spec/google/api_client/service_account_spec.rb

   1 # Copyright 2012 Google Inc.
   2 #
   3 # Licensed under the Apache License, Version 2.0 (the "License");
   4 # you may not use this file except in compliance with the License.
   5 # You may obtain a copy of the License at
   6 #
   7 #      http://www.apache.org/licenses/LICENSE-2.0
   8 #
   9 # Unless required by applicable law or agreed to in writing, software
  10 # distributed under the License is distributed on an "AS IS" BASIS,
  11 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12 # See the License for the specific language governing permissions and
  13 # limitations under the License.
  14
  15 require 'spec_helper'
  16
  17 require 'google/api_client'
  18
  19 fixtures_path = File.expand_path('../../../fixtures', __FILE__)
  20
  21 describe Google::APIClient::KeyUtils do
  22   it 'should read PKCS12 files from the filesystem' do
  23     pending "Reading from PKCS12 not supported on jruby" if RUBY_PLATFORM == 'java'
  24     path =  File.expand_path('files/privatekey.p12', fixtures_path)
  25     key = Google::APIClient::KeyUtils.load_from_pkcs12(path, 'notasecret')
  26     key.should_not == nil
  27   end
  28
  29   it 'should read PKCS12 files from loaded files' do
  30     pending "Reading from PKCS12 not supported on jruby" if RUBY_PLATFORM == 'java'
  31     path =  File.expand_path('files/privatekey.p12', fixtures_path)
  32     content = File.read(path)
  33     key = Google::APIClient::KeyUtils.load_from_pkcs12(content, 'notasecret')
  34     key.should_not == nil
  35   end
  36
  37   it 'should read PEM files from the filesystem' do
  38     path =  File.expand_path('files/secret.pem', fixtures_path)
  39     key = Google::APIClient::KeyUtils.load_from_pem(path, 'notasecret')
  40     key.should_not == nil
  41   end
  42
  43   it 'should read PEM files from loaded files' do
  44     path =  File.expand_path('files/secret.pem', fixtures_path)
  45     content = File.read(path)
  46     key = Google::APIClient::KeyUtils.load_from_pem(content, 'notasecret')
  47     key.should_not == nil
  48   end
  49
  50 end
  51
  52 describe Google::APIClient::JWTAsserter do
  53   include ConnectionHelpers
  54
  55   before do
  56     @key = OpenSSL::PKey::RSA.new 2048
  57   end
  58
  59   it 'should generate valid JWTs' do
  60     asserter = Google::APIClient::JWTAsserter.new('client1', 'scope1 scope2', @key)
  61     jwt = asserter.to_authorization.to_jwt
  62     jwt.should_not == nil
  63
  64     claim = JWT.decode(jwt, @key.public_key, true)
  65     claim["iss"].should == 'client1'
  66     claim["scope"].should == 'scope1 scope2'
  67   end
  68
  69   it 'should allow impersonation' do
  70     conn = stub_connection do |stub|
  71       stub.post('/o/oauth2/token') do |env|
  72         params = Addressable::URI.form_unencode(env[:body])
  73         JWT.decode(params.assoc("assertion").last, @key.public_key)
  74         params.assoc("grant_type").should == ['grant_type','urn:ietf:params:oauth:grant-type:jwt-bearer']
  75         [200, {}, '{
  76           "access_token" : "1/abcdef1234567890",
  77           "token_type" : "Bearer",
  78           "expires_in" : 3600
  79         }']
  80       end
  81     end
  82     asserter = Google::APIClient::JWTAsserter.new('client1', 'scope1 scope2', @key)
  83     auth = asserter.authorize('user1@email.com', { :connection => conn })
  84     auth.should_not == nil?
  85     auth.person.should == 'user1@email.com'
  86     conn.verify
  87   end
  88
  89   it 'should send valid access token request' do
  90     conn = stub_connection do |stub|
  91       stub.post('/o/oauth2/token') do |env|
  92         params = Addressable::URI.form_unencode(env[:body])
  93         JWT.decode(params.assoc("assertion").last, @key.public_key)
  94         params.assoc("grant_type").should == ['grant_type','urn:ietf:params:oauth:grant-type:jwt-bearer']
  95         [200, {}, '{
  96           "access_token" : "1/abcdef1234567890",
  97           "token_type" : "Bearer",
  98           "expires_in" : 3600
  99         }']
 100       end
 101     end
 102     asserter = Google::APIClient::JWTAsserter.new('client1', 'scope1 scope2', @key)
 103     auth = asserter.authorize(nil, { :connection => conn })
 104     auth.should_not == nil?
 105     auth.access_token.should == "1/abcdef1234567890"
 106     conn.verify
 107   end
 108
 109   it 'should be refreshable' do
 110     conn = stub_connection do |stub|
 111       stub.post('/o/oauth2/token') do |env|
 112         params = Addressable::URI.form_unencode(env[:body])
 113         JWT.decode(params.assoc("assertion").last, @key.public_key)
 114         params.assoc("grant_type").should == ['grant_type','urn:ietf:params:oauth:grant-type:jwt-bearer']
 115         [200, {}, '{
 116           "access_token" : "1/abcdef1234567890",
 117           "token_type" : "Bearer",
 118           "expires_in" : 3600
 119         }']
 120       end
 121       stub.post('/o/oauth2/token') do |env|
 122         params = Addressable::URI.form_unencode(env[:body])
 123         JWT.decode(params.assoc("assertion").last, @key.public_key)
 124         params.assoc("grant_type").should == ['grant_type','urn:ietf:params:oauth:grant-type:jwt-bearer']
 125         [200, {}, '{
 126           "access_token" : "1/0987654321fedcba",
 127           "token_type" : "Bearer",
 128           "expires_in" : 3600
 129         }']
 130       end
 131     end
 132     asserter = Google::APIClient::JWTAsserter.new('client1', 'scope1 scope2', @key)
 133     auth = asserter.authorize(nil, { :connection => conn })
 134     auth.should_not == nil?
 135     auth.access_token.should == "1/abcdef1234567890"
 136
 137     auth.fetch_access_token!(:connection => conn)
 138     auth.access_token.should == "1/0987654321fedcba"
 139
 140     conn.verify
 141   end
 142 end
 143
 144 describe Google::APIClient::ComputeServiceAccount do
 145   include ConnectionHelpers
 146
 147   it 'should query metadata server' do
 148     conn = stub_connection do |stub|
 149       stub.get('/computeMetadata/v1beta1/instance/service-accounts/default/token') do |env|
 150         env.url.host.should == 'metadata'
 151         [200, {}, '{
 152           "access_token" : "1/abcdef1234567890",
 153           "token_type" : "Bearer",
 154           "expires_in" : 3600
 155         }']
 156       end
 157     end
 158     service_account = Google::APIClient::ComputeServiceAccount.new
 159     auth = service_account.fetch_access_token!({ :connection => conn })
 160     auth.should_not == nil?
 161     auth["access_token"].should == "1/abcdef1234567890"
 162     conn.verify
 163   end
 164 end