main_test.go

package main

import (
	"bytes"
	"context"
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"os"
	"reflect"
	"strings"
	"testing"

	"google.golang.org/api/option"
	stsv1 "google.golang.org/api/sts/v1"
	credentialproviderapi "k8s.io/kubelet/pkg/apis/credentialprovider/v1"
)

func newTestProvider(t *testing.T, handler http.Handler) *Provider {
	server := httptest.NewServer(handler)
	t.Cleanup(server.Close)

	stsService, err := stsv1.NewService(context.Background(), option.WithEndpoint(server.URL), option.WithoutAuthentication())

	if err != nil {
		t.Fatalf("failed to create test sts service: %v", err)
	}

	return &Provider{stsService: stsService}
}

func TestProvider_run(t *testing.T) {
	if err := os.Setenv("GCP_AUDIENCE", "test-audience"); err != nil {
		t.Fatalf("failed to set GCP_AUDIENCE: %v", err)
	}
	t.Cleanup(func() {
		if err := os.Unsetenv("GCP_AUDIENCE"); err != nil {
			t.Fatalf("failed to unset GCP_AUDIENCE: %v", err)
		}
	})

	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.URL.Path != "/v1/token" {
			t.Errorf("Expected to request '/v1/token', got: %s", r.URL.Path)
			http.Error(w, "unexpected path", http.StatusBadRequest)
			return
		}

		// Verify that request body looks good
		var req stsv1.GoogleIdentityStsV1ExchangeTokenRequest
		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			http.Error(w, err.Error(), http.StatusBadRequest)
			return
		}
		if req.SubjectToken != "test-sa-token" {
			t.Errorf("expected subject token 'test-sa-token', got '%s'", req.SubjectToken)
			http.Error(w, "bad request", http.StatusBadRequest)
		}
		if req.Audience != "test-audience" {
			t.Errorf("expected audience 'test-audience', got '%s'", req.Audience)
			http.Error(w, "bad request", http.StatusBadRequest)
		}

		w.WriteHeader(http.StatusOK)
		if err := json.NewEncoder(w).Encode(&stsv1.GoogleIdentityStsV1ExchangeTokenResponse{
			AccessToken: "test-token",
			ExpiresIn:   3600,
		}); err != nil {
			http.Error(w, "failed to encode response", http.StatusInternalServerError)
		}
	})

	p := newTestProvider(t, handler)

	tests := []struct {
		name        string
		input       string
		expectErr   bool
		expectedOut string
	}{
		{
			name: "valid request",
			input: `{
				"apiVersion": "credentialprovider.kubelet.k8s.io/v1",
				"kind": "CredentialProviderRequest",
				"image": "us-central1-docker.pkg.dev/my-project/my-repo/my-image:latest",
				"serviceAccountToken": "test-sa-token"
			}`,
			expectErr: false,
			expectedOut: `{
				"apiVersion": "credentialprovider.kubelet.k8s.io/v1",
				"kind": "CredentialProviderResponse",
				"cacheKeyType": "Image",
				"cacheDuration": "59m0s",
				"auth": {
					"us-central1-docker.pkg.dev": {
						"username": "oauth2accesstoken",
						"password": "test-token"
					}
				}
			}`,
		},
		{
			name:        "empty input",
			input:       ``,
			expectErr:   true,
			expectedOut: "",
		},
		{
			name: "missing service account token",
			input: `{
				"apiVersion": "credentialprovider.kubelet.k8s.io/v1",
				"kind": "CredentialProviderRequest",
				"image": "us-central1-docker.pkg.dev/my-project/my-repo/my-image:latest"
			}`,
			expectErr:   true,
			expectedOut: "",
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			in := strings.NewReader(tt.input)
			var out bytes.Buffer

			err := p.run(in, &out)

			if (err != nil) != tt.expectErr {
				t.Fatalf("run() error = %v, expectErr %v", err, tt.expectErr)
			}

			if !tt.expectErr {
				var expected, actual credentialproviderapi.CredentialProviderResponse
				if err := json.Unmarshal([]byte(tt.expectedOut), &expected); err != nil {
					t.Fatalf("failed to unmarshal expected output: %v", err)
				}
				if err := json.Unmarshal(out.Bytes(), &actual); err != nil {
					t.Fatalf("failed to unmarshal actual output: %v", err)
				}
				if !reflect.DeepEqual(expected, actual) {
					t.Errorf("run() output mismatch:\nexpected: %+v\nactual:   %+v", tt.expectedOut, actual)
				}
			}
		})
	}
}