test(credential-providers)): region suite

Author: kuhe

packages/credential-provider-node/tests/credential-provider-node.integ.spec.ts

@@ -8,7 +8,7 @@ import {
   fromTokenFile,
   fromWebToken,
 } from "@aws-sdk/credential-providers";
-import { MockNodeHttpHandler } from "@aws-sdk/credential-providers/tests/_test-lib.spec";
+import { MockNodeHttpHandler, assumeRoleArns } from "@aws-sdk/credential-providers/tests/_test-lib.spec";
 import { NodeHttpHandler } from "@smithy/node-http-handler";
 import { externalDataInterceptor } from "@smithy/shared-ini-file-loader";
 import type { HttpRequest, MiddlewareStack, ParsedIniData } from "@smithy/types";
@@ -22,8 +22,6 @@ import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test as i
 // eslint-disable-next-line no-restricted-imports
 import { defaultProvider } from "../src/defaultProvider";
 
-const assumeRoleArns: string[] = [];
-
 describe("credential-provider-node integration test", () => {
   let sts: STS = null as any;
   let processSnapshot: typeof process.env = null as any;

packages/credential-providers/README.md

@@ -826,7 +826,7 @@ import { fromSSO } from "@aws-sdk/credential-providers"; // ES6 import
 const client = new FooClient({
   // Optional, available on clients as of v3.714.0.
   profile: "my-sso-profile",
-  credentials: fromProcess({
+  credentials: fromSSO({
     // Optional. Defaults to the client's profile if that is set.
     // You can specify a profile here as well, but this applies
     // only to the credential resolution and not to the upper client.

packages/credential-providers/tests/_test-lib.spec.ts

@@ -1,6 +1,5 @@
 import { S3 } from "@aws-sdk/client-s3";
 import { ParsedIniData, RuntimeConfigAwsCredentialIdentityProvider } from "@aws-sdk/types";
-import { AttributedAwsCredentialIdentity } from "@aws-sdk/types/src";
 import { NodeHttpHandler } from "@smithy/node-http-handler";
 import { HttpResponse } from "@smithy/protocol-http";
 import { externalDataInterceptor } from "@smithy/shared-ini-file-loader";
@@ -11,12 +10,13 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { PassThrough } from "node:stream";
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test as it } from "vitest";
+import { fromSSO } from "@aws-sdk/credential-providers";
 
 describe("placeholder for testing lib", () => {
   it("", () => {});
 });
 
-const assumeRoleArns: string[] = [];
+export const assumeRoleArns: string[] = [];
 let iniProfileData: ParsedIniData = null as any;
 
 export type CredentialTestParameters = {
@@ -38,13 +38,30 @@ export type CredentialTestParameters = {
  * Credential provider tester.
  */
 export class CTest<P extends (init?: any) => RuntimeConfigAwsCredentialIdentityProvider> {
-  private lastCredentials: AttributedAwsCredentialIdentity | undefined;
-
-  public constructor(
-    public credentialProvider: P,
-    public providerParams: (testParams: CredentialTestParameters) => Parameters<P>[0],
-    public profileCredentials?: boolean
-  ) {
+  private readonly credentialProvider: P;
+  private readonly providerParams: (testParams: CredentialTestParameters) => Parameters<P>[0];
+  private readonly profileCredentials: boolean;
+  private readonly filter: (testParams: CredentialTestParameters) => boolean;
+  private readonly fallbackRegion: string;
+
+  public constructor({
+    credentialProvider,
+    providerParams,
+    profileCredentials,
+    filter,
+    fallbackRegion,
+  }: {
+    credentialProvider: P;
+    providerParams: (testParams: CredentialTestParameters) => Parameters<P>[0];
+    profileCredentials?: boolean;
+    filter?: (testParams: CredentialTestParameters) => boolean;
+    fallbackRegion?: string;
+  }) {
+    this.credentialProvider = credentialProvider;
+    this.providerParams = providerParams;
+    this.profileCredentials = !!profileCredentials;
+    this.filter = filter ?? (() => true);
+    this.fallbackRegion = fallbackRegion ?? "unresolved";
     this.init();
   }
 
@@ -57,8 +74,11 @@ export class CTest<P extends (init?: any) => RuntimeConfigAwsCredentialIdentityP
       };
     }
     return {
+      // used by fromIni
       profile,
       clientConfig: {
+        // used by e.g. fromTemporaryCredentials that don't have top level profile selection
+        profile,
         region: providerRegion ? "provider-region" : undefined,
       },
     };
@@ -157,6 +177,9 @@ export class CTest<P extends (init?: any) => RuntimeConfigAwsCredentialIdentityP
   public testRegion() {
     for (const withCaller of [true, false]) {
       for (const callerClientRegion of [true, false]) {
+        if (callerClientRegion && !withCaller) {
+          continue;
+        }
         for (const envRegion of [true, false]) {
           for (const profileRegion of [true, false]) {
             for (const providerRegion of [true, false]) {
@@ -174,14 +197,33 @@ export class CTest<P extends (init?: any) => RuntimeConfigAwsCredentialIdentityP
                   profile,
                 };
 
+                if (!this.filter(params)) {
+                  continue;
+                }
+
                 it(`${serializeParams(params)}`, async () => {
-                  const region = await this.resolveStsRegion(params);
+                  const region = await this.findCredentialSourceRegion(params).catch((e) => {
+                    return "failed";
+                  });
+                  const regionRequired = this.fallbackRegion === "unresolved" || withCaller;
+                  const providerParams = this.providerParams(params);
+                  const isSso = this.credentialProvider === fromSSO || providerParams.ssoStartUrl;
+                  const hasRegion = providerRegion || profileRegion || callerClientRegion || envRegion;
+
+                  if (regionRequired && !hasRegion) {
+                    expect(region).toBe("failed");
+                  }
 
                   if (providerRegion) {
                     expect(region).toBe("provider-region");
                     return;
                   }
 
+                  if (isSso) {
+                    expect(region).toBe(providerParams.ssoRegion);
+                    return;
+                  }
+
                   const usesProfileCredentials = this.profileCredentials;
 
                   if (usesProfileCredentials && profileRegion) {
@@ -204,7 +246,7 @@ export class CTest<P extends (init?: any) => RuntimeConfigAwsCredentialIdentityP
                     return;
                   }
 
-                  expect(region).toBe("us-east-1");
+                  expect(region).toBe(this.fallbackRegion);
                 });
               }
             }
@@ -214,7 +256,7 @@ export class CTest<P extends (init?: any) => RuntimeConfigAwsCredentialIdentityP
     }
   }
 
-  private async resolveStsRegion(testParams: CredentialTestParameters) {
+  private async findCredentialSourceRegion(testParams: CredentialTestParameters) {
     const { withCaller, envRegion, profile, profileRegion, callerClientRegion, providerRegion } = testParams;
 
     if (envRegion) {
@@ -285,13 +327,13 @@ export class CTest<P extends (init?: any) => RuntimeConfigAwsCredentialIdentityP
 
       await s3.listBuckets({});
       const credentials = await s3.config.credentials();
-      return credentials.sessionToken!.replace("STS_AR_SESSION_TOKEN_", "");
+      return credentials.sessionToken!.replace(/(.*?)SESSION_TOKEN_/, "");
     }
 
     const provider = this.credentialProvider(this.providerParams(testParams));
 
     const credentials = await provider();
-    return credentials.sessionToken!.replace("STS_AR_SESSION_TOKEN_", "");
+    return credentials.sessionToken!.replace(/(.*?)SESSION_TOKEN_/, "");
   }
 }
 

packages/credential-providers/tests/fromCognitoIdentity.integ.spec.ts

@@ -1,6 +1,20 @@
 import { fromCognitoIdentity } from "@aws-sdk/credential-providers";
-import { describe, test as it } from "vitest";
+import { describe } from "vitest";
+
+import { CTest } from "./_test-lib.spec";
 
 describe(fromCognitoIdentity.name, () => {
-  it("placeholder", () => {});
+  const ctest = new CTest({
+    credentialProvider: fromCognitoIdentity,
+    providerParams: (testParams) => {
+      return {
+        identityId: "us-east-1:128d0a74-c82f-4553-916d-90053example",
+        ...CTest.defaultRegionConfigProvider(testParams),
+      };
+    },
+    profileCredentials: false,
+    fallbackRegion: "unresolved",
+  });
+
+  ctest.testRegion();
 });

packages/credential-providers/tests/fromCognitoIdentityPool.integ.spec.ts

@@ -1,6 +1,20 @@
 import { fromCognitoIdentityPool } from "@aws-sdk/credential-providers";
-import { describe, test as it } from "vitest";
+import { describe } from "vitest";
+
+import { CTest } from "./_test-lib.spec";
 
 describe(fromCognitoIdentityPool.name, () => {
-  it("placeholder", () => {});
+  const ctest = new CTest({
+    credentialProvider: fromCognitoIdentityPool,
+    providerParams: (testParams) => {
+      return {
+        identityPoolId: "us-east-1:1699ebc0-7900-4099-b910-2df94f52a030",
+        ...CTest.defaultRegionConfigProvider(testParams),
+      };
+    },
+    profileCredentials: false,
+    fallbackRegion: "unresolved",
+  });
+
+  ctest.testRegion();
 });

packages/credential-providers/tests/fromEnv.integ.spec.ts

@@ -4,8 +4,11 @@ import { describe, test as it } from "vitest";
 import { CTest } from "./_test-lib.spec";
 
 describe(fromEnv.name, () => {
-  const ctest = new CTest(fromEnv, () => {
-    return {};
+  const ctest = new CTest({
+    credentialProvider: fromEnv,
+    providerParams: () => {
+      return {};
+    },
   });
 
   it("placeholder", () => {});

packages/credential-providers/tests/fromIni.integ.spec.ts

@@ -4,7 +4,12 @@ import { describe } from "vitest";
 import { CTest } from "./_test-lib.spec";
 
 describe(fromIni.name, () => {
-  const ctest = new CTest(fromIni, CTest.defaultRegionConfigProvider, true);
+  const ctest = new CTest({
+    credentialProvider: fromIni,
+    providerParams: CTest.defaultRegionConfigProvider,
+    profileCredentials: true,
+    fallbackRegion: "us-east-1",
+  });
 
   ctest.testRegion();
 });

packages/credential-providers/tests/fromNodeProviderChain.integ.spec.ts

@@ -4,7 +4,12 @@ import { describe } from "vitest";
 import { CTest } from "./_test-lib.spec";
 
 describe(fromNodeProviderChain.name, () => {
-  const ctest = new CTest(fromNodeProviderChain, CTest.defaultRegionConfigProvider, true);
+  const ctest = new CTest({
+    credentialProvider: fromNodeProviderChain,
+    providerParams: CTest.defaultRegionConfigProvider,
+    profileCredentials: true,
+    fallbackRegion: "us-east-1",
+  });
 
   ctest.testRegion();
 });

packages/credential-providers/tests/fromSSO.integ.spec.ts

@@ -1,6 +1,23 @@
 import { fromSSO } from "@aws-sdk/credential-providers";
-import { describe, test as it } from "vitest";
+import { describe } from "vitest";
+
+import { CTest } from "./_test-lib.spec";
 
 describe(fromSSO.name, () => {
-  it("placeholder", () => {});
+  const ctest = new CTest({
+    credentialProvider: fromSSO,
+    providerParams: (testParams) => {
+      return {
+        ssoStartUrl: "SSO_START_URL",
+        ssoAccountId: "1234567890",
+        ssoRegion: "sso-region-1",
+        ssoRoleName: "arn:aws:iam::1234567890:role/Rigamarole",
+        ...CTest.defaultRegionConfigProvider(testParams),
+      };
+    },
+    profileCredentials: false,
+    fallbackRegion: "unresolved",
+  });
+
+  ctest.testRegion();
 });

packages/credential-providers/tests/fromTemporaryCredentials.integ.spec.ts

@@ -5,18 +5,19 @@ import { describe, expect, test as it } from "vitest";
 import { CTest } from "./_test-lib.spec";
 
 describe(fromTemporaryCredentials.name, () => {
-  const ctest = new CTest(
-    fromTemporaryCredentials,
-    (testParams) => {
+  const ctest = new CTest({
+    credentialProvider: fromTemporaryCredentials,
+    providerParams: (testParams) => {
       return {
         params: {
           RoleArn: "arn:aws:iam::1234567890:role/Rigamarole",
         },
         ...CTest.defaultRegionConfigProvider(testParams),
       };
     },
-    false
-  );
+    profileCredentials: false,
+    fallbackRegion: "us-east-1",
+  });
 
   ctest.testRegion();