
    i                       d dl Z d dlZd dlmZ d dlZd dlZd dlZd dlZd dl	m
Z
 d dlZd dlmZmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d	Zd
ZdZdZdZdj5                  e      Zeez   ZdZddgZej>                  jA                  ej>                  jC                  e"      d      Z#ej>                  jA                  e#d      Z$ej>                  jA                  e#d      Z%ej>                  jA                  e#d      Z&ej>                  jA                  e#d      Z'ej>                  jA                  e#d      Z(ej>                  jA                  e#d      Z)ej>                  jA                  e#d      Z*ej>                  jA                  e#d      Z+dZ, e-e$      5 Z.e.j_                         Z0ddd        e-e%      5 Z. ejb                  e.      Z2e2jg                  e,      Z4ddd        e-e)d      5 Z5 e jl                   e
jn                  e
jp                   e
jr                  e
jt                  e5j_                                           jw                  d      Z<ddd        e-e+d      5 Z5 e jl                   e
jn                  e
jp                   e
jr                  e
jt                  e5j_                                           jw                  d      Z=ddd       dZ>dZ?d Z@d!ZAd"ZBd#ZCd$ZDg d%ZEg d&ZFg d'ZGg d(ZH G d) d*ej                        ZJ G d+ d,eK      ZLy# 1 sw Y   kxY w# 1 sw Y   DxY w# 1 sw Y   xY w# 1 sw Y   nxY w)-    N)crypto)_helpersexternal_account)
exceptions)identity_pool)metrics)	transport)DEFAULT_UNIVERSE_DOMAINusernamepasswordzdXNlcm5hbWU6cGFzc3dvcmQ=z1service-1234@service-name.iam.gserviceaccount.comz.https://us-east1-iamcredentials.googleapis.comz5/v1/projects/-/serviceAccounts/{}:generateAccessTokenQUOTA_PROJECT_IDscope1scope2datazexternal_subject_token.txtzexternal_subject_token.jsonztrust_chain_with_leaf.pemztrust_chain_without_leaf.pemztrust_chain_wrong_order.pemzpublic_cert.pemzprivatekey.pemzother_cert.pemaccess_tokenrbutf-8z#https://sts.googleapis.com/v1/tokenz(https://sts.googleapis.com/v1/introspectz$urn:ietf:params:oauth:token-type:jwtzi//iam.googleapis.com/projects/123456/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_IDzR//iam.googleapis.com/locations/global/workforcePools/POOL_ID/providers/PROVIDER_IDz)urn:ietf:params:oauth:token-type:id_token"WORKFORCE_POOL_USER_PROJECT_NUMBER)	https://sts.googleapis.comz$https://us-east-1.sts.googleapis.comz$https://US-EAST-1.sts.googleapis.comz$https://sts.us-east-1.googleapis.comz$https://sts.US-WEST-1.googleapis.comz$https://us-east-1-sts.googleapis.comz$https://US-WEST-1-sts.googleapis.comz/https://us-west-1-sts.googleapis.com/path?queryz&https://sts-us-east-1.p.googleapis.com)%https://iamcredentials.googleapis.comzsts.googleapis.comhttps://zhttp://sts.googleapis.comzhttps://st.s.googleapis.comz$https://us-eas	-1.sts.googleapis.comz#https:/us-east-1.sts.googleapis.comz%https://US-WE/ST-1-sts.googleapis.comz$https://sts-us-east-1.googleapis.comz$https://sts-US-WEST-1.googleapis.comz(testhttps://us-east-1.sts.googleapis.comz,https://us-east-1.sts.googleapis.comevil.comz.https://us-east-1.us-east-1.sts.googleapis.comz$https://us-ea.s.t.sts.googleapis.comz"https://sts.googleapis.comevil.comz%hhttps://us-east-1.sts.googleapis.comz!https://us- -1.sts.googleapis.comzhttps://-sts.googleapis.comz-https://us-east-1.sts.googleapis.com.evil.comzhttps://sts.pgoogleapis.comhttps://p.googleapis.comzhttps://sts.p.comzhttp://sts.p.googleapis.comz https://xyz-sts.p.googleapis.comz$https://sts-xyz.123.p.googleapis.comz!https://sts-xyz.p1.googleapis.comzhttps://sts-xyz.p.foo.comz$https://sts-xyz.p.foo.googleapis.com)	r   z/https://us-east-1.iamcredentials.googleapis.comz/https://US-EAST-1.iamcredentials.googleapis.comz/https://iamcredentials.us-east-1.googleapis.comz/https://iamcredentials.US-WEST-1.googleapis.comz/https://us-east-1-iamcredentials.googleapis.comz/https://US-WEST-1-iamcredentials.googleapis.comz:https://us-west-1-iamcredentials.googleapis.com/path?queryz1https://iamcredentials-us-east-1.p.googleapis.com)r   ziamcredentials.googleapis.comr   z$http://iamcredentials.googleapis.comz&https://iamcre.dentials.googleapis.comz/https://us-eas	-1.iamcredentials.googleapis.comz.https:/us-east-1.iamcredentials.googleapis.comz0https://US-WE/ST-1-iamcredentials.googleapis.comz/https://iamcredentials-us-east-1.googleapis.comz/https://iamcredentials-US-WEST-1.googleapis.comz3testhttps://us-east-1.iamcredentials.googleapis.comz7https://us-east-1.iamcredentials.googleapis.comevil.comz9https://us-east-1.us-east-1.iamcredentials.googleapis.comz/https://us-ea.s.t.iamcredentials.googleapis.comz-https://iamcredentials.googleapis.comevil.comz0hhttps://us-east-1.iamcredentials.googleapis.comz,https://us- -1.iamcredentials.googleapis.comz&https://-iamcredentials.googleapis.comz8https://us-east-1.iamcredentials.googleapis.com.evil.comz&https://iamcredentials.pgoogleapis.comr   zhttps://iamcredentials.p.comz&http://iamcredentials.p.googleapis.comz+https://xyz-iamcredentials.p.googleapis.comz/https://iamcredentials-xyz.123.p.googleapis.comz,https://iamcredentials-xyz.p1.googleapis.comz$https://iamcredentials-xyz.p.foo.comz/https://iamcredentials-xyz.p.foo.googleapis.comc                       e Zd Z	 ddZd Zy)TestSubjectTokenSupplierNc                 .    || _         || _        || _        y N)_subject_token_subject_token_exception_expected_context)selfsubject_tokensubject_token_exceptionexpected_contexts       Rplatform/gsutil/third_party/google-auth-library-python/tests/test_identity_pool.py__init__z!TestSubjectTokenSupplier.__init__   s     ,(?%!1    c                     | j                   | j                   |k(  sJ | j                  | j                  | j                  S r   )r   r   r   )r    contextrequests      r$   get_subject_tokenz*TestSubjectTokenSupplier.get_subject_token   sF    !!-))W444((4///"""r&   )NNN)__name__
__module____qualname__r%   r*    r&   r$   r   r      s    QU2#r&   r   c                   "   e Zd ZdeiZeddddZdZdeiZeddddZ	d	d
diiZ
d	ddiiZd	dediZd	dediZd	dediZdddddj%                  e      dZed        Zeej0                  dfd       Zeefd       Zeefd       Zeefd       Ze	 	 	 	 	 	 	 	 dmd       Zee e!ee"dddddddddfd       Z#e$jJ                  jM                  e'jP                  dd      d        Z)e$jJ                  jM                  e'jP                  dd      d         Z*e$jJ                  jM                  e'jP                  dd      d!        Z+e$jJ                  jM                  e'jP                  dd      d"        Z,e$jJ                  jM                  e'jP                  dd      d#        Z-e$jJ                  jM                  e'jP                  dd      d$        Z.e$jJ                  jM                  e'jP                  dd      d%        Z/d& Z0d' Z1d( Z2d) Z3d* Z4d+ Z5d, Z6d- Z7d. Z8d/ Z9d0 Z:d1 Z;d2 Z<d3 Z=d4 Z>d5 Z?d6 Z@d7 ZAd8 ZBd9 ZCd: ZDd; ZEd< ZFd= ZG e$jJ                  d>eHeIf      d?        ZJ e$jJ                  d>eHeIf      d@        ZK e$jJ                  d>eHeIf      dA        ZL e$jJ                  d>eHeIf      dB        ZM e$jJ                  d>eHeIf      dC        ZN e$jJ                  d>eHeIf      dD        ZO e$jJ                  d>eHeIf      dE        ZPdF ZQdG ZRdH ZSdI ZTdJ ZUdK ZVdL ZWdM ZXdN ZYdO ZZdP Z[dQ Z\dR Z]dS Z^dT Z_dU Z`dV ZadW ZbdX ZcdY ZddZ Zed[ Zfd\ Zgd] Zhd^ Zid_ Zjd` Zkda Zldb Zmdc Zndd Zode Zpdf Zqdg Zrdh Zsdi Zt e$jJ                  d>dj      dk        Zudl Zvy)nTestCredentialsfilejsonr   typesubject_token_field_namer1   formatzhttp://fakeurl.comurlr8   r7   certificateuse_default_certificate_configtruecertificate_config_locationzpath/to/configr;   trust_chain_pathACCESS_TOKEN-urn:ietf:params:oauth:token-type:access_tokenBearer   )r   issued_token_type
token_type
expires_inscopec                     t        j                  t        j                  d      }||_        t        |t              r+t        j                  |      j                  d      |_
        |S ||_
        |S )NT)instancer   )mockcreate_autospecr	   Responsestatus
isinstancedictr2   dumpsencoder   )clsrN   r   responses       r$   make_mock_responsez"TestCredentials.make_mock_response   s[    ''	(:(:TJ dD! JJt,33G<HM  !HMr&   Nc                 :   g }|j                  | j                  ||             t        |      dkD  r?|d   |d   |dd  }}}|j                  | j                  ||             t        |      dkD  r?t        j                  t
        j                        }||_        |S )Nr         )appendrU   lenrK   rL   r	   Requestside_effect)rS   token_status
token_dataextra_requests	responsesrN   r   r)   s           r$   make_mock_requestz!TestCredentials.make_mock_request   s     	//jIJ.!A% q!q!qr" )DF
 S33FDAB .!A% &&y'8'89'r&   c                 h    |d   |k(  sJ |d   dk(  sJ |d   |k(  sJ |j                  dd       J y )Nr8   methodGETheadersbody)get)rS   request_kwargsre   r8   s       r$    assert_credential_request_kwargsz0TestCredentials.assert_credential_request_kwargs  sV     e$+++h'5000i(G333!!&$/777r&   c                 D   |d   |k(  sJ |d   dk(  sJ |d   |k(  sJ |d   J t         j                  j                  |d         }t        |      t        |j	                               k(  sJ |D ]-  \  }}|j                  d      ||j                  d         k(  r-J  y Nr8   rc   POSTre   rf   r   )urllibparse	parse_qslrZ   keysdecode)rS   rh   re   request_data	token_urlbody_tupleskvs           r$   assert_token_request_kwargsz+TestCredentials.assert_token_request_kwargs  s     e$	111h'6111i(G333f%111ll,,^F-CD;3|'8'8':#;;;;!FQ88G$QXXg5F(GGGG "r&   c                     |d   |k(  sJ |d   dk(  sJ |d   |k(  sJ |d   J t        j                  |d   j                  d            }||k(  sJ y rk   )r2   loadsrq   )rS   rh   re   rr   !service_account_impersonation_url	body_jsons         r$   #assert_impersonation_request_kwargsz3TestCredentials.assert_impersonation_request_kwargs"  s{     e$(IIIIh'6111i(G333f%111JJ~f5<<WEF	L(((r&   c                 \   | j                   j                         }ddi}|rd|z   |d<   i }|j                  rd|d<   nd|d<   d|d<   |j                  r|j                  rd	|d
<   nd|d
<   nd|d
<   t        j                  |      |d<   |rd}ndj                  |	xs g       }d|d|||d}|r7t        j                  j                  t        j                  d|i            |d<   d}|rqt        j                         j                  d      t!        j"                  d      z   j%                  d      dz   }d|d}ddj'                  |d          |d!d"}d#|	d$d%}g }|
r!|j)                  t*        j,                  |
f       t/        |      }|j)                  t*        j,                  |f       |r,t/        |      }|j)                  t*        j,                  f        | j0                  |D cg c]  }|D ]  }|  c}} }t3        j4                  d&|'      5  |j7                  |       d#d#d#       t/        |j8                        t/        |      k(  sJ |
r"| j;                  |j8                  d   d(   d#       | j=                  |j8                  |   d(   |||       |r8| j?                  |j8                     d(   |       |j@                  d)   k(  sJ |j@                  |d    k(  sJ |jB                  |k(  sJ |jD                  |k(  sJ |jF                  |k(  sJ y#c c}}w # 1 sw Y   xY w)*a  Utility to assert that a credentials are initialized with the expected
        attributes by calling refresh functionality and confirming response matches
        expected one and that the underlying requests were populated with the
        expected parameters.
        Content-Typez!application/x-www-form-urlencodedzBasic Authorizationr<   zsa-impersonationfalsezconfig-lifetimer1   sourcer8   programmaticx-goog-api-clientz#https://www.googleapis.com/auth/iamrD   z/urn:ietf:params:oauth:grant-type:token-exchangerA   )
grant_typeaudiencerequested_token_typerH   r!   subject_token_typeuserProjectoptionsz9gl-python/3.7 auth/1.1 auth-request-type/at cred-type/impr   )microsecondrC   )secondsTZSA_ACCESS_TOKEN)accessToken
expireTimezapplication/jsonz	Bearer {}r   0x0)r~   authorizationr   zx-allowed-locationsN3600s)	delegatesrH   lifetimez:google.auth.metrics.token_request_access_token_impersonatereturn_valuerW   r   )$SUCCESS_RESPONSEcopy"_service_account_impersonation_url_credential_source_credential_source_filer   byoid_metrics_headerjoinrm   rn   quoter2   rQ   r   utcnowreplacedatetime	timedelta	isoformatr7   rY   http_clientOKrZ   ra   rK   patchrefreshcall_args_listri   rw   r|   tokenquota_project_idscopesdefault_scopes)rS   credentialsr   r!   r   rs   rz   basic_auth_encodingr   used_scopescredential_datar   r   workforce_pool_user_projecttoken_responsetoken_headersmetrics_optionstoken_scopestoken_request_datametrics_header_valueexpire_timeimpersonation_responseimpersonation_headersimpersonation_request_datarequeststoken_request_indeximpersonation_request_indexreqelr)   s                                 r$   %assert_underlying_credentials_refreshz5TestCredentials.assert_underlying_credentials_refresh1  s   . --224')LM-58K-KM/*9928O./29O./-4)*))22,2),1)(6OH%-4-I-I.
)* -@L88K$526L L $S!*"4
 ',2LL,>,>

M+FGH-y)
 H 	 - !))a)8$$T23ins#K
  1)&"
 !3!,!3!3N>4R!S%9',	%! "$#*& OO[^^_=>!(m89,*-h-'OO[^^-CDE'#'')O3R"3")OPZZH-
 (	
 7))*c(m;;;001G1G1J11MtT''""#67:		
 -33&&'BCAF%*1	 $$(>}(MMMM$$~(FFFF++/????!!V+++))^;;;A *P
 
s   )L
L""L+c                 F    t        j                  |||||
|||||||	|      S )N)r   r   rs   token_info_urlrz   credential_sourcesubject_token_supplier	client_idclient_secretr   r   r   r   )r   Credentials)rS   r   r   rs   r   r   r   r   r   r   rz   r   r   r   s                 r$   make_credentialsz TestCredentials.make_credentials  s>    " ((1).O/#9'-)(C
 	
r&   r%   r   c                    t         j                  j                  t        t        t
        t        t        ddit        t        t        | j                  d
      }t        |t         j                        sJ |j                  t        t        t
        t        t        ddit        t        | j                  d t        d t               y )Ntoken_lifetime_seconds
  
r   r   rs   r   rz   service_account_impersonationr   r   r   r   r   r   rs   r   rz   %service_account_impersonation_optionsr   r   r   r   r   r   universe_domain)r   r   	from_infoAUDIENCESUBJECT_TOKEN_TYPE	TOKEN_URLTOKEN_INFO_URL!SERVICE_ACCOUNT_IMPERSONATION_URL	CLIENT_IDCLIENT_SECRETr   CREDENTIAL_SOURCE_TEXTrO   assert_called_once_withr
   r    	mock_initr   s      r$   test_from_info_full_optionsz+TestCredentials.test_from_info_full_options  s    #//99$&8&"05V2JD1Q&!.$4%)%@%@
  +}'@'@AAA))1).O3KT2R'"99#'-(,3 	* 	
r&   c                     t         j                  j                  t        t        t
        | j                  d      }t        |t         j                        sJ |j                  t        t        t
        d d i d d | j                  d d d t               y )Nr   r   rs   r   r   )
r   r   r   r   r   r   r   rO   r   r
   r   s      r$   $test_from_info_required_options_onlyz4TestCredentials.test_from_info_required_options_only  s    #//99$&8&%)%@%@	
 +}'@'@AAA))1.224"99#'!(,3 	* 	
r&   c                    t               }t        j                  j                  t        t
        t        |d      }t        |t        j                        sJ |j                  t        t
        t        d d i d d d |d d t               y )N)r   r   rs   r   r   )
r   r   r   r   r   r   r   rO   r   r
   )r    r   supplierr   s       r$   test_from_info_supplierz'TestCredentials.test_from_info_supplier  s    +-#//99$&8&*2	
 +}'@'@AAA))1.224"#+!(,3 	* 	
r&   c                 2   t         j                  j                  t        t        t
        | j                  t        d      }t        |t         j                        sJ |j                  t        t        t
        d d i d d | j                  d d t        t               y )Nr   r   rs   r   r   r   )r   r   r   WORKFORCE_AUDIENCEWORKFORCE_SUBJECT_TOKEN_TYPEr   r   WORKFORCE_POOL_USER_PROJECTrO   r   r
   r   s      r$   test_from_info_workforce_poolz-TestCredentials.test_from_info_workforce_pool9  s    #//99.&B&%)%@%@/J
 +}'@'@AAA))';.224"99#'!(C3 	* 	
r&   c                    t         t        t        t        t        ddit
        t        t        | j                  d
}|j                  d      }|j                  t        j                  |             t        j                  j                  t!        |            }t#        |t        j                        sJ |j%                  t         t        t        t        t        ddit
        t        | j                  d t        d t&               y )Nr   r   r   config.jsonr   )r   r   r   r   r   r   r   r   r   r   writer2   rQ   r   r   	from_filestrrO   r   r
   r    r   tmpdirinfoconfig_filer   s         r$   test_from_file_full_optionsz+TestCredentials.test_from_file_full_optionsW  s     !"4",1R.F-M"* 0!%!<!<
 kk-0$**T*+#//99#k:JK +}'@'@AAA))1).O3KT2R'"99#'-(,3 	* 	
r&   c                    t         t        t        | j                  d}|j	                  d      }|j                  t        j                  |             t        j                  j                  t        |            }t        |t        j                        sJ |j                  t         t        t        d d i d d | j                  d d d t               y )Nr   r   r   )r   r   r   r   r   r   r2   rQ   r   r   r   r   rO   r   r
   r   s         r$   $test_from_file_required_options_onlyz4TestCredentials.test_from_file_required_options_only{  s     !"4"!%!<!<	
 kk-0$**T*+#//99#k:JK +}'@'@AAA))1.224"99#'!(,3 	* 	
r&   c                    t         t        t        | j                  t        d}|j                  d      }|j                  t        j                  |             t        j                  j                  t        |            }t        |t        j                        sJ |j                  t         t        t        d d i d d | j                  d d t        t               y )Nr   r   r   )r   r   r   r   r   r   r   r2   rQ   r   r   r   r   rO   r   r
   r   s         r$   test_from_file_workforce_poolz-TestCredentials.test_from_file_workforce_pool  s     +">"!%!<!<+F
 kk-0$**T*+#//99#k:JK +}'@'@AAA))';.224"99#'!(C3 	* 	
r&   c                     t        j                  t              5 }| j                  t        t
               d d d        j                  d      sJ y # 1 sw Y   xY w)N)r   r   zPworkforce_pool_user_project should not be set for non-workforce pool credentials)pytestraises
ValueErrorr   r   r   matchr    excinfos     r$   >test_constructor_nonworkforce_with_workforce_pool_user_projectzNTestCredentials.test_constructor_nonworkforce_with_workforce_pool_user_project  sT    ]]:&'!!!,G "  ' }}
 	
 
 '&s   AAc                     ddi}t        j                  t              5 }| j                  |       d d d        j	                  d      sJ y # 1 sw Y   xY w)Nunsupportedvaluer   zMissing credential_sourcer   r   r   r   r   r    r   r   s      r$    test_constructor_invalid_optionsz0TestCredentials.test_constructor_invalid_options  sP    *G4]]:&'!!4E!F ' }}9::: '&s   AAc                     | j                   t        d}t        j                  t              5 }| j                  |       d d d        j                  d      sJ y # 1 sw Y   xY w)N)r8   r1   r  Ambiguous credential_source)CREDENTIAL_URLSUBJECT_TOKEN_TEXT_FILEr   r   r   r   r   r  s      r$   -test_constructor_invalid_options_url_and_filez=TestCredentials.test_constructor_invalid_options_url_and_file  s[    &&+

 ]]:&'!!4E!F ' }};<<< '&   AA%c                     | j                   dddiid}t        j                  t              5 }| j	                  |       d d d        j                  d      sJ y # 1 sw Y   xY w)Nr:   r;   T)r8   r:   r  r
  r  r   r   r   r   r   r  s      r$   4test_constructor_invalid_options_url_and_certificatezDTestCredentials.test_constructor_invalid_options_url_and_certificate  sf    &&),Ld+ST

 ]]:&'!!4E!F ' }};<<< '&r  c                     t         dddiid}t        j                  t              5 }| j	                  |       d d d        j                  d      sJ y # 1 sw Y   xY w)Nr:   use_default_certificateT)r1   r:   r  r
  )r  r   r   r   r   r   r  s      r$   5test_constructor_invalid_options_file_and_certificatezETestCredentials.test_constructor_invalid_options_file_and_certificate  s`    +),Et+LM

 ]]:&'!!4E!F ' }};<<< '&s   AAc                     t         | j                  dddiid}t        j                  t              5 }| j                  |       d d d        j                  d      sJ y # 1 sw Y   xY w)Nr:   r  T)r1   r8   r:   r  r
  )r  r  r   r   r   r   r   r  s      r$   9test_constructor_invalid_options_url_file_and_certificatezITestCredentials.test_constructor_invalid_options_url_file_and_certificate  si    +&&),Et+LM
 ]]:&'!!4E!F ' }};<<< '&s   A!!A*c                     | j                   dd}t        j                  t              5 }| j	                  |       d d d        j                  d      sJ y # 1 sw Y   xY w)Naws1)r8   environment_idr  z>Invalid Identity Pool credential_source field 'environment_id'r  r  s      r$   /test_constructor_invalid_options_environment_idz?TestCredentials.test_constructor_invalid_options_environment_id  s\    $($7$76R]]:&'!!4E!F ' }}M
 	
 
 '&s   AA!c                     t        j                  t              5 }| j                  d       d d d        j	                  d      sJ y # 1 sw Y   xY w)Nznon-dictr  z?Invalid credential_source. The credential_source is not a dict.r  r   s     r$   *test_constructor_invalid_credential_sourcez:TestCredentials.test_constructor_invalid_credential_source  sJ    ]]:&'!!J!? ' }}N
 	
 
 '&s   A		Ac                     t        j                  t              5 }| j                          d d d        j	                  d      sJ y # 1 sw Y   xY w)NzGA valid credential source or a subject token supplier must be provided.r  r   s     r$   9test_constructor_invalid_no_credential_source_or_supplierzITestCredentials.test_constructor_invalid_no_credential_source_or_supplier  sE    ]]:&'!!# ' }}V
 	
 
 '&s   AAc                     t               }t        j                  t              5 }| j	                  | j
                  |       d d d        j                  d      sJ y # 1 sw Y   xY w)N)r   r   z[Identity pool credential cannot have both a credential source and a subject token supplier.)r   r   r   r   r   r   r   )r    r   r   s      r$   <test_constructor_invalid_both_credential_source_and_supplierzLTestCredentials.test_constructor_invalid_both_credential_source_and_supplier  s`    +-]]:&'!!"&"="='/ "  ' }}j
 	
 
 '&s   AA'c                     dddid}t        j                  t              5 }| j                  |       d d d        j	                  d      sJ y # 1 sw Y   xY w)Ntest.txtr4   xmlr6   r  z&Invalid credential_source format 'xml'r  r  s      r$   6test_constructor_invalid_credential_source_format_typezFTestCredentials.test_constructor_invalid_credential_source_format_type  sT    %/FE?K]]:&'!!4E!F ' }}FGGG '&   AAc                     dddid}t        j                  t              5 }| j                  |       d d d        j	                  d      sJ y # 1 sw Y   xY w)Nr"  r4   r2   r6   r  zBMissing subject_token_field_name for JSON credential_source formatr  r  s      r$   1test_constructor_missing_subject_token_field_namezATestCredentials.test_constructor_missing_subject_token_field_name'  s[    %/FF;KL]]:&'!!4E!F ' }}Q
 	
 
 '&r%  c                     ddddi}t        j                  t              5 }| j                  |       d d d        j	                  d      sJ y # 1 sw Y   xY w)Nr:   Ttest)r;   r=   r  !Invalid certificate configurationr  r  s      r$   6test_constructor_default_and_file_location_certificatezFTestCredentials.test_constructor_default_and_file_location_certificate1  s]    26/5
 ]]:&'!!4E!F ' }}ABBB '&r%  c                     dddii}t        j                  t              5 }| j                  |       d d d        j	                  d      sJ y # 1 sw Y   xY w)Nr:   r;   Fr  r*  r  r  s      r$   8test_constructor_no_default_or_file_location_certificatezHTestCredentials.test_constructor_no_default_or_file_location_certificate>  sV    *-Mu,UV]]:&'!!4E!F ' }}ABBB '&s   AAc           
          | j                  t        t        | j                  j	                         t
              }|j                  dt        t        t        t        | j                  t
        t        dk(  sJ y )N)r   r   r   r   r   )r4   r   r   rs   r   r   r   r   )
r   r   r   CREDENTIAL_SOURCE_TEXT_URLr   r   r   r   r   r
   r    r   s     r$   *test_info_with_workforce_pool_user_projectz:TestCredentials.test_info_with_workforce_pool_user_projectF  so    ++';"==BBD(C	 , 
 &*">",!%!@!@+F6	$
 	
 		
 	
r&   c           	          | j                  | j                  j                               }|j                  dt        t
        t        t        | j                  t        dk(  sJ y Nr  r   )r4   r   r   rs   r   r   r   )	r   r/  r   r   r   r   r   r   r
   r0  s     r$   %test_info_with_file_credential_sourcez5TestCredentials.test_info_with_file_credential_sourceY  c    ++"==BBD , 
 & "4",!%!@!@6$
 
 	
 
r&   c           	          | j                  | j                  j                               }|j                  dt        t
        t        t        | j                  t        dk(  sJ y r3  )	r   CREDENTIAL_SOURCE_JSON_URLr   r   r   r   r   r   r
   r0  s     r$   $test_info_with_url_credential_sourcez4TestCredentials.test_info_with_url_credential_sourceh  r5  r&   c           	          | j                  | j                  j                               }|j                  dt        t
        t        t        | j                  t        dk(  sJ y r3  )	r   CREDENTIAL_SOURCE_CERTIFICATEr   r   r   r   r   r   r
   r0  s     r$   ,test_info_with_certificate_credential_sourcez<TestCredentials.test_info_with_certificate_credential_sourcew  sc    ++"@@EEG , 
 & "4",!%!C!C6$
 
 	
 
r&   c           	          | j                  | j                  j                               }|j                  dt        t
        t        t        | j                  t        dk(  sJ y r3  )	r   )CREDENTIAL_SOURCE_CERTIFICATE_NOT_DEFAULTr   r   r   r   r   r   r
   r0  s     r$   8test_info_with_non_default_certificate_credential_sourcezHTestCredentials.test_info_with_non_default_certificate_credential_source  sc    ++"LLQQS , 
 & "4",!%!O!O6$
 
 	
 
r&   c                     t        j                  t        t        | j                  j                               }|j                  dt        t        t        | j                  t        dk(  sJ y )N)r   r   r   r   r4   r   r   rs   r   r   )	r   r   r   r   r/  r   r   r   r
   r0  s     r$    test_info_with_default_token_urlz0TestCredentials.test_info_with_default_token_url  sa    #//1"==BBD
 & "4"!%!@!@6$
 
 	
 
r&   c                     t        j                  t        t        | j                  j                         d      }|j                  dt        t        d| j                  ddk(  sJ y )Nztestdomain.org)r   r   r   r   r   z#https://sts.testdomain.org/v1/tokenr@  )r   r   r   r   r/  r   r   r0  s     r$   5test_info_with_default_token_url_with_universe_domainzETestCredentials.test_info_with_default_token_url_with_universe_domain  sd    #//1"==BBD,	
 & "4>!%!@!@/$
 
 	
 
r&   c                 >   |j                  d      }|j                  d       dt        |      i}| j                  |      }t	        j
                  t        j                        5 }|j                  d        d d d        j                  d      sJ y # 1 sw Y   xY w)Nz	empty.txt r1   r  z3Missing subject_token in the credential_source file)
r   r   r   r   r   r   r   RefreshErrorretrieve_subject_tokenr   )r    r   
empty_filer   r   r   s         r$   1test_retrieve_subject_token_missing_subject_tokenzATestCredentials.test_retrieve_subject_token_missing_subject_token  s    [[-
#S_5++>O+P]]:223w..t4 4 }}STTT 43s   %BBc                 t    | j                  | j                        }|j                  d       }|t        k(  sJ y Nr  )r   r   rG  TEXT_FILE_SUBJECT_TOKENr    r   r!   s      r$   %test_retrieve_subject_token_text_filez5TestCredentials.test_retrieve_subject_token_text_file  A    ++"99 , 
 $::4@ 7777r&   c                 t    | j                  | j                        }|j                  d       }|t        k(  sJ y rK  )r   CREDENTIAL_SOURCE_JSONrG  JSON_FILE_SUBJECT_TOKENrM  s      r$   %test_retrieve_subject_token_json_filez5TestCredentials.test_retrieve_subject_token_json_file  rO  r&   zCgoogle.auth.transport._mtls_helper._get_workload_cert_and_key_pathsc                     | j                  | j                        }|j                  d       }|t        j                  t
        g      k(  sJ y rK  )r   r:  rG  r2   rQ   CERT_FILE_CONTENTr    $mock_get_workload_cert_and_key_pathsr   r!   s       r$   /test_retrieve_subject_token_certificate_defaultz?TestCredentials.test_retrieve_subject_token_certificate_default  sO     ++"@@ , 
 $::4@

,=+> ????r&   c                     | j                  | j                        }|j                  d       }|t        j                  t
        g      k(  sJ y rK  )r   r=  rG  r2   rQ   rU  rV  s       r$   8test_retrieve_subject_token_certificate_non_default_pathzHTestCredentials.test_retrieve_subject_token_certificate_non_default_path  sO     ++"LL , 
 $::4@

,=+> ????r&   c                     | j                  | j                        }|j                  d       }|t        j                  t
        t        g      k(  sJ y rK  )r   3CREDENTIAL_SOURCE_CERTIFICATE_TRUST_CHAIN_WITH_LEAFrG  r2   rQ   rU  OTHER_CERT_FILE_CONTENTrV  s       r$   =test_retrieve_subject_token_certificate_trust_chain_with_leafzMTestCredentials.test_retrieve_subject_token_certificate_trust_chain_with_leaf  sR     ++"VV , 
 $::4@

,=?V+W XXXXr&   c                     | j                  | j                        }|j                  d       }|t        j                  t
        t        g      k(  sJ y rK  )r   6CREDENTIAL_SOURCE_CERTIFICATE_TRUST_CHAIN_WITHOUT_LEAFrG  r2   rQ   rU  r]  rV  s       r$   @test_retrieve_subject_token_certificate_trust_chain_without_leafzPTestCredentials.test_retrieve_subject_token_certificate_trust_chain_without_leaf   sR     ++"YY , 
 $::4@

,=?V+W XXXXr&   c                     | j                  | j                        }t        j                  t        j
                        5 }|j                  d        d d d        j                  d      sJ y # 1 sw Y   xY w)Nr  z?The leaf certificate must be at the top of the trust chain file)r   5CREDENTIAL_SOURCE_CERTIFICATE_TRUST_CHAIN_WRONG_ORDERr   r   r   rF  rG  r   r    rW  r   r   s       r$   Atest_retrieve_subject_token_certificate_trust_chain_invalid_orderzQTestCredentials.test_retrieve_subject_token_certificate_trust_chain_invalid_order  so     ++"XX , 
 ]]:223w..t4 4 }}M
 	
 
 43s    A..A7c                     | j                  ddddi      }t        j                  t        j                        5 }|j                  d        d d d        j                  d      sJ y # 1 sw Y   xY w)Nr:   r<   zfake.pemr>   r  z*Trust chain file 'fake.pem' was not found.r   r   r   r   rF  rG  r   rd  s       r$   Gtest_retrieve_subject_token_certificate_trust_chain_file_does_not_existzWTestCredentials.test_retrieve_subject_token_certificate_trust_chain_file_does_not_exist!  ss     ++6<(2  , 
 ]]:223w..t4 4 }}IJJJ 43s   A))A2c                     | j                  ddt        di      }t        j                  t        j
                        5 }|j                  d        d d d        j                  d      sJ y # 1 sw Y   xY w)Nr:   r<   r>   r  z8Error loading PEM certificates from the trust chain file)r   r  r   r   r   rF  rG  r   rd  s       r$   @test_retrieve_subject_token_certificate_invalid_trust_chain_filezPTestCredentials.test_retrieve_subject_token_certificate_invalid_trust_chain_file7  ss     ++6<(?  , 
 ]]:223w..t4 4 }}WXXX 43s   A--A6c                     t         dddd}| j                  |      }t        j                  t        j
                        5 }|j                  d        d d d        j                  dj                  t         d            sJ y # 1 sw Y   1xY wNr2   	not_foundr3   r6   r  @Unable to parse subject_token from JSON file '{}' using key '{}')	SUBJECT_TOKEN_JSON_FILEr   r   r   r   rF  rG  r   r7   r    r   r   r   s       r$   8test_retrieve_subject_token_json_file_invalid_field_namezHTestCredentials.test_retrieve_subject_token_json_file_invalid_field_nameM  s    +%;O
 ++>O+P]]:223w..t4 4 }}NUU'
 	
 
 43   BBc                 x   |j                  d      }|j                  d       t        |      dddd}| j                  |      }t	        j
                  t        j                        5 }|j                  d        d d d        j                  dj                  t        |      d            sJ y # 1 sw Y   6xY w)	Nzinvalid.json{r2   r   r3   r6   r  rn  )r   r   r   r   r   r   r   rF  rG  r   r7   )r    r   invalid_json_filer   r   r   s         r$   (test_retrieve_subject_token_invalid_jsonz8TestCredentials.test_retrieve_subject_token_invalid_json]  s    "KK7$)*%>R
 ++>O+P]]:223w..t4 4 }}NUU%&
 	
 
 43s   )B00B9c                     ddi}| j                  |      }t        j                  t        j                        5 }|j                  d        d d d        j                  d      sJ y # 1 sw Y   xY w)Nr1   z./not_found.txtr  z$File './not_found.txt' was not foundrg  rp  s       r$   *test_retrieve_subject_token_file_not_foundz:TestCredentials.test_retrieve_subject_token_file_not_foundp  sg    #%67++>O+P]]:223w..t4 4 }}DEEE 43s   A((A1c                 f    | j                  | j                        }|j                  t        k(  sJ y rK  )r   rQ  r   r   r0  s     r$   test_token_info_urlz#TestCredentials.test_token_info_urly  s6    ++"99 , 
 ))^;;;r&   c                     t         D ]D  }| j                  | j                  j                         |dz         }|j                  |dz   k(  rDJ  y )Nz/introspectr   r   )VALID_TOKEN_URLSr   rQ  r   r   r    r8   r   s      r$   test_token_info_url_customz*TestCredentials.test_token_info_url_custom  sV    #C//"&"="="B"B"D #m 3 0 K
 --}1DDDD $r&   c                 v    | j                  | j                  j                         d       }|j                  rJ y )Nr|  )r   rQ  r   r   r0  s     r$   test_token_info_url_negativez,TestCredentials.test_token_info_url_negative  s@    ++"99>>@QU , 
 -----r&   c                     t         D ]D  }| j                  | j                  j                         |dz         }|j                  |dz   k(  rDJ  y )Nz/token)r   rs   )r}  r   rQ  r   
_token_urlr~  s      r$   test_token_url_customz%TestCredentials.test_token_url_custom  sT    #C//"&"="="B"B"D> 0 K
 ))cHn=== $r&   c                     t         D ]L  }| j                  | j                  j                         |t        z         }|j
                  |t        z   k(  rLJ  y )N)r   rz   )(VALID_SERVICE_ACCOUNT_IMPERSONATION_URLSr   rQ  r   'SERVICE_ACCOUNT_IMPERSONATION_URL_ROUTEr   r~  s      r$   -test_service_account_impersonation_url_customz=TestCredentials.test_service_account_impersonation_url_custom  s_    ;C//"&"="="B"B"DAA 0 K AA==   <r&   c                     | j                  t        t        | j                  t        dg      }| j                  |t        t        t        t        d t        d t        t        dg       y )Nignoredr   r   r   r   r   r   r   r!   r   rs   rz   r   r   r   r   r   r   r   r   r   SCOPESr   r   rL  r   r   BASIC_AUTH_ENCODINGr0  s     r$   Jtest_refresh_text_file_success_without_impersonation_ignore_default_scopeszZTestCredentials.test_refresh_text_file_success_without_impersonation_ignore_default_scopes  sh     ++'"99%; , 
 	22#11.2 3!%; 	3 	
r&   c                     | j                  t        t        t        t        | j
                  t        t              }| j                  |t        t        t        t        d t        d t        t        d        y N)r   r   r   r   r   r   r   r   r   r!   r   rs   rz   r   r   r   r   r   )r   r   r   r   r   r   r  r   r   rL  r   r  r0  s     r$   Etest_refresh_workforce_success_with_client_auth_without_impersonationzUTestCredentials.test_refresh_workforce_success_with_client_auth_without_impersonation  sh    ++';'"99(C , 

 	22#'1;.2 3!(, 	3 	
r&   c                     | j                  t        t        t        t        | j
                  t        d       }| j                  |t        t        t        t        d t        d t        t        d        y r  )r   r   r   r   r   r   r  r   rL  r   r  r0  s     r$   Htest_refresh_workforce_success_with_client_auth_and_no_workforce_projectzXTestCredentials.test_refresh_workforce_success_with_client_auth_and_no_workforce_project  sh    ++';'"99(, , 

 	22#'1;.2 3!(, 	3 	
r&   c                     | j                  t        t        d d | j                  t        t
              }| j                  |t        t        t        t        d d d t        t        t
               y r  )	r   r   r   r   r  r   r   rL  r   r0  s     r$   Htest_refresh_workforce_success_without_client_auth_without_impersonationzXTestCredentials.test_refresh_workforce_success_without_client_auth_without_impersonation  sh    ++';"99(C , 

 	22#'1;.2 $!(C 	3 	
r&   c                     | j                  t        t        d d t        | j                  t
        t              }| j                  |t        t        t        t        t        d d t
        t
        t               y )N)r   r   r   r   rz   r   r   r   r  )
r   r   r   r   r   r  r   r   rL  r   r0  s     r$   Etest_refresh_workforce_success_without_client_auth_with_impersonationzUTestCredentials.test_refresh_workforce_success_without_client_auth_with_impersonation  sk    ++';.O"99(C , 
 	22#'1;.O $!(C 	3 	
r&   c                     | j                  t        t        | j                  d t              }| j                  |t        t        t        t        d t        d t        d t               y )Nr  r  r  r0  s     r$   Gtest_refresh_text_file_success_without_impersonation_use_default_scopeszWTestCredentials.test_refresh_text_file_success_without_impersonation_use_default_scopes.  sb    ++'"99! , 
 	22#11.2 3!! 	3 	
r&   c                     | j                  | j                  t        t        dg      }| j	                  |t
        t        t        t        t        d d t        t        dg       y )Nr  r   rz   r   r   r  	r   r   r   r  r   r   rL  r   r   r0  s     r$   Gtest_refresh_text_file_success_with_impersonation_ignore_default_scopeszWTestCredentials.test_refresh_text_file_success_with_impersonation_ignore_default_scopesG  sc    ++"99.O%; , 
 	22#11.O $!%; 	3 	
r&   c                     | j                  | j                  t        d t              }| j	                  |t
        t        t        t        t        d d t        d t               y )Nr  r  r  r0  s     r$   Dtest_refresh_text_file_success_with_impersonation_use_default_scopeszTTestCredentials.test_refresh_text_file_success_with_impersonation_use_default_scopes`  sa     ++"99.O! , 
 	22#11.O $!! 	3 	
r&   c                     | j                  t        t        | j                  t              }| j                  |t        t        t        t        d t        d t        t        d        y )Nr   r   r   r   r  )r   r   r   rQ  r  r   r   rR  r   r   r  r0  s     r$   4test_refresh_json_file_success_without_impersonationzDTestCredentials.test_refresh_json_file_success_without_impersonationz  s_    ++'"99 , 
 	22#11.2 3! 	3 	
r&   c                     | j                  | j                  t        t              }| j	                  |t
        t        t        t        t        d d t        t        d        y )Nr   rz   r   r  )	r   rQ  r   r  r   r   rR  r   r   r0  s     r$   1test_refresh_json_file_success_with_impersonationzATestCredentials.test_refresh_json_file_success_with_impersonation  s\    ++"99.O	 , 
 	22#11.O $! 	3 	
r&   c                     t         dddd}| j                  |      }t        j                  t        j
                        5 }|j                  d        d d d        j                  dj                  t         d            sJ y # 1 sw Y   1xY wrl  )	ro  r   r   r   r   rF  r   r   r7   rp  s       r$   .test_refresh_with_retrieve_subject_token_errorz>TestCredentials.test_refresh_with_retrieve_subject_token_error  s    +%;O
 ++>O+P]]:223w% 4 }}NUU'
 	
 
 43rr  c                     | j                  | j                        }| j                  t              }|j	                  |      }|t        k(  sJ | j                  |j                  d   d   d        y Nr  r^   r   rW   )r   r/  ra   rL  rG  ri   r   r    r   r)   r!   s       r$   $test_retrieve_subject_token_from_urlz4TestCredentials.test_retrieve_subject_token_from_url  su    ++"== , 
 ((4K(L#::7C 7777--g.D.DQ.G.JDQr&   c                     | j                  | j                  ddid      }| j                  t              }|j	                  |      }|t        k(  sJ | j                  |j                  d   d   ddi       y )Nfoobar)r8   re   r  r  r   rW   )r   r  ra   rL  rG  ri   r   r  s       r$   1test_retrieve_subject_token_from_url_with_headerszATestCredentials.test_retrieve_subject_token_from_url_with_headers  s    ++&*&9&9uenU , 
 ((4K(L#::7C 7777--""1%a(5%.	
r&   c                     | j                  | j                        }| j                  t              }|j	                  |      }|t
        k(  sJ | j                  |j                  d   d   d        y r  )r   r7  ra   JSON_FILE_CONTENTrG  rR  ri   r   r  s       r$   )test_retrieve_subject_token_from_url_jsonz9TestCredentials.test_retrieve_subject_token_from_url_json  su    ++"== , 
 ((4E(F#::7C 7777--g.D.DQ.G.JDQr&   c                     | j                  | j                  dddddid      }| j                  t              }|j	                  |      }|t
        k(  sJ | j                  |j                  d	   d
   ddi       y )Nr2   r   r3   r  r  )r8   r7   re   r  r  r   rW   )r   r  ra   r  rG  rR  ri   r   r  s       r$   6test_retrieve_subject_token_from_url_json_with_headerszFTestCredentials.test_retrieve_subject_token_from_url_json_with_headers  s    ++**#)~V!5> , 
 ((4E(F#::7C 7777--""1%a(5%.	
r&   c                    | j                  | j                        }t        j                  t        j
                        5 }|j                  | j                  dt                     d d d        j                  d      sJ y # 1 sw Y   xY w)Nr  i  )r]   r^   z.Unable to retrieve Identity Pool subject token)
r   r/  r   r   r   rF  rG  ra   r  r   r    r   r   s      r$   .test_retrieve_subject_token_from_url_not_foundz>TestCredentials.test_retrieve_subject_token_from_url_not_found  s{    ++"== , 
 ]]:223w..&&CDU&V 4
 }}MNNN 43s    'BBc                 `   | j                   dddd}| j                  |      }t        j                  t        j
                        5 }|j                  | j                  t                     d d d        j                  dj                  | j                   d            sJ y # 1 sw Y   7xY wNr2   rm  r3   r9   r  r  rn  )r  r   r   r   r   rF  rG  ra   r  r   r7   rp  s       r$   7test_retrieve_subject_token_from_url_json_invalid_fieldzGTestCredentials.test_retrieve_subject_token_from_url_json_invalid_field  s    &&%;O
 ++>O+P]]:223w..&&2C&D 4
 }}NUU##[
 	
 
 43   &B$$B-c                 H   | j                  | j                        }t        j                  t        j
                        5 }|j                  | j                  d             d d d        j                  dj                  | j                  d            sJ y # 1 sw Y   7xY w)Nr  rt  r  rn  r   )r   r7  r   r   r   rF  rG  ra   r   r7   r  r  s      r$   8test_retrieve_subject_token_from_url_json_invalid_formatzHTestCredentials.test_retrieve_subject_token_from_url_json_invalid_format  s    ++"== , 
 ]]:223w..t/E/EQT/E/UV 4 }}NUU##^
 	
 
 43s    "BB!c                     | j                  t        t        | j                  t              }| j                  |t        t        t        t        d t        d t        t        d t               y Nr  r   r   r!   r   rs   rz   r   r   r   r   r   r   )r   r   r   r/  r  r   r   rL  r   r   r  r0  s     r$   8test_refresh_text_file_success_without_impersonation_urlzHTestCredentials.test_refresh_text_file_success_without_impersonation_url  sb    ++'"== , 
 	22#11.2 3!3 	3 	
r&   c                     | j                  | j                  t        t              }| j	                  |t
        t        t        t        t        d d t        t        d t               y Nr  r  )	r   r/  r   r  r   r   rL  r   r   r0  s     r$   5test_refresh_text_file_success_with_impersonation_urlzETestCredentials.test_refresh_text_file_success_with_impersonation_url+  s_    ++"==.O	 , 
 	22#11.O $!3 	3 	
r&   c                     | j                  t        t        | j                  t              }| j                  |t        t        t        t        d t        d t        t        d t               y r  )r   r   r   r7  r  r   r   rR  r   r   r  r  r0  s     r$   8test_refresh_json_file_success_without_impersonation_urlzHTestCredentials.test_refresh_json_file_success_without_impersonation_urlC  sb    ++'"== , 
 	22#11.2 3!- 	3 	
r&   c                     | j                  | j                  t        t              }| j	                  |t
        t        t        t        t        d d t        t        d t               y r  )
r   r7  r   r  r   r   rR  r   r   r  r0  s     r$   5test_refresh_json_file_success_with_impersonation_urlzETestCredentials.test_refresh_json_file_success_with_impersonation_url[  s_    ++"==.O	 , 
 	22#11.O $!- 	3 	
r&   c                 `   | j                   dddd}| j                  |      }t        j                  t        j
                        5 }|j                  | j                  t                     d d d        j                  dj                  | j                   d            sJ y # 1 sw Y   7xY wr  )r  r   r   r   r   rF  r   ra   r  r   r7   rp  s       r$   2test_refresh_with_retrieve_subject_token_error_urlzBTestCredentials.test_refresh_with_retrieve_subject_token_error_urls  s    &&%;O
 ++>O+P]]:223w 6 6BS 6 TU 4 }}NUU##[
 	
 
 43r  c                     t        t              }| j                  |      }|j                  d       }|t        k(  sJ y )Nr!   r   )r   rR  r   rG  )r    r   r   r!   s       r$   $test_retrieve_subject_token_supplierz4TestCredentials.test_retrieve_subject_token_supplier  s?    +:QR++8+L#::4@ 7777r&   c                     t        t        t        j                  t        t
                    }| j                  |      }|j                  d        y )N)r!   r#   r  )r   rR  r   SupplierContextr   r   r   rG  r    r   r   s      r$   4test_retrieve_subject_token_supplier_correct_contextzDTestCredentials.test_retrieve_subject_token_supplier_correct_context  sE    +1-=="H
 ++8+L**40r&   c                 J   t        j                  d      }t        |      }| j                  |      }t	        j
                  t         j                        5 }|j                  | j                  t                     d d d        j                  d      sJ y # 1 sw Y   xY w)Nz
test error)r"   r  r  )
r   rF  r   r   r   r   r   ra   r  r   )r    expected_exceptionr   r   r   s        r$   *test_retrieve_subject_token_supplier_errorz:TestCredentials.test_retrieve_subject_token_supplier_error  s    '44\B+DVW++8+L]]:223w 6 6BS 6 TU 4 }}\*** 43s   &BB"c                     t        t              }| j                  |t        t              }| j                  |t        t        t        t        t        d d t        t        d        y )Nr  )r   rz   r   r  )
r   rR  r   r   r  r   r   rL  r   r   r  s      r$   4test_refresh_success_supplier_with_impersonation_urlzDTestCredentials.test_refresh_success_supplier_with_impersonation_url  sa    +:QR++#+.O , 
 	22#11.O $! 	3 	
r&   c                     t        t              }| j                  |t              }| j	                  |t
        t        t        t        d d t        t        d 
       y )Nr  )r   r   )
r   r   r!   r   rs   r   r   r   r   r   )	r   rR  r   r  r   r   rL  r   r   r  s      r$   7test_refresh_success_supplier_without_impersonation_urlzGTestCredentials.test_refresh_success_supplier_without_impersonation_url  sZ    +:QR++#+F , 
 	22#11 $! 	3 	
r&   )certkeyc                     | j                  | j                  j                               }|j                         \  }}|dk(  sJ |dk(  sJ y )Nr  r  r  )r   r:  r   _get_mtls_cert_and_key_paths)r    rW  r   r  r  s        r$   test_get_mtls_certsz#TestCredentials.test_get_mtls_certs  sW    
 ++"@@EEG , 
  <<>	cv~~e||r&   c                    | j                  | j                  j                               }t        j                  t
        j                        5 }|j                          d d d        j                  d      sJ y # 1 sw Y   xY w)Nr  zThe credential is not configured to use mtls requests. The credential should include a "certificate" section in the credential source.)	r   r   r   r   r   r   rF  r  r   r  s      r$   test_get_mtls_certs_invalidz+TestCredentials.test_get_mtls_certs_invalid  sw    ++"99>>@ , 
 ]]:223w446 4 }} U
 	
 
 43s   A;;B)NNNNNNNN)wr+   r,   r-   r  r   ro  rQ  r  r/  r7  r:  r=  TRUST_CHAIN_WITH_LEAF_FILEr\  TRUST_CHAIN_WITHOUT_LEAF_FILEr`  TRUST_CHAIN_WRONG_ORDER_FILErc  r   r  r   classmethodrU   r   r   ra   ri   r   rw   r   r|   r   r   r   r   r   rK   r   objectr   r   r   r   r   r   r   r   r   r  r  r  r  r  r  r  r  r  r   r$  r'  r+  r-  r1  r4  r8  r;  r>  rA  rC  rI  rN  rS  	CERT_FILEKEY_FILErX  rZ  r^  ra  re  rh  rj  rq  rv  rx  rz  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r.   r&   r$   r0   r0      s   $&=>'!~N *N"'!8!~N"
 	8&A%! 	57GH1- 	.4 :
;7 	.4 =
>: 	.4 <
=9 'L&!   %..T ( *88 8 >G
H 
H  +L) )  +/ $(E< E<N  -%*.#$(
 
@ 
ZZ}00*4P 
 Q 
D 
ZZ}00*4P
 Q
8 
ZZ}00*4P
 Q
< 
ZZ}00*4P
 Q
: 
ZZ}00*4P!
 Q!
F 
ZZ}00*4P
 Q
: 
ZZ}00*4P
 Q
<

;	=	=	=
=




H
CC
&




 
"
U88 TZZM*	@		@ TZZM*	@		@ TZZM*Y	Y TZZM*Y	Y TZZM*
	
 TZZM*K	K$ TZZM*Y	Y$
 
&F<E.>
6
6
6
6
8
2
2
4
.
.
 R

R
 	O
$

0
0
0
0
 8
1	+
.
( TZZM$	

r&   r0   )Mbase64r   http.clientclientr   r2   osrm   rK   OpenSSLr   r   google.authr   r   r   r   r   r	   google.auth.credentialsr
   r   r   r  SERVICE_ACCOUNT_EMAIL&SERVICE_ACCOUNT_IMPERSONATION_URL_BASEr7   r  r   r   r  pathr   dirname__file__DATA_DIRr  ro  r  r  r  r  r  OTHER_CERT_FILESUBJECT_TOKEN_FIELD_NAMEopenfhreadrL  loadr  rg   rR  f	b64encodedump_certificateFILETYPE_ASN1load_certificateFILETYPE_PEMrq   rU  r]  r   r   r   r   r   r   r   r}  INVALID_TOKEN_URLSr  *INVALID_SERVICE_ACCOUNT_IMPERSONATION_URLSSubjectTokenSupplierr   r  r0   r.   r&   r$   <module>r     s     !  	     2 " %  ! ;	0 K 4 ' +b*h*h+ ' +-TT " & 
H	77<<16:'',,x1MN '',,x1NO WW\\(4OP  "X7U V !ww||H6ST GGLL#45	77<<"23'',,x)9:) 	
!"b ggi # 

!"b!		"/334LM # 
)Ta(((  "9&"9"9&:M:Mqvvx"X	
 fWo	   
/4 A.f..  "9&"9"9&:M:Mqvvx"X	
 fWo	  ! 2	;; vX   K B 
  <
, (. *@#}AA # d
f d
G #" #"  ! s2   L5$L*A&L(!A&L4LL%(L14L=