| // Copyright 2023 Google LLC |
| // |
| // Licensed under the Apache License, Version 2.0 (the "License"); |
| // you may not use this file except in compliance with the License. |
| // You may obtain a copy of the License at |
| // |
| // http://www.apache.org/licenses/LICENSE-2.0 |
| // |
| // Unless required by applicable law or agreed to in writing, software |
| // distributed under the License is distributed on an "AS IS" BASIS, |
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| // See the License for the specific language governing permissions and |
| // limitations under the License. |
| |
| package credsfile |
| |
| import ( |
| "encoding/json" |
| "os" |
| "testing" |
| |
| "github.com/google/go-cmp/cmp" |
| ) |
| |
| func TestParseServiceAccount(t *testing.T) { |
| b, err := os.ReadFile("../testdata/sa.json") |
| if err != nil { |
| t.Fatal(err) |
| } |
| got, err := ParseServiceAccount(b) |
| if err != nil { |
| t.Fatal(err) |
| } |
| want := &ServiceAccountFile{ |
| Type: "service_account", |
| ProjectID: "fake_project", |
| PrivateKeyID: "abcdef1234567890", |
| PrivateKey: "-----BEGIN PRIVATE KEY-----\nMIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBALX0PQoe1igW12ikv1bN/r9lN749y2ijmbc/mFHPyS3hNTyOCjDvBbXYbDhQJzWVUikh4mvGBA07qTj79Xc3yBDfKP2IeyYQIFe0t0zkd7R9Zdn98Y2rIQC47aAbDfubtkU1U72t4zL11kHvoa0/RuFZjncvlr42X7be7lYh4p3NAgMBAAECgYASk5wDw4Az2ZkmeuN6Fk/y9H+Lcb2pskJIXjrL533vrDWGOC48LrsThMQPv8cxBky8HFSEklPpkfTF95tpD43iVwJRB/GrCtGTw65IfJ4/tI09h6zGc4yqvIo1cHX/LQ+SxKLGyir/dQM925rGt/VojxY5ryJR7GLbCzxPnJm/oQJBANwOCO6D2hy1LQYJhXh7O+RLtA/tSnT1xyMQsGT+uUCMiKS2bSKx2wxo9k7h3OegNJIu1q6nZ6AbxDK8H3+d0dUCQQDTrPSXagBxzp8PecbaCHjzNRSQE2in81qYnrAFNB4o3DpHyMMY6s5ALLeHKscEWnqP8Ur6X4PvzZecCWU9BKAZAkAutLPknAuxSCsUOvUfS1i87ex77Ot+w6POp34pEX+UWb+u5iFn2cQacDTHLV1LtE80L8jVLSbrbrlH43H0DjU5AkEAgidhycxS86dxpEljnOMCw8CKoUBd5I880IUahEiUltk7OLJYS/Ts1wbn3kPOVX3wyJs8WBDtBkFrDHW2ezth2QJADj3e1YhMVdjJW5jqwlD/VNddGjgzyunmiZg0uOXsHXbytYmsA545S8KRQFaJKFXYYFo2kOjqOiC1T2cAzMDjCQ==\n-----END PRIVATE KEY-----\n", |
| ClientEmail: "gopher@fake_project.iam.gserviceaccount.com", |
| ClientID: "gopher", |
| AuthURL: "https://accounts.google.com/o/oauth2/auth", |
| TokenURL: "https://oauth2.googleapis.com/token", |
| } |
| if diff := cmp.Diff(want, got); diff != "" { |
| t.Errorf("(-want +got):\n%s", diff) |
| } |
| |
| } |
| |
| func TestParseImpersonatedServiceAccount(t *testing.T) { |
| b, err := os.ReadFile("../testdata/imp.json") |
| if err != nil { |
| t.Fatal(err) |
| } |
| got, err := ParseImpersonatedServiceAccount(b) |
| if err != nil { |
| t.Fatal(err) |
| } |
| want := &ImpersonatedServiceAccountFile{ |
| Type: "impersonated_service_account", |
| ServiceAccountImpersonationURL: "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/sa3@developer.gserviceaccount.com:generateAccessToken", |
| Delegates: []string{ |
| "sa1@developer.gserviceaccount.com", |
| "sa2@developer.gserviceaccount.com", |
| }, |
| CredSource: json.RawMessage(`{ |
| "type": "service_account", |
| "project_id": "fake_project", |
| "private_key_id": "89asd789789uo473454c47543", |
| "private_key": "-----BEGIN PRIVATE KEY-----\nMIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBALX0PQoe1igW12ikv1bN/r9lN749y2ijmbc/mFHPyS3hNTyOCjDvBbXYbDhQJzWVUikh4mvGBA07qTj79Xc3yBDfKP2IeyYQIFe0t0zkd7R9Zdn98Y2rIQC47aAbDfubtkU1U72t4zL11kHvoa0/RuFZjncvlr42X7be7lYh4p3NAgMBAAECgYASk5wDw4Az2ZkmeuN6Fk/y9H+Lcb2pskJIXjrL533vrDWGOC48LrsThMQPv8cxBky8HFSEklPpkfTF95tpD43iVwJRB/GrCtGTw65IfJ4/tI09h6zGc4yqvIo1cHX/LQ+SxKLGyir/dQM925rGt/VojxY5ryJR7GLbCzxPnJm/oQJBANwOCO6D2hy1LQYJhXh7O+RLtA/tSnT1xyMQsGT+uUCMiKS2bSKx2wxo9k7h3OegNJIu1q6nZ6AbxDK8H3+d0dUCQQDTrPSXagBxzp8PecbaCHjzNRSQE2in81qYnrAFNB4o3DpHyMMY6s5ALLeHKscEWnqP8Ur6X4PvzZecCWU9BKAZAkAutLPknAuxSCsUOvUfS1i87ex77Ot+w6POp34pEX+UWb+u5iFn2cQacDTHLV1LtE80L8jVLSbrbrlH43H0DjU5AkEAgidhycxS86dxpEljnOMCw8CKoUBd5I880IUahEiUltk7OLJYS/Ts1wbn3kPOVX3wyJs8WBDtBkFrDHW2ezth2QJADj3e1YhMVdjJW5jqwlD/VNddGjgzyunmiZg0uOXsHXbytYmsA545S8KRQFaJKFXYYFo2kOjqOiC1T2cAzMDjCQ==\n-----END PRIVATE KEY-----\n", |
| "client_email": "sa@fake_project.iam.gserviceaccount.com", |
| "client_id": "gopher", |
| "auth_uri": "https://accounts.google.com/o/oauth2/auth", |
| "token_uri": "https://oauth2.googleapis.com/token" |
| }`), |
| } |
| if diff := cmp.Diff(want, got); diff != "" { |
| t.Errorf("(-want +got):\n%s", diff) |
| } |
| |
| } |
| |
| func TestParseGDCHServiceAccount(t *testing.T) { |
| b, err := os.ReadFile("../testdata/gdch.json") |
| if err != nil { |
| t.Fatal(err) |
| } |
| got, err := ParseGDCHServiceAccount(b) |
| if err != nil { |
| t.Fatal(err) |
| } |
| want := &GDCHServiceAccountFile{ |
| Type: "gdch_service_account", |
| FormatVersion: "1", |
| Project: "fake_project", |
| Name: "sa_name", |
| PrivateKey: "-----BEGIN PRIVATE KEY-----\nMIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBALX0PQoe1igW12ikv1bN/r9lN749y2ijmbc/mFHPyS3hNTyOCjDvBbXYbDhQJzWVUikh4mvGBA07qTj79Xc3yBDfKP2IeyYQIFe0t0zkd7R9Zdn98Y2rIQC47aAbDfubtkU1U72t4zL11kHvoa0/RuFZjncvlr42X7be7lYh4p3NAgMBAAECgYASk5wDw4Az2ZkmeuN6Fk/y9H+Lcb2pskJIXjrL533vrDWGOC48LrsThMQPv8cxBky8HFSEklPpkfTF95tpD43iVwJRB/GrCtGTw65IfJ4/tI09h6zGc4yqvIo1cHX/LQ+SxKLGyir/dQM925rGt/VojxY5ryJR7GLbCzxPnJm/oQJBANwOCO6D2hy1LQYJhXh7O+RLtA/tSnT1xyMQsGT+uUCMiKS2bSKx2wxo9k7h3OegNJIu1q6nZ6AbxDK8H3+d0dUCQQDTrPSXagBxzp8PecbaCHjzNRSQE2in81qYnrAFNB4o3DpHyMMY6s5ALLeHKscEWnqP8Ur6X4PvzZecCWU9BKAZAkAutLPknAuxSCsUOvUfS1i87ex77Ot+w6POp34pEX+UWb+u5iFn2cQacDTHLV1LtE80L8jVLSbrbrlH43H0DjU5AkEAgidhycxS86dxpEljnOMCw8CKoUBd5I880IUahEiUltk7OLJYS/Ts1wbn3kPOVX3wyJs8WBDtBkFrDHW2ezth2QJADj3e1YhMVdjJW5jqwlD/VNddGjgzyunmiZg0uOXsHXbytYmsA545S8KRQFaJKFXYYFo2kOjqOiC1T2cAzMDjCQ==\n-----END PRIVATE KEY-----\n", |
| PrivateKeyID: "abcdef1234567890", |
| CertPath: "cert.pem", |
| TokenURL: "replace_me", |
| } |
| if diff := cmp.Diff(want, got); diff != "" { |
| t.Errorf("(-want +got):\n%s", diff) |
| } |
| } |
| |
| func TestParseClientCredential_Web(t *testing.T) { |
| b, err := os.ReadFile("../testdata/clientcreds_web.json") |
| if err != nil { |
| t.Fatal(err) |
| } |
| got, err := ParseClientCredentials(b) |
| if err != nil { |
| t.Fatal(err) |
| } |
| want := &ClientCredentialsFile{ |
| Web: &Config3LO{ |
| ClientID: "222-nprqovg5k43uum874cs9osjt2koe97g8.apps.googleusercontent.com", |
| ClientSecret: "3Oknc4jS_wA2r9i", |
| RedirectURIs: []string{"https://www.example.com/oauth2callback"}, |
| AuthURI: "https://google.com/o/oauth2/auth", |
| TokenURI: "https://google.com/o/oauth2/token", |
| }, |
| } |
| if diff := cmp.Diff(want, got); diff != "" { |
| t.Errorf("(-want +got):\n%s", diff) |
| } |
| } |
| |
| func TestParseClientCredential_Installed(t *testing.T) { |
| b, err := os.ReadFile("../testdata/clientcreds_installed.json") |
| if err != nil { |
| t.Fatal(err) |
| } |
| got, err := ParseClientCredentials(b) |
| if err != nil { |
| t.Fatal(err) |
| } |
| want := &ClientCredentialsFile{ |
| Installed: &Config3LO{ |
| ClientID: "222-installed.apps.googleusercontent.com", |
| ClientSecret: "shhhh", |
| RedirectURIs: []string{"https://www.example.com/oauth2callback"}, |
| AuthURI: "https://accounts.google.com/o/oauth2/auth", |
| TokenURI: "https://accounts.google.com/o/oauth2/token", |
| }, |
| } |
| if diff := cmp.Diff(want, got); diff != "" { |
| t.Errorf("(-want +got):\n%s", diff) |
| } |
| } |
| |
| func TestParseUserCredentials(t *testing.T) { |
| b, err := os.ReadFile("../testdata/user.json") |
| if err != nil { |
| t.Fatal(err) |
| } |
| got, err := ParseUserCredentials(b) |
| if err != nil { |
| t.Fatal(err) |
| } |
| want := &UserCredentialsFile{ |
| Type: "authorized_user", |
| ClientID: "abc123.apps.googleusercontent.com", |
| ClientSecret: "shh", |
| QuotaProjectID: "fake_project2", |
| RefreshToken: "refreshing", |
| } |
| if diff := cmp.Diff(want, got); diff != "" { |
| t.Errorf("(-want +got):\n%s", diff) |
| } |
| } |
| |
| func TestParseExternalAccount_AWS(t *testing.T) { |
| b, err := os.ReadFile("../testdata/exaccount_aws.json") |
| if err != nil { |
| t.Fatal(err) |
| } |
| got, err := ParseExternalAccount(b) |
| if err != nil { |
| t.Fatal(err) |
| } |
| want := &ExternalAccountFile{ |
| Type: "external_account", |
| Audience: "//iam.googleapis.com/projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/$POOL_ID/providers/$PROVIDER_ID", |
| SubjectTokenType: "urn:ietf:params:aws:token-type:aws4_request", |
| ServiceAccountImpersonationURL: "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/$EMAIL:generateAccessToken", |
| TokenURL: "https://sts.googleapis.com/v1/token", |
| CredentialSource: &CredentialSource{ |
| URL: "http://169.254.169.254/latest/meta-data/iam/security-credentials", |
| EnvironmentID: "aws1", |
| RegionURL: "http://169.254.169.254/latest/meta-data/placement/availability-zone", |
| RegionalCredVerificationURL: "https://sts.{region}.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15", |
| IMDSv2SessionTokenURL: "http://169.254.169.254/latest/api/token", |
| }, |
| } |
| if diff := cmp.Diff(want, got); diff != "" { |
| t.Errorf("(-want +got):\n%s", diff) |
| } |
| } |
| |
| func TestParseExternalAccount_URL(t *testing.T) { |
| b, err := os.ReadFile("../testdata/exaccount_url.json") |
| if err != nil { |
| t.Fatal(err) |
| } |
| got, err := ParseExternalAccount(b) |
| if err != nil { |
| t.Fatal(err) |
| } |
| want := &ExternalAccountFile{ |
| Type: "external_account", |
| Audience: "//iam.googleapis.com/projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/$POOL_ID/providers/$PROVIDER_ID", |
| SubjectTokenType: "urn:ietf:params:oauth:token-type:jwt", |
| ServiceAccountImpersonationURL: "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/$EMAIL:generateAccessToken", |
| TokenURL: "https://sts.googleapis.com/v1/token", |
| CredentialSource: &CredentialSource{ |
| URL: "http://localhost:5000/token", |
| Format: &Format{ |
| Type: "json", |
| SubjectTokenFieldName: "id_token", |
| }, |
| }, |
| } |
| if diff := cmp.Diff(want, got); diff != "" { |
| t.Errorf("(-want +got):\n%s", diff) |
| } |
| } |
| |
| func TestParseExternalAccount_File(t *testing.T) { |
| b, err := os.ReadFile("../testdata/exaccount_file.json") |
| if err != nil { |
| t.Fatal(err) |
| } |
| got, err := ParseExternalAccount(b) |
| if err != nil { |
| t.Fatal(err) |
| } |
| want := &ExternalAccountFile{ |
| Type: "external_account", |
| Audience: "//iam.googleapis.com/projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/$POOL_ID/providers/$PROVIDER_ID", |
| SubjectTokenType: "urn:ietf:params:oauth:token-type:saml2", |
| ServiceAccountImpersonationURL: "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/$EMAIL:generateAccessToken", |
| TokenURL: "https://sts.googleapis.com/v1/token", |
| CredentialSource: &CredentialSource{ |
| File: "/var/run/saml/assertion/token", |
| }, |
| } |
| if diff := cmp.Diff(want, got); diff != "" { |
| t.Errorf("(-want +got):\n%s", diff) |
| } |
| } |
| |
| func TestParseExternalAccount_Cmd(t *testing.T) { |
| b, err := os.ReadFile("../testdata/exaccount_cmd.json") |
| if err != nil { |
| t.Fatal(err) |
| } |
| got, err := ParseExternalAccount(b) |
| if err != nil { |
| t.Fatal(err) |
| } |
| want := &ExternalAccountFile{ |
| Type: "external_account", |
| Audience: "//iam.googleapis.com/projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/$POOL_ID/providers/$PROVIDER_ID", |
| SubjectTokenType: "urn:ietf:params:oauth:token-type:saml2", |
| ServiceAccountImpersonationURL: "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/$EMAIL@project.iam.gserviceaccount.com:generateAccessToken", |
| TokenURL: "https://sts.googleapis.com/v1/token", |
| CredentialSource: &CredentialSource{ |
| Executable: &ExecutableConfig{ |
| Command: "/path/to/executable --arg1=value1 --arg2=value2", |
| OutputFile: "/path/to/cached/credentials", |
| }, |
| }, |
| } |
| want.CredentialSource.Executable.TimeoutMillis = 5000 |
| if diff := cmp.Diff(want, got); diff != "" { |
| t.Errorf("(-want +got):\n%s", diff) |
| } |
| } |
| |
| func TestParseExternalAccountAuthorizedUser(t *testing.T) { |
| b, err := os.ReadFile("../testdata/exaccount_user.json") |
| if err != nil { |
| t.Fatal(err) |
| } |
| got, err := ParseExternalAccountAuthorizedUser(b) |
| if err != nil { |
| t.Fatal(err) |
| } |
| want := &ExternalAccountAuthorizedUserFile{ |
| Type: "external_account_authorized_user", |
| Audience: "//iam.googleapis.com/locations/global/workforcePools/$POOL_ID/providers/$PROVIDER_ID", |
| ClientID: "abc123.apps.googleusercontent.com", |
| ClientSecret: "shh", |
| RefreshToken: "refreshing", |
| TokenURL: "https://sts.googleapis.com/v1/oauthtoken", |
| TokenInfoURL: "https://sts.googleapis.com/v1/info", |
| RevokeURL: "https://sts.googleapis.com/v1/revoke", |
| QuotaProjectID: "fake_project2", |
| } |
| if diff := cmp.Diff(want, got); diff != "" { |
| t.Errorf("(-want +got):\n%s", diff) |
| } |
| } |
