spec/google/api_client/service_account_spec.rb

   1 # Copyright 2012 Google Inc.
   2 #
   3 # Licensed under the Apache License, Version 2.0 (the "License");
   4 # you may not use this file except in compliance with the License.
   5 # You may obtain a copy of the License at
   6 #
   7 #      http://www.apache.org/licenses/LICENSE-2.0
   8 #
   9 # Unless required by applicable law or agreed to in writing, software
  10 # distributed under the License is distributed on an "AS IS" BASIS,
  11 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12 # See the License for the specific language governing permissions and
  13 # limitations under the License.
  14
  15 require 'spec_helper'
  16
  17 require 'google/api_client'
  18
  19 fixtures_path = File.expand_path('../../../fixtures', __FILE__)
  20
  21 describe Google::APIClient::KeyUtils do
  22   it 'should read PKCS12 files from the filesystem' do
  23     pending "Reading from PKCS12 not supported on jruby" if RUBY_PLATFORM == 'java'
  24     path =  File.expand_path('files/privatekey.p12', fixtures_path)
  25     key = Google::APIClient::KeyUtils.load_from_pkcs12(path, 'notasecret')
  26     expect(key).not_to eq(nil)
  27   end
  28
  29   it 'should read PKCS12 files from loaded files' do
  30     pending "Reading from PKCS12 not supported on jruby" if RUBY_PLATFORM == 'java'
  31     path =  File.expand_path('files/privatekey.p12', fixtures_path)
  32     content = File.read(path)
  33     key = Google::APIClient::KeyUtils.load_from_pkcs12(content, 'notasecret')
  34     expect(key).not_to eq(nil)
  35   end
  36
  37   it 'should read PEM files from the filesystem' do
  38     path =  File.expand_path('files/secret.pem', fixtures_path)
  39     key = Google::APIClient::KeyUtils.load_from_pem(path, 'notasecret')
  40     expect(key).not_to eq(nil)
  41   end
  42
  43   it 'should read PEM files from loaded files' do
  44     path =  File.expand_path('files/secret.pem', fixtures_path)
  45     content = File.read(path)
  46     key = Google::APIClient::KeyUtils.load_from_pem(content, 'notasecret')
  47     expect(key).not_to eq(nil)
  48   end
  49
  50 end
  51
  52 describe Google::APIClient::JWTAsserter do
  53   include ConnectionHelpers
  54
  55   before do
  56     @key = OpenSSL::PKey::RSA.new 2048
  57   end
  58
  59   it 'should generate valid JWTs' do
  60     asserter = Google::APIClient::JWTAsserter.new('client1', 'scope1 scope2', @key)
  61     jwt = asserter.to_authorization.to_jwt
  62     expect(jwt).not_to eq(nil)
  63
  64     claim = JWT.decode(jwt, @key.public_key, true)
  65     claim = claim.first if claim.respond_to? :first
  66     expect(claim["iss"]).to eq('client1')
  67     expect(claim["scope"]).to eq('scope1 scope2')
  68   end
  69
  70   it 'should allow impersonation' do
  71     conn = stub_connection do |stub|
  72       stub.post('/o/oauth2/token') do |env|
  73         params = Addressable::URI.form_unencode(env[:body])
  74         JWT.decode(params.assoc("assertion").last, @key.public_key)
  75         expect(params.assoc("grant_type")).to eq(['grant_type','urn:ietf:params:oauth:grant-type:jwt-bearer'])
  76         [200, {}, '{
  77           "access_token" : "1/abcdef1234567890",
  78           "token_type" : "Bearer",
  79           "expires_in" : 3600
  80         }']
  81       end
  82     end
  83     asserter = Google::APIClient::JWTAsserter.new('client1', 'scope1 scope2', @key)
  84     auth = asserter.authorize('user1@email.com', { :connection => conn })
  85     expect(auth).not_to eq(nil?)
  86     expect(auth.person).to eq('user1@email.com')
  87     conn.verify
  88   end
  89
  90   it 'should send valid access token request' do
  91     conn = stub_connection do |stub|
  92       stub.post('/o/oauth2/token') do |env|
  93         params = Addressable::URI.form_unencode(env[:body])
  94         JWT.decode(params.assoc("assertion").last, @key.public_key)
  95         expect(params.assoc("grant_type")).to eq(['grant_type','urn:ietf:params:oauth:grant-type:jwt-bearer'])
  96         [200, {}, '{
  97           "access_token" : "1/abcdef1234567890",
  98           "token_type" : "Bearer",
  99           "expires_in" : 3600
 100         }']
 101       end
 102     end
 103     asserter = Google::APIClient::JWTAsserter.new('client1', 'scope1 scope2', @key)
 104     auth = asserter.authorize(nil, { :connection => conn })
 105     expect(auth).not_to eq(nil?)
 106     expect(auth.access_token).to eq("1/abcdef1234567890")
 107     conn.verify
 108   end
 109
 110   it 'should be refreshable' do
 111     conn = stub_connection do |stub|
 112       stub.post('/o/oauth2/token') do |env|
 113         params = Addressable::URI.form_unencode(env[:body])
 114         JWT.decode(params.assoc("assertion").last, @key.public_key)
 115         expect(params.assoc("grant_type")).to eq(['grant_type','urn:ietf:params:oauth:grant-type:jwt-bearer'])
 116         [200, {}, '{
 117           "access_token" : "1/abcdef1234567890",
 118           "token_type" : "Bearer",
 119           "expires_in" : 3600
 120         }']
 121       end
 122       stub.post('/o/oauth2/token') do |env|
 123         params = Addressable::URI.form_unencode(env[:body])
 124         JWT.decode(params.assoc("assertion").last, @key.public_key)
 125         expect(params.assoc("grant_type")).to eq(['grant_type','urn:ietf:params:oauth:grant-type:jwt-bearer'])
 126         [200, {}, '{
 127           "access_token" : "1/0987654321fedcba",
 128           "token_type" : "Bearer",
 129           "expires_in" : 3600
 130         }']
 131       end
 132     end
 133     asserter = Google::APIClient::JWTAsserter.new('client1', 'scope1 scope2', @key)
 134     auth = asserter.authorize(nil, { :connection => conn })
 135     expect(auth).not_to eq(nil?)
 136     expect(auth.access_token).to eq("1/abcdef1234567890")
 137
 138     auth.fetch_access_token!(:connection => conn)
 139     expect(auth.access_token).to eq("1/0987654321fedcba")
 140
 141     conn.verify
 142   end
 143 end
 144
 145 describe Google::APIClient::ComputeServiceAccount do
 146   include ConnectionHelpers
 147
 148   it 'should query metadata server' do
 149     conn = stub_connection do |stub|
 150       stub.get('/computeMetadata/v1beta1/instance/service-accounts/default/token') do |env|
 151         expect(env.url.host).to eq('metadata')
 152         [200, {}, '{
 153           "access_token" : "1/abcdef1234567890",
 154           "token_type" : "Bearer",
 155           "expires_in" : 3600
 156         }']
 157       end
 158     end
 159     service_account = Google::APIClient::ComputeServiceAccount.new
 160     auth = service_account.fetch_access_token!({ :connection => conn })
 161     expect(auth).not_to eq(nil?)
 162     expect(auth["access_token"]).to eq("1/abcdef1234567890")
 163     conn.verify
 164   end
 165 end