credentials/internal/providers/ecs_ram_role_test.go - Code Metrics - Inspection of "feat: support IMDS v2 default for ecs ram role" - aliyun/credentials-go - Measure and Improve Code Quality continuously with Scrutinizer

Passed

Push — master ( af7c74...f2abf1 )

by Jackson

created 2024-09-12 05:52 UTC

credentials/internal/providers/ecs_ram_role_test.go B

↳ Parent: Project

Size/Duplication

Total Lines	445
Duplicated Lines	0 %

Importance

Changes

Metric	Value
cc	44
eloc	291
dl	0
loc	445
rs	8.8798
c	0
b	0
f	0

7 Methods

Rating	Name	Size	Complexity
B	providers.TestECSRAMRoleCredentialsProvider_getCredentialsWithMetadataV2	48	6
B	providers.TestECSRAMRoleCredentialsProvider_getRoleNameWithMetadataV2	38	5
B	providers.TestECSRAMRoleCredentialsProviderGetCredentials	41	5
A	providers.TestNewECSRAMRoleCredentialsProvider	10	1
F	providers.TestECSRAMRoleCredentialsProvider_getCredentials	166	17
B	providers.TestECSRAMRoleCredentialsProvider_getRoleName	41	5
B	providers.TestECSRAMRoleCredentialsProvider_getMetadataToken	77	5

package providers

import (
	"errors"
	"os"
	"testing"
	"time"

	httputil "github.com/aliyun/credentials-go/credentials/internal/http"
	"github.com/stretchr/testify/assert"
)

func TestNewECSRAMRoleCredentialsProvider(t *testing.T) {
	p, err := NewECSRAMRoleCredentialsProviderBuilder().Build()
	assert.Nil(t, err)
	assert.Equal(t, "", p.roleName)

	p, err = NewECSRAMRoleCredentialsProviderBuilder().WithRoleName("role").Build()
	assert.Nil(t, err)
	assert.Equal(t, "role", p.roleName)

	assert.True(t, p.needUpdateCredential())
}

func TestECSRAMRoleCredentialsProvider_getRoleName(t *testing.T) {
	originHttpDo := httpDo
	defer func() { httpDo = originHttpDo }()

	p, err := NewECSRAMRoleCredentialsProviderBuilder().Build()
	assert.Nil(t, err)

	// case 1: server error
	httpDo = func(req *httputil.Request) (res *httputil.Response, err error) {
		err = errors.New("mock server error")
		return
	}

	_, err = p.getRoleName()
	assert.NotNil(t, err)
	assert.Equal(t, "get role name failed: mock server error", err.Error())

	// case 2: 4xx error
	httpDo = func(req *httputil.Request) (res *httputil.Response, err error) {
		res = &httputil.Response{
			StatusCode: 400,
			Body:       []byte("4xx error"),
		}
		return
	}

	_, err = p.getRoleName()
	assert.NotNil(t, err)
	assert.Equal(t, "get role name failed: GET http://100.100.100.200/latest/meta-data/ram/security-credentials/ 400", err.Error())

	// case 3: ok
	httpDo = func(req *httputil.Request) (res *httputil.Response, err error) {
		res = &httputil.Response{
			StatusCode: 200,
			Body:       []byte("rolename"),
		}
		return
	}
	roleName, err := p.getRoleName()
	assert.Nil(t, err)
	assert.Equal(t, "rolename", roleName)
}

func TestECSRAMRoleCredentialsProvider_getRoleNameWithMetadataV2(t *testing.T) {
	originHttpDo := httpDo
	defer func() { httpDo = originHttpDo }()

	p, err := NewECSRAMRoleCredentialsProviderBuilder().WithDisableIMDSv1(true).Build()
	assert.Nil(t, err)

	// case 1: get metadata token failed
	httpDo = func(req *httputil.Request) (res *httputil.Response, err error) {
		err = errors.New("mock server error")
		return
	}

	_, err = p.getRoleName()
	assert.NotNil(t, err)
	assert.Equal(t, "get metadata token failed: mock server error", err.Error())

	// case 2: return token
	httpDo = func(req *httputil.Request) (res *httputil.Response, err error) {
		if req.Path == "/latest/api/token" {
			res = &httputil.Response{
				StatusCode: 200,
				Body:       []byte("tokenxxxxx"),
			}
		} else {
			assert.Equal(t, "tokenxxxxx", req.Headers["x-aliyun-ecs-metadata-token"])

			res = &httputil.Response{
				StatusCode: 200,
				Body:       []byte("rolename"),
			}
		}
		return
	}

	roleName, err := p.getRoleName()
	assert.Nil(t, err)
	assert.Equal(t, "rolename", roleName)
}

func TestECSRAMRoleCredentialsProvider_getCredentials(t *testing.T) {
	originHttpDo := httpDo
	defer func() { httpDo = originHttpDo }()

	p, err := NewECSRAMRoleCredentialsProviderBuilder().Build()
	assert.Nil(t, err)

	// case 1: server error
	httpDo = func(req *httputil.Request) (res *httputil.Response, err error) {
		err = errors.New("mock server error")
		return
	}
	_, err = p.getCredentials()
	assert.NotNil(t, err)
	assert.Equal(t, "get role name failed: mock server error", err.Error())

	// case 2: get role name ok, get credentials failed with server error
	httpDo = func(req *httputil.Request) (res *httputil.Response, err error) {
		if req.Path == "/latest/meta-data/ram/security-credentials/" {
			res = &httputil.Response{
				StatusCode: 200,
				Body:       []byte("rolename"),
			}
			return
		}
		err = errors.New("mock server error")
		return
	}

	_, err = p.getCredentials()
	assert.NotNil(t, err)
	assert.Equal(t, "refresh Ecs sts token err: mock server error", err.Error())

	// case 3: 4xx error
	httpDo = func(req *httputil.Request) (res *httputil.Response, err error) {
		if req.Path == "/latest/meta-data/ram/security-credentials/" {
			res = &httputil.Response{
				StatusCode: 200,
				Body:       []byte("rolename"),
			}
			return
		}

		res = &httputil.Response{
			StatusCode: 400,
			Body:       []byte("4xx error"),
		}
		return
	}

	_, err = p.getCredentials()
	assert.NotNil(t, err)
	assert.Equal(t, "refresh Ecs sts token err, httpStatus: 400, message = 4xx error", err.Error())

	// case 4: invalid json
	httpDo = func(req *httputil.Request) (res *httputil.Response, err error) {
		if req.Path == "/latest/meta-data/ram/security-credentials/" {
			res = &httputil.Response{
				StatusCode: 200,
				Body:       []byte("rolename"),
			}
			return
		}

		res = &httputil.Response{
			StatusCode: 200,
			Body:       []byte("invalid json"),
		}
		return
	}

	_, err = p.getCredentials()
	assert.NotNil(t, err)
	assert.Equal(t, "refresh Ecs sts token err, json.Unmarshal fail: invalid character 'i' looking for beginning of value", err.Error())

	// case 5: empty response json
	httpDo = func(req *httputil.Request) (res *httputil.Response, err error) {
		if req.Path == "/latest/meta-data/ram/security-credentials/" {
			res = &httputil.Response{
				StatusCode: 200,
				Body:       []byte("rolename"),
			}
			return
		}

		res = &httputil.Response{
			StatusCode: 200,
			Body:       []byte("null"),
		}
		return
	}

	_, err = p.getCredentials()
	assert.NotNil(t, err)
	assert.Equal(t, "refresh Ecs sts token err, fail to get credentials", err.Error())

	// case 6: empty session ak response json
	httpDo = func(req *httputil.Request) (res *httputil.Response, err error) {
		if req.Path == "/latest/meta-data/ram/security-credentials/" {
			res = &httputil.Response{
				StatusCode: 200,
				Body:       []byte("rolename"),
			}
			return
		}

		res = &httputil.Response{
			StatusCode: 200,
			Body:       []byte("{}"),
		}
		return
	}
	_, err = p.getCredentials()
	assert.NotNil(t, err)
	assert.Equal(t, "refresh Ecs sts token err, fail to get credentials", err.Error())

	// case 7: non-success response
	httpDo = func(req *httputil.Request) (res *httputil.Response, err error) {
		if req.Path == "/latest/meta-data/ram/security-credentials/" {
			res = &httputil.Response{
				StatusCode: 200,
				Body:       []byte("rolename"),
			}
			return
		}

		res = &httputil.Response{
			StatusCode: 200,
			Body:       []byte(`{"AccessKeyId":"saki","AccessKeySecret":"saks","Expiration":"2021-10-20T04:27:09Z","SecurityToken":"token","Code":"Failed"}`),
		}
		return
	}
	_, err = p.getCredentials()
	assert.NotNil(t, err)
	assert.Equal(t, "refresh Ecs sts token err, Code is not Success", err.Error())

	// case 8: mock ok value
	httpDo = func(req *httputil.Request) (res *httputil.Response, err error) {
		if req.Path == "/latest/meta-data/ram/security-credentials/" {
			res = &httputil.Response{
				StatusCode: 200,
				Body:       []byte("rolename"),
			}
			return
		}

		res = &httputil.Response{
			StatusCode: 200,
			Body:       []byte(`{"AccessKeyId":"saki","AccessKeySecret":"saks","Expiration":"2021-10-20T04:27:09Z","SecurityToken":"token","Code":"Success"}`),
		}
		return
	}
	creds, err := p.getCredentials()
	assert.Nil(t, err)
	assert.Equal(t, "saki", creds.AccessKeyId)
	assert.Equal(t, "saks", creds.AccessKeySecret)
	assert.Equal(t, "token", creds.SecurityToken)
	assert.Equal(t, "2021-10-20T04:27:09Z", creds.Expiration)

	// needUpdateCredential
	assert.True(t, p.needUpdateCredential())
	p.expirationTimestamp = time.Now().Unix()
	assert.True(t, p.needUpdateCredential())

	p.expirationTimestamp = time.Now().Unix() + 300
	assert.False(t, p.needUpdateCredential())
}

func TestECSRAMRoleCredentialsProvider_getCredentialsWithMetadataV2(t *testing.T) {
	originHttpDo := httpDo
	defer func() { httpDo = originHttpDo }()

	p, err := NewECSRAMRoleCredentialsProviderBuilder().WithDisableIMDSv1(true).WithRoleName("rolename").Build()
	assert.Nil(t, err)

	// case 1: get metadata token failed
	httpDo = func(req *httputil.Request) (res *httputil.Response, err error) {
		err = errors.New("mock server error")
		return
	}

	_, err = p.getCredentials()
	assert.NotNil(t, err)
	assert.Equal(t, "get metadata token failed: mock server error", err.Error())

	// case 2: return token
	httpDo = func(req *httputil.Request) (res *httputil.Response, err error) {
		if req.Path == "/latest/api/token" {
			res = &httputil.Response{
				StatusCode: 200,
				Body:       []byte("tokenxxxxx"),
			}
		} else if req.Path == "/latest/meta-data/ram/security-credentials/rolename" {
			assert.Equal(t, "tokenxxxxx", req.Headers["x-aliyun-ecs-metadata-token"])
			res = &httputil.Response{
				StatusCode: 200,
				Body:       []byte(`{"AccessKeyId":"saki","AccessKeySecret":"saks","Expiration":"2021-10-20T04:27:09Z","SecurityToken":"token","Code":"Success"}`),
			}
		}
		return
	}

	creds, err := p.getCredentials()
	assert.Nil(t, err)
	assert.Equal(t, "saki", creds.AccessKeyId)
	assert.Equal(t, "saks", creds.AccessKeySecret)
	assert.Equal(t, "token", creds.SecurityToken)
	assert.Equal(t, "2021-10-20T04:27:09Z", creds.Expiration)

	// needUpdateCredential
	assert.True(t, p.needUpdateCredential())
	p.expirationTimestamp = time.Now().Unix()
	assert.True(t, p.needUpdateCredential())

	p.expirationTimestamp = time.Now().Unix() + 300
	assert.False(t, p.needUpdateCredential())
}

func TestECSRAMRoleCredentialsProviderGetCredentials(t *testing.T) {
	originHttpDo := httpDo
	defer func() { httpDo = originHttpDo }()

	p, err := NewECSRAMRoleCredentialsProviderBuilder().WithRoleName("rolename").Build()
	assert.Nil(t, err)
	// case 1: get credentials failed
	httpDo = func(req *httputil.Request) (res *httputil.Response, err error) {
		err = errors.New("mock server error")
		return
	}
	_, err = p.GetCredentials()
	assert.NotNil(t, err)
	assert.Equal(t, "refresh Ecs sts token err: mock server error", err.Error())

	// case 2: get invalid expiration
	httpDo = func(req *httputil.Request) (res *httputil.Response, err error) {
		res = &httputil.Response{
			StatusCode: 200,
			Body:       []byte(`{"AccessKeyId":"saki","AccessKeySecret":"saks","Expiration":"invalidexpiration","SecurityToken":"token","Code":"Success"}`),
		}
		return
	}
	_, err = p.GetCredentials()
	assert.NotNil(t, err)
	assert.Equal(t, "parsing time \"invalidexpiration\" as \"2006-01-02T15:04:05Z\": cannot parse \"invalidexpiration\" as \"2006\"", err.Error())

	// case 3: happy result
	httpDo = func(req *httputil.Request) (res *httputil.Response, err error) {
		res = &httputil.Response{
			StatusCode: 200,
			Body:       []byte(`{"AccessKeyId":"akid","AccessKeySecret":"aksecret","Expiration":"2021-10-20T04:27:09Z","SecurityToken":"token","Code":"Success"}`),
		}
		return
	}
	cc, err := p.GetCredentials()
	assert.Nil(t, err)
	assert.Equal(t, "akid", cc.AccessKeyId)
	assert.Equal(t, "aksecret", cc.AccessKeySecret)
	assert.Equal(t, "token", cc.SecurityToken)
	assert.True(t, p.needUpdateCredential())
}

func TestECSRAMRoleCredentialsProvider_getMetadataToken(t *testing.T) {
	originHttpDo := httpDo
	defer func() { httpDo = originHttpDo }()

	p, err := NewECSRAMRoleCredentialsProviderBuilder().Build()
	assert.Nil(t, err)

	// case 1: server error
	httpDo = func(req *httputil.Request) (res *httputil.Response, err error) {
		err = errors.New("mock server error")
		return
	}

	_, err = p.getMetadataToken()
	assert.Nil(t, err)

	p, err = NewECSRAMRoleCredentialsProviderBuilder().WithDisableIMDSv1(false).Build()
	assert.Nil(t, err)

	_, err = p.getMetadataToken()
	assert.Nil(t, err)

	os.Setenv("ALIBABA_CLOUD_IMDSV1_DISABLE", "true")
	p, err = NewECSRAMRoleCredentialsProviderBuilder().Build()
	assert.Nil(t, err)

	_, err = p.getMetadataToken()
	assert.NotNil(t, err)

	os.Setenv("ALIBABA_CLOUD_IMDSV1_DISABLE", "")
	p, err = NewECSRAMRoleCredentialsProviderBuilder().Build()
	assert.Nil(t, err)

	_, err = p.getMetadataToken()
	assert.Nil(t, err)

	p, err = NewECSRAMRoleCredentialsProviderBuilder().WithDisableIMDSv1(true).Build()
	assert.Nil(t, err)

	_, err = p.getMetadataToken()
	assert.NotNil(t, err)

	assert.Equal(t, "get metadata token failed: mock server error", err.Error())

	// case 2: return token
	httpDo = func(req *httputil.Request) (res *httputil.Response, err error) {
		res = &httputil.Response{
			StatusCode: 200,
			Body:       []byte("tokenxxxxx"),
		}
		return
	}
	metadataToken, err := p.getMetadataToken()
	assert.Nil(t, err)
	assert.Equal(t, "tokenxxxxx", metadataToken)

	// case 3: return 404
	p, err = NewECSRAMRoleCredentialsProviderBuilder().WithDisableIMDSv1(false).Build()
	assert.Nil(t, err)

	httpDo = func(req *httputil.Request) (res *httputil.Response, err error) {
		res = &httputil.Response{
			StatusCode: 404,
			Body:       []byte("not found"),
		}
		return
	}
	metadataToken, err = p.getMetadataToken()
	assert.Nil(t, err)
	assert.Equal(t, "", metadataToken)

	p, err = NewECSRAMRoleCredentialsProviderBuilder().WithDisableIMDSv1(true).Build()
	assert.Nil(t, err)

	metadataToken, err = p.getMetadataToken()
	assert.NotNil(t, err)
	assert.Equal(t, "", metadataToken)
}


1			package providers
2
3			import (
4			"errors"
5			"os"
6			"testing"
7			"time"
8
9			httputil "github.com/aliyun/credentials-go/credentials/internal/http"
10			"github.com/stretchr/testify/assert"
11			)
12
13			func TestNewECSRAMRoleCredentialsProvider(t *testing.T) {
14			p, err := NewECSRAMRoleCredentialsProviderBuilder().Build()
15			assert.Nil(t, err)
16			assert.Equal(t, "", p.roleName)
17
18			p, err = NewECSRAMRoleCredentialsProviderBuilder().WithRoleName("role").Build()
19			assert.Nil(t, err)
20			assert.Equal(t, "role", p.roleName)
21
22			assert.True(t, p.needUpdateCredential())
23			}
24
25			func TestECSRAMRoleCredentialsProvider_getRoleName(t *testing.T) {
26			originHttpDo := httpDo
27			defer func() { httpDo = originHttpDo }()
28
29			p, err := NewECSRAMRoleCredentialsProviderBuilder().Build()
30			assert.Nil(t, err)
31
32			// case 1: server error
33			httpDo = func(req httputil.Request) (res httputil.Response, err error) {
34			err = errors.New("mock server error")
35			return
36			}
37
38			_, err = p.getRoleName()
39			assert.NotNil(t, err)
40			assert.Equal(t, "get role name failed: mock server error", err.Error())
41
42			// case 2: 4xx error
43			httpDo = func(req httputil.Request) (res httputil.Response, err error) {
44			res = &httputil.Response{
45			StatusCode: 400,
46			Body: []byte("4xx error"),
47			}
48			return
49			}
50
51			_, err = p.getRoleName()
52			assert.NotNil(t, err)
53			assert.Equal(t, "get role name failed: GET http://100.100.100.200/latest/meta-data/ram/security-credentials/ 400", err.Error())
54
55			// case 3: ok
56			httpDo = func(req httputil.Request) (res httputil.Response, err error) {
57			res = &httputil.Response{
58			StatusCode: 200,
59			Body: []byte("rolename"),
60			}
61			return
62			}
63			roleName, err := p.getRoleName()
64			assert.Nil(t, err)
65			assert.Equal(t, "rolename", roleName)
66			}
67
68			func TestECSRAMRoleCredentialsProvider_getRoleNameWithMetadataV2(t *testing.T) {
69			originHttpDo := httpDo
70			defer func() { httpDo = originHttpDo }()
71
72			p, err := NewECSRAMRoleCredentialsProviderBuilder().WithDisableIMDSv1(true).Build()
73			assert.Nil(t, err)
74
75			// case 1: get metadata token failed
76			httpDo = func(req httputil.Request) (res httputil.Response, err error) {
77			err = errors.New("mock server error")
78			return
79			}
80
81			_, err = p.getRoleName()
82			assert.NotNil(t, err)
83			assert.Equal(t, "get metadata token failed: mock server error", err.Error())
84
85			// case 2: return token
86			httpDo = func(req httputil.Request) (res httputil.Response, err error) {
87			if req.Path == "/latest/api/token" {
88			res = &httputil.Response{
89			StatusCode: 200,
90			Body: []byte("tokenxxxxx"),
91			}
92			} else {
93			assert.Equal(t, "tokenxxxxx", req.Headers["x-aliyun-ecs-metadata-token"])
94
95			res = &httputil.Response{
96			StatusCode: 200,
97			Body: []byte("rolename"),
98			}
99			}
100			return
101			}
102
103			roleName, err := p.getRoleName()
104			assert.Nil(t, err)
105			assert.Equal(t, "rolename", roleName)
106			}
107
108			func TestECSRAMRoleCredentialsProvider_getCredentials(t *testing.T) {
109			originHttpDo := httpDo
110			defer func() { httpDo = originHttpDo }()
111
112			p, err := NewECSRAMRoleCredentialsProviderBuilder().Build()
113			assert.Nil(t, err)
114
115			// case 1: server error
116			httpDo = func(req httputil.Request) (res httputil.Response, err error) {
117			err = errors.New("mock server error")
118			return
119			}
120			_, err = p.getCredentials()
121			assert.NotNil(t, err)
122			assert.Equal(t, "get role name failed: mock server error", err.Error())
123
124			// case 2: get role name ok, get credentials failed with server error
125			httpDo = func(req httputil.Request) (res httputil.Response, err error) {
126			if req.Path == "/latest/meta-data/ram/security-credentials/" {
127			res = &httputil.Response{
128			StatusCode: 200,
129			Body: []byte("rolename"),
130			}
131			return
132			}
133			err = errors.New("mock server error")
134			return
135			}
136
137			_, err = p.getCredentials()
138			assert.NotNil(t, err)
139			assert.Equal(t, "refresh Ecs sts token err: mock server error", err.Error())
140
141			// case 3: 4xx error
142			httpDo = func(req httputil.Request) (res httputil.Response, err error) {
143			if req.Path == "/latest/meta-data/ram/security-credentials/" {
144			res = &httputil.Response{
145			StatusCode: 200,
146			Body: []byte("rolename"),
147			}
148			return
149			}
150
151			res = &httputil.Response{
152			StatusCode: 400,
153			Body: []byte("4xx error"),
154			}
155			return
156			}
157
158			_, err = p.getCredentials()
159			assert.NotNil(t, err)
160			assert.Equal(t, "refresh Ecs sts token err, httpStatus: 400, message = 4xx error", err.Error())
161
162			// case 4: invalid json
163			httpDo = func(req httputil.Request) (res httputil.Response, err error) {
164			if req.Path == "/latest/meta-data/ram/security-credentials/" {
165			res = &httputil.Response{
166			StatusCode: 200,
167			Body: []byte("rolename"),
168			}
169			return
170			}
171
172			res = &httputil.Response{
173			StatusCode: 200,
174			Body: []byte("invalid json"),
175			}
176			return
177			}
178
179			_, err = p.getCredentials()
180			assert.NotNil(t, err)
181			assert.Equal(t, "refresh Ecs sts token err, json.Unmarshal fail: invalid character 'i' looking for beginning of value", err.Error())
182
183			// case 5: empty response json
184			httpDo = func(req httputil.Request) (res httputil.Response, err error) {
185			if req.Path == "/latest/meta-data/ram/security-credentials/" {
186			res = &httputil.Response{
187			StatusCode: 200,
188			Body: []byte("rolename"),
189			}
190			return
191			}
192
193			res = &httputil.Response{
194			StatusCode: 200,
195			Body: []byte("null"),
196			}
197			return
198			}
199
200			_, err = p.getCredentials()
201			assert.NotNil(t, err)
202			assert.Equal(t, "refresh Ecs sts token err, fail to get credentials", err.Error())
203
204			// case 6: empty session ak response json
205			httpDo = func(req httputil.Request) (res httputil.Response, err error) {
206			if req.Path == "/latest/meta-data/ram/security-credentials/" {
207			res = &httputil.Response{
208			StatusCode: 200,
209			Body: []byte("rolename"),
210			}
211			return
212			}
213
214			res = &httputil.Response{
215			StatusCode: 200,
216			Body: []byte("{}"),
217			}
218			return
219			}
220			_, err = p.getCredentials()
221			assert.NotNil(t, err)
222			assert.Equal(t, "refresh Ecs sts token err, fail to get credentials", err.Error())
223
224			// case 7: non-success response
225			httpDo = func(req httputil.Request) (res httputil.Response, err error) {
226			if req.Path == "/latest/meta-data/ram/security-credentials/" {
227			res = &httputil.Response{
228			StatusCode: 200,
229			Body: []byte("rolename"),
230			}
231			return
232			}
233
234			res = &httputil.Response{
235			StatusCode: 200,
236			Body: []byte(`{"AccessKeyId":"saki","AccessKeySecret":"saks","Expiration":"2021-10-20T04:27:09Z","SecurityToken":"token","Code":"Failed"}`),
237			}
238			return
239			}
240			_, err = p.getCredentials()
241			assert.NotNil(t, err)
242			assert.Equal(t, "refresh Ecs sts token err, Code is not Success", err.Error())
243
244			// case 8: mock ok value
245			httpDo = func(req httputil.Request) (res httputil.Response, err error) {
246			if req.Path == "/latest/meta-data/ram/security-credentials/" {
247			res = &httputil.Response{
248			StatusCode: 200,
249			Body: []byte("rolename"),
250			}
251			return
252			}
253
254			res = &httputil.Response{
255			StatusCode: 200,
256			Body: []byte(`{"AccessKeyId":"saki","AccessKeySecret":"saks","Expiration":"2021-10-20T04:27:09Z","SecurityToken":"token","Code":"Success"}`),
257			}
258			return
259			}
260			creds, err := p.getCredentials()
261			assert.Nil(t, err)
262			assert.Equal(t, "saki", creds.AccessKeyId)
263			assert.Equal(t, "saks", creds.AccessKeySecret)
264			assert.Equal(t, "token", creds.SecurityToken)
265			assert.Equal(t, "2021-10-20T04:27:09Z", creds.Expiration)
266
267			// needUpdateCredential
268			assert.True(t, p.needUpdateCredential())
269			p.expirationTimestamp = time.Now().Unix()
270			assert.True(t, p.needUpdateCredential())
271
272			p.expirationTimestamp = time.Now().Unix() + 300
273			assert.False(t, p.needUpdateCredential())
274			}
275
276			func TestECSRAMRoleCredentialsProvider_getCredentialsWithMetadataV2(t *testing.T) {
277			originHttpDo := httpDo
278			defer func() { httpDo = originHttpDo }()
279
280			p, err := NewECSRAMRoleCredentialsProviderBuilder().WithDisableIMDSv1(true).WithRoleName("rolename").Build()
281			assert.Nil(t, err)
282
283			// case 1: get metadata token failed
284			httpDo = func(req httputil.Request) (res httputil.Response, err error) {
285			err = errors.New("mock server error")
286			return
287			}
288
289			_, err = p.getCredentials()
290			assert.NotNil(t, err)
291			assert.Equal(t, "get metadata token failed: mock server error", err.Error())
292
293			// case 2: return token
294			httpDo = func(req httputil.Request) (res httputil.Response, err error) {
295			if req.Path == "/latest/api/token" {
296			res = &httputil.Response{
297			StatusCode: 200,
298			Body: []byte("tokenxxxxx"),
299			}
300			} else if req.Path == "/latest/meta-data/ram/security-credentials/rolename" {
301			assert.Equal(t, "tokenxxxxx", req.Headers["x-aliyun-ecs-metadata-token"])
302			res = &httputil.Response{
303			StatusCode: 200,
304			Body: []byte(`{"AccessKeyId":"saki","AccessKeySecret":"saks","Expiration":"2021-10-20T04:27:09Z","SecurityToken":"token","Code":"Success"}`),
305			}
306			}
307			return
308			}
309
310			creds, err := p.getCredentials()
311			assert.Nil(t, err)
312			assert.Equal(t, "saki", creds.AccessKeyId)
313			assert.Equal(t, "saks", creds.AccessKeySecret)
314			assert.Equal(t, "token", creds.SecurityToken)
315			assert.Equal(t, "2021-10-20T04:27:09Z", creds.Expiration)
316
317			// needUpdateCredential
318			assert.True(t, p.needUpdateCredential())
319			p.expirationTimestamp = time.Now().Unix()
320			assert.True(t, p.needUpdateCredential())
321
322			p.expirationTimestamp = time.Now().Unix() + 300
323			assert.False(t, p.needUpdateCredential())
324			}
325
326			func TestECSRAMRoleCredentialsProviderGetCredentials(t *testing.T) {
327			originHttpDo := httpDo
328			defer func() { httpDo = originHttpDo }()
329
330			p, err := NewECSRAMRoleCredentialsProviderBuilder().WithRoleName("rolename").Build()
331			assert.Nil(t, err)
332			// case 1: get credentials failed
333			httpDo = func(req httputil.Request) (res httputil.Response, err error) {
334			err = errors.New("mock server error")
335			return
336			}
337			_, err = p.GetCredentials()
338			assert.NotNil(t, err)
339			assert.Equal(t, "refresh Ecs sts token err: mock server error", err.Error())
340
341			// case 2: get invalid expiration
342			httpDo = func(req httputil.Request) (res httputil.Response, err error) {
343			res = &httputil.Response{
344			StatusCode: 200,
345			Body: []byte(`{"AccessKeyId":"saki","AccessKeySecret":"saks","Expiration":"invalidexpiration","SecurityToken":"token","Code":"Success"}`),
346			}
347			return
348			}
349			_, err = p.GetCredentials()
350			assert.NotNil(t, err)
351			assert.Equal(t, "parsing time \"invalidexpiration\" as \"2006-01-02T15:04:05Z\": cannot parse \"invalidexpiration\" as \"2006\"", err.Error())
352
353			// case 3: happy result
354			httpDo = func(req httputil.Request) (res httputil.Response, err error) {
355			res = &httputil.Response{
356			StatusCode: 200,
357			Body: []byte(`{"AccessKeyId":"akid","AccessKeySecret":"aksecret","Expiration":"2021-10-20T04:27:09Z","SecurityToken":"token","Code":"Success"}`),
358			}
359			return
360			}
361			cc, err := p.GetCredentials()
362			assert.Nil(t, err)
363			assert.Equal(t, "akid", cc.AccessKeyId)
364			assert.Equal(t, "aksecret", cc.AccessKeySecret)
365			assert.Equal(t, "token", cc.SecurityToken)
366			assert.True(t, p.needUpdateCredential())
367			}
368
369			func TestECSRAMRoleCredentialsProvider_getMetadataToken(t *testing.T) {
370			originHttpDo := httpDo
371			defer func() { httpDo = originHttpDo }()
372
373			p, err := NewECSRAMRoleCredentialsProviderBuilder().Build()
374			assert.Nil(t, err)
375
376			// case 1: server error
377			httpDo = func(req httputil.Request) (res httputil.Response, err error) {
378			err = errors.New("mock server error")
379			return
380			}
381
382			_, err = p.getMetadataToken()
383			assert.Nil(t, err)
384
385			p, err = NewECSRAMRoleCredentialsProviderBuilder().WithDisableIMDSv1(false).Build()
386			assert.Nil(t, err)
387
388			_, err = p.getMetadataToken()
389			assert.Nil(t, err)
390
391			os.Setenv("ALIBABA_CLOUD_IMDSV1_DISABLE", "true")
392			p, err = NewECSRAMRoleCredentialsProviderBuilder().Build()
393			assert.Nil(t, err)
394
395			_, err = p.getMetadataToken()
396			assert.NotNil(t, err)
397
398			os.Setenv("ALIBABA_CLOUD_IMDSV1_DISABLE", "")
399			p, err = NewECSRAMRoleCredentialsProviderBuilder().Build()
400			assert.Nil(t, err)
401
402			_, err = p.getMetadataToken()
403			assert.Nil(t, err)
404
405			p, err = NewECSRAMRoleCredentialsProviderBuilder().WithDisableIMDSv1(true).Build()
406			assert.Nil(t, err)
407
408			_, err = p.getMetadataToken()
409			assert.NotNil(t, err)
410
411			assert.Equal(t, "get metadata token failed: mock server error", err.Error())
412
413			// case 2: return token
414			httpDo = func(req httputil.Request) (res httputil.Response, err error) {
415			res = &httputil.Response{
416			StatusCode: 200,
417			Body: []byte("tokenxxxxx"),
418			}
419			return
420			}
421			metadataToken, err := p.getMetadataToken()
422			assert.Nil(t, err)
423			assert.Equal(t, "tokenxxxxx", metadataToken)
424
425			// case 3: return 404
426			p, err = NewECSRAMRoleCredentialsProviderBuilder().WithDisableIMDSv1(false).Build()
427			assert.Nil(t, err)
428
429			httpDo = func(req httputil.Request) (res httputil.Response, err error) {
430			res = &httputil.Response{
431			StatusCode: 404,
432			Body: []byte("not found"),
433			}
434			return
435			}
436			metadataToken, err = p.getMetadataToken()
437			assert.Nil(t, err)
438			assert.Equal(t, "", metadataToken)
439
440			p, err = NewECSRAMRoleCredentialsProviderBuilder().WithDisableIMDSv1(true).Build()
441			assert.Nil(t, err)
442
443			metadataToken, err = p.getMetadataToken()
444			assert.NotNil(t, err)
445			assert.Equal(t, "", metadataToken)
446			}
447

aliyun / credentials-go

GitHub Access Token became invalid

Push — master ( af7c74...f2abf1 )

credentials/internal/providers/ecs_ram_role_test.go B

Size/Duplication

Importance

7 Methods

Duplication Side-by-Side

Filter issues like