez/var/run/secrets/goog.id/tokenr   $urn:ietf:params:oauth:token-type:jwtr   r   r   )	r	   rw   ru   r   rx   r_   r   rr   r   r   s     r    testFromJsonFileBasedCredentials7TestWrappedCredentials.testFromJsonFileBasedCredentials  s    ((

<& `:9&
 	E& 	%!34%++'7'C'CD%++}'@'@Ar   c                 F   [         R                  " [        R                  " SSSSS00SSSS	S
.05      5      nU R	                  U[         5        U R	                  UR
                  [        R                  5        U R	                  UR
                  [        R                  5        g )Nr_   r   
executablecommandz/path/to/command.shr   r   r   r   r   )	r	   rw   ru   r   rx   r_   r   rr   r   r   s     r    testFromJsonPluggableCredentials7TestWrappedCredentials.testFromJsonPluggableCredentials0  s    ((

 !#8#& `:9&
 	E* 	%!34%++'7'C'CD%++y'<'<=r   c                     [         R                  " [        R                  " SSSSSSSSS	.05      5      nU R	                  U[         5        U R	                  UR
                  [        R                  5        g )
Nr_   r   r   r   r   r   r   r   )r   rH   r   rJ   r   rn   r   )r	   rw   ru   r   rx   r_   r   rr   r   s     r   4testFromJsonExternalAccountAuthorizedUserCredentialsKTestWrappedCredentials.testFromJsonExternalAccountAuthorizedUserCredentialsJ  sq    ((

6t"??"
 	E( 	%!34%++:FFHr   r*   N)r-   r.   r/   r0   r>   r   patchobjecthttplib2rf   r|   r   r   r   r   r   r   r   r1   r*   r   r   r@   r@   H   s    Z::Xv57 672>8B, ::Xv5 7 6 7D=3~8>B0>4Hr   r@   )r>   rs   ru   r   google.authr   r   r   r   r   gslib.testsr   gslib.utils.wrapped_credentialsr	   rZ   sixr
   r   	six.movesr   rY   rV   ResponselenrU   rr   r   dictr4   GsUtilUnitTestCaser@   r*   r   r   <module>r      s    (     ( 8 % !   >  % VV_	5 6 
 'l 	&22 	$Od OYHX88 YHr   