Skills › HyperFrames › media-use › gemini-auth_test.py
gemini-auth_test.py
90 lines · skills/media-use/audio/scripts/lib/gemini-auth_test.py at a595755
1"""Credential-boundary tests; stub Google's transport, never use real secrets."""
3import importlib.util
4import json
5import os
6import sys
7from pathlib import Path
8import tempfile
9import types
10import unittest
11from unittest.mock import Mock, patch
14# Keep the credential subprocess protocol UTF-8 on every platform.
15for _stream in (sys.stdout, sys.stderr):
16 if hasattr(_stream, "reconfigure"):
17 _stream.reconfigure(encoding="utf-8", errors=_stream.errors)
19spec = importlib.util.spec_from_file_location("gemini_auth", Path(__file__).with_name("gemini-auth.py"))
20auth = importlib.util.module_from_spec(spec)
21spec.loader.exec_module(auth)
24class AuthenticationTests(unittest.TestCase):
25 def setUp(self):
26 self.info = {"type": "service_account", "project_id": "account-project", "token_uri": "https://untrusted.invalid/token"}
27 self.credentials = Mock(token="fixture-token")
28 self.factory = Mock(return_value=self.credentials)
29 self.request = Mock(return_value=object())
30 transport = types.ModuleType("google.auth.transport.requests")
31 transport.Request = self.request
32 oauth = types.ModuleType("google.oauth2")
33 oauth.service_account = types.SimpleNamespace(Credentials=types.SimpleNamespace(from_service_account_info=self.factory))
34 modules = {name: types.ModuleType(name) for name in ("google", "google.auth", "google.auth.transport")}
35 modules.update({"google.auth.transport.requests": transport, "google.oauth2": oauth})
36 self.addCleanup(patch.stopall)
37 patch.dict("sys.modules", modules).start()
38 patch.dict(os.environ, {"GCS_CREDS": json.dumps(self.info)}, clear=True).start()
40 def test_scope_endpoint_and_refresh(self):
41 self.assertEqual(auth.authenticate(), {"token": "fixture-token", "project": "account-project"})
42 info = self.factory.call_args.args[0]
43 self.assertEqual(info["token_uri"], "https://oauth2.googleapis.com/token")
44 self.assertEqual(self.factory.call_args.kwargs["scopes"], ["https://www.googleapis.com/auth/generative-language.retriever"])
45 self.credentials.refresh.assert_called_once_with(self.request.return_value)
47 def test_file_takes_precedence_over_json_environment(self):
48 with tempfile.TemporaryDirectory() as directory:
49 path = Path(directory) / "service.json"
50 path.write_text(json.dumps({**self.info, "project_id": "file-project"}), encoding="utf-8")
51 os.environ["GOOGLE_APPLICATION_CREDENTIALS"] = str(path)
52 os.environ["GCS_CREDS"] = "invalid-json"
53 self.assertEqual(auth.authenticate()["project"], "file-project")
55 def test_quota_project_precedence(self):
56 os.environ["GCLOUD_PROJECT_ID"] = "alias-project"
57 self.assertEqual(auth.authenticate()["project"], "alias-project")
58 os.environ["GOOGLE_CLOUD_PROJECT"] = "explicit-project"
59 self.assertEqual(auth.authenticate()["project"], "explicit-project")
61 def test_user_adc_is_rejected_before_exchange(self):
62 os.environ["GCS_CREDS"] = json.dumps({"type": "authorized_user"})
63 self.assertIn("service-account JSON", auth.authenticate()["error"])
64 self.factory.assert_not_called()
66 def test_invalid_json_or_missing_file_does_not_fall_back(self):
67 os.environ["GCS_CREDS"] = "private-invalid-json"
68 self.assertIn("error", auth.authenticate())
69 os.environ["GCS_CREDS"] = json.dumps(self.info)
70 os.environ["GOOGLE_APPLICATION_CREDENTIALS"] = "/missing/service-account-fixture.json"
71 self.assertIn("error", auth.authenticate())
72 self.factory.assert_not_called()
74 def test_library_errors_are_redacted(self):
75 for boundary in (self.factory, self.credentials.refresh):
76 with self.subTest(boundary=boundary):
77 boundary.side_effect = RuntimeError("private-key-and-token")
78 result = auth.authenticate()
79 self.assertIn("error", result)
80 self.assertNotIn("private-key-and-token", json.dumps(result))
81 boundary.side_effect = None
83 def test_missing_dependency_has_actionable_error(self):
84 with patch.dict("sys.modules", {"google.auth.transport.requests": None}):
85 self.assertIn("pip install google-auth requests", auth.authenticate()["error"])
86 self.factory.assert_not_called()
89if __name__ == "__main__":
90 unittest.main()