wp-stateless / lib / Google / vendor / google / auth / tests / Credentials / ServiceAccountCredentialsTest.php

ServiceAccountCredentialsTest.php in WP-Stateless – Google Cloud Storage 2.1.4, at lib/Google/vendor/google/auth/tests/Credentials/ServiceAccountCredentialsTest.php

512 lines 13.9 KB

Raw Download Zip

1	<?php
2	/*
3	* Copyright 2015 Google Inc.
4	*
5	* Licensed under the Apache License, Version 2.0 (the "License");
6	* you may not use this file except in compliance with the License.
7	* You may obtain a copy of the License at
8	*
9	* http://www.apache.org/licenses/LICENSE-2.0
10	*
11	* Unless required by applicable law or agreed to in writing, software
12	* distributed under the License is distributed on an "AS IS" BASIS,
13	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14	* See the License for the specific language governing permissions and
15	* limitations under the License.
16	*/
17
18	namespace Google\Auth\Tests;
19
20	use Google\Auth\ApplicationDefaultCredentials;
21	use Google\Auth\CredentialsLoader;
22	use Google\Auth\Credentials\ServiceAccountCredentials;
23	use Google\Auth\Credentials\ServiceAccountJwtAccessCredentials;
24	use Google\Auth\HttpHandler\Guzzle6HttpHandler;
25	use Google\Auth\OAuth2;
26	use GuzzleHttp\Client;
27	use GuzzleHttp\Psr7;
28	use GuzzleHttp\Psr7\Response;
29
30	// Creates a standard JSON auth object for testing.
31	function createTestJson()
32	{
33	return [
34	'private_key_id' => 'key123',
35	'private_key' => 'privatekey',
36	'client_email' => 'test@example.com',
37	'client_id' => 'client123',
38	'type' => 'service_account'
39	];
40	}
41
42	class SACGetCacheKeyTest extends \PHPUnit_Framework_TestCase
43	{
44	public function testShouldBeTheSameAsOAuth2WithTheSameScope()
45	{
46	$testJson = createTestJson();
47	$scope = ['scope/1', 'scope/2'];
48	$sa = new ServiceAccountCredentials(
49	$scope,
50	$testJson);
51	$o = new OAuth2(['scope' => $scope]);
52	$this->assertSame(
53	$testJson['client_email'] . ':' . $o->getCacheKey(),
54	$sa->getCacheKey()
55	);
56	}
57
58	public function testShouldBeTheSameAsOAuth2WithTheSameScopeWithSub()
59	{
60	$testJson = createTestJson();
61	$scope = ['scope/1', 'scope/2'];
62	$sub = 'sub123';
63	$sa = new ServiceAccountCredentials(
64	$scope,
65	$testJson,
66	$sub);
67	$o = new OAuth2(['scope' => $scope]);
68	$this->assertSame(
69	$testJson['client_email'] . ':' . $o->getCacheKey() . ':' . $sub,
70	$sa->getCacheKey()
71	);
72	}
73
74	public function testShouldBeTheSameAsOAuth2WithTheSameScopeWithSubAddedLater()
75	{
76	$testJson = createTestJson();
77	$scope = ['scope/1', 'scope/2'];
78	$sub = 'sub123';
79	$sa = new ServiceAccountCredentials(
80	$scope,
81	$testJson,
82	null);
83	$sa->setSub($sub);
84
85	$o = new OAuth2(['scope' => $scope]);
86	$this->assertSame(
87	$testJson['client_email'] . ':' . $o->getCacheKey() . ':' . $sub,
88	$sa->getCacheKey()
89	);
90	}
91	}
92
93	class SACConstructorTest extends \PHPUnit_Framework_TestCase
94	{
95	/**
96	* @expectedException InvalidArgumentException
97	*/
98	public function testShouldFailIfScopeIsNotAValidType()
99	{
100	$testJson = createTestJson();
101	$notAnArrayOrString = new \stdClass();
102	$sa = new ServiceAccountCredentials(
103	$notAnArrayOrString,
104	$testJson
105	);
106	}
107
108	/**
109	* @expectedException InvalidArgumentException
110	*/
111	public function testShouldFailIfJsonDoesNotHaveClientEmail()
112	{
113	$testJson = createTestJson();
114	unset($testJson['client_email']);
115	$scope = ['scope/1', 'scope/2'];
116	$sa = new ServiceAccountCredentials(
117	$scope,
118	$testJson
119	);
120	}
121
122	/**
123	* @expectedException InvalidArgumentException
124	*/
125	public function testShouldFailIfJsonDoesNotHavePrivateKey()
126	{
127	$testJson = createTestJson();
128	unset($testJson['private_key']);
129	$scope = ['scope/1', 'scope/2'];
130	$sa = new ServiceAccountCredentials(
131	$scope,
132	$testJson
133	);
134	}
135
136	/**
137	* @expectedException InvalidArgumentException
138	*/
139	public function testFailsToInitalizeFromANonExistentFile()
140	{
141	$keyFile = __DIR__ . '/../fixtures' . '/does-not-exist-private.json';
142	new ServiceAccountCredentials('scope/1', $keyFile);
143	}
144
145	public function testInitalizeFromAFile()
146	{
147	$keyFile = __DIR__ . '/../fixtures' . '/private.json';
148	$this->assertNotNull(
149	new ServiceAccountCredentials('scope/1', $keyFile)
150	);
151	}
152	}
153
154	class SACFromEnvTest extends \PHPUnit_Framework_TestCase
155	{
156	protected function tearDown()
157	{
158	putenv(ServiceAccountCredentials::ENV_VAR); // removes it from
159	}
160
161	public function testIsNullIfEnvVarIsNotSet()
162	{
163	$this->assertNull(ServiceAccountCredentials::fromEnv('a scope'));
164	}
165
166	/**
167	* @expectedException DomainException
168	*/
169	public function testFailsIfEnvSpecifiesNonExistentFile()
170	{
171	$keyFile = __DIR__ . '/../fixtures' . '/does-not-exist-private.json';
172	putenv(ServiceAccountCredentials::ENV_VAR . '=' . $keyFile);
173	ApplicationDefaultCredentials::getCredentials('a scope');
174	}
175
176	public function testSucceedIfFileExists()
177	{
178	$keyFile = __DIR__ . '/../fixtures' . '/private.json';
179	putenv(ServiceAccountCredentials::ENV_VAR . '=' . $keyFile);
180	$this->assertNotNull(ApplicationDefaultCredentials::getCredentials('a scope'));
181	}
182	}
183
184	class SACFromWellKnownFileTest extends \PHPUnit_Framework_TestCase
185	{
186	private $originalHome;
187
188	protected function setUp()
189	{
190	$this->originalHome = getenv('HOME');
191	}
192
193	protected function tearDown()
194	{
195	if ($this->originalHome != getenv('HOME')) {
196	putenv('HOME=' . $this->originalHome);
197	}
198	}
199
200	public function testIsNullIfFileDoesNotExist()
201	{
202	putenv('HOME=' . __DIR__ . '/../not_exists_fixtures');
203	$this->assertNull(
204	ServiceAccountCredentials::fromWellKnownFile('a scope')
205	);
206	}
207
208	public function testSucceedIfFileIsPresent()
209	{
210	putenv('HOME=' . __DIR__ . '/../fixtures');
211	$this->assertNotNull(
212	ApplicationDefaultCredentials::getCredentials('a scope')
213	);
214	}
215	}
216
217	class SACFetchAuthTokenTest extends \PHPUnit_Framework_TestCase
218	{
219	private $privateKey;
220
221	public function setUp()
222	{
223	$this->privateKey =
224	file_get_contents(__DIR__ . '/../fixtures' . '/private.pem');
225	}
226
227	private function createTestJson()
228	{
229	$testJson = createTestJson();
230	$testJson['private_key'] = $this->privateKey;
231	return $testJson;
232	}
233
234	/**
235	* @expectedException GuzzleHttp\Exception\ClientException
236	*/
237	public function testFailsOnClientErrors()
238	{
239	$testJson = $this->createTestJson();
240	$scope = ['scope/1', 'scope/2'];
241	$httpHandler = getHandler([
242	buildResponse(400)
243	]);
244	$sa = new ServiceAccountCredentials(
245	$scope,
246	$testJson
247	);
248	$sa->fetchAuthToken($httpHandler);
249	}
250
251	/**
252	* @expectedException GuzzleHttp\Exception\ServerException
253	*/
254	public function testFailsOnServerErrors()
255	{
256	$testJson = $this->createTestJson();
257	$scope = ['scope/1', 'scope/2'];
258	$httpHandler = getHandler([
259	buildResponse(500)
260	]);
261	$sa = new ServiceAccountCredentials(
262	$scope,
263	$testJson
264	);
265	$sa->fetchAuthToken($httpHandler);
266	}
267
268	public function testCanFetchCredsOK()
269	{
270	$testJson = $this->createTestJson();
271	$testJsonText = json_encode($testJson);
272	$scope = ['scope/1', 'scope/2'];
273	$httpHandler = getHandler([
274	buildResponse(200, [], Psr7\stream_for($testJsonText))
275	]);
276	$sa = new ServiceAccountCredentials(
277	$scope,
278	$testJson
279	);
280	$tokens = $sa->fetchAuthToken($httpHandler);
281	$this->assertEquals($testJson, $tokens);
282	}
283
284	public function testUpdateMetadataFunc()
285	{
286	$testJson = $this->createTestJson();
287	$scope = ['scope/1', 'scope/2'];
288	$access_token = 'accessToken123';
289	$responseText = json_encode(array('access_token' => $access_token));
290	$httpHandler = getHandler([
291	buildResponse(200, [], Psr7\stream_for($responseText))
292	]);
293	$sa = new ServiceAccountCredentials(
294	$scope,
295	$testJson
296	);
297	$update_metadata = $sa->getUpdateMetadataFunc();
298	$this->assertTrue(is_callable($update_metadata));
299
300	$actual_metadata = call_user_func($update_metadata,
301	$metadata = array('foo' => 'bar'),
302	$authUri = null,
303	$httpHandler);
304	$this->assertTrue(
305	isset($actual_metadata[CredentialsLoader::AUTH_METADATA_KEY]));
306	$this->assertEquals(
307	$actual_metadata[CredentialsLoader::AUTH_METADATA_KEY],
308	array('Bearer ' . $access_token));
309	}
310	}
311
312	class SACJwtAccessTest extends \PHPUnit_Framework_TestCase
313	{
314	private $privateKey;
315
316	public function setUp()
317	{
318	$this->privateKey =
319	file_get_contents(__DIR__ . '/../fixtures' . '/private.pem');
320	}
321
322	private function createTestJson()
323	{
324	$testJson = createTestJson();
325	$testJson['private_key'] = $this->privateKey;
326	return $testJson;
327	}
328
329	/**
330	* @expectedException InvalidArgumentException
331	*/
332	public function testFailsOnMissingClientEmail()
333	{
334	$testJson = $this->createTestJson();
335	unset($testJson['client_email']);
336	$sa = new ServiceAccountJwtAccessCredentials(
337	$testJson
338	);
339	}
340
341	/**
342	* @expectedException InvalidArgumentException
343	*/
344	public function testFailsOnMissingPrivateKey()
345	{
346	$testJson = $this->createTestJson();
347	unset($testJson['private_key']);
348	$sa = new ServiceAccountJwtAccessCredentials(
349	$testJson
350	);
351	}
352
353	public function testCanInitializeFromJson()
354	{
355	$testJson = $this->createTestJson();
356	$sa = new ServiceAccountJwtAccessCredentials(
357	$testJson
358	);
359	$this->assertNotNull($sa);
360	}
361
362
363	public function testNoOpOnFetchAuthToken()
364	{
365	$testJson = $this->createTestJson();
366	$sa = new ServiceAccountJwtAccessCredentials(
367	$testJson
368	);
369	$this->assertNotNull($sa);
370
371	$httpHandler = getHandler([
372	buildResponse(200)
373	]);
374	$result = $sa->fetchAuthToken($httpHandler); // authUri has not been set
375	$this->assertNull($result);
376	}
377
378
379	public function testAuthUriIsNotSet()
380	{
381	$testJson = $this->createTestJson();
382	$sa = new ServiceAccountJwtAccessCredentials(
383	$testJson
384	);
385	$this->assertNotNull($sa);
386
387	$update_metadata = $sa->getUpdateMetadataFunc();
388	$this->assertTrue(is_callable($update_metadata));
389
390	$actual_metadata = call_user_func($update_metadata,
391	$metadata = array('foo' => 'bar'),
392	$authUri = null);
393	$this->assertTrue(
394	!isset($actual_metadata[CredentialsLoader::AUTH_METADATA_KEY]));
395	}
396
397	public function testUpdateMetadataFunc()
398	{
399	$testJson = $this->createTestJson();
400	$sa = new ServiceAccountJwtAccessCredentials(
401	$testJson
402	);
403	$this->assertNotNull($sa);
404
405	$update_metadata = $sa->getUpdateMetadataFunc();
406	$this->assertTrue(is_callable($update_metadata));
407
408	$actual_metadata = call_user_func($update_metadata,
409	$metadata = array('foo' => 'bar'),
410	$authUri = 'https://example.com/service');
411	$this->assertTrue(
412	isset($actual_metadata[CredentialsLoader::AUTH_METADATA_KEY]));
413
414	$authorization = $actual_metadata[CredentialsLoader::AUTH_METADATA_KEY];
415	$this->assertTrue(is_array($authorization));
416
417	$bearer_token = current($authorization);
418	$this->assertTrue(is_string($bearer_token));
419	$this->assertTrue(strpos($bearer_token, 'Bearer ') == 0);
420	$this->assertTrue(strlen($bearer_token) > 30);
421
422	$actual_metadata2 = call_user_func($update_metadata,
423	$metadata = array('foo' => 'bar'),
424	$authUri = 'https://example.com/anotherService');
425	$this->assertTrue(
426	isset($actual_metadata2[CredentialsLoader::AUTH_METADATA_KEY]));
427
428	$authorization2 = $actual_metadata2[CredentialsLoader::AUTH_METADATA_KEY];
429	$this->assertTrue(is_array($authorization2));
430
431	$bearer_token2 = current($authorization2);
432	$this->assertTrue(is_string($bearer_token2));
433	$this->assertTrue(strpos($bearer_token2, 'Bearer ') == 0);
434	$this->assertTrue(strlen($bearer_token2) > 30);
435	$this->assertTrue($bearer_token != $bearer_token2);
436	}
437
438	}
439
440	class SACJwtAccessComboTest extends \PHPUnit_Framework_TestCase
441	{
442	private $privateKey;
443
444	public function setUp()
445	{
446	$this->privateKey =
447	file_get_contents(__DIR__ . '/../fixtures' . '/private.pem');
448	}
449
450	private function createTestJson()
451	{
452	$testJson = createTestJson();
453	$testJson['private_key'] = $this->privateKey;
454	return $testJson;
455	}
456
457	public function testNoScopeUseJwtAccess()
458	{
459	$testJson = $this->createTestJson();
460	// no scope, jwt access should be used, no outbound
461	// call should be made
462	$scope = null;
463	$sa = new ServiceAccountCredentials(
464	$scope,
465	$testJson
466	);
467	$this->assertNotNull($sa);
468
469	$update_metadata = $sa->getUpdateMetadataFunc();
470	$this->assertTrue(is_callable($update_metadata));
471
472	$actual_metadata = call_user_func($update_metadata,
473	$metadata = array('foo' => 'bar'),
474	$authUri = 'https://example.com/service');
475	$this->assertTrue(
476	isset($actual_metadata[CredentialsLoader::AUTH_METADATA_KEY]));
477
478	$authorization = $actual_metadata[CredentialsLoader::AUTH_METADATA_KEY];
479	$this->assertTrue(is_array($authorization));
480
481	$bearer_token = current($authorization);
482	$this->assertTrue(is_string($bearer_token));
483	$this->assertTrue(strpos($bearer_token, 'Bearer ') == 0);
484	$this->assertTrue(strlen($bearer_token) > 30);
485	}
486
487	public function testNoScopeAndNoAuthUri()
488	{
489	$testJson = $this->createTestJson();
490	// no scope, jwt access should be used, no outbound
491	// call should be made
492	$scope = null;
493	$sa = new ServiceAccountCredentials(
494	$scope,
495	$testJson
496	);
497	$this->assertNotNull($sa);
498
499	$update_metadata = $sa->getUpdateMetadataFunc();
500	$this->assertTrue(is_callable($update_metadata));
501
502	$actual_metadata = call_user_func($update_metadata,
503	$metadata = array('foo' => 'bar'),
504	$authUri = null);
505	// no access_token is added to the metadata hash
506	// but also, no error should be thrown
507	$this->assertTrue(is_array($actual_metadata));
508	$this->assertTrue(
509	!isset($actual_metadata[CredentialsLoader::AUTH_METADATA_KEY]));
510	}
511	}
512