Add googleid tests

Author: everesio

README.md

@@ -368,7 +368,6 @@ spec:
 * [ ] Optional ApiVersionsRequest before Local SASL Authentication Sequence
 * [ ] SaslHandshakeRequest v1 - Kafka 1.1.0
 * [X] Connect to Kafka through SOCKS5 Proxy
-* [ ] Proxy support for outgoing HTTP/HTTPS connections (googleid)
 * [ ] Performance tests and tuning
 * [ ] Socket buffer sizing e.g. SO_RCVBUF = 32768, SO_SNDBUF = 131072
 * [ ] Kafka connect tests

pkg/libs/googleid/certs_test.go

@@ -0,0 +1,32 @@
+package googleid
+
+import (
+	"context"
+	"github.com/stretchr/testify/assert"
+	"testing"
+	"time"
+)
+
+func TestGetCerts(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	certs, err := GetCerts(ctx)
+
+	a := assert.New(t)
+	a.Nil(err)
+	a.NotNil(certs)
+	a.True(len(certs.Keys) > 0)
+
+	for _, key := range certs.Keys {
+		a.NotEmpty(key.Kty)
+		a.NotEmpty(key.Alg)
+		a.NotEmpty(key.Use)
+		a.NotEmpty(key.E)
+		a.NotEmpty(key.N)
+		a.NotEmpty(key.Kid)
+
+		pk, err := key.GetPublicKey()
+		a.Nil(err)
+		a.NotNil(pk)
+	}
+}

pkg/libs/googleid/jwt_test.go

@@ -0,0 +1,70 @@
+package googleid
+
+import (
+	"crypto"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha256"
+	"encoding/base64"
+	"fmt"
+	"github.com/stretchr/testify/assert"
+	"testing"
+)
+
+func TestParseJWT(t *testing.T) {
+	a := assert.New(t)
+	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	a.Nil(err)
+
+	testHeader := `{
+       "alg": "RS256",
+       "kid": "978ca4118bf1883b316bbca6ce9044d9977f2027"
+    }`
+	testClaims := `{
+       "azp": "4712.apps.googleusercontent.com",
+       "aud": "4711.apps.googleusercontent.com",
+       "sub": "100004711",
+       "hd": "grepplabs.com",
+       "email": "[email protected]",
+       "email_verified": true,
+       "exp": 2114380800,
+       "iss": "accounts.google.com",
+       "iat": 1516304351
+       }`
+
+	tokenString, err := encodeTestToken(testHeader, testClaims, privateKey)
+	a.Nil(err)
+	a.NotEmpty(tokenString)
+
+	token, err := ParseJWT(tokenString)
+	a.Nil(err)
+	a.NotNil(token)
+
+	a.Equal(token.Raw, tokenString)
+	a.Equal(token.Header.Algorithm, "RS256")
+	a.Equal(token.Header.KeyID, "978ca4118bf1883b316bbca6ce9044d9977f2027")
+
+	a.Equal(token.ClaimSet.Azp, "4712.apps.googleusercontent.com")
+	a.Equal(token.ClaimSet.Aud, "4711.apps.googleusercontent.com")
+	a.Equal(token.ClaimSet.Sub, "100004711")
+	a.Equal(token.ClaimSet.Email, "[email protected]")
+	a.Equal(token.ClaimSet.EmailVerified, true)
+	a.Equal(token.ClaimSet.Exp, int64(2114380800))
+	a.Equal(token.ClaimSet.Iss, "accounts.google.com")
+	a.Equal(token.ClaimSet.Iat, int64(1516304351))
+
+}
+
+func encodeTestToken(headerJSON string, claimsJSON string, key *rsa.PrivateKey) (string, error) {
+	sg := func(data []byte) (sig []byte, err error) {
+		h := sha256.New()
+		h.Write(data)
+		return rsa.SignPKCS1v15(rand.Reader, key, crypto.SHA256, h.Sum(nil))
+	}
+	ss := fmt.Sprintf("%s.%s", base64.RawURLEncoding.EncodeToString([]byte(headerJSON)), base64.RawURLEncoding.EncodeToString([]byte(claimsJSON)))
+	sig, err := sg([]byte(ss))
+	if err != nil {
+		return "", err
+	}
+	return fmt.Sprintf("%s.%s", ss, base64.RawURLEncoding.EncodeToString(sig)), nil
+}

pkg/libs/googleid/service_account_test.go

@@ -0,0 +1,24 @@
+package googleid
+
+import (
+	"context"
+	"github.com/stretchr/testify/assert"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+func TestGetServiceAccountIDToken(t *testing.T) {
+	t.Skip() // Uncomment to execute
+
+	credentialsFile := filepath.Join(os.Getenv("HOME"), "kafka-gateway-service-account.json")
+	src, err := NewServiceAccountTokenSource(credentialsFile, "tcp://kafka-gateway.grepplabs.com")
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	token, err := src.GetIDToken(ctx)
+
+	a := assert.New(t)
+	a.Nil(err)
+	a.NotEmpty(token)
+}

pkg/libs/googleid/user_account_test.go

@@ -0,0 +1,21 @@
+package googleid
+
+import (
+	"context"
+	"github.com/stretchr/testify/assert"
+	"testing"
+	"time"
+)
+
+func TestGetUserIDToken(t *testing.T) {
+	t.Skip() // Uncomment to execute
+
+	src := NewAuthorizedUserTokenSource()
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	token, err := src.GetIDToken(ctx)
+
+	a := assert.New(t)
+	a.Nil(err)
+	a.NotEmpty(token)
+}