
    G                         S SK Jr  S SKrS SKrS SKrS SKrS SKJr  S SKJ	r	  S SK
Jr  S SK
Jr  SrSrSr " S	 S
\5      rg)    N)
exceptions)	transport)sts)utilsusernamepasswordzdXNlcm5hbWU6cGFzc3dvcmQ=c                      \ rS rSrSrSrSrSS/rSrSr	S	r
S
rS	rSrSS0rSS/SS.0rSSSSSS.rSSSS.rSSSS.r\R(                  " \R*                  R,                  \\5      r\R(                  " \R*                  R4                  \\5      r\S1S j5       r\\R>                  4S  j5       r \S! 5       r!S" r"S# r#S$ r$S% r%S& r&S' r'S( r(S) r)S* r*S+ r+S, r,S- r-S. r.S/ r/S0r0g)2TestStsClient!   z/urn:ietf:params:oauth:grant-type:token-exchangezhttps://api.example.com/zurn:example:cooperation-contextscope1scope2z-urn:ietf:params:oauth:token-type:access_tokenz&HEADER.SUBJECT_TOKEN_PAYLOAD.SIGNATUREz$urn:ietf:params:oauth:token-type:jwtz$HEADER.ACTOR_TOKEN_PAYLOAD.SIGNATUREz https://example.com/token.oauth2zx-client-versionz0.1.2
additionaloptionsz
some-value)znon-standardotherACCESS_TOKENBeareri  zscope1 scope2)access_tokenissued_token_type
token_type
expires_inscopeabcxyz)r   refresh_tokenr   invalid_requestzInvalid subject tokenz#https://tools.ietf.org/html/rfc6749)errorerror_description	error_uriNc                 D    [         R                  " U R                  U5      $ N)r   ClientTOKEN_EXCHANGE_ENDPOINT)clsclient_auths     Oplatform/gsutil/third_party/google-auth-library-python/tests/oauth2/test_sts.pymake_clientTestStsClient.make_clientF   s    zz#55{CC    c                     [         R                  " [        R                  SS9nX#l        [
        R                  " U5      R                  S5      Ul        [         R                  " [        R                  5      nX4l
        U$ )NT)instanceutf-8)mockcreate_autospecr   ResponsestatusjsondumpsencodedataRequestreturn_value)r#   r3   r/   responserequests        r%   make_mock_requestTestStsClient.make_mock_requestJ   s[    ''	(:(:TJ 

4(//8&&y'8'89'r(   c                 d   US   U R                   :X  d   eUS   S:X  d   eUS   U:X  d   eUS   c   e[        R                  R                  US   5      nU H-  u  pVUR	                  S5      X5R	                  S5         :X  a  M-   e   [        U5      [        UR                  5       5      :X  d   eg)zEAsserts the request was called with the expected parameters.
        urlmethodPOSTheadersbodyNr+   )r"   urllibparse	parse_qsldecodelenkeys)r#   request_kwargsr>   request_databody_tupleskvs          r%   assert_request_kwargs#TestStsClient.assert_request_kwargsU   s     e$(C(CCCCh'6111i(G333f%111ll,,^F-CD!FQ88G$XXg5F(GGGG ";3|'8'8':#;;;;r(   c                    U R                  5       nU R                  R                  5       nSUS'   U R                  U R                  U R
                  SR                  U R                  5      U R                  U R                  U R                  U R                  U R                  [        R                  R                  [         R"                  " U R$                  5      5      S.
nU R'                  [(        R*                  U R,                  S9nUR/                  UU R                  U R                  U R                  U R                  U R
                  U R                  U R                  U R                  U R                  U R$                  U R                  5      nU R1                  UR2                  S   X#5        XPR,                  :X  d   eg)zQTest token exchange success without client authentication using full
parameters.
!application/x-www-form-urlencodedContent-Type 

grant_typeresourceaudiencer   requested_token_typesubject_tokensubject_token_typeactor_tokenactor_token_typer   r/   r3      N)r&   ADDON_HEADERScopy
GRANT_TYPERESOURCEAUDIENCEjoinSCOPESREQUESTED_TOKEN_TYPESUBJECT_TOKENSUBJECT_TOKEN_TYPEACTOR_TOKENACTOR_TOKEN_TYPEr@   rA   quoter0   r1   ADDON_OPTIONSr8   http_clientOKSUCCESS_RESPONSEexchange_tokenrK   	call_argsselfclientr>   rG   r7   r6   s         r%   -test_exchange_token_full_success_without_auth;TestStsClient.test_exchange_token_full_success_without_authb   so    !!#$$))+"E//XXdkk*$($=$=!//"&"9"9++ $ 5 5||))$**T5G5G*HI
 ((>>(=(= ) 
 ((OO##MMMMKK%%!!
 	""7#4#4Q#7O00000r(   c           	         U R                  5       nSS0nU R                  U R                  U R                  U R                  U R
                  S.nU R                  [        R                  U R                  S9nUR                  UU R                  U R                  U R
                  U R                  U R                  S9nU R                  UR                  S   X#5        XPR                  :X  d   eg)zdTest token exchange success without client authentication using
partial (required only) parameters.
rO   rN   rR   rT   rU   rV   rW   rZ   rR   rV   rW   rT   rU   r[   N)r&   r^   r`   rc   rd   re   r8   rj   rk   rl   rm   rK   rn   ro   s         r%   0test_exchange_token_partial_success_without_auth>TestStsClient.test_exchange_token_partial_success_without_auth   s     !!#!#FG//$($=$=!//"&"9"9
 ((>>(=(= ) 
 ((,,#66]]!%!:!: ) 
 	""7#4#4Q#7O00000r(   c                 4   U R                  5       nU R                  [        R                  U R                  S9n[
        R                  " [        R                  5       nUR                  UU R                  U R                  U R                  U R                  U R                  U R                  U R                   U R"                  U R$                  U R&                  U R(                  5        SSS5        WR+                  S5      (       d   eg! , (       d  f       N'= f)zPTest token exchange without client auth responding with non-200 status.
        rZ   NWError code invalid_request: Invalid subject token - https://tools.ietf.org/html/rfc6749)r&   r8   rj   BAD_REQUESTERROR_RESPONSEpytestraisesr   
OAuthErrorrm   r^   rd   re   r_   r`   rb   rc   rf   rg   ri   r\   matchrp   rq   r7   excinfos       r%   'test_exchange_token_non200_without_auth5TestStsClient.test_exchange_token_non200_without_auth   s     !!#((**1D1D ) 
 ]]:001W!!""''))  %%"""" 2  }}f
 
 	
 
! 21s   BD		
Dc                    U R                  U R                  5      nU R                  R                  5       nSUS'   SR	                  [
        5      US'   U R                  U R                  U R                  SR                  U R                  5      U R                  U R                  U R                  U R                  U R                  [         R"                  R%                  [&        R(                  " U R*                  5      5      S.
nU R-                  [.        R0                  U R2                  S9nUR5                  UU R                  U R                  U R                  U R                  U R                  U R                  U R                  U R                  U R                  U R*                  U R                  5      nU R7                  UR8                  S   X#5        XPR2                  :X  d   eg	)
zTTest token exchange success with basic client authentication using full
parameters.
rN   rO   Basic {}AuthorizationrP   rQ   rZ   r[   N)r&   CLIENT_AUTH_BASICr\   r]   formatBASIC_AUTH_ENCODINGr^   r_   r`   ra   rb   rc   rd   re   rf   rg   r@   rA   rh   r0   r1   ri   r8   rj   rk   rl   rm   rK   rn   ro   s         r%   0test_exchange_token_full_success_with_basic_auth>TestStsClient.test_exchange_token_full_success_with_basic_auth   s    !!$"8"89$$))+"E#-#4#45H#I //XXdkk*$($=$=!//"&"9"9++ $ 5 5||))$**T5G5G*HI
 ((>>(=(= ) 
 ((OO##MMMMKK%%!!
 	""7#4#4Q#7O00000r(   c           	         U R                  U R                  5      nSSR                  [        5      S.nU R                  U R
                  U R                  U R                  U R                  S.nU R                  [        R                  U R                  S9nUR                  UU R                  U R                  U R                  U R
                  U R                  S9nU R                  UR                  S   X#5        XPR                  :X  d   eg)	zgTest token exchange success with basic client authentication using
partial (required only) parameters.
rN   r   )rO   r   ru   rZ   rv   r[   N)r&   r   r   r   r^   r`   rc   rd   re   r8   rj   rk   rl   rm   rK   rn   ro   s         r%   3test_exchange_token_partial_success_with_basic_authATestStsClient.test_exchange_token_partial_success_with_basic_auth   s     !!$"8"89?'../BC

 //$($=$=!//"&"9"9
 ((>>(=(= ) 
 ((,,#66]]!%!:!: ) 
 	""7#4#4Q#7O00000r(   c                 J   U R                  U R                  5      nU R                  [        R                  U R
                  S9n[        R                  " [        R                  5       nUR                  UU R                  U R                  U R                  U R                  U R                  U R                   U R"                  U R$                  U R&                  U R(                  U R*                  5        SSS5        WR-                  S5      (       d   eg! , (       d  f       N'= f)zKTest token exchange with basic client auth responding with non-200
status.
rZ   Nrz   )r&   r   r8   rj   r{   r|   r}   r~   r   r   rm   r^   rd   re   r_   r`   rb   rc   rf   rg   ri   r\   r   r   s       r%   *test_exchange_token_non200_with_basic_auth8TestStsClient.test_exchange_token_non200_with_basic_auth  s     !!$"8"89((**1D1D ) 
 ]]:001W!!""''))  %%"""" 2  }}f
 
 	
 
! 21   (BD
D"c                    U R                  U R                  5      nU R                  R                  5       nSUS'   U R                  U R
                  U R                  SR                  U R                  5      U R                  U R                  U R                  U R                  U R                  [        R                  R!                  ["        R$                  " U R&                  5      5      [(        [*        S.nU R-                  [.        R0                  U R2                  S9nUR5                  UU R                  U R                  U R                  U R
                  U R                  U R                  U R                  U R                  U R                  U R&                  U R                  5      nU R7                  UR8                  S   X#5        XPR2                  :X  d   eg)z[Test token exchange success with request body client authenticaiton
using full parameters.
rN   rO   rP   )rR   rS   rT   r   rU   rV   rW   rX   rY   r   	client_idclient_secretrZ   r[   N)r&   CLIENT_AUTH_REQUEST_BODYr\   r]   r^   r_   r`   ra   rb   rc   rd   re   rf   rg   r@   rA   rh   r0   r1   ri   	CLIENT_IDCLIENT_SECRETr8   rj   rk   rl   rm   rK   rn   ro   s         r%   2test_exchange_token_full_success_with_reqbody_auth@TestStsClient.test_exchange_token_full_success_with_reqbody_auth+  s}    !!$"?"?@$$))+"E//XXdkk*$($=$=!//"&"9"9++ $ 5 5||))$**T5G5G*HI"*
 ((>>(=(= ) 
 ((OO##MMMMKK%%!!
 	""7#4#4Q#7O00000r(   c           	         U R                  U R                  5      nSS0nU R                  U R                  U R                  U R
                  U R                  [        [        S.nU R                  [        R                  U R                  S9nUR                  UU R                  U R
                  U R                  U R                  U R                  S9nU R                  UR                  S   X#5        XPR                  :X  d   eg)znTest token exchange success with request body client authentication
using partial (required only) parameters.
rO   rN   )rR   rT   rU   rV   rW   r   r   rZ   rv   r[   N)r&   r   r^   r`   rc   rd   re   r   r   r8   rj   rk   rl   rm   rK   rn   ro   s         r%   5test_exchange_token_partial_success_with_reqbody_authCTestStsClient.test_exchange_token_partial_success_with_reqbody_authV  s     !!$"?"?@!#FG//$($=$=!//"&"9"9"*
 ((>>(=(= ) 
 ((,,#66]]!%!:!: ) 
 	""7#4#4Q#7O00000r(   c                 J   U R                  U R                  5      nU R                  [        R                  U R
                  S9n[        R                  " [        R                  5       nUR                  UU R                  U R                  U R                  U R                  U R                  U R                   U R"                  U R$                  U R&                  U R(                  U R*                  5        SSS5        WR-                  S5      (       d   eg! , (       d  f       N'= f)zWTest token exchange with POST request body client auth responding
with non-200 status.
rZ   Nrz   )r&   r   r8   rj   r{   r|   r}   r~   r   r   rm   r^   rd   re   r_   r`   rb   rc   rf   rg   ri   r\   r   r   s       r%   ,test_exchange_token_non200_with_reqbody_auth:TestStsClient.test_exchange_token_non200_with_reqbody_authu  s     !!$"?"?@((**1D1D ) 
 ]]:001W!!""''))  %%"""" 2  }}f
 
 	
 
! 21r   c                 "   U R                  U R                  5      nU R                  [        R                  U R
                  S9nUR                  US5      nSSS.nSSS.nU R                  UR                  S   XE5        X0R
                  :X  d   eg	
z,Test refresh token with successful response.rZ   refreshtokenBasic dXNlcm5hbWU6cGFzc3dvcmQ=rN   )r   rO   r   )rR   r   r[   N)	r&   r   r8   rj   rk   rl   r   rK   rn   rp   rq   r7   r6   r>   rG   s         r%   test_refresh_token_success(TestStsClient.test_refresh_token_success  s    !!$"8"89((>>(=(= ) 
 ''@ >?
 '6W""7#4#4Q#7O00000r(   c                 "   U R                  U R                  5      nU R                  [        R                  U R
                  S9nUR                  US5      nSSS.nSSS.nU R                  UR                  S   XE5        X0R
                  :X  d   eg	r   )	r&   r   r8   rj   rk   SUCCESS_RESPONSE_WITH_REFRESHr   rK   rn   r   s         r%   'test_refresh_token_success_with_refresh5TestStsClient.test_refresh_token_success_with_refresh  s    !!$"8"89((>>(J(J ) 
 ''@ >?
 '6W""7#4#4Q#7O=====r(   c                 Z   U R                  U R                  5      nU R                  [        R                  U R
                  S9n[        R                  " [        R                  5       nUR                  US5        SSS5        WR                  S5      (       d   eg! , (       d  f       N'= f))Test refresh token with failure response.rZ   r   Nrz   )r&   r   r8   rj   r{   r|   r}   r~   r   r   r   r   r   s       r%   test_refresh_token_failure(TestStsClient.test_refresh_token_failure  s    !!$"8"89((**1D1D ) 
 ]]:001W  .9 2 }}f
 
 	
 
 21s   (B
B*c                 ,   U R                  U R                  5      nU R                  [        R                  U R
                  S9nUR                  USS0SS05      nSSSS.nSS0nU R                  UR                  S	   XE5        X0R
                  :X  d   eg
)z*Test base method with successful response.rZ   abcdr   rN   )r   rO   r   r[   N)	r&   r   r8   rj   rk   rl   _make_requestrK   rn   r   s         r%   test__make_request_success(TestStsClient.test__make_request_success  s    !!$"8"89((>>(=(= ) 
 ''#sc3ZH >?

 Sz""7#4#4Q#7O00000r(   c                 d   U R                  U R                  5      nU R                  [        R                  U R
                  S9n[        R                  " [        R                  5       nUR                  USS0SS05        SSS5        WR                  S5      (       d   eg! , (       d  f       N'= f)r   rZ   r   r   r   r   Nrz   )r&   r   r8   rj   r{   r|   r}   r~   r   r   r   r   r   s       r%   test_make_request_failure'TestStsClient.test_make_request_failure  s    !!$"8"89((**1D1D ) 
 ]]:001W  3*sCjA 2 }}f
 
 	
 
 21s   (B!!
B/ r    )1__name__
__module____qualname____firstlineno__r^   r_   r`   rb   rc   rd   re   rf   rg   r"   r\   ri   rl   r   r|   r   ClientAuthenticationClientAuthTypebasicr   r   r   request_bodyr   classmethodr&   rj   rk   r8   rK   rr   rw   r   r   r   r   r   r   r   r   r   r   r   r   __static_attributes__r   r(   r%   r
   r
   !   so   BJ)H0H!FJ<M?8K=@'1M!YK,#WXM&L  %! #4:N
 22""I}  %99))9m  D D ,7NN   
< 
<'1R1:
8(1T1@
:)1V1>
:1">"
1$
r(   r
   )http.clientrq   rj   r0   r@   r,   r}   google.authr   r   google.oauth2r   r   r   r   r   objectr
   r   r(   r%   <module>r      s@    "     " !  	0 
F 
r(   