# Copyright 2020 Google LLC

#

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

#

# http://www.apache.org/licenses/LICENSE-2.0

#

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

import datetime

import http.client as http_client

import json

import os

import urllib.parse

import mock

import pytest # type: ignore

from google.auth import _helpers, external_account

from google.auth import aws

from google.auth import environment_vars

from google.auth import exceptions

from google.auth import transport

from google.auth.credentials import DEFAULT_UNIVERSE_DOMAIN

IMPERSONATE_ACCESS_TOKEN_REQUEST_METRICS_HEADER_VALUE = (

"gl-python/3.7 auth/1.1 auth-request-type/at cred-type/imp"

)

LANG_LIBRARY_METRICS_HEADER_VALUE = "gl-python/3.7 auth/1.1"

CLIENT_ID = "username"

CLIENT_SECRET = "password"

# Base64 encoding of "username:password".

BASIC_AUTH_ENCODING = "dXNlcm5hbWU6cGFzc3dvcmQ="

SERVICE_ACCOUNT_EMAIL = "service-1234@service-name.iam.gserviceaccount.com"

SERVICE_ACCOUNT_IMPERSONATION_URL_BASE = (

"https://us-east1-iamcredentials.googleapis.com"

)

SERVICE_ACCOUNT_IMPERSONATION_URL_ROUTE = "/v1/projects/-/serviceAccounts/{}:generateAccessToken".format(

SERVICE_ACCOUNT_EMAIL

)

SERVICE_ACCOUNT_IMPERSONATION_URL = (

SERVICE_ACCOUNT_IMPERSONATION_URL_BASE + SERVICE_ACCOUNT_IMPERSONATION_URL_ROUTE

)

QUOTA_PROJECT_ID = "QUOTA_PROJECT_ID"

SCOPES = ["scope1", "scope2"]

TOKEN_URL = "https://sts.googleapis.com/v1/token"

TOKEN_INFO_URL = "https://sts.googleapis.com/v1/introspect"

SUBJECT_TOKEN_TYPE = "urn:ietf:params:aws:token-type:aws4_request"

AUDIENCE = "//iam.googleapis.com/projects/123456/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID"

REGION_URL = "http://169.254.169.254/latest/meta-data/placement/availability-zone"

IMDSV2_SESSION_TOKEN_URL = "http://169.254.169.254/latest/api/token"

SECURITY_CREDS_URL = "http://169.254.169.254/latest/meta-data/iam/security-credentials"

REGION_URL_IPV6 = "http://[fd00:ec2::254]/latest/meta-data/placement/availability-zone"

IMDSV2_SESSION_TOKEN_URL_IPV6 = "http://[fd00:ec2::254]/latest/api/token"

SECURITY_CREDS_URL_IPV6 = (

"http://[fd00:ec2::254]/latest/meta-data/iam/security-credentials"

)

CRED_VERIFICATION_URL = (

"https://sts.{region}.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15"

)

# Sample fictitious AWS security credentials to be used with tests that require a session token.

ACCESS_KEY_ID = "AKIAIOSFODNN7EXAMPLE"

SECRET_ACCESS_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"

TOKEN = "AQoEXAMPLEH4aoAH0gNCAPyJxz4BlCFFxWNE1OPTgk5TthT+FvwqnKwRcOIfrRh3c/LTo6UDdyJwOOvEVPvLXCrrrUtdnniCEXAMPLE/IvU1dYUg2RVAJBanLiHb4IgRmpRV3zrkuWJOgQs8IZZaIv2BXIa2R4OlgkBN9bkUDNCJiBeb/AXlzBBko7b15fjrBs2+cTQtpZ3CYWFXG8C5zqx37wnOE49mRl/+OtkIKGO7fAE"

# To avoid json.dumps() differing behavior from one version to other,

# the JSON payload is hardcoded.

REQUEST_PARAMS = '{"KeySchema":[{"KeyType":"HASH","AttributeName":"Id"}],"TableName":"TestTable","AttributeDefinitions":[{"AttributeName":"Id","AttributeType":"S"}],"ProvisionedThroughput":{"WriteCapacityUnits":5,"ReadCapacityUnits":5}}'

# Each tuple contains the following entries:

# region, time, credentials, original_request, signed_request

VALID_TOKEN_URLS = [

]

INVALID_TOKEN_URLS = [

]

VALID_SERVICE_ACCOUNT_IMPERSONATION_URLS = [

]

INVALID_SERVICE_ACCOUNT_IMPERSONATION_URLS = [

]

TEST_FIXTURES = [

]

class TestRequestSigner(object):

assert excinfo.match(r"Invalid AWS service URL")

class TestAwsSecurityCredentialsSupplier(aws.AwsSecurityCredentialsSupplier):

return self._region

class TestCredentials(object):