
    ԋ                        S SK r S SKrS SKJr  S SKrS SKrS SKrS SKrS SK	J
r
  S SK	Jr  S SK	Jr  S SK	Jr  S SK	Jr  S SKJr  S SKJr  S S	KJr  \R(                  R+                  \R(                  R-                  \5      S
S5      r\" \R(                  R+                  \S5      S5       r\R7                  5       rSSS5        \R(                  R+                  \S5      r\R(                  R+                  \S5      rSrSr \" \S5       r\RB                  " \5      r"SSS5        \" \S5       r\RB                  " \5      r#SSS5        \RH                  RK                  \S5      r&Sr'Sr(Sr)\RT                  S 5       r+\RT                  S 5       r, " S S5      r-\RT                  S 5       r.\RT                  S 5       r/ " S S\05      r1g! , (       d  f       GN= f! , (       d  f       N= f! , (       d  f       N= f)    N)_helpers)crypt)
exceptions)impersonated_credentials)	transport)Credentials)credentials)service_account datazprivatekey.pemrbzservice_account.jsonz8impersonated_service_account_authorized_user_source.jsona?  eyJhbGciOiJSUzI1NiIsImtpZCI6ImRmMzc1ODkwOGI3OTIyOTNhZDk3N2EwYjk5MWQ5OGE3N2Y0ZWVlY2QiLCJ0eXAiOiJKV1QifQ.eyJhdWQiOiJodHRwczovL2Zvby5iYXIiLCJhenAiOiIxMDIxMDE1NTA4MzQyMDA3MDg1NjgiLCJleHAiOjE1NjQ0NzUwNTEsImlhdCI6MTU2NDQ3MTQ1MSwiaXNzIjoiaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tIiwic3ViIjoiMTAyMTAxNTUwODM0MjAwNzA4NTY4In0.redactedi?]1z https://example.com/oauth2/tokenz9gl-python/3.7 auth/1.1 auth-request-type/at cred-type/impz9gl-python/3.7 auth/1.1 auth-request-type/it cred-type/impc               #      #    [         R                  " SSS9 n S[        R                  " 5       [        R
                  " SS9-   0 4U l        U v   S S S 5        g ! , (       d  f       g = f7f)Ngoogle.oauth2._client.jwt_grantTautospeczsource token  secondsmockpatchr   utcnowdatetime	timedeltareturn_valuegrants    ]platform/gsutil/third_party/google-auth-library-python/tests/test_impersonated_credentials.pymock_donor_credentialsr    F   sS     	5	EOO 2 23 ??

  
F	E	E   A)7A	A)
A&"A)c               #      #    [         R                  " SSS9 n S[        R                  " 5       [        R
                  " SS9-   0 4U l        U v   S S S 5        g ! , (       d  f       g = f7f)Nr   Tr   1/fFAGRNJasdfz70BzhT3Zgr   r   r   r   s    r   mock_dwd_credentialsr$   Q   sS     	5	E%OO 2 23 ??

  
F	E	Er!   c                        \ rS rSrS rS rSrg)MockResponse\   c                     Xl         X l        g N	json_datastatus_code)selfr+   r,   s      r   __init__MockResponse.__init__]   s    "&    c                     U R                   $ r)   )r+   )r-   s    r   jsonMockResponse.jsona   s    ~~r0   r*   N)__name__
__module____qualname____firstlineno__r.   r2   __static_attributes__ r0   r   r&   r&   \   s    'r0   r&   c               #      #    [         R                  " SSS9 n SSS.n[        U[        R                  5      U l        U v   S S S 5        g ! , (       d  f       g = f7f)N8google.auth.transport.requests.AuthorizedSession.requestTr   r   c2lnbmF0dXJl)keyId
signedBlob)r   r   r&   http_clientOKr   auth_sessionr   s     r   mock_authorizedsession_signrC   e   sK     	BT
	N;$0{~~$F!
 
 
s   A)A
	A

AAc               #      #    [         R                  " SSS9 n S[        0n[        U[        R
                  5      U l        U v   S S S 5        g ! , (       d  f       g = f7f)Nr;   Tr   token)r   r   ID_TOKEN_DATAr&   r?   r@   r   rA   s     r   mock_authorizedsession_idtokenrG   o   sK     	BT
	'$0{~~$F!
 
 
s   A,A	A
AAc                      \ rS rSrSrSrS/r/ rSr\	R                  " \\\5      r\R                  " SS9rSS	R!                  \5      -   r\\\S
S
4S jrS rS rS rS rS rS rS rS rS r\R:                  S
S
S4S jrS r\ RB                  RE                  SSS/5      S 5       r#\ RB                  RE                  SSS/5      S 5       r$\ RB                  RE                  SSS/5      S 5       r%\ RB                  RE                  SSS/5      S 5       r&\ RB                  RE                  SSS /5      S! 5       r'S" r(S# r)S$ r*S% r+S& r,S' r-S( r.S) r/S* r0S+ r1S, r2S- r3S. r4\5Rl                  " S/S
S09S1 5       r7S2 r8\ RB                  RE                  SSS/5      S3 5       r9S4 r:S5 r;S6 r<S7 r=S8 r>S9 r?S: r@S; rAS< rBS= rCS> rDS? rES@ rFSA rGSBrHg
)CTestImpersonatedCredentialsy   zservice-account@example.com,impersonated@project.iam.gserviceaccount.comz4https://www.googleapis.com/auth/devstorage.read_onlyi  ABCDE)rE   z<https://us-east1-iamcredentials.googleapis.com/v1/projects/-z'/serviceAccounts/{}:generateAccessTokenNc           
      H    [        UUU R                  U R                  UUUS9$ )N)source_credentialstarget_principaltarget_scopes	delegateslifetimesubjectiam_endpoint_override)r   TARGET_SCOPES	DELEGATES)r-   rN   rR   rO   rS   rT   s         r   make_credentials,TestImpersonatedCredentials.make_credentials   s0     1-,,nn"7
 	
r0   c                     [         R                  R                  [        5      n[	        U[         R                  5      (       d   eg r)   )r   r   &from_impersonated_service_account_info8IMPERSONATED_SERVICE_ACCOUNT_AUTHORIZED_USER_SOURCE_INFO
isinstancer-   r	   s     r   +test_from_impersonated_service_account_infoGTestImpersonatedCredentials.test_from_impersonated_service_account_info   s7    .::aaD
 +'?'K'KLLLLr0   c                 `   [         R                  " [        5      nSU;   d   eSUS   S'   [        R                  " [
        R                  5       n[        R                  R                  U5        S S S 5        WR                  SR                  S5      5      (       d   eg ! , (       d  f       N6= f)NrN   invalid_typetypez-source credential of type {} is not supported)copydeepcopyr[   pytestraisesr   DefaultCredentialsErrorr   r   rZ   matchformatr-   infoexcinfos      r   Ptest_from_impersonated_service_account_info_with_invalid_source_credentials_typelTestImpersonatedCredentials.test_from_impersonated_service_account_info_with_invalid_source_credentials_type   s     }}UV#t+++-;!"6*]]:==>'$00WW ? }};BB>R
 
 	
 
	 ?>s    B
B-c                 ,   [         R                  " [        5      nSUS'   [        R                  " [
        R                  5       n[        R                  R                  U5        S S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)Ninvalid_url!service_account_impersonation_urlz$Cannot extract target principal from)rc   rd   r[   re   rf   r   rg   r   r   rZ   rh   rj   s      r   Jtest_from_impersonated_service_account_info_with_invalid_impersonation_urlfTestImpersonatedCredentials.test_from_impersonated_service_account_info_with_invalid_impersonation_url   so     }}UV4A01]]:==>'$00WW ? }}DEEEE	 ?>s    B
Bc                     U R                  5       nUR                  " 5       (       a   eSUl        UR                  " 5       SSSS.:X  d   eg )N/path/to/filezimpersonated credentialsrK   )credential_sourcecredential_type	principal)rW   get_cred_info_cred_file_pathr]   s     r   test_get_cred_info.TestImpersonatedCredentials.test_get_cred_info   sV    ++-,,....&5#((*!09G/
 
 	
 
r0   c                     [         R                  " [        S[        SS9nU R	                  US9nUR
                  S:X  d   eg )Nsome@email.comfoo.baruniverse_domainrN   )r
   r   SIGNER	TOKEN_URIrW   r   r-   rN   r	   s      r   $test_universe_domain_matching_source@TestImpersonatedCredentials.test_universe_domain_matching_source   sG    ,88$i
 ++?Q+R**i777r0   c                 x    U R                  5       nSUl        UR                  " 5       nUR                  S:X  d   eg )Nru   )rW   rz   
_make_copy)r-   r	   	cred_copys      r   test__make_copy_get_cred_info9TestImpersonatedCredentials.test__make_copy_get_cred_info   s:    ++-&5#**,	((O;;;r0   c                     U R                  U R                  S9nUR                  (       a   eUR                  (       d   eg )Nr   )rW   USER_SOURCE_CREDENTIALSvalidexpiredr]   s     r   test_make_from_user_credentials;TestImpersonatedCredentials.test_make_from_user_credentials   s@    ++#;; , 
 $$$$""""r0   c                 p    U R                  5       nUR                  (       a   eUR                  (       d   eg r)   )rW   r   r   r]   s     r   test_default_state.TestImpersonatedCredentials.test_default_state   s.    ++-$$$$""""r0   c                     [         R                  " [        U R                  [        SS9nU R                  US9nUR                  R                  (       d   eUR                  R                  (       d   eg )NT)always_use_jwt_accessr   )	r
   r   r   SERVICE_ACCOUNT_EMAILr   rW   _source_credentials_always_use_jwt_access_jwt_credentialsr   s      r   .test_make_from_service_account_self_signed_jwtJTestImpersonatedCredentials.test_make_from_service_account_self_signed_jwt   sc    ,88D..	QU
 ++?Q+R..EEEE..????r0   Tc                    [         R                  " [        R                  SS9nX&l        U(       a  [
        R                  " U5      OUUl        U=(       d    0 Ul        [         R                  " [        R                  SS9nXGl
        Xgl        U$ )NFinstance)r   create_autospecr   Responsestatusr   to_bytesr   headersRequestside_effectr   )r-   r   r   r   r   use_data_bytesresponserequests           r   make_request(TestImpersonatedCredentials.make_request   sl     ''	(:(:UK 3A))$/t"=b&&y'8'85I)'r0   c                     U R                  5       nSUl        S Ul        0 nUR                  " [        R
                  " 5       S S U5        US   S:X  d   eUS   S:X  d   eg )NrE   authorizationzBearer tokenx-goog-api-clientzcred-type/imp)rW   rE   expirybefore_requestr   Mock)r-   r	   r   s      r   test_token_usage_metrics4TestImpersonatedCredentials.test_token_usage_metrics   sf    ++-#!""499;dGD'>999*+>>>r0   r   Fc                 H   U R                  S S9nSn[        R                  " 5       R                  SS9[        R
                  " SS9-   R                  S5      S-   nXES	.nU R                  [        R                  " U5      [        R                  US
9n[        R                  " S[        S9   UR                  " U5        S S S 5        UR                   (       d   eUR"                  (       a   eUR$                  R&                  S   S   [        :X  d   eg ! , (       d  f       N[= f)NrR   rE   r   microsecondr   r   TZaccessToken
expireTimer   r   r   :google.auth.metrics.token_request_access_token_impersonater   r   r   )rW   r   r   replacer   r   	isoformatr   r2   dumpsr?   r@   r   r   )ACCESS_TOKEN_REQUEST_METRICS_HEADER_VALUErefreshr   r   	call_argskwargs)r-   r   r    r	   rE   expire_timeresponse_bodyr   s           r   test_refresh_success0TestImpersonatedCredentials.test_refresh_success  s   ++T+: OO%%!%4x7I7IRU7VV
)C.3 ).I##M*>>) $ 
 ZZHB
 (	
     &&&&$$Y/0CD89	
9
 
s   +D
D!c                    U R                  SS S9nSS0nU R                  [        R                  " U5      [        R
                  US9n[        R                  " S[        S9   UR                  " U5        S S S 5        UR                  (       d   eUR                  (       a   eUR                  S:X  d   eg ! , (       d  f       NG= f)	Ntest@email.com)rS   rR   	signedJwtexample_signed_jwtr   r   r   r#   )rW   r   r2   r   r?   r@   r   r   r   r   r   r   rE   )r-   r   r$   r	   r   r   s         r   !test_refresh_with_subject_success=TestImpersonatedCredentials.test_refresh_with_subject_success%  s    ++4Dt+T$&:;##M*>>) $ 
 ZZHB
 (	
     &&&&  $====
 
s   !B55
Cc                 
   [         R                  " [        S[        SS9nU R	                  S US9nSn[
        R                  " 5       R                  SS9[        R                  " SS	9-   R                  S
5      S-   nXVS.nU R                  [        R                  " U5      [        R                  US9nUR                   " U5        UR"                  (       d   eUR$                  (       a   eUR&                  S   n	U	S   S:X  d   eg )Nr~   r   r   rR   rN   rE   r   r   r   r   r   r   r   r      urlz}https://iamcredentials.foo.bar/v1/projects/-/serviceAccounts/impersonated@project.iam.gserviceaccount.com:generateAccessToken)r
   r   r   r   rW   r   r   r   r   r   r   r   r2   r   r?   r@   r   r   r   r   )
r-   r   r    rN   r	   rE   r   r   r   request_kwargss
             r   test_refresh_success_nonGdu7TestImpersonatedCredentials.test_refresh_success_nonGdu;  s   ,88$i
 ++.@ , 
  OO%%!%4x7I7IRU7VV
)C.3 ).I##M*>>) $ 
 	G$    &&&& **1-5! OO	
Or0   c                    U R                  S U R                  S9nSn[        R                  " 5       R	                  SS9[
        R                  " SS9-   R                  S5      S-   nXES	.nU R                  [        R                  " U5      [        R                  US
9nUR                  " U5        UR                  (       d   eUR                  (       a   eUR                   S   nUS   U R                  :X  d   eg )NrR   rT   rE   r   r   r   r   r   r   r   r   r   r   )rW   IAM_ENDPOINT_OVERRIDEr   r   r   r   r   r   r   r2   r   r?   r@   r   r   r   r   )	r-   r   r    r	   rE   r   r   r   r   s	            r   *test_refresh_success_iam_endpoint_overrideFTestImpersonatedCredentials.test_refresh_success_iam_endpoint_override[  s     ++1K1K , 
  OO%%!%4x7I7IRU7VV
)C.3 ).I##M*>>) $ 
 	G$    &&&& **1-e$(B(BBBBr0   	time_skew   ijc                    U R                  S S9n[        R                  " 5       [        R                  -   [        R
                  " US9-   UR                  l        SUR                  l        [        R                  " SSS9 n[        R                  " 5       R                  SS9[        R
                  " S	S9-   R                  S
5      S-   nSUS.nU R                  [        R                  " U5      [         R"                  S9nUR$                  " U5        UR&                  (       d   eUR(                  (       a   eUS:  a  UR+                  5         OUR-                  5         S S S 5        g ! , (       d  f       g = f)Nr   r   Tokenz1google.oauth2.service_account.Credentials.refreshTr   r   r   r   r   r   rE   r   r   r   )rW   r   r   REFRESH_THRESHOLDr   r   r   r   rE   r   r   r   r   r   r2   r   r?   r@   r   r   r   assert_not_calledassert_called_once)r-   r   r	   source_cred_refreshr   r   r   s          r   test_refresh_source_credentials;TestImpersonatedCredentials.test_refresh_source_credentialsw  sC   ++T+: OO(()  34 	''.
 18''-ZZ?$
 !))a)8$$S12ins#K -4;OM''ZZ.{~~ ( G ($$$$"**** 1}#557#668-
 
 
s    C E))
E7c                 <   U R                  S S9nSn[        R                  " 5       [        R                  " SS9-   R                  S5      nX4S.nU R                  [        R                  " U5      [        R                  S9n[        R                  " [        R                  5       nUR                  " U5        S S S 5        WR!                  ["        R$                  5      (       d   eUR&                  (       a   eUR(                  (       d   eg ! , (       d  f       N[= f)Nr   rE   r   r   r   r   r   )rW   r   r   r   r   r   r   r2   r   r?   r@   re   rf   r   RefreshErrorr   rh   r   _REFRESH_ERRORr   r   )r-   r    r	   rE   r   r   r   rl   s           r   *test_refresh_failure_malformed_expire_timeFTestImpersonatedCredentials.test_refresh_failure_malformed_expire_time  s    ++T+:(8+=+=c+JJUU
 ).I##M*;>> $ 
 ]]:223w( 4 }}5DDEEEE$$$$"""" 43s   %D
Dc                    U R                  S S9nSSSSS.0nU R                  [        R                  " U5      [        R
                  S9n[        R                  " [        R                  5       nUR                  " U5        S S S 5        WR                  [        R                  5      (       d   eUR                  (       a   eUR                  (       d   eg ! , (       d  f       N[= f)Nr   error  z#The caller does not have permissionPERMISSION_DENIED)codemessager   r   )rW   r   r2   r   r?   UNAUTHORIZEDre   rf   r   r   r   rh   r   r   r   r   r-   r    r	   r   r   rl   s         r    test_refresh_failure_unauthorzed<TestImpersonatedCredentials.test_refresh_failure_unauthorzed  s    ++T+: @-
 ##M*;3K3K $ 
 ]]:223w( 4 }}5DDEEEE$$$$"""" 43s   .C
C$c                 6   U R                  S S9nS Ul        SUl        [        R                  " USS9n[
        R                  " [        R                  SS9n[        R                  Ul        [
        R                  " SS9Ul        [
        R                  " S	US9   [        R                   " ["        R$                  5       nUR'                  S 5        S S S 5        S S S 5        WR)                  S
5      (       d   eg ! , (       d  f       N/= f! , (       d  f       N8= f)Nr   rE   audiencetarget_audienceFr   zfailed to get ID tokenr   5google.auth.transport.requests.AuthorizedSession.postzError getting ID token)rW   r   rE   r   IDTokenCredentialsr   r   r   r   r?   r   r,   r   r2   r   re   rf   r   r   r   rh   )r-   r	   id_credsr   rl   s        r   test_refresh_failure0TestImpersonatedCredentials.test_refresh_failure  s    ++T+:!#+>>
 ''	(:(:UK*77		/GHZZC!
 z6677  & 8	
 }}56666 87	
 
s$   %D
>C9D
9
D	D


Dc                    U R                  S S9n0 nU R                  [        R                  " U5      [        R
                  S9n[        R                  " [        R                  5       nUR                  " U5        S S S 5        WR                  [        R                  5      (       d   eUR                  (       a   eUR                  (       d   eg ! , (       d  f       N[= f)Nr   r   )rW   r   r2   r   r?   HTTPExceptionre   rf   r   r   r   rh   r   r   r   r   r   s         r   test_refresh_failure_http_error;TestImpersonatedCredentials.test_refresh_failure_http_error  s    ++T+:##M*;3L3L $ 
 ]]:223w( 4 }}5DDEEEE$$$$"""" 43s   (C
Cc                 T   [         R                  " [        S[        SS9nU R	                  USS9n[
        R                  " 5       R                  SS9R                  S5      S	-   nS
US.nU R                  [        R                  " U5      [        R                  S9n[        R                  " [         R"                  5       nUR$                  " U5        S S S 5        WR'                  S5      (       d   eUR(                  (       a   eUR*                  (       d   eg ! , (       d  f       NM= f)Nr~   r   r   r   )rN   rS   r   r   r   r   rE   r   r   zNDomain-wide delegation is not supported in universes other than googleapis.com)r
   r   r   r   rW   r   r   r   r   r   r2   r   r?   r@   re   rf   r   GoogleAuthErrorr   rh   r   r   )r-   r    rN   r	   r   r   r   rl   s           r   3test_refresh_failure_subject_with_nondefault_domainOTestImpersonatedCredentials.test_refresh_failure_subject_with_nondefault_domain  s    -88$i
 ++1;K , 
  (00Q0?JJ3ORUU(/{K##M*;>> $ 
 ]]:556'( 7 }}$
 
 	
 

 $$$$"""" 76s   ?D
D'c                 H    U R                  S S9nUR                  (       d   eg )Nr   )rW   r   r]   s     r   test_expired(TestImpersonatedCredentials.test_expired
  s$    ++T+:""""r0   c                 z    U R                  5       n[        UR                  [        R                  5      (       d   eg r)   )rW   r\   signerr   r   r]   s     r   test_signer'TestImpersonatedCredentials.test_signer  s0    ++-+,,.F.R.RSSSSr0   c                 n    U R                  U R                  S9nUR                  U R                  :X  d   eg N)rO   )rW   TARGET_PRINCIPALsigner_emailr]   s     r   test_signer_email-TestImpersonatedCredentials.test_signer_email  s5    ++T=R=R+S''4+@+@@@@r0   c                 n    U R                  U R                  S9nUR                  U R                  :X  d   eg r  )rW   r  service_account_emailr]   s     r   test_service_account_email6TestImpersonatedCredentials.test_service_account_email  s5    ++T=R=R+S00D4I4IIIIr0   c                 N    U R                  S S9nSnU R                  UUUU5        g )Nr   zyhttps://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/impersonated@project.iam.gserviceaccount.com:signBlob)rW   _sign_bytes_helper)r-   r    rC   r	   expected_urls        r   test_sign_bytes+TestImpersonatedCredentials.test_sign_bytes  s7    ++T+: S"'		
r0   c                     [         R                  " [        S[        SS9nU R	                  S US9nSnU R                  UUUU5        g )Nr~   r   r   r   zrhttps://iamcredentials.foo.bar/v1/projects/-/serviceAccounts/impersonated@project.iam.gserviceaccount.com:signBlob)r
   r   r   r   rW   r  )r-   r    rC   rN   r	   r  s         r   test_sign_bytes_nonGdu2TestImpersonatedCredentials.test_sign_bytes_nonGdu$  s^     -88$i
 ++.@ , 
 L"'		
r0   c           	         Sn[         R                  " 5       R                  SS9[        R                  " SS9-   R                  S5      S-   nXVS.n[        R                  " [        R                  S	S
9n[        R                  Ul        [         R                  " [        R                  " U5      5      Ul        [        R                  " [        R"                  S	S
9n	Xl        UR&                  " U	5        UR(                  (       d   eUR*                  (       a   eUR,                  " S5      n
UR/                  [        R0                  SUS S/ S.SS0S9  U
S:X  d   eg )NrE   r   r   r   r   r   r   r   Fr   s   signed bytesPOSTc2lnbmVkIGJ5dGVz)payloadrQ   zContent-Typezapplication/json)r2   r   s	   signature)r   r   r   r   r   r   r   r   r   r   r?   r@   r   r   r2   r   r   r   r   r   r   r   
sign_bytesassert_called_withANY)r-   r	   r    rC   r  rE   r   token_response_bodyr   r   	signatures              r   r  .TestImpersonatedCredentials._sign_bytes_helper5  s.     OO%%!%4x7I7IRU7VV
)C.3 /4O''	(:(:UK%.. ))$**5H*IJ&&y'8'85I'G$    &&&&**?;	#66HH/bA#%78 	7 	
 L(((r0   c                    U R                  S S9n[        R                  " SSS9 nSSSS.0n[        U[        R
                  5      nXBl        [        R                  " [        R                  5       nUR                  " S	5        S S S 5        WR                  S
5      (       d   e S S S 5        g ! , (       d  f       N0= f! , (       d  f       g = f)Nr   r;   Tr   r   r   unauthorizedr   r      fooz'code': 403)rW   r   r   r&   r?   r   r   re   rf   r   TransportErrorr&  rh   )r-   r	   rB   r   mock_responserl   s         r   test_sign_bytes_failure3TestImpersonatedCredentials.test_sign_bytes_failureZ  s    ++T+:ZZFQU
cnEFD({/G/GHM(5%z889W&&v. :==////
 
 :9
 
$   AB?1B. B?.
B<	8B??
Cz
time.sleepr   c                    U R                  S S9n[        R                  " SSS9 nSSSS.0n[        U[        R
                  5      nXSl        [        R                  " [        R                  5       nUR                  " S	5        S S S 5        WR                  S
5      (       d   e S S S 5        g ! , (       d  f       N0= f! , (       d  f       g = f)Nr   r;   Tr   r   r   internal_failurer.  r/  z#exhausted signBlob endpoint retries)rW   r   r   r&   r?   INTERNAL_SERVER_ERRORr   re   rf   r   r0  r&  rh   )r-   	mock_timer	   rB   r   r1  rl   s          r   !test_sign_bytes_retryable_failure=TestImpersonatedCredentials.test_sign_bytes_retryable_failureh  s    ++T+:ZZFQU
c6HIJD({/P/PQM(5%z889W&&v. :==!FGGGG
 
 :9
 
r4  c                 l    U R                  5       nUR                  " S5      nUR                  S:X  d   eg )Nproject-foo)rW   with_quota_project_quota_project_id)r-   r	   quota_project_credss      r   test_with_quota_project3TestImpersonatedCredentials.test_with_quota_projectw  s5    ++-)<<]K"44EEEr0   c                    U R                  S U R                  S9nSnUR                  " S5      n[        R                  " 5       R                  SS9[        R                  " SS9-   R                  S5      S	-   nXFS
.nU R                  [        R                  " U5      [        R                  US9nUR                  U5        UR                  (       d   eUR                   (       a   eUR"                  S   n	U	S   U R                  :X  d   eg )Nr   rE   r<  r   r   r   r   r   r   r   r   r   r   )rW   r   r=  r   r   r   r   r   r   r   r2   r   r?   r@   r   r   r   r   )
r-   r   r    r	   rE   r?  r   r   r   r   s
             r   -test_with_quota_project_iam_endpoint_overrideITestImpersonatedCredentials.test_with_quota_project_iam_endpoint_override}  s    ++1K1K , 
 )<<]K OO%%!%4x7I7IRU7VV
)C.3 ).I##M*>>) $ 
 	##G,"((((&.... **1-e$(B(BBBBr0   c                     U R                  5       n/ Ul        UR                  SL d   eUR                  " SS/5      nUR                  SL d   eUR                  SS/:X  d   eg )NTfake_scope1fake_scope2F)rW   _target_scopesrequires_scopeswith_scopesr]   s     r   test_with_scopes,TestImpersonatedCredentials.test_with_scopes  sn    ++-%'"**d222!--}m.LM**e333))m]-KKKKr0   c                 ~    U R                  5       n/ Ul        UR                  " S/S/S9nUR                  S/:X  d   eg )NrF  rG  )default_scopes)rW   rH  rJ  r]   s     r   'test_with_scopes_provide_default_scopesCTestImpersonatedCredentials.test_with_scopes_provide_default_scopes  sI    ++-%'"!--O]O
 ))m_<<<r0   c                 t   U R                  S S9nSnSn[        R                  " 5       R                  SS9[        R
                  " SS9-   R                  S5      S	-   nXFS
.nU R                  [        R                  " U5      [        R                  S9nUR                  " U5        UR                  (       d   eUR                  (       a   e[        R                   " X5S9n	U	R                  U5        U	R"                  [$        :X  d   eU	R&                  [        R                  R)                  [*        5      :X  d   eg )Nr   rE   https://foo.barr   r   r   r   r   r   r   r   r   )rW   r   r   r   r   r   r   r   r2   r   r?   r@   r   r   r   r   r   rE   rF   r   utcfromtimestampID_TOKEN_EXPIRY
r-   r    rG   r	   rE   r   r   r   r   r   s
             r   test_id_token_success1TestImpersonatedCredentials.test_id_token_success  s    ++T+:+ OO%%!%4x7I7IRU7VV
)C.3 ).I##M*;>> $ 
 	G$    &&&&+>>
 	!~~...("3"3"D"D_"UUUUr0   c                 ~   U R                  S S9nSUl        S Ul        Sn[        R                  " X#S9n[
        R                  " S[        S9   [
        R                  " SSS	9 nS[        0n[        U[        R                  5      Ul        UR                  S 5        UR                  [        :X  d   eUR                  [        R                  R                  [         5      :X  d   eUR"                  R$                  S
   S   [        :X  d   e S S S 5        S S S 5        g ! , (       d  f       N= f! , (       d  f       g = f)Nr   rE   rR  r   z6google.auth.metrics.token_request_id_token_impersonater   r   Tr   r   r   )rW   rE   r   r   r   r   r   %ID_TOKEN_REQUEST_METRICS_HEADER_VALUErF   r&   r?   r@   r   r   r   rS  rT  r   r   )r-   r    r	   r   r   	mock_postr   s          r   test_id_token_metrics1TestImpersonatedCredentials.test_id_token_metrics  s$   ++T+:#!++>>
 ZZD>
 GRV/)5dKNN)K	&  &~~666(*;*;*L*L#+    ''..y9:MN<==	
 
 	
 
s%   D.#B(DD.
D+	'D..
D<c                 n    U R                  S S9nU R                  S S9nSnU R                  UUUUU5        g )Nr   zhttps://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/impersonated@project.iam.gserviceaccount.com:generateIdToken)rW   _test_id_token_helper)r-   r    rG   r	   target_credentialsr  s         r   test_id_token_from_credential9TestImpersonatedCredentials.test_id_token_from_credential  sP     ++T+:!22D2A Z"""*	
r0   c                     [         R                  " [        S[        SS9nU R	                  S US9nU R	                  S US9nSnU R                  UUUUU5        g )Nr~   r   r   r   zyhttps://iamcredentials.foo.bar/v1/projects/-/serviceAccounts/impersonated@project.iam.gserviceaccount.com:generateIdToken)r
   r   r   r   rW   r^  )r-   r    rG   rN   r	   r_  r  s          r   $test_id_token_from_credential_nonGdu@TestImpersonatedCredentials.test_id_token_from_credential_nonGdu  s     -88$i
 ++.@ , 
 "22.@ 3 
 S"""*	
r0   c                    SnSn[         R                  " 5       R                  SS9[        R                  " SS9-   R                  S5      S-   nXhS	.n	U R                  [        R                  " U	5      [        R                  S
9n
UR                  " U
5        UR                  (       d   eUR                  (       a   e[        R                  " XSS9nUR!                  US9nUR                  U
5        UR"                  R$                  nUS   U:X  d   eUR&                  [(        :X  d   eUR*                  SL d   eUR,                  UL d   eg )NrE   rR  r   r   r   r   r   r   r   r   T)r   include_email)r_     )r   r   r   r   r   r   r   r2   r   r?   r@   r   r   r   r   r   from_credentialsr   argsrE   rF   _include_email_target_credentials)r-   r	   r_  r    rG   r  rE   r   r   r   r   r   ri  s                r   r^  1TestImpersonatedCredentials._test_id_token_helper	  sA    + OO%%!%4x7I7IRU7VV
)C.3 ).I##M*;>> $ 
 	G$    &&&&+>>
 ,,@R,S!-77<<Aw,&&&~~...&&$...++/AAAAr0   c                    U R                  S S9nSnSn[        R                  " 5       R                  SS9[        R
                  " SS9-   R                  S5      S	-   nXFS
.nU R                  [        R                  " U5      [        R                  S9nUR                  " U5        UR                  (       d   eUR                  (       a   e[        R                   " USS9n	U	R#                  US9n	U	R                  U5        U	R$                  [&        :X  d   eU	R(                  [        R                  R+                  [,        5      :X  d   eU	R.                  SL d   eg )Nr   rE   rR  r   r   r   r   r   r   r   r   T)rf  r   )rW   r   r   r   r   r   r   r   r2   r   r?   r@   r   r   r   r   r   with_target_audiencerE   rF   r   rS  rT  rj  rU  s
             r   "test_id_token_with_target_audience>TestImpersonatedCredentials.test_id_token_with_target_audience0  s>    ++T+:+ OO%%!%4x7I7IRU7VV
)C.3 ).I##M*;>> $ 
 	G$    &&&&+>>t
 000Q!~~...("3"3"D"D_"UUUU&&$...r0   c                     S n[         R                  " [        R                  5       n[        R
                  " U5        S S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)Nz4Provided Credential must be impersonated_credentials)re   rf   r   r  r   r   rh   )r-   r    rG   r	   rl   s        r   test_id_token_invalid_cred6TestImpersonatedCredentials.test_id_token_invalid_credO  sQ     ]]:556'$77D 7 }}VWWWW 76s   A
A-c                 0   U R                  S S9nSnSn[        R                  " 5       R                  SS9[        R
                  " SS9-   R                  S5      S	-   nXFS
.nU R                  [        R                  " U5      [        R                  S9nUR                  " U5        UR                  (       d   eUR                  (       a   e[        R                   " X5S9n	U	R#                  S5      n	U	R                  U5        U	R$                  [&        :X  d   eg )Nr   rE   rR  r   r   r   r   r   r   r   r   r   T)rW   r   r   r   r   r   r   r   r2   r   r?   r@   r   r   r   r   r   with_include_emailrE   rF   rU  s
             r    test_id_token_with_include_email<TestImpersonatedCredentials.test_id_token_with_include_emailY  s    ++T+:+ OO%%!%4x7I7IRU7VV
)C.3 ).I##M*;>> $ 
 	G$    &&&&+>>
 ..t4!~~...r0   c                 (   U R                  S S9nSnSn[        R                  " 5       R                  SS9[        R
                  " SS9-   R                  S5      S	-   nXFS
.nU R                  [        R                  " U5      [        R                  S9nUR                  " U5        UR                  (       d   eUR                  (       a   e[        R                   " X5S9n	U	R#                  S5      n	U	R                  U5        U	R$                  S:X  d   eg )Nr   rE   rR  r   r   r   r   r   r   r   r   r   r<  )rW   r   r   r   r   r   r   r   r2   r   r?   r@   r   r   r   r   r   r=  quota_project_idrU  s
             r    test_id_token_with_quota_project<TestImpersonatedCredentials.test_id_token_with_quota_projectv  s    ++T+:+ OO%%!%4x7I7IRU7VV
)C.3 ).I##M*;>> $ 
 	G$    &&&&+>>
 ..}=!((M999r0   c                 L   SnSnSUS.nU R                  [        R                  " U5      [        R                  S9n[
        R                  " XA0 0 S9nXR:X  d   eUR                  SS0 [        R                  " / [        R                  " 0 5      S	.5      R                  S
5      S9  g )Nfoo@example.comcorrect_signed_jwtr   )r=   r   r   r   rx   r   r%  z[https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/foo@example.com:signJwtr#  )rQ   r%  zutf-8)r   methodr   body)	r   r2   r   r?   r@   r   _sign_jwt_requestassert_called_once_withencode)r-   rx   expected_signed_jwtr   r   
signed_jwts         r   test_sign_jwt_request_success9TestImpersonatedCredentials.test_sign_jwt_request_success  s    %	2"%4GH##M*;>> $ 
 .??"b

 000''m"BHIPP	 	( 	
r0   c                    SnU R                  S[        R                  S9n[        R                  " [
        R                  5       n[        R                  " X!0 0 S9nS S S 5        WR                  [        R                  5      (       d   eUR                  R                  S   S:X  d   eUR                  R                  S   S:X  d   eg ! , (       d  f       Ns= f)Nr}  error_messager   r  r   z*Unable to acquire impersonated credentialsr   )r   r?   BAD_REQUESTre   rf   r   r   r   r  rh   r   valueri  r-   rx   r   rl   _s        r    test_sign_jwt_request_http_error<TestImpersonatedCredentials.test_sign_jwt_request_http_error  s    %	## )@)@ $ 
 ]]:223w(::b"A 4
 }}5DDEEEE}}!!!$(TTTT}}!!!$777 43   C		
Cc                    SnU R                  S[        R                  S9n[        R                  " [
        R                  5       n[        R                  " X!0 0 S9nS S S 5        WR                  [        R                  5      (       d   eUR                  R                  S   S:X  d   eUR                  R                  S   S:X  d   eg ! , (       d  f       Ns= f)Nr}  invalid_datar   r  r   zFUnable to acquire impersonated credentials: No signed JWT in response.r   )r   r?   r@   re   rf   r   r   r   r  rh   r   r  ri  r  s        r   ,test_sign_jwt_request_invalid_response_errorHTestImpersonatedCredentials.test_sign_jwt_request_invalid_response_error  s    %	###O]]:223w(::b"A 4
 }}5DDEEEE MMq!WX	
X }}!!!$666 43r  r9   )Ir4   r5   r6   r7   r   r  rU   rV   LIFETIMEr
   r   r   r   SOURCE_CREDENTIALSr	   r   ri   r   rW   r^   rm   rr   r{   r   r   r   r   r   r?   r@   r   r   re   markparametrizer   r   r   r   r   r   r   r   r  r  r
  r  r  r  r  r   r  r2  r   r   r9  r@  rC  rK  rO  rV  r[  r`  rc  r^  ro  rr  rv  rz  r  r  r  r8   r9   r0   r   rI   rI   y   s   9EKLM IH(44%y *55GDF
3
:
:;P
Q	R  .)"
&M
	F	
8<##
@ ~~&? [[-e}=
 >
8 [[-e}=> >>* [[-e}=
 >
> [[-e}=C >C6 [[[3+6#9 7#9J#*#.7*#"#6#TAJ

"#)J0 
ZZ40H 1HF [[-e}=C >C:L=V:<

*%BN/>X/:::
.8"7r0   rI   )2rc   r   http.clientclientr?   r2   osr   re   google.authr   r   r   r   r   $google.auth.impersonated_credentialsr   google.oauth2r	   r
   pathjoindirname__file__DATA_DIRopenfhreadPRIVATE_KEY_BYTESSERVICE_ACCOUNT_JSON_FILE8IMPERSONATED_SERVICE_ACCOUNT_AUTHORIZED_USER_SOURCE_FILErF   rT  loadSERVICE_ACCOUNT_INFOr[   	RSASignerfrom_stringr   r   r   rY  fixturer    r$   r&   rC   rG   objectrI   r9   r0   r   <module>r     s     !  	      " 0 ! < % )77<<12v>	"'',,x!1
2D9R	 : GGLL3IJ ;=77<<H< 8
  	
#T*b99R= + 

BDIR?Cyy}< J 
	$	$%6	<.	 @ * @ &
         R7& R7m :9$ +* JIs$   (GG*G(
G
G%(
G6