
    ;                         S SK r S SKrS SKrS SKrS SKrS SKJr  S SKJr  S SKJ	r	  S SK
Jr  SrSrSrS	rS
rSR#                  \5      r\\-   rSrSS/rSrSrSrSrSr/ SQr/ SQr/ SQr/ SQr " S S\5      r g)    N)
exceptions)	pluggable)DEFAULT_UNIVERSE_DOMAIN)WORKFORCE_AUDIENCEusernamepasswordzdXNlcm5hbWU6cGFzc3dvcmQ=z1service-1234@service-name.iam.gserviceaccount.comz.https://us-east1-iamcredentials.googleapis.comz5/v1/projects/-/serviceAccounts/{}:generateAccessTokenQUOTA_PROJECT_IDscope1scope2access_tokenz#https://sts.googleapis.com/v1/tokenz(https://sts.googleapis.com/v1/introspect$urn:ietf:params:oauth:token-type:jwtzi//iam.googleapis.com/projects/123456/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID)	https://sts.googleapis.comz$https://us-east-1.sts.googleapis.comz$https://US-EAST-1.sts.googleapis.comz$https://sts.us-east-1.googleapis.comz$https://sts.US-WEST-1.googleapis.comz$https://us-east-1-sts.googleapis.comz$https://US-WEST-1-sts.googleapis.comz/https://us-west-1-sts.googleapis.com/path?queryz&https://sts-us-east-1.p.googleapis.com)%https://iamcredentials.googleapis.comzsts.googleapis.comhttps://zhttp://sts.googleapis.comzhttps://st.s.googleapis.comz$https://us-eas	-1.sts.googleapis.comz#https:/us-east-1.sts.googleapis.comz%https://US-WE/ST-1-sts.googleapis.comz$https://sts-us-east-1.googleapis.comz$https://sts-US-WEST-1.googleapis.comz(testhttps://us-east-1.sts.googleapis.comz,https://us-east-1.sts.googleapis.comevil.comz.https://us-east-1.us-east-1.sts.googleapis.comz$https://us-ea.s.t.sts.googleapis.comz"https://sts.googleapis.comevil.comz%hhttps://us-east-1.sts.googleapis.comz!https://us- -1.sts.googleapis.comzhttps://-sts.googleapis.comz-https://us-east-1.sts.googleapis.com.evil.comzhttps://sts.pgoogleapis.comhttps://p.googleapis.comzhttps://sts.p.comzhttp://sts.p.googleapis.comz https://xyz-sts.p.googleapis.comz$https://sts-xyz.123.p.googleapis.comz!https://sts-xyz.p1.googleapis.comzhttps://sts-xyz.p.foo.comz$https://sts-xyz.p.foo.googleapis.com)	r   z/https://us-east-1.iamcredentials.googleapis.comz/https://US-EAST-1.iamcredentials.googleapis.comz/https://iamcredentials.us-east-1.googleapis.comz/https://iamcredentials.US-WEST-1.googleapis.comz/https://us-east-1-iamcredentials.googleapis.comz/https://US-WEST-1-iamcredentials.googleapis.comz:https://us-west-1-iamcredentials.googleapis.com/path?queryz1https://iamcredentials-us-east-1.p.googleapis.com)r   ziamcredentials.googleapis.comr   z$http://iamcredentials.googleapis.comz&https://iamcre.dentials.googleapis.comz/https://us-eas	-1.iamcredentials.googleapis.comz.https:/us-east-1.iamcredentials.googleapis.comz0https://US-WE/ST-1-iamcredentials.googleapis.comz/https://iamcredentials-us-east-1.googleapis.comz/https://iamcredentials-US-WEST-1.googleapis.comz3testhttps://us-east-1.iamcredentials.googleapis.comz7https://us-east-1.iamcredentials.googleapis.comevil.comz9https://us-east-1.us-east-1.iamcredentials.googleapis.comz/https://us-ea.s.t.iamcredentials.googleapis.comz-https://iamcredentials.googleapis.comevil.comz0hhttps://us-east-1.iamcredentials.googleapis.comz,https://us- -1.iamcredentials.googleapis.comz&https://-iamcredentials.googleapis.comz8https://us-east-1.iamcredentials.googleapis.com.evil.comz&https://iamcredentials.pgoogleapis.comr   zhttps://iamcredentials.p.comz&http://iamcredentials.p.googleapis.comz+https://xyz-iamcredentials.p.googleapis.comz/https://iamcredentials-xyz.123.p.googleapis.comz,https://iamcredentials-xyz.p1.googleapis.comz$https://iamcredentials-xyz.p.foo.comz/https://iamcredentials-xyz.p.foo.googleapis.comc                      \ rS rSrSrSr\SS\S.rS\0rSrS	S
S\SS.r	S	S
S\S.r
S	S
S\SS.rS	S
S\S.rSrS	S
S\SS.rS	S
S\S.rS	SSSS.rSr\\\\\SSSSSSSSS4S j5       rS r\R4                  R7                  \R:                  SSS9S 5       r\R4                  R7                  \R:                  SSS9S 5       r\R4                  R7                  \R:                  SSS9S  5       r \R4                  R7                  \R:                  SSS9S! 5       r!S" r"S# r#S$ r$S% r%S& r&S' r'S( r(S) r)\R4                  RU                  \+RX                  S*S+05      S, 5       r-\R4                  RU                  \+RX                  S*S+05      S- 5       r.\R4                  RU                  \+RX                  S*S+05      S. 5       r/\R4                  RU                  \+RX                  S*S+05      S/ 5       r0\R4                  RU                  \+RX                  S+S+S0.5      S1 5       r1\R4                  RU                  \+RX                  S*S205      S3 5       r2\R4                  RU                  \+RX                  S*S+05      S4 5       r3\R4                  RU                  \+RX                  S*S+05      S5 5       r4\R4                  RU                  \+RX                  S*S+05      S6 5       r5\R4                  RU                  \+RX                  S*S+05      S7 5       r6\R4                  RU                  \+RX                  S*S+05      S8 5       r7\R4                  RU                  \+RX                  S*S+05      S9 5       r8\R4                  RU                  \+RX                  S*S+05      S: 5       r9\R4                  RU                  \+RX                  S*S+05      S; 5       r:\R4                  RU                  \+RX                  S*S+05      S< 5       r;\R4                  RU                  \+RX                  S*S+05      S= 5       r<\R4                  RU                  \+RX                  S*S+05      S> 5       r=\R4                  RU                  \+RX                  S*S+05      S? 5       r>\R4                  RU                  \+RX                  S*S+05      S@ 5       r?\R4                  RU                  \+RX                  S*S+05      SA 5       r@\R4                  RU                  \+RX                  S*S+05      SB 5       rA\R4                  RU                  \+RX                  S*S+05      SC 5       rB\R4                  RU                  \+RX                  S*S+05      SD 5       rC\R4                  RU                  \+RX                  S*S+05      SE 5       rD\R4                  RU                  \+RX                  S*S+05      SF 5       rE\R4                  RU                  \+RX                  S*S+05      SG 5       rF\R4                  RU                  \+RX                  S*S+05      SH 5       rG\R4                  RU                  \+RX                  S*S+05      SI 5       rH\R4                  RU                  \+RX                  S*S+05      SJ 5       rI\R4                  RU                  \+RX                  S*S205      SK 5       rJ\R4                  RU                  \+RX                  S*S+05      SL 5       rK\R4                  RU                  \+RX                  S*S+05      SM 5       rL\R4                  RU                  \+RX                  S*S+05      SN 5       rM\R4                  RU                  \+RX                  S*S+05      SO 5       rNSPrOg)QTestCredentials   z4/fake/external/excutable --arg1=value1 --arg2=value2fake_output_file0u   )commandtimeout_millisinteractive_timeout_millisoutput_file
executableFAKE_ID_TOKEN   T)urn:ietf:params:oauth:token-type:id_token   c(	 versionsuccess
token_typeid_tokenexpiration_timer"   r#   r$   r%   r   FAKE_SAML_RESPONSEz&urn:ietf:params:oauth:token-type:saml2)r"   r#   r$   saml_responser&   )r"   r#   r$   r)   F401z(Permission denied. Caller not authorized)r"   r#   codemessagezhttp://fakeurl.comNc                 B    [         R                  " UUUUU
UUUUUU	UUS9$ )N)audiencesubject_token_type	token_urltoken_info_url!service_account_impersonation_urlcredential_source	client_idclient_secretquota_project_idscopesdefault_scopesworkforce_pool_user_projectinteractive)r   Credentials)clsr.   r/   r0   r1   r4   r5   r6   r7   r8   r2   r3   r9   r:   s                 Nplatform/gsutil/third_party/google-auth-library-python/tests/test_pluggable.pymake_pluggableTestCredentials.make_pluggable   s>    " $$1).O/'-)(C#
 	
    c           	         [         R                  " [        [        [        [
        U R                  SS9n[        USS5        [        U[         R                  5      (       d   eUR                  (       d   eUR                  S:X  d   eg )NT)r.   r/   r0   r1   r3   r:   _tokeninfo_usernamemock_external_account_id)r   r;   AUDIENCESUBJECT_TOKEN_TYPE	TOKEN_URLTOKEN_INFO_URLCREDENTIAL_SOURCEsetattr
isinstancer:   external_account_idselfcredentialss     r=   #test_from_constructor_and_injection3TestCredentials.test_from_constructor_and_injection   sw    ++1)"44
 	24NO+y'<'<====&&&&..2LLLLr@   __init__return_valuec                    [         R                  R                  [        [        [
        [        [        SS0[        [        [        U R                  S.
5      n[        U[         R                  5      (       d   eUR                  [        [        [
        [        [        SS0[        [        U R                  [        S [        S9  g )Ntoken_lifetime_seconds
  
r.   r/   r0   r1   r2   service_account_impersonationr4   r5   r6   r3   r.   r/   r0   r1   r2   %service_account_impersonation_optionsr4   r5   r3   r6   r9   universe_domain)r   r;   	from_inforD   rE   rF   rG   !SERVICE_ACCOUNT_IMPERSONATION_URL	CLIENT_IDCLIENT_SECRETr	   rH   rJ   assert_called_once_withr   rM   	mock_initrN   s      r=   test_from_info_full_options+TestCredentials.test_from_info_full_options   s    ++55$&8&"05V2JD1Q&!.$4%)%;%;
  +y'<'<====))1).O3KT2R'"44-(,3 	* 	
r@   c                 "   [         R                  R                  [        [        [
        U R                  S.5      n[        U[         R                  5      (       d   eUR                  [        [        [
        S S 0 S S U R                  S S [        S9  g )Nr.   r/   r0   r3   rY   )
r   r;   r\   rD   rE   rF   rH   rJ   r`   r   ra   s      r=   $test_from_info_required_options_only4TestCredentials.test_from_info_required_options_only  s    ++55$&8&%)%;%;	
 +y'<'<====))1.224"44!(,3 	* 	
r@   c                    [         [        [        [        [        SS0[
        [        [        U R                  S.
nUR                  S5      nUR                  [        R                  " U5      5        [        R                  R                  [!        U5      5      n[#        U[        R                  5      (       d   eUR%                  [         [        [        [        [        SS0[
        [        U R                  [        S [&        S9  g )NrU   rV   rW   config.jsonrY   )rD   rE   rF   rG   r]   r^   r_   r	   rH   joinwritejsondumpsr   r;   	from_filestrrJ   r`   r   rM   rb   tmpdirinfoconfig_filerN   s         r=   test_from_file_full_options+TestCredentials.test_from_file_full_options1  s     !"4",1R.F-M"* 0!%!7!7
 kk-0$**T*+++55c+6FG +y'<'<====))1).O3KT2R'"44-(,3 	* 	
r@   c                    [         [        [        U R                  S.nUR	                  S5      nUR                  [        R                  " U5      5        [        R                  R                  [        U5      5      n[        U[        R                  5      (       d   eUR                  [         [        [        S S 0 S S U R                  S S [        S9  g )Nrf   rj   rY   )rD   rE   rF   rH   rk   rl   rm   rn   r   r;   ro   rp   rJ   r`   r   rq   s         r=   $test_from_file_required_options_only4TestCredentials.test_from_file_required_options_onlyT  s     !"4"!%!7!7	
 kk-0$**T*+++55c+6FG +y'<'<====))1.224"44!(,3 	* 	
r@   c                     SS0n[         R                  " [        5       nU R                  US9  S S S 5        WR	                  S5      (       d   eg ! , (       d  f       N'= f)Nunsupportedvaluer3   Missing credential_sourcepytestraises
ValueErrorr>   match)rM   r3   excinfos      r=    test_constructor_invalid_options0TestCredentials.test_constructor_invalid_optionsq  sS    *G4]]:&'2CD ' }}9:::: '&s   A
Ac                     [         R                  " [        5       nU R                  SS9  S S S 5        WR	                  S5      (       d   eg ! , (       d  f       N'= f)Nznon-dictr}   r~   r   )rM   r   s     r=   *test_constructor_invalid_credential_source:TestCredentials.test_constructor_invalid_credential_sourcey  sG    ]]:&'*= ' }}9:::: '&s   A
Ac           	          U R                  U R                  R                  5       S9nUR                  S[        [
        [        [        U R                  [        S.:X  d   eg )Nr}   external_account)typer.   r/   r0   r1   r3   r[   )	r>   rH   copyrs   rD   rE   rF   rG   r   rL   s     r=    test_info_with_credential_source0TestCredentials.test_info_with_credential_source  sc    ))"4499; * 
 & "4",!%!7!76$
 
 	
 
r@   c                 ~    U R                  U R                  R                  5       S9nUR                  [        :X  d   eg )Nr}   )r>   rH   r   r1   rG   rL   s     r=   test_token_info_url#TestCredentials.test_token_info_url  s?    ))"4499; * 
 ))^;;;r@   c                     [          HC  nU R                  U R                  R                  5       US-   S9nUR                  US-   :X  a  MC   e   g )Nz/introspectr3   r1   )VALID_TOKEN_URLSr>   rH   r   r1   rM   urlrN   s      r=   test_token_info_url_custom*TestCredentials.test_token_info_url_custom  sV    #C--"&"8"8"="="? #m 3 . K
 --}1DDDD $r@   c                 z    U R                  U R                  R                  5       S S9nUR                  (       a   eg )Nr   )r>   rH   r   r1   rL   s     r=   test_token_info_url_negative,TestCredentials.test_token_info_url_negative  s?    ))"4499;D * 
 -----r@   c                     [          HC  nU R                  U R                  R                  5       US-   S9nUR                  US-   :X  a  MC   e   g )Nz/token)r3   r0   )r   r>   rH   r   
_token_urlr   s      r=   test_token_url_custom%TestCredentials.test_token_url_custom  sT    #C--"&"8"8"="="?> . K
 ))cHn=== $r@   c                     [          HK  nU R                  U R                  R                  5       U[        -   S9nUR
                  U[        -   :X  a  MK   e   g )N)r3   r2   )(VALID_SERVICE_ACCOUNT_IMPERSONATION_URLSr>   rH   r   'SERVICE_ACCOUNT_IMPERSONATION_URL_ROUTE"_service_account_impersonation_urlr   s      r=   -test_service_account_impersonation_url_custom=TestCredentials.test_service_account_impersonation_url_custom  s_    ;C--"&"8"8"="="?AA . K AA==   <r@   )GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES1c                 *   UR                  S5      nSSUS.nSU0n[        R                  " U R                  5      R	                  S5      [
        U R                  U R                  S.[        U R                  SU R                  S	.[        R                  " U R                  5      R	                  S5      [
        U R                  U R                  S.[        U R                  SU R                  S	.[        R                  " U R                  5      R	                  S5      [
        U R                  U R                  S.[        U R                  SU R                  S	.S
.nUR                  5        GH  n[        US5       n[        R                   " UR#                  S5      U5        S S S 5        [$        R&                  " S[(        R*                  " / UR#                  S5      SS9S9   U R-                  UR#                  S[.        5      UR#                  S5      UUR#                  SS5      S9nUR1                  S 5      n	XR#                  S5      :X  d   e S S S 5        [2        R4                  " U5        GM     g ! , (       d  f       N= f! , (       d  f       N;= f)Nactual_output_filer   r   r   r   r   r   UTF-8)stdoutimpersonation_urlfile_contentexpect_tokenT)r.   r   r:   r   )subject_token_oidc_id_token,subject_token_oidc_id_token_interacitve_modesubject_token_oidc_jwt'subject_token_oidc_jwt_interactive_modesubject_token_saml#subject_token_saml_interactive_modewr   subprocess.runr   r   argsr   
returncoderR   r.   r   r:   Fr.   r2   r3   r:   r   )rk   rm   rn   ,EXECUTABLE_SUCCESSFUL_OIDC_RESPONSE_ID_TOKENencoder]   ?EXECUTABLE_SUCCESSFUL_OIDC_NO_EXPIRATION_TIME_RESPONSE_ID_TOKENEXECUTABLE_OIDC_TOKENr   'EXECUTABLE_SUCCESSFUL_OIDC_RESPONSE_JWT:EXECUTABLE_SUCCESSFUL_OIDC_NO_EXPIRATION_TIME_RESPONSE_JWT#EXECUTABLE_SUCCESSFUL_SAML_RESPONSE6EXECUTABLE_SUCCESSFUL_SAML_NO_EXPIRATION_TIME_RESPONSEEXECUTABLE_SAML_TOKENvaluesopendumpgetmockpatch
subprocessCompletedProcessr>   rD   retrieve_subject_tokenosremove)
rM   rr   /ACTUAL_CREDENTIAL_SOURCE_EXECUTABLE_OUTPUT_FILE#ACTUAL_CREDENTIAL_SOURCE_EXECUTABLEACTUAL_CREDENTIAL_SOURCEtestDatadatar   rN   subject_tokens
             r=   (test_retrieve_subject_token_successfully8TestCredentials.test_retrieve_subject_token_successfully  sP   :@++ ;
7 !*0J/
+
 %12U#V  **EE&/%F $ d d $ : :, / $ d d# $ : :	= **@@&/%F $ _ _ $ : :' / $ _ _# $ : :	8 **T%M%MNUU &G $ [ [ $ : :# / $ [ [# $ : :	4K+
Z OO%D?		$((>2K@
  '88DHHX$61 #11!XXj(;6:hh?R6S&> $ >	 2  !, B B4 H$(@@@@ IIEF) & 
 s   :'I3!A-J3
J	
J	c           	      \   [         R                  " S[        R                  " / [        R
                  " U R                  5      R                  S5      SS9S9   U R                  U R                  S9nUR                  S 5      nX R                  :X  d   e S S S 5        g ! , (       d  f       g = f)Nr   r   r   r   rR   r}   )r   r   r   r   rm   rn   r   r   r>   rH   r   r   )rM   rN   r   s      r=    test_retrieve_subject_token_saml0TestCredentials.test_retrieve_subject_token_saml
  s    ZZ#44zz$"J"JKRR 	
 --@V@V-WK'>>tDM $>$>>>>	
 	
 	
s   <B
B+c                    UR                  S5      nSSUS.nSU0n[        US5       n[        R                  " U R                  U5        S S S 5        [
        R                  " S[        R                  " / SS	9S
9   U R                  [        USS9nUR                  S 5      nXpR                  :X  d   e[        R                  " U5        S S S 5        g ! , (       d  f       N= f! , (       d  f       g = f)Nr   r   r   r   r   r   r   r   r   r   rR   Tr.   r3   r:   )rk   r   rm   r   r   r   r   r   r   r>   r   r   r   r   r   rM   rr   r   r   r   r   rN   r   s           r=   1test_retrieve_subject_token_saml_interactive_modeATestCredentials.test_retrieve_subject_token_saml_interactive_mode  s     ;A++ ;
7 !*0J/
+
 %12U#V A3G;IIKK[ H
 ZZ#44"K
 --+":  . K (>>tDM $>$>>>>IIEF
 
 HG

 
s   "C:AC"
C"
C0c           	         [         R                  " S[        R                  " / [        R
                  " U R                  5      R                  S5      SS9S9   U R                  U R                  S9n[        R                  " [        R                  5       nUR                  S 5      nS S S 5        WR                  S5      (       d   e S S S 5        g ! , (       d  f       N0= f! , (       d  f       g = f)Nr   r   r   r   rR   r}   hExecutable returned unsuccessful response: code: 401, message: Permission denied. Caller not authorized.)r   r   r   r   rm   rn   EXECUTABLE_FAILED_RESPONSEr   r>   rH   r   r   r   RefreshErrorr   r   rM   rN   r   _s       r=   "test_retrieve_subject_token_failed2TestCredentials.test_retrieve_subject_token_failed<  s    ZZ#44zz$"A"ABII'R
 --@V@V-WKz667766t< 8 =={   
 
 87
 
s$   >C"C' C"
C	C""
C0)r   #GOOGLE_EXTERNAL_ACCOUNT_INTERACTIVEc                 n   UR                  S5      nSSUS.nSU0n[        USSS9 n[        R                  " U R                  U5        S S S 5        [
        R                  " S	[        R                  " / S
S9S9   U R                  [        USS9n[        R                  " [        R                  5       nUR                  S 5      nS S S 5        WR!                  S5      (       d   e["        R$                  " U5        S S S 5        g ! , (       d  f       N= f! , (       d  f       NV= f! , (       d  f       g = f)Nr   r   r   r   r   r   utf-8)encodingr   r   r   rR   Tr   r   )rk   r   rm   r   r   r   r   r   r   r>   r   r   r   r   r   r   r   r   r   )	rM   rr   r   r   r   r   rN   r   r   s	            r=   3test_retrieve_subject_token_failed_interactive_modeCTestCredentials.test_retrieve_subject_token_failed_interactive_modeO  s'    ;A++ ;
7 !*0J/
+
 %12U#V ;S7
IId55{C

 ZZ#44"K
 --+":  . K z667766t< 8 =={    IIEF!
 

 
 87
 
s/   "D9:D&3D6D&
D
D#	D&&
D40c           	         [         R                  " S[        R                  " / [        R
                  " U R                  5      R                  S5      SS9S9   U R                  U R                  S9n[        R                  " [        5       nUR                  S 5      nS S S 5        WR                  S5      (       d   e S S S 5        g ! , (       d  f       N0= f! , (       d  f       g = f)Nr   r   r   r   rR   r}   )Executables need to be explicitly allowed)r   r   r   r   rm   rn   r   r   r>   rH   r   r   r   r   r   r   s       r=   &test_retrieve_subject_token_not_allowd6TestCredentials.test_retrieve_subject_token_not_allowdw  s    ZZ#44zzEE&/	
 --@V@V-WKz*g66t< + ==!MNNNN	
 	
 +*	
 	
s$   4CC C
C	C
C&c           	         SSSU R                   SS.n[        R                  " S[        R                  " / [
        R                  " U5      R                  S5      SS	9S
9   U R                  U R                  S9n[        R                  " [        R                  5       nUR                  S 5      nS S S 5        WR                  S5      (       d   e S S S 5        g ! , (       d  f       N0= f! , (       d  f       g = f)N   Tr   r    r!   r   r   r   r   rR   r}   (Executable returned unsupported version.r   r   r   r   r   rm   rn   r   r>   rH   r   r   r   r   r   r   )rM   -EXECUTABLE_SUCCESSFUL_OIDC_RESPONSE_VERSION_2rN   r   r   s        r=   +test_retrieve_subject_token_invalid_version;TestCredentials.test_retrieve_subject_token_invalid_version  s     E22)9
5 ZZ#44zz"OPWW 	
 --@V@V-WKz667766t< 8 ==!LMMMM	
 	
 87	
 	
$   >C*C/ C*
C'	#C**
C8c           	         SSSU R                   SS.n[        R                  " S[        R                  " / [
        R                  " U5      R                  S5      SS9S	9   U R                  U R                  S
9n[        R                  " [        R                  5       nUR                  S 5      nS S S 5        WR                  S5      (       d   e S S S 5        g ! , (       d  f       N0= f! , (       d  f       g = f)Nr   Tr   r   r!   r   r   r   rR   r}   z0The token returned by the executable is expired.r   )rM   +EXECUTABLE_SUCCESSFUL_OIDC_RESPONSE_EXPIREDrN   r   r   s        r=   )test_retrieve_subject_token_expired_token9TestCredentials.test_retrieve_subject_token_expired_token  s     E22 7
3 ZZ#44zz"MNUU 	
 --@V@V-WKz667766t< 8 ==!TUUUU	
 	
 87	
 	
r   c                 V   UR                  S5      nSSUS.nSU0n[        US5       n[        R                  " U R                  U5        S S S 5        U R                  US9nUR                  S 5      nXpR                  :X  d   e[        R                  " U5        g ! , (       d  f       NV= f)Nr   r   r   r   r   r   r   r   r}   )
rk   r   rm   r   r   r>   r   r   r   r   r   s           r=   &test_retrieve_subject_token_file_cache6TestCredentials.test_retrieve_subject_token_file_cache  s    :@++ ;
7 !#J/
+
 %12U#V A3G;IIdGGU H ))<T)U#::4@ : ::::
		AB HGs   "B
B(c           	      Z   SSS.nSU0n[         R                  " S[        R                  " / [        R
                  " U R                  5      R                  S5      SS9S	9   U R                  US
9nUR                  S 5      nX@R                  :X  d   e S S S 5        g ! , (       d  f       g = f)Nr   r   r   r   r   r   r   r   r   rR   r}   )r   r   r   r   rm   rn   r   r   r>   r   r   )rM   r   r   rN   r   s        r=   )test_retrieve_subject_token_no_file_cache9TestCredentials.test_retrieve_subject_token_no_file_cache  s     !#/
+ %12U#V ZZ#44zzEE&/	
 --": . K (>>tDM $>$>>>>!	
 	
 	
s    2B
B*c                    UR                  S5      nSSUS.nSU0nSSU R                  SS	.n[        US
5       n[        R                  " XV5        S S S 5        U R                  US9n[        R                  " [        5       nUR                  S 5      n	S S S 5        WR                  S5      (       d   e[        R                  " U5        g ! , (       d  f       N= f! , (       d  f       NN= f)Nr   r   r   r  r   Tr   r    r#   r$   r%   r&   r   r}   5The executable response is missing the version field.)rk   r   r   rm   r   r>   r   r   r   r   r   r   r   )
rM   rr   r   r   r   ACTUAL_EXECUTABLE_RESPONSEr   rN   r   r   s
             r=   9test_retrieve_subject_token_file_cache_value_error_reportITestCredentials.test_retrieve_subject_token_file_cache_value_error_report  s    :@++ ;
7 !#J/
+
 %12U#V E22)	&
" A3G;II0> H ))<T)U]]:&'2248A ' }}UVVVV
		AB HG
 '&s   C
C

C
C)c           	      F   UR                  S5      nSSUS.nSU0nSSSU R                  S	S
.n[        US5       n[        R                  " XV5        S S S 5        [
        R                  " S[        R                  " / [        R                  " U R                  5      R                  S5      SS9S9   U R                  US9nUR                  S 5      nXR                  :X  d   e S S S 5        [        R                  " U5        g ! , (       d  f       N= f! , (       d  f       N6= f)Nr   r   r   r  r   r   Tr   r    r!   r   r   r   r   r   rR   r}   )rk   r   r   rm   r   r   r   r   r   rn   r   r   r>   r   r   r   )	rM   rr   r   r   r   r  r   rN   r   s	            r=   :test_retrieve_subject_token_file_cache_refresh_error_retryJTestCredentials.test_retrieve_subject_token_file_cache_refresh_error_retry  s   :@++ ;
7 !#J/
+
 %12U#V E22)&
" A3G;II0> H ZZ#44zzEE&/	
 --": . K (>>tDM $>$>>>>!	
$ 			AB+ HG	
 	
s   D/2D
D
D c           	         SSSU R                   SS.n[        R                  " S[        R                  " / [
        R                  " U5      R                  S5      SS	9S
9   U R                  U R                  S9n[        R                  " [        R                  5       nUR                  S 5      nS S S 5        WR                  S5      (       d   e S S S 5        g ! , (       d  f       N0= f! , (       d  f       g = f)Nr   Tunsupported_token_typer    r!   r   r   r   r   rR   r}   z+Executable returned unsupported token type.r   rM   #EXECUTABLE_SUCCESSFUL_OIDC_RESPONSErN   r   r   s        r=   2test_retrieve_subject_token_unsupported_token_typeBTestCredentials.test_retrieve_subject_token_unsupported_token_type5  s     222)/
+ ZZ#44zz"EFMMgV
 --@V@V-WKz667766t< 8 ==!OPPPP
 
 87
 
r   c           	         SSU R                   SS.n[        R                  " S[        R                  " / [
        R                  " U5      R                  S5      SS9S	9   U R                  U R                  S
9n[        R                  " [        5       nUR                  S 5      nS S S 5        WR                  S5      (       d   e S S S 5        g ! , (       d  f       N0= f! , (       d  f       g = f)NTr   r    r
  r   r   r   r   rR   r}   r  r   r   r   r   r   rm   rn   r   r>   rH   r   r   r   r   r   r  s        r=   +test_retrieve_subject_token_missing_version;TestCredentials.test_retrieve_subject_token_missing_versionN  s     E22)	/
+ ZZ#44zz"EFMMgV
 --@V@V-WKz*g66t< + ==H   
 
 +*
 
$   4CC$ C
C	C
C-c           	         SSU R                   SS.n[        R                  " S[        R                  " / [
        R                  " U5      R                  S5      SS9S	9   U R                  U R                  S
9n[        R                  " [        5       nUR                  S 5      nS S S 5        WR                  S5      (       d   e S S S 5        g ! , (       d  f       N0= f! , (       d  f       g = f)Nr   r   r    )r"   r$   r%   r&   r   r   r   r   rR   r}   5The executable response is missing the success field.r  r  s        r=   +test_retrieve_subject_token_missing_success;TestCredentials.test_retrieve_subject_token_missing_successh  s     E22)	/
+ ZZ#44zz"EFMMgV
 --@V@V-WKz*g66t< + ==H   
 
 +*
 
r  c           	         SSS.n[         R                  " S[        R                  " / [        R
                  " U5      R                  S5      SS9S9   U R                  U R                  S	9n[        R                  " [        5       nUR                  S 5      nS S S 5        WR                  S
5      (       d   e S S S 5        g ! , (       d  f       N0= f! , (       d  f       g = f)Nr   Fr"   r#   r   r   r   r   rR   r}   z;Error code and message fields are required in the response.)r   r   r   r   rm   rn   r   r>   rH   r   r   r   r   r   r  s        r=   6test_retrieve_subject_token_missing_error_code_messageFTestCredentials.test_retrieve_subject_token_missing_error_code_message  s    :;.N+ZZ#44zz"EFMMgV
 --@V@V-WKz*g66t< + ==N   
 
 +*
 
s$   4CC C
C	C
C!c           	      d   SSSU R                   S.nSSSS.0n[        R                  " S	[        R                  " / [
        R                  " U5      R                  S
5      SS9S9   U R                  US9nUR                  S 5      nX@R                   :X  d   e S S S 5        g ! , (       d  f       g = f)Nr   Tr   r'   r   r   r   r  r   r   r   r   rR   r}   )
r   r   r   r   r   rm   rn   r   r>   r   )rM   r  rH   rN   r   s        r=   ^test_retrieve_subject_token_without_expiration_time_should_pass_when_output_file_not_specifiednTestCredentials.test_retrieve_subject_token_without_expiration_time_should_pass_when_output_file_not_specified  s    
 E22	/
+ i5I
 ZZ#44zz"EFMMgV
 --@Q-RK'>>tDM $>$>>>>
 
 
s   %2B!!
B/c           	         SSU R                   SS.n[        R                  " S[        R                  " / [
        R                  " U5      R                  S5      SS9S	9   U R                  U R                  S
9n[        R                  " [        5       nUR                  S 5      nS S S 5        WR                  S5      (       d   e S S S 5        g ! , (       d  f       N0= f! , (       d  f       g = f)Nr   Tr    )r"   r#   r%   r&   r   r   r   r   rR   r}   z8The executable response is missing the token_type field.r  r  s        r=   .test_retrieve_subject_token_missing_token_type>TestCredentials.test_retrieve_subject_token_missing_token_type  s     22)	/
+ ZZ#44zz"EFMMgV
 --@V@V-WKz*g66t< + ==K   
 
 +*
 
r  c                     [         R                  " [        5       nSSU R                  S.0nU R	                  US9nS S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)Nr   r   )r   r   r}   z;Missing command field. Executable command must be provided.)r   r   r   (CREDENTIAL_SOURCE_EXECUTABLE_OUTPUT_FILEr>   r   rM   r   rH   r   s       r=   &test_credential_source_missing_command6TestCredentials.test_credential_source_missing_command  sp    ]]:&'&+#'#P#P! ##6G#HA ' }}J
 
 	
 
 '&s   !A
A+c                     SSU R                   00nU R                  USS9n[        R                  " [        5       nUR                  S 5      nS S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)Nr   r   Tr3   r:   zVAn output_file must be specified in the credential configuration for interactive mode.)$CREDENTIAL_SOURCE_EXECUTABLE_COMMANDr>   r   r   r   r   r   )rM   rH   rN   r   r   s        r=   6test_credential_source_missing_output_interactive_modeFTestCredentials.test_credential_source_missing_output_interactive_mode  s     9d&O&OP
 ))/T * 
 ]]:&'2248A ' }}e
 
 	
 
 '&s   A..
A<c                     SU R                   U R                  S.0nU R                  US9nUR                  [        R
                  :X  d   eg )Nr   r   r   r}   )r2  r,  r>   ,_credential_source_executable_timeout_millisr   !EXECUTABLE_TIMEOUT_MILLIS_DEFAULT)rM   rH   rN   s      r=   Etest_credential_source_timeout_missing_will_use_default_timeout_valueUTestCredentials.test_credential_source_timeout_missing_will_use_default_timeout_value  s_     DD#LL
 ))<M)N DD::;	
;r@   c                     [         R                  " [        5       nSU R                  SU R                  S.0nU R                  US9nS S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)Nr   i  r  r}   *Timeout must be between 5 and 120 seconds.r   r   r   r2  r,  r>   r   r-  s       r=   $test_credential_source_timeout_small4TestCredentials.test_credential_source_timeout_small  sq    ]]:&'#HH&.#'#P#P! ##6G#HA ' }}JKKKK '&   ,A((
A6c                     [         R                  " [        5       nSU R                  SU R                  S.0nU R                  US9nS S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)Nr   i r  r}   r<  r=  r-  s       r=   $test_credential_source_timeout_large4TestCredentials.test_credential_source_timeout_large  sq    ]]:&'#HH&0#'#P#P! ##6G#HA ' }}JKKKK '&r@  c                     [         R                  " [        5       nSU R                  SU R                  S.0nU R                  US9nS S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)Nr   i/u  r   r}   >Interactive timeout must be between 30 seconds and 30 minutes.r=  r-  s       r=   0test_credential_source_interactive_timeout_small@TestCredentials.test_credential_source_interactive_timeout_small  sy    ]]:&'#HH2;#'#P#P! ##6G#HA ' }}M
 
 	
 
 '&r@  c                     [         R                  " [        5       nSU R                  SU R                  S.0nU R                  US9nS S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)Nr   iAw r   r}   rE  r=  r-  s       r=   0test_credential_source_interactive_timeout_large@TestCredentials.test_credential_source_interactive_timeout_large&  sy    ]]:&'#HH2=#'#P#P! ##6G#HA ' }}M
 
 	
 
 '&r@  c           	         [         R                  " S[        R                  " / S SS9S9   U R	                  U R
                  S9n[        R                  " [        R                  5       nUR                  S 5      nS S S 5        WR                  S5      (       d   e S S S 5        g ! , (       d  f       N0= f! , (       d  f       g = f)Nr   r   r   rR   r}   :Executable exited with non-zero return code 1. Error: None)r   r   r   r   r>   rH   r   r   r   r   r   r   r   s       r=   +test_retrieve_subject_token_executable_fail;TestCredentials.test_retrieve_subject_token_executable_fail6  s    ZZ#44
 --@V@V-WKz667766t< 8 ==M   
 
 87
 
s#   >B5(B$: B5$
B2	.B55
Cc                     U R                  U R                  SS9n[        R                  " [        5       nUR                  S 5      nS S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)NTr1  z4Interactive mode is only enabled for workforce pool.)r>   rH   r   r   r   r   r   r   s       r=   ?test_retrieve_subject_token_non_workforce_fail_interactive_modeOTestCredentials.test_retrieve_subject_token_non_workforce_fail_interactive_modeG  sh    ))"44$ * 
 ]]:&'2248A ' }}TUUUU '&   A((
A6c                    U R                   U R                  S.nSU0nU R                  USS9n[        R                  " [
        5       nUR                  S 5      nS S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)Nr6  r   Tr1  z;Interactive mode cannot run without an interactive timeout.)r2  r,  r>   r   r   r   r   r   )rM   CREDENTIAL_SOURCE_EXECUTABLErH   rN   r   r   s         r=   Jtest_retrieve_subject_token_fail_on_validation_missing_interactive_timeoutZTestCredentials.test_retrieve_subject_token_fail_on_validation_missing_interactive_timeoutQ  s    
 @@HH(
$ *+GH))/T * 
 ]]:&'2248A ' }}J
 
 	
 
 '&s   A;;
B	c           	         [         R                  " S[        R                  " / S SS9S9   U R	                  [
        U R                  SS9n[        R                  " [        R                  5       nUR                  S 5      nS S S 5        WR                  S5      (       d   e S S S 5        g ! , (       d  f       N0= f! , (       d  f       g = f)Nr   r   r   rR   Tr   rL  )r   r   r   r   r>   r   rH   r   r   r   r   r   r   r   s       r=   <test_retrieve_subject_token_executable_fail_interactive_modeLTestCredentials.test_retrieve_subject_token_executable_fail_interactive_moded  s    ZZ#44
 --+"&"8"8  . K z667766t< 8 ==M   
 
 87
 
s$   AB;.B*  B;*
B8	4B;;
C	c                     U R                  U R                  SS9n[        R                  " [        5       nUR                  S 5      nS S S 5        WR                  S5      (       d   eg ! , (       d  f       N'= f)NTr1  r   )r>   rH   r   r   r   revoker   r   s       r=   )test_revoke_failed_executable_not_allowed9TestCredentials.test_revoke_failed_executable_not_allowedy  sh    ))"44$ * 
 ]]:&'""4(A ' }}IJJJJ '&rR  c                 X   S[         SS.S[        R                  SS.0 [         SS.S	S
0[        R                  SS.S	S0[         SS.SSS.[        R                  SS.S.nUR                  5        GH  n[        R
                  " S[        R                  " / [        R                  " UR                  S5      5      R                  S5      UR                  SS5      S9S9   U R                  [        [        U R                  UR                  SS5      S9n[         R"                  " UR                  S5      5       nUR%                  S 5      nS S S 5        WR'                  UR                  S5      5      (       d   e S S S 5        GM     g ! , (       d  f       ND= f! , (       d  f       GM:  = f)NFz.Revoke is only enabled under interactive mode.)r:   expectErrTypeexpectErrPatternr   z!Auth revoke failed on executable.)r   r_  r`  r  )responser_  r`  r"   r   r   r  r"  z)Revoke failed with unsuccessful response.)non_interactive_modeexecutable_failed#response_validation_missing_version#response_validation_invalid_version#response_validation_missing_success6response_validation_failed_with_success_field_is_falser   ra  r   r   r   r   rR   r:   Tr   r_  r`  )r   r   r   r   r   r   r   r   rm   rn   r   r   r>   r   r]   rH   r   r   r[  r   )rM   r   r   rN   r   r   s         r=   test_revoke_failed"TestCredentials.test_revoke_failed  s     %!+$U%  !+!8!8$H" !+$\4 'N!+!8!8$O4 'N!+$\4 )*e<!+!8!8$PG5
@ OO%D '88::dhhz&:;BB7K#xxa8 #11/6W&*&<&< $ =	 2  ]]488O#<=#**40A > }}TXX.@%ABBBB%  &  >= s%   AF8F
/F
FF
F)	c           	      :   SSS.n[         R                  " S[        R                  " / [        R
                  " U5      R                  S5      SS9S9   U R                  [        U R                  SS	9nUR                  S 5      nS S S 5        g ! , (       d  f       g = f)
Nr   Tr"  r   r   r   r   rR   r   )r   r   r   r   rm   rn   r   r>   r   rH   r[  )rM   ACTUAL_RESPONSErN   r   s       r=   test_revoke_successfully(TestCredentials.test_revoke_successfully  s    &'D9ZZ#44zz/299'B
 --+"&"8"8  . K
 ""4(A
 
 
s   1B
Bc                 h   [         R                  " SS5         U R                  U R                  S9n[        R
                  " [        R                  5       nUR                  S 5      nS S S 5        WR                  S5      (       d   e S S S 5        g ! , (       d  f       N0= f! , (       d  f       g = f)Nsys.version_infor      r}   0Pluggable auth is only supported for python 3.7+)
r   r   r>   rH   r   r   r   r   r   r   r   s       r=   $test_retrieve_subject_token_python_24TestCredentials.test_retrieve_subject_token_python_2  s    ZZ*F3--@V@V-WKz667766t< 8 ==!TUUUU 43 87 43s#   >B#B( B#
B 	B##
B1c                 t   [         R                  " SS5         U R                  [        U R                  SS9n[
        R                  " [        R                  5       nUR                  S 5      nS S S 5        WR                  S5      (       d   e S S S 5        g ! , (       d  f       N0= f! , (       d  f       g = f)Nro  rp  Tr   rr  )r   r   r>   r   rH   r   r   r   r   r[  r   r   s       r=   "test_revoke_subject_token_python_22TestCredentials.test_revoke_subject_token_python_2  s    ZZ*F3--+"&"8"8  . K z6677&&t, 8 ==!TUUUU 43 87 43s$   AB)B. B)
B&	"B))
B7 )P__name__
__module____qualname____firstlineno__r2  r,  rT  rH   r   r   r   r   r   r   r   r   r   CREDENTIAL_URLclassmethodrD   rE   rF   rG   r>   rO   r   r   objectr   r;   rc   rg   ru   rx   r   r   r   r   r   r   r   r   dictr   environr   r   r   r   r   r   r   r   r  r  r  r  r  r  r  r#  r&  r)  r.  r3  r9  r>  rB  rF  rI  rM  rP  rU  rX  r\  rh  rl  rs  rv  __static_attributes__rx  r@   r=   r   r      se   > ) 0B,7&,?	$  &'CD+A)%40 A)	GC <)%/+ <)	B> 1>.%+' >.	>: =	" *N -%*.$(
 
@M 
ZZy,,jtL
 M
B 
ZZy,,jtL
 M
6 
ZZy,,jtL 
 M 
D 
ZZy,,jtL
 M
8;;
<E.> 
ZZ__RZZ"Ms!STLG ULG\ 
ZZ__RZZ"Ms!ST? U?" 
ZZ__RZZ"Ms!STG UG> 
ZZ__RZZ"Ms!ST U$ 
ZZ__


9<36	
GGB 
ZZ__RZZ"Ms!STO UO$ 
ZZ__RZZ"Ms!STN UN4 
ZZ__RZZ"Ms!STV UV4 
ZZ__RZZ"Ms!STC UC( 
ZZ__RZZ"Ms!ST? U?2 
ZZ__RZZ"Ms!STC UC8 
ZZ__RZZ"Ms!ST&C U&CP 
ZZ__RZZ"Ms!STQ UQ0 
ZZ__RZZ"Ms!ST U2 
ZZ__RZZ"Ms!ST U2 
ZZ__RZZ"Ms!ST U( 
ZZ__RZZ"Ms!ST? U?6 
ZZ__RZZ"Ms!ST U2 
ZZ__RZZ"Ms!ST
 U
 
ZZ__RZZ"Ms!ST
 U
 
ZZ__RZZ"Ms!ST
 U
 
ZZ__RZZ"Ms!STL UL 
ZZ__RZZ"Ms!STL UL 
ZZ__RZZ"Ms!ST
 U
 
ZZ__RZZ"Ms!ST
 U
 
ZZ__RZZ"Ms!ST U  
ZZ__RZZ"Ms!STV UV 
ZZ__RZZ"Ms!ST
 U
$ 
ZZ__RZZ"Ms!ST U( 
ZZ__RZZ"Ms!STK UK 
ZZ__RZZ"Ms!ST4C U4Cl 
ZZ__RZZ"Ms!ST) U)" 
ZZ__RZZ"Ms!STV UV 
ZZ__RZZ"Ms!STV UVr@   r   )!rm   r   r   r   r   google.authr   r   google.auth.credentialsr   tests.test__defaultr   r^   r_   BASIC_AUTH_ENCODINGSERVICE_ACCOUNT_EMAIL&SERVICE_ACCOUNT_IMPERSONATION_URL_BASEformatr   r]   r	   SCOPESSUBJECT_TOKEN_FIELD_NAMErF   rG   rE   rD   r   INVALID_TOKEN_URLSr   *INVALID_SERVICE_ACCOUNT_IMPERSONATION_URLSr  r   rx  r@   r=   <module>r     s     	    " ! ; 2	0 K 4 ' +b*h*h+ ' +-TT " & 
H	) 1	;; v
  <
, (. *@\Vf \Vr@   