Initial public release of Warp.

Repo-Sync-Origin: warpdotdev/warp-internal@12af1d983b
2026-04-28 08:43:33 -05:00
commit 0dbd3d567a
4982 changed files with 1431549 additions and 0 deletions
@@ -0,0 +1,153 @@
+use std::path::Path;
+use std::time::Duration;
+
+use serde_json::json;
+
+use super::{GcpFederationConfig, PrepareGcpCredentialsError, generate_gcp_credential_config};
+
+#[test]
+fn basic_config_shape() {
+    let config = GcpFederationConfig {
+        project_number: "123456789".to_string(),
+        pool_id: "my-pool".to_string(),
+        provider_id: "my-provider".to_string(),
+        service_account_email: None,
+        token_lifetime: None,
+    };
+
+    let result = generate_gcp_credential_config(
+        "task-42",
+        &config,
+        Path::new("/usr/bin/oz"),
+        Path::new("/tmp/token_cache"),
+    )
+    .unwrap();
+
+    assert_eq!(
+        result,
+        json!({
+            "type": "external_account",
+            "audience": "//iam.googleapis.com/projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider",
+            "subject_token_type": "urn:ietf:params:oauth:token-type:id_token",
+            "token_url": "https://sts.googleapis.com/v1/token",
+            "credential_source": {
+                "executable": {
+                    "command": "/usr/bin/oz federate issue-gcp-token --run-id task-42",
+                    "timeout_millis": 30000,
+                    "output_file": "/tmp/token_cache"
+                }
+            }
+        })
+    );
+}
+
+#[test]
+fn rejects_binary_path_with_spaces() {
+    let config = GcpFederationConfig {
+        project_number: "123".to_string(),
+        pool_id: "pool".to_string(),
+        provider_id: "prov".to_string(),
+        service_account_email: None,
+        token_lifetime: None,
+    };
+
+    let result = generate_gcp_credential_config(
+        "task-1",
+        &config,
+        Path::new("/path with spaces/oz"),
+        Path::new("/tmp/out"),
+    );
+    assert!(matches!(
+        result,
+        Err(PrepareGcpCredentialsError::InvalidBinaryPath { .. })
+    ));
+}
+
+#[test]
+fn rejects_task_id_with_spaces() {
+    let config = GcpFederationConfig {
+        project_number: "123".to_string(),
+        pool_id: "pool".to_string(),
+        provider_id: "prov".to_string(),
+        service_account_email: None,
+        token_lifetime: None,
+    };
+
+    let result = generate_gcp_credential_config(
+        "task with spaces",
+        &config,
+        Path::new("/bin/oz"),
+        Path::new("/tmp/out"),
+    );
+    assert!(matches!(
+        result,
+        Err(PrepareGcpCredentialsError::InvalidTaskId { .. })
+    ));
+}
+
+#[test]
+fn service_account_impersonation() {
+    let config = GcpFederationConfig {
+        project_number: "111".to_string(),
+        pool_id: "pool".to_string(),
+        provider_id: "prov".to_string(),
+        service_account_email: Some("sa@project.iam.gserviceaccount.com".to_string()),
+        token_lifetime: Some(Duration::from_secs(1800)),
+    };
+
+    let result =
+        generate_gcp_credential_config("t-1", &config, Path::new("/bin/oz"), Path::new("/tmp/out"))
+            .unwrap();
+
+    assert_eq!(
+        result,
+        json!({
+            "type": "external_account",
+            "audience": "//iam.googleapis.com/projects/111/locations/global/workloadIdentityPools/pool/providers/prov",
+            "subject_token_type": "urn:ietf:params:oauth:token-type:id_token",
+            "token_url": "https://sts.googleapis.com/v1/token",
+            "credential_source": {
+                "executable": {
+                    "command": "/bin/oz federate issue-gcp-token --run-id t-1 --duration 1800s",
+                    "timeout_millis": 30000,
+                    "output_file": "/tmp/out"
+                }
+            },
+            "service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/sa@project.iam.gserviceaccount.com:generateAccessToken",
+            "service_account_impersonation": {
+                "token_lifetime_seconds": 1800
+            }
+        })
+    );
+}
+
+#[test]
+fn no_duration_flag_when_lifetime_absent() {
+    let config = GcpFederationConfig {
+        project_number: "333".to_string(),
+        pool_id: "pool".to_string(),
+        provider_id: "prov".to_string(),
+        service_account_email: None,
+        token_lifetime: None,
+    };
+
+    let result =
+        generate_gcp_credential_config("t-3", &config, Path::new("/bin/oz"), Path::new("/tmp/out"))
+            .unwrap();
+    assert_eq!(
+        result,
+        json!({
+            "type": "external_account",
+            "audience": "//iam.googleapis.com/projects/333/locations/global/workloadIdentityPools/pool/providers/prov",
+            "subject_token_type": "urn:ietf:params:oauth:token-type:id_token",
+            "token_url": "https://sts.googleapis.com/v1/token",
+            "credential_source": {
+                "executable": {
+                    "command": "/bin/oz federate issue-gcp-token --run-id t-3",
+                    "timeout_millis": 30000,
+                    "output_file": "/tmp/out"
+                }
+            }
+        })
+    );
+}