fix: only add IAM scope to credentials that can change scopes (#451)
diff --git a/tests/test_impersonated_credentials.py b/tests/test_impersonated_credentials.py
index 1cfcc7c..31075ca 100644
--- a/tests/test_impersonated_credentials.py
+++ b/tests/test_impersonated_credentials.py
@@ -26,6 +26,7 @@
from google.auth import impersonated_credentials
from google.auth import transport
from google.auth.impersonated_credentials import Credentials
+from google.oauth2 import credentials
from google.oauth2 import service_account
DATA_DIR = os.path.join(os.path.dirname(__file__), "", "data")
@@ -102,17 +103,30 @@
SOURCE_CREDENTIALS = service_account.Credentials(
SIGNER, SERVICE_ACCOUNT_EMAIL, TOKEN_URI
)
+ USER_SOURCE_CREDENTIALS = credentials.Credentials(token="ABCDE")
- def make_credentials(self, lifetime=LIFETIME, target_principal=TARGET_PRINCIPAL):
+ def make_credentials(
+ self,
+ source_credentials=SOURCE_CREDENTIALS,
+ lifetime=LIFETIME,
+ target_principal=TARGET_PRINCIPAL,
+ ):
return Credentials(
- source_credentials=self.SOURCE_CREDENTIALS,
+ source_credentials=source_credentials,
target_principal=target_principal,
target_scopes=self.TARGET_SCOPES,
delegates=self.DELEGATES,
lifetime=lifetime,
)
+ def test_make_from_user_credentials(self):
+ credentials = self.make_credentials(
+ source_credentials=self.USER_SOURCE_CREDENTIALS
+ )
+ assert not credentials.valid
+ assert credentials.expired
+
def test_default_state(self):
credentials = self.make_credentials()
assert not credentials.valid