blob: a317e0ac19e003d125fbdfa50c77173b6bec5d41 [file] [log] [blame]
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -07001# Copyright 2016 Google Inc.
2#
3# Licensed under the Apache License, Version 2.0 (the "License");
4# you may not use this file except in compliance with the License.
5# You may obtain a copy of the License at
6#
7# http://www.apache.org/licenses/LICENSE-2.0
8#
9# Unless required by applicable law or agreed to in writing, software
10# distributed under the License is distributed on an "AS IS" BASIS,
11# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12# See the License for the specific language governing permissions and
13# limitations under the License.
14
15import json
16import os
17
18import mock
19import pytest
20
21from google.auth import _default
Jon Wayne Parrott2148fde2016-10-24 13:44:25 -070022from google.auth import app_engine
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -070023from google.auth import compute_engine
24from google.auth import environment_vars
25from google.auth import exceptions
26from google.oauth2 import service_account
27import google.oauth2.credentials
28
29
30DATA_DIR = os.path.join(os.path.dirname(__file__), 'data')
31AUTHORIZED_USER_FILE = os.path.join(DATA_DIR, 'authorized_user.json')
32
33with open(AUTHORIZED_USER_FILE) as fh:
34 AUTHORIZED_USER_FILE_DATA = json.load(fh)
35
36SERVICE_ACCOUNT_FILE = os.path.join(DATA_DIR, 'service_account.json')
37
38with open(SERVICE_ACCOUNT_FILE) as fh:
39 SERVICE_ACCOUNT_FILE_DATA = json.load(fh)
40
41with open(os.path.join(DATA_DIR, 'cloud_sdk.cfg')) as fh:
42 CLOUD_SDK_CONFIG_DATA = fh.read()
43
44LOAD_FILE_PATCH = mock.patch(
45 'google.auth._default._load_credentials_from_file', return_value=(
Jon Wayne Parrott8784b232016-11-10 12:53:55 -080046 mock.sentinel.credentials, mock.sentinel.project_id), autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -070047
48
49def test__load_credentials_from_file_invalid_json(tmpdir):
50 jsonfile = tmpdir.join('invalid.json')
51 jsonfile.write('{')
52
53 with pytest.raises(exceptions.DefaultCredentialsError) as excinfo:
54 _default._load_credentials_from_file(str(jsonfile))
55
56 assert excinfo.match(r'not a valid json file')
57
58
59def test__load_credentials_from_file_invalid_type(tmpdir):
60 jsonfile = tmpdir.join('invalid.json')
61 jsonfile.write(json.dumps({'type': 'not-a-real-type'}))
62
63 with pytest.raises(exceptions.DefaultCredentialsError) as excinfo:
64 _default._load_credentials_from_file(str(jsonfile))
65
66 assert excinfo.match(r'does not have a valid type')
67
68
69def test__load_credentials_from_file_authorized_user():
70 credentials, project_id = _default._load_credentials_from_file(
71 AUTHORIZED_USER_FILE)
72 assert isinstance(credentials, google.oauth2.credentials.Credentials)
73 assert project_id is None
74
75
76def test__load_credentials_from_file_authorized_user_bad_format(tmpdir):
77 filename = tmpdir.join('authorized_user_bad.json')
78 filename.write(json.dumps({'type': 'authorized_user'}))
79
80 with pytest.raises(exceptions.DefaultCredentialsError) as excinfo:
81 _default._load_credentials_from_file(str(filename))
82
83 assert excinfo.match(r'Failed to load authorized user')
84 assert excinfo.match(r'missing fields')
85
86
87def test__load_credentials_from_file_service_account():
88 credentials, project_id = _default._load_credentials_from_file(
89 SERVICE_ACCOUNT_FILE)
90 assert isinstance(credentials, service_account.Credentials)
91 assert project_id == SERVICE_ACCOUNT_FILE_DATA['project_id']
92
93
94def test__load_credentials_from_file_service_account_bad_format(tmpdir):
95 filename = tmpdir.join('serivce_account_bad.json')
96 filename.write(json.dumps({'type': 'service_account'}))
97
98 with pytest.raises(exceptions.DefaultCredentialsError) as excinfo:
99 _default._load_credentials_from_file(str(filename))
100
101 assert excinfo.match(r'Failed to load service account')
102 assert excinfo.match(r'missing fields')
103
104
105@mock.patch.dict(os.environ, {}, clear=True)
106def test__get_explicit_environ_credentials_no_env():
107 assert _default._get_explicit_environ_credentials() == (None, None)
108
109
110@LOAD_FILE_PATCH
111def test__get_explicit_environ_credentials(mock_load, monkeypatch):
112 monkeypatch.setenv(environment_vars.CREDENTIALS, 'filename')
113
114 credentials, project_id = _default._get_explicit_environ_credentials()
115
116 assert credentials is mock.sentinel.credentials
117 assert project_id is mock.sentinel.project_id
118 mock_load.assert_called_with('filename')
119
120
121@LOAD_FILE_PATCH
122def test__get_explicit_environ_credentials_no_project_id(
123 mock_load, monkeypatch):
124 mock_load.return_value = (mock.sentinel.credentials, None)
125 monkeypatch.setenv(environment_vars.CREDENTIALS, 'filename')
126
127 credentials, project_id = _default._get_explicit_environ_credentials()
128
129 assert credentials is mock.sentinel.credentials
130 assert project_id is None
131
132
133@LOAD_FILE_PATCH
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800134@mock.patch(
135 'google.auth._cloud_sdk.get_application_default_credentials_path',
136 autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700137def test__get_gcloud_sdk_credentials(
138 mock_get_adc_path, mock_load):
139 mock_get_adc_path.return_value = SERVICE_ACCOUNT_FILE
140
141 credentials, project_id = _default._get_gcloud_sdk_credentials()
142
143 assert credentials is mock.sentinel.credentials
144 assert project_id is mock.sentinel.project_id
145 mock_load.assert_called_with(SERVICE_ACCOUNT_FILE)
146
147
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800148@mock.patch(
149 'google.auth._cloud_sdk.get_application_default_credentials_path',
150 autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700151def test__get_gcloud_sdk_credentials_non_existent(mock_get_adc_path, tmpdir):
152 non_existent = tmpdir.join('non-existent')
153 mock_get_adc_path.return_value = str(non_existent)
154
155 credentials, project_id = _default._get_gcloud_sdk_credentials()
156
157 assert credentials is None
158 assert project_id is None
159
160
161@mock.patch(
162 'google.auth._cloud_sdk.get_project_id',
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800163 return_value=mock.sentinel.project_id, autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700164@mock.patch('os.path.isfile', return_value=True)
165@LOAD_FILE_PATCH
166def test__get_gcloud_sdk_credentials_project_id(
167 mock_load, unused_mock_isfile, mock_get_project_id):
168 # Don't return a project ID from load file, make the function check
169 # the Cloud SDK project.
170 mock_load.return_value = (mock.sentinel.credentials, None)
171
172 credentials, project_id = _default._get_gcloud_sdk_credentials()
173
174 assert credentials == mock.sentinel.credentials
175 assert project_id == mock.sentinel.project_id
176 assert mock_get_project_id.called
177
178
179@mock.patch(
180 'google.auth._cloud_sdk.get_project_id',
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800181 return_value=None, autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700182@mock.patch('os.path.isfile', return_value=True)
183@LOAD_FILE_PATCH
184def test__get_gcloud_sdk_credentials_no_project_id(
185 mock_load, unused_mock_isfile, mock_get_project_id):
186 # Don't return a project ID from load file, make the function check
187 # the Cloud SDK project.
188 mock_load.return_value = (mock.sentinel.credentials, None)
189
190 credentials, project_id = _default._get_gcloud_sdk_credentials()
191
192 assert credentials == mock.sentinel.credentials
193 assert project_id is None
194
195
Jon Wayne Parrott2148fde2016-10-24 13:44:25 -0700196@pytest.fixture
197def app_identity_mock(monkeypatch):
198 """Mocks the app_identity module for google.auth.app_engine."""
199 app_identity_mock = mock.Mock()
200 monkeypatch.setattr(
201 app_engine, 'app_identity', app_identity_mock)
202 yield app_identity_mock
203
204
205def test__get_gae_credentials(app_identity_mock):
206 app_identity_mock.get_application_id.return_value = mock.sentinel.project
207
208 credentials, project_id = _default._get_gae_credentials()
209
210 assert isinstance(credentials, app_engine.Credentials)
211 assert project_id == mock.sentinel.project
212
213
214def test__get_gae_credentials_no_apis():
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700215 assert _default._get_gae_credentials() == (None, None)
216
217
218@mock.patch(
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800219 'google.auth.compute_engine._metadata.ping', return_value=True,
220 autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700221@mock.patch(
Jon Wayne Parrott5b03ba12016-10-24 13:51:26 -0700222 'google.auth.compute_engine._metadata.get_project_id',
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800223 return_value='example-project', autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700224def test__get_gce_credentials(get_mock, ping_mock):
225 credentials, project_id = _default._get_gce_credentials()
226
227 assert isinstance(credentials, compute_engine.Credentials)
228 assert project_id == 'example-project'
229
230
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800231@mock.patch(
232 'google.auth.compute_engine._metadata.ping', return_value=False,
233 autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700234def test__get_gce_credentials_no_ping(ping_mock):
235 credentials, project_id = _default._get_gce_credentials()
236
237 assert credentials is None
238 assert project_id is None
239
240
241@mock.patch(
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800242 'google.auth.compute_engine._metadata.ping', return_value=True,
243 autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700244@mock.patch(
Jon Wayne Parrott5b03ba12016-10-24 13:51:26 -0700245 'google.auth.compute_engine._metadata.get_project_id',
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800246 side_effect=exceptions.TransportError(), autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700247def test__get_gce_credentials_no_project_id(get_mock, ping_mock):
248 credentials, project_id = _default._get_gce_credentials()
249
250 assert isinstance(credentials, compute_engine.Credentials)
251 assert project_id is None
252
253
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800254@mock.patch(
255 'google.auth.compute_engine._metadata.ping', return_value=False,
256 autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700257def test__get_gce_credentials_explicit_request(ping_mock):
258 _default._get_gce_credentials(mock.sentinel.request)
259 ping_mock.assert_called_with(request=mock.sentinel.request)
260
261
262@mock.patch(
263 'google.auth._default._get_explicit_environ_credentials',
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800264 return_value=(mock.sentinel.credentials, mock.sentinel.project_id),
265 autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700266def test_default_early_out(get_mock):
267 assert _default.default() == (
268 mock.sentinel.credentials, mock.sentinel.project_id)
269
270
271@mock.patch(
272 'google.auth._default._get_explicit_environ_credentials',
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800273 return_value=(mock.sentinel.credentials, mock.sentinel.project_id),
274 autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700275def test_default_explict_project_id(get_mock, monkeypatch):
276 monkeypatch.setenv(environment_vars.PROJECT, 'explicit-env')
277 assert _default.default() == (
278 mock.sentinel.credentials, 'explicit-env')
279
280
281@mock.patch(
282 'google.auth._default._get_explicit_environ_credentials',
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800283 return_value=(mock.sentinel.credentials, mock.sentinel.project_id),
284 autospec=True)
Jon Wayne Parrottce37cba2016-11-07 16:41:42 -0800285def test_default_explict_legacy_project_id(get_mock, monkeypatch):
286 monkeypatch.setenv(environment_vars.LEGACY_PROJECT, 'explicit-env')
287 assert _default.default() == (
288 mock.sentinel.credentials, 'explicit-env')
289
290
291@mock.patch(
292 'google.auth._default._get_explicit_environ_credentials',
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800293 return_value=(None, None), autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700294@mock.patch(
295 'google.auth._default._get_gcloud_sdk_credentials',
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800296 return_value=(None, None), autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700297@mock.patch(
298 'google.auth._default._get_gae_credentials',
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800299 return_value=(None, None), autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700300@mock.patch(
301 'google.auth._default._get_gce_credentials',
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800302 return_value=(None, None), autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700303def test_default_fail(unused_gce, unused_gae, unused_sdk, unused_explicit):
304 with pytest.raises(exceptions.DefaultCredentialsError):
305 assert _default.default()
Jon Wayne Parrott8a7e5062016-11-07 16:45:17 -0800306
307
308@mock.patch(
309 'google.auth._default._get_explicit_environ_credentials',
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800310 return_value=(mock.sentinel.credentials, mock.sentinel.project_id),
311 autospec=True)
Jon Wayne Parrott8a7e5062016-11-07 16:45:17 -0800312@mock.patch(
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800313 'google.auth.credentials.with_scopes_if_required', autospec=True)
Jon Wayne Parrott8a7e5062016-11-07 16:45:17 -0800314def test_default_scoped(with_scopes_mock, get_mock):
315 scopes = ['one', 'two']
316
317 credentials, project_id = _default.default(scopes=scopes)
318
319 assert credentials == with_scopes_mock.return_value
320 assert project_id == mock.sentinel.project_id
321 with_scopes_mock.assert_called_once_with(
322 mock.sentinel.credentials, scopes)