aliyun / credentials-go

import (

	"encoding/json"

	"fmt"

	"io/ioutil"

	"os"

	"path"

	"strings"

	"sync"

	"testing"

	"time"

	httputil "github.com/aliyun/credentials-go/credentials/internal/http"

	"github.com/aliyun/credentials-go/credentials/internal/utils"

	"github.com/stretchr/testify/assert"

)

func TestCLIProfileCredentialsProvider(t *testing.T) {

	rollback := utils.Memory("ALIBABA_CLOUD_PROFILE", "ALIBABA_CLOUD_CLI_PROFILE_DISABLED")

	defer rollback()

	b, err := NewCLIProfileCredentialsProviderBuilder().

		Build()

	assert.Nil(t, err)

	assert.Equal(t, "", b.profileName)

	// get from env

	os.Setenv("ALIBABA_CLOUD_PROFILE", "custom_profile")

	b, err = NewCLIProfileCredentialsProviderBuilder().

		Build()

	assert.Nil(t, err)

	assert.Equal(t, "custom_profile", b.profileName)

	b, err = NewCLIProfileCredentialsProviderBuilder().

		WithProfileName("profilename").

		Build()

	assert.Nil(t, err)

	assert.Equal(t, "profilename", b.profileName)

	os.Setenv("ALIBABA_CLOUD_CLI_PROFILE_DISABLED", "True")

	_, err = NewCLIProfileCredentialsProviderBuilder().

		WithProfileName("profilename").

		Build()

	assert.Nil(t, err)

	assert.Equal(t, p.Name, "jacksontian")

	assert.Equal(t, p.Mode, "AK")

}

func TestCLIProfileCredentialsProvider_getCredentialsProvider(t *testing.T) {

	conf := &configuration{

		Current: "AK",

		Profiles: []*profile{

			{

				Mode:            "AK",

				Name:            "AK",

				AccessKeyID:     "akid",

				AccessKeySecret: "secret",

			},

			{

				Mode:            "StsToken",

				Name:            "StsToken",

				AccessKeyID:     "access_key_id",

				AccessKeySecret: "access_key_secret",

				SecurityToken:   "sts_token",

			},

			{

				Mode:            "RamRoleArn",

				Name:            "RamRoleArn",

				AccessKeyID:     "akid",

				AccessKeySecret: "secret",

				RoleArn:         "arn",

				StsRegion:       "cn-hangzhou",

				EnableVpc:       true,

				Policy:          "policy",

				ExternalId:      "externalId",

			},

			{

				Mode: "RamRoleArn",

				Name: "Invalid_RamRoleArn",

			},

			{

				Mode:     "EcsRamRole",

				Name:     "EcsRamRole",

				RoleName: "rolename",

			},

			{

				Mode:            "OIDC",

				Name:            "OIDC",

				RoleArn:         "role_arn",

				OIDCTokenFile:   "path/to/oidc/file",

				OIDCProviderARN: "provider_arn",

				StsRegion:       "cn-hangzhou",

				EnableVpc:       true,

				Policy:          "policy",

			},

			{

				Mode:          "ChainableRamRoleArn",

				Name:          "ChainableRamRoleArn",

				RoleArn:       "arn",

				SourceProfile: "AK",

			},

			{

				Mode:          "ChainableRamRoleArn",

				Name:          "ChainableRamRoleArn2",

				SourceProfile: "InvalidSource",

			},

			{

				Name:              "CloudSSO",

				Mode:              "CloudSSO",

				SignInUrl:         "url",

				AccessToken:       "token",

				AccessTokenExpire: time.Now().Unix() + 1000,

				AccessConfig:      "config",

				AccountId:         "uid",

			},

			{

				Mode:                   "OAuth",

				Name:                   "OAuth",

				OauthSiteType:          "CN",

				OauthRefreshToken:      "refresh_token",

				OauthAccessToken:       "access_token",

				OauthAccessTokenExpire: time.Now().Unix() + 1000,

			},

			{

				Mode: "Unsupported",

				Name: "Unsupported",

			},

		},

	}

	provider, err := NewCLIProfileCredentialsProviderBuilder().Build()

	assert.Nil(t, err)

	_, err = provider.getCredentialsProvider(conf, "inexist")

	assert.EqualError(t, err, "unable to get profile with 'inexist'")

	// AK

	cp, err := provider.getCredentialsProvider(conf, "AK")

	assert.Nil(t, err)

	akcp, ok := cp.(*StaticAKCredentialsProvider)

	assert.True(t, ok)

	cc, err := akcp.GetCredentials()

	assert.Nil(t, err)

	assert.Equal(t, cc, &Credentials{AccessKeyId: "akid", AccessKeySecret: "secret", SecurityToken: "", ProviderName: "static_ak"})

	// STS

	cp, err = provider.getCredentialsProvider(conf, "StsToken")

	assert.Nil(t, err)

	stscp, ok := cp.(*StaticSTSCredentialsProvider)

	assert.True(t, ok)

	cc, err = stscp.GetCredentials()

	assert.Nil(t, err)

	assert.Equal(t, cc, &Credentials{AccessKeyId: "access_key_id", AccessKeySecret: "access_key_secret", SecurityToken: "sts_token", ProviderName: "static_sts"})

	// RamRoleArn

	cp, err = provider.getCredentialsProvider(conf, "RamRoleArn")

	assert.Nil(t, err)

	_, ok = cp.(*RAMRoleARNCredentialsProvider)

	assert.True(t, ok)

	// RamRoleArn invalid ak

	_, err = provider.getCredentialsProvider(conf, "Invalid_RamRoleArn")

	assert.EqualError(t, err, "the access key id is empty")

	// EcsRamRole

	cp, err = provider.getCredentialsProvider(conf, "EcsRamRole")

	assert.Nil(t, err)

	_, ok = cp.(*ECSRAMRoleCredentialsProvider)

	assert.True(t, ok)

	// OIDC

	cp, err = provider.getCredentialsProvider(conf, "OIDC")

	assert.Nil(t, err)

	_, ok = cp.(*OIDCCredentialsProvider)

	assert.True(t, ok)

	// ChainableRamRoleArn

	cp, err = provider.getCredentialsProvider(conf, "ChainableRamRoleArn")

	assert.Nil(t, err)

	_, ok = cp.(*RAMRoleARNCredentialsProvider)

	assert.True(t, ok)

	// CloudSSO

	cp, err = provider.getCredentialsProvider(conf, "CloudSSO")

	assert.Nil(t, err)

	_, ok = cp.(*CloudSSOCredentialsProvider)

	assert.True(t, ok)

	// OAuth

	cp, err = provider.getCredentialsProvider(conf, "OAuth")

	assert.Nil(t, err)

	_, ok = cp.(*OAuthCredentialsProvider)

	assert.True(t, ok)

	// ChainableRamRoleArn with invalid source profile

	_, err = provider.getCredentialsProvider(conf, "ChainableRamRoleArn2")

	assert.EqualError(t, err, "get source profile failed: unable to get profile with 'InvalidSource'")

	// Unsupported

	_, err = provider.getCredentialsProvider(conf, "Unsupported")

	assert.EqualError(t, err, "unsupported profile mode 'Unsupported'")

}

func TestCLIProfileCredentialsProvider_OAuthProfile(t *testing.T) {

	// Test OAuth profile with CN site type

	conf := &configuration{

		Current: "OAuthCN",

		Profiles: []*profile{

			{

				Mode:                   "OAuth",

				Name:                   "OAuthCN",

				OauthSiteType:          "CN",

				OauthRefreshToken:      "refresh_token",

				OauthAccessToken:       "access_token",

				OauthAccessTokenExpire: time.Now().Unix() + 1000,

			},

			{

				Mode:                   "OAuth",

				Name:                   "OAuthINTL",

				OauthSiteType:          "INTL",

				OauthRefreshToken:      "refresh_token",

				OauthAccessToken:       "access_token",

				OauthAccessTokenExpire: time.Now().Unix() + 1000,

			},

			{

				Mode:                   "OAuth",

				Name:                   "OAuthInvalid",

				OauthSiteType:          "INVALID",

				OauthRefreshToken:      "refresh_token",

				OauthAccessToken:       "access_token",

				OauthAccessTokenExpire: time.Now().Unix() + 1000,

			},

		},

	}

	provider, err := NewCLIProfileCredentialsProviderBuilder().Build()

	assert.Nil(t, err)

	// Test CN OAuth profile

	cp, err := provider.getCredentialsProvider(conf, "OAuthCN")

	assert.Nil(t, err)

	oauthProvider, ok := cp.(*OAuthCredentialsProvider)

	assert.True(t, ok)

	assert.Equal(t, "https://oauth.aliyun.com", oauthProvider.signInUrl)

	assert.Equal(t, "4038181954557748008", oauthProvider.clientId)

	assert.Equal(t, "refresh_token", oauthProvider.refreshToken)

	assert.Equal(t, "access_token", oauthProvider.accessToken)

	// Test INTL OAuth profile

	cp, err = provider.getCredentialsProvider(conf, "OAuthINTL")

	assert.Nil(t, err)

	oauthProvider, ok = cp.(*OAuthCredentialsProvider)

	assert.True(t, ok)

	assert.Equal(t, "https://oauth.alibabacloud.com", oauthProvider.signInUrl)

	assert.Equal(t, "4103531455503354461", oauthProvider.clientId)

	// Test invalid site type

	_, err = provider.getCredentialsProvider(conf, "OAuthInvalid")

	assert.EqualError(t, err, "invalid site type, support CN or INTL")

}

func TestCLIProfileCredentialsProvider_updateOAuthTokens(t *testing.T) {

	// 创建临时配置文件用于测试

	tempDir, err := ioutil.TempDir("", "oauth_test")

	assert.Nil(t, err)

	defer os.RemoveAll(tempDir)

	configPath := path.Join(tempDir, "config.json")

	// 创建测试配置

	testConfig := &configuration{

		Current: "OAuthTest",

		Profiles: []*profile{

			{

				Mode:                   "OAuth",

				Name:                   "OAuthTest",

				OauthSiteType:          "CN",

				OauthRefreshToken:      "old_refresh_token",

				OauthAccessToken:       "old_access_token",

				OauthAccessTokenExpire: time.Now().Unix() + 1000,

			},

		},

	}

	// 写入测试配置

	data, err := json.MarshalIndent(testConfig, "", "    ")

	assert.Nil(t, err)

	err = ioutil.WriteFile(configPath, data, 0644)

	assert.Nil(t, err)

	// 创建CLI Profile提供者

	provider, err := NewCLIProfileCredentialsProviderBuilder().

		WithProfileFile(configPath).

		WithProfileName("OAuthTest").

		Build()

	assert.Nil(t, err)

	// 测试更新OAuth令牌

	newRefreshToken := "new_refresh_token"

	newAccessToken := "new_access_token"

	newAccessKey := "new_access_key"

	newSecret := "new_secret"

	newSecurityToken := "new_security_token"

	newExpireTime := time.Now().Unix() + 3600

	newStsExpire := time.Now().Unix() + 7200

	err = provider.updateOAuthTokens(newRefreshToken, newAccessToken, newAccessKey, newSecret, newSecurityToken, newExpireTime, newStsExpire)

	assert.Nil(t, err)

	// 验证配置文件已更新

	updatedConf, err := newConfigurationFromPath(configPath)

	assert.Nil(t, err)

	updatedProfile, err := updatedConf.getProfile("OAuthTest")

	assert.Nil(t, err)

	assert.Equal(t, newRefreshToken, updatedProfile.OauthRefreshToken)

	assert.Equal(t, newAccessToken, updatedProfile.OauthAccessToken)

	assert.Equal(t, newAccessKey, updatedProfile.AccessKeyID)

	assert.Equal(t, newSecret, updatedProfile.AccessKeySecret)

	assert.Equal(t, newSecurityToken, updatedProfile.SecurityToken)

	assert.Equal(t, newExpireTime, updatedProfile.OauthAccessTokenExpire)

	assert.Equal(t, newStsExpire, updatedProfile.StsExpire)

}

func TestCLIProfileCredentialsProvider_writeConfigurationToFile(t *testing.T) {

	// 创建临时配置文件用于测试

	tempDir, err := ioutil.TempDir("", "oauth_write_test")

	assert.Nil(t, err)

	defer os.RemoveAll(tempDir)

	configPath := path.Join(tempDir, "config.json")

	// 创建测试配置

	testConfig := &configuration{

		Current: "OAuthTest",

		Profiles: []*profile{

			{

				Mode:                   "OAuth",

				Name:                   "OAuthTest",

				OauthSiteType:          "CN",

				OauthRefreshToken:      "test_refresh_token",

				OauthAccessToken:       "test_access_token",

				OauthAccessTokenExpire: time.Now().Unix() + 1000,

			},

		},

	}

	// 创建CLI Profile提供者

	provider, err := NewCLIProfileCredentialsProviderBuilder().

		WithProfileFile(configPath).

		WithProfileName("OAuthTest").

		Build()

	assert.Nil(t, err)

	// 测试writeConfigurationToFile函数

	err = provider.writeConfigurationToFile(configPath, testConfig)

	assert.Nil(t, err)

	// 验证文件已写入

	_, err = os.Stat(configPath)

	assert.Nil(t, err)

	// 验证文件内容

	updatedConf, err := newConfigurationFromPath(configPath)

	assert.Nil(t, err)

	assert.Equal(t, testConfig.Current, updatedConf.Current)

	assert.Equal(t, len(testConfig.Profiles), len(updatedConf.Profiles))

}

func TestCLIProfileCredentialsProvider_writeConfigurationToFile_Error(t *testing.T) {

	// 创建临时目录用于测试

	tempDir, err := ioutil.TempDir("", "oauth_write_error_test")

	assert.Nil(t, err)

	defer os.RemoveAll(tempDir)

	// 创建一个只读目录来测试写入错误

	readOnlyDir := path.Join(tempDir, "readonly")

	err = os.Mkdir(readOnlyDir, 0444) // 只读权限

	assert.Nil(t, err)

	configPath := path.Join(readOnlyDir, "config.json")

	// 创建测试配置

	testConfig := &configuration{

		Current: "OAuthTest",

		Profiles: []*profile{

			{

				Mode:                   "OAuth",

				Name:                   "OAuthTest",

				OauthSiteType:          "CN",

				OauthRefreshToken:      "test_refresh_token",

				OauthAccessToken:       "test_access_token",

				OauthAccessTokenExpire: time.Now().Unix() + 1000,

			},

		},

	}

	// 创建CLI Profile提供者

	provider, err := NewCLIProfileCredentialsProviderBuilder().

		WithProfileFile(configPath).

		WithProfileName("OAuthTest").

		Build()

	assert.Nil(t, err)

	// 测试写入只读目录应该失败

	err = provider.writeConfigurationToFile(configPath, testConfig)

	assert.NotNil(t, err)

	assert.Contains(t, err.Error(), "failed to write temp file")

}

func TestCLIProfileCredentialsProvider_writeConfigurationToFileWithLock(t *testing.T) {

	// 创建临时配置文件用于测试

	tempDir, err := ioutil.TempDir("", "oauth_write_lock_test")

	assert.Nil(t, err)

	defer os.RemoveAll(tempDir)

	configPath := path.Join(tempDir, "config.json")

	// 创建测试配置

	testConfig := &configuration{

		Current: "OAuthTest",

		Profiles: []*profile{

			{

				Mode:                   "OAuth",

				Name:                   "OAuthTest",

				OauthSiteType:          "CN",

				OauthRefreshToken:      "test_refresh_token",

				OauthAccessToken:       "test_access_token",

				OauthAccessTokenExpire: time.Now().Unix() + 1000,

			},

		},

	}

	// 创建CLI Profile提供者

	provider, err := NewCLIProfileCredentialsProviderBuilder().

		WithProfileFile(configPath).

		WithProfileName("OAuthTest").

		Build()

	assert.Nil(t, err)

	// 测试writeConfigurationToFileWithLock函数

	err = provider.writeConfigurationToFileWithLock(configPath, testConfig)

	assert.Nil(t, err)

	// 验证文件已写入

	_, err = os.Stat(configPath)

	assert.Nil(t, err)

	// 验证文件内容

	updatedConf, err := newConfigurationFromPath(configPath)

	assert.Nil(t, err)

	assert.Equal(t, testConfig.Current, updatedConf.Current)

	assert.Equal(t, len(testConfig.Profiles), len(updatedConf.Profiles))

}

func TestCLIProfileCredentialsProvider_writeConfigurationToFileWithLock_Error(t *testing.T) {

	// 创建临时目录用于测试

	tempDir, err := ioutil.TempDir("", "oauth_write_lock_error_test")

	assert.Nil(t, err)

	defer os.RemoveAll(tempDir)

	// 创建一个只读目录来测试写入错误

	readOnlyDir := path.Join(tempDir, "readonly")

	err = os.Mkdir(readOnlyDir, 0444) // 只读权限

	assert.Nil(t, err)

	configPath := path.Join(readOnlyDir, "config.json")

	// 创建测试配置

	testConfig := &configuration{

		Current: "OAuthTest",

		Profiles: []*profile{

			{

				Mode:                   "OAuth",

				Name:                   "OAuthTest",

				OauthSiteType:          "CN",

				OauthRefreshToken:      "test_refresh_token",

				OauthAccessToken:       "test_access_token",

				OauthAccessTokenExpire: time.Now().Unix() + 1000,

			},

		},

	}

	// 创建CLI Profile提供者

	provider, err := NewCLIProfileCredentialsProviderBuilder().

		WithProfileFile(configPath).

		WithProfileName("OAuthTest").

		Build()

	assert.Nil(t, err)

	// 测试写入只读目录应该失败

	err = provider.writeConfigurationToFileWithLock(configPath, testConfig)

	assert.NotNil(t, err)

	assert.Contains(t, err.Error(), "failed to open config file")

}

func TestCLIProfileCredentialsProvider_getOAuthTokenUpdateCallback(t *testing.T) {

	// 创建临时配置文件用于测试

	tempDir, err := ioutil.TempDir("", "oauth_callback_test")

	assert.Nil(t, err)

	defer os.RemoveAll(tempDir)

	configPath := path.Join(tempDir, "config.json")

	// 创建测试配置

	testConfig := &configuration{

		Current: "OAuthTest",

		Profiles: []*profile{

			{

				Mode:                   "OAuth",

				Name:                   "OAuthTest",

				OauthSiteType:          "CN",

				OauthRefreshToken:      "test_refresh_token",

				OauthAccessToken:       "test_access_token",

				OauthAccessTokenExpire: time.Now().Unix() + 1000,

			},

		},

	}

	// 写入测试配置

	data, err := json.MarshalIndent(testConfig, "", "    ")

	assert.Nil(t, err)

	err = ioutil.WriteFile(configPath, data, 0644)

	assert.Nil(t, err)

	// 创建CLI Profile提供者

	provider, err := NewCLIProfileCredentialsProviderBuilder().

		WithProfileFile(configPath).

		WithProfileName("OAuthTest").

		Build()

	assert.Nil(t, err)

	// 测试获取回调函数

	callback := provider.getOAuthTokenUpdateCallback()

	assert.NotNil(t, callback)

	// 测试回调函数

	newRefreshToken := "callback_refresh_token"

	newAccessToken := "callback_access_token"

	newAccessKey := "callback_access_key"

	newSecret := "callback_secret"

	newSecurityToken := "callback_security_token"

	newExpireTime := time.Now().Unix() + 3600

	newStsExpire := time.Now().Unix() + 7200

	err = callback(newRefreshToken, newAccessToken, newAccessKey, newSecret, newSecurityToken, newExpireTime, newStsExpire)

	assert.Nil(t, err)

	// 验证配置文件已更新

	updatedConf, err := newConfigurationFromPath(configPath)

	assert.Nil(t, err)

	updatedProfile, err := updatedConf.getProfile("OAuthTest")

	assert.Nil(t, err)

	assert.Equal(t, newRefreshToken, updatedProfile.OauthRefreshToken)

	assert.Equal(t, newAccessToken, updatedProfile.OauthAccessToken)

	assert.Equal(t, newAccessKey, updatedProfile.AccessKeyID)

	assert.Equal(t, newSecret, updatedProfile.AccessKeySecret)

	assert.Equal(t, newSecurityToken, updatedProfile.SecurityToken)

	assert.Equal(t, newExpireTime, updatedProfile.OauthAccessTokenExpire)

	assert.Equal(t, newStsExpire, updatedProfile.StsExpire)

}

func TestCLIProfileCredentialsProvider_updateOAuthTokens_Error(t *testing.T) {

	// 创建临时配置文件用于测试

	tempDir, err := ioutil.TempDir("", "oauth_update_error_test")

	assert.Nil(t, err)

	defer os.RemoveAll(tempDir)

	configPath := path.Join(tempDir, "config.json")

	// 创建CLI Profile提供者

	provider, err := NewCLIProfileCredentialsProviderBuilder().

		WithProfileFile(configPath).

		WithProfileName("NonExistentProfile").

		Build()

	assert.Nil(t, err)

	// 测试更新不存在的profile应该失败

	newRefreshToken := "new_refresh_token"

	newAccessToken := "new_access_token"

	newAccessKey := "new_access_key"

	newSecret := "new_secret"

	newSecurityToken := "new_security_token"

	newExpireTime := time.Now().Unix() + 3600

	newStsExpire := time.Now().Unix() + 7200

	err = provider.updateOAuthTokens(newRefreshToken, newAccessToken, newAccessKey, newSecret, newSecurityToken, newExpireTime, newStsExpire)

	assert.NotNil(t, err)

	assert.Contains(t, err.Error(), "failed to read config file")

}

func TestCLIProfileCredentialsProvider_updateOAuthTokens_ProfileNotFound(t *testing.T) {

	// 创建临时配置文件用于测试

	tempDir, err := ioutil.TempDir("", "oauth_update_profile_error_test")

	assert.Nil(t, err)

	defer os.RemoveAll(tempDir)

	configPath := path.Join(tempDir, "config.json")

	// 创建测试配置

	testConfig := &configuration{

		Current: "OAuthTest",

		Profiles: []*profile{

			{

				Mode:                   "OAuth",

				Name:                   "OAuthTest",

				OauthSiteType:          "CN",

				OauthRefreshToken:      "test_refresh_token",

				OauthAccessToken:       "test_access_token",

				OauthAccessTokenExpire: time.Now().Unix() + 1000,

			},

		},

	}

	// 写入测试配置

	data, err := json.MarshalIndent(testConfig, "", "    ")

	assert.Nil(t, err)

	err = ioutil.WriteFile(configPath, data, 0644)

	assert.Nil(t, err)

	// 创建CLI Profile提供者，使用不存在的profile名称

	provider, err := NewCLIProfileCredentialsProviderBuilder().

		WithProfileFile(configPath).

		WithProfileName("NonExistentProfile").

		Build()

	assert.Nil(t, err)

	// 测试更新不存在的profile应该失败

	newRefreshToken := "new_refresh_token"

	newAccessToken := "new_access_token"

	newAccessKey := "new_access_key"

	newSecret := "new_secret"

	newSecurityToken := "new_security_token"

	newExpireTime := time.Now().Unix() + 3600

	newStsExpire := time.Now().Unix() + 7200

	err = provider.updateOAuthTokens(newRefreshToken, newAccessToken, newAccessKey, newSecret, newSecurityToken, newExpireTime, newStsExpire)

	assert.NotNil(t, err)

	assert.Contains(t, err.Error(), "failed to get profile NonExistentProfile")

}

func TestCLIProfileCredentialsProvider_ConcurrentUpdate(t *testing.T) {

	// 创建临时配置文件用于测试

	tempDir, err := ioutil.TempDir("", "oauth_concurrent_test")

	assert.Nil(t, err)

	defer os.RemoveAll(tempDir)

	configPath := path.Join(tempDir, "config.json")

	// 创建测试配置

	testConfig := &configuration{

		Current: "OAuthTest",

		Profiles: []*profile{

			{

				Mode:                   "OAuth",

				Name:                   "OAuthTest",

				OauthSiteType:          "CN",

				OauthRefreshToken:      "initial_refresh_token",

				OauthAccessToken:       "initial_access_token",

				OauthAccessTokenExpire: time.Now().Unix() + 1000,

			},

		},

	}

	// 写入测试配置

	data, err := json.MarshalIndent(testConfig, "", "    ")

	assert.Nil(t, err)

	err = ioutil.WriteFile(configPath, data, 0644)

	assert.Nil(t, err)

	// 创建CLI Profile提供者

	provider, err := NewCLIProfileCredentialsProviderBuilder().

		WithProfileFile(configPath).

		WithProfileName("OAuthTest").

		Build()

	assert.Nil(t, err)

	// 并发更新测试

	var wg sync.WaitGroup

	numGoroutines := 10

	for i := 0; i < numGoroutines; i++ {

		wg.Add(1)

		go func(index int) {

			defer wg.Done()

			refreshToken := fmt.Sprintf("refresh_token_%d", index)

			accessToken := fmt.Sprintf("access_token_%d", index)

			accessKey := fmt.Sprintf("access_key_%d", index)

			secret := fmt.Sprintf("secret_%d", index)

			securityToken := fmt.Sprintf("security_token_%d", index)

			expireTime := time.Now().Unix() + int64(3600+index)

			stsExpire := time.Now().Unix() + int64(7200+index)

			err := provider.updateOAuthTokens(refreshToken, accessToken, accessKey, secret, securityToken, expireTime, stsExpire)

			// 由于并发访问，可能会有一些更新失败，这是正常的

			_ = err

		}(i)

	}

	wg.Wait()

	// 验证最终配置文件仍然有效

	updatedConf, err := newConfigurationFromPath(configPath)

	assert.Nil(t, err)

	updatedProfile, err := updatedConf.getProfile("OAuthTest")

	assert.Nil(t, err)

	assert.NotEmpty(t, updatedProfile.OauthRefreshToken)

	assert.NotEmpty(t, updatedProfile.OauthAccessToken)

	assert.True(t, updatedProfile.OauthAccessTokenExpire > 0)

}

func TestCLIProfileCredentialsProvider_FileLock(t *testing.T) {

	// 创建临时配置文件用于测试

	tempDir, err := ioutil.TempDir("", "oauth_filelock_test")

	assert.Nil(t, err)

	defer os.RemoveAll(tempDir)

	configPath := path.Join(tempDir, "config.json")

	// 创建测试配置

	testConfig := &configuration{

		Current: "OAuthTest",

		Profiles: []*profile{

			{

				Mode:                   "OAuth",

				Name:                   "OAuthTest",

				OauthSiteType:          "CN",

				OauthRefreshToken:      "initial_refresh_token",

				OauthAccessToken:       "initial_access_token",

				OauthAccessTokenExpire: time.Now().Unix() + 1000,

			},

		},

	}

	// 写入测试配置

	data, err := json.MarshalIndent(testConfig, "", "    ")

	assert.Nil(t, err)

	err = ioutil.WriteFile(configPath, data, 0644)

	assert.Nil(t, err)

	// 创建CLI Profile提供者

	provider, err := NewCLIProfileCredentialsProviderBuilder().

		WithProfileFile(configPath).

		WithProfileName("OAuthTest").

		Build()

	assert.Nil(t, err)

	// 测试操作系统级别的文件锁

	newRefreshToken := "locked_refresh_token"

	newAccessToken := "locked_access_token"

	newAccessKey := "locked_access_key"

	newSecret := "locked_secret"

	newSecurityToken := "locked_security_token"

	newExpireTime := time.Now().Unix() + 3600

	newStsExpire := time.Now().Unix() + 7200

	err = provider.updateOAuthTokens(newRefreshToken, newAccessToken, newAccessKey, newSecret, newSecurityToken, newExpireTime, newStsExpire)

	assert.Nil(t, err)

	// 验证配置文件已更新

	updatedConf, err := newConfigurationFromPath(configPath)

	assert.Nil(t, err)

	updatedProfile, err := updatedConf.getProfile("OAuthTest")

	assert.Nil(t, err)

	assert.Equal(t, newRefreshToken, updatedProfile.OauthRefreshToken)

	assert.Equal(t, newAccessToken, updatedProfile.OauthAccessToken)

	assert.Equal(t, newAccessKey, updatedProfile.AccessKeyID)

	assert.Equal(t, newSecret, updatedProfile.AccessKeySecret)

	assert.Equal(t, newSecurityToken, updatedProfile.SecurityToken)

	assert.Equal(t, newExpireTime, updatedProfile.OauthAccessTokenExpire)

	assert.Equal(t, newStsExpire, updatedProfile.StsExpire)

}

func TestCLIProfileCredentialsProvider_GetCredentials(t *testing.T) {

	originHttpDo := httpDo

	defer func() { httpDo = originHttpDo }()

	rollback := utils.Memory("ALIBABA_CLOUD_CONFIG_FILE")

	defer func() {

		getHomePath = utils.GetHomePath

		rollback()

	}()

	getHomePath = func() string {

		return ""

	}

	provider, err := NewCLIProfileCredentialsProviderBuilder().Build()

	assert.Nil(t, err)

	_, err = provider.GetCredentials()

	assert.EqualError(t, err, "cannot found home dir")

	getHomePath = func() string {

		return "/path/invalid/home/dir"

	}

	provider, err = NewCLIProfileCredentialsProviderBuilder().Build()

	assert.Nil(t, err)

	_, err = provider.GetCredentials()

	assert.EqualError(t, err, "reading aliyun cli config from '/path/invalid/home/dir/.aliyun/config.json' failed open /path/invalid/home/dir/.aliyun/config.json: no such file or directory")

	// testcase: specify credentials file

	provider, err = NewCLIProfileCredentialsProviderBuilder().WithProfileFile("/path/to/config.invalid").Build()

	assert.Nil(t, err)

	_, err = provider.GetCredentials()

	assert.EqualError(t, err, "reading aliyun cli config from '/path/to/config.invalid' failed open /path/to/config.invalid: no such file or directory")

	// testcase: specify credentials file with env

	os.Setenv("ALIBABA_CLOUD_CONFIG_FILE", "/path/to/config.invalid")

	provider, err = NewCLIProfileCredentialsProviderBuilder().Build()

	assert.Nil(t, err)

	_, err = provider.GetCredentials()

	assert.EqualError(t, err, "reading aliyun cli config from '/path/to/config.invalid' failed open /path/to/config.invalid: no such file or directory")

	provider, err = NewCLIProfileCredentialsProviderBuilder().WithProfileFile("/path/to/config1.invalid").Build()

	assert.Nil(t, err)

	_, err = provider.GetCredentials()

	assert.EqualError(t, err, "reading aliyun cli config from '/path/to/config1.invalid' failed open /path/to/config1.invalid: no such file or directory")

	os.Unsetenv("ALIBABA_CLOUD_CONFIG_FILE")

	getHomePath = func() string {

		wd, _ := os.Getwd()

		return path.Join(wd, "fixtures")

	}

	// get credentials by current profile

	provider, err = NewCLIProfileCredentialsProviderBuilder().Build()

	assert.Nil(t, err)

	cc, err := provider.GetCredentials()

	assert.Nil(t, err)

	assert.Equal(t, &Credentials{AccessKeyId: "akid", AccessKeySecret: "secret", SecurityToken: "", ProviderName: "cli_profile/static_ak"}, cc)

	provider, err = NewCLIProfileCredentialsProviderBuilder().WithProfileName("inexist").Build()

	assert.Nil(t, err)

	_, err = provider.GetCredentials()

	assert.EqualError(t, err, "unable to get profile with 'inexist'")

	// The get_credentials_error profile is invalid

	provider, err = NewCLIProfileCredentialsProviderBuilder().WithProfileName("get_credentials_error").Build()

	assert.Nil(t, err)

	_, err = provider.GetCredentials()

	assert.Contains(t, err.Error(), "InvalidAccessKeyId.NotFound")

	httpDo = func(req *httputil.Request) (res *httputil.Response, err error) {

		res = &httputil.Response{

			StatusCode: 200,

			Body:       []byte(`{"Credentials": {"AccessKeyId":"akid","AccessKeySecret":"aksecret","Expiration":"2021-10-20T04:27:09Z","SecurityToken":"ststoken"}}`),

		}

		return

	}

	provider, err = NewCLIProfileCredentialsProviderBuilder().WithProfileName("ChainableRamRoleArn").Build()

	assert.Nil(t, err)

	cc, err = provider.GetCredentials()

	assert.Nil(t, err)

	assert.Equal(t, "akid", cc.AccessKeyId)

	assert.Equal(t, "aksecret", cc.AccessKeySecret)

	assert.Equal(t, "ststoken", cc.SecurityToken)

	assert.Equal(t, "cli_profile/ram_role_arn/ram_role_arn/static_ak", cc.ProviderName)

	provider.innerProvider = new(testProvider)

	cc, err = provider.GetCredentials()

	assert.Nil(t, err)

	assert.Equal(t, "test", cc.AccessKeyId)

	assert.Equal(t, "test", cc.AccessKeySecret)

	assert.Equal(t, "cli_profile/test", cc.ProviderName)

}

func TestCLIProfileCredentialsProvider_writeConfigurationToFile_RenameError(t *testing.T) {

	// 创建临时配置文件用于测试

	tempDir, err := ioutil.TempDir("", "oauth_rename_error_test")

	assert.Nil(t, err)

	defer os.RemoveAll(tempDir)

	configPath := path.Join(tempDir, "config.json")

	// 创建测试配置

	testConfig := &configuration{

		Current: "OAuthTest",

		Profiles: []*profile{

			{

				Mode:                   "OAuth",

				Name:                   "OAuthTest",

				OauthSiteType:          "CN",

				OauthRefreshToken:      "test_refresh_token",

				OauthAccessToken:       "test_access_token",

				OauthAccessTokenExpire: time.Now().Unix() + 1000,

			},

		},

	}

	// 创建CLI Profile提供者

	provider, err := NewCLIProfileCredentialsProviderBuilder().

		WithProfileFile(configPath).

		WithProfileName("OAuthTest").

		Build()

	assert.Nil(t, err)

	// 创建一个已存在的文件来模拟重命名错误

	err = ioutil.WriteFile(configPath, []byte("existing content"), 0644)

	assert.Nil(t, err)

	// 在Windows上，重命名可能会失败，这里我们测试错误处理

	err = provider.writeConfigurationToFile(configPath, testConfig)

	// 这个测试可能会成功或失败，取决于操作系统，我们主要测试错误处理路径

	_ = err

}

func TestCLIProfileCredentialsProvider_writeConfigurationToFileWithLock_RenameError(t *testing.T) {

	// 创建临时配置文件用于测试

	tempDir, err := ioutil.TempDir("", "oauth_rename_lock_error_test")

	assert.Nil(t, err)

	defer os.RemoveAll(tempDir)

	configPath := path.Join(tempDir, "config.json")

	// 创建测试配置

	testConfig := &configuration{

		Current: "OAuthTest",

		Profiles: []*profile{

			{

				Mode:                   "OAuth",

				Name:                   "OAuthTest",

				OauthSiteType:          "CN",

				OauthRefreshToken:      "test_refresh_token",

				OauthAccessToken:       "test_access_token",

				OauthAccessTokenExpire: time.Now().Unix() + 1000,

			},

		},

	}

	// 创建CLI Profile提供者

	provider, err := NewCLIProfileCredentialsProviderBuilder().

		WithProfileFile(configPath).

		WithProfileName("OAuthTest").

		Build()

	assert.Nil(t, err)

	// 创建一个已存在的文件来模拟重命名错误

	err = ioutil.WriteFile(configPath, []byte("existing content"), 0644)

	assert.Nil(t, err)

	// 在Windows上，重命名可能会失败，这里我们测试错误处理

	err = provider.writeConfigurationToFileWithLock(configPath, testConfig)

	// 这个测试可能会成功或失败，取决于操作系统，我们主要测试错误处理路径

	_ = err

}

func TestCLIProfileCredentialsProvider_updateOAuthTokens_WriteError(t *testing.T) {

	// 创建临时配置文件用于测试

	tempDir, err := ioutil.TempDir("", "oauth_update_write_error_test")

	assert.Nil(t, err)

	defer os.RemoveAll(tempDir)

	configPath := path.Join(tempDir, "config.json")

	// 创建测试配置

	testConfig := &configuration{

		Current: "OAuthTest",

		Profiles: []*profile{

			{

				Mode:                   "OAuth",

				Name:                   "OAuthTest",

				OauthSiteType:          "CN",

				OauthRefreshToken:      "test_refresh_token",

				OauthAccessToken:       "test_access_token",

				OauthAccessTokenExpire: time.Now().Unix() + 1000,

			},

		},

	}

	// 写入测试配置

	data, err := json.MarshalIndent(testConfig, "", "    ")

	assert.Nil(t, err)

	err = ioutil.WriteFile(configPath, data, 0644)

	assert.Nil(t, err)

	// 创建CLI Profile提供者

	provider, err := NewCLIProfileCredentialsProviderBuilder().

		WithProfileFile(configPath).

		WithProfileName("OAuthTest").

		Build()

	assert.Nil(t, err)

	// 删除文件以模拟读取错误

	err = os.Remove(configPath)

	assert.Nil(t, err)

	// 测试更新应该失败

	newRefreshToken := "new_refresh_token"

	newAccessToken := "new_access_token"

	newAccessKey := "new_access_key"

	newSecret := "new_secret"

	newSecurityToken := "new_security_token"

	newExpireTime := time.Now().Unix() + 3600

	newStsExpire := time.Now().Unix() + 7200

	err = provider.updateOAuthTokens(newRefreshToken, newAccessToken, newAccessKey, newSecret, newSecurityToken, newExpireTime, newStsExpire)

	assert.NotNil(t, err)

	assert.Contains(t, err.Error(), "failed to read config file")

}

func TestCLIProfileCredentialsProvider_GetCredentials_WithOAuthProfile(t *testing.T) {

	// 创建临时配置文件用于测试

	tempDir, err := ioutil.TempDir("", "oauth_get_credentials_test")

	assert.Nil(t, err)

	defer os.RemoveAll(tempDir)

	configPath := path.Join(tempDir, "config.json")

	// 创建测试配置

	testConfig := &configuration{

		Current: "OAuthTest",

		Profiles: []*profile{

			{

				Mode:                   "OAuth",

				Name:                   "OAuthTest",

				OauthSiteType:          "CN",

				OauthRefreshToken:      "test_refresh_token",

				OauthAccessToken:       "test_access_token",

				OauthAccessTokenExpire: time.Now().Unix() + 1000,

			},

		},

	}

	// 写入测试配置

	data, err := json.MarshalIndent(testConfig, "", "    ")

	assert.Nil(t, err)

	err = ioutil.WriteFile(configPath, data, 0644)

	assert.Nil(t, err)

	// 创建CLI Profile提供者

	provider, err := NewCLIProfileCredentialsProviderBuilder().

		WithProfileFile(configPath).

		WithProfileName("OAuthTest").

		Build()

	assert.Nil(t, err)

	// 测试获取凭据（会失败，因为没有真实的OAuth服务）

	_, err = provider.GetCredentials()

	assert.NotNil(t, err)

	// 应该包含OAuth相关的错误信息

	assert.Contains(t, err.Error(), "OAuth")

}

func TestCLIProfileCredentialsProvider_FileLock_ConcurrentAccess(t *testing.T) {

	// 创建临时配置文件用于测试

	tempDir, err := ioutil.TempDir("", "oauth_filelock_concurrent_test")

	assert.Nil(t, err)

	defer os.RemoveAll(tempDir)

	configPath := path.Join(tempDir, "config.json")

	// 创建测试配置

	testConfig := &configuration{

		Current: "OAuthTest",

		Profiles: []*profile{

			{

				Mode:                   "OAuth",

				Name:                   "OAuthTest",

				OauthSiteType:          "CN",

				OauthRefreshToken:      "test_refresh_token",

				OauthAccessToken:       "test_access_token",

				OauthAccessTokenExpire: time.Now().Unix() + 1000,

			},

		},

	}

	// 写入测试配置

	data, err := json.MarshalIndent(testConfig, "", "    ")

	assert.Nil(t, err)

	err = ioutil.WriteFile(configPath, data, 0644)

	assert.Nil(t, err)

	// 创建CLI Profile提供者

	provider, err := NewCLIProfileCredentialsProviderBuilder().

		WithProfileFile(configPath).

		WithProfileName("OAuthTest").

		Build()

	assert.Nil(t, err)

	// 测试文件锁的并发访问

	var wg sync.WaitGroup

	numGoroutines := 5

	for i := 0; i < numGoroutines; i++ {

		wg.Add(1)

		go func(index int) {

			defer wg.Done()

			// 测试文件锁写入

			err := provider.writeConfigurationToFileWithLock(configPath, testConfig)

			_ = err // 忽略错误，主要测试并发安全性