TEST_F(CheckAuthTest, TestOKAuth) {
  // Step 1. Check auth requires open ID discovery and fetching public key.
  TestValidToken(kToken, kUserInfo_kSub2_kIss);

  EXPECT_TRUE(Mock::VerifyAndClearExpectations(raw_request_));
  EXPECT_TRUE(Mock::VerifyAndClearExpectations(raw_env_));

  // Step 2. Check auth with the same auth token. This time the token is cached.
  EXPECT_CALL(*raw_request_, FindHeader("x-goog-iap-jwt-assertion", _))
      .WillOnce(Invoke([](const std::string &, std::string *token) {
        *token = "";
        return false;
      }));
  EXPECT_CALL(*raw_request_, FindHeader(kAuthHeader, _))
      .WillOnce(Invoke([](const std::string &, std::string *token) {
        *token = std::string(kBearer) + std::string(kToken);
        return true;
      }));
  EXPECT_CALL(*raw_request_, SetAuthToken(kToken)).Times(1);
  EXPECT_CALL(*raw_env_, DoRunHTTPRequest(_)).Times(0);
  EXPECT_CALL(*raw_request_,
              AddHeaderToBackend(kEndpointApiUserInfo, kUserInfo_kSub_kIss))
      .WillOnce(Return(utils::Status::OK));

  CheckAuth(context_, [](Status status) { ASSERT_TRUE(status.ok()); });

  EXPECT_TRUE(Mock::VerifyAndClearExpectations(raw_request_));
  EXPECT_TRUE(Mock::VerifyAndClearExpectations(raw_env_));

  // Step 3. Check auth with a different token signed by the same issuer.
  // In this case, the token is not in the cache, but key is cached.
  EXPECT_CALL(*raw_request_, FindHeader("x-goog-iap-jwt-assertion", _))
      .WillOnce(Invoke([](const std::string &, std::string *token) {
        *token = "";
        return false;
      }));
  EXPECT_CALL(*raw_request_, FindHeader(kAuthHeader, _))
      .WillOnce(Invoke([](const std::string &, std::string *token) {
        *token = std::string(kToken2);
        return true;
      }));
  EXPECT_CALL(*raw_request_, SetAuthToken(kToken2)).Times(1);
  EXPECT_CALL(*raw_env_, DoRunHTTPRequest(_)).Times(0);
  EXPECT_CALL(*raw_request_,
              AddHeaderToBackend(kEndpointApiUserInfo, kUserInfo_kSub2_kIss2))
      .WillOnce(Return(utils::Status::OK));

  CheckAuth(context_, [](Status status) { ASSERT_TRUE(status.ok()); });
}
TEST_F(CheckAuthTest, TestOKAuth) {
   
  TestValidToken(kToken, kUserInfo_kSub2_kIss);

  EXPECT_TRUE(Mock::VerifyAndClearExpectations(raw_request_));
  EXPECT_TRUE(Mock::VerifyAndClearExpectations(raw_env_));

   
  EXPECT_CALL(*raw_request_, FindHeader("x-goog-iap-jwt-assertion", _))
      .WillOnce(Invoke([](const std::string &, std::string *token) {
        *token = "";
        return false;
      }));
  EXPECT_CALL(*raw_request_, FindHeader(kAuthHeader, _))
      .WillOnce(Invoke([](const std::string &, std::string *token) {
        *token = std::string(kBearer) + std::string(kToken);
        return true;
      }));
  EXPECT_CALL(*raw_request_, SetAuthToken(kToken)).Times(1);
  EXPECT_CALL(*raw_env_, DoRunHTTPRequest(_)).Times(0);
  EXPECT_CALL(*raw_request_,
              AddHeaderToBackend(kEndpointApiUserInfo, kUserInfo_kSub_kIss))
      .WillOnce(Return(utils::Status::OK));

  CheckAuth(context_, [](Status status) { ASSERT_TRUE(status.ok()); });

  EXPECT_TRUE(Mock::VerifyAndClearExpectations(raw_request_));
  EXPECT_TRUE(Mock::VerifyAndClearExpectations(raw_env_));

   
   
  EXPECT_CALL(*raw_request_, FindHeader("x-goog-iap-jwt-assertion", _))
      .WillOnce(Invoke([](const std::string &, std::string *token) {
        *token = "";
        return false;
      }));
  EXPECT_CALL(*raw_request_, FindHeader(kAuthHeader, _))
      .WillOnce(Invoke([](const std::string &, std::string *token) {
        *token = std::string(kToken2);
        return true;
      }));
  EXPECT_CALL(*raw_request_, SetAuthToken(kToken2)).Times(1);
  EXPECT_CALL(*raw_env_, DoRunHTTPRequest(_)).Times(0);
  EXPECT_CALL(*raw_request_,
              AddHeaderToBackend(kEndpointApiUserInfo, kUserInfo_kSub2_kIss2))
      .WillOnce(Return(utils::Status::OK));

  CheckAuth(context_, [](Status status) { ASSERT_TRUE(status.ok()); });
}