Splits the JWTHeader creds into its own class

spec/googleauth/service_account_spec.rb

@@ -80,67 +80,6 @@ describe Google::Auth::ServiceAccountCredentials do
 
   it_behaves_like 'apply/apply! are OK'
 
-  context 'when jwt_aud_uri is present' do
-    WANTED_AUTH_KEY = ServiceAccountCredentials::AUTH_METADATA_KEY
-    JWT_AUD_URI_KEY = ServiceAccountCredentials::JWT_AUD_URI_KEY
-    let(:test_uri) { 'https://www.googleapis.com/myservice' }
-    let(:auth_prefix) { 'Bearer ' }
-
-    def expect_is_encoded_jwt(hdr)
-      expect(hdr).to_not be_nil
-      expect(hdr.start_with?(auth_prefix)).to be true
-      authorization = hdr[auth_prefix.length..-1]
-      payload, _ = JWT.decode(authorization, @key.public_key)
-      expect(payload['aud']).to eq(test_uri)
-      expect(payload['iss']).to eq(client_email)
-    end
-
-    describe '#apply!' do
-      it 'should update the target hash with a jwt token' do
-        md = { foo: 'bar' }
-        md[JWT_AUD_URI_KEY] = test_uri
-        @client.apply!(md)
-        auth_header = md[WANTED_AUTH_KEY]
-        expect_is_encoded_jwt(auth_header)
-        expect(md[JWT_AUD_URI_KEY]).to be_nil
-      end
-    end
-
-    describe 'updater_proc' do
-      it 'should provide a proc that updates a hash with a jwt token' do
-        md = { foo: 'bar' }
-        md[JWT_AUD_URI_KEY] = test_uri
-        the_proc = @client.updater_proc
-        got = the_proc.call(md)
-        auth_header = got[WANTED_AUTH_KEY]
-        expect_is_encoded_jwt(auth_header)
-        expect(got[JWT_AUD_URI_KEY]).to be_nil
-        expect(md[JWT_AUD_URI_KEY]).to_not be_nil
-      end
-    end
-
-    describe '#apply' do
-      it 'should not update the original hash with a jwt token' do
-        md = { foo: 'bar' }
-        md[JWT_AUD_URI_KEY] = test_uri
-        the_proc = @client.updater_proc
-        got = the_proc.call(md)
-        auth_header = md[WANTED_AUTH_KEY]
-        expect(auth_header).to be_nil
-        expect(got[JWT_AUD_URI_KEY]).to be_nil
-        expect(md[JWT_AUD_URI_KEY]).to_not be_nil
-      end
-
-      it 'should add a jwt token to the returned hash' do
-        md = { foo: 'bar' }
-        md[JWT_AUD_URI_KEY] = test_uri
-        got = @client.apply(md)
-        auth_header = got[WANTED_AUTH_KEY]
-        expect_is_encoded_jwt(auth_header)
-      end
-    end
-  end
-
   describe '#from_env' do
     before(:example) do
       @var_name = CredentialsLoader::ENV_VAR
@@ -207,3 +146,151 @@ describe Google::Auth::ServiceAccountCredentials do
     end
   end
 end
+
+describe Google::Auth::ServiceAccountJwtHeaderCredentials do
+  CredentialsLoader = Google::Auth::CredentialsLoader
+  ServiceAccountJwtHeaderCredentials =
+    Google::Auth::ServiceAccountJwtHeaderCredentials
+
+  let(:client_email) { 'app@developer.gserviceaccount.com' }
+  let(:clz) { Google::Auth::ServiceAccountJwtHeaderCredentials }
+
+  before(:example) do
+    @key = OpenSSL::PKey::RSA.new(2048)
+    @client = clz.new(StringIO.new(cred_json_text))
+  end
+
+  def cred_json_text
+    cred_json = {
+      private_key_id: 'a_private_key_id',
+      private_key: @key.to_pem,
+      client_email: client_email,
+      client_id: 'app.apps.googleusercontent.com',
+      type: 'service_account'
+    }
+    MultiJson.dump(cred_json)
+  end
+
+  context 'when jwt_aud_uri is present' do
+    WANTED_AUTH_KEY = ServiceAccountJwtHeaderCredentials::AUTH_METADATA_KEY
+    JWT_AUD_URI_KEY = ServiceAccountJwtHeaderCredentials::JWT_AUD_URI_KEY
+    let(:test_uri) { 'https://www.googleapis.com/myservice' }
+    let(:auth_prefix) { 'Bearer ' }
+
+    def expect_is_encoded_jwt(hdr)
+      expect(hdr).to_not be_nil
+      expect(hdr.start_with?(auth_prefix)).to be true
+      authorization = hdr[auth_prefix.length..-1]
+      payload, _ = JWT.decode(authorization, @key.public_key)
+      expect(payload['aud']).to eq(test_uri)
+      expect(payload['iss']).to eq(client_email)
+    end
+
+    describe '#apply!' do
+      it 'should update the target hash with a jwt token' do
+        md = { foo: 'bar' }
+        md[JWT_AUD_URI_KEY] = test_uri
+        @client.apply!(md)
+        auth_header = md[WANTED_AUTH_KEY]
+        expect_is_encoded_jwt(auth_header)
+        expect(md[JWT_AUD_URI_KEY]).to be_nil
+      end
+    end
+
+    describe 'updater_proc' do
+      it 'should provide a proc that updates a hash with a jwt token' do
+        md = { foo: 'bar' }
+        md[JWT_AUD_URI_KEY] = test_uri
+        the_proc = @client.updater_proc
+        got = the_proc.call(md)
+        auth_header = got[WANTED_AUTH_KEY]
+        expect_is_encoded_jwt(auth_header)
+        expect(got[JWT_AUD_URI_KEY]).to be_nil
+        expect(md[JWT_AUD_URI_KEY]).to_not be_nil
+      end
+    end
+
+    describe '#apply' do
+      it 'should not update the original hash with a jwt token' do
+        md = { foo: 'bar' }
+        md[JWT_AUD_URI_KEY] = test_uri
+        the_proc = @client.updater_proc
+        got = the_proc.call(md)
+        auth_header = md[WANTED_AUTH_KEY]
+        expect(auth_header).to be_nil
+        expect(got[JWT_AUD_URI_KEY]).to be_nil
+        expect(md[JWT_AUD_URI_KEY]).to_not be_nil
+      end
+
+      it 'should add a jwt token to the returned hash' do
+        md = { foo: 'bar' }
+        md[JWT_AUD_URI_KEY] = test_uri
+        got = @client.apply(md)
+        auth_header = got[WANTED_AUTH_KEY]
+        expect_is_encoded_jwt(auth_header)
+      end
+    end
+  end
+
+  describe '#from_env' do
+    before(:example) do
+      @var_name = CredentialsLoader::ENV_VAR
+      @orig = ENV[@var_name]
+    end
+
+    after(:example) do
+      ENV[@var_name] = @orig unless @orig.nil?
+    end
+
+    it 'returns nil if the GOOGLE_APPLICATION_CREDENTIALS is unset' do
+      ENV.delete(@var_name) unless ENV[@var_name].nil?
+      expect(clz.from_env).to be_nil
+    end
+
+    it 'fails if the GOOGLE_APPLICATION_CREDENTIALS path does not exist' do
+      ENV.delete(@var_name) unless ENV[@var_name].nil?
+      expect(clz.from_env).to be_nil
+      Dir.mktmpdir do |dir|
+        key_path = File.join(dir, 'does-not-exist')
+        ENV[@var_name] = key_path
+        expect { clz.from_env }.to raise_error
+      end
+    end
+
+    it 'succeeds when the GOOGLE_APPLICATION_CREDENTIALS file is valid' do
+      Dir.mktmpdir do |dir|
+        key_path = File.join(dir, 'my_cert_file')
+        FileUtils.mkdir_p(File.dirname(key_path))
+        File.write(key_path, cred_json_text)
+        ENV[@var_name] = key_path
+        expect(clz.from_env).to_not be_nil
+      end
+    end
+  end
+
+  describe '#from_well_known_path' do
+    before(:example) do
+      @home = ENV['HOME']
+      @known_path = CredentialsLoader::WELL_KNOWN_PATH
+    end
+
+    after(:example) do
+      ENV['HOME'] = @home unless @home == ENV['HOME']
+    end
+
+    it 'is nil if no file exists' do
+      ENV['HOME'] = File.dirname(__FILE__)
+      expect(clz.from_well_known_path).to be_nil
+    end
+
+    it 'successfully loads the file when it is present' do
+      Dir.mktmpdir do |dir|
+        key_path = File.join(dir, '.config', @known_path)
+        FileUtils.mkdir_p(File.dirname(key_path))
+        File.write(key_path, cred_json_text)
+        ENV['HOME'] = dir
+        expect(clz.from_well_known_path).to_not be_nil
+      end
+    end
+  end
+end