From 5c9270196149c21c1902bf6e43b175db783c70ba Mon Sep 17 00:00:00 2001 From: MahendraMula Date: Wed, 9 Sep 2026 18:31:26 +0530 Subject: [PATCH 1/3] test(auth): clean up test coverage and outdated docstrings for mTLS and identity pool (#17758) --- .../tests/compute_engine/test__mtls.py | 12 +++++ .../google-auth/tests/test_identity_pool.py | 53 +++++++++++++++++++ .../tests/transport/test_aio_mtls_helper.py | 6 +-- 3 files changed, 68 insertions(+), 3 deletions(-) diff --git a/packages/google-auth/tests/compute_engine/test__mtls.py b/packages/google-auth/tests/compute_engine/test__mtls.py index 3fea6308f585..a597738ae9a1 100644 --- a/packages/google-auth/tests/compute_engine/test__mtls.py +++ b/packages/google-auth/tests/compute_engine/test__mtls.py @@ -326,3 +326,15 @@ def test_mds_mtls_adapter_send_no_fallback_strict_mode( request = requests.Request(method="GET", url="https://fake-mds.com").prepare() with pytest.raises(requests.exceptions.SSLError): adapter.send(request) + +@mock.patch("requests.adapters.HTTPAdapter.close") +@mock.patch("ssl.create_default_context") +def test_mds_mtls_adapter_close( + mock_ssl_context, mock_super_close, mock_mds_mtls_config +): + adapter = _mtls.MdsMtlsAdapter(mock_mds_mtls_config) + with mock.patch.object(adapter._fallback_adapter, "close") as mock_fallback_close: + adapter.close() + mock_fallback_close.assert_called_once() + mock_super_close.assert_called_once() + diff --git a/packages/google-auth/tests/test_identity_pool.py b/packages/google-auth/tests/test_identity_pool.py index 1138db284db7..7cc2445e08ad 100644 --- a/packages/google-auth/tests/test_identity_pool.py +++ b/packages/google-auth/tests/test_identity_pool.py @@ -1000,6 +1000,27 @@ def test_retrieve_subject_token_json_file(self): assert subject_token == JSON_FILE_SUBJECT_TOKEN + def test_retrieve_subject_token_supplier_leaf_cert_callback_error(self): + def failing_callback(): + raise RuntimeError("Read error") + + supplier = identity_pool._X509Supplier( + trust_chain_path=None, + leaf_cert_callback=failing_callback, + ) + with pytest.raises(exceptions.RefreshError) as excinfo: + supplier.get_subject_token(None, None) + assert "Failed to retrieve leaf certificate." in str(excinfo.value) + + def test_retrieve_subject_token_supplier_leaf_cert_parse_error(self): + supplier = identity_pool._X509Supplier( + trust_chain_path=None, + leaf_cert_callback=lambda: b"invalid-non-pem-data", + ) + with pytest.raises(exceptions.RefreshError) as excinfo: + supplier.get_subject_token(None, None) + assert "Failed to parse leaf certificate." in str(excinfo.value) + @mock.patch( "google.auth.transport._mtls_helper._get_workload_cert_and_key_paths", return_value=(CERT_FILE, KEY_FILE), @@ -1097,6 +1118,38 @@ def test_retrieve_subject_token_certificate_trust_chain_file_does_not_exist( assert excinfo.match("Trust chain file 'fake.pem' was not found.") + @mock.patch.object( + identity_pool.Credentials, + "_get_cert_bytes", + side_effect=Exception("Read error"), + ) + def test_retrieve_subject_token_leaf_cert_callback_error( + self, mock_get_cert_bytes + ): + credentials = self.make_credentials( + credential_source=self.CREDENTIAL_SOURCE_CERTIFICATE + ) + with pytest.raises( + exceptions.RefreshError, match="Failed to retrieve leaf certificate." + ): + credentials.retrieve_subject_token(None) + + @mock.patch.object( + identity_pool.Credentials, + "_get_cert_bytes", + return_value=b"invalid-pem-data", + ) + def test_retrieve_subject_token_leaf_cert_parse_error( + self, mock_get_cert_bytes + ): + credentials = self.make_credentials( + credential_source=self.CREDENTIAL_SOURCE_CERTIFICATE + ) + with pytest.raises( + exceptions.RefreshError, match="Failed to parse leaf certificate." + ): + credentials.retrieve_subject_token(None) + @mock.patch( "google.auth.transport._mtls_helper._get_workload_cert_and_key_paths", return_value=(CERT_FILE, KEY_FILE), diff --git a/packages/google-auth/tests/transport/test_aio_mtls_helper.py b/packages/google-auth/tests/transport/test_aio_mtls_helper.py index 0900225cada0..40a7c5f79979 100644 --- a/packages/google-auth/tests/transport/test_aio_mtls_helper.py +++ b/packages/google-auth/tests/transport/test_aio_mtls_helper.py @@ -181,15 +181,15 @@ async def test_get_client_cert_and_key_callback_async(self): @pytest.mark.asyncio async def test_get_client_cert_and_key_callback_sync(self): - """Tests that a sync callback is handled via the TypeError fallback.""" + """Tests that a sync callback is handled via inspect.isawaitable.""" callback = mock.Mock(return_value=(CERT_DATA, KEY_DATA)) success, cert, key = await mtls.get_client_cert_and_key(callback) assert success is True assert cert == CERT_DATA - # Note: In the source, the first 'await' will call the function. - # When it fails to await, the exception handler uses the result already obtained. + # When the callback is synchronous, inspect.isawaitable() is False + # and the result is returned directly without awaiting. assert callback.call_count == 1 @pytest.mark.asyncio From dfb706c0a273278dc8ce3feb63dd6822cc73321d Mon Sep 17 00:00:00 2001 From: Venkata Surya Mahendra Mula Date: Wed, 9 Sep 2026 18:41:21 +0530 Subject: [PATCH 2/3] Update packages/google-auth/tests/compute_engine/test__mtls.py Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> --- packages/google-auth/tests/compute_engine/test__mtls.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/google-auth/tests/compute_engine/test__mtls.py b/packages/google-auth/tests/compute_engine/test__mtls.py index a597738ae9a1..86d5ead43c69 100644 --- a/packages/google-auth/tests/compute_engine/test__mtls.py +++ b/packages/google-auth/tests/compute_engine/test__mtls.py @@ -328,7 +328,7 @@ def test_mds_mtls_adapter_send_no_fallback_strict_mode( adapter.send(request) @mock.patch("requests.adapters.HTTPAdapter.close") -@mock.patch("ssl.create_default_context") +@mock.patch("google.auth.compute_engine._mtls.ssl.create_default_context") def test_mds_mtls_adapter_close( mock_ssl_context, mock_super_close, mock_mds_mtls_config ): From 0cab83c362be67a93539f2a3e4722d04ef9c115a Mon Sep 17 00:00:00 2001 From: MahendraMula Date: Thu, 10 Sep 2026 10:08:32 +0530 Subject: [PATCH 3/3] style(auth): apply Black formatting to test files --- packages/google-auth/tests/compute_engine/test__mtls.py | 2 +- packages/google-auth/tests/test_identity_pool.py | 8 ++------ 2 files changed, 3 insertions(+), 7 deletions(-) diff --git a/packages/google-auth/tests/compute_engine/test__mtls.py b/packages/google-auth/tests/compute_engine/test__mtls.py index 86d5ead43c69..1c5f18641558 100644 --- a/packages/google-auth/tests/compute_engine/test__mtls.py +++ b/packages/google-auth/tests/compute_engine/test__mtls.py @@ -327,6 +327,7 @@ def test_mds_mtls_adapter_send_no_fallback_strict_mode( with pytest.raises(requests.exceptions.SSLError): adapter.send(request) + @mock.patch("requests.adapters.HTTPAdapter.close") @mock.patch("google.auth.compute_engine._mtls.ssl.create_default_context") def test_mds_mtls_adapter_close( @@ -337,4 +338,3 @@ def test_mds_mtls_adapter_close( adapter.close() mock_fallback_close.assert_called_once() mock_super_close.assert_called_once() - diff --git a/packages/google-auth/tests/test_identity_pool.py b/packages/google-auth/tests/test_identity_pool.py index 7cc2445e08ad..f7fec22c3f34 100644 --- a/packages/google-auth/tests/test_identity_pool.py +++ b/packages/google-auth/tests/test_identity_pool.py @@ -1123,9 +1123,7 @@ def test_retrieve_subject_token_certificate_trust_chain_file_does_not_exist( "_get_cert_bytes", side_effect=Exception("Read error"), ) - def test_retrieve_subject_token_leaf_cert_callback_error( - self, mock_get_cert_bytes - ): + def test_retrieve_subject_token_leaf_cert_callback_error(self, mock_get_cert_bytes): credentials = self.make_credentials( credential_source=self.CREDENTIAL_SOURCE_CERTIFICATE ) @@ -1139,9 +1137,7 @@ def test_retrieve_subject_token_leaf_cert_callback_error( "_get_cert_bytes", return_value=b"invalid-pem-data", ) - def test_retrieve_subject_token_leaf_cert_parse_error( - self, mock_get_cert_bytes - ): + def test_retrieve_subject_token_leaf_cert_parse_error(self, mock_get_cert_bytes): credentials = self.make_credentials( credential_source=self.CREDENTIAL_SOURCE_CERTIFICATE )