
    G                         d dl mZ d dlZd dlZd dlZd dlZd dlmZ d dlm	Z	 d dl
mZ d dl
mZ dZdZdZ G d	 d
e      Zy)    N)
exceptions)	transport)sts)utilsusernamepasswordzdXNlcm5hbWU6cGFzc3dvcmQ=c                      e Zd ZdZdZdZddgZdZdZdZ	d	Z
dZd
ZddiZddgddiZddddddZddddZddddZ ej&                  ej(                  j*                  ee      Z ej&                  ej(                  j2                  ee      Zed/d       Zeej<                  fd       Zed         Z d! Z!d" Z"d# Z#d$ Z$d% Z%d& Z&d' Z'd( Z(d) Z)d* Z*d+ Z+d, Z,d- Z-d. Z.y)0TestStsClientz/urn:ietf:params:oauth:grant-type:token-exchangezhttps://api.example.com/zurn:example:cooperation-contextscope1scope2z-urn:ietf:params:oauth:token-type:access_tokenz&HEADER.SUBJECT_TOKEN_PAYLOAD.SIGNATUREz$urn:ietf:params:oauth:token-type:jwtz$HEADER.ACTOR_TOKEN_PAYLOAD.SIGNATUREz https://example.com/token.oauth2zx-client-versionz0.1.2
additionaloptionsz
some-value)znon-standardotherACCESS_TOKENBeareri  zscope1 scope2)access_tokenissued_token_type
token_type
expires_inscopeabcxyz)r   refresh_tokenr   invalid_requestzInvalid subject tokenz#https://tools.ietf.org/html/rfc6749)errorerror_description	error_uriNc                 B    t        j                  | j                  |      S N)r   ClientTOKEN_EXCHANGE_ENDPOINT)clsclient_auths     Oplatform/gsutil/third_party/google-auth-library-python/tests/oauth2/test_sts.pymake_clientzTestStsClient.make_clientF   s    zz#55{CC    c                    t        j                  t        j                  d      }||_        t        j                  |      j                  d      |_        t        j                  t        j                        }||_
        |S )NT)instanceutf-8)mockcreate_autospecr   ResponsestatusjsondumpsencodedataRequestreturn_value)r"   r1   r-   responserequests        r$   make_mock_requestzTestStsClient.make_mock_requestJ   s_    ''	(:(:TJ 

4(//8&&y'8'89'r&   c                 X   |d   | j                   k(  sJ |d   dk(  sJ |d   |k(  sJ |d   J t        j                  j                  |d         }|D ]-  \  }}|j	                  d      ||j	                  d         k(  r-J  t        |      t        |j                               k(  sJ y)zEAsserts the request was called with the expected parameters.
        urlmethodPOSTheadersbodyNr)   )r!   urllibparse	parse_qsldecodelenkeys)r"   request_kwargsr;   request_databody_tupleskvs          r$   assert_request_kwargsz#TestStsClient.assert_request_kwargsU   s     e$(C(CCCCh'6111i(G333f%111ll,,^F-CD!FQ88G$QXXg5F(GGGG ";3|'8'8':#;;;;r&   c                    | j                         }| j                  j                         }d|d<   | j                  | j                  | j
                  dj                  | j                        | j                  | j                  | j                  | j                  | j                  t        j                  j                  t!        j"                  | j$                              d
}| j'                  t(        j*                  | j,                        }|j/                  || j                  | j                  | j                  | j                  | j
                  | j                  | j                  | j                  | j                  | j$                  | j                        }| j1                  |j2                  d   ||       || j,                  k(  sJ y)zaTest token exchange success without client authentication using full
        parameters.
        !application/x-www-form-urlencodedContent-Type 

grant_typeresourceaudiencer   requested_token_typesubject_tokensubject_token_typeactor_tokenactor_token_typer   r-   r1      N)r%   ADDON_HEADERScopy
GRANT_TYPERESOURCEAUDIENCEjoinSCOPESREQUESTED_TOKEN_TYPESUBJECT_TOKENSUBJECT_TOKEN_TYPEACTOR_TOKENACTOR_TOKEN_TYPEr=   r>   quoter.   r/   ADDON_OPTIONSr6   http_clientOKSUCCESS_RESPONSEexchange_tokenrH   	call_argsselfclientr;   rD   r5   r4   s         r$   -test_exchange_token_full_success_without_authz;TestStsClient.test_exchange_token_full_success_without_authb   ss    !!#$$))+"E//XXdkk*$($=$=!//"&"9"9++ $ 5 5||))$**T5G5G*HI
 ((>>(=(= ) 
 ((OO##MMMMKK%%!!
 	""7#4#4Q#7,O400000r&   c                    | j                         }ddi}| j                  | j                  | j                  | j                  | j
                  d}| j                  t        j                  | j                        }|j                  || j                  | j                  | j
                  | j                  | j                        }| j                  |j                  d   ||       || j                  k(  sJ y)ztTest token exchange success without client authentication using
        partial (required only) parameters.
        rK   rJ   rN   rP   rQ   rR   rS   rV   rN   rR   rS   rP   rQ   rW   N)r%   rZ   r\   r_   r`   ra   r6   rf   rg   rh   ri   rH   rj   rk   s         r$   0test_exchange_token_partial_success_without_authz>TestStsClient.test_exchange_token_partial_success_without_auth   s     !!#!#FG//$($=$=!//"&"9"9
 ((>>(=(= ) 
 ((,,#66]]!%!:!: ) 
 	""7#4#4Q#7,O400000r&   c                 $   | j                         }| j                  t        j                  | j                        }t        j                  t        j                        5 }|j                  || j                  | j                  | j                  | j                  | j                  | j                  | j                   | j"                  | j$                  | j&                  | j(                         ddd       j+                  d      sJ y# 1 sw Y   xY w)zPTest token exchange without client auth responding with non-200 status.
        rV   NWError code invalid_request: Invalid subject token - https://tools.ietf.org/html/rfc6749)r%   r6   rf   BAD_REQUESTERROR_RESPONSEpytestraisesr   
OAuthErrorri   rZ   r`   ra   r[   r\   r^   r_   rb   rc   re   rX   matchrl   rm   r5   excinfos       r$   'test_exchange_token_non200_without_authz5TestStsClient.test_exchange_token_non200_without_auth   s     !!#((**1D1D ) 
 ]]:001W!!""''))  %%"""" 2  }}f
 	
 
! 21s   BDDc                    | j                  | j                        }| j                  j                         }d|d<   dj	                  t
              |d<   | j                  | j                  | j                  dj                  | j                        | j                  | j                  | j                  | j                  | j                  t         j"                  j%                  t'        j(                  | j*                              d
}| j-                  t.        j0                  | j2                        }|j5                  || j                  | j                  | j                  | j                  | j                  | j                  | j                  | j                  | j                  | j*                  | j                        }| j7                  |j8                  d   ||       || j2                  k(  sJ y	)
zdTest token exchange success with basic client authentication using full
        parameters.
        rJ   rK   Basic {}AuthorizationrL   rM   rV   rW   N)r%   CLIENT_AUTH_BASICrX   rY   formatBASIC_AUTH_ENCODINGrZ   r[   r\   r]   r^   r_   r`   ra   rb   rc   r=   r>   rd   r.   r/   re   r6   rf   rg   rh   ri   rH   rj   rk   s         r$   0test_exchange_token_full_success_with_basic_authz>TestStsClient.test_exchange_token_full_success_with_basic_auth   s    !!$"8"89$$))+"E#-#4#45H#I //XXdkk*$($=$=!//"&"9"9++ $ 5 5||))$**T5G5G*HI
 ((>>(=(= ) 
 ((OO##MMMMKK%%!!
 	""7#4#4Q#7,O400000r&   c                 (   | j                  | j                        }ddj                  t              d}| j                  | j
                  | j                  | j                  | j                  d}| j                  t        j                  | j                        }|j                  || j                  | j                  | j                  | j
                  | j                        }| j                  |j                  d   ||       || j                  k(  sJ y)	zwTest token exchange success with basic client authentication using
        partial (required only) parameters.
        rJ   r   )rK   r   rp   rV   rq   rW   N)r%   r   r   r   rZ   r\   r_   r`   ra   r6   rf   rg   rh   ri   rH   rj   rk   s         r$   3test_exchange_token_partial_success_with_basic_authzATestStsClient.test_exchange_token_partial_success_with_basic_auth   s    !!$"8"89?'../BC

 //$($=$=!//"&"9"9
 ((>>(=(= ) 
 ((,,#66]]!%!:!: ) 
 	""7#4#4Q#7,O400000r&   c                 :   | j                  | j                        }| j                  t        j                  | j
                        }t        j                  t        j                        5 }|j                  || j                  | j                  | j                  | j                  | j                  | j                   | j"                  | j$                  | j&                  | j(                  | j*                         ddd       j-                  d      sJ y# 1 sw Y   xY w)z[Test token exchange with basic client auth responding with non-200
        status.
        rV   Nrt   )r%   r   r6   rf   ru   rv   rw   rx   r   ry   ri   rZ   r`   ra   r[   r\   r^   r_   rb   rc   re   rX   rz   r{   s       r$   *test_exchange_token_non200_with_basic_authz8TestStsClient.test_exchange_token_non200_with_basic_auth  s     !!$"8"89((**1D1D ) 
 ]]:001W!!""''))  %%"""" 2  }}f
 	
 
! 21   *BDDc                    | j                  | j                        }| j                  j                         }d|d<   | j                  | j
                  | j                  dj                  | j                        | j                  | j                  | j                  | j                  | j                  t        j                  j!                  t#        j$                  | j&                              t(        t*        d}| j-                  t.        j0                  | j2                        }|j5                  || j                  | j                  | j                  | j
                  | j                  | j                  | j                  | j                  | j                  | j&                  | j                        }| j7                  |j8                  d   ||       || j2                  k(  sJ y)zkTest token exchange success with request body client authenticaiton
        using full parameters.
        rJ   rK   rL   )rN   rO   rP   r   rQ   rR   rS   rT   rU   r   	client_idclient_secretrV   rW   N)r%   CLIENT_AUTH_REQUEST_BODYrX   rY   rZ   r[   r\   r]   r^   r_   r`   ra   rb   rc   r=   r>   rd   r.   r/   re   	CLIENT_IDCLIENT_SECRETr6   rf   rg   rh   ri   rH   rj   rk   s         r$   2test_exchange_token_full_success_with_reqbody_authz@TestStsClient.test_exchange_token_full_success_with_reqbody_auth+  s    !!$"?"?@$$))+"E//XXdkk*$($=$=!//"&"9"9++ $ 5 5||))$**T5G5G*HI"*
 ((>>(=(= ) 
 ((OO##MMMMKK%%!!
 	""7#4#4Q#7,O400000r&   c                    | j                  | j                        }ddi}| j                  | j                  | j                  | j
                  | j                  t        t        d}| j                  t        j                  | j                        }|j                  || j                  | j
                  | j                  | j                  | j                        }| j                  |j                  d   ||       || j                  k(  sJ y)z~Test token exchange success with request body client authentication
        using partial (required only) parameters.
        rK   rJ   )rN   rP   rQ   rR   rS   r   r   rV   rq   rW   N)r%   r   rZ   r\   r_   r`   ra   r   r   r6   rf   rg   rh   ri   rH   rj   rk   s         r$   5test_exchange_token_partial_success_with_reqbody_authzCTestStsClient.test_exchange_token_partial_success_with_reqbody_authV  s     !!$"?"?@!#FG//$($=$=!//"&"9"9"*
 ((>>(=(= ) 
 ((,,#66]]!%!:!: ) 
 	""7#4#4Q#7,O400000r&   c                 :   | j                  | j                        }| j                  t        j                  | j
                        }t        j                  t        j                        5 }|j                  || j                  | j                  | j                  | j                  | j                  | j                   | j"                  | j$                  | j&                  | j(                  | j*                         ddd       j-                  d      sJ y# 1 sw Y   xY w)zgTest token exchange with POST request body client auth responding
        with non-200 status.
        rV   Nrt   )r%   r   r6   rf   ru   rv   rw   rx   r   ry   ri   rZ   r`   ra   r[   r\   r^   r_   rb   rc   re   rX   rz   r{   s       r$   ,test_exchange_token_non200_with_reqbody_authz:TestStsClient.test_exchange_token_non200_with_reqbody_authu  s     !!$"?"?@((**1D1D ) 
 ]]:001W!!""''))  %%"""" 2  }}f
 	
 
! 21r   c                 *   | j                  | j                        }| j                  t        j                  | j
                        }|j                  |d      }ddd}ddd}| j                  |j                  d   ||       || j
                  k(  sJ y	
z,Test refresh token with successful response.rV   refreshtokenBasic dXNlcm5hbWU6cGFzc3dvcmQ=rJ   )r   rK   r   )rN   r   rW   N)	r%   r   r6   rf   rg   rh   r   rH   rj   rl   rm   r5   r4   r;   rD   s         r$   test_refresh_token_successz(TestStsClient.test_refresh_token_success  s    !!$"8"89((>>(=(= ) 
 ''@ >?
 '6W""7#4#4Q#7,O400000r&   c                 *   | j                  | j                        }| j                  t        j                  | j
                        }|j                  |d      }ddd}ddd}| j                  |j                  d   ||       || j
                  k(  sJ y	r   )	r%   r   r6   rf   rg   SUCCESS_RESPONSE_WITH_REFRESHr   rH   rj   r   s         r$   'test_refresh_token_success_with_refreshz5TestStsClient.test_refresh_token_success_with_refresh  s    !!$"8"89((>>(J(J ) 
 ''@ >?
 '6W""7#4#4Q#7,O4=====r&   c                 J   | j                  | j                        }| j                  t        j                  | j
                        }t        j                  t        j                        5 }|j                  |d       ddd       j                  d      sJ y# 1 sw Y   xY w))Test refresh token with failure response.rV   r   Nrt   )r%   r   r6   rf   ru   rv   rw   rx   r   ry   r   rz   r{   s       r$   test_refresh_token_failurez(TestStsClient.test_refresh_token_failure  s    !!$"8"89((**1D1D ) 
 ]]:001W  .9 2 }}f
 	
 
 21s   *BB"c                 4   | j                  | j                        }| j                  t        j                  | j
                        }|j                  |ddiddi      }dddd}ddi}| j                  |j                  d	   ||       || j
                  k(  sJ y
)z*Test base method with successful response.rV   abcdr   rJ   )r   rK   r   rW   N)	r%   r   r6   rf   rg   rh   _make_requestrH   rj   r   s         r$   test__make_request_successz(TestStsClient.test__make_request_success  s    !!$"8"89((>>(=(= ) 
 ''#sc3ZH >?

 Sz""7#4#4Q#7,O400000r&   c                 T   | j                  | j                        }| j                  t        j                  | j
                        }t        j                  t        j                        5 }|j                  |ddiddi       ddd       j                  d      sJ y# 1 sw Y   xY w)r   rV   r   r   r   r   Nrt   )r%   r   r6   rf   ru   rv   rw   rx   r   ry   r   rz   r{   s       r$   test_make_request_failurez'TestStsClient.test_make_request_failure  s    !!$"8"89((**1D1D ) 
 ]]:001W  3*sCjA 2 }}f
 	
 
 21s   *BB'r   )/__name__
__module____qualname__rZ   r[   r\   r^   r_   r`   ra   rb   rc   r!   rX   re   rh   r   rv   r   ClientAuthenticationClientAuthTypebasicr   r   r   request_bodyr   classmethodr%   rf   rg   r6   rH   rn   rr   r}   r   r   r   r   r   r   r   r   r   r   r    r&   r$   r
   r
   !   ss   BJ)H0H!FJ<M?8K=@'1M!YK,#WXM&L  %! #4:N
 322""I}  :u99))9m  D D ,7NN   
< 
<'1R1:
8(1T1@
:)1V1>
:1">"
1$
r&   r
   )http.clientrm   rf   r.   r=   r*   rw   google.authr   r   google.oauth2r   r   r   r   r   objectr
   r   r&   r$   <module>r      s@    "     " !  	0 
F 
r&   