blob: 001a19cd53ba9939fc23ab3b1432bcca5c403b51 [file] [log] [blame]
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -07001# Copyright 2016 Google Inc.
2#
3# Licensed under the Apache License, Version 2.0 (the "License");
4# you may not use this file except in compliance with the License.
5# You may obtain a copy of the License at
6#
7# http://www.apache.org/licenses/LICENSE-2.0
8#
9# Unless required by applicable law or agreed to in writing, software
10# distributed under the License is distributed on an "AS IS" BASIS,
11# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12# See the License for the specific language governing permissions and
13# limitations under the License.
14
15import json
16import os
17
18import mock
19import pytest
20
21from google.auth import _default
Jon Wayne Parrott2148fde2016-10-24 13:44:25 -070022from google.auth import app_engine
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -070023from google.auth import compute_engine
24from google.auth import environment_vars
25from google.auth import exceptions
26from google.oauth2 import service_account
27import google.oauth2.credentials
28
29
30DATA_DIR = os.path.join(os.path.dirname(__file__), 'data')
31AUTHORIZED_USER_FILE = os.path.join(DATA_DIR, 'authorized_user.json')
32
33with open(AUTHORIZED_USER_FILE) as fh:
34 AUTHORIZED_USER_FILE_DATA = json.load(fh)
35
36SERVICE_ACCOUNT_FILE = os.path.join(DATA_DIR, 'service_account.json')
37
38with open(SERVICE_ACCOUNT_FILE) as fh:
39 SERVICE_ACCOUNT_FILE_DATA = json.load(fh)
40
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -070041LOAD_FILE_PATCH = mock.patch(
42 'google.auth._default._load_credentials_from_file', return_value=(
Jon Wayne Parrott8784b232016-11-10 12:53:55 -080043 mock.sentinel.credentials, mock.sentinel.project_id), autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -070044
45
46def test__load_credentials_from_file_invalid_json(tmpdir):
47 jsonfile = tmpdir.join('invalid.json')
48 jsonfile.write('{')
49
50 with pytest.raises(exceptions.DefaultCredentialsError) as excinfo:
51 _default._load_credentials_from_file(str(jsonfile))
52
53 assert excinfo.match(r'not a valid json file')
54
55
56def test__load_credentials_from_file_invalid_type(tmpdir):
57 jsonfile = tmpdir.join('invalid.json')
58 jsonfile.write(json.dumps({'type': 'not-a-real-type'}))
59
60 with pytest.raises(exceptions.DefaultCredentialsError) as excinfo:
61 _default._load_credentials_from_file(str(jsonfile))
62
63 assert excinfo.match(r'does not have a valid type')
64
65
66def test__load_credentials_from_file_authorized_user():
67 credentials, project_id = _default._load_credentials_from_file(
68 AUTHORIZED_USER_FILE)
69 assert isinstance(credentials, google.oauth2.credentials.Credentials)
70 assert project_id is None
71
72
73def test__load_credentials_from_file_authorized_user_bad_format(tmpdir):
74 filename = tmpdir.join('authorized_user_bad.json')
75 filename.write(json.dumps({'type': 'authorized_user'}))
76
77 with pytest.raises(exceptions.DefaultCredentialsError) as excinfo:
78 _default._load_credentials_from_file(str(filename))
79
80 assert excinfo.match(r'Failed to load authorized user')
81 assert excinfo.match(r'missing fields')
82
83
84def test__load_credentials_from_file_service_account():
85 credentials, project_id = _default._load_credentials_from_file(
86 SERVICE_ACCOUNT_FILE)
87 assert isinstance(credentials, service_account.Credentials)
88 assert project_id == SERVICE_ACCOUNT_FILE_DATA['project_id']
89
90
91def test__load_credentials_from_file_service_account_bad_format(tmpdir):
92 filename = tmpdir.join('serivce_account_bad.json')
93 filename.write(json.dumps({'type': 'service_account'}))
94
95 with pytest.raises(exceptions.DefaultCredentialsError) as excinfo:
96 _default._load_credentials_from_file(str(filename))
97
98 assert excinfo.match(r'Failed to load service account')
99 assert excinfo.match(r'missing fields')
100
101
102@mock.patch.dict(os.environ, {}, clear=True)
103def test__get_explicit_environ_credentials_no_env():
104 assert _default._get_explicit_environ_credentials() == (None, None)
105
106
107@LOAD_FILE_PATCH
108def test__get_explicit_environ_credentials(mock_load, monkeypatch):
109 monkeypatch.setenv(environment_vars.CREDENTIALS, 'filename')
110
111 credentials, project_id = _default._get_explicit_environ_credentials()
112
113 assert credentials is mock.sentinel.credentials
114 assert project_id is mock.sentinel.project_id
115 mock_load.assert_called_with('filename')
116
117
118@LOAD_FILE_PATCH
119def test__get_explicit_environ_credentials_no_project_id(
120 mock_load, monkeypatch):
121 mock_load.return_value = (mock.sentinel.credentials, None)
122 monkeypatch.setenv(environment_vars.CREDENTIALS, 'filename')
123
124 credentials, project_id = _default._get_explicit_environ_credentials()
125
126 assert credentials is mock.sentinel.credentials
127 assert project_id is None
128
129
130@LOAD_FILE_PATCH
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800131@mock.patch(
132 'google.auth._cloud_sdk.get_application_default_credentials_path',
133 autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700134def test__get_gcloud_sdk_credentials(
135 mock_get_adc_path, mock_load):
136 mock_get_adc_path.return_value = SERVICE_ACCOUNT_FILE
137
138 credentials, project_id = _default._get_gcloud_sdk_credentials()
139
140 assert credentials is mock.sentinel.credentials
141 assert project_id is mock.sentinel.project_id
142 mock_load.assert_called_with(SERVICE_ACCOUNT_FILE)
143
144
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800145@mock.patch(
146 'google.auth._cloud_sdk.get_application_default_credentials_path',
147 autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700148def test__get_gcloud_sdk_credentials_non_existent(mock_get_adc_path, tmpdir):
149 non_existent = tmpdir.join('non-existent')
150 mock_get_adc_path.return_value = str(non_existent)
151
152 credentials, project_id = _default._get_gcloud_sdk_credentials()
153
154 assert credentials is None
155 assert project_id is None
156
157
158@mock.patch(
159 'google.auth._cloud_sdk.get_project_id',
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800160 return_value=mock.sentinel.project_id, autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700161@mock.patch('os.path.isfile', return_value=True)
162@LOAD_FILE_PATCH
163def test__get_gcloud_sdk_credentials_project_id(
164 mock_load, unused_mock_isfile, mock_get_project_id):
165 # Don't return a project ID from load file, make the function check
166 # the Cloud SDK project.
167 mock_load.return_value = (mock.sentinel.credentials, None)
168
169 credentials, project_id = _default._get_gcloud_sdk_credentials()
170
171 assert credentials == mock.sentinel.credentials
172 assert project_id == mock.sentinel.project_id
173 assert mock_get_project_id.called
174
175
176@mock.patch(
177 'google.auth._cloud_sdk.get_project_id',
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800178 return_value=None, autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700179@mock.patch('os.path.isfile', return_value=True)
180@LOAD_FILE_PATCH
181def test__get_gcloud_sdk_credentials_no_project_id(
182 mock_load, unused_mock_isfile, mock_get_project_id):
183 # Don't return a project ID from load file, make the function check
184 # the Cloud SDK project.
185 mock_load.return_value = (mock.sentinel.credentials, None)
186
187 credentials, project_id = _default._get_gcloud_sdk_credentials()
188
189 assert credentials == mock.sentinel.credentials
190 assert project_id is None
191
192
Jon Wayne Parrott2148fde2016-10-24 13:44:25 -0700193@pytest.fixture
194def app_identity_mock(monkeypatch):
195 """Mocks the app_identity module for google.auth.app_engine."""
196 app_identity_mock = mock.Mock()
197 monkeypatch.setattr(
198 app_engine, 'app_identity', app_identity_mock)
199 yield app_identity_mock
200
201
202def test__get_gae_credentials(app_identity_mock):
203 app_identity_mock.get_application_id.return_value = mock.sentinel.project
204
205 credentials, project_id = _default._get_gae_credentials()
206
207 assert isinstance(credentials, app_engine.Credentials)
208 assert project_id == mock.sentinel.project
209
210
211def test__get_gae_credentials_no_apis():
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700212 assert _default._get_gae_credentials() == (None, None)
213
214
215@mock.patch(
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800216 'google.auth.compute_engine._metadata.ping', return_value=True,
217 autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700218@mock.patch(
Jon Wayne Parrott5b03ba12016-10-24 13:51:26 -0700219 'google.auth.compute_engine._metadata.get_project_id',
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800220 return_value='example-project', autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700221def test__get_gce_credentials(get_mock, ping_mock):
222 credentials, project_id = _default._get_gce_credentials()
223
224 assert isinstance(credentials, compute_engine.Credentials)
225 assert project_id == 'example-project'
226
227
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800228@mock.patch(
229 'google.auth.compute_engine._metadata.ping', return_value=False,
230 autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700231def test__get_gce_credentials_no_ping(ping_mock):
232 credentials, project_id = _default._get_gce_credentials()
233
234 assert credentials is None
235 assert project_id is None
236
237
238@mock.patch(
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800239 'google.auth.compute_engine._metadata.ping', return_value=True,
240 autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700241@mock.patch(
Jon Wayne Parrott5b03ba12016-10-24 13:51:26 -0700242 'google.auth.compute_engine._metadata.get_project_id',
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800243 side_effect=exceptions.TransportError(), autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700244def test__get_gce_credentials_no_project_id(get_mock, ping_mock):
245 credentials, project_id = _default._get_gce_credentials()
246
247 assert isinstance(credentials, compute_engine.Credentials)
248 assert project_id is None
249
250
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800251@mock.patch(
252 'google.auth.compute_engine._metadata.ping', return_value=False,
253 autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700254def test__get_gce_credentials_explicit_request(ping_mock):
255 _default._get_gce_credentials(mock.sentinel.request)
256 ping_mock.assert_called_with(request=mock.sentinel.request)
257
258
259@mock.patch(
260 'google.auth._default._get_explicit_environ_credentials',
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800261 return_value=(mock.sentinel.credentials, mock.sentinel.project_id),
262 autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700263def test_default_early_out(get_mock):
264 assert _default.default() == (
265 mock.sentinel.credentials, mock.sentinel.project_id)
266
267
268@mock.patch(
269 'google.auth._default._get_explicit_environ_credentials',
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800270 return_value=(mock.sentinel.credentials, mock.sentinel.project_id),
271 autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700272def test_default_explict_project_id(get_mock, monkeypatch):
273 monkeypatch.setenv(environment_vars.PROJECT, 'explicit-env')
274 assert _default.default() == (
275 mock.sentinel.credentials, 'explicit-env')
276
277
278@mock.patch(
279 'google.auth._default._get_explicit_environ_credentials',
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800280 return_value=(mock.sentinel.credentials, mock.sentinel.project_id),
281 autospec=True)
Jon Wayne Parrottce37cba2016-11-07 16:41:42 -0800282def test_default_explict_legacy_project_id(get_mock, monkeypatch):
283 monkeypatch.setenv(environment_vars.LEGACY_PROJECT, 'explicit-env')
284 assert _default.default() == (
285 mock.sentinel.credentials, 'explicit-env')
286
287
288@mock.patch(
289 'google.auth._default._get_explicit_environ_credentials',
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800290 return_value=(None, None), autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700291@mock.patch(
292 'google.auth._default._get_gcloud_sdk_credentials',
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800293 return_value=(None, None), autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700294@mock.patch(
295 'google.auth._default._get_gae_credentials',
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800296 return_value=(None, None), autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700297@mock.patch(
298 'google.auth._default._get_gce_credentials',
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800299 return_value=(None, None), autospec=True)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700300def test_default_fail(unused_gce, unused_gae, unused_sdk, unused_explicit):
301 with pytest.raises(exceptions.DefaultCredentialsError):
302 assert _default.default()
Jon Wayne Parrott8a7e5062016-11-07 16:45:17 -0800303
304
305@mock.patch(
306 'google.auth._default._get_explicit_environ_credentials',
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800307 return_value=(mock.sentinel.credentials, mock.sentinel.project_id),
308 autospec=True)
Jon Wayne Parrott8a7e5062016-11-07 16:45:17 -0800309@mock.patch(
Jon Wayne Parrott8784b232016-11-10 12:53:55 -0800310 'google.auth.credentials.with_scopes_if_required', autospec=True)
Jon Wayne Parrott8a7e5062016-11-07 16:45:17 -0800311def test_default_scoped(with_scopes_mock, get_mock):
312 scopes = ['one', 'two']
313
314 credentials, project_id = _default.default(scopes=scopes)
315
316 assert credentials == with_scopes_mock.return_value
317 assert project_id == mock.sentinel.project_id
318 with_scopes_mock.assert_called_once_with(
319 mock.sentinel.credentials, scopes)