|
7 | 7 | from unittest import mock |
8 | 8 | from unittest.mock import Mock, patch |
9 | 9 |
|
| 10 | +import aiohttp |
10 | 11 | import pytest |
11 | 12 |
|
12 | 13 | try: |
|
18 | 19 | import snowflake.connector.errors |
19 | 20 | from snowflake.connector.token_cache import TokenCache, TokenKey, TokenType |
20 | 21 |
|
21 | | -from ...wiremock.wiremock_utils import WiremockClient |
| 22 | +from ...test_utils.wiremock.wiremock_utils import WiremockClient |
22 | 23 | from ..test_oauth_token import omit_oauth_urls_check # noqa: F401 |
23 | 24 |
|
24 | 25 | logger = logging.getLogger(__name__) |
@@ -699,3 +700,159 @@ async def test_client_creds_expired_refresh_token_flow_async( |
699 | 700 | cached_refresh_token = temp_cache_async.retrieve(refresh_token_key) |
700 | 701 | assert cached_access_token == "expired-access-token-123" |
701 | 702 | assert cached_refresh_token == "expired-refresh-token-123" |
| 703 | + |
| 704 | + |
| 705 | +@pytest.mark.skipolddriver |
| 706 | +@pytest.mark.parametrize("proxy_method", ["explicit_args", "env_vars"]) |
| 707 | +async def test_client_credentials_flow_through_proxy_async( |
| 708 | + wiremock_oauth_client_creds_dir, |
| 709 | + wiremock_generic_mappings_dir, |
| 710 | + wiremock_target_proxy_pair, |
| 711 | + temp_cache_async, |
| 712 | + proxy_env_vars, |
| 713 | + proxy_method, |
| 714 | +): |
| 715 | + """Run OAuth Client-Credentials flow and ensure it goes through proxy (async).""" |
| 716 | + from snowflake.connector.aio import SnowflakeConnection |
| 717 | + |
| 718 | + target_wm, proxy_wm = wiremock_target_proxy_pair |
| 719 | + |
| 720 | + expected_headers = {"Via": {"contains": "wiremock"}} |
| 721 | + |
| 722 | + target_wm.import_mapping_with_default_placeholders( |
| 723 | + wiremock_oauth_client_creds_dir / "successful_flow.json", expected_headers |
| 724 | + ) |
| 725 | + target_wm.add_mapping_with_default_placeholders( |
| 726 | + wiremock_generic_mappings_dir / "snowflake_login_successful.json", |
| 727 | + expected_headers, |
| 728 | + ) |
| 729 | + target_wm.add_mapping( |
| 730 | + wiremock_generic_mappings_dir / "snowflake_disconnect_successful.json", |
| 731 | + expected_headers=expected_headers, |
| 732 | + ) |
| 733 | + |
| 734 | + token_request_url = f"http://{target_wm.wiremock_host}:{target_wm.wiremock_http_port}/oauth/token-request" |
| 735 | + |
| 736 | + set_proxy_env_vars, clear_proxy_env_vars = proxy_env_vars |
| 737 | + connect_kwargs = { |
| 738 | + "user": "testUser", |
| 739 | + "authenticator": "OAUTH_CLIENT_CREDENTIALS", |
| 740 | + "oauth_client_id": "cid", |
| 741 | + "oauth_client_secret": "secret", |
| 742 | + "account": "testAccount", |
| 743 | + "protocol": "http", |
| 744 | + "role": "ANALYST", |
| 745 | + "oauth_token_request_url": token_request_url, |
| 746 | + "host": target_wm.wiremock_host, |
| 747 | + "port": target_wm.wiremock_http_port, |
| 748 | + "oauth_enable_refresh_tokens": True, |
| 749 | + "client_store_temporary_credential": True, |
| 750 | + "token_cache": temp_cache_async, |
| 751 | + } |
| 752 | + |
| 753 | + if proxy_method == "explicit_args": |
| 754 | + connect_kwargs.update( |
| 755 | + { |
| 756 | + "proxy_host": proxy_wm.wiremock_host, |
| 757 | + "proxy_port": str(proxy_wm.wiremock_http_port), |
| 758 | + "proxy_user": "proxyUser", |
| 759 | + "proxy_password": "proxyPass", |
| 760 | + } |
| 761 | + ) |
| 762 | + clear_proxy_env_vars() |
| 763 | + else: |
| 764 | + proxy_url = f"http://proxyUser:proxyPass@{proxy_wm.wiremock_host}:{proxy_wm.wiremock_http_port}" |
| 765 | + set_proxy_env_vars(proxy_url) |
| 766 | + |
| 767 | + with mock.patch("secrets.token_urlsafe", return_value="abc123"): |
| 768 | + cnx = SnowflakeConnection(**connect_kwargs) |
| 769 | + await cnx.connect() |
| 770 | + await cnx.close() |
| 771 | + |
| 772 | + async with aiohttp.ClientSession() as session: |
| 773 | + async with session.get( |
| 774 | + f"{proxy_wm.http_host_with_port}/__admin/requests" |
| 775 | + ) as resp: |
| 776 | + proxy_requests = await resp.json() |
| 777 | + assert any( |
| 778 | + req["request"]["url"].endswith("/oauth/token-request") |
| 779 | + for req in proxy_requests["requests"] |
| 780 | + ) |
| 781 | + |
| 782 | + async with session.get( |
| 783 | + f"{target_wm.http_host_with_port}/__admin/requests" |
| 784 | + ) as resp: |
| 785 | + target_requests = await resp.json() |
| 786 | + assert any( |
| 787 | + req["request"]["url"].endswith("/oauth/token-request") |
| 788 | + for req in target_requests["requests"] |
| 789 | + ) |
| 790 | + |
| 791 | + |
| 792 | +@pytest.mark.skipolddriver |
| 793 | +@patch("snowflake.connector.auth._http_server.AuthHttpServer.DEFAULT_TIMEOUT", 30) |
| 794 | +async def test_oauth_code_successful_flow_through_proxy_async( |
| 795 | + wiremock_oauth_authorization_code_dir, |
| 796 | + wiremock_generic_mappings_dir, |
| 797 | + wiremock_target_proxy_pair, |
| 798 | + webbrowser_mock_sync, |
| 799 | + monkeypatch, |
| 800 | + omit_oauth_urls_check, # noqa: F811 |
| 801 | +) -> None: |
| 802 | + from snowflake.connector.aio import SnowflakeConnection |
| 803 | + |
| 804 | + monkeypatch.setenv("SNOWFLAKE_AUTH_SOCKET_REUSE_PORT", "true") |
| 805 | + target_wm, proxy_wm = wiremock_target_proxy_pair |
| 806 | + |
| 807 | + target_wm.import_mapping_with_default_placeholders( |
| 808 | + wiremock_oauth_authorization_code_dir / "successful_flow.json", |
| 809 | + ) |
| 810 | + target_wm.add_mapping_with_default_placeholders( |
| 811 | + wiremock_generic_mappings_dir / "snowflake_login_successful.json", |
| 812 | + ) |
| 813 | + target_wm.add_mapping( |
| 814 | + wiremock_generic_mappings_dir / "snowflake_disconnect_successful.json", |
| 815 | + ) |
| 816 | + |
| 817 | + with mock.patch("webbrowser.open", new=webbrowser_mock_sync.open): |
| 818 | + with mock.patch("secrets.token_urlsafe", return_value="abc123"): |
| 819 | + cnx = SnowflakeConnection( |
| 820 | + user="testUser", |
| 821 | + authenticator="OAUTH_AUTHORIZATION_CODE", |
| 822 | + oauth_client_id="123", |
| 823 | + account="testAccount", |
| 824 | + protocol="http", |
| 825 | + role="ANALYST", |
| 826 | + proxy_host=proxy_wm.wiremock_host, |
| 827 | + proxy_port=str(proxy_wm.wiremock_http_port), |
| 828 | + proxy_user="proxyUser", |
| 829 | + proxy_password="proxyPass", |
| 830 | + oauth_client_secret="testClientSecret", |
| 831 | + oauth_token_request_url=f"http://{target_wm.wiremock_host}:{target_wm.wiremock_http_port}/oauth/token-request", |
| 832 | + oauth_authorization_url=f"http://{target_wm.wiremock_host}:{target_wm.wiremock_http_port}/oauth/authorize", |
| 833 | + oauth_redirect_uri="http://localhost:8009/snowflake/oauth-redirect", |
| 834 | + host=target_wm.wiremock_host, |
| 835 | + port=target_wm.wiremock_http_port, |
| 836 | + ) |
| 837 | + |
| 838 | + await cnx.connect() |
| 839 | + await cnx.close() |
| 840 | + |
| 841 | + async with aiohttp.ClientSession() as session: |
| 842 | + async with session.get( |
| 843 | + f"http://{proxy_wm.wiremock_host}:{proxy_wm.wiremock_http_port}/__admin/requests" |
| 844 | + ) as resp: |
| 845 | + proxy_requests = await resp.json() |
| 846 | + assert any( |
| 847 | + req["request"]["url"].endswith("/oauth/token-request") |
| 848 | + for req in proxy_requests["requests"] |
| 849 | + ), "Proxy did not record token-request" |
| 850 | + |
| 851 | + async with session.get( |
| 852 | + f"http://{target_wm.wiremock_host}:{target_wm.wiremock_http_port}/__admin/requests" |
| 853 | + ) as resp: |
| 854 | + target_requests = await resp.json() |
| 855 | + assert any( |
| 856 | + req["request"]["url"].endswith("/oauth/token-request") |
| 857 | + for req in target_requests["requests"] |
| 858 | + ), "Target did not receive token-request forwarded by proxy" |
0 commit comments