
    "                        d Z ddlmZ ddlmZ ddlmZ ddlmZ ddlZddlmZ	 ddlm
Z
 dd	lmZ dd
lmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmc mZ ddlmZ ddlmZ ddlmZ ddlm Z  ddlm!Z! ddlm"Z" ddl#m$Z$m%Z%  e$ e%ddd             ddl&m'Z' ddl(m(Z( d Z)ejT                  jW                  dd      Z, G d dejZ                        Z. G d d ej^                        Z0y)!9Tests for various combinations of configured credentials.    )absolute_import)print_function)division)unicode_literalsN)
exceptions)http_wrapper)AccessDeniedException)	CredTypes)DiscardMessagesQueue)CommandException)
GcsJsonApi)MockLoggingHandler)	SkipForS3)
SkipForXML)ObjectToURI)SetBotoConfigForTest)SetEnvironmentForTest)unittest)add_moveMovedModulemockzunittest.mock)r   )datetimec                 v    t         j                  j                  t        j                  ddid| z  d            S )Nstatusi  z{"error": {"message": "%s"}}zhttp://www.google.com)infocontentrequest_url)apitools_exceptions	HttpErrorFromResponser	   Response)messages    0platform/gsutil/gslib/tests/test_creds_config.py_Make403r%   0   s=    

'
'
4
4(C$BW$L(?AB C    GSUtil test_impersonate_service_accountc                        e Zd ZdZ fdZd Z ed       ed       ej                  d      d                      Z
 ed       ed       ej                  d      d                      Z xZS )	TestCredsConfigr   c                     t         t        |           t               | _        | j
                  j                  | j                         y )N)superr*   setUpr   log_handlerlogger
addHandler)self	__class__s    r$   r-   zTestCredsConfig.setUp>   s3    	/4&()+DKK4++,r&   c                    t        g d      5  	 t        d | j                  t                      | j	                  d       d d d        y # t
        $ rg}t        |      }| j                  d|       | j                  t        j                  |       | j                  t        j                  |       Y d }~td }~ww xY w# 1 sw Y   y xY w)N)Credentialsgs_oauth2_refresh_tokenfoo)r5   gs_service_client_idbar)r5   gs_service_key_filebazr5   gs_impersonate_service_accountNz2Succeeded with multiple types of configured creds.ztypes of configured credentials)r   r   r/   r   failr   strassertInr   OAUTH2_USER_ACCOUNTOAUTH2_SERVICE_ACCOUNT)r1   emsgs      r$   testMultipleConfiguredCredsz+TestCredsConfig.testMultipleConfiguredCredsC   s    	  
=4&:&<=		FG
 
  =!f7=i33S9i66<<	=
 
s/   B<0A			B9AB4/B<4B99B<<CTests only uses gs credentials.Tests only run on JSON API.zgslib.third_party.iamcredentials_apitools.iamcredentials_v1_client.IamcredentialsV1.ProjectsServiceAccountsService.GenerateAccessTokenc                    t        g d      5  t        d      |_        	 t        d | j                  t                      | j                  d       t        d      |_        	 t        d | j                  t                      | j                  d       d d d        y # t        $ r%}| j                  dt        |             Y d }~sd }~ww xY w# t        $ r%}| j                  dt        |             Y d }~cd }~ww xY w# 1 sw Y   y xY w)Nr4   r5   r8   Nr5   r:   N)r5   r=   r9   z#The caller does not have permissionz-Succeeded when IAM Credentials threw an errorz%Service account impersonation failed.z5IAM Service Account Credentials API has not been usedz+IAM Service Account Credentials API has not)
r   r%   side_effectr   r/   r   r>   r
   r@   r?   )r1   $mock_iam_creds_generate_access_tokenrC   s      r$   1testImpersonationBlockedByIamCredentialsApiErrorszATestCredsConfig.testImpersonationBlockedByIamCredentialsApiErrorsT   s     
  
 8
9 +6G4&:&<=		AB
 J
K +6M4&:&<=		AB%
 
 # G=s1vFFG # MCSVLLM'
 
sX   C<0BC<!0C	C#C>C<CC<	C9C4/C<4C99C<<Dc                 r   t        g d      5  d}t        j                         j                  d      }||j                  _        ||j                  _        t        d | j                  t                     }| j                  |t        |j                  j                               d d d        y # 1 sw Y   y xY w)NrI   z#Mock token from IAM Credentials APIz%Y-%m-%dT23:59:59Z)r   r   nowstrftimereturn_valueaccessToken
expireTimer   r/   r   r@   r?   credentialsaccess_token)r1   rM   
fake_tokenexpire_timeapis        r$   &testImpersonationSuccessfullyUsesTokenz6TestCredsConfig.testImpersonationSuccessfullyUsesTokenq   s     
  
 9jLLN++,@AkFP*77CEP*77BtT[[*>*@Ac
mmJCOO$@$@ AB
 
 
s   BB--B6)__name__
__module____qualname____doc__r-   rE   r   r   r   patchrN   rZ   __classcell__)r2   s   @r$   r*   r*   ;   s    A-
=" ./+,4:: D EME - 0
M0 ./+,4:: D ECE - 0
Cr&   r*   c                      e Zd Z ed      d        Z ej                  ed       ed       ed      d                      Z	 ej                  ed       ed       ed      d                      Z
 ej                  ed       ed       ed      d                      Z ej                  ed       ed       ed      d                      Zy	)
TestCredsConfigIntegrationrF   c                     | j                         }t        g dd      5  | j                  dt        |      gdd      }| j	                  d|       d d d        y # 1 sw Y   y xY w)	N)r4   rJ   rK   r<   F)use_existing_configls   T)expected_statusreturn_stderrzcredentials are invalid)CreateBucketr   	RunGsUtilsurir@   )r1   
bucket_uristderrs      r$   testExactlyOneInvalidz0TestCredsConfigIntegration.testExactlyOneInvalid   sk    ""$J		B "
# ~~tT*%56./,0  2f mm-v6
# 
# 
#s   2AA$z/Test requires test_impersonate_service_account.rG   c                     t        ddt        fg      5  t        i       5  | j                  ddgd      }| j	                  d|       d d d        d d d        y # 1 sw Y   xY w# 1 sw Y   y xY w)Nr5   r=   re   gs://pubTrh   #using service account impersonation)r   SERVICE_ACCOUNTr   rj   r@   r1   rm   s     r$   *testImpersonationCredentialsFromBotoConfigzETestCredsConfigIntegration.testImpersonationCredentialsFromBotoConfig   sm    
 
/O / 1 2 
3 $z 2$G;VD %
3 
3$$
3 
3s"   A%(AA%A"	A%%A.c                     t        dg      5  t        dt        i      5  | j                  ddgd      }| j	                  d|       d d d        d d d        y # 1 sw Y   xY w# 1 sw Y   y xY w)Nr<   )CLOUDSDK_AUTH_IMPERSONATE_SERVICE_ACCOUNTre   rp   Trq   rr   )r   r   rs   rj   r@   rt   s     r$   &testImpersonationCredentialsFromGCloudzATestCredsConfigIntegration.testImpersonationCredentialsFromGCloud   su    
 
  & ' 
( 6
HJz 2$G;VDJ
( 
(J J
( 
(s"   A$(AA$A!	A$$A-c                     t        dg      5  t        ddi      5  | j                  dt        ddgd      }| j	                  d	t        z  |       d d d        d d d        y # 1 sw Y   xY w# 1 sw Y   y xY w)
N)r5   r=   zfoo@google.comrw   zbar@google.comz-ire   rp   Trq   !API calls will be executed as [%s)r   r   rj   rs   r@   rt   s     r$   5testImpersonationCredentialsFromOptionOverridesOtherszPTestCredsConfigIntegration.testImpersonationCredentialsFromOptionOverridesOthers   s    
 
  2 3 
4 68H
IKj I.2   49OK		K
4 
4K K
4 
4s"   A-5A!A-!A*	&A--A6c                     t        ddt        fg      5  | j                  ddgd      }| j                  dt        z  |       d d d        y # 1 sw Y   y xY w)Nr5   r=   re   rp   Trq   rz   )r   rs   rj   r@   rt   s     r$   testImpersonationSuccessz3TestCredsConfigIntegration.testImpersonationSuccess   s\    
 
/O / 1 2 
3~~tZ0~Ef
mm7/I
3 
3 
3s   /AAN)r[   r\   r]   r   rn   r   
skipUnlessrs   r   ru   rx   r{   r}    r&   r$   rb   rb      s.   ./7 07 8HJ./+,E - 0JE 8HJ./+,E - 0JE 8HJ./+, - 0J 8HJ./+, - 0Jr&   rb   )1r^   
__future__r   r   r   r   botoapitools.base.pyr   r   r	   gslib.cloud_apir
   gslib.cred_typesr   gslib.discard_messages_queuer   gslib.exceptionr   gslib.gcs_json_apir    gslib.tests.mock_logging_handlerr   gslib.tests.testcaseteststestcase)gslib.tests.testcase.integration_testcaser   r   gslib.tests.utilr   rk   r   r   r   sixr   r   	six.movesr   r   r%   config	get_valuers   GsUtilUnitTestCaser*   GsUtilIntegrationTestCaserb   r   r&   r$   <module>r      s    @ & %  '  > ) 1 & = , ) ? ' ' ? @ 0 1 2 % % VV_	5 6  C ++''(JLHCh11 HCV>!C!C >r&   