credentials/providers/ram_role_arn_test.go - Code Metrics - Inspection of "feat: expose internal providers && support init cl..." - aliyun/credentials-go - Measure and Improve Code Quality continuously with Scrutinizer

Passed

Push — master ( 47c2ea...25ec51 )

unknown

created 2024-11-04 03:15 UTC

credentials/providers/ram_role_arn_test.go A

↳ Parent: Project

Size/Duplication

Total Lines	401
Duplicated Lines	0 %

Importance

Changes

Metric	Value
cc	22
eloc	310
dl	0
loc	401
rs	10
c	0
b	0
f	0

8 Methods

Rating	Name	Size	Complexity
A	providers.*errorCredentialsProvider.GetCredentials	3	1
A	providers.TestRAMRoleARNCredentialsProvider_getCredentialsWithRequestCheck	39	3
A	providers.TestRAMRoleARNCredentialsProviderGetCredentialsWithError	16	1
B	providers.TestNewRAMRoleARNCredentialsProvider	116	2
C	providers.TestRAMRoleARNCredentialsProvider_getCredentials	100	8
A	providers.*errorCredentialsProvider.GetProviderName	2	1
B	providers.TestRAMRoleARNCredentialsProviderGetCredentials	73	5
A	providers.TestRAMRoleARNCredentialsProviderWithHttpOptions	21	1

package providers

import (
	"errors"
	"os"
	"strings"
	"testing"
	"time"

	httputil "github.com/aliyun/credentials-go/credentials/internal/http"
	"github.com/aliyun/credentials-go/credentials/internal/utils"
	"github.com/stretchr/testify/assert"
)

func TestNewRAMRoleARNCredentialsProvider(t *testing.T) {
	rollback := utils.Memory("ALIBABA_CLOUD_STS_REGION", "ALIBABA_CLOUD_VPC_ENDPOINT_ENABLED")
	defer func() {
		rollback()
	}()
	// case 1: no credentials provider
	_, err := NewRAMRoleARNCredentialsProviderBuilder().
		Build()
	assert.EqualError(t, err, "must specify a previous credentials provider to assume role")

	// case 2: no role arn
	akProvider, err := NewStaticAKCredentialsProviderBuilder().
		WithAccessKeyId("akid").
		WithAccessKeySecret("aksecret").
		Build()
	assert.Nil(t, err)
	_, err = NewRAMRoleARNCredentialsProviderBuilder().
		WithCredentialsProvider(akProvider).
		Build()
	assert.EqualError(t, err, "the RoleArn is empty")

	// case 3: check default role session name
	p, err := NewRAMRoleARNCredentialsProviderBuilder().
		WithCredentialsProvider(akProvider).
		WithRoleArn("roleArn").
		Build()
	assert.Nil(t, err)
	assert.True(t, strings.HasPrefix(p.roleSessionName, "credentials-go-"))

	// case 4: check default duration seconds
	p, err = NewRAMRoleARNCredentialsProviderBuilder().
		WithCredentialsProvider(akProvider).
		WithRoleArn("roleArn").Build()
	assert.Nil(t, err)
	assert.Equal(t, 3600, p.durationSeconds)

	// case 5: check invalid duration seconds
	_, err = NewRAMRoleARNCredentialsProviderBuilder().
		WithCredentialsProvider(akProvider).
		WithRoleArn("roleArn").
		WithDurationSeconds(100).
		Build()
	assert.EqualError(t, err, "session duration should be in the range of 900s - max session duration")

	// case 6: check all duration seconds
	p, err = NewRAMRoleARNCredentialsProviderBuilder().
		WithCredentialsProvider(akProvider).
		WithRoleArn("roleArn").
		WithStsRegionId("cn-hangzhou").
		WithEnableVpc(true).
		WithPolicy("policy").
		WithExternalId("externalId").
		WithRoleSessionName("rsn").
		WithDurationSeconds(1000).
		Build()
	assert.Nil(t, err)
	assert.Equal(t, "rsn", p.roleSessionName)
	assert.Equal(t, "roleArn", p.roleArn)
	assert.Equal(t, "policy", p.policy)
	assert.Equal(t, "externalId", p.externalId)
	assert.Equal(t, "cn-hangzhou", p.stsRegionId)
	assert.Equal(t, 1000, p.durationSeconds)
	// sts endpoint with sts region
	assert.Equal(t, "sts-vpc.cn-hangzhou.aliyuncs.com", p.stsEndpoint)

	// default sts endpoint
	os.Setenv("ALIBABA_CLOUD_VPC_ENDPOINT_ENABLED", "1")
	p, err = NewRAMRoleARNCredentialsProviderBuilder().
		WithCredentialsProvider(akProvider).
		WithRoleArn("roleArn").
		WithPolicy("policy").
		WithExternalId("externalId").
		WithRoleSessionName("rsn").
		WithDurationSeconds(1000).
		Build()
	assert.Nil(t, err)
	assert.Equal(t, "rsn", p.roleSessionName)
	assert.Equal(t, "roleArn", p.roleArn)
	assert.Equal(t, "policy", p.policy)
	assert.Equal(t, "externalId", p.externalId)
	assert.Equal(t, "", p.stsRegionId)
	assert.Equal(t, 1000, p.durationSeconds)
	assert.Equal(t, "sts.aliyuncs.com", p.stsEndpoint)

	// sts endpoint with env
	os.Setenv("ALIBABA_CLOUD_STS_REGION", "cn-hangzhou")
	os.Setenv("ALIBABA_CLOUD_VPC_ENDPOINT_ENABLED", "True")
	p, err = NewRAMRoleARNCredentialsProviderBuilder().
		WithCredentialsProvider(akProvider).
		WithRoleArn("roleArn").
		WithPolicy("policy").
		WithExternalId("externalId").
		WithRoleSessionName("rsn").
		WithDurationSeconds(1000).
		Build()
	assert.Nil(t, err)
	assert.Equal(t, "sts-vpc.cn-hangzhou.aliyuncs.com", p.stsEndpoint)

	// sts endpoint with sts endpoint
	p, err = NewRAMRoleARNCredentialsProviderBuilder().
		WithCredentialsProvider(akProvider).
		WithRoleArn("roleArn").
		WithStsEndpoint("sts.cn-shanghai.aliyuncs.com").
		WithPolicy("policy").
		WithExternalId("externalId").
		WithRoleSessionName("rsn").
		WithDurationSeconds(1000).
		Build()
	assert.Nil(t, err)
	assert.Equal(t, "rsn", p.roleSessionName)
	assert.Equal(t, "roleArn", p.roleArn)
	assert.Equal(t, "policy", p.policy)
	assert.Equal(t, "externalId", p.externalId)
	assert.Equal(t, "", p.stsRegionId)
	assert.Equal(t, 1000, p.durationSeconds)
	assert.Equal(t, "sts.cn-shanghai.aliyuncs.com", p.stsEndpoint)
}

func TestRAMRoleARNCredentialsProvider_getCredentials(t *testing.T) {
	originHttpDo := httpDo
	defer func() { httpDo = originHttpDo }()

	akProvider, err := NewStaticAKCredentialsProviderBuilder().
		WithAccessKeyId("akid").
		WithAccessKeySecret("aksecret").
		Build()
	assert.Nil(t, err)
	p, err := NewRAMRoleARNCredentialsProviderBuilder().
		WithCredentialsProvider(akProvider).
		WithRoleArn("roleArn").
		WithRoleSessionName("rsn").
		WithDurationSeconds(1000).
		Build()
	assert.Nil(t, err)

	cc, err := akProvider.GetCredentials()
	assert.Nil(t, err)

	// case 1: server error
	httpDo = func(req *httputil.Request) (res *httputil.Response, err error) {
		err = errors.New("mock server error")
		return
	}
	_, err = p.getCredentials(cc)
	assert.NotNil(t, err)
	assert.Equal(t, "mock server error", err.Error())

	// case 2: 4xx error
	httpDo = func(req *httputil.Request) (res *httputil.Response, err error) {
		res = &httputil.Response{
			StatusCode: 400,
			Body:       []byte("4xx error"),
		}
		return
	}

	_, err = p.getCredentials(cc)
	assert.NotNil(t, err)
	assert.Equal(t, "refresh session token failed: 4xx error", err.Error())

	// case 3: invalid json
	httpDo = func(req *httputil.Request) (res *httputil.Response, err error) {
		res = &httputil.Response{
			StatusCode: 200,
			Body:       []byte("invalid json"),
		}
		return
	}
	_, err = p.getCredentials(cc)
	assert.NotNil(t, err)
	assert.Equal(t, "refresh RoleArn sts token err, json.Unmarshal fail: invalid character 'i' looking for beginning of value", err.Error())

	// case 4: empty response json
	httpDo = func(req *httputil.Request) (res *httputil.Response, err error) {
		res = &httputil.Response{
			StatusCode: 200,
			Body:       []byte("null"),
		}
		return
	}
	_, err = p.getCredentials(cc)
	assert.NotNil(t, err)
	assert.Equal(t, "refresh RoleArn sts token err, fail to get credentials", err.Error())

	// case 5: empty session ak response json
	httpDo = func(req *httputil.Request) (res *httputil.Response, err error) {
		res = &httputil.Response{
			StatusCode: 200,
			Body:       []byte(`{"Credentials": {}}`),
		}
		return
	}
	_, err = p.getCredentials(cc)
	assert.NotNil(t, err)
	assert.Equal(t, "refresh RoleArn sts token err, fail to get credentials", err.Error())

	// case 6: mock ok value
	httpDo = func(req *httputil.Request) (res *httputil.Response, err error) {
		res = &httputil.Response{
			StatusCode: 200,
			Body:       []byte(`{"Credentials": {"AccessKeyId":"saki","AccessKeySecret":"saks","Expiration":"2021-10-20T04:27:09Z","SecurityToken":"token"}}`),
		}
		return
	}
	creds, err := p.getCredentials(cc)
	assert.Nil(t, err)
	assert.Equal(t, "saki", creds.AccessKeyId)
	assert.Equal(t, "saks", creds.AccessKeySecret)
	assert.Equal(t, "token", creds.SecurityToken)
	assert.Equal(t, "2021-10-20T04:27:09Z", creds.Expiration)

	// needUpdateCredential
	assert.True(t, p.needUpdateCredential())
	p.expirationTimestamp = time.Now().Unix()
	assert.True(t, p.needUpdateCredential())

	p.expirationTimestamp = time.Now().Unix() + 300
	assert.False(t, p.needUpdateCredential())
}

func TestRAMRoleARNCredentialsProvider_getCredentialsWithRequestCheck(t *testing.T) {
	originHttpDo := httpDo
	defer func() { httpDo = originHttpDo }()

	stsProvider, err := NewStaticSTSCredentialsProviderBuilder().
		WithAccessKeyId("akid").
		WithAccessKeySecret("aksecret").
		WithSecurityToken("ststoken").
		Build()
	assert.Nil(t, err)
	p, err := NewRAMRoleARNCredentialsProviderBuilder().
		WithCredentialsProvider(stsProvider).
		WithRoleArn("roleArn").
		WithRoleSessionName("rsn").
		WithDurationSeconds(1000).
		WithPolicy("policy").
		WithStsRegionId("cn-beijing").
		WithExternalId("externalId").
		Build()
	assert.Nil(t, err)

	// case 1: server error
	httpDo = func(req *httputil.Request) (res *httputil.Response, err error) {
		assert.Equal(t, "sts.cn-beijing.aliyuncs.com", req.Host)
		assert.Equal(t, "ststoken", req.Queries["SecurityToken"])
		assert.Equal(t, "policy", req.Form["Policy"])
		assert.Equal(t, "roleArn", req.Form["RoleArn"])
		assert.Equal(t, "rsn", req.Form["RoleSessionName"])
		assert.Equal(t, "1000", req.Form["DurationSeconds"])

		err = errors.New("mock server error")
		return
	}

	cc, err := stsProvider.GetCredentials()
	assert.Nil(t, err)
	_, err = p.getCredentials(cc)
	assert.NotNil(t, err)
	assert.Equal(t, "mock server error", err.Error())
}

type errorCredentialsProvider struct {
}

func (p *errorCredentialsProvider) GetCredentials() (cc *Credentials, err error) {
	err = errors.New("get credentials failed")
	return
}

func (p *errorCredentialsProvider) GetProviderName() string {
	return "error_credentials_provider"
}

func TestRAMRoleARNCredentialsProviderGetCredentials(t *testing.T) {
	originHttpDo := httpDo
	defer func() { httpDo = originHttpDo }()

	// case 0: get previous credentials failed
	p, err := NewRAMRoleARNCredentialsProviderBuilder().
		WithCredentialsProvider(&errorCredentialsProvider{}).
		WithRoleArn("roleArn").
		WithRoleSessionName("rsn").
		WithDurationSeconds(1000).
		Build()
	assert.Nil(t, err)
	_, err = p.GetCredentials()
	assert.Equal(t, "get credentials failed", err.Error())

	akProvider, err := NewStaticAKCredentialsProviderBuilder().
		WithAccessKeyId("akid").
		WithAccessKeySecret("aksecret").
		Build()
	assert.Nil(t, err)

	p, err = NewRAMRoleARNCredentialsProviderBuilder().
		WithCredentialsProvider(akProvider).
		WithRoleArn("roleArn").
		WithRoleSessionName("rsn").
		WithDurationSeconds(1000).
		Build()
	assert.Nil(t, err)

	// case 1: get credentials failed
	httpDo = func(req *httputil.Request) (res *httputil.Response, err error) {
		err = errors.New("mock server error")
		return
	}
	_, err = p.GetCredentials()
	assert.NotNil(t, err)
	assert.Equal(t, "mock server error", err.Error())

	// case 2: get invalid expiration
	httpDo = func(req *httputil.Request) (res *httputil.Response, err error) {
		res = &httputil.Response{
			StatusCode: 200,
			Body:       []byte(`{"Credentials": {"AccessKeyId":"akid","AccessKeySecret":"aksecret","Expiration":"invalidexpiration","SecurityToken":"ststoken"}}`),
		}
		return
	}
	_, err = p.GetCredentials()
	assert.NotNil(t, err)
	assert.Equal(t, "parsing time \"invalidexpiration\" as \"2006-01-02T15:04:05Z\": cannot parse \"invalidexpiration\" as \"2006\"", err.Error())

	// case 3: happy result
	httpDo = func(req *httputil.Request) (res *httputil.Response, err error) {
		res = &httputil.Response{
			StatusCode: 200,
			Body:       []byte(`{"Credentials": {"AccessKeyId":"akid","AccessKeySecret":"aksecret","Expiration":"2021-10-20T04:27:09Z","SecurityToken":"ststoken"}}`),
		}
		return
	}
	cc, err := p.GetCredentials()
	assert.Nil(t, err)
	assert.Equal(t, "akid", cc.AccessKeyId)
	assert.Equal(t, "aksecret", cc.AccessKeySecret)
	assert.Equal(t, "ststoken", cc.SecurityToken)
	assert.Equal(t, "ram_role_arn/static_ak", cc.ProviderName)
	assert.True(t, p.needUpdateCredential())
	// get credentials again
	cc, err = p.GetCredentials()
	assert.Nil(t, err)
	assert.Equal(t, "akid", cc.AccessKeyId)
	assert.Equal(t, "aksecret", cc.AccessKeySecret)
	assert.Equal(t, "ststoken", cc.SecurityToken)
	assert.Equal(t, "ram_role_arn/static_ak", cc.ProviderName)
	assert.True(t, p.needUpdateCredential())
}

func TestRAMRoleARNCredentialsProviderGetCredentialsWithError(t *testing.T) {
	akProvider, err := NewStaticAKCredentialsProviderBuilder().
		WithAccessKeyId("akid").
		WithAccessKeySecret("aksecret").
		Build()
	assert.Nil(t, err)
	p, err := NewRAMRoleARNCredentialsProviderBuilder().
		WithCredentialsProvider(akProvider).
		WithRoleArn("roleArn").
		WithRoleSessionName("rsn").
		WithDurationSeconds(1000).
		Build()
	assert.Nil(t, err)
	_, err = p.GetCredentials()
	assert.NotNil(t, err)
	assert.Contains(t, err.Error(), "InvalidAccessKeyId.NotFound")
}

func TestRAMRoleARNCredentialsProviderWithHttpOptions(t *testing.T) {
	akProvider, err := NewStaticAKCredentialsProviderBuilder().
		WithAccessKeyId("akid").
		WithAccessKeySecret("aksecret").
		Build()
	assert.Nil(t, err)
	p, err := NewRAMRoleARNCredentialsProviderBuilder().
		WithCredentialsProvider(akProvider).
		WithRoleArn("roleArn").
		WithRoleSessionName("rsn").
		WithDurationSeconds(1000).
		WithHttpOptions(&HttpOptions{
			ConnectTimeout: 1,
			ReadTimeout:    1,
			Proxy:          "localhost:3999",
		}).
		Build()
	assert.Nil(t, err)
	_, err = p.GetCredentials()
	assert.NotNil(t, err)
	assert.Contains(t, err.Error(), "proxyconnect tcp:")
}


1			package providers
2
3			import (
4			"errors"
5			"os"
6			"strings"
7			"testing"
8			"time"
9
10			httputil "github.com/aliyun/credentials-go/credentials/internal/http"
11			"github.com/aliyun/credentials-go/credentials/internal/utils"
12			"github.com/stretchr/testify/assert"
13			)
14
15			func TestNewRAMRoleARNCredentialsProvider(t *testing.T) {
16			rollback := utils.Memory("ALIBABA_CLOUD_STS_REGION", "ALIBABA_CLOUD_VPC_ENDPOINT_ENABLED")
17			defer func() {
18			rollback()
19			}()
20			// case 1: no credentials provider
21			_, err := NewRAMRoleARNCredentialsProviderBuilder().
22			Build()
23			assert.EqualError(t, err, "must specify a previous credentials provider to assume role")
24
25			// case 2: no role arn
26			akProvider, err := NewStaticAKCredentialsProviderBuilder().
27			WithAccessKeyId("akid").
28			WithAccessKeySecret("aksecret").
29			Build()
30			assert.Nil(t, err)
31			_, err = NewRAMRoleARNCredentialsProviderBuilder().
32			WithCredentialsProvider(akProvider).
33			Build()
34			assert.EqualError(t, err, "the RoleArn is empty")
35
36			// case 3: check default role session name
37			p, err := NewRAMRoleARNCredentialsProviderBuilder().
38			WithCredentialsProvider(akProvider).
39			WithRoleArn("roleArn").
40			Build()
41			assert.Nil(t, err)
42			assert.True(t, strings.HasPrefix(p.roleSessionName, "credentials-go-"))
43
44			// case 4: check default duration seconds
45			p, err = NewRAMRoleARNCredentialsProviderBuilder().
46			WithCredentialsProvider(akProvider).
47			WithRoleArn("roleArn").Build()
48			assert.Nil(t, err)
49			assert.Equal(t, 3600, p.durationSeconds)
50
51			// case 5: check invalid duration seconds
52			_, err = NewRAMRoleARNCredentialsProviderBuilder().
53			WithCredentialsProvider(akProvider).
54			WithRoleArn("roleArn").
55			WithDurationSeconds(100).
56			Build()
57			assert.EqualError(t, err, "session duration should be in the range of 900s - max session duration")
58
59			// case 6: check all duration seconds
60			p, err = NewRAMRoleARNCredentialsProviderBuilder().
61			WithCredentialsProvider(akProvider).
62			WithRoleArn("roleArn").
63			WithStsRegionId("cn-hangzhou").
64			WithEnableVpc(true).
65			WithPolicy("policy").
66			WithExternalId("externalId").
67			WithRoleSessionName("rsn").
68			WithDurationSeconds(1000).
69			Build()
70			assert.Nil(t, err)
71			assert.Equal(t, "rsn", p.roleSessionName)
72			assert.Equal(t, "roleArn", p.roleArn)
73			assert.Equal(t, "policy", p.policy)
74			assert.Equal(t, "externalId", p.externalId)
75			assert.Equal(t, "cn-hangzhou", p.stsRegionId)
76			assert.Equal(t, 1000, p.durationSeconds)
77			// sts endpoint with sts region
78			assert.Equal(t, "sts-vpc.cn-hangzhou.aliyuncs.com", p.stsEndpoint)
79
80			// default sts endpoint
81			os.Setenv("ALIBABA_CLOUD_VPC_ENDPOINT_ENABLED", "1")
82			p, err = NewRAMRoleARNCredentialsProviderBuilder().
83			WithCredentialsProvider(akProvider).
84			WithRoleArn("roleArn").
85			WithPolicy("policy").
86			WithExternalId("externalId").
87			WithRoleSessionName("rsn").
88			WithDurationSeconds(1000).
89			Build()
90			assert.Nil(t, err)
91			assert.Equal(t, "rsn", p.roleSessionName)
92			assert.Equal(t, "roleArn", p.roleArn)
93			assert.Equal(t, "policy", p.policy)
94			assert.Equal(t, "externalId", p.externalId)
95			assert.Equal(t, "", p.stsRegionId)
96			assert.Equal(t, 1000, p.durationSeconds)
97			assert.Equal(t, "sts.aliyuncs.com", p.stsEndpoint)
98
99			// sts endpoint with env
100			os.Setenv("ALIBABA_CLOUD_STS_REGION", "cn-hangzhou")
101			os.Setenv("ALIBABA_CLOUD_VPC_ENDPOINT_ENABLED", "True")
102			p, err = NewRAMRoleARNCredentialsProviderBuilder().
103			WithCredentialsProvider(akProvider).
104			WithRoleArn("roleArn").
105			WithPolicy("policy").
106			WithExternalId("externalId").
107			WithRoleSessionName("rsn").
108			WithDurationSeconds(1000).
109			Build()
110			assert.Nil(t, err)
111			assert.Equal(t, "sts-vpc.cn-hangzhou.aliyuncs.com", p.stsEndpoint)
112
113			// sts endpoint with sts endpoint
114			p, err = NewRAMRoleARNCredentialsProviderBuilder().
115			WithCredentialsProvider(akProvider).
116			WithRoleArn("roleArn").
117			WithStsEndpoint("sts.cn-shanghai.aliyuncs.com").
118			WithPolicy("policy").
119			WithExternalId("externalId").
120			WithRoleSessionName("rsn").
121			WithDurationSeconds(1000).
122			Build()
123			assert.Nil(t, err)
124			assert.Equal(t, "rsn", p.roleSessionName)
125			assert.Equal(t, "roleArn", p.roleArn)
126			assert.Equal(t, "policy", p.policy)
127			assert.Equal(t, "externalId", p.externalId)
128			assert.Equal(t, "", p.stsRegionId)
129			assert.Equal(t, 1000, p.durationSeconds)
130			assert.Equal(t, "sts.cn-shanghai.aliyuncs.com", p.stsEndpoint)
131			}
132
133			func TestRAMRoleARNCredentialsProvider_getCredentials(t *testing.T) {
134			originHttpDo := httpDo
135			defer func() { httpDo = originHttpDo }()
136
137			akProvider, err := NewStaticAKCredentialsProviderBuilder().
138			WithAccessKeyId("akid").
139			WithAccessKeySecret("aksecret").
140			Build()
141			assert.Nil(t, err)
142			p, err := NewRAMRoleARNCredentialsProviderBuilder().
143			WithCredentialsProvider(akProvider).
144			WithRoleArn("roleArn").
145			WithRoleSessionName("rsn").
146			WithDurationSeconds(1000).
147			Build()
148			assert.Nil(t, err)
149
150			cc, err := akProvider.GetCredentials()
151			assert.Nil(t, err)
152
153			// case 1: server error
154			httpDo = func(req httputil.Request) (res httputil.Response, err error) {
155			err = errors.New("mock server error")
156			return
157			}
158			_, err = p.getCredentials(cc)
159			assert.NotNil(t, err)
160			assert.Equal(t, "mock server error", err.Error())
161
162			// case 2: 4xx error
163			httpDo = func(req httputil.Request) (res httputil.Response, err error) {
164			res = &httputil.Response{
165			StatusCode: 400,
166			Body: []byte("4xx error"),
167			}
168			return
169			}
170
171			_, err = p.getCredentials(cc)
172			assert.NotNil(t, err)
173			assert.Equal(t, "refresh session token failed: 4xx error", err.Error())
174
175			// case 3: invalid json
176			httpDo = func(req httputil.Request) (res httputil.Response, err error) {
177			res = &httputil.Response{
178			StatusCode: 200,
179			Body: []byte("invalid json"),
180			}
181			return
182			}
183			_, err = p.getCredentials(cc)
184			assert.NotNil(t, err)
185			assert.Equal(t, "refresh RoleArn sts token err, json.Unmarshal fail: invalid character 'i' looking for beginning of value", err.Error())
186
187			// case 4: empty response json
188			httpDo = func(req httputil.Request) (res httputil.Response, err error) {
189			res = &httputil.Response{
190			StatusCode: 200,
191			Body: []byte("null"),
192			}
193			return
194			}
195			_, err = p.getCredentials(cc)
196			assert.NotNil(t, err)
197			assert.Equal(t, "refresh RoleArn sts token err, fail to get credentials", err.Error())
198
199			// case 5: empty session ak response json
200			httpDo = func(req httputil.Request) (res httputil.Response, err error) {
201			res = &httputil.Response{
202			StatusCode: 200,
203			Body: []byte(`{"Credentials": {}}`),
204			}
205			return
206			}
207			_, err = p.getCredentials(cc)
208			assert.NotNil(t, err)
209			assert.Equal(t, "refresh RoleArn sts token err, fail to get credentials", err.Error())
210
211			// case 6: mock ok value
212			httpDo = func(req httputil.Request) (res httputil.Response, err error) {
213			res = &httputil.Response{
214			StatusCode: 200,
215			Body: []byte(`{"Credentials": {"AccessKeyId":"saki","AccessKeySecret":"saks","Expiration":"2021-10-20T04:27:09Z","SecurityToken":"token"}}`),
216			}
217			return
218			}
219			creds, err := p.getCredentials(cc)
220			assert.Nil(t, err)
221			assert.Equal(t, "saki", creds.AccessKeyId)
222			assert.Equal(t, "saks", creds.AccessKeySecret)
223			assert.Equal(t, "token", creds.SecurityToken)
224			assert.Equal(t, "2021-10-20T04:27:09Z", creds.Expiration)
225
226			// needUpdateCredential
227			assert.True(t, p.needUpdateCredential())
228			p.expirationTimestamp = time.Now().Unix()
229			assert.True(t, p.needUpdateCredential())
230
231			p.expirationTimestamp = time.Now().Unix() + 300
232			assert.False(t, p.needUpdateCredential())
233			}
234
235			func TestRAMRoleARNCredentialsProvider_getCredentialsWithRequestCheck(t *testing.T) {
236			originHttpDo := httpDo
237			defer func() { httpDo = originHttpDo }()
238
239			stsProvider, err := NewStaticSTSCredentialsProviderBuilder().
240			WithAccessKeyId("akid").
241			WithAccessKeySecret("aksecret").
242			WithSecurityToken("ststoken").
243			Build()
244			assert.Nil(t, err)
245			p, err := NewRAMRoleARNCredentialsProviderBuilder().
246			WithCredentialsProvider(stsProvider).
247			WithRoleArn("roleArn").
248			WithRoleSessionName("rsn").
249			WithDurationSeconds(1000).
250			WithPolicy("policy").
251			WithStsRegionId("cn-beijing").
252			WithExternalId("externalId").
253			Build()
254			assert.Nil(t, err)
255
256			// case 1: server error
257			httpDo = func(req httputil.Request) (res httputil.Response, err error) {
258			assert.Equal(t, "sts.cn-beijing.aliyuncs.com", req.Host)
259			assert.Equal(t, "ststoken", req.Queries["SecurityToken"])
260			assert.Equal(t, "policy", req.Form["Policy"])
261			assert.Equal(t, "roleArn", req.Form["RoleArn"])
262			assert.Equal(t, "rsn", req.Form["RoleSessionName"])
263			assert.Equal(t, "1000", req.Form["DurationSeconds"])
264
265			err = errors.New("mock server error")
266			return
267			}
268
269			cc, err := stsProvider.GetCredentials()
270			assert.Nil(t, err)
271			_, err = p.getCredentials(cc)
272			assert.NotNil(t, err)
273			assert.Equal(t, "mock server error", err.Error())
274			}
275
276			type errorCredentialsProvider struct {
277			}
278
279			func (p errorCredentialsProvider) GetCredentials() (cc Credentials, err error) {
280			err = errors.New("get credentials failed")
281			return
282			}
283
284			func (p *errorCredentialsProvider) GetProviderName() string {
285			return "error_credentials_provider"
286			}
287
288			func TestRAMRoleARNCredentialsProviderGetCredentials(t *testing.T) {
289			originHttpDo := httpDo
290			defer func() { httpDo = originHttpDo }()
291
292			// case 0: get previous credentials failed
293			p, err := NewRAMRoleARNCredentialsProviderBuilder().
294			WithCredentialsProvider(&errorCredentialsProvider{}).
295			WithRoleArn("roleArn").
296			WithRoleSessionName("rsn").
297			WithDurationSeconds(1000).
298			Build()
299			assert.Nil(t, err)
300			_, err = p.GetCredentials()
301			assert.Equal(t, "get credentials failed", err.Error())
302
303			akProvider, err := NewStaticAKCredentialsProviderBuilder().
304			WithAccessKeyId("akid").
305			WithAccessKeySecret("aksecret").
306			Build()
307			assert.Nil(t, err)
308
309			p, err = NewRAMRoleARNCredentialsProviderBuilder().
310			WithCredentialsProvider(akProvider).
311			WithRoleArn("roleArn").
312			WithRoleSessionName("rsn").
313			WithDurationSeconds(1000).
314			Build()
315			assert.Nil(t, err)
316
317			// case 1: get credentials failed
318			httpDo = func(req httputil.Request) (res httputil.Response, err error) {
319			err = errors.New("mock server error")
320			return
321			}
322			_, err = p.GetCredentials()
323			assert.NotNil(t, err)
324			assert.Equal(t, "mock server error", err.Error())
325
326			// case 2: get invalid expiration
327			httpDo = func(req httputil.Request) (res httputil.Response, err error) {
328			res = &httputil.Response{
329			StatusCode: 200,
330			Body: []byte(`{"Credentials": {"AccessKeyId":"akid","AccessKeySecret":"aksecret","Expiration":"invalidexpiration","SecurityToken":"ststoken"}}`),
331			}
332			return
333			}
334			_, err = p.GetCredentials()
335			assert.NotNil(t, err)
336			assert.Equal(t, "parsing time \"invalidexpiration\" as \"2006-01-02T15:04:05Z\": cannot parse \"invalidexpiration\" as \"2006\"", err.Error())
337
338			// case 3: happy result
339			httpDo = func(req httputil.Request) (res httputil.Response, err error) {
340			res = &httputil.Response{
341			StatusCode: 200,
342			Body: []byte(`{"Credentials": {"AccessKeyId":"akid","AccessKeySecret":"aksecret","Expiration":"2021-10-20T04:27:09Z","SecurityToken":"ststoken"}}`),
343			}
344			return
345			}
346			cc, err := p.GetCredentials()
347			assert.Nil(t, err)
348			assert.Equal(t, "akid", cc.AccessKeyId)
349			assert.Equal(t, "aksecret", cc.AccessKeySecret)
350			assert.Equal(t, "ststoken", cc.SecurityToken)
351			assert.Equal(t, "ram_role_arn/static_ak", cc.ProviderName)
352			assert.True(t, p.needUpdateCredential())
353			// get credentials again
354			cc, err = p.GetCredentials()
355			assert.Nil(t, err)
356			assert.Equal(t, "akid", cc.AccessKeyId)
357			assert.Equal(t, "aksecret", cc.AccessKeySecret)
358			assert.Equal(t, "ststoken", cc.SecurityToken)
359			assert.Equal(t, "ram_role_arn/static_ak", cc.ProviderName)
360			assert.True(t, p.needUpdateCredential())
361			}
362
363			func TestRAMRoleARNCredentialsProviderGetCredentialsWithError(t *testing.T) {
364			akProvider, err := NewStaticAKCredentialsProviderBuilder().
365			WithAccessKeyId("akid").
366			WithAccessKeySecret("aksecret").
367			Build()
368			assert.Nil(t, err)
369			p, err := NewRAMRoleARNCredentialsProviderBuilder().
370			WithCredentialsProvider(akProvider).
371			WithRoleArn("roleArn").
372			WithRoleSessionName("rsn").
373			WithDurationSeconds(1000).
374			Build()
375			assert.Nil(t, err)
376			_, err = p.GetCredentials()
377			assert.NotNil(t, err)
378			assert.Contains(t, err.Error(), "InvalidAccessKeyId.NotFound")
379			}
380
381			func TestRAMRoleARNCredentialsProviderWithHttpOptions(t *testing.T) {
382			akProvider, err := NewStaticAKCredentialsProviderBuilder().
383			WithAccessKeyId("akid").
384			WithAccessKeySecret("aksecret").
385			Build()
386			assert.Nil(t, err)
387			p, err := NewRAMRoleARNCredentialsProviderBuilder().
388			WithCredentialsProvider(akProvider).
389			WithRoleArn("roleArn").
390			WithRoleSessionName("rsn").
391			WithDurationSeconds(1000).
392			WithHttpOptions(&HttpOptions{
393			ConnectTimeout: 1,
394			ReadTimeout: 1,
395			Proxy: "localhost:3999",
396			}).
397			Build()
398			assert.Nil(t, err)
399			_, err = p.GetCredentials()
400			assert.NotNil(t, err)
401			assert.Contains(t, err.Error(), "proxyconnect tcp:")
402			}
403

aliyun / credentials-go

GitHub Access Token became invalid

Push — master ( 47c2ea...25ec51 )

credentials/providers/ram_role_arn_test.go A

Size/Duplication

Importance

8 Methods

Duplication Side-by-Side

Filter issues like