Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 1 | # Copyright 2016 Google Inc. |
| 2 | # |
| 3 | # Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | # you may not use this file except in compliance with the License. |
| 5 | # You may obtain a copy of the License at |
| 6 | # |
| 7 | # http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | # |
| 9 | # Unless required by applicable law or agreed to in writing, software |
| 10 | # distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | # See the License for the specific language governing permissions and |
| 13 | # limitations under the License. |
| 14 | |
| 15 | import json |
| 16 | import os |
| 17 | |
| 18 | import mock |
| 19 | import pytest |
| 20 | |
| 21 | from google.auth import _default |
Jon Wayne Parrott | 2148fde | 2016-10-24 13:44:25 -0700 | [diff] [blame] | 22 | from google.auth import app_engine |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 23 | from google.auth import compute_engine |
| 24 | from google.auth import environment_vars |
| 25 | from google.auth import exceptions |
| 26 | from google.oauth2 import service_account |
| 27 | import google.oauth2.credentials |
| 28 | |
| 29 | |
| 30 | DATA_DIR = os.path.join(os.path.dirname(__file__), 'data') |
| 31 | AUTHORIZED_USER_FILE = os.path.join(DATA_DIR, 'authorized_user.json') |
| 32 | |
| 33 | with open(AUTHORIZED_USER_FILE) as fh: |
| 34 | AUTHORIZED_USER_FILE_DATA = json.load(fh) |
| 35 | |
| 36 | SERVICE_ACCOUNT_FILE = os.path.join(DATA_DIR, 'service_account.json') |
| 37 | |
| 38 | with open(SERVICE_ACCOUNT_FILE) as fh: |
| 39 | SERVICE_ACCOUNT_FILE_DATA = json.load(fh) |
| 40 | |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 41 | LOAD_FILE_PATCH = mock.patch( |
| 42 | 'google.auth._default._load_credentials_from_file', return_value=( |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 43 | mock.sentinel.credentials, mock.sentinel.project_id), autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 44 | |
| 45 | |
| 46 | def test__load_credentials_from_file_invalid_json(tmpdir): |
| 47 | jsonfile = tmpdir.join('invalid.json') |
| 48 | jsonfile.write('{') |
| 49 | |
| 50 | with pytest.raises(exceptions.DefaultCredentialsError) as excinfo: |
| 51 | _default._load_credentials_from_file(str(jsonfile)) |
| 52 | |
| 53 | assert excinfo.match(r'not a valid json file') |
| 54 | |
| 55 | |
| 56 | def test__load_credentials_from_file_invalid_type(tmpdir): |
| 57 | jsonfile = tmpdir.join('invalid.json') |
| 58 | jsonfile.write(json.dumps({'type': 'not-a-real-type'})) |
| 59 | |
| 60 | with pytest.raises(exceptions.DefaultCredentialsError) as excinfo: |
| 61 | _default._load_credentials_from_file(str(jsonfile)) |
| 62 | |
| 63 | assert excinfo.match(r'does not have a valid type') |
| 64 | |
| 65 | |
| 66 | def test__load_credentials_from_file_authorized_user(): |
| 67 | credentials, project_id = _default._load_credentials_from_file( |
| 68 | AUTHORIZED_USER_FILE) |
| 69 | assert isinstance(credentials, google.oauth2.credentials.Credentials) |
| 70 | assert project_id is None |
| 71 | |
| 72 | |
| 73 | def test__load_credentials_from_file_authorized_user_bad_format(tmpdir): |
| 74 | filename = tmpdir.join('authorized_user_bad.json') |
| 75 | filename.write(json.dumps({'type': 'authorized_user'})) |
| 76 | |
| 77 | with pytest.raises(exceptions.DefaultCredentialsError) as excinfo: |
| 78 | _default._load_credentials_from_file(str(filename)) |
| 79 | |
| 80 | assert excinfo.match(r'Failed to load authorized user') |
| 81 | assert excinfo.match(r'missing fields') |
| 82 | |
| 83 | |
| 84 | def test__load_credentials_from_file_service_account(): |
| 85 | credentials, project_id = _default._load_credentials_from_file( |
| 86 | SERVICE_ACCOUNT_FILE) |
| 87 | assert isinstance(credentials, service_account.Credentials) |
| 88 | assert project_id == SERVICE_ACCOUNT_FILE_DATA['project_id'] |
| 89 | |
| 90 | |
| 91 | def test__load_credentials_from_file_service_account_bad_format(tmpdir): |
| 92 | filename = tmpdir.join('serivce_account_bad.json') |
| 93 | filename.write(json.dumps({'type': 'service_account'})) |
| 94 | |
| 95 | with pytest.raises(exceptions.DefaultCredentialsError) as excinfo: |
| 96 | _default._load_credentials_from_file(str(filename)) |
| 97 | |
| 98 | assert excinfo.match(r'Failed to load service account') |
| 99 | assert excinfo.match(r'missing fields') |
| 100 | |
| 101 | |
| 102 | @mock.patch.dict(os.environ, {}, clear=True) |
| 103 | def test__get_explicit_environ_credentials_no_env(): |
| 104 | assert _default._get_explicit_environ_credentials() == (None, None) |
| 105 | |
| 106 | |
| 107 | @LOAD_FILE_PATCH |
| 108 | def test__get_explicit_environ_credentials(mock_load, monkeypatch): |
| 109 | monkeypatch.setenv(environment_vars.CREDENTIALS, 'filename') |
| 110 | |
| 111 | credentials, project_id = _default._get_explicit_environ_credentials() |
| 112 | |
| 113 | assert credentials is mock.sentinel.credentials |
| 114 | assert project_id is mock.sentinel.project_id |
| 115 | mock_load.assert_called_with('filename') |
| 116 | |
| 117 | |
| 118 | @LOAD_FILE_PATCH |
| 119 | def test__get_explicit_environ_credentials_no_project_id( |
| 120 | mock_load, monkeypatch): |
| 121 | mock_load.return_value = (mock.sentinel.credentials, None) |
| 122 | monkeypatch.setenv(environment_vars.CREDENTIALS, 'filename') |
| 123 | |
| 124 | credentials, project_id = _default._get_explicit_environ_credentials() |
| 125 | |
| 126 | assert credentials is mock.sentinel.credentials |
| 127 | assert project_id is None |
| 128 | |
| 129 | |
| 130 | @LOAD_FILE_PATCH |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 131 | @mock.patch( |
| 132 | 'google.auth._cloud_sdk.get_application_default_credentials_path', |
| 133 | autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 134 | def test__get_gcloud_sdk_credentials( |
| 135 | mock_get_adc_path, mock_load): |
| 136 | mock_get_adc_path.return_value = SERVICE_ACCOUNT_FILE |
| 137 | |
| 138 | credentials, project_id = _default._get_gcloud_sdk_credentials() |
| 139 | |
| 140 | assert credentials is mock.sentinel.credentials |
| 141 | assert project_id is mock.sentinel.project_id |
| 142 | mock_load.assert_called_with(SERVICE_ACCOUNT_FILE) |
| 143 | |
| 144 | |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 145 | @mock.patch( |
| 146 | 'google.auth._cloud_sdk.get_application_default_credentials_path', |
| 147 | autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 148 | def test__get_gcloud_sdk_credentials_non_existent(mock_get_adc_path, tmpdir): |
| 149 | non_existent = tmpdir.join('non-existent') |
| 150 | mock_get_adc_path.return_value = str(non_existent) |
| 151 | |
| 152 | credentials, project_id = _default._get_gcloud_sdk_credentials() |
| 153 | |
| 154 | assert credentials is None |
| 155 | assert project_id is None |
| 156 | |
| 157 | |
| 158 | @mock.patch( |
| 159 | 'google.auth._cloud_sdk.get_project_id', |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 160 | return_value=mock.sentinel.project_id, autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 161 | @mock.patch('os.path.isfile', return_value=True) |
| 162 | @LOAD_FILE_PATCH |
| 163 | def test__get_gcloud_sdk_credentials_project_id( |
| 164 | mock_load, unused_mock_isfile, mock_get_project_id): |
| 165 | # Don't return a project ID from load file, make the function check |
| 166 | # the Cloud SDK project. |
| 167 | mock_load.return_value = (mock.sentinel.credentials, None) |
| 168 | |
| 169 | credentials, project_id = _default._get_gcloud_sdk_credentials() |
| 170 | |
| 171 | assert credentials == mock.sentinel.credentials |
| 172 | assert project_id == mock.sentinel.project_id |
| 173 | assert mock_get_project_id.called |
| 174 | |
| 175 | |
| 176 | @mock.patch( |
| 177 | 'google.auth._cloud_sdk.get_project_id', |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 178 | return_value=None, autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 179 | @mock.patch('os.path.isfile', return_value=True) |
| 180 | @LOAD_FILE_PATCH |
| 181 | def test__get_gcloud_sdk_credentials_no_project_id( |
| 182 | mock_load, unused_mock_isfile, mock_get_project_id): |
| 183 | # Don't return a project ID from load file, make the function check |
| 184 | # the Cloud SDK project. |
| 185 | mock_load.return_value = (mock.sentinel.credentials, None) |
| 186 | |
| 187 | credentials, project_id = _default._get_gcloud_sdk_credentials() |
| 188 | |
| 189 | assert credentials == mock.sentinel.credentials |
| 190 | assert project_id is None |
| 191 | |
| 192 | |
Jon Wayne Parrott | 2148fde | 2016-10-24 13:44:25 -0700 | [diff] [blame] | 193 | @pytest.fixture |
| 194 | def app_identity_mock(monkeypatch): |
| 195 | """Mocks the app_identity module for google.auth.app_engine.""" |
| 196 | app_identity_mock = mock.Mock() |
| 197 | monkeypatch.setattr( |
| 198 | app_engine, 'app_identity', app_identity_mock) |
| 199 | yield app_identity_mock |
| 200 | |
| 201 | |
| 202 | def test__get_gae_credentials(app_identity_mock): |
| 203 | app_identity_mock.get_application_id.return_value = mock.sentinel.project |
| 204 | |
| 205 | credentials, project_id = _default._get_gae_credentials() |
| 206 | |
| 207 | assert isinstance(credentials, app_engine.Credentials) |
| 208 | assert project_id == mock.sentinel.project |
| 209 | |
| 210 | |
| 211 | def test__get_gae_credentials_no_apis(): |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 212 | assert _default._get_gae_credentials() == (None, None) |
| 213 | |
| 214 | |
| 215 | @mock.patch( |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 216 | 'google.auth.compute_engine._metadata.ping', return_value=True, |
| 217 | autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 218 | @mock.patch( |
Jon Wayne Parrott | 5b03ba1 | 2016-10-24 13:51:26 -0700 | [diff] [blame] | 219 | 'google.auth.compute_engine._metadata.get_project_id', |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 220 | return_value='example-project', autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 221 | def test__get_gce_credentials(get_mock, ping_mock): |
| 222 | credentials, project_id = _default._get_gce_credentials() |
| 223 | |
| 224 | assert isinstance(credentials, compute_engine.Credentials) |
| 225 | assert project_id == 'example-project' |
| 226 | |
| 227 | |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 228 | @mock.patch( |
| 229 | 'google.auth.compute_engine._metadata.ping', return_value=False, |
| 230 | autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 231 | def test__get_gce_credentials_no_ping(ping_mock): |
| 232 | credentials, project_id = _default._get_gce_credentials() |
| 233 | |
| 234 | assert credentials is None |
| 235 | assert project_id is None |
| 236 | |
| 237 | |
| 238 | @mock.patch( |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 239 | 'google.auth.compute_engine._metadata.ping', return_value=True, |
| 240 | autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 241 | @mock.patch( |
Jon Wayne Parrott | 5b03ba1 | 2016-10-24 13:51:26 -0700 | [diff] [blame] | 242 | 'google.auth.compute_engine._metadata.get_project_id', |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 243 | side_effect=exceptions.TransportError(), autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 244 | def test__get_gce_credentials_no_project_id(get_mock, ping_mock): |
| 245 | credentials, project_id = _default._get_gce_credentials() |
| 246 | |
| 247 | assert isinstance(credentials, compute_engine.Credentials) |
| 248 | assert project_id is None |
| 249 | |
| 250 | |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 251 | @mock.patch( |
| 252 | 'google.auth.compute_engine._metadata.ping', return_value=False, |
| 253 | autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 254 | def test__get_gce_credentials_explicit_request(ping_mock): |
| 255 | _default._get_gce_credentials(mock.sentinel.request) |
| 256 | ping_mock.assert_called_with(request=mock.sentinel.request) |
| 257 | |
| 258 | |
| 259 | @mock.patch( |
| 260 | 'google.auth._default._get_explicit_environ_credentials', |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 261 | return_value=(mock.sentinel.credentials, mock.sentinel.project_id), |
| 262 | autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 263 | def test_default_early_out(get_mock): |
| 264 | assert _default.default() == ( |
| 265 | mock.sentinel.credentials, mock.sentinel.project_id) |
| 266 | |
| 267 | |
| 268 | @mock.patch( |
| 269 | 'google.auth._default._get_explicit_environ_credentials', |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 270 | return_value=(mock.sentinel.credentials, mock.sentinel.project_id), |
| 271 | autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 272 | def test_default_explict_project_id(get_mock, monkeypatch): |
| 273 | monkeypatch.setenv(environment_vars.PROJECT, 'explicit-env') |
| 274 | assert _default.default() == ( |
| 275 | mock.sentinel.credentials, 'explicit-env') |
| 276 | |
| 277 | |
| 278 | @mock.patch( |
| 279 | 'google.auth._default._get_explicit_environ_credentials', |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 280 | return_value=(mock.sentinel.credentials, mock.sentinel.project_id), |
| 281 | autospec=True) |
Jon Wayne Parrott | ce37cba | 2016-11-07 16:41:42 -0800 | [diff] [blame] | 282 | def test_default_explict_legacy_project_id(get_mock, monkeypatch): |
| 283 | monkeypatch.setenv(environment_vars.LEGACY_PROJECT, 'explicit-env') |
| 284 | assert _default.default() == ( |
| 285 | mock.sentinel.credentials, 'explicit-env') |
| 286 | |
| 287 | |
| 288 | @mock.patch( |
| 289 | 'google.auth._default._get_explicit_environ_credentials', |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 290 | return_value=(None, None), autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 291 | @mock.patch( |
| 292 | 'google.auth._default._get_gcloud_sdk_credentials', |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 293 | return_value=(None, None), autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 294 | @mock.patch( |
| 295 | 'google.auth._default._get_gae_credentials', |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 296 | return_value=(None, None), autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 297 | @mock.patch( |
| 298 | 'google.auth._default._get_gce_credentials', |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 299 | return_value=(None, None), autospec=True) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 300 | def test_default_fail(unused_gce, unused_gae, unused_sdk, unused_explicit): |
| 301 | with pytest.raises(exceptions.DefaultCredentialsError): |
| 302 | assert _default.default() |
Jon Wayne Parrott | 8a7e506 | 2016-11-07 16:45:17 -0800 | [diff] [blame] | 303 | |
| 304 | |
| 305 | @mock.patch( |
| 306 | 'google.auth._default._get_explicit_environ_credentials', |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 307 | return_value=(mock.sentinel.credentials, mock.sentinel.project_id), |
| 308 | autospec=True) |
Jon Wayne Parrott | 8a7e506 | 2016-11-07 16:45:17 -0800 | [diff] [blame] | 309 | @mock.patch( |
Jon Wayne Parrott | 8784b23 | 2016-11-10 12:53:55 -0800 | [diff] [blame] | 310 | 'google.auth.credentials.with_scopes_if_required', autospec=True) |
Jon Wayne Parrott | 8a7e506 | 2016-11-07 16:45:17 -0800 | [diff] [blame] | 311 | def test_default_scoped(with_scopes_mock, get_mock): |
| 312 | scopes = ['one', 'two'] |
| 313 | |
| 314 | credentials, project_id = _default.default(scopes=scopes) |
| 315 | |
| 316 | assert credentials == with_scopes_mock.return_value |
| 317 | assert project_id == mock.sentinel.project_id |
| 318 | with_scopes_mock.assert_called_once_with( |
| 319 | mock.sentinel.credentials, scopes) |