Setting the file. One moment. ⋯
scripts/11 files
Pythonaudio/scripts/lib/gemini-auth_test.py
Python·90 lines·4 KB
13
14# Keep the credential subprocess protocol UTF-8 on every platform.
15for _stream in (sys.stdout, sys.stderr):
16 if hasattr(_stream, "reconfigure"):
17 _stream.reconfigure(encoding="utf-8", errors=_stream.errors)
18
19spec = importlib.util.spec_from_file_location("gemini_auth", Path(__file__).with_name("gemini-auth.py"))
20auth = importlib.util.module_from_spec(spec)
21spec.loader.exec_module(auth)
22
23
24class AuthenticationTests(unittest.TestCase):
25 def setUp(self):
26 self.info = {"type": "service_account", "project_id": "account-project", "token_uri": "https://untrusted.invalid/token"}
27 self.credentials = Mock(token="fixture-token")
28 self.factory = Mock(return_value=self.credentials)
29 self.request = Mock(return_value=object())
30 transport = types.ModuleType("google.auth.transport.requests")
31 transport.Request = self.request
32 oauth = types.ModuleType("google.oauth2")
33 oauth.service_account = types.SimpleNamespace(Credentials=types.SimpleNamespace(from_service_account_info=self.factory))
34 modules = {name: types.ModuleType(name) for name in ("google", "google.auth", "google.auth.transport")}
35 modules.update({"google.auth.transport.requests": transport, "google.oauth2": oauth})
36 self.addCleanup(patch.stopall)
37 patch.dict("sys.modules", modules).start()
38 patch.dict(os.environ, {"GCS_CREDS": json.dumps(self.info)}, clear=True).start()
39
40 def test_scope_endpoint_and_refresh(self):
41 self.assertEqual(auth.authenticate(), {"token": "fixture-token", "project": "account-project"})
42 info = self.factory.call_args.args[0]
43 self.assertEqual(info["token_uri"], "https://oauth2.googleapis.com/token")
44 self.assertEqual(self.factory.call_args.kwargs["scopes"], ["https://www.googleapis.com/auth/generative-language.retriever"])
45 self.credentials.refresh.assert_called_once_with(self.request.return_value)
46
47 def test_file_takes_precedence_over_json_environment(self):
48 with tempfile.TemporaryDirectory() as directory:
49 path = Path(directory) / "service.json"
50 path.write_text(json.dumps({**self.info, "project_id": "file-project"}), encoding="utf-8")
51 os.environ["GOOGLE_APPLICATION_CREDENTIALS"] = str(path)
52 os.environ["GCS_CREDS"] = "invalid-json"
53 self.assertEqual(auth.authenticate()["project"], "file-project")
54
55 def test_quota_project_precedence(self):
56 os.environ["GCLOUD_PROJECT_ID"] = "alias-project"
57 self.assertEqual(auth.authenticate()["project"], "alias-project")
58 os.environ["GOOGLE_CLOUD_PROJECT"] = "explicit-project"
59 self.assertEqual(auth.authenticate()["project"], "explicit-project")
60
61 def test_user_adc_is_rejected_before_exchange(self):
62 os.environ["GCS_CREDS"] = json.dumps({"type": "authorized_user"})
63 self.assertIn("service-account JSON", auth.authenticate()["error"])
64 self.factory.assert_not_called()
65
66 def test_invalid_json_or_missing_file_does_not_fall_back(self):
67 os.environ["GCS_CREDS"] = "private-invalid-json"
68 self.assertIn("error", auth.authenticate())
69 os.environ["GCS_CREDS"] = json.dumps(self.info)
70 os.environ["GOOGLE_APPLICATION_CREDENTIALS"] = "/missing/service-account-fixture.json"
71 self.assertIn("error", auth.authenticate())
72 self.factory.assert_not_called()
73
74 def test_library_errors_are_redacted(self):
75 for boundary in (self.factory, self.credentials.refresh):
76 with self.subTest(boundary=boundary):
77 boundary.side_effect = RuntimeError("private-key-and-token")
78 result = auth.authenticate()
79 self.assertIn("error", result)
80 self.assertNotIn("private-key-and-token", json.dumps(result))
81 boundary.side_effect = None
82
83 def test_missing_dependency_has_actionable_error(self):
84 with patch.dict("sys.modules", {"google.auth.transport.requests": None}):
85 self.assertIn("pip install google-auth requests", auth.authenticate()["error"])
86 self.factory.assert_not_called()
87
88
89if __name__ == "__main__":
90 unittest.main()