@@ -25,6 +25,10 @@ func baseConfig(extra map[string]interface{}) *auth.AuthConfig {
2525 }
2626}
2727
28+ // TestNewGCPAuthMethod_serviceAccountDefault verifies that when no
29+ // service_account is provided the field is left empty, so that the IAM
30+ // branch can derive it from credentials.ClientEmail instead of sending
31+ // the literal string "default" to the GCP IAM API.
2832func TestNewGCPAuthMethod_serviceAccountDefault (t * testing.T ) {
2933 m , err := NewGCPAuthMethod (baseConfig (nil ))
3034 if err != nil {
@@ -36,6 +40,8 @@ func TestNewGCPAuthMethod_serviceAccountDefault(t *testing.T) {
3640 }
3741}
3842
43+ // TestNewGCPAuthMethod_explicitServiceAccount verifies that an explicitly
44+ // configured service_account is preserved as-is.
3945func TestNewGCPAuthMethod_explicitServiceAccount (t * testing.T ) {
4046 const want = "my-sa@my-project.iam.gserviceaccount.com"
4147 m , err := NewGCPAuthMethod (baseConfig (map [string ]interface {}{
@@ -50,6 +56,9 @@ func TestNewGCPAuthMethod_explicitServiceAccount(t *testing.T) {
5056 }
5157}
5258
59+ // TestNewGCPAuthMethod_GCETypeWithNoServiceAccount verifies that a GCE-type
60+ // method can be constructed without a service_account; the "default" alias
61+ // is applied inside Authenticate only for the GCE flow.
5362func TestNewGCPAuthMethod_GCETypeWithNoServiceAccount (t * testing.T ) {
5463 m , err := NewGCPAuthMethod (& auth.AuthConfig {
5564 Logger : hclog .NewNullLogger (),
@@ -65,6 +74,7 @@ func TestNewGCPAuthMethod_GCETypeWithNoServiceAccount(t *testing.T) {
6574 }
6675}
6776
77+ // TestNewGCPAuthMethod_missingType verifies that missing type returns an error.
6878func TestNewGCPAuthMethod_missingType (t * testing.T ) {
6979 _ , err := NewGCPAuthMethod (& auth.AuthConfig {
7080 Logger : hclog .NewNullLogger (),
@@ -76,6 +86,7 @@ func TestNewGCPAuthMethod_missingType(t *testing.T) {
7686 }
7787}
7888
89+ // TestNewGCPAuthMethod_missingRole verifies that missing role returns an error.
7990func TestNewGCPAuthMethod_missingRole (t * testing.T ) {
8091 _ , err := NewGCPAuthMethod (& auth.AuthConfig {
8192 Logger : hclog .NewNullLogger (),
@@ -87,6 +98,7 @@ func TestNewGCPAuthMethod_missingRole(t *testing.T) {
8798 }
8899}
89100
101+ // TestNewGCPAuthMethod_nilConfig verifies that a nil config returns an error.
90102func TestNewGCPAuthMethod_nilConfig (t * testing.T ) {
91103 _ , err := NewGCPAuthMethod (nil )
92104 if err == nil {
0 commit comments