-
Notifications
You must be signed in to change notification settings - Fork 20
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: add alloydbomni service account validation
- Loading branch information
Showing
8 changed files
with
206 additions
and
12 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
103 changes: 103 additions & 0 deletions
103
utils/alloydbomni/service_account_credentials_validator.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,103 @@ | ||
| package alloydbomniUtils | ||
|
|
||
| import ( | ||
| "errors" | ||
|
|
||
| "github.com/xeipuuv/gojsonschema" | ||
| ) | ||
|
|
||
| func ValidateServiceAccountCredentials(i interface{}) error { | ||
| s, ok := i.(string) | ||
| if !ok { | ||
| return errors.New("expected input to be a string") | ||
| } | ||
|
|
||
| r, err := gojsonschema.Validate( | ||
| gojsonschema.NewStringLoader(serviceAccountCredentialsSchema), | ||
| gojsonschema.NewStringLoader(s), | ||
| ) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| if !r.Valid() { | ||
| var errMsg string | ||
| for _, e := range r.Errors() { | ||
| errMsg += e.String() + "\n" | ||
| } | ||
| return errors.New(errMsg) | ||
| } | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| // trunk-ignore-all(gitleaks/private-key) | ||
| const serviceAccountCredentialsSchema = `{ | ||
| "title": "Google service account credentials map", | ||
| "type": "object", | ||
| "properties": { | ||
| "type": { | ||
| "type": "string", | ||
| "title": "Credentials type", | ||
| "description": "Always service_account for credentials created in Gcloud console or CLI", | ||
| "example": "service_account" | ||
| }, | ||
| "project_id": { | ||
| "type": "string", | ||
| "title": "Gcloud project id", | ||
| "example": "some-my-project" | ||
| }, | ||
| "private_key_id": { | ||
| "type": "string", | ||
| "title": "Hexadecimal ID number of your private key", | ||
| "example": "5fdeb02a11ddf081930ac3ac60bf376a0aef8fad" | ||
| }, | ||
| "private_key": { | ||
| "type": "string", | ||
| "title": "PEM-encoded private key", | ||
| "example": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n" | ||
| }, | ||
| "client_email": { | ||
| "type": "string", | ||
| "title": "Email of the service account", | ||
| "example": "my-service-account@some-my-project.iam.gserviceaccount.com" | ||
| }, | ||
| "client_id": { | ||
| "type": "string", | ||
| "title": "Numeric client id for this service account", | ||
| "example": "103654484443722885992" | ||
| }, | ||
| "auth_uri": { | ||
| "type": "string", | ||
| "title": "The authentication endpoint of Google", | ||
| "example": "https://accounts.google.com/o/oauth2/auth" | ||
| }, | ||
| "token_uri": { | ||
| "type": "string", | ||
| "title": "The token lease endpoint of Google", | ||
| "example": "https://accounts.google.com/o/oauth2/token" | ||
| }, | ||
| "auth_provider_x509_cert_url": { | ||
| "type": "string", | ||
| "title": "The certificate service of Google", | ||
| "example": "https://www.googleapis.com/oauth2/v1/certs" | ||
| }, | ||
| "client_x509_cert_url": { | ||
| "type": "string", | ||
| "title": "Certificate URL for your service account", | ||
| "example": "https://www.googleapis.com/robot/v1/metadata/x509/my-service-account%40some-my-project.iam.gserviceaccount.com" | ||
| }, | ||
| "universe_domain": { | ||
| "type": "string", | ||
| "title": "The universe domain", | ||
| "description": "The universe domain. The default universe domain is googleapis.com." | ||
| } | ||
| }, | ||
| "required": [ | ||
| "private_key_id", | ||
| "private_key", | ||
| "client_email", | ||
| "client_id" | ||
| ], | ||
| "additionalProperties": false | ||
| }` |
61 changes: 61 additions & 0 deletions
61
utils/alloydbomni/service_account_credentials_validator_test.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| package alloydbomniUtils | ||
|
|
||
| import ( | ||
| "testing" | ||
|
|
||
| "github.com/stretchr/testify/assert" | ||
| ) | ||
|
|
||
| func TestValidateServiceAccountCredentials(t *testing.T) { | ||
| cases := []struct { | ||
| name string | ||
| input string | ||
| expected string | ||
| }{ | ||
| { | ||
| name: "valid", | ||
| input: `{ | ||
| "private_key_id": "0", | ||
| "private_key": "1", | ||
| "client_email": "2", | ||
| "client_id": "3" | ||
| }`, | ||
| expected: "", | ||
| }, | ||
| { | ||
| name: "invalid, empty", | ||
| input: `{}`, | ||
| expected: "(root): private_key_id is required\n(root): private_key is required\n(root): client_email is required\n(root): client_id is required\n", | ||
| }, | ||
| { | ||
| name: "missing private_key_id", | ||
| input: `{ | ||
| "private_key": "1", | ||
| "client_email": "2", | ||
| "client_id": "3" | ||
| }`, | ||
| expected: "(root): private_key_id is required\n", | ||
| }, | ||
| { | ||
| name: "invalid type client_id", | ||
| input: `{ | ||
| "private_key_id": "0", | ||
| "private_key": "1", | ||
| "client_email": "2", | ||
| "client_id": 3 | ||
| }`, | ||
| expected: "client_id: Invalid type. Expected: string, given: integer\n", | ||
| }, | ||
| } | ||
|
|
||
| for _, tc := range cases { | ||
| t.Run(tc.name, func(t *testing.T) { | ||
| err := ValidateServiceAccountCredentials(tc.input) | ||
| if tc.expected == "" { | ||
| assert.NoError(t, err) | ||
| } else { | ||
| assert.EqualError(t, err, tc.expected) | ||
| } | ||
| }) | ||
| } | ||
| } |