
    ԋ                        d dl Z d dlZd dlmZ d dlZd dlZd dlZd dlZd dl	m
Z
 d dl	mZ d dl	mZ d dl	mZ d dl	mZ d dlmZ d dlmZ d d	lmZ ej(                  j+                  ej(                  j-                  e      d
d      Z eej(                  j+                  ed      d      5 Zej7                         Zddd       ej(                  j+                  ed      Zej(                  j+                  ed      ZdZdZ  eed      5 Z ejB                  e      Z"ddd        eed      5 Z ejB                  e      Z#ddd       ejH                  jK                  ed      Z&dZ'dZ(dZ)ejT                  d        Z+ejT                  d        Z, G d d      Z-ejT                  d        Z.ejT                  d        Z/ G d de0      Z1y# 1 sw Y   xY w# 1 sw Y   xY w# 1 sw Y   xY w)    N)_helpers)crypt)
exceptions)impersonated_credentials)	transport)Credentials)credentials)service_account datazprivatekey.pemrbzservice_account.jsonz8impersonated_service_account_authorized_user_source.jsona?  eyJhbGciOiJSUzI1NiIsImtpZCI6ImRmMzc1ODkwOGI3OTIyOTNhZDk3N2EwYjk5MWQ5OGE3N2Y0ZWVlY2QiLCJ0eXAiOiJKV1QifQ.eyJhdWQiOiJodHRwczovL2Zvby5iYXIiLCJhenAiOiIxMDIxMDE1NTA4MzQyMDA3MDg1NjgiLCJleHAiOjE1NjQ0NzUwNTEsImlhdCI6MTU2NDQ3MTQ1MSwiaXNzIjoiaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tIiwic3ViIjoiMTAyMTAxNTUwODM0MjAwNzA4NTY4In0.redactedi?]1z https://example.com/oauth2/tokenz9gl-python/3.7 auth/1.1 auth-request-type/at cred-type/impz9gl-python/3.7 auth/1.1 auth-request-type/it cred-type/impc               #      K   t        j                  dd      5 } dt        j                         t	        j
                  d      z   i f| _        |  d d d        y # 1 sw Y   y xY ww)Ngoogle.oauth2._client.jwt_grantTautospeczsource token  secondsmockpatchr   utcnowdatetime	timedeltareturn_valuegrants    ]platform/gsutil/third_party/google-auth-library-python/tests/test_impersonated_credentials.pymock_donor_credentialsr    F   sT     	5	EOO 2 23 ??

  
F	E	E   A'8A	A'A$ A'c               #      K   t        j                  dd      5 } dt        j                         t	        j
                  d      z   i f| _        |  d d d        y # 1 sw Y   y xY ww)Nr   Tr   1/fFAGRNJasdfz70BzhT3Zgr   r   r   r   s    r   mock_dwd_credentialsr$   Q   sT     	5	E%OO 2 23 ??

  
F	E	Er!   c                       e Zd Zd Zd Zy)MockResponsec                      || _         || _        y N)	json_datastatus_code)selfr)   r*   s      r   __init__zMockResponse.__init__]   s    "&    c                     | j                   S r(   )r)   )r+   s    r   jsonzMockResponse.jsona   s    ~~r-   N)__name__
__module____qualname__r,   r/    r-   r   r&   r&   \   s    'r-   r&   c               #      K   t        j                  dd      5 } ddd}t        |t        j                        | _        |  d d d        y # 1 sw Y   y xY ww)N8google.auth.transport.requests.AuthorizedSession.requestTr   r   c2lnbmF0dXJl)keyId
signedBlob)r   r   r&   http_clientOKr   auth_sessionr   s     r   mock_authorizedsession_signr=   e   sL     	BT
	N;$0{~~$F!
 
 
s   A)A	AAAc               #      K   t        j                  dd      5 } dt        i}t        |t        j
                        | _        |  d d d        y # 1 sw Y   y xY ww)Nr5   Tr   token)r   r   ID_TOKEN_DATAr&   r9   r:   r   r;   s     r   mock_authorizedsession_idtokenrA   o   sL     	BT
	'$0{~~$F!
 
 
s   A,A	AAAc                      e Zd ZdZdZdgZg ZdZ ej                  e
ee      Z ej                  d      Zddj                  e      z   Zeeed	d	fd
Zd Zd Zd Zd Zd Zd Zd Zd Zd Zej8                  d	d	dfdZd Zej@                  jC                  dddg      d        Z"ej@                  jC                  dddg      d        Z#ej@                  jC                  dddg      d        Z$ej@                  jC                  dddg      d        Z%ej@                  jC                  dddg      d         Z&d! Z'd" Z(d# Z)d$ Z*d% Z+d& Z,d' Z-d( Z.d) Z/d* Z0d+ Z1d, Z2d- Z3 e4jj                  d.d	/      d0        Z6d1 Z7ej@                  jC                  dddg      d2        Z8d3 Z9d4 Z:d5 Z;d6 Z<d7 Z=d8 Z>d9 Z?d: Z@d; ZAd< ZBd= ZCd> ZDd? ZEd@ ZFy	)ATestImpersonatedCredentialszservice-account@example.com,impersonated@project.iam.gserviceaccount.comz4https://www.googleapis.com/auth/devstorage.read_onlyi  ABCDE)r?   z<https://us-east1-iamcredentials.googleapis.com/v1/projects/-z'/serviceAccounts/{}:generateAccessTokenNc           	      N    t        ||| j                  | j                  |||      S )N)source_credentialstarget_principaltarget_scopes	delegateslifetimesubjectiam_endpoint_override)r   TARGET_SCOPES	DELEGATES)r+   rG   rK   rH   rL   rM   s         r   make_credentialsz,TestImpersonatedCredentials.make_credentials   s0     1-,,nn"7
 	
r-   c                     t         j                  j                  t              }t	        |t         j                        sJ y r(   )r   r   &from_impersonated_service_account_info8IMPERSONATED_SERVICE_ACCOUNT_AUTHORIZED_USER_SOURCE_INFO
isinstancer+   r	   s     r   +test_from_impersonated_service_account_infozGTestImpersonatedCredentials.test_from_impersonated_service_account_info   s4    .::aaD
 +'?'K'KLLLr-   c                 D   t        j                  t              }d|v sJ d|d   d<   t        j                  t
        j                        5 }t        j                  j                  |       d d d        j                  dj                  d            sJ y # 1 sw Y   ,xY w)NrG   invalid_typetypez-source credential of type {} is not supported)copydeepcopyrS   pytestraisesr   DefaultCredentialsErrorr   r   rR   matchformatr+   infoexcinfos      r   Ptest_from_impersonated_service_account_info_with_invalid_source_credentials_typezlTestImpersonatedCredentials.test_from_impersonated_service_account_info_with_invalid_source_credentials_type   s     }}UV#t+++-;!"6*]]:==>'$00WW ? }};BB>R
 	
 
	 ?>s    BBc                    t        j                  t              }d|d<   t        j                  t
        j                        5 }t        j                  j                  |       d d d        j                  d      sJ y # 1 sw Y   xY w)Ninvalid_url!service_account_impersonation_urlz$Cannot extract target principal from)rZ   r[   rS   r\   r]   r   r^   r   r   rR   r_   ra   s      r   Jtest_from_impersonated_service_account_info_with_invalid_impersonation_urlzfTestImpersonatedCredentials.test_from_impersonated_service_account_info_with_invalid_impersonation_url   sl     }}UV4A01]]:==>'$00WW ? }}DEEE	 ?>s    A>>Bc                     | j                         } |j                         rJ d|_         |j                         ddddk(  sJ y )N/path/to/filezimpersonated credentialsrD   )credential_sourcecredential_type	principal)rP   get_cred_info_cred_file_pathrU   s     r   test_get_cred_infoz.TestImpersonatedCredentials.test_get_cred_info   sW    ++-,;,,...&5#({((*!09G/
 
 	
 
r-   c                     t        j                  t        dt        d      }| j	                  |      }|j
                  dk(  sJ y )Nsome@email.comfoo.baruniverse_domainrG   )r
   r   SIGNER	TOKEN_URIrP   ru   r+   rG   r	   s      r   $test_universe_domain_matching_sourcez@TestImpersonatedCredentials.test_universe_domain_matching_source   sG    ,88$i
 ++?Q+R**i777r-   c                 v    | j                         }d|_         |j                         }|j                  dk(  sJ y )Nrj   )rP   ro   
_make_copy)r+   r	   	cred_copys      r   test__make_copy_get_cred_infoz9TestImpersonatedCredentials.test__make_copy_get_cred_info   s<    ++-&5#*K**,	((O;;;r-   c                 t    | j                  | j                        }|j                  rJ |j                  sJ y )Nrv   )rP   USER_SOURCE_CREDENTIALSvalidexpiredrU   s     r   test_make_from_user_credentialsz;TestImpersonatedCredentials.test_make_from_user_credentials   s@    ++#;; , 
 $$$$""""r-   c                 \    | j                         }|j                  rJ |j                  sJ y r(   )rP   r   r   rU   s     r   test_default_statez.TestImpersonatedCredentials.test_default_state   s.    ++-$$$$""""r-   c                     t        j                  t        | j                  t        d      }| j                  |      }|j                  j                  sJ |j                  j                  sJ y )NT)always_use_jwt_accessrv   )	r
   r   rw   SERVICE_ACCOUNT_EMAILrx   rP   _source_credentials_always_use_jwt_access_jwt_credentialsry   s      r   .test_make_from_service_account_self_signed_jwtzJTestImpersonatedCredentials.test_make_from_service_account_self_signed_jwt   sc    ,88D..	QU
 ++?Q+R..EEEE..????r-   Tc                    t        j                  t        j                  d      }||_        |rt        j                  |      n||_        |xs i |_        t        j                  t        j                  d      }||_
        ||_        |S )NFinstance)r   create_autospecr   Responsestatusr   to_bytesr   headersRequestside_effectr   )r+   r   r   r   r   use_data_bytesresponserequests           r   make_requestz(TestImpersonatedCredentials.make_request   sr     ''	(:(:UK 3A))$/t"=b&&y'8'85I)'r-   c                     | j                         }d|_        d |_        i } |j                  t	        j
                         d d |       |d   dk(  sJ |d   dk(  sJ y )Nr?   authorizationzBearer tokenx-goog-api-clientzcred-type/imp)rP   r?   expirybefore_requestr   Mock)r+   r	   r   s      r   test_token_usage_metricsz4TestImpersonatedCredentials.test_token_usage_metrics   sh    ++-#!"""499;dGD'>999*+>>>r-   r   Fc                 @   | j                  d       }d}t        j                         j                  d      t	        j
                  d      z   j                  d      dz   }||d	}| j                  t        j                  |      t        j                  |
      }t        j                  dt              5   |j                  |       d d d        |j                   sJ |j"                  rJ |j$                  j&                  d   d   t        k(  sJ y # 1 sw Y   KxY w)NrK   r?   r   microsecondr   r   TZaccessToken
expireTimer   r   r   :google.auth.metrics.token_request_access_token_impersonater   r   r   )rP   r   r   replacer   r   	isoformatr   r/   dumpsr9   r:   r   r   )ACCESS_TOKEN_REQUEST_METRICS_HEADER_VALUErefreshr   r   	call_argskwargs)r+   r   r    r	   r?   expire_timeresponse_bodyr   s           r   test_refresh_successz0TestImpersonatedCredentials.test_refresh_success  s   ++T+: OO%%!%4x7I7IRU7VV
)C.3 ).[I##M*>>) $ 
 ZZHB
  K(	
     &&&&$$Y/0CD89	
9
 
s   7DDc                 z   | j                  dd       }ddi}| j                  t        j                  |      t        j
                  |      }t        j                  dt              5   |j                  |       d d d        |j                  sJ |j                  rJ |j                  dk(  sJ y # 1 sw Y   7xY w)	Ntest@email.com)rL   rK   	signedJwtexample_signed_jwtr   r   r   r#   )rP   r   r/   r   r9   r:   r   r   r   r   r   r   r?   )r+   r   r$   r	   r   r   s         r   !test_refresh_with_subject_successz=TestImpersonatedCredentials.test_refresh_with_subject_success%  s    ++4Dt+T$&:;##M*>>) $ 
 ZZHB
  K(	
     &&&&  $====
 
s   (B11B:c                    t        j                  t        dt        d      }| j	                  d |      }d}t        j                         j                  d      t        j                  d	      z   j                  d
      dz   }||d}| j                  t        j                  |      t        j                  |      } |j                   |       |j"                  sJ |j$                  rJ |j&                  d   }	|	d   dk(  sJ y )Nrr   rs   rt   rK   rG   r?   r   r   r   r   r   r   r   r      urlz}https://iamcredentials.foo.bar/v1/projects/-/serviceAccounts/impersonated@project.iam.gserviceaccount.com:generateAccessToken)r
   r   rw   rx   rP   r   r   r   r   r   r   r   r/   r   r9   r:   r   r   r   r   )
r+   r   r    rG   r	   r?   r   r   r   request_kwargss
             r   test_refresh_success_nonGduz7TestImpersonatedCredentials.test_refresh_success_nonGdu;  s   ,88$i
 ++.@ , 
  OO%%!%4x7I7IRU7VV
)C.3 ).[I##M*>>) $ 
 	G$    &&&& **1-5! OO	
Or-   c                    | j                  d | j                        }d}t        j                         j	                  d      t        j                  d      z   j                  d      dz   }||d	}| j                  t        j                  |      t        j                  |
      } |j                  |       |j                  sJ |j                  rJ |j                   d   }|d   | j                  k(  sJ y )NrK   rM   r?   r   r   r   r   r   r   r   r   r   r   )rP   IAM_ENDPOINT_OVERRIDEr   r   r   r   r   r   r   r/   r   r9   r:   r   r   r   r   )	r+   r   r    r	   r?   r   r   r   r   s	            r   *test_refresh_success_iam_endpoint_overridezFTestImpersonatedCredentials.test_refresh_success_iam_endpoint_override[  s     ++1K1K , 
  OO%%!%4x7I7IRU7VV
)C.3 ).[I##M*>>) $ 
 	G$    &&&& **1-e$(B(BBBBr-   	time_skew   ijc                    | j                  d       }t        j                         t        j                  z   t	        j
                  |      z   |j                  _        d|j                  _        t        j                  dd      5 }t        j                         j                  d      t	        j
                  d	      z   j                  d
      dz   }d|d}| j                  t        j                  |      t         j"                        } |j$                  |       |j&                  sJ |j(                  rJ |dkD  r|j+                          n|j-                          d d d        y # 1 sw Y   y xY w)Nr   r   Tokenz1google.oauth2.service_account.Credentials.refreshTr   r   r   r   r   r   r?   r   r   r   )rP   r   r   REFRESH_THRESHOLDr   r   r   r   r?   r   r   r   r   r   r/   r   r9   r:   r   r   r   assert_not_calledassert_called_once)r+   r   r	   source_cred_refreshr   r   r   s          r   test_refresh_source_credentialsz;TestImpersonatedCredentials.test_refresh_source_credentialsw  sE   ++T+: OO(()  34 	''.
 18''-ZZ?$
 !))a)8$$S12ins#K -4;OM''ZZ.{~~ ( G  K($$$$"**** 1}#557#668-
 
 
s   CE**E3c                     | j                  d       }d}t        j                         t        j                  d      z   j                  d      }||d}| j                  t        j                  |      t        j                        }t        j                  t        j                        5 } |j                  |       d d d        j!                  t"        j$                        sJ |j&                  rJ |j(                  sJ y # 1 sw Y   GxY w)Nr   r?   r   r   r   r   r   )rP   r   r   r   r   r   r   r/   r   r9   r:   r\   r]   r   RefreshErrorr   r_   r   _REFRESH_ERRORr   r   )r+   r    r	   r?   r   r   r   rc   s           r   *test_refresh_failure_malformed_expire_timezFTestImpersonatedCredentials.test_refresh_failure_malformed_expire_time  s    ++T+:(8+=+=c+JJUU
 ).[I##M*;>> $ 
 ]]:223wK( 4 }}5DDEEE$$$$"""" 43s   +DDc                    | j                  d       }dddddi}| j                  t        j                  |      t        j
                        }t        j                  t        j                        5 } |j                  |       d d d        j                  t        j                        sJ |j                  rJ |j                  sJ y # 1 sw Y   GxY w)Nr   error  z#The caller does not have permissionPERMISSION_DENIED)codemessager   r   )rP   r   r/   r   r9   UNAUTHORIZEDr\   r]   r   r   r   r_   r   r   r   r   r+   r    r	   r   r   rc   s         r    test_refresh_failure_unauthorzedz<TestImpersonatedCredentials.test_refresh_failure_unauthorzed  s    ++T+: @-
 ##M*;3K3K $ 
 ]]:223wK( 4 }}5DDEEE$$$$"""" 43s   2CCc                 ,   | j                  d       }d |_        d|_        t        j                  |d      }t        j                  t        j                  d      }t        j                  |_        t        j                  d      |_        t        j                  d	|      5  t        j                   t"        j$                        5 }|j'                  d        d d d        d d d        j)                  d
      sJ y # 1 sw Y   %xY w# 1 sw Y   )xY w)Nr   r?   audiencetarget_audienceFr   zfailed to get ID tokenr   5google.auth.transport.requests.AuthorizedSession.postzError getting ID token)rP   r   r?   r   IDTokenCredentialsr   r   r   r   r9   r   r*   r   r/   r   r\   r]   r   r   r   r_   )r+   r	   id_credsr   rc   s        r   test_refresh_failurez0TestImpersonatedCredentials.test_refresh_failure  s    ++T+:!#+>>
 ''	(:(:UK*77		/GHZZC!
 z6677  & 8	
 }}5666 87	
 
s$   $$D
C>D
>D	D

Dc                    | j                  d       }i }| j                  t        j                  |      t        j
                        }t        j                  t        j                        5 } |j                  |       d d d        j                  t        j                        sJ |j                  rJ |j                  sJ y # 1 sw Y   GxY w)Nr   r   )rP   r   r/   r   r9   HTTPExceptionr\   r]   r   r   r   r_   r   r   r   r   r   s         r   test_refresh_failure_http_errorz;TestImpersonatedCredentials.test_refresh_failure_http_error  s    ++T+:##M*;3L3L $ 
 ]]:223wK( 4 }}5DDEEE$$$$"""" 43s   ,CCc                 <   t        j                  t        dt        d      }| j	                  |d      }t        j                         j                  d      j                  d      d	z   }d
|d}| j                  t        j                  |      t        j                        }t        j                  t         j"                        5 } |j$                  |       d d d        j'                  d      sJ |j(                  rJ |j*                  sJ y # 1 sw Y   9xY w)Nrr   rs   rt   r   )rG   rL   r   r   r   r   r?   r   r   zNDomain-wide delegation is not supported in universes other than googleapis.com)r
   r   rw   rx   rP   r   r   r   r   r   r/   r   r9   r:   r\   r]   r   GoogleAuthErrorr   r_   r   r   )r+   r    rG   r	   r   r   r   rc   s           r   3test_refresh_failure_subject_with_nondefault_domainzOTestImpersonatedCredentials.test_refresh_failure_subject_with_nondefault_domain  s    -88$i
 ++1;K , 
  (00Q0?JJ3ORUU(/{K##M*;>> $ 
 ]]:556'K( 7 }}$
 	
 

 $$$$"""" 76s   DDc                 D    | j                  d       }|j                  sJ y )Nr   )rP   r   rU   s     r   test_expiredz(TestImpersonatedCredentials.test_expired
  s$    ++T+:""""r-   c                 p    | j                         }t        |j                  t        j                        sJ y r(   )rP   rT   signerr   r   rU   s     r   test_signerz'TestImpersonatedCredentials.test_signer  s-    ++-+,,.F.R.RSSSr-   c                 r    | j                  | j                        }|j                  | j                  k(  sJ y N)rH   )rP   TARGET_PRINCIPALsigner_emailrU   s     r   test_signer_emailz-TestImpersonatedCredentials.test_signer_email  s5    ++T=R=R+S''4+@+@@@@r-   c                 r    | j                  | j                        }|j                  | j                  k(  sJ y r   )rP   r   service_account_emailrU   s     r   test_service_account_emailz6TestImpersonatedCredentials.test_service_account_email  s5    ++T=R=R+S00D4I4IIIIr-   c                 T    | j                  d       }d}| j                  ||||       y )Nr   zyhttps://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/impersonated@project.iam.gserviceaccount.com:signBlob)rP   _sign_bytes_helper)r+   r    r=   r	   expected_urls        r   test_sign_bytesz+TestImpersonatedCredentials.test_sign_bytes  s7    ++T+: S"'		
r-   c                     t        j                  t        dt        d      }| j	                  d |      }d}| j                  ||||       y )Nrr   rs   rt   r   zrhttps://iamcredentials.foo.bar/v1/projects/-/serviceAccounts/impersonated@project.iam.gserviceaccount.com:signBlob)r
   r   rw   rx   rP   r   )r+   r    r=   rG   r	   r   s         r   test_sign_bytes_nonGduz2TestImpersonatedCredentials.test_sign_bytes_nonGdu$  s^     -88$i
 ++.@ , 
 L"'		
r-   c           	         d}t        j                         j                  d      t        j                  d      z   j                  d      dz   }||d}t        j                  t        j                  d	
      }t        j                  |_        t        j                  t        j                  |            |_        t        j                  t        j"                  d	
      }	||	_         |j&                  |	       |j(                  sJ |j*                  rJ  |j,                  d      }
|j/                  t        j0                  d|d dg dddi       |
dk(  sJ y )Nr?   r   r   r   r   r   r   r   Fr   s   signed bytesPOSTc2lnbmVkIGJ5dGVz)payloadrJ   zContent-Typezapplication/json)r/   r   s	   signature)r   r   r   r   r   r   r   r   r   r   r9   r:   r   r   r/   r   r   r   r   r   r   r   
sign_bytesassert_called_withANY)r+   r	   r    r=   r   r?   r   token_response_bodyr   r   	signatures              r   r   z.TestImpersonatedCredentials._sign_bytes_helper5  s6     OO%%!%4x7I7IRU7VV
)C.3 /4;O''	(:(:UK%.. ))$**5H*IJ&&y'8'85I'G$    &&&&*K**?;	#66HH/bA#%78 	7 	
 L(((r-   c                    | j                  d       }t        j                  dd      5 }ddddi}t        |t        j
                        }||_        t        j                  t        j                        5 } |j                  d	       d d d        j                  d
      sJ 	 d d d        y # 1 sw Y   &xY w# 1 sw Y   y xY w)Nr   r5   Tr   r   r   unauthorizedr   r      fooz'code': 403)rP   r   r   r&   r9   r   r   r\   r]   r   TransportErrorr  r_   )r+   r	   r<   r   mock_responserc   s         r   test_sign_bytes_failurez3TestImpersonatedCredentials.test_sign_bytes_failureZ  s    ++T+:ZZFQU
cnEFD({/G/GHM(5L%z889W&&&v. :==///
 
 :9
 
$   AB:6B.	B:.B7	3B::Cz
time.sleepr   c                    | j                  d       }t        j                  dd      5 }ddddi}t        |t        j
                        }||_        t        j                  t        j                        5 } |j                  d	       d d d        j                  d
      sJ 	 d d d        y # 1 sw Y   &xY w# 1 sw Y   y xY w)Nr   r5   Tr   r   r   internal_failurer
  r  z#exhausted signBlob endpoint retries)rP   r   r   r&   r9   INTERNAL_SERVER_ERRORr   r\   r]   r   r  r  r_   )r+   	mock_timer	   r<   r   r  rc   s          r   !test_sign_bytes_retryable_failurez=TestImpersonatedCredentials.test_sign_bytes_retryable_failureh  s    ++T+:ZZFQU
c6HIJD({/P/PQM(5L%z889W&&&v. :==!FGGG
 
 :9
 
r  c                 j    | j                         } |j                  d      }|j                  dk(  sJ y )Nproject-foo)rP   with_quota_project_quota_project_id)r+   r	   quota_project_credss      r   test_with_quota_projectz3TestImpersonatedCredentials.test_with_quota_projectw  s7    ++-<k<<]K"44EEEr-   c                    | j                  d | j                        }d} |j                  d      }t        j                         j                  d      t        j                  d      z   j                  d      d	z   }||d
}| j                  t        j                  |      t        j                  |      }|j                  |       |j                  sJ |j                   rJ |j"                  d   }	|	d   | j                  k(  sJ y )Nr   r?   r  r   r   r   r   r   r   r   r   r   r   )rP   r   r  r   r   r   r   r   r   r   r/   r   r9   r:   r   r   r   r   )
r+   r   r    r	   r?   r  r   r   r   r   s
             r   -test_with_quota_project_iam_endpoint_overridezITestImpersonatedCredentials.test_with_quota_project_iam_endpoint_override}  s	    ++1K1K , 
 <k<<]K OO%%!%4x7I7IRU7VV
)C.3 ).[I##M*>>) $ 
 	##G,"((((&.... **1-e$(B(BBBBr-   c                     | j                         }g |_        |j                  du sJ  |j                  ddg      }|j                  du sJ |j                  ddgk(  sJ y )NTfake_scope1fake_scope2F)rP   _target_scopesrequires_scopeswith_scopesrU   s     r   test_with_scopesz,TestImpersonatedCredentials.test_with_scopes  sp    ++-%'"**d222-k--}m.LM**e333))m]-KKKKr-   c                     | j                         }g |_         |j                  dgdg      }|j                  dgk(  sJ y )Nr  r  )default_scopes)rP   r   r"  rU   s     r   'test_with_scopes_provide_default_scopeszCTestImpersonatedCredentials.test_with_scopes_provide_default_scopes  sK    ++-%'"-k--O]O
 ))m_<<<r-   c                 v   | j                  d       }d}d}t        j                         j                  d      t	        j
                  d      z   j                  d      d	z   }||d
}| j                  t        j                  |      t        j                        } |j                  |       |j                  sJ |j                  rJ t        j                   ||      }	|	j                  |       |	j"                  t$        k(  sJ |	j&                  t        j                  j)                  t*              k(  sJ y )Nr   r?   https://foo.barr   r   r   r   r   r   r   r   r   )rP   r   r   r   r   r   r   r   r/   r   r9   r:   r   r   r   r   r   r?   r@   r   utcfromtimestampID_TOKEN_EXPIRY
r+   r    rA   r	   r?   r   r   r   r   r   s
             r   test_id_token_successz1TestImpersonatedCredentials.test_id_token_success  s    ++T+:+ OO%%!%4x7I7IRU7VV
)C.3 ).[I##M*;>> $ 
 	G$    &&&&+>>
 	!~~...("3"3"D"D_"UUUUr-   c                 x   | j                  d       }d|_        d |_        d}t        j                  ||      }t        j                  dt              5  t        j                  dd	      5 }dt        i}t        |t        j                        |_        |j                  d        |j                  t        k(  sJ |j                  t        j                  j                  t               k(  sJ |j"                  j$                  d
   d   t        k(  sJ 	 d d d        d d d        y # 1 sw Y   xY w# 1 sw Y   y xY w)Nr   r?   r(  r   z6google.auth.metrics.token_request_id_token_impersonater   r   Tr   r   r   )rP   r?   r   r   r   r   r   %ID_TOKEN_REQUEST_METRICS_HEADER_VALUEr@   r&   r9   r:   r   r   r   r)  r*  r   r   )r+   r    r	   r   r   	mock_postr   s          r   test_id_token_metricsz1TestImpersonatedCredentials.test_id_token_metrics  s&   ++T+:#!++>>
 ZZD>
 GRV/)5dKNN)K	&  &~~666(*;*;*L*L#+    ''..y9:MN<==	
 
 	
 
s%   D0-B%D$D0$D-	)D00D9c                 z    | j                  d       }| j                  d       }d}| j                  |||||       y )Nr   zhttps://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/impersonated@project.iam.gserviceaccount.com:generateIdToken)rP   _test_id_token_helper)r+   r    rA   r	   target_credentialsr   s         r   test_id_token_from_credentialz9TestImpersonatedCredentials.test_id_token_from_credential  sP     ++T+:!22D2A Z"""*	
r-   c                     t        j                  t        dt        d      }| j	                  d |      }| j	                  d |      }d}| j                  |||||       y )Nrr   rs   rt   r   zyhttps://iamcredentials.foo.bar/v1/projects/-/serviceAccounts/impersonated@project.iam.gserviceaccount.com:generateIdToken)r
   r   rw   rx   rP   r2  )r+   r    rA   rG   r	   r3  r   s          r   $test_id_token_from_credential_nonGduz@TestImpersonatedCredentials.test_id_token_from_credential_nonGdu  s     -88$i
 ++.@ , 
 "22.@ 3 
 S"""*	
r-   c                    d}d}t        j                         j                  d      t        j                  d      z   j                  d      dz   }||d	}	| j                  t        j                  |	      t        j                  
      }
 |j                  |
       |j                  sJ |j                  rJ t        j                  ||d      }|j!                  |      }|j                  |
       |j"                  j$                  }|d   |k(  sJ |j&                  t(        k(  sJ |j*                  du sJ |j,                  |u sJ y )Nr?   r(  r   r   r   r   r   r   r   r   T)r   include_email)r3     )r   r   r   r   r   r   r   r/   r   r9   r:   r   r   r   r   r   from_credentialsr   argsr?   r@   _include_email_target_credentials)r+   r	   r3  r    rA   r   r?   r   r   r   r   r   r;  s                r   r2  z1TestImpersonatedCredentials._test_id_token_helper	  sG    + OO%%!%4x7I7IRU7VV
)C.3 ).[I##M*;>> $ 
 	G$    &&&&+>>
 ,,@R,S!-77<<Aw,&&&~~...&&$...++/AAAAr-   c                    | j                  d       }d}d}t        j                         j                  d      t	        j
                  d      z   j                  d      d	z   }||d
}| j                  t        j                  |      t        j                        } |j                  |       |j                  sJ |j                  rJ t        j                   |d      }	|	j#                  |      }	|	j                  |       |	j$                  t&        k(  sJ |	j(                  t        j                  j+                  t,              k(  sJ |	j.                  du sJ y )Nr   r?   r(  r   r   r   r   r   r   r   r   T)r8  r   )rP   r   r   r   r   r   r   r   r/   r   r9   r:   r   r   r   r   r   with_target_audiencer?   r@   r   r)  r*  r<  r+  s
             r   "test_id_token_with_target_audiencez>TestImpersonatedCredentials.test_id_token_with_target_audience0  sB    ++T+:+ OO%%!%4x7I7IRU7VV
)C.3 ).[I##M*;>> $ 
 	G$    &&&&+>>t
 000Q!~~...("3"3"D"D_"UUUU&&$...r-   c                     d }t        j                  t        j                        5 }t	        j
                  |       d d d        j                  d      sJ y # 1 sw Y   xY w)Nz4Provided Credential must be impersonated_credentials)r\   r]   r   r   r   r   r_   )r+   r    rA   r	   rc   s        r   test_id_token_invalid_credz6TestImpersonatedCredentials.test_id_token_invalid_credO  sN     ]]:556'$77D 7 }}VWWW 76s   AA!c                 4   | j                  d       }d}d}t        j                         j                  d      t	        j
                  d      z   j                  d      d	z   }||d
}| j                  t        j                  |      t        j                        } |j                  |       |j                  sJ |j                  rJ t        j                   ||      }	|	j#                  d      }	|	j                  |       |	j$                  t&        k(  sJ y )Nr   r?   r(  r   r   r   r   r   r   r   r   r   T)rP   r   r   r   r   r   r   r   r/   r   r9   r:   r   r   r   r   r   with_include_emailr?   r@   r+  s
             r    test_id_token_with_include_emailz<TestImpersonatedCredentials.test_id_token_with_include_emailY  s    ++T+:+ OO%%!%4x7I7IRU7VV
)C.3 ).[I##M*;>> $ 
 	G$    &&&&+>>
 ..t4!~~...r-   c                 ,   | j                  d       }d}d}t        j                         j                  d      t	        j
                  d      z   j                  d      d	z   }||d
}| j                  t        j                  |      t        j                        } |j                  |       |j                  sJ |j                  rJ t        j                   ||      }	|	j#                  d      }	|	j                  |       |	j$                  dk(  sJ y )Nr   r?   r(  r   r   r   r   r   r   r   r   r   r  )rP   r   r   r   r   r   r   r   r/   r   r9   r:   r   r   r   r   r   r  quota_project_idr+  s
             r    test_id_token_with_quota_projectz<TestImpersonatedCredentials.test_id_token_with_quota_projectv  s
    ++T+:+ OO%%!%4x7I7IRU7VV
)C.3 ).[I##M*;>> $ 
 	G$    &&&&+>>
 ..}=!((M999r-   c                 X   d}d}d|d}| j                  t        j                  |      t        j                        }t        j                  ||i i       }||k(  sJ |j                  ddi t        j                  g t        j                  i       d	      j                  d
             y )Nfoo@example.comcorrect_signed_jwtr   )r7   r   r   r   rm   r   r  z[https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/foo@example.com:signJwtr   )rJ   r  zutf-8)r   methodr   body)	r   r/   r   r9   r:   r   _sign_jwt_requestassert_called_once_withencode)r+   rm   expected_signed_jwtr   r   
signed_jwts         r   test_sign_jwt_request_successz9TestImpersonatedCredentials.test_sign_jwt_request_success  s    %	2"%4GH##M*;>> $ 
 .??y"b

 0000''m"BHIPP	 	( 	
r-   c                    d}| j                  dt        j                        }t        j                  t
        j                        5 }t        j                  ||i i       }d d d        j                  t        j                        sJ |j                  j                  d   dk(  sJ |j                  j                  d   dk(  sJ y # 1 sw Y   gxY w)NrJ  error_messager   rL  r   z*Unable to acquire impersonated credentialsr   )r   r9   BAD_REQUESTr\   r]   r   r   r   rO  r_   r   valuer;  r+   rm   r   rc   _s        r    test_sign_jwt_request_http_errorz<TestImpersonatedCredentials.test_sign_jwt_request_http_error  s    %	## )@)@ $ 
 ]]:223w(::9b"A 4
 }}5DDEEE}}!!!$(TTTT}}!!!$777 43   CCc                    d}| j                  dt        j                        }t        j                  t
        j                        5 }t        j                  ||i i       }d d d        j                  t        j                        sJ |j                  j                  d   dk(  sJ |j                  j                  d   dk(  sJ y # 1 sw Y   gxY w)NrJ  invalid_datar   rL  r   zFUnable to acquire impersonated credentials: No signed JWT in response.r   )r   r9   r:   r\   r]   r   r   r   rO  r_   r   rX  r;  rY  s        r   ,test_sign_jwt_request_invalid_response_errorzHTestImpersonatedCredentials.test_sign_jwt_request_invalid_response_error  s    %	###O]]:223w(::9b"A 4
 }}5DDEEE MMq!WX	
X }}!!!$666 43r\  )Gr0   r1   r2   r   r   rN   rO   LIFETIMEr
   r   rw   rx   SOURCE_CREDENTIALSr	   r   r`   r   rP   rV   rd   rh   rp   rz   r~   r   r   r   r9   r:   r   r   r\   markparametrizer   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r  r   r   r  r  r  r#  r&  r,  r0  r4  r6  r2  r@  rB  rE  rH  rT  r[  r_  r3   r-   r   rC   rC   y   s   9EKLM IH444%y 6k55GDF
3
:
:;P
Q	R  .)"
&M
	F	
8<##
@ ~~&? [[-e}=
 >
8 [[-e}=> >>* [[-e}=
 >
> [[-e}=C >C6 [[[3+6#9 7#9J#*#.7*#"#6#TAJ

"#)J0 TZZ40H 1HF [[-e}=C >C:L=V:<

*%BN/>X/:::
.8"7r-   rC   )2rZ   r   http.clientclientr9   r/   osr   r\   google.authr   r   r   r   r   $google.auth.impersonated_credentialsr   google.oauth2r	   r
   pathjoindirname__file__DATA_DIRopenfhreadPRIVATE_KEY_BYTESSERVICE_ACCOUNT_JSON_FILE8IMPERSONATED_SERVICE_ACCOUNT_AUTHORIZED_USER_SOURCE_FILEr@   r*  loadSERVICE_ACCOUNT_INFOrS   	RSASignerfrom_stringrw   rx   r   r.  fixturer    r$   r&   r=   rA   objectrC   r3   r-   r   <module>r{     s     !  	      " 0 ! < % )77<<12v>	"'',,x!1
2D9R	 : GGLL3IJ ;=77<<H< 8
  	
#T*b$499R= + 

BDIR?Htyy}< J 
	$	$%6	<.	 @ * @ &
         R7& R7m :9$ +* JIs$   (GG*GGGG'