Repository: grpc/grpc-go
File: credentials/jwt/token_file_call_creds_ext_test.go (Go)

Code before:
	_, err = client.EmptyCall(ctx, &testpb.Empty{}, grpc.PerRPCCredentials(jwtCreds))

	if err == nil || !strings.Contains(err.Error(), "cannot send secure credentials on an insecure connection") {
		t.Fatalf("EmptyCall() error = %v; want error containing %q", err, "cannot send secure credentials on an insecure connection")
	}
}

// TestJWTCallCredentials_InsecureTransport_AsDialOption verifies that when JWT
// call credentials are passed as a dial option over an insecure transport, the
// client creation fails with a meaningful error.
func TestJWTCallCredentials_InsecureTransport_AsDialOption(t *testing.T) {
	token := createTestJWT(t, time.Now().Add(time.Hour))
	tokenFile := writeTempTokenFile(t, token)

	jwtCreds, err := jwt.NewTokenFileCallCredentials(tokenFile)
	if err != nil {
		t.Fatalf("NewTokenFileCallCredentials(%q) failed: %v", tokenFile, err)
	}

	ss := &stubserver.StubServer{}
	if err := ss.StartServer(grpc.Creds(insecure.NewCredentials())); err != nil {
		t.Fatalf("Failed to start server: %v", err)
	}
	defer ss.Stop()

	_, err = grpc.NewClient(ss.Address,
		grpc.WithTransportCredentials(insecure.NewCredentials()),
		grpc.WithPerRPCCredentials(jwtCreds),
	)

	if err == nil || !strings.Contains(err.Error(), "the credentials require transport level security") {
		t.Fatalf("grpc.NewClient() error = %v; want error containing %q", err, "the credentials require transport level security")
	}
}

// TestJWTCallCredentials_SecureTransport_AsDialOption verifies that JWT call
// credentials work correctly when passed as a dial option over a secure TLS
// transport.
func TestJWTCallCredentials_SecureTransport_AsDialOption(t *testing.T) {
	token := createTestJWT(t, time.Now().Add(time.Hour))
	tokenFile := writeTempTokenFile(t, token)

	jwtCreds, err := jwt.NewTokenFileCallCredentials(tokenFile)
	if err != nil {
		t.Fatalf("NewTokenFileCallCredentials(%q) failed: %v", tokenFile, err)
	}

	wantAuth := "Bearer " + token
	ss := &stubserver.StubServer{
		EmptyCallF: func(ctx context.Context, _ *testpb.Empty) (*testpb.Empty, error) {
			md, ok := metadata.FromIncomingContext(ctx)

Review comment (security):
Please don't break up lines this way. Please see the "Line length" section of the style guide: cannot send secure credentials on an insecure connection

This line is short enough to be on a single line. In other places where we have to pass a *lot* of dial options, we usually define a slice of dial options right before the call to `NewClient` and pass that slice to it.

Code after:

	client := testgrpc.NewTestServiceClient(cc)
	_, err = client.EmptyCall(ctx, &testpb.Empty{}, grpc.PerRPCCredentials(jwtCreds))
	if err == nil || !strings.Contains(err.Error(), wantErr) {
		t.Fatalf("EmptyCall() error = %v; want error containing %q", err, wantErr)
	}
}

// TestJWTCallCredentials_InsecureTransport_AsDialOption verifies that when JWT
// call credentials are passed as a dial option over an insecure transport, the
// client creation fails with a meaningful error.
func TestJWTCallCredentials_InsecureTransport_AsDialOption(t *testing.T) {
	token := createTestJWT(t, time.Now().Add(time.Hour))
	tokenFile := writeTempTokenFile(t, token)

	jwtCreds, err := jwt.NewTokenFileCallCredentials(tokenFile)
	if err != nil {
		t.Fatalf("NewTokenFileCallCredentials(%q) failed: %v", tokenFile, err)
	}

	ss := &stubserver.StubServer{}
	if err := ss.StartServer(grpc.Creds(insecure.NewCredentials())); err != nil {
		t.Fatalf("Failed to start server: %v", err)
	}
	defer ss.Stop()

	_, err = grpc.NewClient(ss.Address, grpc.WithTransportCredentials(insecure.NewCredentials()), grpc.WithPerRPCCredentials(jwtCreds))
	if err == nil || !strings.Contains(err.Error(), "the credentials require transport level security") {
		t.Fatalf("grpc.NewClient() error = %v; want error containing %q", err, "the credentials require transport level security")
	}
}

// TestJWTCallCredentials_SecureTransport_AsDialOption verifies that JWT call
// credentials work correctly when passed as a dial option over a secure TLS
// transport.
func TestJWTCallCredentials_SecureTransport_AsDialOption(t *testing.T) {
	token := createTestJWT(t, time.Now().Add(time.Hour))
	tokenFile := writeTempTokenFile(t, token)

	jwtCreds, err := jwt.NewTokenFileCallCredentials(tokenFile)
	if err != nil {
		t.Fatalf("NewTokenFileCallCredentials(%q) failed: %v", tokenFile, err)
	}

	wantAuth := "Bearer " + token
	ss := &stubserver.StubServer{
		EmptyCallF: func(ctx context.Context, _ *testpb.Empty) (*testpb.Empty, error) {
			md, ok := metadata.FromIncomingContext(ctx)
			if !ok {
				return nil, fmt.Errorf("no metadata received")
			}