
    8                     b   d Z ddlZddlZddlZddlmZ ddlmZ ddlmZ ddlmZ ddlm	Z	 ddl
mZ dd	lmZ ddlZdd
lmZmZ  e eddd             ddlmZ dZdZ ej,                  dd ee      d      Z G d dej2                        Z G d de      Z G d dej:                        Zy)z!Tests for wrapped_credentials.py.    N)aws)external_account) external_account_authorized_user)identity_pool)	pluggable)testcase)WrappedCredentials)add_moveMovedModulemockzunittest.mock)r   foocontentz
text/plain200)zcontent-typestatuszcontent-lengthc                   &     e Zd Zd fd	Zd Z xZS )MockCredentialsc                      t           |i | d  _        | _        d  _         fd}t        j                  |       _        y )Nc                      ~ ~_         y Ntoken)argskwargsselfr   s     7platform/gsutil/gslib/tests/test_wrapped_credentials.pyside_effectz-MockCredentials.__init__.<locals>.side_effect4   s    
dj    r   )super__init__	_audienceexpiryr   r   Mockrefresh)r   r   r"   r   r   r   	__class__s   ``    r   r    zMockCredentials.__init__.   sA    	Gd%f%DNDKDJ 995DLr   c                       y r    r'   r   r   retrieve_subject_tokenz&MockCredentials.retrieve_subject_token:   s    r   )NN)__name__
__module____qualname__r    r(   __classcell__)r%   s   @r   r   r   ,   s    
6	r   r   c                       e Zd ZdZd Zd Zy)HeadersWithAuthzUA utility class to use to make sure a set of headers includes specific authenticationc                     |xs d| _         y )N r   )r   r   s     r   r    zHeadersWithAuth.__init__A   s    "DJr   c                 @    |d   t        d| j                  z   d      k(  S )Ns   AuthorizationzBearer zutf-8)bytesr   )r   headerss     r   __eq__zHeadersWithAuth.__eq__D   s#    #$i$**.Dg(NNNr   N)r)   r*   r+   __doc__r    r4   r'   r   r   r.   r.   >   s    ]Or   r.   c                       e Zd ZdZej
                  j                  edd      d        Zd Z	d Z
ej
                  j                  edd      d        Zd	 Zd
 Zd Zd Zd Zy)TestWrappedCredentialszRTest logic for interacting with Wrapped Credentials the way we intend to use them.HttpT)autospecc           	      N   t         t        f|j                  j                  _        |j                  j                  }t	        t        t        dddd            }t        j                  j                         }|j                  |       |j                  d      \  }}| j                  |t               |j                  j                  j                  t        j                          |j                  ddt#        t              d t        j                   t        j                   	       y )
Nr   barhttps://sts.googleapis.comqux)r   audiencesubject_token_type	token_urlcredential_source
google.comuriGETmethodr3   bodyconnection_typeredirections)RESPONSECONTENTreturn_valuerequestr	   r   ACCESS_TOKENoauth2client	transportget_http_object	authorizeassertEqual_baser$   assert_called_once_withr   ANYr.   )r   httpreqcreds_r   s         r   testWrappedCredentialUsagez1TestWrappedCredentials.testWrappedCredentialUsageK   s    .6-@D*



#
#Cl!&+0">*/		12E !!113D	OOD,/JAwWg&	KK//9 ',(7(E%)04-1XX   7r   c           	         t        t        j                  dddddi            }t        |_        t        j
                  ddd	d
d
      |_        |j                         }t        j                  |      }| j                  |d   d       | j                  |d   t               | j                  |d   d       | j                  |d   d   d       | j                  |d   d   d       | j                  |d   d   d       | j                  |d   d   d   d       t        j                  |      }| j                  |t                | j                  |j                  t        j                         | j                  |j                  d       | j                  |j                  t               | j                  |j                  |j                         y)QTest logic for converting Wrapped Credentials to and from JSON for serialization.r   r;   r<   urlrB   )r>   r?   r@   rA           r   	client_idaccess_tokentoken_expiry2001-12-05T00:00:00ZrU   r>   r?   r@   rA   N)r	   r   CredentialsrO   rd   datetimere   to_jsonjsonloadsrT   	from_jsonassertIsInstancerU   rc   )r   rZ   
creds_jsonjson_valuescreds2s        r   "testWrappedCredentialSerializationz9TestWrappedCredentials.testWrappedCredentialSerializatione   s   !!55:,H5:L4I	KLE
 &E!**4Q1=EJ**Z(K[-u5[0,?[02HI[)*5u=[)*>?G[)+613[)*=>uE!#  ))*5F&"45&,,(A(ABV%%u-V((,7V((%*<*<=r   c                     t        j                  t        j                  dt        ddddddddd	d
            }| j                  |t                | j                  |j                  t        j                         y)zdTest logic for creating a Wrapped Credentials using keywords that exist in IdentityPool but not AWS.r   rf   r   r;   r<   rB   
1234567890)r_   workforce_pool_user_project)typer>   r?   r@   rA   )rc   rd   re   rU   N)	r	   rl   rj   dumpsrO   rm   rU   r   rg   r   rZ   s     r   1testWrappedCredentialSerializationMissingKeywordszHTestWrappedCredentials.testWrappedCredentialSerializationMissingKeywords   su    ((

(2*!&+9'3?&		
 	E" 	%!34%++}'@'@Ar   c           
         t         t        f|j                  j                  _        |j                  j                  }t	        t        j                  dddddd            fd}t        j                  |	      j                  _
        t        j                  j                         }j                  |       |j                  d
      \  }}| j                  |t               j                  j                  j!                  t        j"                         |j!                  d
dt%        t&              d t        j"                  t        j"                         y )N^//iam.googleapis.com/locations/global/workforcePools/$WORKFORCE_POOL_ID/providers/$PROVIDER_IDrefreshToken)https://sts.googleapis.com/v1/oauth/token)https://sts.googleapis.com/v1/instrospectclientIdclientSecretr>   refresh_tokenr@   token_info_urlrc   client_secretc                  4    ~ ~t         j                  _        y r   )rO   rU   r   )r   r   rZ   s     r   _refresh_token_side_effectzrTestWrappedCredentials.testWrappedCredentialUsageExternalAccountAuthorizedUser.<locals>._refresh_token_side_effect   s    
&ekkr   r   rB   rC   rE   rF   )rK   rL   rM   rN   r	   r   rg   r   r#   rU   r$   rP   rQ   rR   rS   rT   rV   rW   r.   rO   )r   rX   rY   r   r[   r   rZ   s         @r   7testWrappedCredentialUsageExternalAccountAuthorizedUserzNTestWrappedCredentials.testWrappedCredentialUsageExternalAccountAuthorizedUser   s   .6-@D*



#
#C(44l(AF (	*+E' ))0JKEKK!!113D	OOD,/JAwWg&	KK//9 ',(7(E%)04-1XX   7r   c                 ~   t        t        j                  dddddd            }t        |_        t        j
                  dd	d
dd      |_        |j                         }t        j                  |      }i dddddddt        dddddddddddddddg ddddddd dd!d"dt        ddddddd#d$
}| j                  ||       t        j                  |      }| j                  |t                | j                  |j                  t        j                         | j                  |j                  d       y)%r^   rz   r{   r|   r}   r~   r   r   r`   ra   rb   r   _classr	   _modulezgslib.utils.wrapped_credentialsrc   rd   re   rf   r   r   id_tokenNid_token_jwtinvalidF
revoke_uriscopestoken_info_uritoken_response	token_uri
user_agentrU   r   zgoogleapis.com)
ru   r>   r   r"   r@   r   r   rc   r   universe_domain)r	   r   rg   rO   rd   rh   re   ri   rj   rk   rT   rl   rm   rU   rc   )r   rZ   rn   ro   expected_json_valuesrp   s         r   ?testWrappedCredentialSerializationExternalAccountAuthorizedUserzVTestWrappedCredentials.testWrappedCredentialSerializationExternalAccountAuthorizedUser   s   (44l(AF (	*+E &E!**4Q1=EJ**Z(K'&'4' 	Z' 		'
 	.' 	' 	' 	D' 	' 	5' 	d' 	"' 	$' 	$' 	T'  	d!'" 	2p&;; )
#'P 	["67))*5F&"45&,,:FFHV%%z2r   c                 D   t        j                  t        j                  ddddddddd	d
ddi            }| j	                  |t                | j	                  |j
                  t        j                         | j	                  |j
                  t        j                         y )NrU   i//iam.googleapis.com/projects/123456/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_IDaws1zChttp://169.254.169.254/latest/meta-data/placement/availability-zonezNhttps://sts.{region}.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15z@http://169.254.169.254/latest/meta-data/iam/security-credentials)environment_id
region_urlregional_cred_verification_urlr_   https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/service-1234@service-name.iam.gserviceaccount.com:generateAccessTokenz+urn:ietf:params:aws:token-type:aws4_request#https://sts.googleapis.com/v1/tokenr   r>   rA   !service_account_impersonation_urlr?   r@   ru   )	r	   rl   rj   rv   rm   rU   r   rg   r   rw   s     r   testFromJsonAWSCredentialsz1TestWrappedCredentials.testFromJsonAWSCredentials   s    ((

 ]hZ	& `A9&)
 	E4 	%!34%++'7'C'CD%++s7r   c                 >   t        j                  t        j                  ddddiddddd	i            }| j	                  |t                | j	                  |j
                  t        j                         | j	                  |j
                  t        j                         y )
NrU   r   filez/var/run/secrets/goog.id/tokenr   $urn:ietf:params:oauth:token-type:jwtr   r   r   )	r	   rl   rj   rv   rm   rU   r   rg   r   rw   s     r    testFromJsonFileBasedCredentialsz7TestWrappedCredentials.testFromJsonFileBasedCredentials  s    ((

<& `:9&
 	E& 	%!34%++'7'C'CD%++}'@'@Ar   c                 B   t        j                  t        j                  dddddiidddd	d
i            }| j	                  |t                | j	                  |j
                  t        j                         | j	                  |j
                  t        j                         y )NrU   r   
executablecommandz/path/to/command.shr   r   r   r   r   )	r	   rl   rj   rv   rm   rU   r   rg   r   rw   s     r    testFromJsonPluggableCredentialsz7TestWrappedCredentials.testFromJsonPluggableCredentials0  s    ((

 !#8#& `:9&
 	E* 	%!34%++'7'C'CD%++y'<'<=r   c                     t        j                  t        j                  ddddddddd	i            }| j	                  |t                | j	                  |j
                  t        j                         y )
NrU   r   rz   r{   r|   r}   r~   r   )ru   r>   r   r@   r   rc   r   )r	   rl   rj   rv   rm   rU   r   rg   rw   s     r   4testFromJsonExternalAccountAuthorizedUserCredentialszKTestWrappedCredentials.testFromJsonExternalAccountAuthorizedUserCredentialsJ  sq    ((

6t"??"
 	E( 	%!34%++:FFHr   N)r)   r*   r+   r5   r   patchobjecthttplib2r\   rq   rx   r   r   r   r   r   r   r'   r   r   r7   r7   H   s    Z::Xv57 672>8B, ::Xv5 7 6 7D=3~8>B0>4Hr   r7   )r5   rh   rj   r   google.authr   r   r   r   r   gslib.testsr   gslib.utils.wrapped_credentialsr	   rP   sixr
   r   	six.movesr   rO   rL   ResponselenrK   rg   r   dictr.   GsUtilUnitTestCaser7   r'   r   r   <module>r      s    (     ( 8 % !   >  % VV_	5 6 
8 'l 	&22 	$Od OYHX88 YHr   