
    ;                         d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZ d dlm	Z	 d dl
mZ dZdZdZd	Zd
Zdj#                  e      Zeez   ZdZddgZdZdZdZdZdZg dZg dZg dZg dZ G d de      Z y)    N)
exceptions)	pluggable)DEFAULT_UNIVERSE_DOMAIN)WORKFORCE_AUDIENCEusernamepasswordzdXNlcm5hbWU6cGFzc3dvcmQ=z1service-1234@service-name.iam.gserviceaccount.comz.https://us-east1-iamcredentials.googleapis.comz5/v1/projects/-/serviceAccounts/{}:generateAccessTokenQUOTA_PROJECT_IDscope1scope2access_tokenz#https://sts.googleapis.com/v1/tokenz(https://sts.googleapis.com/v1/introspect$urn:ietf:params:oauth:token-type:jwtzi//iam.googleapis.com/projects/123456/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID)	https://sts.googleapis.comz$https://us-east-1.sts.googleapis.comz$https://US-EAST-1.sts.googleapis.comz$https://sts.us-east-1.googleapis.comz$https://sts.US-WEST-1.googleapis.comz$https://us-east-1-sts.googleapis.comz$https://US-WEST-1-sts.googleapis.comz/https://us-west-1-sts.googleapis.com/path?queryz&https://sts-us-east-1.p.googleapis.com)%https://iamcredentials.googleapis.comzsts.googleapis.comhttps://zhttp://sts.googleapis.comzhttps://st.s.googleapis.comz$https://us-eas	-1.sts.googleapis.comz#https:/us-east-1.sts.googleapis.comz%https://US-WE/ST-1-sts.googleapis.comz$https://sts-us-east-1.googleapis.comz$https://sts-US-WEST-1.googleapis.comz(testhttps://us-east-1.sts.googleapis.comz,https://us-east-1.sts.googleapis.comevil.comz.https://us-east-1.us-east-1.sts.googleapis.comz$https://us-ea.s.t.sts.googleapis.comz"https://sts.googleapis.comevil.comz%hhttps://us-east-1.sts.googleapis.comz!https://us- -1.sts.googleapis.comzhttps://-sts.googleapis.comz-https://us-east-1.sts.googleapis.com.evil.comzhttps://sts.pgoogleapis.comhttps://p.googleapis.comzhttps://sts.p.comzhttp://sts.p.googleapis.comz https://xyz-sts.p.googleapis.comz$https://sts-xyz.123.p.googleapis.comz!https://sts-xyz.p1.googleapis.comzhttps://sts-xyz.p.foo.comz$https://sts-xyz.p.foo.googleapis.com)	r   z/https://us-east-1.iamcredentials.googleapis.comz/https://US-EAST-1.iamcredentials.googleapis.comz/https://iamcredentials.us-east-1.googleapis.comz/https://iamcredentials.US-WEST-1.googleapis.comz/https://us-east-1-iamcredentials.googleapis.comz/https://US-WEST-1-iamcredentials.googleapis.comz:https://us-west-1-iamcredentials.googleapis.com/path?queryz1https://iamcredentials-us-east-1.p.googleapis.com)r   ziamcredentials.googleapis.comr   z$http://iamcredentials.googleapis.comz&https://iamcre.dentials.googleapis.comz/https://us-eas	-1.iamcredentials.googleapis.comz.https:/us-east-1.iamcredentials.googleapis.comz0https://US-WE/ST-1-iamcredentials.googleapis.comz/https://iamcredentials-us-east-1.googleapis.comz/https://iamcredentials-US-WEST-1.googleapis.comz3testhttps://us-east-1.iamcredentials.googleapis.comz7https://us-east-1.iamcredentials.googleapis.comevil.comz9https://us-east-1.us-east-1.iamcredentials.googleapis.comz/https://us-ea.s.t.iamcredentials.googleapis.comz-https://iamcredentials.googleapis.comevil.comz0hhttps://us-east-1.iamcredentials.googleapis.comz,https://us- -1.iamcredentials.googleapis.comz&https://-iamcredentials.googleapis.comz8https://us-east-1.iamcredentials.googleapis.com.evil.comz&https://iamcredentials.pgoogleapis.comr   zhttps://iamcredentials.p.comz&http://iamcredentials.p.googleapis.comz+https://xyz-iamcredentials.p.googleapis.comz/https://iamcredentials-xyz.123.p.googleapis.comz,https://iamcredentials-xyz.p1.googleapis.comz$https://iamcredentials-xyz.p.foo.comz/https://iamcredentials-xyz.p.foo.googleapis.comc                      e Zd ZdZdZeddedZdeiZdZdd	d
eddZdd	d
edZ	dd	deddZ
dd	dedZdZdd	deddZdd	dedZdddddZdZeeeeedddddddddfd       Zd Zej2                  j5                  ej8                  dd      d        Zej2                  j5                  ej8                  dd      d        Zej2                  j5                  ej8                  dd      d        Zej2                  j5                  ej8                  dd      d         Z d! Z!d" Z"d# Z#d$ Z$d% Z%d& Z&d' Z'd( Z(ej2                  jS                  e*jV                  d)d*i      d+        Z,ej2                  jS                  e*jV                  d)d*i      d,        Z-ej2                  jS                  e*jV                  d)d*i      d-        Z.ej2                  jS                  e*jV                  d)d*i      d.        Z/ej2                  jS                  e*jV                  d*d*d/      d0        Z0ej2                  jS                  e*jV                  d)d1i      d2        Z1ej2                  jS                  e*jV                  d)d*i      d3        Z2ej2                  jS                  e*jV                  d)d*i      d4        Z3ej2                  jS                  e*jV                  d)d*i      d5        Z4ej2                  jS                  e*jV                  d)d*i      d6        Z5ej2                  jS                  e*jV                  d)d*i      d7        Z6ej2                  jS                  e*jV                  d)d*i      d8        Z7ej2                  jS                  e*jV                  d)d*i      d9        Z8ej2                  jS                  e*jV                  d)d*i      d:        Z9ej2                  jS                  e*jV                  d)d*i      d;        Z:ej2                  jS                  e*jV                  d)d*i      d<        Z;ej2                  jS                  e*jV                  d)d*i      d=        Z<ej2                  jS                  e*jV                  d)d*i      d>        Z=ej2                  jS                  e*jV                  d)d*i      d?        Z>ej2                  jS                  e*jV                  d)d*i      d@        Z?ej2                  jS                  e*jV                  d)d*i      dA        Z@ej2                  jS                  e*jV                  d)d*i      dB        ZAej2                  jS                  e*jV                  d)d*i      dC        ZBej2                  jS                  e*jV                  d)d*i      dD        ZCej2                  jS                  e*jV                  d)d*i      dE        ZDej2                  jS                  e*jV                  d)d*i      dF        ZEej2                  jS                  e*jV                  d)d*i      dG        ZFej2                  jS                  e*jV                  d)d*i      dH        ZGej2                  jS                  e*jV                  d)d*i      dI        ZHej2                  jS                  e*jV                  d)d1i      dJ        ZIej2                  jS                  e*jV                  d)d*i      dK        ZJej2                  jS                  e*jV                  d)d*i      dL        ZKej2                  jS                  e*jV                  d)d*i      dM        ZLej2                  jS                  e*jV                  d)d*i      dN        ZMy)OTestCredentialsz4/fake/external/excutable --arg1=value1 --arg2=value2fake_output_file0u   )commandtimeout_millisinteractive_timeout_millisoutput_file
executableFAKE_ID_TOKEN   T)urn:ietf:params:oauth:token-type:id_token   c(	 versionsuccess
token_typeid_tokenexpiration_timer!   r"   r#   r$   r   FAKE_SAML_RESPONSEz&urn:ietf:params:oauth:token-type:saml2)r!   r"   r#   saml_responser%   )r!   r"   r#   r(   F401z(Permission denied. Caller not authorized)r!   r"   codemessagezhttp://fakeurl.comNc                 F    t        j                  |||||
||||||	||      S )N)audiencesubject_token_type	token_urltoken_info_url!service_account_impersonation_urlcredential_source	client_idclient_secretquota_project_idscopesdefault_scopesworkforce_pool_user_projectinteractive)r   Credentials)clsr-   r.   r/   r0   r3   r4   r5   r6   r7   r1   r2   r8   r9   s                 Nplatform/gsutil/third_party/google-auth-library-python/tests/test_pluggable.pymake_pluggablezTestCredentials.make_pluggable   s>    " $$1).O/'-)(C#
 	
    c                     t        j                  t        t        t        t
        | j                  d      }t        |dd       t        |t         j                        sJ |j                  sJ |j                  dk(  sJ y )NT)r-   r.   r/   r0   r2   r9   _tokeninfo_usernamemock_external_account_id)r   r:   AUDIENCESUBJECT_TOKEN_TYPE	TOKEN_URLTOKEN_INFO_URLCREDENTIAL_SOURCEsetattr
isinstancer9   external_account_idselfcredentialss     r<   #test_from_constructor_and_injectionz3TestCredentials.test_from_constructor_and_injection   st    ++1)"44
 	24NO+y'<'<===&&&&..2LLLLr>   __init__return_valuec                    t         j                  j                  t        t        t
        t        t        ddit        t        t        | j                  d
      }t        |t         j                        sJ |j                  t        t        t
        t        t        ddit        t        | j                  t        d t               y )Ntoken_lifetime_seconds
  
r-   r.   r/   r0   r1   service_account_impersonationr3   r4   r5   r2   r-   r.   r/   r0   r1   %service_account_impersonation_optionsr3   r4   r2   r5   r8   universe_domain)r   r:   	from_inforB   rC   rD   rE   !SERVICE_ACCOUNT_IMPERSONATION_URL	CLIENT_IDCLIENT_SECRETr	   rF   rH   assert_called_once_withr   rK   	mock_initrL   s      r<   test_from_info_full_optionsz+TestCredentials.test_from_info_full_options   s    ++55$&8&"05V2JD1Q&!.$4%)%;%;
  +y'<'<===))1).O3KT2R'"44-(,3 	* 	
r>   c                    t         j                  j                  t        t        t
        | j                  d      }t        |t         j                        sJ |j                  t        t        t
        d d i d d | j                  d d t               y )Nr-   r.   r/   r2   rV   )
r   r:   rY   rB   rC   rD   rF   rH   r]   r   r^   s      r<   $test_from_info_required_options_onlyz4TestCredentials.test_from_info_required_options_only  s    ++55$&8&%)%;%;	
 +y'<'<===))1.224"44!(,3 	* 	
r>   c                    t         t        t        t        t        ddit
        t        t        | j                  d
}|j                  d      }|j                  t        j                  |             t        j                  j                  t!        |            }t#        |t        j                        sJ |j%                  t         t        t        t        t        ddit
        t        | j                  t        d t&               y )NrR   rS   rT   config.jsonrV   )rB   rC   rD   rE   rZ   r[   r\   r	   rF   joinwritejsondumpsr   r:   	from_filestrrH   r]   r   rK   r_   tmpdirinfoconfig_filerL   s         r<   test_from_file_full_optionsz+TestCredentials.test_from_file_full_options1  s     !"4",1R.F-M"* 0!%!7!7
 kk-0$**T*+++55c+6FG +y'<'<===))1).O3KT2R'"44-(,3 	* 	
r>   c                    t         t        t        | j                  d}|j	                  d      }|j                  t        j                  |             t        j                  j                  t        |            }t        |t        j                        sJ |j                  t         t        t        d d i d d | j                  d d t               y )Nrb   re   rV   )rB   rC   rD   rF   rf   rg   rh   ri   r   r:   rj   rk   rH   r]   r   rl   s         r<   $test_from_file_required_options_onlyz4TestCredentials.test_from_file_required_options_onlyT  s     !"4"!%!7!7	
 kk-0$**T*+++55c+6FG +y'<'<===))1.224"44!(,3 	* 	
r>   c                     ddi}t        j                  t              5 }| j                  |       d d d        j	                  d      sJ y # 1 sw Y   xY w)Nunsupportedvaluer2   Missing credential_sourcepytestraises
ValueErrorr=   match)rK   r2   excinfos      r<    test_constructor_invalid_optionsz0TestCredentials.test_constructor_invalid_optionsq  sP    *G4]]:&'2CD ' }}9::: '&s   AAc                     t        j                  t              5 }| j                  d       d d d        j	                  d      sJ y # 1 sw Y   xY w)Nznon-dictrv   rw   rx   )rK   r}   s     r<   *test_constructor_invalid_credential_sourcez:TestCredentials.test_constructor_invalid_credential_sourcey  sD    ]]:&'*= ' }}9::: '&s   A		Ac           	          | j                  | j                  j                               }|j                  dt        t
        t        t        | j                  t        dk(  sJ y )Nrv   external_account)typer-   r.   r/   r0   r2   rX   )	r=   rF   copyrn   rB   rC   rD   rE   r   rJ   s     r<    test_info_with_credential_sourcez0TestCredentials.test_info_with_credential_source  sc    ))"4499; * 
 & "4",!%!7!76$
 
 	
 
r>   c                     | j                  | j                  j                               }|j                  t        k(  sJ y )Nrv   )r=   rF   r   r0   rE   rJ   s     r<   test_token_info_urlz#TestCredentials.test_token_info_url  s?    ))"4499; * 
 ))^;;;r>   c                     t         D ]D  }| j                  | j                  j                         |dz         }|j                  |dz   k(  rDJ  y )Nz/introspectr2   r0   )VALID_TOKEN_URLSr=   rF   r   r0   rK   urlrL   s      r<   test_token_info_url_customz*TestCredentials.test_token_info_url_custom  sV    #C--"&"8"8"="="? #m 3 . K
 --}1DDDD $r>   c                 v    | j                  | j                  j                         d       }|j                  rJ y )Nr   )r=   rF   r   r0   rJ   s     r<   test_token_info_url_negativez,TestCredentials.test_token_info_url_negative  s?    ))"4499;D * 
 -----r>   c                     t         D ]D  }| j                  | j                  j                         |dz         }|j                  |dz   k(  rDJ  y )Nz/token)r2   r/   )r   r=   rF   r   
_token_urlr   s      r<   test_token_url_customz%TestCredentials.test_token_url_custom  sT    #C--"&"8"8"="="?> . K
 ))cHn=== $r>   c                     t         D ]L  }| j                  | j                  j                         |t        z         }|j
                  |t        z   k(  rLJ  y )N)r2   r1   )(VALID_SERVICE_ACCOUNT_IMPERSONATION_URLSr=   rF   r   'SERVICE_ACCOUNT_IMPERSONATION_URL_ROUTE"_service_account_impersonation_urlr   s      r<   -test_service_account_impersonation_url_customz=TestCredentials.test_service_account_impersonation_url_custom  s_    ;C--"&"8"8"="="?AA . K AA==   <r>   )GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES1c                    |j                  d      }dd|d}d|i}t        j                  | j                        j	                  d      t
        | j                  | j                  dt        | j                  d| j                  d	t        j                  | j                        j	                  d      t
        | j                  | j                  dt        | j                  d| j                  d	t        j                  | j                        j	                  d      t
        | j                  | j                  dt        | j                  d| j                  d	d
}|j                         D ]  }t        |d      5 }t        j                   |j#                  d      |       d d d        t%        j&                  dt)        j*                  g |j#                  d      d            5  | j-                  |j#                  dt.              |j#                  d      ||j#                  dd            }|j1                  d       }	|	|j#                  d      k(  sJ 	 d d d        t3        j4                  |       
 y # 1 sw Y   xY w# 1 sw Y   .xY w)Nactual_output_filer   r   r   r   r   r   UTF-8)stdoutimpersonation_urlfile_contentexpect_tokenT)r-   r   r9   r   )subject_token_oidc_id_token,subject_token_oidc_id_token_interacitve_modesubject_token_oidc_jwt'subject_token_oidc_jwt_interactive_modesubject_token_saml#subject_token_saml_interactive_modewr   subprocess.runr   r   argsr   
returncoderO   r-   r   r9   Fr-   r1   r2   r9   r   )rf   rh   ri   ,EXECUTABLE_SUCCESSFUL_OIDC_RESPONSE_ID_TOKENencoderZ   ?EXECUTABLE_SUCCESSFUL_OIDC_NO_EXPIRATION_TIME_RESPONSE_ID_TOKENEXECUTABLE_OIDC_TOKENr   'EXECUTABLE_SUCCESSFUL_OIDC_RESPONSE_JWT:EXECUTABLE_SUCCESSFUL_OIDC_NO_EXPIRATION_TIME_RESPONSE_JWT#EXECUTABLE_SUCCESSFUL_SAML_RESPONSE6EXECUTABLE_SUCCESSFUL_SAML_NO_EXPIRATION_TIME_RESPONSEEXECUTABLE_SAML_TOKENvaluesopendumpgetmockpatch
subprocessCompletedProcessr=   rB   retrieve_subject_tokenosremove)
rK   rm   /ACTUAL_CREDENTIAL_SOURCE_EXECUTABLE_OUTPUT_FILE#ACTUAL_CREDENTIAL_SOURCE_EXECUTABLEACTUAL_CREDENTIAL_SOURCEtestDatadatar   rL   subject_tokens
             r<   (test_retrieve_subject_token_successfullyz8TestCredentials.test_retrieve_subject_token_successfully  sR   :@++ ;
7 !*0J/
+
 %12U#V  **EE&/%F $ d d $ : :, / $ d d# $ : :	= **@@&/%F $ _ _ $ : :' / $ _ _# $ : :	8 **T%M%MNUU &G $ [ [ $ : :# / $ [ [# $ : :	4K+
Z OO%D?		$((>2K@
  '88DHHX$61 #11!XXj(;6:hh?R6S&> $ >	 2  !, B B4 H$(@@@@ IIEF) & 
 s   7&I3!A0I?3I<	?J	c           	      ^   t        j                  dt        j                  g t	        j
                  | j                        j                  d      d            5  | j                  | j                        }|j                  d       }|| j                  k(  sJ 	 d d d        y # 1 sw Y   y xY w)Nr   r   r   r   rO   rv   )r   r   r   r   rh   ri   r   r   r=   rF   r   r   )rK   rL   r   s      r<    test_retrieve_subject_token_samlz0TestCredentials.test_retrieve_subject_token_saml
  s    ZZ#44zz$"J"JKRR 	
 --@V@V-WK'>>tDM D$>$>>>>	
 	
 	
s   ?B##B,c                    |j                  d      }dd|d}d|i}t        |d      5 }t        j                  | j                  |       d d d        t        j                  dt        j                  g d	      
      5  | j                  t        |d      }|j                  d       }|| j                  k(  sJ t        j                  |       d d d        y # 1 sw Y   xY w# 1 sw Y   y xY w)Nr   r   r   r   r   r   r   r   r   r   rO   Tr-   r2   r9   )rf   r   rh   r   r   r   r   r   r   r=   r   r   r   r   r   rK   rm   r   r   r   r   rL   r   s           r<   1test_retrieve_subject_token_saml_interactive_modezATestCredentials.test_retrieve_subject_token_saml_interactive_mode  s     ;A++ ;
7 !*0J/
+
 %12U#V A3G;IIKK[ H
 ZZ#44"K
 --+":  . K (>>tDM D$>$>>>>IIEF
 
 HG

 
s   !C=AC"C"C+c           	         t        j                  dt        j                  g t	        j
                  | j                        j                  d      d            5  | j                  | j                        }t        j                  t        j                        5 }|j                  d       }d d d        j                  d      sJ 	 d d d        y # 1 sw Y   &xY w# 1 sw Y   y xY w)Nr   r   r   r   rO   rv   hExecutable returned unsuccessful response: code: 401, message: Permission denied. Caller not authorized.)r   r   r   r   rh   ri   EXECUTABLE_FAILED_RESPONSEr   r=   rF   ry   rz   r   RefreshErrorr   r|   rK   rL   r}   _s       r<   "test_retrieve_subject_token_failedz2TestCredentials.test_retrieve_subject_token_failed<  s    ZZ#44zz$"A"ABII'R
 --@V@V-WKz667766t< 8 =={  
 
 87
 
s%   A CC,CC	CC&)r   #GOOGLE_EXTERNAL_ACCOUNT_INTERACTIVEc                 T   |j                  d      }dd|d}d|i}t        |dd      5 }t        j                  | j                  |       d d d        t        j                  d	t        j                  g d
            5  | j                  t        |d      }t        j                  t        j                        5 }|j                  d       }d d d        j!                  d      sJ t#        j$                  |       d d d        y # 1 sw Y   xY w# 1 sw Y   FxY w# 1 sw Y   y xY w)Nr   r   r   r   r   r   utf-8)encodingr   r   r   rO   Tr   r   )rf   r   rh   r   r   r   r   r   r   r=   r   ry   rz   r   r   r   r|   r   r   )	rK   rm   r   r   r   r   rL   r}   r   s	            r<   3test_retrieve_subject_token_failed_interactive_modezCTestCredentials.test_retrieve_subject_token_failed_interactive_modeO  s"    ;A++ ;
7 !*0J/
+
 %12U#V ;S7
IId55{C

 ZZ#44"K
 --+":  . K z667766t< 8 =={   IIEF!
 

 
 87
 
s/   !D?<D;D0DDD	DD'0c           	         t        j                  dt        j                  g t	        j
                  | j                        j                  d      d            5  | j                  | j                        }t        j                  t              5 }|j                  d       }d d d        j                  d      sJ 	 d d d        y # 1 sw Y   &xY w# 1 sw Y   y xY w)Nr   r   r   r   rO   rv   )Executables need to be explicitly allowed)r   r   r   r   rh   ri   r   r   r=   rF   ry   rz   r{   r   r|   r   s       r<   &test_retrieve_subject_token_not_allowdz6TestCredentials.test_retrieve_subject_token_not_allowdw  s    ZZ#44zzEE&/	
 --@V@V-WKz*g66t< + ==!MNNN	
 	
 +*	
 	
s$   6CC"CC	CCc           	         ddd| j                   dd}t        j                  dt        j                  g t        j                  |      j                  d      d	      
      5  | j                  | j                        }t        j                  t        j                        5 }|j                  d       }d d d        j                  d      sJ 	 d d d        y # 1 sw Y   &xY w# 1 sw Y   y xY w)N   Tr   r   r    r   r   r   r   rO   rv   (Executable returned unsupported version.r   r   r   r   r   rh   ri   r   r=   rF   ry   rz   r   r   r   r|   )rK   -EXECUTABLE_SUCCESSFUL_OIDC_RESPONSE_VERSION_2rL   r}   r   s        r<   +test_retrieve_subject_token_invalid_versionz;TestCredentials.test_retrieve_subject_token_invalid_version  s     E22)9
5 ZZ#44zz"OPWW 	
 --@V@V-WKz667766t< 8 ==!LMMM	
 	
 87	
 	
%   "A C%"C4C%C"	C%%C.c           	         ddd| j                   dd}t        j                  dt        j                  g t        j                  |      j                  d      d      	      5  | j                  | j                  
      }t        j                  t        j                        5 }|j                  d       }d d d        j                  d      sJ 	 d d d        y # 1 sw Y   &xY w# 1 sw Y   y xY w)Nr   Tr   r   r    r   r   r   rO   rv   z0The token returned by the executable is expired.r   )rK   +EXECUTABLE_SUCCESSFUL_OIDC_RESPONSE_EXPIREDrL   r}   r   s        r<   )test_retrieve_subject_token_expired_tokenz9TestCredentials.test_retrieve_subject_token_expired_token  s     E22 7
3 ZZ#44zz"MNUU 	
 --@V@V-WKz667766t< 8 ==!TUUU	
 	
 87	
 	
r   c                 N   |j                  d      }dd|d}d|i}t        |d      5 }t        j                  | j                  |       d d d        | j                  |      }|j                  d       }|| j                  k(  sJ t        j                  |       y # 1 sw Y   SxY w)Nr   r   r   r   r   r   r   r   rv   )
rf   r   rh   r   r   r=   r   r   r   r   r   s           r<   &test_retrieve_subject_token_file_cachez6TestCredentials.test_retrieve_subject_token_file_cache  s    :@++ ;
7 !#J/
+
 %12U#V A3G;IIdGGU H ))<T)U#::4@ : ::::
		AB HGs   !BB$c           	      \   ddd}d|i}t        j                  dt        j                  g t	        j
                  | j                        j                  d      d      	      5  | j                  |
      }|j                  d       }|| j                  k(  sJ 	 d d d        y # 1 sw Y   y xY w)Nr   r   r   r   r   r   r   r   r   rO   rv   )r   r   r   r   rh   ri   r   r   r=   r   r   )rK   r   r   rL   r   s        r<   )test_retrieve_subject_token_no_file_cachez9TestCredentials.test_retrieve_subject_token_no_file_cache  s     !#/
+ %12U#V ZZ#44zzEE&/	
 --": . K (>>tDM D$>$>>>>!	
 	
 	
s   #5B""B+c                    |j                  d      }dd|d}d|i}dd| j                  dd	}t        |d
      5 }t        j                  ||       d d d        | j                  |      }t        j                  t              5 }|j                  d       }	d d d        j                  d      sJ t        j                  |       y # 1 sw Y   wxY w# 1 sw Y   >xY w)Nr   r   r   r   r   Tr   r   r"   r#   r$   r%   r   rv   5The executable response is missing the version field.)rf   r   r   rh   r   r=   ry   rz   r{   r   r|   r   r   )
rK   rm   r   r   r   ACTUAL_EXECUTABLE_RESPONSEr   rL   r}   r   s
             r<   9test_retrieve_subject_token_file_cache_value_error_reportzITestCredentials.test_retrieve_subject_token_file_cache_value_error_report  s    :@++ ;
7 !#J/
+
 %12U#V E22)	&
" A3G;II0+> H ))<T)U]]:&'2248A ' }}UVVV
		AB HG
 '&s   CCCCc           	      <   |j                  d      }dd|d}d|i}ddd| j                  d	d
}t        |d      5 }t        j                  ||       d d d        t        j                  dt        j                  g t        j                  | j                        j                  d      d            5  | j                  |      }|j                  d       }|| j                  k(  sJ 	 d d d        t        j                  |       y # 1 sw Y   xY w# 1 sw Y   +xY w)Nr   r   r   r   r   r   Tr   r   r    r   r   r   r   r   rO   rv   )rf   r   r   rh   r   r   r   r   r   ri   r   r   r=   r   r   r   )	rK   rm   r   r   r   r   r   rL   r   s	            r<   :test_retrieve_subject_token_file_cache_refresh_error_retryzJTestCredentials.test_retrieve_subject_token_file_cache_refresh_error_retry  s"   :@++ ;
7 !#J/
+
 %12U#V E22)&
" A3G;II0+> H ZZ#44zzEE&/	
 --": . K (>>tDM D$>$>>>>!	
$ 			AB+ HG	
 	
s   D25DDDc           	         ddd| j                   dd}t        j                  dt        j                  g t        j                  |      j                  d      d	      
      5  | j                  | j                        }t        j                  t        j                        5 }|j                  d       }d d d        j                  d      sJ 	 d d d        y # 1 sw Y   &xY w# 1 sw Y   y xY w)Nr   Tunsupported_token_typer   r    r   r   r   r   rO   rv   z+Executable returned unsupported token type.r   rK   #EXECUTABLE_SUCCESSFUL_OIDC_RESPONSErL   r}   r   s        r<   2test_retrieve_subject_token_unsupported_token_typezBTestCredentials.test_retrieve_subject_token_unsupported_token_type5  s     222)/
+ ZZ#44zz"EFMMgV
 --@V@V-WKz667766t< 8 ==!OPPP
 
 87
 
r   c           	         dd| j                   dd}t        j                  dt        j                  g t        j                  |      j                  d      d      	      5  | j                  | j                  
      }t        j                  t              5 }|j                  d       }d d d        j                  d      sJ 	 d d d        y # 1 sw Y   &xY w# 1 sw Y   y xY w)NTr   r   r   r   r   r   r   rO   rv   r   r   r   r   r   r   rh   ri   r   r=   rF   ry   rz   r{   r   r|   r   s        r<   +test_retrieve_subject_token_missing_versionz;TestCredentials.test_retrieve_subject_token_missing_versionN  s     E22)	/
+ ZZ#44zz"EFMMgV
 --@V@V-WKz*g66t< + ==H  
 
 +*
 
$   !6CC)CC	CC#c           	         dd| j                   dd}t        j                  dt        j                  g t        j                  |      j                  d      d      	      5  | j                  | j                  
      }t        j                  t              5 }|j                  d       }d d d        j                  d      sJ 	 d d d        y # 1 sw Y   &xY w# 1 sw Y   y xY w)Nr   r   r   )r!   r#   r$   r%   r   r   r   r   rO   rv   5The executable response is missing the success field.r   r   s        r<   +test_retrieve_subject_token_missing_successz;TestCredentials.test_retrieve_subject_token_missing_successh  s     E22)	/
+ ZZ#44zz"EFMMgV
 --@V@V-WKz*g66t< + ==H  
 
 +*
 
r   c           	         ddd}t        j                  dt        j                  g t	        j
                  |      j                  d      d            5  | j                  | j                  	      }t        j                  t              5 }|j                  d       }d d d        j                  d
      sJ 	 d d d        y # 1 sw Y   &xY w# 1 sw Y   y xY w)Nr   Fr!   r"   r   r   r   r   rO   rv   z;Error code and message fields are required in the response.)r   r   r   r   rh   ri   r   r=   rF   ry   rz   r{   r   r|   r   s        r<   6test_retrieve_subject_token_missing_error_code_messagezFTestCredentials.test_retrieve_subject_token_missing_error_code_message  s    :;.N+ZZ#44zz"EFMMgV
 --@V@V-WKz*g66t< + ==N  
 
 +*
 
s$   6CCCC	CCc           	      f   ddd| j                   d}ddddi}t        j                  d	t        j                  g t        j                  |      j                  d
      d            5  | j                  |      }|j                  d       }|| j                   k(  sJ 	 d d d        y # 1 sw Y   y xY w)Nr   Tr   r&   r   r   r   r   r   r   r   r   rO   rv   )
r   r   r   r   r   rh   ri   r   r=   r   )rK   r   rF   rL   r   s        r<   ^test_retrieve_subject_token_without_expiration_time_should_pass_when_output_file_not_specifiedznTestCredentials.test_retrieve_subject_token_without_expiration_time_should_pass_when_output_file_not_specified  s    
 E22	/
+ i5I
 ZZ#44zz"EFMMgV
 --@Q-RK'>>tDM D$>$>>>>
 
 
s   (5B''B0c           	         dd| j                   dd}t        j                  dt        j                  g t        j                  |      j                  d      d      	      5  | j                  | j                  
      }t        j                  t              5 }|j                  d       }d d d        j                  d      sJ 	 d d d        y # 1 sw Y   &xY w# 1 sw Y   y xY w)Nr   Tr   )r!   r"   r$   r%   r   r   r   r   rO   rv   z8The executable response is missing the token_type field.r   r   s        r<   .test_retrieve_subject_token_missing_token_typez>TestCredentials.test_retrieve_subject_token_missing_token_type  s     22)	/
+ ZZ#44zz"EFMMgV
 --@V@V-WKz*g66t< + ==K  
 
 +*
 
r   c                     t        j                  t              5 }dd| j                  di}| j	                  |      }d d d        j                  d      sJ y # 1 sw Y   xY w)Nr   r   )r   r   rv   z;Missing command field. Executable command must be provided.)ry   rz   r{   (CREDENTIAL_SOURCE_EXECUTABLE_OUTPUT_FILEr=   r|   rK   r}   rF   r   s       r<   &test_credential_source_missing_commandz6TestCredentials.test_credential_source_missing_command  sk    ]]:&'&+#'#P#P! ##6G#HA ' }}J
 	
 
 '&s   $AA#c                     dd| j                   ii}| j                  |d      }t        j                  t              5 }|j                  d       }d d d        j                  d      sJ y # 1 sw Y   xY w)Nr   r   Tr2   r9   zVAn output_file must be specified in the credential configuration for interactive mode.)$CREDENTIAL_SOURCE_EXECUTABLE_COMMANDr=   ry   rz   r{   r   r|   )rK   rF   rL   r}   r   s        r<   6test_credential_source_missing_output_interactive_modezFTestCredentials.test_credential_source_missing_output_interactive_mode  s     9d&O&OP
 ))/T * 
 ]]:&'2248A ' }}e
 	
 
 '&s   A++A4c                     d| j                   | j                  di}| j                  |      }|j                  t        j
                  k(  sJ y )Nr   r   r   rv   )r  r  r=   ,_credential_source_executable_timeout_millisr   !EXECUTABLE_TIMEOUT_MILLIS_DEFAULT)rK   rF   rL   s      r<   Etest_credential_source_timeout_missing_will_use_default_timeout_valuezUTestCredentials.test_credential_source_timeout_missing_will_use_default_timeout_value  s_     DD#LL
 ))<M)N DD::;	
;r>   c                     t        j                  t              5 }d| j                  d| j                  di}| j                  |      }d d d        j                  d      sJ y # 1 sw Y   xY w)Nr   i  r   rv   *Timeout must be between 5 and 120 seconds.ry   rz   r{   r  r  r=   r|   r  s       r<   $test_credential_source_timeout_smallz4TestCredentials.test_credential_source_timeout_small  sn    ]]:&'#HH&.#'#P#P! ##6G#HA ' }}JKKK '&   /A%%A.c                     t        j                  t              5 }d| j                  d| j                  di}| j                  |      }d d d        j                  d      sJ y # 1 sw Y   xY w)Nr   i r   rv   r  r  r  s       r<   $test_credential_source_timeout_largez4TestCredentials.test_credential_source_timeout_large  sn    ]]:&'#HH&0#'#P#P! ##6G#HA ' }}JKKK '&r  c                     t        j                  t              5 }d| j                  d| j                  di}| j                  |      }d d d        j                  d      sJ y # 1 sw Y   xY w)Nr   i/u  r   rv   >Interactive timeout must be between 30 seconds and 30 minutes.r  r  s       r<   0test_credential_source_interactive_timeout_smallz@TestCredentials.test_credential_source_interactive_timeout_small  st    ]]:&'#HH2;#'#P#P! ##6G#HA ' }}M
 	
 
 '&r  c                     t        j                  t              5 }d| j                  d| j                  di}| j                  |      }d d d        j                  d      sJ y # 1 sw Y   xY w)Nr   iAw r   rv   r  r  r  s       r<   0test_credential_source_interactive_timeout_largez@TestCredentials.test_credential_source_interactive_timeout_large&  st    ]]:&'#HH2=#'#P#P! ##6G#HA ' }}M
 	
 
 '&r  c                 z   t        j                  dt        j                  g d d            5  | j	                  | j
                        }t        j                  t        j                        5 }|j                  d       }d d d        j                  d      sJ 	 d d d        y # 1 sw Y   &xY w# 1 sw Y   y xY w)Nr   r   r   rO   rv   :Executable exited with non-zero return code 1. Error: None)r   r   r   r   r=   rF   ry   rz   r   r   r   r|   r   s       r<   +test_retrieve_subject_token_executable_failz;TestCredentials.test_retrieve_subject_token_executable_fail6  s    ZZ#44
 --@V@V-WKz667766t< 8 ==M  
 
 87
 
s$   A B1.B% B1%B.	*B11B:c                     | j                  | j                  d      }t        j                  t              5 }|j                  d       }d d d        j                  d      sJ y # 1 sw Y   xY w)NTr  z4Interactive mode is only enabled for workforce pool.)r=   rF   ry   rz   r{   r   r|   r   s       r<   ?test_retrieve_subject_token_non_workforce_fail_interactive_modezOTestCredentials.test_retrieve_subject_token_non_workforce_fail_interactive_modeG  se    ))"44$ * 
 ]]:&'2248A ' }}TUUU '&   A%%A.c                    | j                   | j                  d}d|i}| j                  |d      }t        j                  t
              5 }|j                  d       }d d d        j                  d      sJ y # 1 sw Y   xY w)Nr  r   Tr  z;Interactive mode cannot run without an interactive timeout.)r  r  r=   ry   rz   r{   r   r|   )rK   CREDENTIAL_SOURCE_EXECUTABLErF   rL   r}   r   s         r<   Jtest_retrieve_subject_token_fail_on_validation_missing_interactive_timeoutzZTestCredentials.test_retrieve_subject_token_fail_on_validation_missing_interactive_timeoutQ  s    
 @@HH(
$ *+GH))/T * 
 ]]:&'2248A ' }}J
 	
 
 '&s   
A88Bc                    t        j                  dt        j                  g d d            5  | j	                  t
        | j                  d      }t        j                  t        j                        5 }|j                  d       }d d d        j                  d      sJ 	 d d d        y # 1 sw Y   &xY w# 1 sw Y   y xY w)Nr   r   r   rO   Tr   r$  )r   r   r   r   r=   r   rF   ry   rz   r   r   r   r|   r   s       r<   <test_retrieve_subject_token_executable_fail_interactive_modezLTestCredentials.test_retrieve_subject_token_executable_fail_interactive_moded  s    ZZ#44
 --+"&"8"8  . K z667766t< 8 ==M  
 
 87
 
s$   AB74B+B7+B4	0B77C c                     | j                  | j                  d      }t        j                  t              5 }|j                  d       }d d d        j                  d      sJ y # 1 sw Y   xY w)NTr  r   )r=   rF   ry   rz   r{   revoker|   r   s       r<   )test_revoke_failed_executable_not_allowedz9TestCredentials.test_revoke_failed_executable_not_allowedy  se    ))"44$ * 
 ]]:&'""4(A ' }}IJJJ '&r(  c                 >   dt         dddt        j                  ddi t         ddd	d
it        j                  ddd	dit         dddddt        j                  ddd}|j                         D ]  }t	        j
                  dt        j                  g t        j                  |j                  d            j                  d      |j                  dd                  5  | j                  t        t        | j                  |j                  dd            }t!        j"                  |j                  d            5 }|j%                  d       }d d d        j'                  |j                  d            sJ 	 d d d         y # 1 sw Y   8xY w# 1 sw Y   -xY w)NFz.Revoke is only enabled under interactive mode.)r9   expectErrTypeexpectErrPatternr   z!Auth revoke failed on executable.)r   r2  r3  r   )responser2  r3  r!   r   r   r  r  z)Revoke failed with unsuccessful response.)non_interactive_modeexecutable_failed#response_validation_missing_version#response_validation_invalid_version#response_validation_missing_success6response_validation_failed_with_success_field_is_falser   r4  r   r   r   r   rO   r9   Tr   r2  r3  )r{   r   r   r   r   r   r   r   rh   ri   r   r   r=   r   rZ   rF   ry   rz   r/  r|   )rK   r   r   rL   r}   r   s         r<   test_revoke_failedz"TestCredentials.test_revoke_failed  s     %!+$U%  !+!8!8$H" !+$\4 'N!+!8!8$O4 'N!+$\4 )*e<!+!8!8$PG5
@ OO%D '88::dhhz&:;BB7K#xxa8 #11/6W&*&<&< $ =	 2  ]]488O#<=#**40A > }}TXX.@%ABBB%  &  >= s%   !AF=F*FFFF	c           	      <   ddd}t        j                  dt        j                  g t	        j
                  |      j                  d      d            5  | j                  t        | j                  d	      }|j                  d       }d d d        y # 1 sw Y   y xY w)
Nr   Tr  r   r   r   r   rO   r   )r   r   r   r   rh   ri   r   r=   r   rF   r/  )rK   ACTUAL_RESPONSErL   r   s       r<   test_revoke_successfullyz(TestCredentials.test_revoke_successfully  s    &'D9ZZ#44zz/299'B
 --+"&"8"8  . K
 ""4(A
 
 
s   4BBc                 L   t        j                  dd      5  | j                  | j                        }t	        j
                  t        j                        5 }|j                  d       }d d d        j                  d      sJ 	 d d d        y # 1 sw Y   &xY w# 1 sw Y   y xY w)Nsys.version_infor      rv   0Pluggable auth is only supported for python 3.7+)
r   r   r=   rF   ry   rz   r   r   r   r|   r   s       r<   $test_retrieve_subject_token_python_2z4TestCredentials.test_retrieve_subject_token_python_2  s    ZZ*F3--@V@V-WKz667766t< 8 ==!TUUU 43 87 43s$   A BB)BB	BB#c                 X   t        j                  dd      5  | j                  t        | j                  d      }t        j                  t        j                        5 }|j                  d       }d d d        j                  d      sJ 	 d d d        y # 1 sw Y   &xY w# 1 sw Y   y xY w)Nr@  rA  Tr   rC  )r   r   r=   r   rF   ry   rz   r   r   r/  r|   r   s       r<   "test_revoke_subject_token_python_2z2TestCredentials.test_revoke_subject_token_python_2  s    ZZ*F3--+"&"8"8  . K z6677&&t, 8 ==!TUUU 43 87 43s$   AB B/B B	B  B))N__name__
__module____qualname__r  r  r*  rF   r   r   r   r   r   r   r   r   r   CREDENTIAL_URLclassmethodrB   rC   rD   rE   r=   rM   r   r   objectr   r:   r`   rc   rp   rr   r~   r   r   r   r   r   r   r   dictr   environr   r   r   r   r   r   r   r   r   r   r   r   r   r   r  r  r  r	  r  r  r  r  r  r   r"  r%  r'  r+  r-  r0  r;  r>  rD  rF   r>   r<   r   r      se   > ) 0B,7&,?	$  &'CD+A)%40 A)	GC <)%/+ <)	B> 1>.%+' >.	>: =	" *N -%*.$(
 
@M 
ZZy,,jtL
 M
B 
ZZy,,jtL
 M
6 
ZZy,,jtL 
 M 
D 
ZZy,,jtL
 M
8;;
<E.> 
ZZ__RZZ"Ms!STLG ULG\ 
ZZ__RZZ"Ms!ST? U?" 
ZZ__RZZ"Ms!STG UG> 
ZZ__RZZ"Ms!ST U$ 
ZZ__


9<36	
GGB 
ZZ__RZZ"Ms!STO UO$ 
ZZ__RZZ"Ms!STN UN4 
ZZ__RZZ"Ms!STV UV4 
ZZ__RZZ"Ms!STC UC( 
ZZ__RZZ"Ms!ST? U?2 
ZZ__RZZ"Ms!STC UC8 
ZZ__RZZ"Ms!ST&C U&CP 
ZZ__RZZ"Ms!STQ UQ0 
ZZ__RZZ"Ms!ST U2 
ZZ__RZZ"Ms!ST U2 
ZZ__RZZ"Ms!ST U( 
ZZ__RZZ"Ms!ST? U?6 
ZZ__RZZ"Ms!ST U2 
ZZ__RZZ"Ms!ST
 U
 
ZZ__RZZ"Ms!ST
 U
 
ZZ__RZZ"Ms!ST
 U
 
ZZ__RZZ"Ms!STL UL 
ZZ__RZZ"Ms!STL UL 
ZZ__RZZ"Ms!ST
 U
 
ZZ__RZZ"Ms!ST
 U
 
ZZ__RZZ"Ms!ST U  
ZZ__RZZ"Ms!STV UV 
ZZ__RZZ"Ms!ST
 U
$ 
ZZ__RZZ"Ms!ST U( 
ZZ__RZZ"Ms!STK UK 
ZZ__RZZ"Ms!ST4C U4Cl 
ZZ__RZZ"Ms!ST) U)" 
ZZ__RZZ"Ms!STV UV 
ZZ__RZZ"Ms!STV UVr>   r   )!rh   r   r   r   ry   google.authr   r   google.auth.credentialsr   tests.test__defaultr   r[   r\   BASIC_AUTH_ENCODINGSERVICE_ACCOUNT_EMAIL&SERVICE_ACCOUNT_IMPERSONATION_URL_BASEformatr   rZ   r	   SCOPESSUBJECT_TOKEN_FIELD_NAMErD   rE   rC   rB   r   INVALID_TOKEN_URLSr   *INVALID_SERVICE_ACCOUNT_IMPERSONATION_URLSrL  r   rO  r>   r<   <module>r[     s     	    " ! ; 2	0 K 4 ' +b*h*h+ ' +-TT " & 
H	) 1	;; v
  <
, (. *@\Vf \Vr>   