Repository: hashicorp/vault
File: api/auth/cert/cert_test.go (Go)

Code before:
		{"with role", []LoginOption{WithRole("myrole")}, "cert-myrole-token"},
		{"with mount and role", []LoginOption{WithMountPath("mycert"), WithRole("myrole")}, "mycert-myrole-token"},
	}
	for name, certAuthClient := range map[string]*api.Client{"default": defaultAuthClient, "based-on-client": basedOnClient} {
		for _, test := range tests {
			t.Run(fmt.Sprintf("%s-%s", name, test.name), func(t *testing.T) {
				auth, err := NewCertAuth(test.opts...)
				if err != nil {
					t.Fatalf("failed to create CertAuth: %v", err)
				}

				secret, err := auth.Login(context.Background(), certAuthClient)
				if err != nil {
					t.Fatalf("failed to login: %v", err)
				}

				if secret == nil || secret.Auth == nil || secret.Auth.ClientToken != test.expectedToken {
					t.Fatalf("unexpected response: %v", secret)
				}
			})
		}
	}
}

// TestNewDefaultCertAuthClient tests the NewDefaultCertAuthClient function validates inputs properly
func TestNewDefaultCertAuthClient1(t *testing.T) {
	certs := createCertificates(t)
	addr := "https://127.0.0.1:8200"
	tlsConfig := &api.TLSConfig{
		CAPath:     certs.caCert,
		ClientCert: certs.clientCert,
		ClientKey:  certs.clientKey,
	}
	type args struct {
		address   string
		tlsConfig *api.TLSConfig
	}
	tests := []struct {
		name    string
		args    args
		wantErr bool
	}{
		{"missing address", args{"", tlsConfig}, true},
		{"missing config", args{addr, nil}, true},
		{"missing client cert", args{addr, &api.TLSConfig{}}, true},
		{"ok", args{addr, tlsConfig}, false},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			got, err := NewDefaultCertAuthClient(tt.args.address, tt.args.tlsConfig)
			if (err != nil) != tt.wantErr {

Review comment (security):
```suggestion
func TestNewDefaultCertAuthClient(t *testing.T) {
```

Code after:
		{"with role", []LoginOption{WithRole("myrole")}, "cert-myrole-token"},
		{"with mount and role", []LoginOption{WithMountPath("mycert"), WithRole("myrole")}, "mycert-myrole-token"},
	}
	for name, certAuthClient := range map[string]*api.Client{"default": defaultAuthClient, "based-on-client": basedOnClient} {
		for _, test := range tests {
			t.Run(fmt.Sprintf("%s-%s", name, test.name), func(t *testing.T) {
				auth, err := NewCertAuth(test.opts...)
				if err != nil {
					t.Fatalf("failed to create CertAuth: %v", err)
				}

				secret, err := auth.Login(context.Background(), certAuthClient)
				if err != nil {
					t.Fatalf("failed to login: %v", err)
				}

				if secret == nil || secret.Auth == nil || secret.Auth.ClientToken != test.expectedToken {
					t.Fatalf("unexpected response: %v", secret)
				}
			})
		}
	}
}

// TestNewDefaultCertAuthClient tests the NewDefaultCertAuthClient function validates inputs properly
func TestNewDefaultCertAuthClient(t *testing.T) {
	certs := createCertificates(t)
	addr := "https://127.0.0.1:8200"
	tlsConfig := &api.TLSConfig{
		CAPath:     certs.caCert,
		ClientCert: certs.clientCert,
		ClientKey:  certs.clientKey,
	}
	type args struct {
		address   string
		tlsConfig *api.TLSConfig
	}
	tests := []struct {
		name    string
		args    args
		wantErr bool
	}{
		{"missing address", args{"", tlsConfig}, true},
		{"missing config", args{addr, nil}, true},
		{"missing client cert", args{addr, &api.TLSConfig{}}, true},
		{"ok", args{addr, tlsConfig}, false},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			got, err := NewDefaultCertAuthClient(tt.args.address, tt.args.tlsConfig)
			if (err != nil) != tt.wantErr {