
                           S SK r S SKJr  S SKrS SKrS SKrS SKrS SK	r	S SK
JrJr  S SK
Jr  S SK
Jr  S SK
Jr  S SK
Jr  S SKJr  SrS	rS
rSrSrSrSrSR5                  \5      r\\-   rSrSS/rSrSr Sr!Sr"Sr#Sr$Sr%Sr&Sr'Sr(Sr)Sr*Sr+S r,S!r-/ S"Qr./ S#Qr// S$Qr0/ S%Qr1S&S'S(S)S*.S+S,S-S.0S/.S,S+S0S1S.S2.S3.4S&S'S(S)S*.S+S4S-S.0S/.S4S+S0S1S.S2.S3.4S&S'S(S)S*.S+S5S-S.0S/.S5S+S0S1S.S2.S3.4S&S'S(S)S*.S+S6S-S.0S/.S6S+S7S1S.S2.S3.4S&S'S(S)S*.S+S8S-S.0S/.S8S+S9S1S.S2.S3.4S&S'S(S)S*.S+S:S-S.0S/.S:S+S;S1S.S2.S3.4S&S'S(S)S*.S+S<S-S.0S/.S<S+S=S1S.S2.S3.4S&S'S(S)S*.S+S>R5                  \Rd                  Rg                  S?5      5      S-S.0S/.S>R5                  \Rd                  Rg                  S?5      5      S+S@S1S.S2.S3.4S&S'S(S)S*.SASBS.SCSD.S/.SBSASES1S.SCSF.S3.4S&S'S(S)S*.SASBS.SGSH.S/.SBSASIS1S.SGSJ.S3.4S&S'S(S)S*.SASBS.SKSL.S/.SBSASMS1S.SKSN.S3.4S&S'S(S)S*.SASBSOS.SP.SQSR.SBSASSS1SOS.ST.SQSU.4S&S'S(S)S*.SASVS-S.0S/.SVSASWS1S.S2.S3.4SXSY\*\+\,SZ.S+S[S\.S[S+S]\*-   S^-   S_S`\,Sa.S3.4SXSY\*\+\,SZ.SASbS\.SbSAS]\*-   Sc-   SdS`\,Sa.S3.4SXSY\*\+S*.SASbS\.SbSAS]\*-   Se-   SdS`Sf.S3.4SXSY\*\+\,SZ.SASgShSiSj.\-SR.SgSAS]\*-   Sk-   SlS`ShSi\,Sm.\-SU.4/r4 " Sn So\55      r6 " Sp Sq\Rn                  5      r8 " Sr Ss\55      r9g)t    N)_helpersexternal_account)aws)environment_vars)
exceptions)	transport)DEFAULT_UNIVERSE_DOMAINz9gl-python/3.7 auth/1.1 auth-request-type/at cred-type/impzgl-python/3.7 auth/1.1usernamepasswordzdXNlcm5hbWU6cGFzc3dvcmQ=z1service-1234@service-name.iam.gserviceaccount.comz.https://us-east1-iamcredentials.googleapis.comz5/v1/projects/-/serviceAccounts/{}:generateAccessTokenQUOTA_PROJECT_IDscope1scope2z#https://sts.googleapis.com/v1/tokenz(https://sts.googleapis.com/v1/introspectz+urn:ietf:params:aws:token-type:aws4_requestzi//iam.googleapis.com/projects/123456/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_IDzChttp://169.254.169.254/latest/meta-data/placement/availability-zonez'http://169.254.169.254/latest/api/tokenz@http://169.254.169.254/latest/meta-data/iam/security-credentialszChttp://[fd00:ec2::254]/latest/meta-data/placement/availability-zonez'http://[fd00:ec2::254]/latest/api/tokenz@http://[fd00:ec2::254]/latest/meta-data/iam/security-credentialszNhttps://sts.{region}.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15AKIAIOSFODNN7EXAMPLEz(wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEYzAQoEXAMPLEH4aoAH0gNCAPyJxz4BlCFFxWNE1OPTgk5TthT+FvwqnKwRcOIfrRh3c/LTo6UDdyJwOOvEVPvLXCrrrUtdnniCEXAMPLE/IvU1dYUg2RVAJBanLiHb4IgRmpRV3zrkuWJOgQs8IZZaIv2BXIa2R4OlgkBN9bkUDNCJiBeb/AXlzBBko7b15fjrBs2+cTQtpZ3CYWFXG8C5zqx37wnOE49mRl/+OtkIKGO7fAEz{"KeySchema":[{"KeyType":"HASH","AttributeName":"Id"}],"TableName":"TestTable","AttributeDefinitions":[{"AttributeName":"Id","AttributeType":"S"}],"ProvisionedThroughput":{"WriteCapacityUnits":5,"ReadCapacityUnits":5}})	https://sts.googleapis.comz$https://us-east-1.sts.googleapis.comz$https://US-EAST-1.sts.googleapis.comz$https://sts.us-east-1.googleapis.comz$https://sts.US-WEST-1.googleapis.comz$https://us-east-1-sts.googleapis.comz$https://US-WEST-1-sts.googleapis.comz/https://us-west-1-sts.googleapis.com/path?queryz&https://sts-us-east-1.p.googleapis.com)%https://iamcredentials.googleapis.comzsts.googleapis.comhttps://zhttp://sts.googleapis.comzhttps://st.s.googleapis.comz$https://us-eas	-1.sts.googleapis.comz#https:/us-east-1.sts.googleapis.comz%https://US-WE/ST-1-sts.googleapis.comz$https://sts-us-east-1.googleapis.comz$https://sts-US-WEST-1.googleapis.comz(testhttps://us-east-1.sts.googleapis.comz,https://us-east-1.sts.googleapis.comevil.comz.https://us-east-1.us-east-1.sts.googleapis.comz$https://us-ea.s.t.sts.googleapis.comz"https://sts.googleapis.comevil.comz%hhttps://us-east-1.sts.googleapis.comz!https://us- -1.sts.googleapis.comzhttps://-sts.googleapis.comz-https://us-east-1.sts.googleapis.com.evil.comzhttps://sts.pgoogleapis.comhttps://p.googleapis.comzhttps://sts.p.comzhttp://sts.p.googleapis.comz https://xyz-sts.p.googleapis.comz$https://sts-xyz.123.p.googleapis.comz!https://sts-xyz.p1.googleapis.comzhttps://sts-xyz.p.foo.comz$https://sts-xyz.p.foo.googleapis.com)	r   z/https://us-east-1.iamcredentials.googleapis.comz/https://US-EAST-1.iamcredentials.googleapis.comz/https://iamcredentials.us-east-1.googleapis.comz/https://iamcredentials.US-WEST-1.googleapis.comz/https://us-east-1-iamcredentials.googleapis.comz/https://US-WEST-1-iamcredentials.googleapis.comz:https://us-west-1-iamcredentials.googleapis.com/path?queryz1https://iamcredentials-us-east-1.p.googleapis.com)r   ziamcredentials.googleapis.comr   z$http://iamcredentials.googleapis.comz&https://iamcre.dentials.googleapis.comz/https://us-eas	-1.iamcredentials.googleapis.comz.https:/us-east-1.iamcredentials.googleapis.comz0https://US-WE/ST-1-iamcredentials.googleapis.comz/https://iamcredentials-us-east-1.googleapis.comz/https://iamcredentials-US-WEST-1.googleapis.comz3testhttps://us-east-1.iamcredentials.googleapis.comz7https://us-east-1.iamcredentials.googleapis.comevil.comz9https://us-east-1.us-east-1.iamcredentials.googleapis.comz/https://us-ea.s.t.iamcredentials.googleapis.comz-https://iamcredentials.googleapis.comevil.comz0hhttps://us-east-1.iamcredentials.googleapis.comz,https://us- -1.iamcredentials.googleapis.comz&https://-iamcredentials.googleapis.comz8https://us-east-1.iamcredentials.googleapis.com.evil.comz&https://iamcredentials.pgoogleapis.comr   zhttps://iamcredentials.p.comz&http://iamcredentials.p.googleapis.comz+https://xyz-iamcredentials.p.googleapis.comz/https://iamcredentials-xyz.123.p.googleapis.comz,https://iamcredentials-xyz.p1.googleapis.comz$https://iamcredentials-xyz.p.foo.comz/https://iamcredentials-xyz.p.foo.googleapis.comz	us-east-1z2011-09-09T23:36:00ZAKIDEXAMPLEz(wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY)access_key_idsecret_access_keyGETzhttps://host.foo.comdatezMon, 09 Sep 2011 23:36:00 GMT)methodurlheaderszAWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=b27ccfbfa7df52a200ff74193ca6e32d4b48b8856fab7ebf1c595d0670a7e470zhost.foo.com)Authorizationhostr   r   r   r   z"https://host.foo.com/foo/bar/../..zhttps://host.foo.com/./zhttps://host.foo.com/./foozAWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=910e4d6c9abafaf87898e1eb4c929135782ea25bb0279703146455745391e63azhttps://host.foo.com/%E1%88%B4zAWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=8d6634c189aa8c75c2e51e106b6b5121bed103fdb351f7d7d4381c738823af74z%https://host.foo.com/?foo=Zoo&foo=ahazAWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=be7148d34ebccdc6423b19085378aa0bee970bdc61d144bd1a8c48c33079ab09z!https://host.foo.com/?foo=b&foo=azAWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=feb926e49e382bec75c9d7dcb2a1b6dc8aa50ca43c25d2bc51143768c0875acczhttps://host.foo.com/?{}=barz	%E1%88%B4zAWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=6fb359e9a05394cc7074e0feb42573a2601abc0c869a953e8c5c12e4e01f1a8cPOSTzhttps://host.foo.com/zoobar)r   ZOOzAWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host;zoo, Signature=b7a95a52518abbca0964a999a880429ab734f35ebbf1235bd79a5de87756dc4a)r   r   r   r!   ZOOBAR)r   zoozAWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host;zoo, Signature=273313af9d0c265c531e11db70bbd653f3ba074c1009239e8559d3987039cad7)r   r   r   r#   phfft)r   pzAWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host;p, Signature=debf546796015d6f6ded8626f5ce98597c33b47b9164cf6b17b4642036fcb592)r   r   r   r%   !application/x-www-form-urlencoded)Content-Typer   zfoo=bar)r   r   r   datazAWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=content-type;date;host, Signature=5a15b22cf462f047318703b92e6f4f38884e4a7ab7b1d6426ca46a8bd1c26cbc)r   r   r'   r   )r   r   r   r(   zhttps://host.foo.com/?foo=barzAWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=b6e3b79003ce0743a491606ba1035a804593b0efb1e20a11cba83f8c25a57a92	us-east-22020-08-11T06:55:22Z)r   r   security_tokenzMhttps://ec2.us-east-2.amazonaws.com?Action=DescribeRegions&Version=2013-10-15)r   r   zAWS4-HMAC-SHA256 Credential=z/20200811/us-east-2/ec2/aws4_request, SignedHeaders=host;x-amz-date;x-amz-security-token, Signature=41e226f997bf917ec6c9b2b14218df0874225f13bb153236c247881e614fafc9zec2.us-east-2.amazonaws.com20200811T065522Z)r   r   
x-amz-datex-amz-security-tokenOhttps://sts.us-east-2.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15z/20200811/us-east-2/sts/aws4_request, SignedHeaders=host;x-amz-date;x-amz-security-token, Signature=596aa990b792d763465d73703e684ca273c45536c6d322c31be01a41d02e5b60zsts.us-east-2.amazonaws.comz/20200811/us-east-2/sts/aws4_request, SignedHeaders=host;x-amz-date, Signature=9e722e5b7bfa163447e2a14df118b45ebd283c5aea72019bdf921d6e7dc01a9a)r   r   r-   z)https://dynamodb.us-east-2.amazonaws.com/zapplication/x-amz-json-1.0zDynamoDB_20120810.CreateTable)r'   x-amz-targetz/20200811/us-east-2/dynamodb/aws4_request, SignedHeaders=content-type;host;x-amz-date;x-amz-security-token;x-amz-target, Signature=eb8bce0e63654bba672d4a8acb07e72d69210c1797d56ce024dbbc31beb2a2c7z dynamodb.us-east-2.amazonaws.com)r   r   r-   r'   r0   r.   c                       \ rS rSr\R
                  R                  S\5      \R                  " S5      S 5       5       r
S rS rS rSrg	)
TestRequestSigneria  z;region, time, credentials, original_request, signed_requestgoogle.auth._helpers.utcnowc           	         [         R                   R                  US5      Ul        [        R                  " U5      n[        R
                  " UR                  S5      UR                  S5      UR                  S5      5      nUR                  UUR                  S5      UR                  S5      UR                  S5      UR                  S5      5      n	X:X  d   eg )	N%Y-%m-%dT%H:%M:%SZr   r   r+   r   r   r(   r   )datetimestrptimereturn_valuer   RequestSignerAwsSecurityCredentialsgetget_request_options)
selfutcnowregiontimecredentialsoriginal_requestsigned_requestrequest_signercredentials_objectactual_signed_requests
             Hplatform/gsutil/third_party/google-auth-library-python/tests/test_aws.pytest_get_request_options*TestRequestSigner.test_get_request_optionsb  s     '//88?ST**62 77OOO,OO/0OO,-

 !/ B B  '  *  (  +!
 %666    c                 (   [         R                  " S5      n[        R                  " [        5       nUR                  [         R                  " [        [        5      SS5        S S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)Nr)   invalidr   Invalid AWS service URL
r   r9   pytestraises
ValueErrorr<   r:   ACCESS_KEY_IDSECRET_ACCESS_KEYmatchr=   rD   excinfos      rG   0test_get_request_options_with_missing_scheme_urlBTestRequestSigner.test_get_request_options_with_missing_scheme_urlz  sk    **;7]]:&'..**=:KL ' }}78888 '&   1B
Bc                 (   [         R                  " S5      n[        R                  " [        5       nUR                  [         R                  " [        [        5      SS5        S S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)Nr)   zhttp://invalidr   rM   rN   rU   s      rG   0test_get_request_options_with_invalid_scheme_urlBTestRequestSigner.test_get_request_options_with_invalid_scheme_url  sk    **;7]]:&'..**=:KL  ' }}78888 '&rY   c                 (   [         R                  " S5      n[        R                  " [        5       nUR                  [         R                  " [        [        5      SS5        S S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)Nr)   r   r   rM   rN   rU   s      rG   2test_get_request_options_with_missing_hostname_urlDTestRequestSigner.test_get_request_options_with_missing_hostname_url  sk    **;7]]:&'..**=:KL ' }}78888 '&rY    N)__name__
__module____qualname____firstlineno__rO   markparametrizeTEST_FIXTURESmockpatchrH   rW   r[   r^   __static_attributes__r`   rJ   rG   r2   r2   a  sK    [[E} 
ZZ-.7 /7(
9
9
9rJ   r2   c                   4    \ rS rSr     SS jrS rS rSrg)"TestAwsSecurityCredentialsSupplieri  Nc                 @    Xl         X l        X0l        X@l        XPl        g N)_security_credentials_region_credentials_exception_region_exception_expected_context)r=   security_credentialsr?   credentials_exceptionregion_exceptionexpected_contexts         rG   __init__+TestAwsSecurityCredentialsSupplier.__init__  s!     &:"&;#!1!1rJ   c                     U R                   b  U R                   U:X  d   eU R                  b  U R                  eU R                  $ rn   )rs   rq   ro   r=   contextrequests      rG   get_aws_security_credentials?TestAwsSecurityCredentialsSupplier.get_aws_security_credentials  sF    !!-))W444&&2---)))rJ   c                     U R                   b  U R                   U:X  d   eU R                  b  U R                  eU R                  $ rn   )rs   rr   rp   r{   s      rG   get_aws_region1TestAwsSecurityCredentialsSupplier.get_aws_region  sD    !!-))W444!!-(((||rJ   )rq   rs   rp   rr   ro   )NNNNN)ra   rb   rc   rd   rx   r~   r   rj   r`   rJ   rG   rl   rl     s"     ""2*rJ   rl   c                   F   \ rS rSrSrSr\\\S.r	Sr
SrS\\\S.rS\\\\S	.rS
SSSSR)                  \5      S.r\  SOS j5       r\            SPS j5       r\SS\\SSSSSS4
S j5       r\ SQS j5       r\\4S j5       r\\4S j5       r \!RD                  RG                  \$RJ                  SSS9S 5       r&\!RD                  RG                  \$RJ                  SSS9S 5       r'\!RD                  RG                  \$RJ                  SSS9S 5       r(\!RD                  RG                  \$RJ                  SSS9S 5       r)\!RD                  RG                  \$RJ                  SSS9S 5       r*S r+S r,S  r-S! r.S" r/S# r0S$ r1S% r2S& r3S' r4S( r5S) r6S* r7S+ r8S, r9\!RD                  " S-5      S. 5       r:\!RD                  " S-5      \!RD                  Rw                  \<Rz                  0 5      S/ 5       5       r>\!RD                  " S-5      \!RD                  Rw                  \<Rz                  \?R                  \\?R                  \05      S0 5       5       rA\!RD                  " S-5      \!RD                  Rw                  \<Rz                  \?R                  \\?R                  \05      S1 5       5       rC\!RD                  " S-5      \!RD                  Rw                  \<Rz                  \?R                  \05      S2 5       5       rD\!RD                  " S-5      \!RD                  Rw                  \<Rz                  \?R                  \\?R                  \\?R                  \05      S3 5       5       rE\!RD                  " S-5      S4 5       rF\!RD                  " S-5      S5 5       rG\!RD                  " S-5      S6 5       rH\!RD                  " S-5      S7 5       rI\!RD                  " S-5      S8 5       rJ\!RD                  " S-5      S9 5       rK\!RD                  " S-5      S: 5       rL\!RD                  " S-5      S; 5       rMS< rNS= rOS> rPS? rQ\!RD                  " S@\RS9\!RD                  " S-5      SA 5       5       rS\!RD                  " S@\RS9\!RD                  " S-5      SB 5       5       rT\!RD                  " SC\US9\!RD                  " S@\RS9\!RD                  " S-5      SD 5       5       5       rV\!RD                  " SC\US9\!RD                  " S@\RS9\!RD                  " S-5      SE 5       5       5       rWSF rX\!RD                  " S-5      SG 5       rY\!RD                  " S-5      SH 5       rZ\!RD                  " S-5      SI 5       r[SJ r\SK r]\!RD                  " S@\RS9\!RD                  " S-5      SL 5       5       r^\!RD                  " S@\RS9\!RD                  " S-5      SM 5       5       r_SNr`g)RTestCredentialsi  r)   zgcp-aws-role)AccessKeyIdSecretAccessKeyTokenawsimdsv2sessiontokenr*   aws1)environment_id
region_urlr   regional_cred_verification_url)r   r   r   r   imdsv2_session_token_urlACCESS_TOKEN-urn:ietf:params:oauth:token-type:access_tokenBearer   )access_tokenissued_token_type
token_type
expires_inscopec                    [         R                  " U5      nUR                  XS5      nUR                  S5      UR                  S5      SUR                  S5      R                  S5      S.SUR                  S5      R                  S5      S.SUR                  S5      R                  S5      S./S	.nUR                  bA  UR                  S5      R                  S
UR                  S5      R                  S
5      S.5        UR                  S5      R                  S[        S.5      4  [        R                  R                  [        R                  " USSS95      $ )zUtility to generate serialize AWS signed requests.
This makes it easy to assert generated subject tokens based on the
provided AWS security credentials, regions and AWS STS endpoint.
r   r   r   r   r   )keyvaluer   r-   r   r.   zx-goog-cloud-target-resource),:T)
separators	sort_keys)r   r9   r<   r;   session_tokenappendAUDIENCEurllibparsequotejsondumps)clsaws_security_credentialsregion_namer   rD   rC   reformatted_signed_requests          rG   "make_serialized_aws_signed_request2TestCredentials.make_serialized_aws_signed_request  sU    **;7';;$6
 "%%e,$((2 ++//	:>>O ););I)F)J)J6)RS'+//	:>>|L
&
"  $11=&**95<<1+//	:>>?UV 	#&&y1882XF	
 	 ||!!JJ*zT
 	
rJ   Nc                    / nU(       a  U(       a@  [         R                  " [        R                  SS9nXl        Xl        UR                  U5        [         R                  " [        R                  SS9nXl        U(       a%  SR                  U5      R                  S5      Ul        UR                  U5        U(       a@  [         R                  " [        R                  SS9nXl        Xl        UR                  U5        U(       aX  [         R                  " [        R                  SS9nUUl        U(       a  UR                  S5      Ul        UR                  U5        U(       al  [         R                  " [        R                  SS9nUUl        U(       a*  [        R                  " U5      R                  S5      Ul        UR                  U5        U(       ae  [         R                  " [        R                  SS9nUUl        [        R                  " U5      R                  S5      Ul        UR                  U5        U	(       ae  [         R                  " [        R                  SS9nU	Ul        [        R                  " U
5      R                  S5      Ul        UR                  U5        [         R                  " [        R                  5      nUUl        U$ )zUtility function to generate a mock HTTP request object.
This will facilitate testing various edge cases by specify how the
various endpoints will respond while generating a Google Access token
in an AWS environment.
T)instancez{}butf-8)rh   create_autospecr   Responsestatusr(   r   formatencoder   r   Requestside_effect)r   region_statusr   role_status	role_namesecurity_credentials_statussecurity_credentials_datatoken_status
token_dataimpersonation_statusimpersonation_dataimdsv2_session_token_statusimdsv2_session_token_data	responsesimdsv2_session_responseregion_responserole_responsesecurity_credentials_responsetoken_responseimpersonation_responser}   s                        rG   make_mock_request!TestCredentials.make_mock_request  sC   * 	**.*>*>&&+' 2M./H,  !89 #2293E3EPTUO%2"',||K'@'G'G'P$_-&&*&:&:""T'# .I*+D(45 001C1CdSM#.M %.%5%5g%>"]+&,0,@,@""T-) 4O)0(59ZZ-6&/ .2 :;!11)2D2DtTN$0N!"&**Z"8"?"?"HN^,%)%9%9""T&" -A")*.**5G*H*O*OPW*X"'34&&y'8'89'rJ   c                 P    [         R                  " [        [        UUU
UUUUUUU	S9$ )N)audiencesubject_token_type	token_urltoken_info_url!service_account_impersonation_urlcredential_source!aws_security_credentials_supplier	client_idclient_secretquota_project_idscopesdefault_scopes)r   Credentialsr   SUBJECT_TOKEN_TYPE)r   r   r   r   r   r   r   r   r   r   r   s              rG   make_credentials TestCredentials.make_credentialsf  s9     1).O/.O'-)
 	
rJ   c                     US   U:X  d   eUS   U:X  d   eU(       a  US   U:X  d   eOSU;  d  US   b   eSU;  d   eg )Nr   r   r   bodyr`   )r   request_kwargsr   r   r   s        rG   "assert_aws_metadata_request_kwargs2TestCredentials.assert_aws_metadata_request_kwargs  sf     e$+++h'6111!),777N2nY6O6WWW^+++rJ   c                 P   US   U:X  d   eUS   S:X  d   eUS   U:X  d   eUS   c   e[         R                  R                  US   5      n[        U5      [        UR	                  5       5      :X  d   eU H-  u  pgUR                  S5      X6R                  S5         :X  a  M-   e   g Nr   r   r   r   r   r   )r   r   	parse_qsllenkeysdecode)r   r   r   request_datar   body_tupleskvs           rG   assert_token_request_kwargs+TestCredentials.assert_token_request_kwargs  s     e$	111h'6111i(G333f%111ll,,^F-CD;3|'8'8':#;;;;!FQ88G$XXg5F(GGGG "rJ   c                     US   U:X  d   eUS   S:X  d   eUS   U:X  d   eUS   c   e[         R                  " US   R                  S5      5      nXS:X  d   eg r   )r   loadsr   )r   r   r   r   r   	body_jsons         rG   #assert_impersonation_request_kwargs3TestCredentials.assert_impersonation_request_kwargs  sy     e$(IIIIh'6111i(G333f%111JJ~f5<<WEF	(((rJ   rx   )r8   c                    [         R                  R                  [        [        [
        [        [        SS0[        [        [        U R                  S.
5      n[        U[         R                  5      (       d   eUR                  [        [        [
        [        [        SS0[        [        U R                  S [        S [        S9  g )Ntoken_lifetime_seconds
  )
r   r   r   r   r   service_account_impersonationr   r   r   r   r   r   r   r   r   %service_account_impersonation_optionsr   r   r   r   r   workforce_pool_user_projectuniverse_domain)r   r   	from_infor   r   	TOKEN_URLTOKEN_INFO_URL!SERVICE_ACCOUNT_IMPERSONATION_URL	CLIENT_IDCLIENT_SECRETr   CREDENTIAL_SOURCE
isinstanceassert_called_once_withr	   r=   	mock_initrA   s      rG   test_from_info_full_options+TestCredentials.test_from_info_full_options  s    oo//$&8&"05V2JD1Q&!.$4%)%;%;
  +s7777))1).O3KT2R'"44.2-(,3 	* 	
rJ   c                 $   [         R                  R                  [        [        [
        U R                  S.5      n[        U[         R                  5      (       d   eUR                  [        [        [
        S S 0 S S U R                  S S S [        S9  g )Nr   r   r   r   r   )
r   r   r   r   r   r   r   r  r  r	   r  s      rG   $test_from_info_required_options_only4TestCredentials.test_from_info_required_options_only  s    oo//$&8&%)%;%;	
 +s7777))1.224"44.2!(,3 	* 	
rJ   c                    [        5       n[        R                  R                  [        [
        [        US.5      n[        U[        R                  5      (       d   eUR                  [        [
        [        S S 0 S S S US S [        S9  g )N)r   r   r   r   r   )
rl   r   r   r   r   r   r   r  r  r	   )r=   r  supplierrA   s       rG   test_from_info_supplier'TestCredentials.test_from_info_supplier  s    57oo//$&8&5=	
 +s7777))1.224".6!(,3 	* 	
rJ   c                    [         [        [        [        [        SS0[
        [        [        U R                  [        S.nUR                  S5      nUR                  [        R                  " U5      5        [        R                  R!                  [#        U5      5      n[%        U[        R                  5      (       d   eUR'                  [         [        [        [        [        SS0[
        [        U R                  S [        S [        S9  g )Nr   r   )r   r   r   r   r   r   r   r   r   r   r   config.jsonr   )r   r   r   r   r   r   r   r   r   r	   joinwriter   r   r   r   	from_filestrr  r  r=   r  tmpdirinfoconfig_filerA   s         rG   test_from_file_full_options+TestCredentials.test_from_file_full_options  s     !"4",1R.F-M"* 0!%!7!76
 kk-0$**T*+oo//K0@A +s7777))1).O3KT2R'"44.2-(,3 	* 	
rJ   c                    [         [        [        U R                  S.nUR	                  S5      nUR                  [        R                  " U5      5        [        R                  R                  [        U5      5      n[        U[        R                  5      (       d   eUR                  [         [        [        S S 0 S S U R                  S S S [        S9  g )Nr  r  r   )r   r   r   r   r  r  r   r   r   r   r  r  r  r  r	   r  s         rG   $test_from_file_required_options_only4TestCredentials.test_from_file_required_options_only1  s     !"4"!%!7!7	
 kk-0$**T*+oo//K0@A +s7777))1.224"44.2!(,3 	* 	
rJ   c                     SS0n[         R                  " [        5       nU R                  US9  S S S 5        WR	                  S5      (       d   eg ! , (       d  f       N'= f)Nunsupportedr   r   )No valid AWS 'credential_source' providedrO   rP   rQ   r   rT   r=   r   rV   s      rG   *test_constructor_invalid_credential_source:TestCredentials.test_constructor_invalid_credential_sourceO  sS    *G4]]:&'!!4E!F ' }}IJJJJ '&s   A
Ac                     [         R                  " [        5       nU R                  U R                  SS9  S S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)Ntest)r   r   z]AWS credential cannot have both a credential source and an AWS security credentials supplier.)rO   rP   rQ   r   r   rT   r=   rV   s     rG   7test_constructor_invalid_credential_source_and_supplierGTestCredentials.test_constructor_invalid_credential_source_and_supplierX  s]    ]]:&'!!"&"8"828 "  ' }}l
 
 	
 
 '&s   A
A%c                     [         R                  " [        5       nU R                  5         S S S 5        WR	                  S5      (       d   eg ! , (       d  f       N'= f)NzPA valid credential source or AWS security credentials supplier must be provided.r"  r(  s     rG   9test_constructor_invalid_no_credential_source_or_supplierITestCredentials.test_constructor_invalid_no_credential_source_or_supplierd  sJ    ]]:&'!!# ' }}_
 
 	
 
 '&s   A
Ac                     U R                   R                  5       nSUS'   [        R                  " [        5       nU R                  US9  S S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)Nazure1r   r   r!  r   copyrO   rP   rQ   r   rT   r#  s      rG   'test_constructor_invalid_environment_id7TestCredentials.test_constructor_invalid_environment_idm  si     22779.6*+]]:&'!!4E!F ' }}IJJJJ '&   A++
A9c                    U R                   R                  5       nUR                  S5        [        R                  " [
        5       nU R                  US9  S S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)Nr   r   r!  )r   r1  poprO   rP   rQ   r   rT   r#  s      rG   .test_constructor_missing_cred_verification_url>TestCredentials.test_constructor_missing_cred_verification_urlw  sl     22779>?]]:&'!!4E!F ' }}IJJJJ '&s   A77
Bc                     U R                   R                  5       nSUS'   [        R                  " [        5       nU R                  US9  S S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)Naws3r   r   z6aws version '3' is not supported in the current build.r0  r#  s      rG   /test_constructor_invalid_environment_id_version?TestCredentials.test_constructor_invalid_environment_id_version  si     22779.4*+]]:&'!!4E!F ' }}VWWWW '&r4  c           	          U R                  U R                  R                  5       S9nUR                  S[        [
        [        [        U R                  [        S.:X  d   eg )Nr   r   )typer   r   r   r   r   r   )	r   r   r1  r  r   r   r   r   r	   r=   rA   s     rG   	test_infoTestCredentials.test_info  sc    ++"4499; , 
 & "4",!%!7!76$
 
 	
 
rJ   c                 ~    U R                  U R                  R                  5       S9nUR                  [        :X  d   eg )Nr   )r   r   r1  r   r   r?  s     rG   test_token_info_url#TestCredentials.test_token_info_url  s?    ++"4499; , 
 ))^;;;rJ   c                     [          HC  nU R                  U R                  R                  5       US-   S9nUR                  US-   :X  a  MC   e   g )Nz/introspectr   r   )VALID_TOKEN_URLSr   r   r1  r   r=   r   rA   s      rG   test_token_info_url_custom*TestCredentials.test_token_info_url_custom  sV    #C//"&"8"8"="="? #m 3 0 K
 --#2EFFF $rJ   c                 z    U R                  U R                  R                  5       S S9nUR                  (       a   eg )NrF  )r   r   r1  r   r?  s     rG   test_token_info_url_negative,TestCredentials.test_token_info_url_negative  s?    ++"4499;D , 
 -----rJ   c                     [          HC  nU R                  U R                  R                  5       US-   S9nUR                  US-   :X  a  MC   e   g )Nz/token)r   r   )rG  r   r   r1  
_token_urlrH  s      rG   test_token_url_custom%TestCredentials.test_token_url_custom  sT    #C//"&"8"8"="="?> 0 K
 ))cHn=== $rJ   c                     [          HK  nU R                  U R                  R                  5       U[        -   S9nUR
                  U[        -   :X  a  MK   e   g )N)r   r   )(VALID_SERVICE_ACCOUNT_IMPERSONATION_URLSr   r   r1  'SERVICE_ACCOUNT_IMPERSONATION_URL_ROUTE"_service_account_impersonation_urlrH  s      rG   -test_service_account_impersonation_url_custom=TestCredentials.test_service_account_impersonation_url_custom  s_    ;C//"&"8"8"="="?AA 0 K AA==   <rJ   c                     [         R                  " [        [        U R                  R                  5       S9nUR                  S[        [        [        U R                  R                  5       [        S.:X  d   eg )N)r   r   r   r   r>  r   r   r   r   r   )	r   r   r   r   r   r1  r  r   r	   r?  s     rG    test_info_with_default_token_url0TestCredentials.test_info_with_default_token_url  sh    oo1"4499;
 & "4"!%!7!7!<!<!>6$
 
 	
 
rJ   c                     [         R                  " [        [        U R                  R                  5       SS9nUR                  S[        [        SU R                  R                  5       SS.:X  d   eg )Nztestdomain.org)r   r   r   r   r   z#https://sts.testdomain.org/v1/tokenrY  )r   r   r   r   r   r1  r  r?  s     rG   5test_info_with_default_token_url_with_universe_domainETestCredentials.test_info_with_default_token_url_with_universe_domain  sk    oo1"4499;,	
 & "4>!%!7!7!<!<!>/$
 
 	
 
rJ   c                 F   U R                   R                  5       nUR                  S5        U R                  US9n[        R
                  " [        R                  5       nUR                  S 5        S S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)Nr   r   zUnable to determine AWS region)
r   r1  r6  r   rO   rP   r   RefreshErrorretrieve_subject_tokenrT   )r=   r   rA   rV   s       rG   .test_retrieve_subject_token_missing_region_url>TestCredentials.test_retrieve_subject_token_missing_region_url  s     !22779l+++>O+P]]:223w..t4 4 }}>???? 43s   B
B r3   c           	         [         R                   R                  U R                  S5      Ul        U R	                  [
        R                  U R                  [
        R                  U R                  [
        R                  U R                  S9nU R                  U R                  S9nUR                  U5      nX@R                  [        R                  " [         ["        [$        5      5      :X  d   eU R'                  UR(                  S   S   [*        5        U R'                  UR(                  S   S   [,        5        U R'                  UR(                  S   S   SR/                  [,        U R                  5      SS	05        U R	                  [
        R                  U R                  [
        R                  U R                  S
9nUR                  U5        [1        UR(                  5      S:X  d   eU R'                  UR(                  S   S   [,        5        U R'                  UR(                  S   S   SR/                  [,        U R                  5      SS	05        g )Nr5   r   r   r   r   r   r   r   r         {}/{}r'   application/json)r   r   r   r   )r6   r7   AWS_SIGNATURE_TIMEr8   r   http_clientOK
AWS_REGIONAWS_ROLE!AWS_SECURITY_CREDENTIALS_RESPONSEr   r   ra  r   r   r:   rR   rS   TOKENr   call_args_list
REGION_URLSECURITY_CREDS_URLr   r   )r=   r>   r}   rA   subject_tokennew_requests         rG   Btest_retrieve_subject_token_success_temp_creds_no_environment_varsRTestCredentials.test_retrieve_subject_token_success_temp_creds_no_environment_vars  s    '//88##%9
 ((%..#mm(3&*&L&L ) 
 ++d>T>T+U#::7C G G&&}6GO!
 
 	
 
 	//""1%a(*	
 	//""1%a(*<	
 	//""1%a(NN-t}}=/0	
 ,,#mm(3&*&L&L	 - 
 	**;7 ;--.!333//&&q)!,.@	
 	//&&q)!,NN-t}}=/0	
rJ   c                    [         R                   R                  U R                  S5      Ul        U R	                  [
        R                  U R                  [
        R                  U R                  [
        R                  U R                  [
        R                  U R                  S9nU R                  R                  5       n[        US'   U R                  US9nUR                  U5      nXPR!                  ["        R$                  " [&        [(        [*        5      5      :X  d   eU R-                  UR.                  S   S   [        SS0S	5        U R-                  UR.                  S   S   [0        S
U R                  05        U R-                  UR.                  S   S   [        SS0S	5        U R-                  UR.                  S   S   [2        S
U R                  05        U R-                  UR.                  S   S   SR5                  [2        U R                  5      SU R                  S.5        U R	                  [
        R                  U R                  [
        R                  U R                  [
        R                  U R                  S9nUR                  U5        [7        UR.                  5      S:X  d   eU R-                  UR.                  S   S   [        SS0S	5        U R-                  UR.                  S   S   [2        S
U R                  05        U R-                  UR.                  S   S   SR5                  [2        U R                  5      SU R                  S.5        g )Nr5   r   r   r   r   r   r   r   r   r   r   r   rf  $X-aws-ec2-metadata-token-ttl-seconds300PUTX-aws-ec2-metadata-tokenrg        rh  ri  r'   r}  r   r   r   r   r   r   )r6   r7   rj  r8   r   rk  rl  rm  rn  ro  AWS_IMDSV2_SESSION_TOKENr   r1  IMDSV2_SESSION_TOKEN_URLr   ra  r   r   r:   rR   rS   rp  r   rq  rr  rs  r   r   )r=   r>   r}   credential_source_token_urlrA   rt  ru  s          rG   Itest_retrieve_subject_token_success_temp_creds_no_environment_vars_idmsv2YTestCredentials.test_retrieve_subject_token_success_temp_creds_no_environment_vars_idmsv20  s,   
 '//88##%9
 ((%..#mm(3&*&L&L(3&*&C&C ) 	
 '+&<&<&A&A&C# % 	$&	
 ++9 , 
 $::7C G G&&}6GO!
 
 	
 
 	//""1%a($3U;		
 	//""1%a(')F)FG	
 	//""1%a($3U;		
 	//""1%a(')F)FG	
 	//""1%a(NN-t}}= 2,0,I,I	
 ,,#mm(3&*&L&L(3&*&C&C - 
 	**;7 ;--.!333//""1%a($3U;		
 	//&&q)!,')F)FG	
 	//&&q)!,NN-t}}= 2,0,I,I	
rJ   c           	      f   [         R                   R                  U R                  S5      Ul        U R	                  [
        R                  U R                  [
        R                  U R                  [
        R                  U R                  S9nU R                  R                  5       n[        US'   U R                  US9nUR                  U5      nXPR                  [         R"                  " [$        [&        [(        5      5      :X  d   eU R+                  UR,                  S   S   [        SS0S	5        U R+                  UR,                  S   S   [.        S
U R                  05        U R+                  UR,                  S   S   SR1                  [.        U R                  5      SU R                  S.5        g Nr5   r  r   r   r   rf  rz  r{  r|  r}  rg  rh  ri  r  r6   r7   rj  r8   r   rk  rl  rn  ro  r  r   r1  r  r   ra  r   r   r:   rR   rS   rp  r   rq  rs  r   r=   r>   r}   r  rA   rt  s         rG   `test_retrieve_subject_token_success_temp_creds_environment_vars_missing_secret_access_key_idmsv2pTestCredentials.test_retrieve_subject_token_success_temp_creds_environment_vars_missing_secret_access_key_idmsv2      '//88##%9
 ((#mm(3&*&L&L(3&*&C&C ) 
 '+&<&<&A&A&C# % 	$&	
 ++9 , 
 $::7C G G&&}6GO!
 
 	
 
 	//""1%a($3U;		
 	//""1%a(')F)FG	
 	//""1%a(NN-t}}= 2,0,I,I	
rJ   c           	      f   [         R                   R                  U R                  S5      Ul        U R	                  [
        R                  U R                  [
        R                  U R                  [
        R                  U R                  S9nU R                  R                  5       n[        US'   U R                  US9nUR                  U5      nXPR                  [         R"                  " [$        [&        [(        5      5      :X  d   eU R+                  UR,                  S   S   [        SS0S	5        U R+                  UR,                  S   S   [.        S
U R                  05        U R+                  UR,                  S   S   SR1                  [.        U R                  5      SU R                  S.5        g r  r  r  s         rG   \test_retrieve_subject_token_success_temp_creds_environment_vars_missing_access_key_id_idmsv2lTestCredentials.test_retrieve_subject_token_success_temp_creds_environment_vars_missing_access_key_id_idmsv2  r  rJ   c           	      f   [         R                   R                  U R                  S5      Ul        U R	                  [
        R                  U R                  [
        R                  U R                  [
        R                  U R                  S9nU R                  R                  5       n[        US'   U R                  US9nUR                  U5      nXPR                  [         R"                  " [$        [&        [(        5      5      :X  d   eU R+                  UR,                  S   S   [        SS0S	5        U R+                  UR,                  S   S   [.        S
U R                  05        U R+                  UR,                  S   S   SR1                  [.        U R                  5      SU R                  S.5        g r  r  r  s         rG   Ttest_retrieve_subject_token_success_temp_creds_environment_vars_missing_creds_idmsv2dTestCredentials.test_retrieve_subject_token_success_temp_creds_environment_vars_missing_creds_idmsv2
  s   
 '//88##%9
 ((#mm(3&*&L&L(3&*&C&C ) 
 '+&<&<&A&A&C# % 	$&	
 ++9 , 
 $::7C G G&&}6GO!
 
 	
 
 	//""1%a($3U;		
 	//""1%a(')F)FG	
 	//""1%a(NN-t}}= 2,0,I,I	
rJ   c                 ^   [         R                   R                  U R                  S5      Ul        U R	                  [
        R                  U R                  S9nU R                  R                  5       n[        US'   U R                  US9nUR                  U5        UR                  (       a   eg )Nr5   )r   r   r   r   )r6   r7   rj  r8   r   rk  rl  rn  r   r1  r  r   ra  called)r=   r>   r}   r  rA   s        rG   5test_retrieve_subject_token_success_temp_creds_idmsv2ETestCredentials.test_retrieve_subject_token_success_temp_creds_idmsv2=  s     '//88##%9
 ((#$-- ) 
 '+&<&<&A&A&C# % 	$&	
 ++9 , 
 	**73>>!!>rJ   c                 B   [         R                   R                  U R                  S5      Ul        U R	                  [
        R                  U R                  [
        R                  U R                  [
        R                  U R                  [
        R                  U R                  S9nU R                  R                  5       nU R                  US9nUR                  U5      nXPR                  [         R"                  " [$        [&        [(        5      5      :X  d   eU R+                  UR,                  S   S   [.        SS0S5        U R+                  UR,                  S   S   [0        S	U R                  05        U R+                  UR,                  S
   S   [.        SS0S5        U R+                  UR,                  S   S   [2        S	U R                  05        U R+                  UR,                  S   S   SR5                  [2        U R                  5      SU R                  S.5        g )Nr5   ry  r   r   rf  rz  r{  r|  r}  rg  r~  r  rh  ri  r  )r6   r7   rj  r8   r   rk  rl  rm  rn  ro  r  CREDENTIAL_SOURCE_IPV6r1  r   ra  r   r   r:   rR   rS   rp  r   rq  IMDSV2_SESSION_TOKEN_URL_IPV6REGION_URL_IPV6SECURITY_CREDS_URL_IPV6r   r  s         rG   (test_retrieve_subject_token_success_ipv68TestCredentials.test_retrieve_subject_token_success_ipv6X  s   &//88##%9
 ((%..#mm(3&*&L&L(3&*&C&C ) 	
 '+&A&A&F&F&H#++9 , 
 $::7C G G&&}6GO!
 
 	
 
 	//""1%a()3U;		
 	//""1%a(')F)FG	
 	//""1%a()3U;		
 	//""1%a(#')F)FG	
 	//""1%a(NN2DMMB 2,0,I,I	
rJ   c                 $   [         R                   R                  U R                  S5      Ul        U R	                  [
        R                  SS9nU R                  R                  5       n[        US'   U R                  US9n[        R                  " [        R                  5       nUR                  U5        S S S 5        WR!                  S5      (       d   eU R#                  UR$                  S   S   [        S	S
0S5        g ! , (       d  f       NQ= f)Nr5   unauthorized)r   r   r   r   z$Unable to retrieve AWS Session Tokenr   rf  rz  r{  r|  )r6   r7   rj  r8   r   rk  UNAUTHORIZEDr   r1  r  r   rO   rP   r   r`  ra  rT   r   rq  )r=   r>   r}   r  rA   rV   s         rG   0test_retrieve_subject_token_session_error_idmsv2@TestCredentials.test_retrieve_subject_token_session_error_idmsv2  s   &//88##%9
 (((3(@(@&4 ) 
 '+&<&<&A&A&C# % 	$&	
 ++9 , 
 ]]:223w..w7 4 }}DEEEE 	//""1%a($3U;		
 43s   $D
Dc           	         U R                   R                  5       nUR                  S5        [        R                  R	                  U R
                  S5      Ul        U R                  [        R                  U R                  [        R                  U R                  [        R                  US9nU R                  U R                  S9nUR                  U5      nXPR                  [         R"                  " [$        [&        5      5      :X  d   eg )Nr   r5   re  r   )ro  r1  r6  r6   r7   rj  r8   r   rk  rl  rm  rn  r   r   ra  r   r   r:   rR   rS   )r=   r>   security_creds_responser}   rA   rt  s         rG   Gtest_retrieve_subject_token_success_permanent_creds_no_environment_varsWTestCredentials.test_retrieve_subject_token_success_permanent_creds_no_environment_vars  s     #'"H"H"M"M"O##G,&//88##%9
 ((%..#mm(3&= ) 
 ++d>T>T+U#::7C G G&&}6GH!
 
 	
 
rJ   c                 R   UR                  [        R                  [        5        UR                  [        R                  [
        5        UR                  [        R                  [        5        UR                  [        R                  U R                  5        [        R                  R                  U R                  S5      Ul        U R                  U R                  S9nUR                  S 5      nX@R!                  ["        R$                  " [        [
        [        5      5      :X  d   eg Nr5   r   )setenvr   AWS_ACCESS_KEY_IDrR   AWS_SECRET_ACCESS_KEYrS   AWS_SESSION_TOKENrp  rm  r6   r7   rj  r8   r   r   ra  r   r   r:   r=   r>   monkeypatchrA   rt  s        rG   4test_retrieve_subject_token_success_environment_varsDTestCredentials.test_retrieve_subject_token_success_environment_vars  s    +==}M+AACTU+==uE+66H&//88##%9
 ++d>T>T+U#::4@ G G&&}6GO!
 
 	
 
rJ   c                 R   UR                  [        R                  [        5        UR                  [        R                  [
        5        UR                  [        R                  [        5        UR                  [        R                  U R                  5        [        R                  R                  U R                  S5      Ul        U R                  U R                  S9nUR!                  S 5      nX@R#                  [$        R&                  " [        [
        [        5      5      :X  d   eg r  r  r   r  rR   r  rS   r  rp  AWS_DEFAULT_REGIONrm  r6   r7   rj  r8   r   r   ra  r   r   r:   r  s        rG   Htest_retrieve_subject_token_success_environment_vars_with_default_regionXTestCredentials.test_retrieve_subject_token_success_environment_vars_with_default_region  s     	+==}M+AACTU+==uE+>>P&//88##%9
 ++d>T>T+U#::4@ G G&&}6GO!
 
 	
 
rJ   c                    UR                  [        R                  [        5        UR                  [        R                  [
        5        UR                  [        R                  [        5        UR                  [        R                  S5        UR                  [        R                  U R                  5        [        R                  R                  U R                  S5      Ul        U R                  U R                  S9nUR!                  S 5      nX@R#                  [$        R&                  " [        [
        [        5      5      :X  d   eg )NzMalformed AWS Regionr5   r   r  r  s        rG   Jtest_retrieve_subject_token_success_environment_vars_with_both_regions_setZTestCredentials.test_retrieve_subject_token_success_environment_vars_with_both_regions_set  s     	+==}M+AACTU+==uE+>>@VW 	+66H&//88##%9
 ++d>T>T+U#::4@ G G&&}6GO!
 
 	
 
rJ   c                     UR                  [        R                  [        5        UR                  [        R                  [
        5        UR                  [        R                  U R                  5        [        R                  R                  U R                  S5      Ul
        U R                  U R                  S9nUR                  S 5      nX@R                  [        R                   " [        [
        5      5      :X  d   eg r  )r  r   r  rR   r  rS   rm  r6   r7   rj  r8   r   r   ra  r   r   r:   r  s        rG   Etest_retrieve_subject_token_success_environment_vars_no_session_tokenUTestCredentials.test_retrieve_subject_token_success_environment_vars_no_session_token	  s     	+==}M+AACTU+66H&//88##%9
 ++d>T>T+U#::4@ G G&&}6GH!
 
 	
 
rJ   c                 N   UR                  [        R                  [        5        UR                  [        R                  [
        5        UR                  [        R                  [        5        [        R                  R                  U R                  S5      Ul        U R                  [        R                  U R                  S9nU R!                  U R"                  S9nUR%                  U5      nXPR'                  [(        R*                  " [        [
        [        5      5      :X  d   eg )Nr5   r   r   r   )r  r   r  rR   r  rS   r  rp  r6   r7   rj  r8   r   rk  rl  rm  r   r   ra  r   r   r:   )r=   r>   r  r}   rA   rt  s         rG   Btest_retrieve_subject_token_success_environment_vars_except_regionRTestCredentials.test_retrieve_subject_token_success_environment_vars_except_region  s     	+==}M+AACTU+==uE&//88##%9
 ((%..doo ) 
 ++d>T>T+U#::7C G G&&}6GO!
 
 	
 
rJ   c                 >   U R                  [        R                  S9nU R                  U R                  S9n[
        R                  " [        R                  5       nUR                  U5        S S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= fN)r   r   zUnable to retrieve AWS region)r   rk  BAD_REQUESTr   r   rO   rP   r   r`  ra  rT   r=   r}   rA   rV   s       rG   8test_retrieve_subject_token_error_determining_aws_regionHTestCredentials.test_retrieve_subject_token_error_determining_aws_region1  s|    (({7N7N(O++d>T>T+U]]:223w..w7 4 }}=>>>> 43   B
Bc                 r   U R                  [        R                  U R                  [        R                  S9nU R                  U R                  S9n[        R                  " [        R                  5       nUR                  U5        S S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)N)r   r   r   r   z Unable to retrieve AWS role name)r   rk  rl  rm  r  r   r   rO   rP   r   r`  ra  rT   r  s       rG   6test_retrieve_subject_token_error_determining_aws_roleFTestCredentials.test_retrieve_subject_token_error_determining_aws_role;  s    ((%..#// ) 

 ++d>T>T+U]]:223w..w7 4 }}@AAAA 43s   5B((
B6c                    U R                   R                  5       nUR                  S5        U R                  [        R
                  U R                  S9nU R                  US9n[        R                  " [        R                  5       nUR                  U5        S S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)Nr   r  r   zIUnable to determine the AWS metadata server security credentials endpoint)r   r1  r6  r   rk  rl  rm  r   rO   rP   r   r`  ra  rT   )r=   r   r}   rA   rV   s        rG   @test_retrieve_subject_token_error_determining_security_creds_urlPTestCredentials.test_retrieve_subject_token_error_determining_security_creds_urlI  s     !22779e$((%..doo ) 
 ++>O+P]]:223w..w7 4 }}X
 
 	
 
 43s   B::
Cc                    U R                  [        R                  U R                  [        R                  U R                  [        R
                  S9nU R                  U R                  S9n[        R                  " [        R                  5       nUR                  U5        S S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)N)r   r   r   r   r   r   z+Unable to retrieve AWS security credentials)r   rk  rl  rm  rn  r  r   r   rO   rP   r   r`  ra  rT   r  s       rG   @test_retrieve_subject_token_error_determining_aws_security_credsPTestCredentials.test_retrieve_subject_token_error_determining_aws_security_credsZ  s    ((%..#mm(3(?(? ) 
 ++d>T>T+U]]:223w..w7 4 }}KLLLL 43s   C
Cz/google.auth.metrics.python_and_auth_lib_versionc                    [         R                   R                  U R                  S5      Ul        U R	                  [
        R                  " [        [        [        5      5      nSS[        -   SS.nS[        SSR                  [        5      U[        S	.nU R                  [         R"                  U R$                  [         R"                  U R&                  [         R"                  U R(                  [         R"                  U R*                  S
9nU R-                  [.        [0        U R2                  [4        [        S/S9nUR7                  U5        [9        UR:                  5      S:X  d   eU R=                  UR:                  S   S   XE5        UR>                  U R*                  S   :X  d   eUR@                  [4        :X  d   eURB                  [        :X  d   eURD                  S/:X  d   eg )Nr5   r&   Basic _gl-python/3.7 auth/1.1 google-byoid-sdk sa-impersonation/false config-lifetime/false source/awsr'   r   x-goog-api-client/urn:ietf:params:oauth:grant-type:token-exchanger   r   
grant_typer   requested_token_typer   rt  r   r   r   r   r   r   r   r   r   ignoredr   r   r   r   r   r   r  r~  rf  r   #r6   r7   rj  r8   r   r   r:   rR   rS   rp  BASIC_AUTH_ENCODINGr   r  SCOPESr   r   rk  rl  rm  rn  ro  SUCCESS_RESPONSEr   r   r   r   r   refreshr   rq  r   tokenr   r   r   r=   r>   mock_auth_lib_valueexpected_subject_tokentoken_headerstoken_request_datar}   rA   s           rG   @test_refresh_success_without_impersonation_ignore_default_scopesPTestCredentials.test_refresh_success_without_impersonation_ignore_default_scopesj  s    '//88##%9
 "&!H!H&&}6GO"
 @%(;; "C
 L $SXXf%3"4
 ((%..#mm(3&*&L&L$,, ) 	
 ++'"44-%; , 
 	G$7))*a///((""1%a(-	
   D$9$9.$IIII++/????!!V+++))i[888rJ   c                    [         R                   R                  U R                  S5      Ul        U R	                  [
        R                  " [        [        [        5      5      nSS[        -   SS.nS[        SSR                  [        5      U[        S	.nU R                  [         R"                  U R$                  [         R"                  U R&                  [         R"                  U R(                  [         R"                  U R*                  S
9nU R-                  [.        [0        U R2                  [4        S [        S9nUR7                  U5        [9        UR:                  5      S:X  d   eU R=                  UR:                  S   S   XE5        UR>                  U R*                  S   :X  d   eUR@                  [4        :X  d   eURB                  b   eURD                  [        :X  d   eg )Nr5   r&   r  r  r  r  r   r   r  r  r  r  r~  rf  r   r  r  s           rG   =test_refresh_success_without_impersonation_use_default_scopesMTestCredentials.test_refresh_success_without_impersonation_use_default_scopes  s    '//88##%9
 "&!H!H&&}6GO"
 @%(;; "C
 L $SXXf%3"4
 ((%..#mm(3&*&L&L$,, ) 	
 ++'"44-! , 
 	G$7))*a///((""1%a(-	
   D$9$9.$IIII++/????!!)))))V333rJ   z:google.auth.metrics.token_request_access_token_impersonatec                 
   [         R                   R                  U R                  S5      Ul        [        R
                  " 5       R                  SS9[         R                  " SS9-   R                  S5      S-   nU R                  [        R                  " [        [        [        5      5      nSS	[        -   S
S.nS[         SSU["        S.nSUS.nSSR%                  U R&                  S   5      [(        [*        SS.n	S [,        SS.n
U R/                  [0        R2                  U R4                  [0        R2                  U R6                  [0        R2                  U R8                  [0        R2                  U R&                  [0        R2                  US9
nU R;                  [<        [>        U R@                  [B        [(        [,        S/S9nURE                  U5        [G        URH                  5      S:X  d   eU RK                  URH                  S   S   Xg5        U RM                  URH                  S   S   U	U
5        URN                  US    :X  d   eURP                  [(        :X  d   eURR                  [,        :X  d   eURT                  S/:X  d   eg )!Nr5   r   microsecondr   secondsTZr&   r  ^gl-python/3.7 auth/1.1 google-byoid-sdk sa-impersonation/true config-lifetime/false source/awsr  r  r   #https://www.googleapis.com/auth/iamr  SA_ACCESS_TOKENaccessToken
expireTimeri  	Bearer {}r   0x0r'   authorizationzx-goog-user-projectr  zx-allowed-locations3600s	delegatesr   lifetime
r   r   r   r   r   r   r   r   r   r   r  r   r   r   r   r   r   r      r~  rf  r  r  +r6   r7   rj  r8   r   r>   replace	timedelta	isoformatr   r   r:   rR   rS   rp  r  r   r   r   r  r   5IMPERSONATE_ACCESS_TOKEN_REQUEST_METRICS_HEADER_VALUEr  r   rk  rl  rm  rn  ro  r   r   r   r   r   r  r   rq  r   r   r  r   r   r   r=   r>   mock_metrics_header_valuer  expire_timer  r  r  r   impersonation_headersimpersonation_request_datar}   rA   s                rG   =test_refresh_success_with_impersonation_ignore_default_scopesMTestCredentials.test_refresh_success_with_impersonation_ignore_default_scopes  sx    '//88##%9
 OO%%!%4x7I7IRV7WW
)C.3 "&!H!H&&}6GO"
 @%(;; "B
 L $S:3"4
 -%"

 /(//0E0En0UV#3!V#(!
 &
"
 ((%..#mm(3&*&L&L$,,!,5 ) 
 ++'"44.O-%; , 	
 	G$7))*a///((""1%a(-	

 	00""1%a(!&	

   $:=$IIII++/????!!V+++))i[888rJ   c                     [         R                   R                  U R                  S5      Ul        [        R
                  " 5       R                  SS9[         R                  " SS9-   R                  S5      S-   nU R                  [        R                  " [        [        [        5      5      nSS	[        -   S
S.nS[         SSU["        S.nSUS.nSSR%                  U R&                  S   5      [(        [*        SS.n	S [,        SS.n
U R/                  [0        R2                  U R4                  [0        R2                  U R6                  [0        R2                  U R8                  [0        R2                  U R&                  [0        R2                  US9
nU R;                  [<        [>        U R@                  [B        [(        S [,        S9nURE                  U5        [G        URH                  5      S:X  d   eU RK                  URH                  S   S   Xg5        U RM                  URH                  S   S   U	U
5        URN                  US   :X  d   eURP                  [(        :X  d   eURR                  b   eURT                  [,        :X  d   eg ) Nr5   r   r  r   r  r  r  r&   r  r  r  r  r   r  r  r  r  ri  r  r   r  r  r  r  r  r  r  r~  rf  r  r  r  r
  s                rG   :test_refresh_success_with_impersonation_use_default_scopesJTestCredentials.test_refresh_success_with_impersonation_use_default_scopes=  sr    '//88##%9
 OO%%!%4x7I7IRV7WW
)C.3 "&!H!H&&}6GO"
 @%(;; "B
 L $S:3"4
 -%"

 /(//0E0En0UV#3!V#(!
 &
"
 ((%..#mm(3&*&L&L$,,!,5 ) 
 ++'"44.O-! , 	
 	G$7))*a///((""1%a(-	

 	00""1%a(!&	

   $:=$IIII++/????!!)))))V333rJ   c                 >   U R                  [        R                  S9nU R                  U R                  S9n[
        R                  " [        R                  5       nUR                  U5        S S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= fr  )r   rk  r  r   r   rO   rP   r   r`  r  rT   r  s       rG   .test_refresh_with_retrieve_subject_token_error>TestCredentials.test_refresh_with_retrieve_subject_token_error  s|    (({7N7N(O++d>T>T+U]]:223w( 4 }}=>>>> 43r  c                    [         R                   R                  U R                  S5      Ul        U R	                  5       n[
        R                  " [        [        5      n[        X0R                  S9nU R                  US9nUR                  U5      nX`R                  [
        R                  " [        [        5      5      :X  d   eg Nr5   rt   r?   r   )r6   r7   rj  r8   r   r   r:   rR   rS   rl   rm  r   ra  r   r=   r>   r}   rt   r  rA   rt  s          rG   1test_retrieve_subject_token_success_with_supplierATestCredentials.test_retrieve_subject_token_success_with_supplier  s    &//88##%9
 ((*"99, 
 6!5oo
 ++h+W#::7C G G&&}6GH!
 
 	
 
rJ   c                    [         R                   R                  U R                  S5      Ul        U R	                  5       n[
        R                  " [        [        [        5      n[        X0R                  S9nU R                  US9nUR                  U5      nX`R                  [
        R                  " [        [        [        5      5      :X  d   eg r  )r6   r7   rj  r8   r   r   r:   rR   rS   rp  rl   rm  r   ra  r   r  s          rG   ?test_retrieve_subject_token_success_with_supplier_session_tokenOTestCredentials.test_retrieve_subject_token_success_with_supplier_session_token  s    &//88##%9
 ((*"99,e 
 6!5oo
 ++h+W#::7C G G&&}6GO!
 
 	
 
rJ   c                 h   [         R                   R                  U R                  S5      Ul        U R	                  5       n[
        R                  " [        [        5      n[        R                  " [        [        5      n[        UU R                  US9nU R                  US9nUR!                  U5        g )Nr5   )rt   r?   rw   r  )r6   r7   rj  r8   r   r   SupplierContextr   r   r   r:   rR   rS   rl   rm  r   ra  )r=   r>   r}   rw   rt   r  rA   s          rG   Atest_retrieve_subject_token_success_with_supplier_correct_contextQTestCredentials.test_retrieve_subject_token_success_with_supplier_correct_context  s    &//88##%9
 ((*+;;
  #99, 
 6!5??-
 ++h+W**73rJ   c                 d   U R                  5       n[        R                  " S5      n[        U R                  US9nU R                  US9n[        R                  " [        R                  5       nUR                  U5        S S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)N
Test error)r?   ru   r  )
r   r   r`  rl   rm  r   rO   rP   r  rT   )r=   r}   expected_exceptionr  rA   rV   s         rG   /test_retrieve_subject_token_error_with_supplier?TestCredentials.test_retrieve_subject_token_error_with_supplier  s    ((*'44\B5??:L
 ++h+W]]:223w( 4 }}]++++ 43s   .B!!
B/c                    U R                  5       n[        R                  " S5      n[        R                  " [
        [        5      n[        UUS9nU R                  US9n[        R                  " [        R                  5       nUR                  U5        S S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)Nr&  )rt   rv   r  )r   r   r`  r   r:   rR   rS   rl   r   rO   rP   r  rT   )r=   r}   r'  rt   r  rA   rV   s          rG   6test_retrieve_subject_token_error_with_supplier_regionFTestCredentials.test_retrieve_subject_token_error_with_supplier_region  s    ((*'44\B"99, 
 6!5/

 ++h+W]]:223w( 4 }}]++++ 43s   B66
Cc           
         [         R                   R                  U R                  S5      Ul        [        R
                  " 5       R                  SS9[         R                  " SS9-   R                  S5      S-   nU R                  [        R                  " [        [        [        5      5      nSS	[        -   S
S.nS[         SSU["        S.nSUS.nSSR%                  U R&                  S   5      [(        [*        SS.nS [,        SS.n	U R/                  [0        R2                  U R&                  [0        R2                  US9n
[5        [        R                  " [        [        [        5      U R6                  S9nU R9                  [:        [<        U[>        [(        [,        S/S9nURA                  U
5        [C        U
RD                  5      S:X  d   eU RG                  U
RD                  S   S   XV5        U RI                  U
RD                  S   S   UU	5        URJ                  US   :X  d   eURL                  [(        :X  d   eURN                  [,        :X  d   eURP                  S/:X  d   eg ) Nr5   r   r  r   r  r  r  r&   r  zggl-python/3.7 auth/1.1 google-byoid-sdk sa-impersonation/true config-lifetime/false source/programmaticr  r  r   r  r  r  r  ri  r  r   r  r  r  r  )r   r   r   r   r  r  )r   r   r   r   r   r   r   rg  rf  r  ))r6   r7   rj  r8   r   r>   r  r  r  r   r   r:   rR   rS   rp  r  r   r   r   r  r   r	  r  r   rk  rl  rl   rm  r   r   r   r   r  r   rq  r   r   r  r   r   r   )r=   r>   r  r  r  r  r  r   r  r  r}   r  rA   s                rG   5test_refresh_success_with_supplier_with_impersonationETestCredentials.test_refresh_success_with_supplier_with_impersonation	  sq    '//88##%9
 OO%%!%4x7I7IRV7WW
)C.3 "&!H!H&&}6GO"
 @%(;; "K
 L $S:3"4
 -%"

 /(//0E0En0UV#3!V#(!
 &
"
 (($,,!,5	 ) 
 6!$!;!;0%" ??	
 ++'.6.O-%; , 	
 	G$7))*a///((""1%a(-	

 	00""1%a(!&	

   $:=$IIII++/????!!V+++))i[888rJ   c           	         [         R                   R                  U R                  S5      Ul        U R	                  [
        R                  " [        [        [        5      5      nSS[        -   SS.nS[        SSR                  [        5      U[        S	.nU R                  [         R"                  U R$                  S
9n['        [
        R                  " [        [        [        5      U R(                  S9nU R+                  [,        [.        U[0        [        S/S9nUR3                  U5        [5        UR6                  5      S:X  d   eU R9                  UR6                  S   S   XE5        UR:                  U R$                  S   :X  d   eUR<                  [0        :X  d   eUR>                  [        :X  d   eUR@                  S/:X  d   eg )Nr5   r&   r  zhgl-python/3.7 auth/1.1 google-byoid-sdk sa-impersonation/false config-lifetime/false source/programmaticr  r  r   r   r  )r   r   r  r  )r   r   r   r   r   r   rf  r   r   )!r6   r7   rj  r8   r   r   r:   rR   rS   rp  r  r   r  r  r   r   rk  rl  r  rl   rm  r   r   r   r   r  r   rq  r   r  r   r   r   )	r=   r>   r  r  r  r  r}   r  rA   s	            rG   "test_refresh_success_with_supplier2TestCredentials.test_refresh_success_with_supplier_	  s    '//88##%9
 "&!H!H&&}6GO"
 @%(;; "L
 L $SXXf%3"4
 (($D4I4I ) 
 6!$!;!;0%" ??	
 ++'.6-%; , 
 	G$7))*a///((""1%a(-	
   D$9$9.$IIII++/????!!V+++))i[888rJ   r`   )r)   r/   )NNNNNNNNNNNN)Nr   )ara   rb   rc   rd   rm  rn  rR   rS   rp  ro  r  rj  rr  rs  CRED_VERIFICATION_URLr   r  r  r  r  r  r  r  classmethodr   r   r   r   r   r   r   r   r   rh   ri   objectr   r   r  r	  r  r  r  r$  r)  r,  r2  r7  r;  r@  rC  rI  rL  rP  rV  rZ  r]  rb  rv  dictosenvironr  r   r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  !LANG_LIBRARY_METRICS_HEADER_VALUEr  r  r	  r  r  r  r  r  r#  r(  r+  r.  r1  rj   r`   rJ   rG   r   r     s7   JH$,)%
  7/  !*?	 !%&*?$A 'L&!   ]	-
 -
^  $("&!$("&W Wr  *.%*.
 
8 7<, , >G
H 
H  +L) ) 
ZZs
F 
 G 
D 
ZZs
F
 G
8 
ZZs
F
 G
< 
ZZs
F"
 G"
H 
ZZs
F
 G
:K


KKX
<G.>
 
"
@ 
ZZ-.9
 /9
v 
ZZ-.	ZZ__RZZ$d
 % /d
L 
ZZ-.	ZZ__


''..	
/
 //
b 
ZZ-.	ZZ__


''224E	
/
 //
b 
ZZ-.	ZZ__RZZ"2"="=z!JK/
 L //
b 
ZZ-.	ZZ__


''..224E	
" /"$ 
ZZ-.:
 /:
x 
ZZ-.
 /
: 
ZZ-.
 /
4 
ZZ-.
 /
  
ZZ-.
 /
$ 
ZZ-.
 /
, 
ZZ-.
 /
" 
ZZ-.
 /
*?B
"M  
ZZ96 
ZZ-.49 /	
49l 
ZZ96 
ZZ-.44 /	
44l 
ZZDJ 
ZZ96 
ZZ-.R9 /		R9h 
ZZDJ 
ZZ96 
ZZ-.R4 /		R4h? 
ZZ-.
 /
( 
ZZ-.
 /
( 
ZZ-.4 /4,,,$ 
ZZ96 
ZZ-.T9 /	
T9l 
ZZ96 
ZZ-.39 /	
39rJ   r   ):r6   http.clientclientrk  r   r7  urllib.parser   rh   rO   google.authr   r   r   r   r   r   google.auth.credentialsr	   r	  r9  r   r   r  SERVICE_ACCOUNT_EMAIL&SERVICE_ACCOUNT_IMPERSONATION_URL_BASEr   rT  r   r   r  r   r   r   r   rr  r  rs  r  r  r  r3  rR   rS   rp  REQUEST_PARAMSrG  INVALID_TOKEN_URLSrS  *INVALID_SERVICE_ACCOUNT_IMPERSONATION_URLSr   unquoterg   r5  r2   AwsSecurityCredentialsSupplierrl   r   r`   rJ   rG   <module>rF     s    !  	    2  ( " ! ; @ 6 %= !	0 K 4 ' +b*h*h+ ' +-TT " & 
H	1	;B vR
D W W I F  U  '>  	z n
  <
, (. *F 	*!K	

 ) ?@	
 * "U&7	
4 	*!K	

 7 ?@	
 8 "U&7	
4 	*!K	

 , ?@	
 - "U&7	
4 	*!K	

 / ?@	
 0 "U&7	
4 	*!K	

 3 ?@	
 4 "U&7	
4 	*!K	

 : ?@	
 ; "U&7	
4 	*!K	

 6 ?@	
 7 "U&7	
4 	*!K	

 188$$[1  ?@	
 288$$[1  "U&7
	
< 	*!K	

 * ?Q	
 + "Y&7			
6 	*!K	

 * ?Q	
 + "Y&7			
6 	*!K	

 * ?gN	
 + "W&7			
6 	*!K	

 * C7 	
 + "b& C7	 
	
!@ 	*!K	

 2 ?@	
 3 "U&7	
0 	*!2#	
 b	

 c!?"  y"y 60(-	
6 	*!2#	
 d	

 e!?"  y"y 60(-	
6 	'>OPd	

 e!?"  d"d 60
	
, 	*!2#	
 > < ? #	
 ?!?"  X"X ;0 < ?(-	 #	
# {~B;9 ;9|)K)K <Z9f Z9rJ   