-
Notifications
You must be signed in to change notification settings - Fork 1.2k
/
user_test.go
130 lines (125 loc) · 3.21 KB
/
user_test.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
// Copyright 2021 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
package impersonate
import (
"bytes"
"context"
"encoding/json"
"io"
"net/http"
"strings"
"testing"
"time"
"google.golang.org/api/option"
)
func TestTokenSource_user(t *testing.T) {
ctx := context.Background()
tests := []struct {
name string
targetPrincipal string
scopes []string
lifetime time.Duration
subject string
wantErr bool
universeDomain string
}{
{
name: "missing targetPrincipal",
wantErr: true,
},
{
name: "missing scopes",
targetPrincipal: "[email protected]",
wantErr: true,
},
{
name: "lifetime over max",
targetPrincipal: "[email protected]",
scopes: []string{"scope"},
lifetime: 13 * time.Hour,
wantErr: true,
},
{
name: "works",
targetPrincipal: "[email protected]",
scopes: []string{"scope"},
subject: "[email protected]",
wantErr: false,
},
{
name: "universeDomain",
targetPrincipal: "[email protected]",
scopes: []string{"scope"},
subject: "[email protected]",
wantErr: true,
// Non-GDU Universe Domain should result in error if
// CredentialsConfig.Subject is present for domain-wide delegation.
universeDomain: "example.com",
},
}
for _, tt := range tests {
userTok := "user-token"
name := tt.name
t.Run(name, func(t *testing.T) {
client := &http.Client{
Transport: RoundTripFn(func(req *http.Request) *http.Response {
if strings.Contains(req.URL.Path, "signJwt") {
resp := signJWTResponse{
KeyID: "123",
SignedJWT: "jwt",
}
b, err := json.Marshal(&resp)
if err != nil {
t.Fatalf("unable to marshal response: %v", err)
}
return &http.Response{
StatusCode: 200,
Body: io.NopCloser(bytes.NewReader(b)),
Header: make(http.Header),
}
}
if strings.Contains(req.URL.Path, "/token") {
resp := exchangeTokenResponse{
AccessToken: userTok,
TokenType: "Bearer",
ExpiresIn: int64(time.Hour.Seconds()),
}
b, err := json.Marshal(&resp)
if err != nil {
t.Fatalf("unable to marshal response: %v", err)
}
return &http.Response{
StatusCode: 200,
Body: io.NopCloser(bytes.NewReader(b)),
Header: make(http.Header),
}
}
return nil
}),
}
ts, err := CredentialsTokenSource(ctx,
CredentialsConfig{
TargetPrincipal: tt.targetPrincipal,
Scopes: tt.scopes,
Lifetime: tt.lifetime,
Subject: tt.subject,
},
option.WithHTTPClient(client),
option.WithUniverseDomain(tt.universeDomain))
if tt.wantErr && err != nil {
return
}
if err != nil {
t.Fatal(err)
}
tok, err := ts.Token()
if err != nil {
t.Fatal(err)
}
if tok.AccessToken != userTok {
t.Fatalf("got %q, want %q", tok.AccessToken, userTok)
}
})
}
}