
                           d dl Z d dlmZ d dlZd dlZd dlZd dlZd dl	Z	d dl
mZmZ d dl
mZ d dl
mZ d dl
mZ d dl
mZ d dlmZ dZd	Zd
ZdZdZdZdZdj5                  e      Zeez   ZdZddgZdZdZ dZ!dZ"dZ#dZ$dZ%dZ&dZ'dZ(dZ)dZ*dZ+d Z,d!Z-g d"Z.g d#Z/g d$Z0g d%Z1d&d'd(d)d*d+d,d-d.id/d,d+d0d1d.d2d3fd&d'd(d)d*d+d4d-d.id/d4d+d0d1d.d2d3fd&d'd(d)d*d+d5d-d.id/d5d+d0d1d.d2d3fd&d'd(d)d*d+d6d-d.id/d6d+d7d1d.d2d3fd&d'd(d)d*d+d8d-d.id/d8d+d9d1d.d2d3fd&d'd(d)d*d+d:d-d.id/d:d+d;d1d.d2d3fd&d'd(d)d*d+d<d-d.id/d<d+d=d1d.d2d3fd&d'd(d)d*d+d>j5                  ejd                  jg                  d?            d-d.id/d>j5                  ejd                  jg                  d?            d+d@d1d.d2d3fd&d'd(d)d*dAdBd.dCdDd/dBdAdEd1d.dCdFd3fd&d'd(d)d*dAdBd.dGdHd/dBdAdId1d.dGdJd3fd&d'd(d)d*dAdBd.dKdLd/dBdAdMd1d.dKdNd3fd&d'd(d)d*dAdBdOd.dPdQdRdBdAdSd1dOd.dTdQdUfd&d'd(d)d*dAdVd-d.id/dVdAdWd1d.d2d3fdXdYe*e+e,dZd+d[d\d[d+d]e*z   d^z   d_d`e,dad3fdXdYe*e+e,dZdAdbd\dbdAd]e*z   dcz   ddd`e,dad3fdXdYe*e+d*dAdbd\dbdAd]e*z   dez   ddd`dfd3fdXdYe*e+e,dZdAdgdhdidje-dRdgdAd]e*z   dkz   dld`dhdie,dme-dUfgZ4 G dn doe5      Z6 G dp dqejn                        Z8 G dr dse5      Z9y)t    N)_helpersexternal_account)aws)environment_vars)
exceptions)	transport)DEFAULT_UNIVERSE_DOMAINz9gl-python/3.7 auth/1.1 auth-request-type/at cred-type/impzgl-python/3.7 auth/1.1usernamepasswordzdXNlcm5hbWU6cGFzc3dvcmQ=z1service-1234@service-name.iam.gserviceaccount.comz.https://us-east1-iamcredentials.googleapis.comz5/v1/projects/-/serviceAccounts/{}:generateAccessTokenQUOTA_PROJECT_IDscope1scope2z#https://sts.googleapis.com/v1/tokenz(https://sts.googleapis.com/v1/introspectz+urn:ietf:params:aws:token-type:aws4_requestzi//iam.googleapis.com/projects/123456/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_IDzChttp://169.254.169.254/latest/meta-data/placement/availability-zonez'http://169.254.169.254/latest/api/tokenz@http://169.254.169.254/latest/meta-data/iam/security-credentialszChttp://[fd00:ec2::254]/latest/meta-data/placement/availability-zonez'http://[fd00:ec2::254]/latest/api/tokenz@http://[fd00:ec2::254]/latest/meta-data/iam/security-credentialszNhttps://sts.{region}.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15AKIAIOSFODNN7EXAMPLEz(wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEYzAQoEXAMPLEH4aoAH0gNCAPyJxz4BlCFFxWNE1OPTgk5TthT+FvwqnKwRcOIfrRh3c/LTo6UDdyJwOOvEVPvLXCrrrUtdnniCEXAMPLE/IvU1dYUg2RVAJBanLiHb4IgRmpRV3zrkuWJOgQs8IZZaIv2BXIa2R4OlgkBN9bkUDNCJiBeb/AXlzBBko7b15fjrBs2+cTQtpZ3CYWFXG8C5zqx37wnOE49mRl/+OtkIKGO7fAEz{"KeySchema":[{"KeyType":"HASH","AttributeName":"Id"}],"TableName":"TestTable","AttributeDefinitions":[{"AttributeName":"Id","AttributeType":"S"}],"ProvisionedThroughput":{"WriteCapacityUnits":5,"ReadCapacityUnits":5}})	https://sts.googleapis.comz$https://us-east-1.sts.googleapis.comz$https://US-EAST-1.sts.googleapis.comz$https://sts.us-east-1.googleapis.comz$https://sts.US-WEST-1.googleapis.comz$https://us-east-1-sts.googleapis.comz$https://US-WEST-1-sts.googleapis.comz/https://us-west-1-sts.googleapis.com/path?queryz&https://sts-us-east-1.p.googleapis.com)%https://iamcredentials.googleapis.comzsts.googleapis.comhttps://zhttp://sts.googleapis.comzhttps://st.s.googleapis.comz$https://us-eas	-1.sts.googleapis.comz#https:/us-east-1.sts.googleapis.comz%https://US-WE/ST-1-sts.googleapis.comz$https://sts-us-east-1.googleapis.comz$https://sts-US-WEST-1.googleapis.comz(testhttps://us-east-1.sts.googleapis.comz,https://us-east-1.sts.googleapis.comevil.comz.https://us-east-1.us-east-1.sts.googleapis.comz$https://us-ea.s.t.sts.googleapis.comz"https://sts.googleapis.comevil.comz%hhttps://us-east-1.sts.googleapis.comz!https://us- -1.sts.googleapis.comzhttps://-sts.googleapis.comz-https://us-east-1.sts.googleapis.com.evil.comzhttps://sts.pgoogleapis.comhttps://p.googleapis.comzhttps://sts.p.comzhttp://sts.p.googleapis.comz https://xyz-sts.p.googleapis.comz$https://sts-xyz.123.p.googleapis.comz!https://sts-xyz.p1.googleapis.comzhttps://sts-xyz.p.foo.comz$https://sts-xyz.p.foo.googleapis.com)	r   z/https://us-east-1.iamcredentials.googleapis.comz/https://US-EAST-1.iamcredentials.googleapis.comz/https://iamcredentials.us-east-1.googleapis.comz/https://iamcredentials.US-WEST-1.googleapis.comz/https://us-east-1-iamcredentials.googleapis.comz/https://US-WEST-1-iamcredentials.googleapis.comz:https://us-west-1-iamcredentials.googleapis.com/path?queryz1https://iamcredentials-us-east-1.p.googleapis.com)r   ziamcredentials.googleapis.comr   z$http://iamcredentials.googleapis.comz&https://iamcre.dentials.googleapis.comz/https://us-eas	-1.iamcredentials.googleapis.comz.https:/us-east-1.iamcredentials.googleapis.comz0https://US-WE/ST-1-iamcredentials.googleapis.comz/https://iamcredentials-us-east-1.googleapis.comz/https://iamcredentials-US-WEST-1.googleapis.comz3testhttps://us-east-1.iamcredentials.googleapis.comz7https://us-east-1.iamcredentials.googleapis.comevil.comz9https://us-east-1.us-east-1.iamcredentials.googleapis.comz/https://us-ea.s.t.iamcredentials.googleapis.comz-https://iamcredentials.googleapis.comevil.comz0hhttps://us-east-1.iamcredentials.googleapis.comz,https://us- -1.iamcredentials.googleapis.comz&https://-iamcredentials.googleapis.comz8https://us-east-1.iamcredentials.googleapis.com.evil.comz&https://iamcredentials.pgoogleapis.comr   zhttps://iamcredentials.p.comz&http://iamcredentials.p.googleapis.comz+https://xyz-iamcredentials.p.googleapis.comz/https://iamcredentials-xyz.123.p.googleapis.comz,https://iamcredentials-xyz.p1.googleapis.comz$https://iamcredentials-xyz.p.foo.comz/https://iamcredentials-xyz.p.foo.googleapis.comz	us-east-1z2011-09-09T23:36:00ZAKIDEXAMPLEz(wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY)access_key_idsecret_access_keyGETzhttps://host.foo.comdatezMon, 09 Sep 2011 23:36:00 GMT)methodurlheaderszAWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=b27ccfbfa7df52a200ff74193ca6e32d4b48b8856fab7ebf1c595d0670a7e470zhost.foo.com)Authorizationhostr   r   r   r   z"https://host.foo.com/foo/bar/../..zhttps://host.foo.com/./zhttps://host.foo.com/./foozAWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=910e4d6c9abafaf87898e1eb4c929135782ea25bb0279703146455745391e63azhttps://host.foo.com/%E1%88%B4zAWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=8d6634c189aa8c75c2e51e106b6b5121bed103fdb351f7d7d4381c738823af74z%https://host.foo.com/?foo=Zoo&foo=ahazAWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=be7148d34ebccdc6423b19085378aa0bee970bdc61d144bd1a8c48c33079ab09z!https://host.foo.com/?foo=b&foo=azAWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=feb926e49e382bec75c9d7dcb2a1b6dc8aa50ca43c25d2bc51143768c0875acczhttps://host.foo.com/?{}=barz	%E1%88%B4zAWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=6fb359e9a05394cc7074e0feb42573a2601abc0c869a953e8c5c12e4e01f1a8cPOSTzhttps://host.foo.com/zoobar)r   ZOOzAWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host;zoo, Signature=b7a95a52518abbca0964a999a880429ab734f35ebbf1235bd79a5de87756dc4a)r   r   r   r!   ZOOBAR)r   zoozAWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host;zoo, Signature=273313af9d0c265c531e11db70bbd653f3ba074c1009239e8559d3987039cad7)r   r   r   r#   phfft)r   pzAWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host;p, Signature=debf546796015d6f6ded8626f5ce98597c33b47b9164cf6b17b4642036fcb592)r   r   r   r%   !application/x-www-form-urlencoded)Content-Typer   zfoo=bar)r   r   r   datazAWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=content-type;date;host, Signature=5a15b22cf462f047318703b92e6f4f38884e4a7ab7b1d6426ca46a8bd1c26cbc)r   r   r'   r   )r   r   r   r(   zhttps://host.foo.com/?foo=barzAWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=b6e3b79003ce0743a491606ba1035a804593b0efb1e20a11cba83f8c25a57a92	us-east-22020-08-11T06:55:22Z)r   r   security_tokenzMhttps://ec2.us-east-2.amazonaws.com?Action=DescribeRegions&Version=2013-10-15)r   r   zAWS4-HMAC-SHA256 Credential=z/20200811/us-east-2/ec2/aws4_request, SignedHeaders=host;x-amz-date;x-amz-security-token, Signature=41e226f997bf917ec6c9b2b14218df0874225f13bb153236c247881e614fafc9zec2.us-east-2.amazonaws.com20200811T065522Z)r   r   
x-amz-datex-amz-security-tokenOhttps://sts.us-east-2.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15z/20200811/us-east-2/sts/aws4_request, SignedHeaders=host;x-amz-date;x-amz-security-token, Signature=596aa990b792d763465d73703e684ca273c45536c6d322c31be01a41d02e5b60zsts.us-east-2.amazonaws.comz/20200811/us-east-2/sts/aws4_request, SignedHeaders=host;x-amz-date, Signature=9e722e5b7bfa163447e2a14df118b45ebd283c5aea72019bdf921d6e7dc01a9a)r   r   r-   z)https://dynamodb.us-east-2.amazonaws.com/zapplication/x-amz-json-1.0zDynamoDB_20120810.CreateTable)r'   x-amz-targetz/20200811/us-east-2/dynamodb/aws4_request, SignedHeaders=content-type;host;x-amz-date;x-amz-security-token;x-amz-target, Signature=eb8bce0e63654bba672d4a8acb07e72d69210c1797d56ce024dbbc31beb2a2c7z dynamodb.us-east-2.amazonaws.com)r   r   r-   r'   r0   r.   c                       e Zd Zej                  j                  de       ej                  d      d               Z	d Z
d Zd Zy)TestRequestSignerz;region, time, credentials, original_request, signed_requestgoogle.auth._helpers.utcnowc           	         t         j                   j                  |d      |_        t        j                  |      }t        j
                  |j                  d      |j                  d      |j                  d            }|j                  ||j                  d      |j                  d      |j                  d      |j                  d            }	|	|k(  sJ y )	N%Y-%m-%dT%H:%M:%SZr   r   r+   r   r   r(   r   )datetimestrptimereturn_valuer   RequestSignerAwsSecurityCredentialsgetget_request_options)
selfutcnowregiontimecredentialsoriginal_requestsigned_requestrequest_signercredentials_objectactual_signed_requests
             Hplatform/gsutil/third_party/google-auth-library-python/tests/test_aws.pytest_get_request_optionsz*TestRequestSigner.test_get_request_optionsb  s     '//88?ST**62 77OOO,OO/0OO,-

 !/ B B  '  *  (  +!
 %666    c                    t        j                  d      }t        j                  t              5 }|j                  t        j                  t        t              dd       d d d        j                  d      sJ y # 1 sw Y   xY w)Nr)   invalidr   Invalid AWS service URL
r   r9   pytestraises
ValueErrorr<   r:   ACCESS_KEY_IDSECRET_ACCESS_KEYmatchr=   rD   excinfos      rG   0test_get_request_options_with_missing_scheme_urlzBTestRequestSigner.test_get_request_options_with_missing_scheme_urlz  sh    **;7]]:&'..**=:KL ' }}7888 '&   0A;;Bc                    t        j                  d      }t        j                  t              5 }|j                  t        j                  t        t              dd       d d d        j                  d      sJ y # 1 sw Y   xY w)Nr)   zhttp://invalidr   rL   rM   rT   s      rG   0test_get_request_options_with_invalid_scheme_urlzBTestRequestSigner.test_get_request_options_with_invalid_scheme_url  sh    **;7]]:&'..**=:KL  ' }}7888 '&rW   c                    t        j                  d      }t        j                  t              5 }|j                  t        j                  t        t              dd       d d d        j                  d      sJ y # 1 sw Y   xY w)Nr)   r   r   rL   rM   rT   s      rG   2test_get_request_options_with_missing_hostname_urlzDTestRequestSigner.test_get_request_options_with_missing_hostname_url  sh    **;7]]:&'..**=:KL ' }}7888 '&rW   N)__name__
__module____qualname__rN   markparametrizeTEST_FIXTURESmockpatchrH   rV   rY   r[    rI   rG   r2   r2   a  sM    [[E} TZZ-.7 /7(
9
9
9rI   r2   c                   *    e Zd Z	 	 	 	 	 ddZd Zd Zy)"TestAwsSecurityCredentialsSupplierNc                 J    || _         || _        || _        || _        || _        y N)_security_credentials_region_credentials_exception_region_exception_expected_context)r=   security_credentialsr?   credentials_exceptionregion_exceptionexpected_contexts         rG   __init__z+TestAwsSecurityCredentialsSupplier.__init__  s+     &:"&;#!1!1rI   c                     | j                   | j                   |k(  sJ | j                  | j                  | j                  S rh   )rm   rk   ri   r=   contextrequests      rG   get_aws_security_credentialsz?TestAwsSecurityCredentialsSupplier.get_aws_security_credentials  sF    !!-))W444&&2---)))rI   c                     | j                   | j                   |k(  sJ | j                  | j                  | j                  S rh   )rm   rl   rj   rt   s      rG   get_aws_regionz1TestAwsSecurityCredentialsSupplier.get_aws_region  sD    !!-))W444!!-(((||rI   )NNNNN)r\   r]   r^   rr   rw   ry   rd   rI   rG   rf   rf     s"     ""2*rI   rf   c                      e Zd ZdZdZeeedZdZ	dZ
deeedZdeeeedZd	d
dddj'                  e      dZe	 	 dMd       Ze	 	 	 	 	 	 	 	 	 	 	 	 dNd       Zeddeeddddddf
d       Ze	 dOd       Zeefd       Zeefd       Ze jB                  jE                  e#jH                  dd      d        Z%e jB                  jE                  e#jH                  dd      d        Z&e jB                  jE                  e#jH                  dd      d        Z'e jB                  jE                  e#jH                  dd      d        Z(e jB                  jE                  e#jH                  dd      d        Z)d Z*d Z+d Z,d  Z-d! Z.d" Z/d# Z0d$ Z1d% Z2d& Z3d' Z4d( Z5d) Z6d* Z7d+ Z8 e jB                  d,      d-        Z9 e jB                  d,      e jB                  ju                  e;jx                  i       d.               Z= e jB                  d,      e jB                  ju                  e;jx                  e>j                  ee>j~                  ei      d/               Z@ e jB                  d,      e jB                  ju                  e;jx                  e>j                  ee>j                  ei      d0               ZB e jB                  d,      e jB                  ju                  e;jx                  e>j                  ei      d1               ZC e jB                  d,      e jB                  ju                  e;jx                  e>j                  ee>j~                  ee>j                  ei      d2               ZD e jB                  d,      d3        ZE e jB                  d,      d4        ZF e jB                  d,      d5        ZG e jB                  d,      d6        ZH e jB                  d,      d7        ZI e jB                  d,      d8        ZJ e jB                  d,      d9        ZK e jB                  d,      d:        ZLd; ZMd< ZNd= ZOd> ZP e jB                  d?eQ       e jB                  d,      d@               ZR e jB                  d?eQ       e jB                  d,      dA               ZS e jB                  dBeT       e jB                  d?eQ       e jB                  d,      dC                      ZU e jB                  dBeT       e jB                  d?eQ       e jB                  d,      dD                      ZVdE ZW e jB                  d,      dF        ZX e jB                  d,      dG        ZY e jB                  d,      dH        ZZdI Z[dJ Z\ e jB                  d?eQ       e jB                  d,      dK               Z] e jB                  d?eQ       e jB                  d,      dL               Z^y)PTestCredentialsr)   zgcp-aws-role)AccessKeyIdSecretAccessKeyTokenawsimdsv2sessiontokenr*   aws1)environment_id
region_urlr   regional_cred_verification_url)r   r   r   r   imdsv2_session_token_urlACCESS_TOKEN-urn:ietf:params:oauth:token-type:access_tokenBearer   )access_tokenissued_token_type
token_type
expires_inscopec                    t        j                  |      }|j                  ||d      }|j                  d      |j                  d      d|j                  d      j                  d      dd|j                  d      j                  d      dd|j                  d      j                  d      dgd	}|j                  A|j                  d      j                  d
|j                  d      j                  d
      d       |j                  d      j                  dt        d      f t        j                  j                  t        j                  |dd            S )zUtility to generate serialize AWS signed requests.
        This makes it easy to assert generated subject tokens based on the
        provided AWS security credentials, regions and AWS STS endpoint.
        r   r   r   r   r   )keyvaluer   r-   r   r.   zx-goog-cloud-target-resource),:T)
separators	sort_keys)r   r9   r<   r;   session_tokenappendAUDIENCEurllibparsequotejsondumps)clsaws_security_credentialsregion_namer   rD   rC   reformatted_signed_requests          rG   "make_serialized_aws_signed_requestz2TestCredentials.make_serialized_aws_signed_request  sW    **;7';;$c6
 "%%e,$((2 ++//	:>>O ););I)F)J)J6)RS'+//	:>>|L
&
"  $11=&**95<<1+//	:>>?UV 	#&&y1882XF	
 	 ||!!JJ*zT
 	
rI   Nc                 d   g }|r|rDt        j                  t        j                  d      }||_        ||_        |j                  |       t        j                  t        j                  d      }||_        |r%dj                  |      j                  d      |_        |j                  |       |rDt        j                  t        j                  d      }||_        ||_        |j                  |       |rUt        j                  t        j                  d      }||_        |r|j                  d      |_        |j                  |       |rht        j                  t        j                  d      }||_        |r)t        j                  |      j                  d      |_        |j                  |       |rft        j                  t        j                  d      }||_        t        j                  |      j                  d      |_        |j                  |       |	rft        j                  t        j                  d      }|	|_        t        j                  |
      j                  d      |_        |j                  |       t        j                  t        j                        }||_        |S )zUtility function to generate a mock HTTP request object.
        This will facilitate testing various edge cases by specify how the
        various endpoints will respond while generating a Google Access token
        in an AWS environment.
        T)instancez{}butf-8)rb   create_autospecr   Responsestatusr(   r   formatencoder   r   Requestside_effect)r   region_statusr   role_status	role_namesecurity_credentials_statussecurity_credentials_datatoken_status
token_dataimpersonation_statusimpersonation_dataimdsv2_session_token_statusimdsv2_session_token_data	responsesimdsv2_session_responseregion_responserole_responsesecurity_credentials_responsetoken_responseimpersonation_responserv   s                        rG   make_mock_requestz!TestCredentials.make_mock_request  sQ   * 	**.*>*>&&+' 2M'./H',  !89 #2293E3EPTUO%2O"',||K'@'G'G'P$_-&&*&:&:""T'# .I#*+D#(45 001C1CdSM#.M %.%5%5g%>"]+&,0,@,@""T-) 4O)0(59ZZ-6&/ .2 :;!11)2D2DtTN$0N!"&**Z"8"?"?"HN^,%)%9%9""T&" -A")*.**5G*H*O*OPW*X"'34&&y'8'89'rI   c                 T    t        j                  t        t        |||
|||||||	      S )N)audiencesubject_token_type	token_urltoken_info_url!service_account_impersonation_urlcredential_source!aws_security_credentials_supplier	client_idclient_secretquota_project_idscopesdefault_scopes)r   Credentialsr   SUBJECT_TOKEN_TYPE)r   r   r   r   r   r   r   r   r   r   r   s              rG   make_credentialsz TestCredentials.make_credentialsf  s9     1).O/.O'-)
 	
rI   c                 f    |d   |k(  sJ |d   |k(  sJ |r
|d   |k(  sJ d|vs|d   J d|vsJ y )Nr   r   r   bodyrd   )r   request_kwargsr   r   r   s        rG   "assert_aws_metadata_request_kwargsz2TestCredentials.assert_aws_metadata_request_kwargs  sf     e$+++h'6111!),777N2nY6O6WWW^+++rI   c                 D   |d   |k(  sJ |d   dk(  sJ |d   |k(  sJ |d   J t         j                  j                  |d         }t        |      t        |j	                               k(  sJ |D ]-  \  }}|j                  d      ||j                  d         k(  r-J  y Nr   r   r   r   r   r   )r   r   	parse_qsllenkeysdecode)r   r   r   request_datar   body_tupleskvs           rG   assert_token_request_kwargsz+TestCredentials.assert_token_request_kwargs  s     e$	111h'6111i(G333f%111ll,,^F-CD;3|'8'8':#;;;;!FQ88G$QXXg5F(GGGG "rI   c                     |d   |k(  sJ |d   dk(  sJ |d   |k(  sJ |d   J t        j                  |d   j                  d            }||k(  sJ y r   )r   loadsr   )r   r   r   r   r   	body_jsons         rG   #assert_impersonation_request_kwargsz3TestCredentials.assert_impersonation_request_kwargs  s{     e$(IIIIh'6111i(G333f%111JJ~f5<<WEF	L(((rI   rr   )r8   c                    t         j                  j                  t        t        t
        t        t        ddit        t        t        | j                  d
      }t        |t         j                        sJ |j                  t        t        t
        t        t        ddit        t        | j                  d t        d t               y )Ntoken_lifetime_seconds
  )
r   r   r   r   r   service_account_impersonationr   r   r   r   r   r   r   r   r   %service_account_impersonation_optionsr   r   r   r   r   workforce_pool_user_projectuniverse_domain)r   r   	from_infor   r   	TOKEN_URLTOKEN_INFO_URL!SERVICE_ACCOUNT_IMPERSONATION_URL	CLIENT_IDCLIENT_SECRETr   CREDENTIAL_SOURCE
isinstanceassert_called_once_withr	   r=   	mock_initrA   s      rG   test_from_info_full_optionsz+TestCredentials.test_from_info_full_options  s    oo//$&8&"05V2JD1Q&!.$4%)%;%;
  +s777))1).O3KT2R'"44.2-(,3 	* 	
rI   c                     t         j                  j                  t        t        t
        | j                  d      }t        |t         j                        sJ |j                  t        t        t
        d d i d d | j                  d d d t               y )Nr   r   r   r   r   )
r   r   r   r   r   r   r   r   r   r	   r   s      rG   $test_from_info_required_options_onlyz4TestCredentials.test_from_info_required_options_only  s    oo//$&8&%)%;%;	
 +s777))1.224"44.2!(,3 	* 	
rI   c                    t               }t        j                  j                  t        t
        t        |d      }t        |t        j                        sJ |j                  t        t
        t        d d i d d d |d d t               y )N)r   r   r   r   r   )
rf   r   r   r   r   r   r   r   r   r	   )r=   r   supplierrA   s       rG   test_from_info_supplierz'TestCredentials.test_from_info_supplier  s    57oo//$&8&5=	
 +s777))1.224".6!(,3 	* 	
rI   c                    t         t        t        t        t        ddit
        t        t        | j                  t        d}|j                  d      }|j                  t        j                  |             t        j                  j!                  t#        |            }t%        |t        j                        sJ |j'                  t         t        t        t        t        ddit
        t        | j                  d t        d t               y )Nr   r   )r   r   r   r   r   r   r   r   r   r   r   config.jsonr   )r   r   r   r   r   r   r   r   r   r	   joinwriter   r   r   r   	from_filestrr   r   r=   r   tmpdirinfoconfig_filerA   s         rG   test_from_file_full_optionsz+TestCredentials.test_from_file_full_options  s     !"4",1R.F-M"* 0!%!7!76
 kk-0$**T*+oo//K0@A +s777))1).O3KT2R'"44.2-(,3 	* 	
rI   c                    t         t        t        | j                  d}|j	                  d      }|j                  t        j                  |             t        j                  j                  t        |            }t        |t        j                        sJ |j                  t         t        t        d d i d d | j                  d d d t               y )Nr   r   r   )r   r   r   r   r   r   r   r   r   r   r  r  r   r   r	   r  s         rG   $test_from_file_required_options_onlyz4TestCredentials.test_from_file_required_options_only1  s     !"4"!%!7!7	
 kk-0$**T*+oo//K0@A +s777))1.224"44.2!(,3 	* 	
rI   c                     ddi}t        j                  t              5 }| j                  |       d d d        j	                  d      sJ y # 1 sw Y   xY w)Nunsupportedr   r   )No valid AWS 'credential_source' providedrN   rO   rP   r   rS   r=   r   rU   s      rG   *test_constructor_invalid_credential_sourcez:TestCredentials.test_constructor_invalid_credential_sourceO  sP    *G4]]:&'!!4E!F ' }}IJJJ '&s   AAc                     t        j                  t              5 }| j                  | j                  d       d d d        j                  d      sJ y # 1 sw Y   xY w)Ntest)r   r   z]AWS credential cannot have both a credential source and an AWS security credentials supplier.)rN   rO   rP   r   r   rS   r=   rU   s     rG   7test_constructor_invalid_credential_source_and_supplierzGTestCredentials.test_constructor_invalid_credential_source_and_supplierX  sX    ]]:&'!!"&"8"828 "  ' }}l
 	
 
 '&s   AAc                     t        j                  t              5 }| j                          d d d        j	                  d      sJ y # 1 sw Y   xY w)NzPA valid credential source or AWS security credentials supplier must be provided.r  r  s     rG   9test_constructor_invalid_no_credential_source_or_supplierzITestCredentials.test_constructor_invalid_no_credential_source_or_supplierd  sE    ]]:&'!!# ' }}_
 	
 
 '&s   AAc                     | j                   j                         }d|d<   t        j                  t              5 }| j                  |       d d d        j                  d      sJ y # 1 sw Y   xY w)Nazure1r   r  r  r   copyrN   rO   rP   r   rS   r  s      rG   'test_constructor_invalid_environment_idz7TestCredentials.test_constructor_invalid_environment_idm  sf     22779.6*+]]:&'!!4E!F ' }}IJJJ '&   A((A1c                     | j                   j                         }|j                  d       t        j                  t
              5 }| j                  |       d d d        j                  d      sJ y # 1 sw Y   xY w)Nr   r  r  )r   r  poprN   rO   rP   r   rS   r  s      rG   .test_constructor_missing_cred_verification_urlz>TestCredentials.test_constructor_missing_cred_verification_urlw  si     22779>?]]:&'!!4E!F ' }}IJJJ '&s   A44A=c                     | j                   j                         }d|d<   t        j                  t              5 }| j                  |       d d d        j                  d      sJ y # 1 sw Y   xY w)Naws3r   r  z6aws version '3' is not supported in the current build.r  r  s      rG   /test_constructor_invalid_environment_id_versionz?TestCredentials.test_constructor_invalid_environment_id_version  sf     22779.4*+]]:&'!!4E!F ' }}VWWW '&r  c           	          | j                  | j                  j                               }|j                  dt        t
        t        t        | j                  t        dk(  sJ y )Nr  r   )typer   r   r   r   r   r   )	r   r   r  r  r   r   r   r   r	   r=   rA   s     rG   	test_infozTestCredentials.test_info  sc    ++"4499; , 
 & "4",!%!7!76$
 
 	
 
rI   c                     | j                  | j                  j                               }|j                  t        k(  sJ y )Nr  )r   r   r  r   r   r%  s     rG   test_token_info_urlz#TestCredentials.test_token_info_url  s?    ++"4499; , 
 ))^;;;rI   c                     t         D ]D  }| j                  | j                  j                         |dz         }|j                  |dz   k(  rDJ  y )Nz/introspectr   r   )VALID_TOKEN_URLSr   r   r  r   r=   r   rA   s      rG   test_token_info_url_customz*TestCredentials.test_token_info_url_custom  sV    #C//"&"8"8"="="? #m 3 0 K
 --#2EFFF $rI   c                 v    | j                  | j                  j                         d       }|j                  rJ y )Nr*  )r   r   r  r   r%  s     rG   test_token_info_url_negativez,TestCredentials.test_token_info_url_negative  s?    ++"4499;D , 
 -----rI   c                     t         D ]D  }| j                  | j                  j                         |dz         }|j                  |dz   k(  rDJ  y )Nz/token)r   r   )r+  r   r   r  
_token_urlr,  s      rG   test_token_url_customz%TestCredentials.test_token_url_custom  sT    #C//"&"8"8"="="?> 0 K
 ))cHn=== $rI   c                     t         D ]L  }| j                  | j                  j                         |t        z         }|j
                  |t        z   k(  rLJ  y )N)r   r   )(VALID_SERVICE_ACCOUNT_IMPERSONATION_URLSr   r   r  'SERVICE_ACCOUNT_IMPERSONATION_URL_ROUTE"_service_account_impersonation_urlr,  s      rG   -test_service_account_impersonation_url_customz=TestCredentials.test_service_account_impersonation_url_custom  s_    ;C//"&"8"8"="="?AA 0 K AA==   <rI   c                     t        j                  t        t        | j                  j                               }|j                  dt        t        t        | j                  j                         t        dk(  sJ y )N)r   r   r   r   r$  r   r   r   r   r   )	r   r   r   r   r   r  r  r   r	   r%  s     rG    test_info_with_default_token_urlz0TestCredentials.test_info_with_default_token_url  sh    oo1"4499;
 & "4"!%!7!7!<!<!>6$
 
 	
 
rI   c                     t        j                  t        t        | j                  j                         d      }|j                  dt        t        d| j                  j                         ddk(  sJ y )Nztestdomain.org)r   r   r   r   r   z#https://sts.testdomain.org/v1/tokenr9  )r   r   r   r   r   r  r  r%  s     rG   5test_info_with_default_token_url_with_universe_domainzETestCredentials.test_info_with_default_token_url_with_universe_domain  sk    oo1"4499;,	
 & "4>!%!7!7!<!<!>/$
 
 	
 
rI   c                 6   | j                   j                         }|j                  d       | j                  |      }t	        j
                  t        j                        5 }|j                  d        d d d        j                  d      sJ y # 1 sw Y   xY w)Nr   r  zUnable to determine AWS region)
r   r  r  r   rN   rO   r   RefreshErrorretrieve_subject_tokenrS   )r=   r   rA   rU   s       rG   .test_retrieve_subject_token_missing_region_urlz>TestCredentials.test_retrieve_subject_token_missing_region_url  s     !22779l+++>O+P]]:223w..t4 4 }}>??? 43s   !BBr3   c                    t         j                   j                  | j                  d      |_        | j	                  t
        j                  | j                  t
        j                  | j                  t
        j                  | j                        }| j                  | j                        }|j                  |      }|| j                  t        j                  t         t"        t$                    k(  sJ | j'                  |j(                  d   d   t*               | j'                  |j(                  d   d   t,               | j'                  |j(                  d   d   dj/                  t,        | j                        dd	i       | j	                  t
        j                  | j                  t
        j                  | j                  
      }|j                  |       t1        |j(                        dk(  sJ | j'                  |j(                  d   d   t,               | j'                  |j(                  d   d   dj/                  t,        | j                        dd	i       y )Nr5   r   r   r   r   r   r   r  r         {}/{}r'   application/json)r   r   r   r   )r6   r7   AWS_SIGNATURE_TIMEr8   r   http_clientOK
AWS_REGIONAWS_ROLE!AWS_SECURITY_CREDENTIALS_RESPONSEr   r   r?  r   r   r:   rQ   rR   TOKENr   call_args_list
REGION_URLSECURITY_CREDS_URLr   r   )r=   r>   rv   rA   subject_tokennew_requests         rG   Btest_retrieve_subject_token_success_temp_creds_no_environment_varszRTestCredentials.test_retrieve_subject_token_success_temp_creds_no_environment_vars  s    '//88##%9
 ((%..#mm(3&*&L&L ) 
 ++d>T>T+U#::7C G G&&}6GO!
 
 	
 
 	//""1%a(*	
 	//""1%a(*<	
 	//""1%a(NN-t}}=/0	
 ,,#mm(3&*&L&L	 - 
 	**;7 ;--.!333//&&q)!,.@	
 	//&&q)!,NN-t}}=/0	
rI   c           
         t         j                   j                  | j                  d      |_        | j	                  t
        j                  | j                  t
        j                  | j                  t
        j                  | j                  t
        j                  | j                        }| j                  j                         }t        |d<   | j                  |      }|j                  |      }|| j!                  t#        j$                  t&        t(        t*                    k(  sJ | j-                  |j.                  d   d   t        ddid	       | j-                  |j.                  d   d   t0        d
| j                  i       | j-                  |j.                  d   d   t        ddid	       | j-                  |j.                  d   d   t2        d
| j                  i       | j-                  |j.                  d   d   dj5                  t2        | j                        d| j                  d       | j	                  t
        j                  | j                  t
        j                  | j                  t
        j                  | j                        }|j                  |       t7        |j.                        dk(  sJ | j-                  |j.                  d   d   t        ddid	       | j-                  |j.                  d   d   t2        d
| j                  i       | j-                  |j.                  d   d   dj5                  t2        | j                        d| j                  d       y )Nr5   r   r   r   r   r   r   r   r   r   r  r   rC  $X-aws-ec2-metadata-token-ttl-seconds300PUTX-aws-ec2-metadata-tokenrD        rE  rF  r'   rY  r   r   r   r   r   r   )r6   r7   rG  r8   r   rH  rI  rJ  rK  rL  AWS_IMDSV2_SESSION_TOKENr   r  IMDSV2_SESSION_TOKEN_URLr   r?  r   r   r:   rQ   rR   rM  r   rN  rO  rP  r   r   )r=   r>   rv   credential_source_token_urlrA   rQ  rR  s          rG   Itest_retrieve_subject_token_success_temp_creds_no_environment_vars_idmsv2zYTestCredentials.test_retrieve_subject_token_success_temp_creds_no_environment_vars_idmsv20  s.   
 '//88##%9
 ((%..#mm(3&*&L&L(3&*&C&C ) 	
 '+&<&<&A&A&C# % 	$&	
 ++9 , 
 $::7C G G&&}6GO!
 
 	
 
 	//""1%a($3U;		
 	//""1%a(')F)FG	
 	//""1%a($3U;		
 	//""1%a(')F)FG	
 	//""1%a(NN-t}}= 2,0,I,I	
 ,,#mm(3&*&L&L(3&*&C&C - 
 	**;7 ;--.!333//""1%a($3U;		
 	//&&q)!,')F)FG	
 	//&&q)!,NN-t}}= 2,0,I,I	
rI   c                 p   t         j                   j                  | j                  d      |_        | j	                  t
        j                  | j                  t
        j                  | j                  t
        j                  | j                        }| j                  j                         }t        |d<   | j                  |      }|j                  |      }|| j                  t!        j"                  t$        t&        t(                    k(  sJ | j+                  |j,                  d   d   t        ddid	       | j+                  |j,                  d   d   t.        d
| j                  i       | j+                  |j,                  d   d   dj1                  t.        | j                        d| j                  d       y Nr5   r]  r   r  r   rC  rV  rW  rX  rY  rD  rE  rF  r\  r6   r7   rG  r8   r   rH  rI  rK  rL  r^  r   r  r_  r   r?  r   r   r:   rQ   rR   rM  r   rN  rP  r   r=   r>   rv   r`  rA   rQ  s         rG   `test_retrieve_subject_token_success_temp_creds_environment_vars_missing_secret_access_key_idmsv2zpTestCredentials.test_retrieve_subject_token_success_temp_creds_environment_vars_missing_secret_access_key_idmsv2      '//88##%9
 ((#mm(3&*&L&L(3&*&C&C ) 
 '+&<&<&A&A&C# % 	$&	
 ++9 , 
 $::7C G G&&}6GO!
 
 	
 
 	//""1%a($3U;		
 	//""1%a(')F)FG	
 	//""1%a(NN-t}}= 2,0,I,I	
rI   c                 p   t         j                   j                  | j                  d      |_        | j	                  t
        j                  | j                  t
        j                  | j                  t
        j                  | j                        }| j                  j                         }t        |d<   | j                  |      }|j                  |      }|| j                  t!        j"                  t$        t&        t(                    k(  sJ | j+                  |j,                  d   d   t        ddid	       | j+                  |j,                  d   d   t.        d
| j                  i       | j+                  |j,                  d   d   dj1                  t.        | j                        d| j                  d       y rc  rd  re  s         rG   \test_retrieve_subject_token_success_temp_creds_environment_vars_missing_access_key_id_idmsv2zlTestCredentials.test_retrieve_subject_token_success_temp_creds_environment_vars_missing_access_key_id_idmsv2  rg  rI   c                 p   t         j                   j                  | j                  d      |_        | j	                  t
        j                  | j                  t
        j                  | j                  t
        j                  | j                        }| j                  j                         }t        |d<   | j                  |      }|j                  |      }|| j                  t!        j"                  t$        t&        t(                    k(  sJ | j+                  |j,                  d   d   t        ddid	       | j+                  |j,                  d   d   t.        d
| j                  i       | j+                  |j,                  d   d   dj1                  t.        | j                        d| j                  d       y rc  rd  re  s         rG   Ttest_retrieve_subject_token_success_temp_creds_environment_vars_missing_creds_idmsv2zdTestCredentials.test_retrieve_subject_token_success_temp_creds_environment_vars_missing_creds_idmsv2
  s   
 '//88##%9
 ((#mm(3&*&L&L(3&*&C&C ) 
 '+&<&<&A&A&C# % 	$&	
 ++9 , 
 $::7C G G&&}6GO!
 
 	
 
 	//""1%a($3U;		
 	//""1%a(')F)FG	
 	//""1%a(NN-t}}= 2,0,I,I	
rI   c                 `   t         j                   j                  | j                  d      |_        | j	                  t
        j                  | j                        }| j                  j                         }t        |d<   | j                  |      }|j                  |       |j                  rJ y )Nr5   )r   r   r   r  )r6   r7   rG  r8   r   rH  rI  rK  r   r  r_  r   r?  called)r=   r>   rv   r`  rA   s        rG   5test_retrieve_subject_token_success_temp_creds_idmsv2zETestCredentials.test_retrieve_subject_token_success_temp_creds_idmsv2=  s     '//88##%9
 ((#$-- ) 
 '+&<&<&A&A&C# % 	$&	
 ++9 , 
 	**73>>!!>rI   c           
      L   t         j                   j                  | j                  d      |_        | j	                  t
        j                  | j                  t
        j                  | j                  t
        j                  | j                  t
        j                  | j                        }| j                  j                         }| j                  |      }|j                  |      }|| j                  t!        j"                  t$        t&        t(                    k(  sJ | j+                  |j,                  d   d   t.        ddid       | j+                  |j,                  d   d   t0        d	| j                  i       | j+                  |j,                  d
   d   t.        ddid       | j+                  |j,                  d   d   t2        d	| j                  i       | j+                  |j,                  d   d   dj5                  t2        | j                        d| j                  d       y )Nr5   rU  r  r   rC  rV  rW  rX  rY  rD  rZ  r[  rE  rF  r\  )r6   r7   rG  r8   r   rH  rI  rJ  rK  rL  r^  CREDENTIAL_SOURCE_IPV6r  r   r?  r   r   r:   rQ   rR   rM  r   rN  IMDSV2_SESSION_TOKEN_URL_IPV6REGION_URL_IPV6SECURITY_CREDS_URL_IPV6r   re  s         rG   (test_retrieve_subject_token_success_ipv6z8TestCredentials.test_retrieve_subject_token_success_ipv6X  s   &//88##%9
 ((%..#mm(3&*&L&L(3&*&C&C ) 	
 '+&A&A&F&F&H#++9 , 
 $::7C G G&&}6GO!
 
 	
 
 	//""1%a()3U;		
 	//""1%a(')F)FG	
 	//""1%a()3U;		
 	//""1%a(#')F)FG	
 	//""1%a(NN2DMMB 2,0,I,I	
rI   c                    t         j                   j                  | j                  d      |_        | j	                  t
        j                  d      }| j                  j                         }t        |d<   | j                  |      }t        j                  t        j                        5 }|j                  |       d d d        j!                  d      sJ | j#                  |j$                  d   d   t        d	d
id       y # 1 sw Y   GxY w)Nr5   unauthorized)r   r   r   r  z$Unable to retrieve AWS Session Tokenr   rC  rV  rW  rX  )r6   r7   rG  r8   r   rH  UNAUTHORIZEDr   r  r_  r   rN   rO   r   r>  r?  rS   r   rN  )r=   r>   rv   r`  rA   rU   s         rG   0test_retrieve_subject_token_session_error_idmsv2z@TestCredentials.test_retrieve_subject_token_session_error_idmsv2  s   &//88##%9
 (((3(@(@&4 ) 
 '+&<&<&A&A&C# % 	$&	
 ++9 , 
 ]]:223w..w7 4 }}DEEE 	//""1%a($3U;		
 43s   )DD
c                     | j                   j                         }|j                  d       t        j                  j	                  | j
                  d      |_        | j                  t        j                  | j                  t        j                  | j                  t        j                  |      }| j                  | j                        }|j                  |      }|| j                  t!        j"                  t$        t&                    k(  sJ y )Nr~   r5   rB  r  )rL  r  r  r6   r7   rG  r8   r   rH  rI  rJ  rK  r   r   r?  r   r   r:   rQ   rR   )r=   r>   security_creds_responserv   rA   rQ  s         rG   Gtest_retrieve_subject_token_success_permanent_creds_no_environment_varszWTestCredentials.test_retrieve_subject_token_success_permanent_creds_no_environment_vars  s     #'"H"H"M"M"O##G,&//88##%9
 ((%..#mm(3&= ) 
 ++d>T>T+U#::7C G G&&}6GH!
 
 	
 
rI   c                 V   |j                  t        j                  t               |j                  t        j                  t
               |j                  t        j                  t               |j                  t        j                  | j                         t        j                  j                  | j                  d      |_        | j                  | j                        }|j                  d       }|| j!                  t#        j$                  t        t
        t                    k(  sJ y Nr5   r  )setenvr   AWS_ACCESS_KEY_IDrQ   AWS_SECRET_ACCESS_KEYrR   AWS_SESSION_TOKENrM  rJ  r6   r7   rG  r8   r   r   r?  r   r   r:   r=   r>   monkeypatchrA   rQ  s        rG   4test_retrieve_subject_token_success_environment_varszDTestCredentials.test_retrieve_subject_token_success_environment_vars  s    +==}M+AACTU+==uE+66H&//88##%9
 ++d>T>T+U#::4@ G G&&}6GO!
 
 	
 
rI   c                 V   |j                  t        j                  t               |j                  t        j                  t
               |j                  t        j                  t               |j                  t        j                  | j                         t        j                  j                  | j                  d      |_        | j                  | j                        }|j!                  d       }|| j#                  t%        j&                  t        t
        t                    k(  sJ y r}  r~  r   r  rQ   r  rR   r  rM  AWS_DEFAULT_REGIONrJ  r6   r7   rG  r8   r   r   r?  r   r   r:   r  s        rG   Htest_retrieve_subject_token_success_environment_vars_with_default_regionzXTestCredentials.test_retrieve_subject_token_success_environment_vars_with_default_region  s     	+==}M+AACTU+==uE+>>P&//88##%9
 ++d>T>T+U#::4@ G G&&}6GO!
 
 	
 
rI   c                    |j                  t        j                  t               |j                  t        j                  t
               |j                  t        j                  t               |j                  t        j                  d       |j                  t        j                  | j                         t        j                  j                  | j                  d      |_        | j                  | j                        }|j!                  d       }|| j#                  t%        j&                  t        t
        t                    k(  sJ y )NzMalformed AWS Regionr5   r  r  r  s        rG   Jtest_retrieve_subject_token_success_environment_vars_with_both_regions_setzZTestCredentials.test_retrieve_subject_token_success_environment_vars_with_both_regions_set  s    	+==}M+AACTU+==uE+>>@VW 	+66H&//88##%9
 ++d>T>T+U#::4@ G G&&}6GO!
 
 	
 
rI   c                    |j                  t        j                  t               |j                  t        j                  t
               |j                  t        j                  | j                         t        j                  j                  | j                  d      |_
        | j                  | j                        }|j                  d       }|| j                  t        j                   t        t
                    k(  sJ y r}  )r~  r   r  rQ   r  rR   rJ  r6   r7   rG  r8   r   r   r?  r   r   r:   r  s        rG   Etest_retrieve_subject_token_success_environment_vars_no_session_tokenzUTestCredentials.test_retrieve_subject_token_success_environment_vars_no_session_token	  s     	+==}M+AACTU+66H&//88##%9
 ++d>T>T+U#::4@ G G&&}6GH!
 
 	
 
rI   c                 X   |j                  t        j                  t               |j                  t        j                  t
               |j                  t        j                  t               t        j                  j                  | j                  d      |_        | j                  t        j                  | j                        }| j!                  | j"                        }|j%                  |      }|| j'                  t)        j*                  t        t
        t                    k(  sJ y )Nr5   r   r   r  )r~  r   r  rQ   r  rR   r  rM  r6   r7   rG  r8   r   rH  rI  rJ  r   r   r?  r   r   r:   )r=   r>   r  rv   rA   rQ  s         rG   Btest_retrieve_subject_token_success_environment_vars_except_regionzRTestCredentials.test_retrieve_subject_token_success_environment_vars_except_region  s     	+==}M+AACTU+==uE&//88##%9
 ((%..doo ) 
 ++d>T>T+U#::7C G G&&}6GO!
 
 	
 
rI   c                 4   | j                  t        j                        }| j                  | j                        }t        j                  t        j                        5 }|j                  |       d d d        j                  d      sJ y # 1 sw Y   xY wN)r   r  zUnable to retrieve AWS region)r   rH  BAD_REQUESTr   r   rN   rO   r   r>  r?  rS   r=   rv   rA   rU   s       rG   8test_retrieve_subject_token_error_determining_aws_regionzHTestCredentials.test_retrieve_subject_token_error_determining_aws_region1  sy    (({7N7N(O++d>T>T+U]]:223w..w7 4 }}=>>> 43    BBc                 h   | j                  t        j                  | j                  t        j                        }| j                  | j                        }t        j                  t        j                        5 }|j                  |       d d d        j                  d      sJ y # 1 sw Y   xY w)N)r   r   r   r  z Unable to retrieve AWS role name)r   rH  rI  rJ  r  r   r   rN   rO   r   r>  r?  rS   r  s       rG   6test_retrieve_subject_token_error_determining_aws_rolezFTestCredentials.test_retrieve_subject_token_error_determining_aws_role;  s    ((%..#// ) 

 ++d>T>T+U]]:223w..w7 4 }}@AAA 43s   :B((B1c                    | j                   j                         }|j                  d       | j                  t        j
                  | j                        }| j                  |      }t        j                  t        j                        5 }|j                  |       d d d        j                  d      sJ y # 1 sw Y   xY w)Nr   r  r  zIUnable to determine the AWS metadata server security credentials endpoint)r   r  r  r   rH  rI  rJ  r   rN   rO   r   r>  r?  rS   )r=   r   rv   rA   rU   s        rG   @test_retrieve_subject_token_error_determining_security_creds_urlzPTestCredentials.test_retrieve_subject_token_error_determining_security_creds_urlI  s     !22779e$((%..doo ) 
 ++>O+P]]:223w..w7 4 }}X
 	
 
 43s   B::Cc                    | j                  t        j                  | j                  t        j                  | j                  t        j
                        }| j                  | j                        }t        j                  t        j                        5 }|j                  |       d d d        j                  d      sJ y # 1 sw Y   xY w)N)r   r   r   r   r   r  z+Unable to retrieve AWS security credentials)r   rH  rI  rJ  rK  r  r   r   rN   rO   r   r>  r?  rS   r  s       rG   @test_retrieve_subject_token_error_determining_aws_security_credszPTestCredentials.test_retrieve_subject_token_error_determining_aws_security_credsZ  s    ((%..#mm(3(?(? ) 
 ++d>T>T+U]]:223w..w7 4 }}KLLL 43s   CCz/google.auth.metrics.python_and_auth_lib_versionc           
         t         j                   j                  | j                  d      |_        | j	                  t        j                  t        t        t                    }ddt        z   dd}dt        ddj                  t              |t        d	}| j                  t         j"                  | j$                  t         j"                  | j&                  t         j"                  | j(                  t         j"                  | j*                  
      }| j-                  t.        t0        | j2                  t4        t        dg      }|j7                  |       t9        |j:                        dk(  sJ | j=                  |j:                  d   d   ||       |j>                  | j*                  d   k(  sJ |j@                  t4        k(  sJ |jB                  t        k(  sJ |jD                  dgk(  sJ y )Nr5   r&   Basic _gl-python/3.7 auth/1.1 google-byoid-sdk sa-impersonation/false config-lifetime/false source/awsr'   r   x-goog-api-client/urn:ietf:params:oauth:grant-type:token-exchanger   r   
grant_typer   requested_token_typer   rQ  r   r   r   r   r   r   r   r   r   ignoredr   r   r   r   r   r   r[  rZ  rC  r   #r6   r7   rG  r8   r   r   r:   rQ   rR   rM  BASIC_AUTH_ENCODINGr   r   SCOPESr   r   rH  rI  rJ  rK  rL  SUCCESS_RESPONSEr   r   r   r   r   refreshr   rN  r   tokenr   r   r   r=   r>   mock_auth_lib_valueexpected_subject_tokentoken_headerstoken_request_datarv   rA   s           rG   @test_refresh_success_without_impersonation_ignore_default_scopeszPTestCredentials.test_refresh_success_without_impersonation_ignore_default_scopesj  s    '//88##%9
 "&!H!H&&}6GO"
 @%(;; "C
 L $SXXf%3"4
 ((%..#mm(3&*&L&L$,, ) 	
 ++'"44-%; , 
 	G$7))*a///((""1%a(-9K	
   D$9$9.$IIII++/????!!V+++))i[888rI   c           
         t         j                   j                  | j                  d      |_        | j	                  t        j                  t        t        t                    }ddt        z   dd}dt        ddj                  t              |t        d	}| j                  t         j"                  | j$                  t         j"                  | j&                  t         j"                  | j(                  t         j"                  | j*                  
      }| j-                  t.        t0        | j2                  t4        d t              }|j7                  |       t9        |j:                        dk(  sJ | j=                  |j:                  d   d   ||       |j>                  | j*                  d   k(  sJ |j@                  t4        k(  sJ |jB                  J |jD                  t        k(  sJ y )Nr5   r&   r  r  r  r  r   r   r  r  r  r[  rZ  rC  r   r  r  s           rG   =test_refresh_success_without_impersonation_use_default_scopeszMTestCredentials.test_refresh_success_without_impersonation_use_default_scopes  s    '//88##%9
 "&!H!H&&}6GO"
 @%(;; "C
 L $SXXf%3"4
 ((%..#mm(3&*&L&L$,, ) 	
 ++'"44-! , 
 	G$7))*a///((""1%a(-9K	
   D$9$9.$IIII++/????!!)))))V333rI   z:google.auth.metrics.token_request_access_token_impersonatec                    t         j                   j                  | j                  d      |_        t	        j
                         j                  d      t        j                  d      z   j                  d      dz   }| j                  t        j                  t        t        t                    }dd	t        z   d
d}dt         dd|t"        d}d|d}ddj%                  | j&                  d         t(        t*        dd}	d t,        dd}
| j/                  t0        j2                  | j4                  t0        j2                  | j6                  t0        j2                  | j8                  t0        j2                  | j&                  t0        j2                  |
      }| j;                  t<        t>        | j@                  tB        t(        t,        dg      }|jE                  |       tG        |jH                        dk(  sJ | jK                  |jH                  d   d   ||       | jM                  |jH                  d   d   |	|
       |jN                  |d    k(  sJ |jP                  t(        k(  sJ |jR                  t,        k(  sJ |jT                  dgk(  sJ y )!Nr5   r   microsecondr   secondsTZr&   r  ^gl-python/3.7 auth/1.1 google-byoid-sdk sa-impersonation/true config-lifetime/false source/awsr  r  r   #https://www.googleapis.com/auth/iamr  SA_ACCESS_TOKENaccessToken
expireTimerF  	Bearer {}r   0x0r'   authorizationzx-goog-user-projectr  zx-allowed-locations3600s	delegatesr   lifetime
r   r   r   r   r   r   r   r   r   r   r  r   r   r   r   r   r   r      rZ  rC  r[  r  +r6   r7   rG  r8   r   r>   replace	timedelta	isoformatr   r   r:   rQ   rR   rM  r  r   r   r   r  r   5IMPERSONATE_ACCESS_TOKEN_REQUEST_METRICS_HEADER_VALUEr  r   rH  rI  rJ  rK  rL  r   r   r   r   r   r  r   rN  r   r   r  r   r   r   r=   r>   mock_metrics_header_valuer  expire_timer  r  r  r   impersonation_headersimpersonation_request_datarv   rA   s                rG   =test_refresh_success_with_impersonation_ignore_default_scopeszMTestCredentials.test_refresh_success_with_impersonation_ignore_default_scopes  s{    '//88##%9
 OO%%!%4x7I7IRV7WW
)C.3 "&!H!H&&}6GO"
 @%(;; "B
 L $S:3"4
 -%"

 /(//0E0En0UV#3!V#(!
 &
"
 ((%..#mm(3&*&L&L$,,!,5 ) 
 ++'"44.O-%; , 	
 	G$7))*a///((""1%a(-9K	

 	00""1%a(!&	

   $:=$IIII++/????!!V+++))i[888rI   c                 
   t         j                   j                  | j                  d      |_        t	        j
                         j                  d      t        j                  d      z   j                  d      dz   }| j                  t        j                  t        t        t                    }dd	t        z   d
d}dt         dd|t"        d}d|d}ddj%                  | j&                  d         t(        t*        dd}	d t,        dd}
| j/                  t0        j2                  | j4                  t0        j2                  | j6                  t0        j2                  | j8                  t0        j2                  | j&                  t0        j2                  |
      }| j;                  t<        t>        | j@                  tB        t(        d t,              }|jE                  |       tG        |jH                        dk(  sJ | jK                  |jH                  d   d   ||       | jM                  |jH                  d   d   |	|
       |jN                  |d   k(  sJ |jP                  t(        k(  sJ |jR                  J |jT                  t,        k(  sJ y ) Nr5   r   r  r   r  r  r  r&   r  r  r  r  r   r  r  r  r  rF  r  r   r  r  r  r  r  r  r  rZ  rC  r[  r  r  r  s                rG   :test_refresh_success_with_impersonation_use_default_scopeszJTestCredentials.test_refresh_success_with_impersonation_use_default_scopes=  su    '//88##%9
 OO%%!%4x7I7IRV7WW
)C.3 "&!H!H&&}6GO"
 @%(;; "B
 L $S:3"4
 -%"

 /(//0E0En0UV#3!V#(!
 &
"
 ((%..#mm(3&*&L&L$,,!,5 ) 
 ++'"44.O-! , 	
 	G$7))*a///((""1%a(-9K	

 	00""1%a(!&	

   $:=$IIII++/????!!)))))V333rI   c                 4   | j                  t        j                        }| j                  | j                        }t        j                  t        j                        5 }|j                  |       d d d        j                  d      sJ y # 1 sw Y   xY wr  )r   rH  r  r   r   rN   rO   r   r>  r  rS   r  s       rG   .test_refresh_with_retrieve_subject_token_errorz>TestCredentials.test_refresh_with_retrieve_subject_token_error  sy    (({7N7N(O++d>T>T+U]]:223w( 4 }}=>>> 43r  c                    t         j                   j                  | j                  d      |_        | j	                         }t        j                  t        t              }t        || j                        }| j                  |      }|j                  |      }|| j                  t        j                  t        t                    k(  sJ y Nr5   rn   r?   r   )r6   r7   rG  r8   r   r   r:   rQ   rR   rf   rJ  r   r?  r   r=   r>   rv   rn   r   rA   rQ  s          rG   1test_retrieve_subject_token_success_with_supplierzATestCredentials.test_retrieve_subject_token_success_with_supplier  s    &//88##%9
 ((*"99, 
 6!5doo
 ++h+W#::7C G G&&}6GH!
 
 	
 
rI   c                    t         j                   j                  | j                  d      |_        | j	                         }t        j                  t        t        t              }t        || j                        }| j                  |      }|j                  |      }|| j                  t        j                  t        t        t                    k(  sJ y r  )r6   r7   rG  r8   r   r   r:   rQ   rR   rM  rf   rJ  r   r?  r   r  s          rG   ?test_retrieve_subject_token_success_with_supplier_session_tokenzOTestCredentials.test_retrieve_subject_token_success_with_supplier_session_token  s    &//88##%9
 ((*"99,e 
 6!5doo
 ++h+W#::7C G G&&}6GO!
 
 	
 
rI   c                 p   t         j                   j                  | j                  d      |_        | j	                         }t        j                  t        t              }t        j                  t        t              }t        || j                  |      }| j                  |      }|j!                  |       y )Nr5   )rn   r?   rq   r  )r6   r7   rG  r8   r   r   SupplierContextr   r   r   r:   rQ   rR   rf   rJ  r   r?  )r=   r>   rv   rq   rn   r   rA   s          rG   Atest_retrieve_subject_token_success_with_supplier_correct_contextzQTestCredentials.test_retrieve_subject_token_success_with_supplier_correct_context  s    &//88##%9
 ((*+;;
  #99, 
 6!5??-
 ++h+W**73rI   c                 X   | j                         }t        j                  d      }t        | j                  |      }| j                  |      }t        j                  t        j                        5 }|j                  |       d d d        j                  d      sJ y # 1 sw Y   xY w)N
Test error)r?   ro   r  )
r   r   r>  rf   rJ  r   rN   rO   r  rS   )r=   rv   expected_exceptionr   rA   rU   s         rG   /test_retrieve_subject_token_error_with_supplierz?TestCredentials.test_retrieve_subject_token_error_with_supplier  s    ((*'44\B5??:L
 ++h+W]]:223w( 4 }}]+++ 43s   2B  B)c                    | j                         }t        j                  d      }t        j                  t
        t              }t        ||      }| j                  |      }t        j                  t        j                        5 }|j                  |       d d d        j                  d      sJ y # 1 sw Y   xY w)Nr  )rn   rp   r  )r   r   r>  r   r:   rQ   rR   rf   r   rN   rO   r  rS   )r=   rv   r  rn   r   rA   rU   s          rG   6test_retrieve_subject_token_error_with_supplier_regionzFTestCredentials.test_retrieve_subject_token_error_with_supplier_region  s    ((*'44\B"99, 
 6!5/

 ++h+W]]:223w( 4 }}]+++ 43s   B44B=c           	         t         j                   j                  | j                  d      |_        t	        j
                         j                  d      t        j                  d      z   j                  d      dz   }| j                  t        j                  t        t        t                    }dd	t        z   d
d}dt         dd|t"        d}d|d}ddj%                  | j&                  d         t(        t*        dd}d t,        dd}	| j/                  t0        j2                  | j&                  t0        j2                  |      }
t5        t        j                  t        t        t              | j6                        }| j9                  t:        t<        |t>        t(        t,        dg      }|jA                  |
       tC        |
jD                        dk(  sJ | jG                  |
jD                  d   d   ||       | jI                  |
jD                  d   d   ||	       |jJ                  |d   k(  sJ |jL                  t(        k(  sJ |jN                  t,        k(  sJ |jP                  dgk(  sJ y ) Nr5   r   r  r   r  r  r  r&   r  zggl-python/3.7 auth/1.1 google-byoid-sdk sa-impersonation/true config-lifetime/false source/programmaticr  r  r   r  r  r  r  rF  r  r   r  r  r  r  )r   r   r   r   r  r  )r   r   r   r   r   r   r   rD  rC  r  ))r6   r7   rG  r8   r   r>   r  r  r  r   r   r:   rQ   rR   rM  r  r   r   r   r  r   r  r  r   rH  rI  rf   rJ  r   r   r   r   r  r   rN  r   r   r  r   r   r   )r=   r>   r  r  r  r  r  r   r  r  rv   r   rA   s                rG   5test_refresh_success_with_supplier_with_impersonationzETestCredentials.test_refresh_success_with_supplier_with_impersonation	  st    '//88##%9
 OO%%!%4x7I7IRV7WW
)C.3 "&!H!H&&}6GO"
 @%(;; "K
 L $S:3"4
 -%"

 /(//0E0En0UV#3!V#(!
 &
"
 (($,,!,5	 ) 
 6!$!;!;0%" ??	
 ++'.6.O-%; , 	
 	G$7))*a///((""1%a(-9K	

 	00""1%a(!&	

   $:=$IIII++/????!!V+++))i[888rI   c                    t         j                   j                  | j                  d      |_        | j	                  t        j                  t        t        t                    }ddt        z   dd}dt        ddj                  t              |t        d	}| j                  t         j"                  | j$                  
      }t'        t        j                  t        t        t              | j(                        }| j+                  t,        t.        |t0        t        dg      }|j3                  |       t5        |j6                        dk(  sJ | j9                  |j6                  d   d   ||       |j:                  | j$                  d   k(  sJ |j<                  t0        k(  sJ |j>                  t        k(  sJ |j@                  dgk(  sJ y )Nr5   r&   r  zhgl-python/3.7 auth/1.1 google-byoid-sdk sa-impersonation/false config-lifetime/false source/programmaticr  r  r   r   r  )r   r   r  r  )r   r   r   r   r   r   rC  r   r   )!r6   r7   rG  r8   r   r   r:   rQ   rR   rM  r  r   r   r  r   r   rH  rI  r  rf   rJ  r   r   r   r   r  r   rN  r   r  r   r   r   )	r=   r>   r  r  r  r  rv   r   rA   s	            rG   "test_refresh_success_with_supplierz2TestCredentials.test_refresh_success_with_supplier_	  s    '//88##%9
 "&!H!H&&}6GO"
 @%(;; "L
 L $SXXf%3"4
 (($D4I4I ) 
 6!$!;!;0%" ??	
 ++'.6-%; , 
 	G$7))*a///((""1%a(-9K	
   D$9$9.$IIII++/????!!V+++))i[888rI   )r)   r/   )NNNNNNNNNNNN)Nr   )_r\   r]   r^   rJ  rK  rQ   rR   rM  rL  r^  rG  rO  rP  CRED_VERIFICATION_URLr   rr  rs  rq  rp  r   r  r  classmethodr   r   r   r   r   r   r   r   r   rb   rc   objectr   r   r   r   r   r  r	  r  r  r  r  r  r"  r&  r(  r-  r/  r2  r7  r:  r<  r@  rS  dictosenvironra  r   r  rf  r  ri  rk  rn  rt  rx  r{  r  r  r  r  r  r  r  r  r  !LANG_LIBRARY_METRICS_HEADER_VALUEr  r  r  r  r  r  r  r  r  r  r  r  r  rd   rI   rG   r{   r{     su   JH$,)%
  7/  !*?	 !%&*?$A 'L&!   ]	-
 -
^  $("&!$("&W Wr  *.%*.
 
8 7<, , >G
H 
H  +L) ) 
ZZs
F 
 G 
D 
ZZs
F
 G
8 
ZZs
F
 G
< 
ZZs
F"
 G"
H 
ZZs
F
 G
:K


KKX
<G.>
 
"
@ TZZ-.9
 /9
v TZZ-.	ZZ__RZZ$d
 % /d
L TZZ-.	ZZ__


''..	
/
 //
b TZZ-.	ZZ__


''224E	
/
 //
b TZZ-.	ZZ__RZZ"2"="=z!JK/
 L //
b TZZ-.	ZZ__


''..224E	
" /"$ TZZ-.:
 /:
x TZZ-.
 /
: TZZ-.
 /
4 TZZ-.
 /
  TZZ-.
 /
$ TZZ-.
 /
, TZZ-.
 /
" TZZ-.
 /
*?B
"M  TZZ96 TZZ-.49 /	
49l TZZ96 TZZ-.44 /	
44l TZZDJ TZZ96 TZZ-.R9 /		R9h TZZDJ TZZ96 TZZ-.R4 /		R4h? TZZ-.
 /
( TZZ-.
 /
( TZZ-.4 /4,,,$ TZZ96 TZZ-.T9 /	
T9l TZZ96 TZZ-.39 /	
39rI   r{   ):r6   http.clientclientrH  r   r  urllib.parser   rb   rN   google.authr   r   r   r   r   r   google.auth.credentialsr	   r  r  r   r   r  SERVICE_ACCOUNT_EMAIL&SERVICE_ACCOUNT_IMPERSONATION_URL_BASEr   r5  r   r   r  r   r   r   r   rO  r_  rP  rr  rq  rs  r  rQ   rR   rM  REQUEST_PARAMSr+  INVALID_TOKEN_URLSr4  *INVALID_SERVICE_ACCOUNT_IMPERSONATION_URLSr   unquotera   r  r2   AwsSecurityCredentialsSupplierrf   r{   rd   rI   rG   <module>r     s    !  	    2  ( " ! ; @ 6 %= !	0 K 4 ' +b*h*h+ ' +-TT " & 
H	1	;B vR
D W W I F  U  '>  	z n
  <
, (. *F 	*!K	

 ) ?@	
 * "U&7	
4 	*!K	

 7 ?@	
 8 "U&7	
4 	*!K	

 , ?@	
 - "U&7	
4 	*!K	

 / ?@	
 0 "U&7	
4 	*!K	

 3 ?@	
 4 "U&7	
4 	*!K	

 : ?@	
 ; "U&7	
4 	*!K	

 6 ?@	
 7 "U&7	
4 	*!K	

 188$$[1  ?@	
 288$$[1  "U&7
	
< 	*!K	

 * ?Q	
 + "Y&7			
6 	*!K	

 * ?Q	
 + "Y&7			
6 	*!K	

 * ?gN	
 + "W&7			
6 	*!K	

 * C7 	
 + "b& C7	 
	
!@ 	*!K	

 2 ?@	
 3 "U&7	
0 	*!2#	
 b	

 c!?"  y"y 60(-	
6 	*!2#	
 d	

 e!?"  y"y 60(-	
6 	'>OPd	

 e!?"  d"d 60
	
, 	*!2#	
 > < ? #	
 ?!?"  X"X ;0 < ?(-	 #	
# {~B;9 ;9|)K)K <Z9f Z9rI   