fix: Revert Missing WORKFORCE_AUDIENCE_PATTERN (#1740)

googleapis · Jan 27, 2024 · 422de68 · 422de68
1 parent effbf87
commit 422de68
Show file tree

Hide file tree

Showing 4 changed files with 127 additions and 0 deletions.
diff --git a/src/auth/baseexternalclient.ts b/src/auth/baseexternalclient.ts
@@ -60,6 +60,9 @@ export const EXTERNAL_ACCOUNT_TYPE = 'external_account';
  **/
 export const CLOUD_RESOURCE_MANAGER =
   'https://cloudresourcemanager.googleapis.com/v1/projects/';
+/** The workforce audience pattern. */
+const WORKFORCE_AUDIENCE_PATTERN =
+  '//iam\\.googleapis\\.com/locations/[^/]+/workforcePools/[^/]+/providers/.+';
 
 // eslint-disable-next-line @typescript-eslint/no-var-requires
 const pkg = require('../../../package.json');
@@ -228,6 +231,17 @@ export abstract class BaseExternalAccountClient extends AuthClient {
     this.audience = opts.get('audience');
     this.subjectTokenType = subjectTokenType;
     this.workforcePoolUserProject = workforcePoolUserProject;
+    const workforceAudiencePattern = new RegExp(WORKFORCE_AUDIENCE_PATTERN);
+    if (
+      this.workforcePoolUserProject &&
+      !this.audience.match(workforceAudiencePattern)
+    ) {
+      throw new Error(
+        'workforcePoolUserProject should not be set for non-workforce pool ' +
+          'credentials.'
+      );
+    }
+
     this.serviceAccountImpersonationUrl = serviceAccountImpersonationUrl;
     this.serviceAccountImpersonationLifetime =
       serviceAccountImpersonationLifetime;

diff --git a/test/test.baseexternalclient.ts b/test/test.baseexternalclient.ts
@@ -171,6 +171,43 @@ describe('BaseExternalAccountClient', () => {
       }, expectedError);
     });
 
+    const invalidWorkforceAudiences = [
+      '//iam.googleapis.com/locations/global/workloadIdentityPools/pool/providers/provider',
+      '//iam.googleapis.com/locations/global/workforcepools/pool/providers/provider',
+      '//iam.googleapis.com/locations/global/workforcePools//providers/provider',
+      '//iam.googleapis.com/locations/global/workforcePools/providers/provider',
+      '//iam.googleapis.com/locations/global/workloadIdentityPools/workforcePools/pool/providers/provider',
+      '//iam.googleapis.com//locations/global/workforcePools/pool/providers/provider',
+      '//iam.googleapis.com/project/123/locations/global/workforcePools/pool/providers/provider',
+      '//iam.googleapis.com/locations/global/workforcePools/pool/providers',
+      '//iam.googleapis.com/locations/global/workforcePools/workloadIdentityPools/pool/providers/provider',
+      '//iam.googleapis.com/locations/global/workforcePools/pool/providers/',
+      '//iam.googleapis.com/locations//workforcePools/pool/providers/provider',
+      '//iam.googleapis.com/locations/workforcePools/pool/providers/provider',
+      '//iamAgoogleapisAcom/locations/global/workforcePools/workloadPools/providers/oidc',
+    ];
+    const invalidExternalAccountOptionsWorkforceUserProject = Object.assign(
+      {},
+      externalAccountOptionsWorkforceUserProject
+    );
+    const expectedWorkforcePoolUserProjectError = new Error(
+      'workforcePoolUserProject should not be set for non-workforce pool ' +
+        'credentials.'
+    );
+
+    invalidWorkforceAudiences.forEach(invalidWorkforceAudience => {
+      it(`should throw given audience ${invalidWorkforceAudience} with user project defined in options`, () => {
+        invalidExternalAccountOptionsWorkforceUserProject.audience =
+          invalidWorkforceAudience;
+
+        assert.throws(() => {
+          return new TestExternalAccountClient(
+            invalidExternalAccountOptionsWorkforceUserProject
+          );
+        }, expectedWorkforcePoolUserProjectError);
+      });
+    });
+
     it('should not throw on valid workforce audience configs', () => {
       const validWorkforceAudiences = [
         '//iam.googleapis.com/locations/global/workforcePools/workforcePools/providers/provider',

diff --git a/test/test.externalclient.ts b/test/test.externalclient.ts
@@ -93,6 +93,21 @@ describe('ExternalAccountClient', () => {
       forceRefreshOnFailure: true,
     };
 
+    const invalidWorkforceIdentityPoolClientAudiences = [
+      '//iam.googleapis.com/locations/global/workloadIdentityPools/pool/providers/oidc',
+      '//iam.googleapis.com/locations/global/workforcepools/pool/providers/oidc',
+      '//iam.googleapis.com/locations/global/workforcePools//providers/oidc',
+      '//iam.googleapis.com/locations/global/workforcePools/providers/oidc',
+      '//iam.googleapis.com/locations/global/workloadIdentityPools/workforcePools/pool/providers/oidc',
+      '//iam.googleapis.com//locations/global/workforcePools/pool/providers/oidc',
+      '//iam.googleapis.com/project/123/locations/global/workforcePools/pool/providers/oidc',
+      '//iam.googleapis.com/locations/global/workforcePools/workloadIdentityPools/pool/providers/oidc',
+      '//iam.googleapis.com/locations/global/workforcePools/pool/providers',
+      '//iam.googleapis.com/locations/global/workforcePools/pool/providers/',
+      '//iam.googleapis.com/locations//workforcePools/pool/providers/oidc',
+      '//iam.googleapis.com/locations/workforcePools/pool/providers/oidc',
+    ];
+
     it('should return IdentityPoolClient on IdentityPoolClientOptions', () => {
       const expectedClient = new IdentityPoolClient(fileSourcedOptions);
 
@@ -186,6 +201,29 @@ describe('ExternalAccountClient', () => {
       );
     });
 
+    invalidWorkforceIdentityPoolClientAudiences.forEach(
+      invalidWorkforceIdentityPoolClientAudience => {
+        const workforceIdentityPoolClientInvalidOptions = Object.assign(
+          {},
+          fileSourcedOptions,
+          {
+            workforce_pool_user_project: 'workforce_pool_user_project',
+            subject_token_type: 'urn:ietf:params:oauth:token-type:id_token',
+          }
+        );
+        it(`should throw an error when an invalid workforce audience ${invalidWorkforceIdentityPoolClientAudience} is provided with a workforce user project`, () => {
+          workforceIdentityPoolClientInvalidOptions.audience =
+            invalidWorkforceIdentityPoolClientAudience;
+
+          assert.throws(() => {
+            return ExternalAccountClient.fromJSON(
+              workforceIdentityPoolClientInvalidOptions
+            );
+          });
+        });
+      }
+    );
+
     it('should return null when given non-ExternalAccountClientOptions', () => {
       assert(
         // eslint-disable-next-line @typescript-eslint/no-explicit-any

diff --git a/test/test.identitypoolclient.ts b/test/test.identitypoolclient.ts
@@ -179,6 +179,29 @@ describe('IdentityPoolClient', () => {
   });
 
   describe('Constructor', () => {
+    const invalidWorkforceIdentityPoolClientAudiences = [
+      '//iam.googleapis.com/locations/global/workloadIdentityPools/pool/providers/oidc',
+      '//iam.googleapis.com/locations/global/workforcepools/pool/providers/oidc',
+      '//iam.googleapis.com/locations/global/workforcePools//providers/oidc',
+      '//iam.googleapis.com/locations/global/workforcePools/providers/oidc',
+      '//iam.googleapis.com/locations/global/workloadIdentityPools/workforcePools/pool/providers/oidc',
+      '//iam.googleapis.com//locations/global/workforcePools/pool/providers/oidc',
+      '//iam.googleapis.com/project/123/locations/global/workforcePools/pool/providers/oidc',
+      '//iam.googleapis.com/locations/global/workforcePools/workloadIdentityPools/pool/providers/oidc',
+      '//iam.googleapis.com/locations/global/workforcePools/pool/providers',
+      '//iam.googleapis.com/locations/global/workforcePools/pool/providers/',
+      '//iam.googleapis.com/locations//workforcePools/pool/providers/oidc',
+      '//iam.googleapis.com/locations/workforcePools/pool/providers/oidc',
+    ];
+    const invalidWorkforceIdentityPoolFileSourceOptions = Object.assign(
+      {},
+      fileSourcedOptionsWithWorkforceUserProject
+    );
+    const expectedWorkforcePoolUserProjectError = new Error(
+      'workforcePoolUserProject should not be set for non-workforce pool ' +
+        'credentials.'
+    );
+
     it('should throw when neither file or url sources are provided', () => {
       const expectedError = new Error(
         'No valid Identity Pool "credential_source" provided, must be either file or url.'
@@ -264,6 +287,21 @@ describe('IdentityPoolClient', () => {
       }, expectedError);
     });
 
+    invalidWorkforceIdentityPoolClientAudiences.forEach(
+      invalidWorkforceIdentityPoolClientAudience => {
+        it(`should throw given audience ${invalidWorkforceIdentityPoolClientAudience} with user project defined in IdentityPoolClientOptions`, () => {
+          invalidWorkforceIdentityPoolFileSourceOptions.audience =
+            invalidWorkforceIdentityPoolClientAudience;
+
+          assert.throws(() => {
+            return new IdentityPoolClient(
+              invalidWorkforceIdentityPoolFileSourceOptions
+            );
+          }, expectedWorkforcePoolUserProjectError);
+        });
+      }
+    );
+
     it('should not throw when valid file-sourced options are provided', () => {
       assert.doesNotThrow(() => {
         return new IdentityPoolClient(fileSourcedOptions);