
    i                       S SK r S SKrS SKJr  S SKrS SKrS SKrS SKrS SK	J
r
  S SKrS SKJrJr  S SKJr  S SKJr  S SKJr  S SKJr  S SKJr  S	rS
rSrSrSrSR5                  \5      r\\-   rSrSS/r\R>                  RA                  \R>                  RC                  \"5      S5      r#\R>                  RA                  \#S5      r$\R>                  RA                  \#S5      r%\R>                  RA                  \#S5      r&\R>                  RA                  \#S5      r'\R>                  RA                  \#S5      r(\R>                  RA                  \#S5      r)\R>                  RA                  \#S5      r*\R>                  RA                  \#S5      r+Sr,\-" \$5       r.\.R_                  5       r0SSS5        \-" \%5       r.\Rb                  " \.5      r2\2Rg                  \,5      r4SSS5        \-" \)S5       r5\ Rl                  " \
Rn                  " \
Rp                  \
Rr                  " \
Rt                  \5R_                  5       5      5      5      Rw                  S5      r<SSS5        \-" \+S5       r5\ Rl                  " \
Rn                  " \
Rp                  \
Rr                  " \
Rt                  \5R_                  5       5      5      5      Rw                  S5      r=SSS5        Sr>Sr?S r@S!rAS"rBS#rCS$rD/ S%QrE/ S&QrF/ S'QrG/ S(QrH " S) S*\R                  5      rJ " S+ S,\K5      rLg! , (       d  f       GNp= f! , (       d  f       GNN= f! , (       d  f       N= f! , (       d  f       N= f)-    N)crypto)_helpersexternal_account)
exceptions)identity_pool)metrics)	transport)DEFAULT_UNIVERSE_DOMAINusernamepasswordzdXNlcm5hbWU6cGFzc3dvcmQ=z1service-1234@service-name.iam.gserviceaccount.comz.https://us-east1-iamcredentials.googleapis.comz5/v1/projects/-/serviceAccounts/{}:generateAccessTokenQUOTA_PROJECT_IDscope1scope2datazexternal_subject_token.txtzexternal_subject_token.jsonztrust_chain_with_leaf.pemztrust_chain_without_leaf.pemztrust_chain_wrong_order.pemzpublic_cert.pemzprivatekey.pemzother_cert.pemaccess_tokenrbutf-8z#https://sts.googleapis.com/v1/tokenz(https://sts.googleapis.com/v1/introspectz$urn:ietf:params:oauth:token-type:jwtzi//iam.googleapis.com/projects/123456/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_IDzR//iam.googleapis.com/locations/global/workforcePools/POOL_ID/providers/PROVIDER_IDz)urn:ietf:params:oauth:token-type:id_token"WORKFORCE_POOL_USER_PROJECT_NUMBER)	https://sts.googleapis.comz$https://us-east-1.sts.googleapis.comz$https://US-EAST-1.sts.googleapis.comz$https://sts.us-east-1.googleapis.comz$https://sts.US-WEST-1.googleapis.comz$https://us-east-1-sts.googleapis.comz$https://US-WEST-1-sts.googleapis.comz/https://us-west-1-sts.googleapis.com/path?queryz&https://sts-us-east-1.p.googleapis.com)%https://iamcredentials.googleapis.comzsts.googleapis.comhttps://zhttp://sts.googleapis.comzhttps://st.s.googleapis.comz$https://us-eas	-1.sts.googleapis.comz#https:/us-east-1.sts.googleapis.comz%https://US-WE/ST-1-sts.googleapis.comz$https://sts-us-east-1.googleapis.comz$https://sts-US-WEST-1.googleapis.comz(testhttps://us-east-1.sts.googleapis.comz,https://us-east-1.sts.googleapis.comevil.comz.https://us-east-1.us-east-1.sts.googleapis.comz$https://us-ea.s.t.sts.googleapis.comz"https://sts.googleapis.comevil.comz%hhttps://us-east-1.sts.googleapis.comz!https://us- -1.sts.googleapis.comzhttps://-sts.googleapis.comz-https://us-east-1.sts.googleapis.com.evil.comzhttps://sts.pgoogleapis.comhttps://p.googleapis.comzhttps://sts.p.comzhttp://sts.p.googleapis.comz https://xyz-sts.p.googleapis.comz$https://sts-xyz.123.p.googleapis.comz!https://sts-xyz.p1.googleapis.comzhttps://sts-xyz.p.foo.comz$https://sts-xyz.p.foo.googleapis.com)	r   z/https://us-east-1.iamcredentials.googleapis.comz/https://US-EAST-1.iamcredentials.googleapis.comz/https://iamcredentials.us-east-1.googleapis.comz/https://iamcredentials.US-WEST-1.googleapis.comz/https://us-east-1-iamcredentials.googleapis.comz/https://US-WEST-1-iamcredentials.googleapis.comz:https://us-west-1-iamcredentials.googleapis.com/path?queryz1https://iamcredentials-us-east-1.p.googleapis.com)r   ziamcredentials.googleapis.comr   z$http://iamcredentials.googleapis.comz&https://iamcre.dentials.googleapis.comz/https://us-eas	-1.iamcredentials.googleapis.comz.https:/us-east-1.iamcredentials.googleapis.comz0https://US-WE/ST-1-iamcredentials.googleapis.comz/https://iamcredentials-us-east-1.googleapis.comz/https://iamcredentials-US-WEST-1.googleapis.comz3testhttps://us-east-1.iamcredentials.googleapis.comz7https://us-east-1.iamcredentials.googleapis.comevil.comz9https://us-east-1.us-east-1.iamcredentials.googleapis.comz/https://us-ea.s.t.iamcredentials.googleapis.comz-https://iamcredentials.googleapis.comevil.comz0hhttps://us-east-1.iamcredentials.googleapis.comz,https://us- -1.iamcredentials.googleapis.comz&https://-iamcredentials.googleapis.comz8https://us-east-1.iamcredentials.googleapis.com.evil.comz&https://iamcredentials.pgoogleapis.comr   zhttps://iamcredentials.p.comz&http://iamcredentials.p.googleapis.comz+https://xyz-iamcredentials.p.googleapis.comz/https://iamcredentials-xyz.123.p.googleapis.comz,https://iamcredentials-xyz.p1.googleapis.comz$https://iamcredentials-xyz.p.foo.comz/https://iamcredentials-xyz.p.foo.googleapis.comc                   &    \ rS rSr SS jrS rSrg)TestSubjectTokenSupplier   Nc                 (    Xl         X l        X0l        g N)_subject_token_subject_token_exception_expected_context)selfsubject_tokensubject_token_exceptionexpected_contexts       Rplatform/gsutil/third_party/google-auth-library-python/tests/test_identity_pool.py__init__!TestSubjectTokenSupplier.__init__   s     ,(?%!1    c                     U R                   b  U R                   U:X  d   eU R                  b  U R                  eU R                  $ r   )r    r   r   )r!   contextrequests      r%   get_subject_token*TestSubjectTokenSupplier.get_subject_token   sF    !!-))W444((4///"""r(   )r    r   r   )NNN)__name__
__module____qualname____firstlineno__r&   r,   __static_attributes__ r(   r%   r   r      s    QU2#r(   r   c                      \ rS rSrS\0r\SSS.S.rSrS\0r	\SSS.S	.r
S
SS00rS
SS00rS
S\S.0rS
S\S.0rS
S\S.0rSSSSSR'                  \5      S.r\S 5       r\\R2                  S4S j5       r\\4S j5       r\\4S j5       r\\4S j5       r\        SoS j5       r \\!\"\\#SSSSSSSSS4S j5       r$\%RL                  RO                  \(RR                  SSS9S  5       r*\%RL                  RO                  \(RR                  SSS9S! 5       r+\%RL                  RO                  \(RR                  SSS9S" 5       r,\%RL                  RO                  \(RR                  SSS9S# 5       r-\%RL                  RO                  \(RR                  SSS9S$ 5       r.\%RL                  RO                  \(RR                  SSS9S% 5       r/\%RL                  RO                  \(RR                  SSS9S& 5       r0S' r1S( r2S) r3S* r4S+ r5S, r6S- r7S. r8S/ r9S0 r:S1 r;S2 r<S3 r=S4 r>S5 r?S6 r@S7 rAS8 rBS9 rCS: rDS; rES< rFS= rGS> rH\%RL                  " S?\I\J4S9S@ 5       rK\%RL                  " S?\I\J4S9SA 5       rL\%RL                  " S?\I\J4S9SB 5       rM\%RL                  " S?\I\J4S9SC 5       rN\%RL                  " S?\I\J4S9SD 5       rO\%RL                  " S?\I\J4S9SE 5       rP\%RL                  " S?\I\J4S9SF 5       rQSG rRSH rSSI rTSJ rUSK rVSL rWSM rXSN rYSO rZSP r[SQ r\SR r]SS r^ST r_SU r`SV raSW rbSX rcSY rdSZ reS[ rfS\ rgS] rhS^ riS_ rjS` rkSa rlSb rmSc rnSd roSe rpSf rqSg rrSh rsSi rtSj ru\%RL                  " S?SkS9Sl 5       rvSm rwSnrxg)pTestCredentials   filejsonr   typesubject_token_field_namer7   formatzhttp://fakeurl.comurlr>   r=   certificateuse_default_certificate_configtruecertificate_config_locationzpath/to/configrA   trust_chain_pathACCESS_TOKEN-urn:ietf:params:oauth:token-type:access_tokenBearer   )r   issued_token_type
token_type
expires_inscopec                     [         R                  " [        R                  SS9nXl        [        U[        5      (       a,  [        R                  " U5      R                  S5      Ul
        U$ X#l
        U$ )NT)instancer   )mockcreate_autospecr	   Responsestatus
isinstancedictr8   dumpsencoder   )clsrT   r   responses       r%   make_mock_response"TestCredentials.make_mock_response   sZ    ''	(:(:TJ dD!! JJt,33G<HM  !Mr(   Nc                 :   / nUR                  U R                  X5      5        [        U5      S:  a?  US   US   USS  p6nUR                  U R                  XV5      5        [        U5      S:  a  M?  [        R                  " [
        R                  5      nXGl        U$ )Nr         )appendr[   lenrQ   rR   r	   Requestside_effect)rY   token_status
token_dataextra_requests	responsesrT   r   r+   s           r%   make_mock_request!TestCredentials.make_mock_request   s     	//IJ.!A% q!q!qr" )F
 S33FAB .!A% &&y'8'89'r(   c                 p    US   U:X  d   eUS   S:X  d   eUS   U:X  d   eUR                  SS 5      b   eg )Nr>   methodGETheadersbody)get)rY   request_kwargsrm   r>   s       r%    assert_credential_request_kwargs0TestCredentials.assert_credential_request_kwargs  sV     e$+++h'5000i(G333!!&$/777r(   c                 P   US   U:X  d   eUS   S:X  d   eUS   U:X  d   eUS   c   e[         R                  R                  US   5      n[        U5      [        UR	                  5       5      :X  d   eU H-  u  pgUR                  S5      X6R                  S5         :X  a  M-   e   g Nr>   rk   POSTrm   rn   r   )urllibparse	parse_qslra   keysdecode)rY   rp   rm   request_data	token_urlbody_tupleskvs           r%   assert_token_request_kwargs+TestCredentials.assert_token_request_kwargs  s     e$	111h'6111i(G333f%111ll,,^F-CD;3|'8'8':#;;;;!FQ88G$XXg5F(GGGG "r(   c                     US   U:X  d   eUS   S:X  d   eUS   U:X  d   eUS   c   e[         R                  " US   R                  S5      5      nXS:X  d   eg rt   )r8   loadsrz   )rY   rp   rm   r{   !service_account_impersonation_url	body_jsons         r%   #assert_impersonation_request_kwargs3TestCredentials.assert_impersonation_request_kwargs"  sy     e$(IIIIh'6111i(G333f%111JJ~f5<<WEF	(((r(   c                    U R                   R                  5       nSS0nU(       a  SU-   US'   0 nUR                  (       a  SUS'   OSUS'   SUS'   UR                  (       a  UR                  (       a  S	US
'   OSUS
'   OSUS
'   [
        R                  " U5      US'   U(       a  SnOSR                  U	=(       d    / 5      nSUSUUUS.nU(       a8  [        R                  R                  [        R                  " SU05      5      US'   SnU(       am  [        R                  " 5       R                  SS9[         R"                  " SS9-   R%                  S5      S-   nSUS.nSSR'                  US    5      US!S".nS#U	S$S%.n/ nU
(       a!  UR)                  [*        R,                  U
45        [/        U5      nUR)                  [*        R,                  U45        U(       a,  [/        U5      nUR)                  [*        R,                  W45        U R0                  " U VVs/ s H  nU  H  nUPM     M     snn6 n[2        R4                  " S&US'9   UR7                  U5        S#S#S#5        [/        UR8                  5      [/        U5      :X  d   eU
(       a"  U R;                  UR8                  S   S(   S#5        U R=                  UR8                  U   S(   UUU5        U(       a:  U R?                  UR8                  W   S(   WWU5        UR@                  WS)   :X  d   eOUR@                  US    :X  d   eURB                  U:X  d   eURD                  U:X  d   eURF                  U:X  d   eg#s  snnf ! , (       d  f       GN= f)*zUtility to assert that a credentials are initialized with the expected
attributes by calling refresh functionality and confirming response matches
expected one and that the underlying requests were populated with the
expected parameters.
Content-Typez!application/x-www-form-urlencodedzBasic AuthorizationrB   zsa-impersonationfalsezconfig-lifetimer7   sourcer>   programmaticx-goog-api-clientz#https://www.googleapis.com/auth/iamrJ   z/urn:ietf:params:oauth:grant-type:token-exchangerG   )
grant_typeaudiencerequested_token_typerN   r"   subject_token_typeuserProjectoptionsz9gl-python/3.7 auth/1.1 auth-request-type/at cred-type/impr   )microsecondrI   )secondsTZSA_ACCESS_TOKEN)accessToken
expireTimezapplication/jsonz	Bearer {}r   0x0)r   authorizationr   zx-allowed-locationsN3600s)	delegatesrN   lifetimez:google.auth.metrics.token_request_access_token_impersonatereturn_valuer^   r   )$SUCCESS_RESPONSEcopy"_service_account_impersonation_url_credential_source_credential_source_filer   byoid_metrics_headerjoinrv   rw   quoter8   rW   r   utcnowreplacedatetime	timedelta	isoformatr=   r`   http_clientOKra   rh   rQ   patchrefreshcall_args_listrq   r   r   tokenquota_project_idscopesdefault_scopes)rY   credentialsr   r"   r   r|   r   basic_auth_encodingr   used_scopescredential_datar   r   workforce_pool_user_projecttoken_responsetoken_headersmetrics_optionstoken_scopestoken_request_datametrics_header_valueexpire_timeimpersonation_responseimpersonation_headersimpersonation_request_datarequeststoken_request_indeximpersonation_request_indexreqelr+   s                                 r%   %assert_underlying_credentials_refresh5TestCredentials.assert_underlying_credentials_refresh1  s   . --224')LM-58K-KM/*9928O./29O./-4)*))22,2),1)(6OH%-4-I-I.
)* -@L88K$526L L $S!*"4
 ',2LL,>,>

M+FGH-y)
 H 	 - !))a)8$$T23ins#K
  1)&"
 !3!,!3!3N>4R!S%9',	%! "$#*& OO[^^_=>!(m89,*-h-'OO[^^-CDE'')O3R"3")OPZZH-
 (	
 7))*c(m;;;001G1G1J11MtT''""#67:		
 -33&&'BCAF%*1	 $$(>}(MMMM$$~(FFFF++/????!!V+++))^;;;A *P
 
s   M!
	M''
M6c                 B    [         R                  " UUUUU
UUUUUUU	US9$ )N)r   r   r|   token_info_urlr   credential_sourcesubject_token_supplier	client_idclient_secretr   r   r   r   )r   Credentials)rY   r   r   r|   r   r   r   r   r   r   r   r   r   r   s                 r%   make_credentials TestCredentials.make_credentials  s>    " ((1).O/#9'-)(C
 	
r(   r&   r   c                    [         R                  R                  [        [        [
        [        [        SS0[        [        [        U R                  S.
5      n[        U[         R                  5      (       d   eUR                  [        [        [
        [        [        SS0[        [        U R                  S [        S [        S9  g )Ntoken_lifetime_seconds
  
r   r   r|   r   r   service_account_impersonationr   r   r   r   r   r   r|   r   r   %service_account_impersonation_optionsr   r   r   r   r   r   universe_domain)r   r   	from_infoAUDIENCESUBJECT_TOKEN_TYPE	TOKEN_URLTOKEN_INFO_URL!SERVICE_ACCOUNT_IMPERSONATION_URL	CLIENT_IDCLIENT_SECRETr   CREDENTIAL_SOURCE_TEXTrU   assert_called_once_withr
   r!   	mock_initr   s      r%   test_from_info_full_options+TestCredentials.test_from_info_full_options  s    #//99$&8&"05V2JD1Q&!.$4%)%@%@
  +}'@'@AAAA))1).O3KT2R'"99#'-(,3 	* 	
r(   c                 $   [         R                  R                  [        [        [
        U R                  S.5      n[        U[         R                  5      (       d   eUR                  [        [        [
        S S 0 S S U R                  S S S [        S9  g )Nr   r   r|   r   r   )
r   r   r   r   r   r   r   rU   r   r
   r   s      r%   $test_from_info_required_options_only4TestCredentials.test_from_info_required_options_only  s    #//99$&8&%)%@%@	
 +}'@'@AAAA))1.224"99#'!(,3 	* 	
r(   c                    [        5       n[        R                  R                  [        [
        [        US.5      n[        U[        R                  5      (       d   eUR                  [        [
        [        S S 0 S S S US S [        S9  g )N)r   r   r|   r   r   )
r   r   r   r   r   r   r   rU   r   r
   )r!   r   supplierr   s       r%   test_from_info_supplier'TestCredentials.test_from_info_supplier  s    +-#//99$&8&*2	
 +}'@'@AAAA))1.224"#+!(,3 	* 	
r(   c                 6   [         R                  R                  [        [        [
        U R                  [        S.5      n[        U[         R                  5      (       d   eUR                  [        [        [
        S S 0 S S U R                  S S [        [        S9  g )Nr   r   r|   r   r   r   )r   r   r   WORKFORCE_AUDIENCEWORKFORCE_SUBJECT_TOKEN_TYPEr   r   WORKFORCE_POOL_USER_PROJECTrU   r   r
   r   s      r%   test_from_info_workforce_pool-TestCredentials.test_from_info_workforce_pool9  s    #//99.&B&%)%@%@/J
 +}'@'@AAAA))';.224"99#'!(C3 	* 	
r(   c                 
   [         [        [        [        [        SS0[
        [        [        U R                  S.
nUR                  S5      nUR                  [        R                  " U5      5        [        R                  R                  [!        U5      5      n[#        U[        R                  5      (       d   eUR%                  [         [        [        [        [        SS0[
        [        U R                  S [        S [&        S9  g )Nr   r   r   config.jsonr   )r   r   r   r   r   r   r   r   r   r   writer8   rW   r   r   	from_filestrrU   r   r
   r!   r   tmpdirinfoconfig_filer   s         r%   test_from_file_full_options+TestCredentials.test_from_file_full_optionsW  s     !"4",1R.F-M"* 0!%!<!<
 kk-0$**T*+#//99#k:JK +}'@'@AAAA))1).O3KT2R'"99#'-(,3 	* 	
r(   c                    [         [        [        U R                  S.nUR	                  S5      nUR                  [        R                  " U5      5        [        R                  R                  [        U5      5      n[        U[        R                  5      (       d   eUR                  [         [        [        S S 0 S S U R                  S S S [        S9  g )Nr   r   r   )r   r   r   r   r   r   r8   rW   r   r   r   r  rU   r   r
   r  s         r%   $test_from_file_required_options_only4TestCredentials.test_from_file_required_options_only{  s     !"4"!%!<!<	
 kk-0$**T*+#//99#k:JK +}'@'@AAAA))1.224"99#'!(,3 	* 	
r(   c                    [         [        [        U R                  [        S.nUR                  S5      nUR                  [        R                  " U5      5        [        R                  R                  [        U5      5      n[        U[        R                  5      (       d   eUR                  [         [        [        S S 0 S S U R                  S S [        [        S9  g )Nr   r   r   )r   r   r   r   r   r   r   r8   rW   r   r   r   r  rU   r   r
   r  s         r%   test_from_file_workforce_pool-TestCredentials.test_from_file_workforce_pool  s     +">"!%!<!<+F
 kk-0$**T*+#//99#k:JK +}'@'@AAAA))';.224"99#'!(C3 	* 	
r(   c                     [         R                  " [        5       nU R                  [        [
        S9  S S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)N)r   r   zPworkforce_pool_user_project should not be set for non-workforce pool credentials)pytestraises
ValueErrorr   r   r   matchr!   excinfos     r%   >test_constructor_nonworkforce_with_workforce_pool_user_projectNTestCredentials.test_constructor_nonworkforce_with_workforce_pool_user_project  sY    ]]:&'!!!,G "  ' }}
 
 	
 
 '&s   A
A#c                     SS0n[         R                  " [        5       nU R                  US9  S S S 5        WR	                  S5      (       d   eg ! , (       d  f       N'= f)Nunsupportedvaluer   zMissing credential_sourcer  r  r  r   r  r!   r   r  s      r%    test_constructor_invalid_options0TestCredentials.test_constructor_invalid_options  sS    *G4]]:&'!!4E!F ' }}9:::: '&s   A
Ac                     U R                   [        S.n[        R                  " [        5       nU R                  US9  S S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)N)r>   r7   r  Ambiguous credential_source)CREDENTIAL_URLSUBJECT_TOKEN_TEXT_FILEr  r  r  r   r  r  s      r%   -test_constructor_invalid_options_url_and_file=TestCredentials.test_constructor_invalid_options_url_and_file  s^    &&+

 ]]:&'!!4E!F ' }};<<<< '&   A
A-c                     U R                   SSS00S.n[        R                  " [        5       nU R	                  US9  S S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)Nr@   rA   T)r>   r@   r  r   r!  r  r  r  r   r  r  s      r%   4test_constructor_invalid_options_url_and_certificateDTestCredentials.test_constructor_invalid_options_url_and_certificate  si    &&),Ld+ST

 ]]:&'!!4E!F ' }};<<<< '&r%  c                     [         SSS00S.n[        R                  " [        5       nU R	                  US9  S S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)Nr@   use_default_certificateT)r7   r@   r  r   )r"  r  r  r  r   r  r  s      r%   5test_constructor_invalid_options_file_and_certificateETestCredentials.test_constructor_invalid_options_file_and_certificate  sc    +),Et+LM

 ]]:&'!!4E!F ' }};<<<< '&s   A
A'c                     [         U R                  SSS00S.n[        R                  " [        5       nU R                  US9  S S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)Nr@   r+  T)r7   r>   r@   r  r   )r"  r!  r  r  r  r   r  r  s      r%   9test_constructor_invalid_options_url_file_and_certificateITestCredentials.test_constructor_invalid_options_url_file_and_certificate  sl    +&&),Et+LM
 ]]:&'!!4E!F ' }};<<<< '&s   A$$
A2c                     U R                   SS.n[        R                  " [        5       nU R	                  US9  S S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)Naws1)r>   environment_idr  z>Invalid Identity Pool credential_source field 'environment_id'r'  r  s      r%   /test_constructor_invalid_options_environment_id?TestCredentials.test_constructor_invalid_options_environment_id  sa    $($7$76R]]:&'!!4E!F ' }}M
 
 	
 
 '&s   A
A)c                     [         R                  " [        5       nU R                  SS9  S S S 5        WR	                  S5      (       d   eg ! , (       d  f       N'= f)Nznon-dictr  z?Invalid credential_source. The credential_source is not a dict.r  r  s     r%   *test_constructor_invalid_credential_source:TestCredentials.test_constructor_invalid_credential_source  sO    ]]:&'!!J!? ' }}N
 
 	
 
 '&s   A
Ac                     [         R                  " [        5       nU R                  5         S S S 5        WR	                  S5      (       d   eg ! , (       d  f       N'= f)NzGA valid credential source or a subject token supplier must be provided.r  r  s     r%   9test_constructor_invalid_no_credential_source_or_supplierITestCredentials.test_constructor_invalid_no_credential_source_or_supplier  sJ    ]]:&'!!# ' }}V
 
 	
 
 '&s   A
Ac                     [        5       n[        R                  " [        5       nU R	                  U R
                  US9  S S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)N)r   r   z[Identity pool credential cannot have both a credential source and a subject token supplier.)r   r  r  r  r   r   r  )r!   r   r  s      r%   <test_constructor_invalid_both_credential_source_and_supplierLTestCredentials.test_constructor_invalid_both_credential_source_and_supplier  se    +-]]:&'!!"&"="='/ "  ' }}j
 
 	
 
 '&s   A!!
A/c                     SSS0S.n[         R                  " [        5       nU R                  US9  S S S 5        WR	                  S5      (       d   eg ! , (       d  f       N'= f)Ntest.txtr:   xmlr<   r  z&Invalid credential_source format 'xml'r  r  s      r%   6test_constructor_invalid_credential_source_format_typeFTestCredentials.test_constructor_invalid_credential_source_format_type  sW    %/FE?K]]:&'!!4E!F ' }}FGGGG '&   A
A!c                     SSS0S.n[         R                  " [        5       nU R                  US9  S S S 5        WR	                  S5      (       d   eg ! , (       d  f       N'= f)Nr@  r:   r8   r<   r  zBMissing subject_token_field_name for JSON credential_source formatr  r  s      r%   1test_constructor_missing_subject_token_field_nameATestCredentials.test_constructor_missing_subject_token_field_name'  s`    %/FF;KL]]:&'!!4E!F ' }}Q
 
 	
 
 '&rD  c                     SSSS.0n[         R                  " [        5       nU R                  US9  S S S 5        WR	                  S5      (       d   eg ! , (       d  f       N'= f)Nr@   Ttest)rA   rC   r  !Invalid certificate configurationr  r  s      r%   6test_constructor_default_and_file_location_certificateFTestCredentials.test_constructor_default_and_file_location_certificate1  s`    26/5
 ]]:&'!!4E!F ' }}ABBBB '&rD  c                     SSS00n[         R                  " [        5       nU R                  US9  S S S 5        WR	                  S5      (       d   eg ! , (       d  f       N'= f)Nr@   rA   Fr  rJ  r  r  s      r%   8test_constructor_no_default_or_file_location_certificateHTestCredentials.test_constructor_no_default_or_file_location_certificate>  sY    *-Mu,UV]]:&'!!4E!F ' }}ABBBB '&s   A
A c           
          U R                  [        [        U R                  R	                  5       [
        S9nUR                  S[        [        [        [        U R                  [
        [        S.:X  d   eg )N)r   r   r   r   r   )r:   r   r   r|   r   r   r   r   )
r   r   r   CREDENTIAL_SOURCE_TEXT_URLr   r   r  r   r   r
   r!   r   s     r%   *test_info_with_workforce_pool_user_project:TestCredentials.test_info_with_workforce_pool_user_projectF  so    ++';"==BBD(C	 , 
 &*">",!%!@!@+F6	$
 	
 		
 	
r(   c           	          U R                  U R                  R                  5       S9nUR                  S[        [
        [        [        U R                  [        S.:X  d   eg Nr  r   )r:   r   r   r|   r   r   r   )	r   rQ  r   r  r   r   r   r   r
   rR  s     r%   %test_info_with_file_credential_source5TestCredentials.test_info_with_file_credential_sourceY  c    ++"==BBD , 
 & "4",!%!@!@6$
 
 	
 
r(   c           	          U R                  U R                  R                  5       S9nUR                  S[        [
        [        [        U R                  [        S.:X  d   eg rV  )	r   CREDENTIAL_SOURCE_JSON_URLr   r  r   r   r   r   r
   rR  s     r%   $test_info_with_url_credential_source4TestCredentials.test_info_with_url_credential_sourceh  rY  r(   c           	          U R                  U R                  R                  5       S9nUR                  S[        [
        [        [        U R                  [        S.:X  d   eg rV  )	r   CREDENTIAL_SOURCE_CERTIFICATEr   r  r   r   r   r   r
   rR  s     r%   ,test_info_with_certificate_credential_source<TestCredentials.test_info_with_certificate_credential_sourcew  sc    ++"@@EEG , 
 & "4",!%!C!C6$
 
 	
 
r(   c           	          U R                  U R                  R                  5       S9nUR                  S[        [
        [        [        U R                  [        S.:X  d   eg rV  )	r   )CREDENTIAL_SOURCE_CERTIFICATE_NOT_DEFAULTr   r  r   r   r   r   r
   rR  s     r%   8test_info_with_non_default_certificate_credential_sourceHTestCredentials.test_info_with_non_default_certificate_credential_source  sc    ++"LLQQS , 
 & "4",!%!O!O6$
 
 	
 
r(   c                     [         R                  " [        [        U R                  R                  5       S9nUR                  S[        [        [        U R                  [        S.:X  d   eg )N)r   r   r   r   r:   r   r   r|   r   r   )	r   r   r   r   rQ  r   r  r   r
   rR  s     r%    test_info_with_default_token_url0TestCredentials.test_info_with_default_token_url  sa    #//1"==BBD
 & "4"!%!@!@6$
 
 	
 
r(   c                     [         R                  " [        [        U R                  R                  5       SS9nUR                  S[        [        SU R                  SS.:X  d   eg )Nztestdomain.org)r   r   r   r   r   z#https://sts.testdomain.org/v1/tokenrg  )r   r   r   r   rQ  r   r  rR  s     r%   5test_info_with_default_token_url_with_universe_domainETestCredentials.test_info_with_default_token_url_with_universe_domain  sd    #//1"==BBD,	
 & "4>!%!@!@/$
 
 	
 
r(   c                 N   UR                  S5      nUR                  S5        S[        U5      0nU R                  US9n[        R
                  " [        R                  5       nUR                  S 5        S S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)Nz	empty.txt r7   r  z3Missing subject_token in the credential_source file)
r   r   r  r   r  r  r   RefreshErrorretrieve_subject_tokenr  )r!   r  
empty_filer   r   r  s         r%   1test_retrieve_subject_token_missing_subject_tokenATestCredentials.test_retrieve_subject_token_missing_subject_token  s    [[-
#S_5++>O+P]]:223w..t4 4 }}STTTT 43s   #B
B$c                 p    U R                  U R                  S9nUR                  S 5      nU[        :X  d   eg Nr  )r   r   rp  TEXT_FILE_SUBJECT_TOKENr!   r   r"   s      r%   %test_retrieve_subject_token_text_file5TestCredentials.test_retrieve_subject_token_text_file  A    ++"99 , 
 $::4@ 7777r(   c                 p    U R                  U R                  S9nUR                  S 5      nU[        :X  d   eg ru  )r   CREDENTIAL_SOURCE_JSONrp  JSON_FILE_SUBJECT_TOKENrw  s      r%   %test_retrieve_subject_token_json_file5TestCredentials.test_retrieve_subject_token_json_file  rz  r(   zCgoogle.auth.transport._mtls_helper._get_workload_cert_and_key_pathsc                     U R                  U R                  S9nUR                  S 5      nU[        R                  " [
        /5      :X  d   eg ru  )r   r_  rp  r8   rW   CERT_FILE_CONTENTr!   $mock_get_workload_cert_and_key_pathsr   r"   s       r%   /test_retrieve_subject_token_certificate_default?TestCredentials.test_retrieve_subject_token_certificate_default  sO     ++"@@ , 
 $::4@

,=+> ????r(   c                     U R                  U R                  S9nUR                  S 5      nU[        R                  " [
        /5      :X  d   eg ru  )r   rc  rp  r8   rW   r  r  s       r%   8test_retrieve_subject_token_certificate_non_default_pathHTestCredentials.test_retrieve_subject_token_certificate_non_default_path  sO     ++"LL , 
 $::4@

,=+> ????r(   c                     U R                  U R                  S9nUR                  S 5      nU[        R                  " [
        [        /5      :X  d   eg ru  )r   3CREDENTIAL_SOURCE_CERTIFICATE_TRUST_CHAIN_WITH_LEAFrp  r8   rW   r  OTHER_CERT_FILE_CONTENTr  s       r%   =test_retrieve_subject_token_certificate_trust_chain_with_leafMTestCredentials.test_retrieve_subject_token_certificate_trust_chain_with_leaf  sR     ++"VV , 
 $::4@

,=?V+W XXXXr(   c                     U R                  U R                  S9nUR                  S 5      nU[        R                  " [
        [        /5      :X  d   eg ru  )r   6CREDENTIAL_SOURCE_CERTIFICATE_TRUST_CHAIN_WITHOUT_LEAFrp  r8   rW   r  r  r  s       r%   @test_retrieve_subject_token_certificate_trust_chain_without_leafPTestCredentials.test_retrieve_subject_token_certificate_trust_chain_without_leaf   sR     ++"YY , 
 $::4@

,=?V+W XXXXr(   c                    U R                  U R                  S9n[        R                  " [        R
                  5       nUR                  S 5        S S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)Nr  z?The leaf certificate must be at the top of the trust chain file)r   5CREDENTIAL_SOURCE_CERTIFICATE_TRUST_CHAIN_WRONG_ORDERr  r  r   ro  rp  r  r!   r  r   r  s       r%   Atest_retrieve_subject_token_certificate_trust_chain_invalid_orderQTestCredentials.test_retrieve_subject_token_certificate_trust_chain_invalid_order  st     ++"XX , 
 ]]:223w..t4 4 }}M
 
 	
 
 43s   A11
A?c                     U R                  SSSS.0S9n[        R                  " [        R                  5       nUR                  S 5        S S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)Nr@   rB   zfake.pemrD   r  z*Trust chain file 'fake.pem' was not found.r   r  r  r   ro  rp  r  r  s       r%   Gtest_retrieve_subject_token_certificate_trust_chain_file_does_not_existWTestCredentials.test_retrieve_subject_token_certificate_trust_chain_file_does_not_exist!  sv     ++6<(2  , 
 ]]:223w..t4 4 }}IJJJJ 43s   A,,
A:c                    U R                  SS[        S.0S9n[        R                  " [        R
                  5       nUR                  S 5        S S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)Nr@   rB   rD   r  z8Error loading PEM certificates from the trust chain file)r   r"  r  r  r   ro  rp  r  r  s       r%   @test_retrieve_subject_token_certificate_invalid_trust_chain_filePTestCredentials.test_retrieve_subject_token_certificate_invalid_trust_chain_file7  sv     ++6<(?  , 
 ]]:223w..t4 4 }}WXXXX 43s   A00
A>c                 0   [         SSS.S.nU R                  US9n[        R                  " [        R
                  5       nUR                  S 5        S S S 5        WR                  SR                  [         S5      5      (       d   eg ! , (       d  f       N;= fNr8   	not_foundr9   r<   r  @Unable to parse subject_token from JSON file '{}' using key '{}')	SUBJECT_TOKEN_JSON_FILEr   r  r  r   ro  rp  r  r=   r!   r   r   r  s       r%   8test_retrieve_subject_token_json_file_invalid_field_nameHTestCredentials.test_retrieve_subject_token_json_file_invalid_field_nameM  s    +%;O
 ++>O+P]]:223w..t4 4 }}NUU'
 
 	
 
 43    B
Bc                    UR                  S5      nUR                  S5        [        U5      SSS.S.nU R                  US9n[        R
                  " [        R                  5       nUR                  S 5        S S S 5        WR                  SR                  [        U5      S5      5      (       d   eg ! , (       d  f       N@= f)	Nzinvalid.json{r8   r   r9   r<   r  r  )r   r   r  r   r  r  r   ro  rp  r  r=   )r!   r  invalid_json_filer   r   r  s         r%   (test_retrieve_subject_token_invalid_json8TestCredentials.test_retrieve_subject_token_invalid_json]  s    "KK7$)*%>R
 ++>O+P]]:223w..t4 4 }}NUU%&
 
 	
 
 43s   'B33
Cc                     SS0nU R                  US9n[        R                  " [        R                  5       nUR                  S 5        S S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)Nr7   z./not_found.txtr  z$File './not_found.txt' was not foundr  r  s       r%   *test_retrieve_subject_token_file_not_found:TestCredentials.test_retrieve_subject_token_file_not_foundp  sj    #%67++>O+P]]:223w..t4 4 }}DEEEE 43s   A++
A9c                 b    U R                  U R                  S9nUR                  [        :X  d   eg ru  )r   r|  r   r   rR  s     r%   test_token_info_url#TestCredentials.test_token_info_urly  s6    ++"99 , 
 ))^;;;r(   c                     [          HC  nU R                  U R                  R                  5       US-   S9nUR                  US-   :X  a  MC   e   g )Nz/introspectr   r   )VALID_TOKEN_URLSr   r|  r   r   r!   r>   r   s      r%   test_token_info_url_custom*TestCredentials.test_token_info_url_custom  sV    #C//"&"="="B"B"D #m 3 0 K
 --}1DDDD $r(   c                 z    U R                  U R                  R                  5       S S9nUR                  (       a   eg )Nr  )r   r|  r   r   rR  s     r%   test_token_info_url_negative,TestCredentials.test_token_info_url_negative  s@    ++"99>>@QU , 
 -----r(   c                     [          HC  nU R                  U R                  R                  5       US-   S9nUR                  US-   :X  a  MC   e   g )Nz/token)r   r|   )r  r   r|  r   
_token_urlr  s      r%   test_token_url_custom%TestCredentials.test_token_url_custom  sT    #C//"&"="="B"B"D> 0 K
 ))cHn=== $r(   c                     [          HK  nU R                  U R                  R                  5       U[        -   S9nUR
                  U[        -   :X  a  MK   e   g )N)r   r   )(VALID_SERVICE_ACCOUNT_IMPERSONATION_URLSr   r|  r   'SERVICE_ACCOUNT_IMPERSONATION_URL_ROUTEr   r  s      r%   -test_service_account_impersonation_url_custom=TestCredentials.test_service_account_impersonation_url_custom  s_    ;C//"&"="="B"B"DAA 0 K AA==   <r(   c                     U R                  [        [        U R                  [        S/S9nU R                  U[        [        [        [        S [        S [        [        S/S9  g )Nignoredr   r   r   r   r   r   r   r"   r   r|   r   r   r   r   r   r   r   r   r   r   SCOPESr   r   rv  r   r   BASIC_AUTH_ENCODINGrR  s     r%   Jtest_refresh_text_file_success_without_impersonation_ignore_default_scopesZTestCredentials.test_refresh_text_file_success_without_impersonation_ignore_default_scopes  sh     ++'"99%; , 
 	22#11.2 3!%; 	3 	
r(   c                     U R                  [        [        [        [        U R
                  [        [        S9nU R                  U[        [        [        [        S [        S [        [        S S9  g N)r   r   r   r   r   r   r   r   r   r"   r   r|   r   r   r   r   r   r   )r   r   r   r   r   r   r  r   r   rv  r   r  rR  s     r%   Etest_refresh_workforce_success_with_client_auth_without_impersonationUTestCredentials.test_refresh_workforce_success_with_client_auth_without_impersonation  sh    ++';'"99(C , 

 	22#'1;.2 3!(, 	3 	
r(   c                     U R                  [        [        [        [        U R
                  [        S S9nU R                  U[        [        [        [        S [        S [        [        S S9  g r  )r   r   r   r   r   r   r  r   rv  r   r  rR  s     r%   Htest_refresh_workforce_success_with_client_auth_and_no_workforce_projectXTestCredentials.test_refresh_workforce_success_with_client_auth_and_no_workforce_project  sh    ++';'"99(, , 

 	22#'1;.2 3!(, 	3 	
r(   c                     U R                  [        [        S S U R                  [        [
        S9nU R                  U[        [        [        [        S S S [        [        [
        S9  g r  )	r   r   r   r   r  r   r   rv  r   rR  s     r%   Htest_refresh_workforce_success_without_client_auth_without_impersonationXTestCredentials.test_refresh_workforce_success_without_client_auth_without_impersonation  sh    ++';"99(C , 

 	22#'1;.2 $!(C 	3 	
r(   c                     U R                  [        [        S S [        U R                  [
        [        S9nU R                  U[        [        [        [        [        S S [
        [
        [        S9  g )N)r   r   r   r   r   r   r   r   r  )
r   r   r   r   r   r  r   r   rv  r   rR  s     r%   Etest_refresh_workforce_success_without_client_auth_with_impersonationUTestCredentials.test_refresh_workforce_success_without_client_auth_with_impersonation  sk    ++';.O"99(C , 
 	22#'1;.O $!(C 	3 	
r(   c                     U R                  [        [        U R                  S [        S9nU R                  U[        [        [        [        S [        S [        S [        S9  g )Nr  r  r  rR  s     r%   Gtest_refresh_text_file_success_without_impersonation_use_default_scopesWTestCredentials.test_refresh_text_file_success_without_impersonation_use_default_scopes.  sb    ++'"99! , 
 	22#11.2 3!! 	3 	
r(   c                     U R                  U R                  [        [        S/S9nU R	                  U[
        [        [        [        [        S S [        [        S/S9  g )Nr  r   r   r   r   r  	r   r   r   r  r   r   rv  r   r   rR  s     r%   Gtest_refresh_text_file_success_with_impersonation_ignore_default_scopesWTestCredentials.test_refresh_text_file_success_with_impersonation_ignore_default_scopesG  sc    ++"99.O%; , 
 	22#11.O $!%; 	3 	
r(   c                     U R                  U R                  [        S [        S9nU R	                  U[
        [        [        [        [        S S [        S [        S9  g )Nr  r  r  rR  s     r%   Dtest_refresh_text_file_success_with_impersonation_use_default_scopesTTestCredentials.test_refresh_text_file_success_with_impersonation_use_default_scopes`  sa     ++"99.O! , 
 	22#11.O $!! 	3 	
r(   c                     U R                  [        [        U R                  [        S9nU R                  U[        [        [        [        S [        S [        [        S S9  g )Nr   r   r   r   r  )r   r   r   r|  r  r   r   r}  r   r   r  rR  s     r%   4test_refresh_json_file_success_without_impersonationDTestCredentials.test_refresh_json_file_success_without_impersonationz  s_    ++'"99 , 
 	22#11.2 3! 	3 	
r(   c                     U R                  U R                  [        [        S9nU R	                  U[
        [        [        [        [        S S [        [        S S9  g )Nr   r   r   r  )	r   r|  r   r  r   r   r}  r   r   rR  s     r%   1test_refresh_json_file_success_with_impersonationATestCredentials.test_refresh_json_file_success_with_impersonation  s\    ++"99.O	 , 
 	22#11.O $! 	3 	
r(   c                 0   [         SSS.S.nU R                  US9n[        R                  " [        R
                  5       nUR                  S 5        S S S 5        WR                  SR                  [         S5      5      (       d   eg ! , (       d  f       N;= fr  )	r  r   r  r  r   ro  r   r  r=   r  s       r%   .test_refresh_with_retrieve_subject_token_error>TestCredentials.test_refresh_with_retrieve_subject_token_error  s    +%;O
 ++>O+P]]:223w% 4 }}NUU'
 
 	
 
 43r  c                     U R                  U R                  S9nU R                  [        S9nUR	                  U5      nU[        :X  d   eU R                  UR                  S   S   S 5        g Nr  re   r   r^   )r   rQ  rh   rv  rp  rq   r   r!   r   r+   r"   s       r%   $test_retrieve_subject_token_from_url4TestCredentials.test_retrieve_subject_token_from_url  su    ++"== , 
 ((4K(L#::7C 7777--g.D.DQ.G.JDQr(   c                     U R                  U R                  SS0S.S9nU R                  [        S9nUR	                  U5      nU[        :X  d   eU R                  UR                  S   S   SS05        g )Nfoobar)r>   rm   r  r  r   r^   )r   r!  rh   rv  rp  rq   r   r  s       r%   1test_retrieve_subject_token_from_url_with_headersATestCredentials.test_retrieve_subject_token_from_url_with_headers  s    ++&*&9&9uenU , 
 ((4K(L#::7C 7777--""1%a(5%.	
r(   c                     U R                  U R                  S9nU R                  [        S9nUR	                  U5      nU[
        :X  d   eU R                  UR                  S   S   S 5        g r  )r   r[  rh   JSON_FILE_CONTENTrp  r}  rq   r   r  s       r%   )test_retrieve_subject_token_from_url_json9TestCredentials.test_retrieve_subject_token_from_url_json  su    ++"== , 
 ((4E(F#::7C 7777--g.D.DQ.G.JDQr(   c                     U R                  U R                  SSS.SS0S.S9nU R                  [        S9nUR	                  U5      nU[
        :X  d   eU R                  UR                  S	   S
   SS05        g )Nr8   r   r9   r  r  )r>   r=   rm   r  r  r   r^   )r   r!  rh   r  rp  r}  rq   r   r  s       r%   6test_retrieve_subject_token_from_url_json_with_headersFTestCredentials.test_retrieve_subject_token_from_url_json_with_headers  s    ++**#)~V!5> , 
 ((4E(F#::7C 7777--""1%a(5%.	
r(   c                 (   U R                  U R                  S9n[        R                  " [        R
                  5       nUR                  U R                  S[        S95        S S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)Nr  i  )rd   re   z.Unable to retrieve Identity Pool subject token)
r   rQ  r  r  r   ro  rp  rh   r  r  r!   r   r  s      r%   .test_retrieve_subject_token_from_url_not_found>TestCredentials.test_retrieve_subject_token_from_url_not_found  s~    ++"== , 
 ]]:223w..&&CDU&V 4
 }}MNNNN 43s   $B
Bc                 j   U R                   SSS.S.nU R                  US9n[        R                  " [        R
                  5       nUR                  U R                  [        S95        S S S 5        WR                  SR                  U R                   S5      5      (       d   eg ! , (       d  f       NA= fNr8   r  r9   r?   r  r  r  )r!  r   r  r  r   ro  rp  rh   r  r  r=   r  s       r%   7test_retrieve_subject_token_from_url_json_invalid_fieldGTestCredentials.test_retrieve_subject_token_from_url_json_invalid_field  s    &&%;O
 ++>O+P]]:223w..&&2C&D 4
 }}NUU##[
 
 	
 
 43   #B$$
B2c                 R   U R                  U R                  S9n[        R                  " [        R
                  5       nUR                  U R                  SS95        S S S 5        WR                  SR                  U R                  S5      5      (       d   eg ! , (       d  f       NA= f)Nr  r  r  r  r   )r   r[  r  r  r   ro  rp  rh   r  r=   r!  r  s      r%   8test_retrieve_subject_token_from_url_json_invalid_formatHTestCredentials.test_retrieve_subject_token_from_url_json_invalid_format  s    ++"== , 
 ]]:223w..t/E/EQT/E/UV 4 }}NUU##^
 
 	
 
 43s   B
B&c                     U R                  [        [        U R                  [        S9nU R                  U[        [        [        [        S [        S [        [        S [        S9  g Nr  r   r   r"   r   r|   r   r   r   r   r   r   r   )r   r   r   rQ  r  r   r   rv  r   r   r  rR  s     r%   8test_refresh_text_file_success_without_impersonation_urlHTestCredentials.test_refresh_text_file_success_without_impersonation_url  sb    ++'"== , 
 	22#11.2 3!3 	3 	
r(   c                     U R                  U R                  [        [        S9nU R	                  U[
        [        [        [        [        S S [        [        S [        S9  g Nr  r  )	r   rQ  r   r  r   r   rv  r   r   rR  s     r%   5test_refresh_text_file_success_with_impersonation_urlETestCredentials.test_refresh_text_file_success_with_impersonation_url+  s_    ++"==.O	 , 
 	22#11.O $!3 	3 	
r(   c                     U R                  [        [        U R                  [        S9nU R                  U[        [        [        [        S [        S [        [        S [        S9  g r  )r   r   r   r[  r  r   r   r}  r   r   r  r  rR  s     r%   8test_refresh_json_file_success_without_impersonation_urlHTestCredentials.test_refresh_json_file_success_without_impersonation_urlC  sb    ++'"== , 
 	22#11.2 3!- 	3 	
r(   c                     U R                  U R                  [        [        S9nU R	                  U[
        [        [        [        [        S S [        [        S [        S9  g r  )
r   r[  r   r  r   r   r}  r   r   r  rR  s     r%   5test_refresh_json_file_success_with_impersonation_urlETestCredentials.test_refresh_json_file_success_with_impersonation_url[  s_    ++"==.O	 , 
 	22#11.O $!- 	3 	
r(   c                 j   U R                   SSS.S.nU R                  US9n[        R                  " [        R
                  5       nUR                  U R                  [        S95        S S S 5        WR                  SR                  U R                   S5      5      (       d   eg ! , (       d  f       NA= fr  )r!  r   r  r  r   ro  r   rh   r  r  r=   r  s       r%   2test_refresh_with_retrieve_subject_token_error_urlBTestCredentials.test_refresh_with_retrieve_subject_token_error_urls  s    &&%;O
 ++>O+P]]:223w 6 6BS 6 TU 4 }}NUU##[
 
 	
 
 43r  c                 v    [        [        S9nU R                  US9nUR                  S 5      nU[        :X  d   eg )Nr"   r   )r   r}  r   rp  )r!   r   r   r"   s       r%   $test_retrieve_subject_token_supplier4TestCredentials.test_retrieve_subject_token_supplier  s?    +:QR++8+L#::4@ 7777r(   c                     [        [        [        R                  " [        [
        5      S9nU R                  US9nUR                  S 5        g )N)r"   r$   r#  )r   r}  r   SupplierContextr   r   r   rp  r!   r   r   s      r%   4test_retrieve_subject_token_supplier_correct_contextDTestCredentials.test_retrieve_subject_token_supplier_correct_context  sE    +1-=="H
 ++8+L**40r(   c                 P   [         R                  " S5      n[        US9nU R                  US9n[        R
                  " [         R                  5       nUR                  U R                  [        S95        S S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)Nz
test error)r#   r#  r  )
r   ro  r   r   r  r  r   rh   r  r  )r!   expected_exceptionr   r   r  s        r%   *test_retrieve_subject_token_supplier_error:TestCredentials.test_retrieve_subject_token_supplier_error  s    '44\B+DVW++8+L]]:223w 6 6BS 6 TU 4 }}\**** 43s   #B
B%c                     [        [        S9nU R                  U[        [        S9nU R                  U[        [        [        [        [        S S [        [        S S9  g )Nr"  )r   r   r   r  )
r   r}  r   r   r  r   r   rv  r   r   r(  s      r%   4test_refresh_success_supplier_with_impersonation_urlDTestCredentials.test_refresh_success_supplier_with_impersonation_url  sa    +:QR++#+.O , 
 	22#11.O $! 	3 	
r(   c                     [        [        S9nU R                  U[        S9nU R	                  U[
        [        [        [        S S [        [        S S9
  g )Nr"  )r   r   )
r   r   r"   r   r|   r   r   r   r   r   )	r   r}  r   r  r   r   rv  r   r   r(  s      r%   7test_refresh_success_supplier_without_impersonation_urlGTestCredentials.test_refresh_success_supplier_without_impersonation_url  sZ    +:QR++#+F , 
 	22#11 $! 	3 	
r(   )certkeyc                     U R                  U R                  R                  5       S9nUR                  5       u  p4US:X  d   eUS:X  d   eg )Nr  r5  r6  )r   r_  r   _get_mtls_cert_and_key_paths)r!   r  r   r5  r6  s        r%   test_get_mtls_certs#TestCredentials.test_get_mtls_certs  sU    
 ++"@@EEG , 
  <<>	v~~e||r(   c                    U R                  U R                  R                  5       S9n[        R                  " [
        R                  5       nUR                  5         S S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)Nr  zThe credential is not configured to use mtls requests. The credential should include a "certificate" section in the credential source.)	r   r   r   r  r  r   ro  r8  r  r  s      r%   test_get_mtls_certs_invalid+TestCredentials.test_get_mtls_certs_invalid  s|    ++"99>>@ , 
 ]]:223w446 4 }} U
 
 	
 
 43s   A>>
Br3   )NNNNNNNN)yr.   r/   r0   r1   r"  r   r  r|  r!  rQ  r[  r_  rc  TRUST_CHAIN_WITH_LEAF_FILEr  TRUST_CHAIN_WITHOUT_LEAF_FILEr  TRUST_CHAIN_WRONG_ORDER_FILEr  r   r  r   classmethodr[   r   r   rh   rq   r   r   r   r   r   r   r   r   r   rQ   r   objectr   r   r   r   r   r   r  r	  r  r  r  r#  r(  r,  r/  r4  r7  r:  r=  rB  rF  rK  rN  rS  rW  r\  r`  rd  rh  rk  rr  rx  r~  	CERT_FILEKEY_FILEr  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r	  r  r  r  r  r  r  r$  r)  r-  r0  r3  r9  r<  r2   r3   r(   r%   r5   r5      s   $&=>'!~N *N"'!8!~N"
 	8&A%! 	57GH1- 	.4 :
;7 	.4 =
>: 	.4 <
=9 'L&!   %..T ( *88 8 >G
H 
H  +L) )  +/ $(E< E<N  -%*.#$(
 
@ 
ZZ}00*4P 
 Q 
D 
ZZ}00*4P
 Q
8 
ZZ}00*4P
 Q
< 
ZZ}00*4P
 Q
: 
ZZ}00*4P!
 Q!
F 
ZZ}00*4P
 Q
: 
ZZ}00*4P
 Q
<

;	=	=	=
=




H
CC
&




 
"
U88 
ZZM*	@		@ 
ZZM*	@		@ 
ZZM*Y	Y 
ZZM*Y	Y 
ZZM*
	
 
ZZM*K	K$ 
ZZM*Y	Y$
 
&F<E.>
6
6
6
6
8
2
2
4
.
.
 R

R
 	O
$

0
0
0
0
 8
1	+
.
( 
ZZM$	

r(   r5   )Mbase64r   http.clientclientr   r8   osrv   rQ   OpenSSLr   r  google.authr   r   r   r   r   r	   google.auth.credentialsr
   r   r   r  SERVICE_ACCOUNT_EMAIL&SERVICE_ACCOUNT_IMPERSONATION_URL_BASEr=   r  r   r   r  pathr   dirname__file__DATA_DIRr"  r  r>  r?  r@  rC  rD  OTHER_CERT_FILESUBJECT_TOKEN_FIELD_NAMEopenfhreadrv  loadr  ro   r}  f	b64encodedump_certificateFILETYPE_ASN1load_certificateFILETYPE_PEMrz   r  r  r   r   r   r   r   r   r   r  INVALID_TOKEN_URLSr  *INVALID_SERVICE_ACCOUNT_IMPERSONATION_URLSSubjectTokenSupplierr   rB  r5   r3   r(   r%   <module>ra     s     !  	     2 " %  ! ;	0 K 4 ' +b*h*h+ ' +-TT " & 
H	77<<16:'',,x1MN '',,x1NO WW\\(4OP  "X7U V !ww||H6ST GGLL#45	77<<"23'',,x)9:) 	
!"b ggi # 

!"b		"/334LM # 
)Ta((  &"9"9&:M:Mqvvx"X	
 fWo	   
/4 A$..  &"9"9&:M:Mqvvx"X	
 fWo	  ! 2	;; vX   K B 
  <
, (. *@#}AA # d
f d
G #" #"  ! s2   L5$L *A&L2!A&M
L 
L/2
M 
M