Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 1 | # Copyright 2016 Google Inc. |
| 2 | # |
| 3 | # Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | # you may not use this file except in compliance with the License. |
| 5 | # You may obtain a copy of the License at |
| 6 | # |
| 7 | # http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | # |
| 9 | # Unless required by applicable law or agreed to in writing, software |
| 10 | # distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | # See the License for the specific language governing permissions and |
| 13 | # limitations under the License. |
| 14 | |
| 15 | import json |
| 16 | import os |
| 17 | |
| 18 | import mock |
| 19 | import pytest |
| 20 | |
| 21 | from google.auth import _default |
Jon Wayne Parrott | 2148fde | 2016-10-24 13:44:25 -0700 | [diff] [blame] | 22 | from google.auth import app_engine |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 23 | from google.auth import compute_engine |
| 24 | from google.auth import environment_vars |
| 25 | from google.auth import exceptions |
| 26 | from google.oauth2 import service_account |
| 27 | import google.oauth2.credentials |
| 28 | |
| 29 | |
| 30 | DATA_DIR = os.path.join(os.path.dirname(__file__), 'data') |
| 31 | AUTHORIZED_USER_FILE = os.path.join(DATA_DIR, 'authorized_user.json') |
| 32 | |
| 33 | with open(AUTHORIZED_USER_FILE) as fh: |
| 34 | AUTHORIZED_USER_FILE_DATA = json.load(fh) |
| 35 | |
| 36 | SERVICE_ACCOUNT_FILE = os.path.join(DATA_DIR, 'service_account.json') |
| 37 | |
| 38 | with open(SERVICE_ACCOUNT_FILE) as fh: |
| 39 | SERVICE_ACCOUNT_FILE_DATA = json.load(fh) |
| 40 | |
| 41 | with open(os.path.join(DATA_DIR, 'cloud_sdk.cfg')) as fh: |
| 42 | CLOUD_SDK_CONFIG_DATA = fh.read() |
| 43 | |
| 44 | LOAD_FILE_PATCH = mock.patch( |
| 45 | 'google.auth._default._load_credentials_from_file', return_value=( |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 46 | mock.sentinel.credentials, mock.sentinel.project_id), autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 47 | |
| 48 | |
| 49 | def test__load_credentials_from_file_invalid_json(tmpdir): |
| 50 | jsonfile = tmpdir.join('invalid.json') |
| 51 | jsonfile.write('{') |
| 52 | |
| 53 | with pytest.raises(exceptions.DefaultCredentialsError) as excinfo: |
| 54 | _default._load_credentials_from_file(str(jsonfile)) |
| 55 | |
| 56 | assert excinfo.match(r'not a valid json file') |
| 57 | |
| 58 | |
| 59 | def test__load_credentials_from_file_invalid_type(tmpdir): |
| 60 | jsonfile = tmpdir.join('invalid.json') |
| 61 | jsonfile.write(json.dumps({'type': 'not-a-real-type'})) |
| 62 | |
| 63 | with pytest.raises(exceptions.DefaultCredentialsError) as excinfo: |
| 64 | _default._load_credentials_from_file(str(jsonfile)) |
| 65 | |
| 66 | assert excinfo.match(r'does not have a valid type') |
| 67 | |
| 68 | |
| 69 | def test__load_credentials_from_file_authorized_user(): |
| 70 | credentials, project_id = _default._load_credentials_from_file( |
| 71 | AUTHORIZED_USER_FILE) |
| 72 | assert isinstance(credentials, google.oauth2.credentials.Credentials) |
| 73 | assert project_id is None |
| 74 | |
| 75 | |
| 76 | def test__load_credentials_from_file_authorized_user_bad_format(tmpdir): |
| 77 | filename = tmpdir.join('authorized_user_bad.json') |
| 78 | filename.write(json.dumps({'type': 'authorized_user'})) |
| 79 | |
| 80 | with pytest.raises(exceptions.DefaultCredentialsError) as excinfo: |
| 81 | _default._load_credentials_from_file(str(filename)) |
| 82 | |
| 83 | assert excinfo.match(r'Failed to load authorized user') |
| 84 | assert excinfo.match(r'missing fields') |
| 85 | |
| 86 | |
| 87 | def test__load_credentials_from_file_service_account(): |
| 88 | credentials, project_id = _default._load_credentials_from_file( |
| 89 | SERVICE_ACCOUNT_FILE) |
| 90 | assert isinstance(credentials, service_account.Credentials) |
| 91 | assert project_id == SERVICE_ACCOUNT_FILE_DATA['project_id'] |
| 92 | |
| 93 | |
| 94 | def test__load_credentials_from_file_service_account_bad_format(tmpdir): |
| 95 | filename = tmpdir.join('serivce_account_bad.json') |
| 96 | filename.write(json.dumps({'type': 'service_account'})) |
| 97 | |
| 98 | with pytest.raises(exceptions.DefaultCredentialsError) as excinfo: |
| 99 | _default._load_credentials_from_file(str(filename)) |
| 100 | |
| 101 | assert excinfo.match(r'Failed to load service account') |
| 102 | assert excinfo.match(r'missing fields') |
| 103 | |
| 104 | |
| 105 | @mock.patch.dict(os.environ, {}, clear=True) |
| 106 | def test__get_explicit_environ_credentials_no_env(): |
| 107 | assert _default._get_explicit_environ_credentials() == (None, None) |
| 108 | |
| 109 | |
| 110 | @LOAD_FILE_PATCH |
| 111 | def test__get_explicit_environ_credentials(mock_load, monkeypatch): |
| 112 | monkeypatch.setenv(environment_vars.CREDENTIALS, 'filename') |
| 113 | |
| 114 | credentials, project_id = _default._get_explicit_environ_credentials() |
| 115 | |
| 116 | assert credentials is mock.sentinel.credentials |
| 117 | assert project_id is mock.sentinel.project_id |
| 118 | mock_load.assert_called_with('filename') |
| 119 | |
| 120 | |
| 121 | @LOAD_FILE_PATCH |
| 122 | def test__get_explicit_environ_credentials_no_project_id( |
| 123 | mock_load, monkeypatch): |
| 124 | mock_load.return_value = (mock.sentinel.credentials, None) |
| 125 | monkeypatch.setenv(environment_vars.CREDENTIALS, 'filename') |
| 126 | |
| 127 | credentials, project_id = _default._get_explicit_environ_credentials() |
| 128 | |
| 129 | assert credentials is mock.sentinel.credentials |
| 130 | assert project_id is None |
| 131 | |
| 132 | |
| 133 | @LOAD_FILE_PATCH |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 134 | @mock.patch( |
| 135 | 'google.auth._cloud_sdk.get_application_default_credentials_path', |
| 136 | autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 137 | def test__get_gcloud_sdk_credentials( |
| 138 | mock_get_adc_path, mock_load): |
| 139 | mock_get_adc_path.return_value = SERVICE_ACCOUNT_FILE |
| 140 | |
| 141 | credentials, project_id = _default._get_gcloud_sdk_credentials() |
| 142 | |
| 143 | assert credentials is mock.sentinel.credentials |
| 144 | assert project_id is mock.sentinel.project_id |
| 145 | mock_load.assert_called_with(SERVICE_ACCOUNT_FILE) |
| 146 | |
| 147 | |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 148 | @mock.patch( |
| 149 | 'google.auth._cloud_sdk.get_application_default_credentials_path', |
| 150 | autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 151 | def test__get_gcloud_sdk_credentials_non_existent(mock_get_adc_path, tmpdir): |
| 152 | non_existent = tmpdir.join('non-existent') |
| 153 | mock_get_adc_path.return_value = str(non_existent) |
| 154 | |
| 155 | credentials, project_id = _default._get_gcloud_sdk_credentials() |
| 156 | |
| 157 | assert credentials is None |
| 158 | assert project_id is None |
| 159 | |
| 160 | |
| 161 | @mock.patch( |
| 162 | 'google.auth._cloud_sdk.get_project_id', |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 163 | return_value=mock.sentinel.project_id, autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 164 | @mock.patch('os.path.isfile', return_value=True) |
| 165 | @LOAD_FILE_PATCH |
| 166 | def test__get_gcloud_sdk_credentials_project_id( |
| 167 | mock_load, unused_mock_isfile, mock_get_project_id): |
| 168 | # Don't return a project ID from load file, make the function check |
| 169 | # the Cloud SDK project. |
| 170 | mock_load.return_value = (mock.sentinel.credentials, None) |
| 171 | |
| 172 | credentials, project_id = _default._get_gcloud_sdk_credentials() |
| 173 | |
| 174 | assert credentials == mock.sentinel.credentials |
| 175 | assert project_id == mock.sentinel.project_id |
| 176 | assert mock_get_project_id.called |
| 177 | |
| 178 | |
| 179 | @mock.patch( |
| 180 | 'google.auth._cloud_sdk.get_project_id', |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 181 | return_value=None, autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 182 | @mock.patch('os.path.isfile', return_value=True) |
| 183 | @LOAD_FILE_PATCH |
| 184 | def test__get_gcloud_sdk_credentials_no_project_id( |
| 185 | mock_load, unused_mock_isfile, mock_get_project_id): |
| 186 | # Don't return a project ID from load file, make the function check |
| 187 | # the Cloud SDK project. |
| 188 | mock_load.return_value = (mock.sentinel.credentials, None) |
| 189 | |
| 190 | credentials, project_id = _default._get_gcloud_sdk_credentials() |
| 191 | |
| 192 | assert credentials == mock.sentinel.credentials |
| 193 | assert project_id is None |
| 194 | |
| 195 | |
Jon Wayne Parrott | 2148fde | 2016-10-24 13:44:25 -0700 | [diff] [blame] | 196 | @pytest.fixture |
| 197 | def app_identity_mock(monkeypatch): |
| 198 | """Mocks the app_identity module for google.auth.app_engine.""" |
| 199 | app_identity_mock = mock.Mock() |
| 200 | monkeypatch.setattr( |
| 201 | app_engine, 'app_identity', app_identity_mock) |
| 202 | yield app_identity_mock |
| 203 | |
| 204 | |
| 205 | def test__get_gae_credentials(app_identity_mock): |
| 206 | app_identity_mock.get_application_id.return_value = mock.sentinel.project |
| 207 | |
| 208 | credentials, project_id = _default._get_gae_credentials() |
| 209 | |
| 210 | assert isinstance(credentials, app_engine.Credentials) |
| 211 | assert project_id == mock.sentinel.project |
| 212 | |
| 213 | |
| 214 | def test__get_gae_credentials_no_apis(): |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 215 | assert _default._get_gae_credentials() == (None, None) |
| 216 | |
| 217 | |
| 218 | @mock.patch( |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 219 | 'google.auth.compute_engine._metadata.ping', return_value=True, |
| 220 | autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 221 | @mock.patch( |
Jon Wayne Parrott | 5b03ba1 | 2016-10-24 13:51:26 -0700 | [diff] [blame] | 222 | 'google.auth.compute_engine._metadata.get_project_id', |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 223 | return_value='example-project', autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 224 | def test__get_gce_credentials(get_mock, ping_mock): |
| 225 | credentials, project_id = _default._get_gce_credentials() |
| 226 | |
| 227 | assert isinstance(credentials, compute_engine.Credentials) |
| 228 | assert project_id == 'example-project' |
| 229 | |
| 230 | |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 231 | @mock.patch( |
| 232 | 'google.auth.compute_engine._metadata.ping', return_value=False, |
| 233 | autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 234 | def test__get_gce_credentials_no_ping(ping_mock): |
| 235 | credentials, project_id = _default._get_gce_credentials() |
| 236 | |
| 237 | assert credentials is None |
| 238 | assert project_id is None |
| 239 | |
| 240 | |
| 241 | @mock.patch( |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 242 | 'google.auth.compute_engine._metadata.ping', return_value=True, |
| 243 | autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 244 | @mock.patch( |
Jon Wayne Parrott | 5b03ba1 | 2016-10-24 13:51:26 -0700 | [diff] [blame] | 245 | 'google.auth.compute_engine._metadata.get_project_id', |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 246 | side_effect=exceptions.TransportError(), autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 247 | def test__get_gce_credentials_no_project_id(get_mock, ping_mock): |
| 248 | credentials, project_id = _default._get_gce_credentials() |
| 249 | |
| 250 | assert isinstance(credentials, compute_engine.Credentials) |
| 251 | assert project_id is None |
| 252 | |
| 253 | |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 254 | @mock.patch( |
| 255 | 'google.auth.compute_engine._metadata.ping', return_value=False, |
| 256 | autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 257 | def test__get_gce_credentials_explicit_request(ping_mock): |
| 258 | _default._get_gce_credentials(mock.sentinel.request) |
| 259 | ping_mock.assert_called_with(request=mock.sentinel.request) |
| 260 | |
| 261 | |
| 262 | @mock.patch( |
| 263 | 'google.auth._default._get_explicit_environ_credentials', |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 264 | return_value=(mock.sentinel.credentials, mock.sentinel.project_id), |
| 265 | autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 266 | def test_default_early_out(get_mock): |
| 267 | assert _default.default() == ( |
| 268 | mock.sentinel.credentials, mock.sentinel.project_id) |
| 269 | |
| 270 | |
| 271 | @mock.patch( |
| 272 | 'google.auth._default._get_explicit_environ_credentials', |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 273 | return_value=(mock.sentinel.credentials, mock.sentinel.project_id), |
| 274 | autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 275 | def test_default_explict_project_id(get_mock, monkeypatch): |
| 276 | monkeypatch.setenv(environment_vars.PROJECT, 'explicit-env') |
| 277 | assert _default.default() == ( |
| 278 | mock.sentinel.credentials, 'explicit-env') |
| 279 | |
| 280 | |
| 281 | @mock.patch( |
| 282 | 'google.auth._default._get_explicit_environ_credentials', |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 283 | return_value=(mock.sentinel.credentials, mock.sentinel.project_id), |
| 284 | autospec=True) |
Jon Wayne Parrott | ce37cba | 2016-11-07 16:41:42 -0800 | [diff] [blame] | 285 | def test_default_explict_legacy_project_id(get_mock, monkeypatch): |
| 286 | monkeypatch.setenv(environment_vars.LEGACY_PROJECT, 'explicit-env') |
| 287 | assert _default.default() == ( |
| 288 | mock.sentinel.credentials, 'explicit-env') |
| 289 | |
| 290 | |
| 291 | @mock.patch( |
| 292 | 'google.auth._default._get_explicit_environ_credentials', |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 293 | return_value=(None, None), autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 294 | @mock.patch( |
| 295 | 'google.auth._default._get_gcloud_sdk_credentials', |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 296 | return_value=(None, None), autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 297 | @mock.patch( |
| 298 | 'google.auth._default._get_gae_credentials', |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 299 | return_value=(None, None), autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 300 | @mock.patch( |
| 301 | 'google.auth._default._get_gce_credentials', |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 302 | return_value=(None, None), autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 303 | def test_default_fail(unused_gce, unused_gae, unused_sdk, unused_explicit): |
| 304 | with pytest.raises(exceptions.DefaultCredentialsError): |
| 305 | assert _default.default() |
Jon Wayne Parrott | 8a7e506 | 2016-11-07 16:45:17 -0800 | [diff] [blame] | 306 | |
| 307 | |
| 308 | @mock.patch( |
| 309 | 'google.auth._default._get_explicit_environ_credentials', |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 310 | return_value=(mock.sentinel.credentials, mock.sentinel.project_id), |
| 311 | autospec=True) |
Jon Wayne Parrott | 8a7e506 | 2016-11-07 16:45:17 -0800 | [diff] [blame] | 312 | @mock.patch( |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 313 | 'google.auth.credentials.with_scopes_if_required', autospec=True) |
Jon Wayne Parrott | 8a7e506 | 2016-11-07 16:45:17 -0800 | [diff] [blame] | 314 | def test_default_scoped(with_scopes_mock, get_mock): |
| 315 | scopes = ['one', 'two'] |
| 316 | |
| 317 | credentials, project_id = _default.default(scopes=scopes) |
| 318 | |
| 319 | assert credentials == with_scopes_mock.return_value |
| 320 | assert project_id == mock.sentinel.project_id |
| 321 | with_scopes_mock.assert_called_once_with( |
| 322 | mock.sentinel.credentials, scopes) |