|
| 1 | +// Copyright 2022 Google LLC |
| 2 | +// |
| 3 | +// Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | +// you may not use this file except in compliance with the License. |
| 5 | +// You may obtain a copy of the License at |
| 6 | +// |
| 7 | +// https://www.apache.org/licenses/LICENSE-2.0 |
| 8 | +// |
| 9 | +// Unless required by applicable law or agreed to in writing, software |
| 10 | +// distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | +// See the License for the specific language governing permissions and |
| 13 | +// limitations under the License. |
| 14 | + |
| 15 | +#include "google/cloud/credentials.h" |
| 16 | +#include "google/cloud/internal/curl_options.h" |
| 17 | +#include "google/cloud/internal/getenv.h" |
| 18 | +#include "google/cloud/internal/oauth2_google_credentials.h" |
| 19 | +#include "google/cloud/internal/oauth2_minimal_iam_credentials_rest.h" |
| 20 | +#include "google/cloud/internal/rest_client.h" |
| 21 | +#include "google/cloud/internal/setenv.h" |
| 22 | +#include "google/cloud/log.h" |
| 23 | +#include "google/cloud/testing_util/scoped_environment.h" |
| 24 | +#include "google/cloud/testing_util/status_matchers.h" |
| 25 | +#include "absl/strings/str_split.h" |
| 26 | +#include <gmock/gmock.h> |
| 27 | +#include <nlohmann/json.hpp> |
| 28 | +#include <fstream> |
| 29 | + |
| 30 | +namespace google { |
| 31 | +namespace cloud { |
| 32 | +namespace rest_internal { |
| 33 | +GOOGLE_CLOUD_CPP_INLINE_NAMESPACE_BEGIN |
| 34 | +namespace { |
| 35 | + |
| 36 | +using ::google::cloud::testing_util::IsOk; |
| 37 | +using ::google::cloud::testing_util::ScopedEnvironment; |
| 38 | +using ::google::cloud::testing_util::StatusIs; |
| 39 | + |
| 40 | +StatusOr<std::unique_ptr<RestResponse>> RetryRestRequest( |
| 41 | + std::function<StatusOr<std::unique_ptr<RestResponse>>()> const& request, |
| 42 | + StatusCode expected_status = StatusCode::kOk) { |
| 43 | + auto delay = std::chrono::seconds(1); |
| 44 | + StatusOr<std::unique_ptr<RestResponse>> response; |
| 45 | + for (auto i = 0; i != 3; ++i) { |
| 46 | + response = request(); |
| 47 | + if (response.status().code() == expected_status) return response; |
| 48 | + std::this_thread::sleep_for(delay); |
| 49 | + delay *= 2; |
| 50 | + } |
| 51 | + return response; |
| 52 | +} |
| 53 | + |
| 54 | +void MakeRestRpcCall(StatusCode expected_status, Options options = {}) { |
| 55 | + std::string bigquery_endpoint = "https://bigquery.googleapis.com"; |
| 56 | + auto client = GetPooledRestClient(bigquery_endpoint, std::move(options)); |
| 57 | + RestRequest request; |
| 58 | + request.SetPath("bigquery/v2/projects/bigquery-public-data/datasets"); |
| 59 | + request.AddQueryParameter({"maxResults", "10"}); |
| 60 | + auto response = RetryRestRequest([&] { return client->Get(request); }); |
| 61 | + ASSERT_THAT(response, IsOk()); |
| 62 | + auto response_payload = std::move(**response).ExtractPayload(); |
| 63 | + auto response_json = ReadAll(std::move(response_payload)); |
| 64 | + ASSERT_THAT(response_json, StatusIs(expected_status)); |
| 65 | + if (response_json.ok()) { |
| 66 | + auto parsed_response = |
| 67 | + nlohmann::json::parse(*response_json, nullptr, false); |
| 68 | + ASSERT_TRUE(parsed_response.is_object()); |
| 69 | + auto kind = parsed_response.find("kind"); |
| 70 | + ASSERT_NE(kind, parsed_response.end()); |
| 71 | + EXPECT_EQ(std::string(kind.value()), "bigquery#datasetList"); |
| 72 | + } |
| 73 | +} |
| 74 | + |
| 75 | +TEST(UnifiedRestCredentialsIntegrationTest, InsecureCredentials) { |
| 76 | + std::string bigquery_endpoint = "https://bigquery.googleapis.com"; |
| 77 | + auto client = GetPooledRestClient( |
| 78 | + bigquery_endpoint, |
| 79 | + Options{}.set<UnifiedCredentialsOption>(MakeInsecureCredentials())); |
| 80 | + RestRequest request; |
| 81 | + request.SetPath("bigquery/v2/projects/bigquery-public-data/datasets"); |
| 82 | + request.AddQueryParameter({"maxResults", "10"}); |
| 83 | + auto response = RetryRestRequest([&] { return client->Get(request); }); |
| 84 | + EXPECT_THAT(response, StatusIs(StatusCode::kOk)); |
| 85 | + auto response_payload = std::move(**response).ExtractPayload(); |
| 86 | + auto response_json = ReadAll(std::move(response_payload)); |
| 87 | + ASSERT_THAT(response_json, StatusIs(StatusCode::kUnauthenticated)); |
| 88 | +} |
| 89 | + |
| 90 | +TEST(UnifiedRestCredentialsIntegrationTest, GoogleDefaultCredentials) { |
| 91 | + MakeRestRpcCall(StatusCode::kOk, Options{}.set<UnifiedCredentialsOption>( |
| 92 | + MakeGoogleDefaultCredentials())); |
| 93 | +} |
| 94 | + |
| 95 | +TEST(UnifiedRestCredentialsIntegrationTest, AccessTokenCredentials) { |
| 96 | + auto env = internal::GetEnv("GOOGLE_CLOUD_CPP_REST_TEST_KEY_FILE_JSON"); |
| 97 | + ASSERT_TRUE(env.has_value()); |
| 98 | + std::string key_file = std::move(*env); |
| 99 | + ScopedEnvironment google_app_creds_override_env_var( |
| 100 | + "GOOGLE_APPLICATION_CREDENTIALS", key_file); |
| 101 | + auto default_creds = oauth2_internal::GoogleDefaultCredentials(); |
| 102 | + ASSERT_THAT(default_creds, IsOk()); |
| 103 | + auto iam_creds = |
| 104 | + oauth2_internal::MakeMinimalIamCredentialsRestStub(*default_creds); |
| 105 | + oauth2_internal::GenerateAccessTokenRequest request; |
| 106 | + request.lifetime = std::chrono::hours(1); |
| 107 | + auto service_account = |
| 108 | + internal::GetEnv("GOOGLE_CLOUD_CPP_REST_TEST_SIGNING_SERVICE_ACCOUNT"); |
| 109 | + ASSERT_TRUE(service_account.has_value()); |
| 110 | + request.service_account = std::move(*service_account); |
| 111 | + request.scopes.emplace_back("https://www.googleapis.com/auth/cloud-platform"); |
| 112 | + auto token = iam_creds->GenerateAccessToken(request); |
| 113 | + auto expiration = std::chrono::system_clock::now() + std::chrono::hours(1); |
| 114 | + MakeRestRpcCall(StatusCode::kOk, |
| 115 | + Options{}.set<UnifiedCredentialsOption>( |
| 116 | + MakeAccessTokenCredentials(token->token, expiration))); |
| 117 | +} |
| 118 | + |
| 119 | +TEST(UnifiedRestCredentialsIntegrationTest, |
| 120 | + ImpersonateServiceAccountCredentials) { |
| 121 | + auto env = internal::GetEnv("GOOGLE_CLOUD_CPP_REST_TEST_KEY_FILE_JSON"); |
| 122 | + ASSERT_TRUE(env.has_value()); |
| 123 | + std::string key_file = std::move(*env); |
| 124 | + ScopedEnvironment google_app_creds_override_env_var( |
| 125 | + "GOOGLE_APPLICATION_CREDENTIALS", key_file); |
| 126 | + auto service_account = |
| 127 | + internal::GetEnv("GOOGLE_CLOUD_CPP_REST_TEST_SIGNING_SERVICE_ACCOUNT"); |
| 128 | + ASSERT_TRUE(service_account.has_value()); |
| 129 | + MakeRestRpcCall(StatusCode::kOk, |
| 130 | + Options{}.set<UnifiedCredentialsOption>( |
| 131 | + MakeImpersonateServiceAccountCredentials( |
| 132 | + MakeGoogleDefaultCredentials(), *service_account))); |
| 133 | +} |
| 134 | + |
| 135 | +TEST(UnifiedRestCredentialsIntegrationTest, ServiceAccountCredentials) { |
| 136 | + auto env = internal::GetEnv("GOOGLE_CLOUD_CPP_REST_TEST_KEY_FILE_JSON"); |
| 137 | + ASSERT_TRUE(env.has_value()); |
| 138 | + std::string key_file = std::move(*env); |
| 139 | + std::ifstream is(key_file); |
| 140 | + auto contents = std::string{std::istreambuf_iterator<char>{is}, {}}; |
| 141 | + MakeRestRpcCall(StatusCode::kOk, |
| 142 | + Options{}.set<UnifiedCredentialsOption>( |
| 143 | + MakeServiceAccountCredentials(contents))); |
| 144 | +} |
| 145 | + |
| 146 | +} // namespace |
| 147 | +GOOGLE_CLOUD_CPP_INLINE_NAMESPACE_END |
| 148 | +} // namespace rest_internal |
| 149 | +} // namespace cloud |
| 150 | +} // namespace google |
0 commit comments