// Copyright 2023 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package credentials

import (
	"context"
	"encoding/base64"
	"encoding/json"
	"fmt"
	"net/http"
	"net/http/httptest"
	"os"
	"strings"
	"testing"
	"time"

	"cloud.google.com/go/auth"
	"cloud.google.com/go/auth/credentials/internal/gdch"
	"cloud.google.com/go/auth/internal"
	"cloud.google.com/go/auth/internal/credsfile"
	"cloud.google.com/go/auth/internal/jwt"
)

type tokResp struct {
	AccessToken string `json:"access_token"`
	TokenType   string `json:"token_type"`
	ExpiresIn   int    `json:"expires_in"`
}

func TestDefaultCredentials_GdchServiceAccountKey(t *testing.T) {
	ctx := context.Background()
	aud := "http://sample-aud.com/"
	b, err := os.ReadFile("../internal/testdata/gdch.json")
	if err != nil {
		t.Fatal(err)
	}
	f, err := credsfile.ParseGDCHServiceAccount(b)
	if err != nil {
		t.Fatal(err)
	}
	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.Method != "POST" {
			t.Errorf("unexpected request method: %v", r.Method)
		}
		if err := r.ParseForm(); err != nil {
			t.Error(err)
		}
		parts := strings.Split(r.FormValue("subject_token"), ".")
		var header jwt.Header
		var claims jwt.Claims
		b, err = base64.RawURLEncoding.DecodeString(parts[0])
		if err != nil {
			t.Fatal(err)
		}
		if err := json.Unmarshal(b, &header); err != nil {
			t.Fatal(err)
		}
		b, err = base64.RawURLEncoding.DecodeString(parts[1])
		if err != nil {
			t.Fatal(err)
		}
		if err := json.Unmarshal(b, &claims); err != nil {
			t.Fatal(err)
		}

		if got := r.FormValue("audience"); got != aud {
			t.Errorf("got audience %v, want %v", got, gdch.GrantType)
		}
		if want := jwt.HeaderAlgRSA256; header.Algorithm != want {
			t.Errorf("got alg %q, want %q", header.Algorithm, want)
		}
		if want := jwt.HeaderType; header.Type != want {
			t.Errorf("got typ %q, want %q", header.Type, want)
		}
		if want := "abcdef1234567890"; header.KeyID != want {
			t.Errorf("got kid %q, want %q", header.KeyID, want)
		}

		if want := "system:serviceaccount:fake_project:sa_name"; claims.Iss != want {
			t.Errorf("got iss %q, want %q", claims.Iss, want)
		}
		if want := "system:serviceaccount:fake_project:sa_name"; claims.Sub != want {
			t.Errorf("got sub %q, want %q", claims.Sub, want)
		}
		if want := fmt.Sprintf("http://%s", r.Host); claims.Aud != want {
			t.Errorf("got aud %q, want %q", claims.Aud, want)
		}
		resp := &tokResp{
			AccessToken: "a_fake_token",
			TokenType:   internal.TokenTypeBearer,
			ExpiresIn:   60,
		}
		if err := json.NewEncoder(w).Encode(&resp); err != nil {
			t.Fatal(err)
		}
	}))
	f.TokenURL = ts.URL
	f.CertPath = "../internal/testdata/cert.pem"
	b, err = json.Marshal(&f)
	if err != nil {
		t.Fatal(err)
	}

	if _, err := DetectDefault(&DetectOptions{CredentialsJSON: b}); err == nil {
		t.Fatal("STSAudience should be required")
	}
	creds, err := DetectDefault(&DetectOptions{
		CredentialsJSON: b,
		STSAudience:     aud,
	})
	if err != nil {
		t.Fatal(err)
	}
	got, err := creds.ProjectID(ctx)
	if err != nil {
		t.Fatal(err)
	}
	if want := "fake_project"; got != want {
		t.Fatalf("got %q, want %q", got, want)
	}
	got, err = creds.UniverseDomain(ctx)
	if err != nil {
		t.Fatal(err)
	}
	if want := "googleapis.com"; got != want {
		t.Fatalf("got %q, want %q", got, want)
	}
	tok, err := creds.Token(context.Background())
	if err != nil {
		t.Fatal(err)
	}
	if want := "a_fake_token"; tok.Value != want {
		t.Fatalf("got AccessToken %q, want %q", tok.Value, want)
	}
	if want := internal.TokenTypeBearer; tok.Type != want {
		t.Fatalf("got TokenType %q, want %q", tok.Type, want)
	}
}

func TestDefaultCredentials_ImpersonatedServiceAccountKey(t *testing.T) {
	ctx := context.Background()
	b, err := os.ReadFile("../internal/testdata/imp.json")
	if err != nil {
		t.Fatal(err)
	}
	f, err := credsfile.ParseImpersonatedServiceAccount(b)
	if err != nil {
		t.Fatal(err)
	}
	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		resp := &struct {
			AccessToken string `json:"accessToken"`
			ExpireTime  string `json:"expireTime"`
		}{
			AccessToken: "a_fake_token",
			ExpireTime:  "2006-01-02T15:04:05Z",
		}
		if err := json.NewEncoder(w).Encode(&resp); err != nil {
			t.Fatal(err)
		}
	}))
	f.ServiceAccountImpersonationURL = ts.URL
	b, err = json.Marshal(f)
	if err != nil {
		t.Fatal(err)
	}

	creds, err := DetectDefault(&DetectOptions{
		CredentialsJSON:  b,
		Scopes:           []string{"https://www.googleapis.com/auth/cloud-platform"},
		UseSelfSignedJWT: true,
	})
	if err != nil {
		t.Fatal(err)
	}
	got, err := creds.UniverseDomain(ctx)
	if err != nil {
		t.Fatal(err)
	}
	if want := "googleapis.com"; got != want {
		t.Fatalf("got %q, want %q", got, want)
	}
	tok, err := creds.Token(context.Background())
	if err != nil {
		t.Fatalf("creds.Token() = %v", err)
	}
	if want := "a_fake_token"; tok.Value != want {
		t.Fatalf("got %q, want %q", tok.Value, want)
	}
	if want := internal.TokenTypeBearer; tok.Type != want {
		t.Fatalf("got %q, want %q", tok.Type, want)
	}
}

func TestDefaultCredentials_UserCredentialsKey(t *testing.T) {
	ctx := context.Background()
	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.Header().Set("Content-Type", "application/json")
		resp := &tokResp{
			AccessToken: "a_fake_token",
			TokenType:   internal.TokenTypeBearer,
			ExpiresIn:   60,
		}
		if err := json.NewEncoder(w).Encode(&resp); err != nil {
			t.Fatal(err)
		}
	}))

	creds, err := DetectDefault(&DetectOptions{
		CredentialsFile: "../internal/testdata/user.json",
		Scopes:          []string{"https://www.googleapis.com/auth/cloud-platform"},
		TokenURL:        ts.URL,
	})
	if err != nil {
		t.Fatal(err)
	}
	got, err := creds.QuotaProjectID(ctx)
	if err != nil {
		t.Fatal(err)
	}
	if want := "fake_project2"; got != want {
		t.Fatalf("got %q, want %q", got, want)
	}
	got, err = creds.UniverseDomain(ctx)
	if err != nil {
		t.Fatal(err)
	}
	if want := "googleapis.com"; got != want {
		t.Fatalf("got %q, want %q", got, want)
	}
	tok, err := creds.Token(context.Background())
	if err != nil {
		t.Fatalf("creds.Token() = %v", err)
	}
	if want := "a_fake_token"; tok.Value != want {
		t.Fatalf("got %q, want %q", tok.Value, want)
	}
	if want := internal.TokenTypeBearer; tok.Type != want {
		t.Fatalf("got %q, want %q", tok.Type, want)
	}
}

func TestDefaultCredentials_UserCredentialsKey_UniverseDomain(t *testing.T) {
	ctx := context.Background()
	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.Header().Set("Content-Type", "application/json")
		resp := &tokResp{
			AccessToken: "a_fake_token",
			TokenType:   internal.TokenTypeBearer,
			ExpiresIn:   60,
		}
		if err := json.NewEncoder(w).Encode(&resp); err != nil {
			t.Fatal(err)
		}
	}))

	creds, err := DetectDefault(&DetectOptions{
		CredentialsFile: "../internal/testdata/user_universe_domain.json",
		Scopes:          []string{"https://www.googleapis.com/auth/cloud-platform"},
		TokenURL:        ts.URL,
	})
	if err != nil {
		t.Fatal(err)
	}
	got, err := creds.QuotaProjectID(ctx)
	if err != nil {
		t.Fatal(err)
	}
	if want := "fake_project2"; got != want {
		t.Fatalf("got %q, want %q", got, want)
	}
	got, err = creds.UniverseDomain(ctx)
	if err != nil {
		t.Fatal(err)
	}
	if want := "example.com"; got != want {
		t.Fatalf("got %q, want %q", got, want)
	}
	tok, err := creds.Token(context.Background())
	if err != nil {
		t.Fatalf("creds.Token() = %v", err)
	}
	if want := "a_fake_token"; tok.Value != want {
		t.Fatalf("got %q, want %q", tok.Value, want)
	}
	if want := internal.TokenTypeBearer; tok.Type != want {
		t.Fatalf("got %q, want %q", tok.Type, want)
	}
}

func TestDefaultCredentials_ServiceAccountKey(t *testing.T) {
	ctx := context.Background()
	b, err := os.ReadFile("../internal/testdata/sa.json")
	if err != nil {
		t.Fatal(err)
	}
	f, err := credsfile.ParseServiceAccount(b)
	if err != nil {
		t.Fatal(err)
	}
	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		resp := &tokResp{
			AccessToken: "a_fake_token",
			TokenType:   internal.TokenTypeBearer,
			ExpiresIn:   60,
		}
		if err := json.NewEncoder(w).Encode(&resp); err != nil {
			t.Fatal(err)
		}
	}))
	f.TokenURL = ts.URL
	b, err = json.Marshal(f)
	if err != nil {
		t.Fatal(err)
	}

	creds, err := DetectDefault(&DetectOptions{
		CredentialsJSON: b,
		Scopes:          []string{"https://www.googleapis.com/auth/cloud-platform"},
	})
	if err != nil {
		t.Fatal(err)
	}
	got, err := creds.ProjectID(ctx)
	if err != nil {
		t.Fatal(err)
	}
	if want := "fake_project"; got != want {
		t.Fatalf("got %q, want %q", got, want)
	}
	got, err = creds.UniverseDomain(ctx)
	if err != nil {
		t.Fatal(err)
	}
	if want := "googleapis.com"; got != want {
		t.Fatalf("got %q, want %q", got, want)
	}
	tok, err := creds.Token(context.Background())
	if err != nil {
		t.Fatalf("creds.Token() = %v", err)
	}
	if want := "a_fake_token"; tok.Value != want {
		t.Fatalf("got %q, want %q", tok.Value, want)
	}
	if want := internal.TokenTypeBearer; tok.Type != want {
		t.Fatalf("got %q, want %q", tok.Type, want)
	}
}

func TestDefaultCredentials_ServiceAccountKeySelfSigned(t *testing.T) {
	ctx := context.Background()
	b, err := os.ReadFile("../internal/testdata/sa.json")
	if err != nil {
		t.Fatal(err)
	}
	oldNow := now
	now = func() time.Time { return time.Date(2000, 2, 1, 12, 30, 0, 0, time.UTC) }
	defer func() { now = oldNow }()
	wantTok := "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImFiY2RlZjEyMzQ1Njc4OTAifQ.eyJpc3MiOiJnb3BoZXJAZmFrZV9wcm9qZWN0LmlhbS5nc2VydmljZWFjY291bnQuY29tIiwic2NvcGUiOiJodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbS9hdXRoL2Nsb3VkLXBsYXRmb3JtIiwiZXhwIjo5NDk0MTE4MDAsImlhdCI6OTQ5NDA4MjAwLCJhdWQiOiIiLCJzdWIiOiJnb3BoZXJAZmFrZV9wcm9qZWN0LmlhbS5nc2VydmljZWFjY291bnQuY29tIn0.n9Hggd-1Vw4WTQiWkh7q9r5eDsz-khU5vwkZl2VmgdUF3ZxDq1ARzchCNtTifeorzbp9C0i0vCr855G7FZkVCJXPVMcnxbwfMSafUYmVsmutbQiV9eTWfWM0_Ljiwa9GEbv1bN06Lz4LrelPKEaxsDbY6tU8LJUiome_gSMLfLk"

	creds, err := DetectDefault(&DetectOptions{
		CredentialsJSON:  b,
		Scopes:           []string{"https://www.googleapis.com/auth/cloud-platform"},
		UseSelfSignedJWT: true,
	})
	if err != nil {
		t.Fatal(err)
	}

	got, err := creds.ProjectID(ctx)
	if err != nil {
		t.Fatal(err)
	}
	if want := "fake_project"; got != want {
		t.Fatalf("got %q, want %q", got, want)
	}
	got, err = creds.UniverseDomain(ctx)
	if err != nil {
		t.Fatal(err)
	}
	if want := "googleapis.com"; got != want {
		t.Fatalf("got %q, want %q", got, want)
	}
	tok, err := creds.Token(context.Background())
	if err != nil {
		t.Fatalf("creds.Token() = %v", err)
	}
	if tok.Value != wantTok {
		t.Fatalf("got %q, want %q", tok.Value, wantTok)
	}
	if want := internal.TokenTypeBearer; tok.Type != want {
		t.Fatalf("got %q, want %q", tok.Type, want)
	}
}

func TestDefaultCredentials_ServiceAccountKeySelfSigned_UniverseDomain(t *testing.T) {
	ctx := context.Background()
	b, err := os.ReadFile("../internal/testdata/sa_universe_domain.json")
	if err != nil {
		t.Fatal(err)
	}
	oldNow := now
	now = func() time.Time { return time.Date(2000, 2, 1, 12, 30, 0, 0, time.UTC) }
	defer func() { now = oldNow }()
	wantTok := "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImFiY2RlZjEyMzQ1Njc4OTAifQ.eyJpc3MiOiJnb3BoZXJAZmFrZV9wcm9qZWN0LmlhbS5nc2VydmljZWFjY291bnQuY29tIiwic2NvcGUiOiJodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbS9hdXRoL2Nsb3VkLXBsYXRmb3JtIiwiZXhwIjo5NDk0MTE4MDAsImlhdCI6OTQ5NDA4MjAwLCJhdWQiOiIiLCJzdWIiOiJnb3BoZXJAZmFrZV9wcm9qZWN0LmlhbS5nc2VydmljZWFjY291bnQuY29tIn0.n9Hggd-1Vw4WTQiWkh7q9r5eDsz-khU5vwkZl2VmgdUF3ZxDq1ARzchCNtTifeorzbp9C0i0vCr855G7FZkVCJXPVMcnxbwfMSafUYmVsmutbQiV9eTWfWM0_Ljiwa9GEbv1bN06Lz4LrelPKEaxsDbY6tU8LJUiome_gSMLfLk"

	creds, err := DetectDefault(&DetectOptions{
		CredentialsJSON:  b,
		Scopes:           []string{"https://www.googleapis.com/auth/cloud-platform"},
		UseSelfSignedJWT: true,
	})
	if err != nil {
		t.Fatal(err)
	}
	got, err := creds.ProjectID(ctx)
	if err != nil {
		t.Fatal(err)
	}
	if want := "fake_project"; got != want {
		t.Fatalf("got %q, want %q", got, want)
	}
	got, err = creds.UniverseDomain(ctx)
	if err != nil {
		t.Fatal(err)
	}
	if want := "example.com"; got != want {
		t.Fatalf("got %q, want %q", got, want)
	}
	tok, err := creds.Token(context.Background())
	if err != nil {
		t.Fatalf("creds.Token() = %v", err)
	}
	if tok.Value != wantTok {
		t.Fatalf("got %q, want %q", tok.Value, wantTok)
	}
	if want := internal.TokenTypeBearer; tok.Type != want {
		t.Fatalf("got %q, want %q", tok.Type, want)
	}
}

func TestDefaultCredentials_ClientCredentials(t *testing.T) {
	ctx := context.Background()
	b, err := os.ReadFile("../internal/testdata/clientcreds_installed.json")
	if err != nil {
		t.Fatal(err)
	}
	f, err := credsfile.ParseClientCredentials(b)
	if err != nil {
		t.Fatal(err)
	}

	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.Header().Set("Content-Type", "application/json")
		resp := &tokResp{
			AccessToken: "a_fake_token",
			TokenType:   internal.TokenTypeBearer,
			ExpiresIn:   60,
		}
		if err := json.NewEncoder(w).Encode(&resp); err != nil {
			t.Fatal(err)
		}
	}))
	f.Installed.TokenURI = ts.URL
	b, err = json.Marshal(f)
	if err != nil {
		t.Fatal(err)
	}

	creds, err := DetectDefault(&DetectOptions{
		CredentialsJSON: b,
		Scopes:          []string{"https://www.googleapis.com/auth/cloud-platform"},
		TokenURL:        ts.URL,
		AuthHandlerOptions: &auth.AuthorizationHandlerOptions{
			Handler: func(authCodeURL string) (code string, state string, err error) {
				return "code", "state", nil
			},
			State: "state",
			PKCEOpts: &auth.PKCEOptions{
				Challenge:       "codeChallenge",
				ChallengeMethod: "plain",
				Verifier:        "codeChallenge",
			},
		},
	})
	if err != nil {
		t.Fatal(err)
	}
	got, err := creds.UniverseDomain(ctx)
	if err != nil {
		t.Fatal(err)
	}
	if want := "googleapis.com"; got != want {
		t.Fatalf("got %q, want %q", got, want)
	}
	tok, err := creds.Token(context.Background())
	if err != nil {
		t.Fatalf("creds.Token() = %v", err)
	}
	if want := "a_fake_token"; tok.Value != want {
		t.Fatalf("got %q, want %q", tok.Value, want)
	}
	if want := internal.TokenTypeBearer; tok.Type != want {
		t.Fatalf("got %q, want %q", tok.Type, want)
	}
}

// Better coverage of all external account features tested in the sub-package.
func TestDefaultCredentials_ExternalAccountKey(t *testing.T) {
	ctx := context.Background()
	b, err := os.ReadFile("../internal/testdata/exaccount_url.json")
	if err != nil {
		t.Fatal(err)
	}
	f, err := credsfile.ParseExternalAccount(b)
	if err != nil {
		t.Fatal(err)
	}
	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		defer r.Body.Close()
		if r.URL.Path == "/token" {
			resp := &struct {
				Token string `json:"id_token"`
			}{
				Token: "a_fake_token_base",
			}
			if err := json.NewEncoder(w).Encode(&resp); err != nil {
				t.Error(err)
			}
		} else if r.URL.Path == "/sts" {
			r.ParseForm()
			if got, want := r.Form.Get("subject_token"), "a_fake_token_base"; got != want {
				t.Errorf("got %q, want %q", got, want)
			}

			resp := &struct {
				AccessToken string `json:"access_token"`
				ExpiresIn   int    `json:"expires_in"`
			}{
				AccessToken: "a_fake_token_sts",
				ExpiresIn:   60,
			}
			if err := json.NewEncoder(w).Encode(&resp); err != nil {
				t.Error(err)
			}
		} else if r.URL.Path == "/impersonate" {
			if want := "a_fake_token_sts"; !strings.Contains(r.Header.Get("Authorization"), want) {
				t.Errorf("missing sts token: got %q, want %q", r.Header.Get("Authorization"), want)
			}

			resp := &struct {
				AccessToken string `json:"accessToken"`
				ExpireTime  string `json:"expireTime"`
			}{
				AccessToken: "a_fake_token",
				ExpireTime:  "2006-01-02T15:04:05Z",
			}
			if err := json.NewEncoder(w).Encode(&resp); err != nil {
				t.Error(err)
			}
		} else {
			t.Errorf("unexpected call to %q", r.URL.Path)
		}
	}))
	f.ServiceAccountImpersonationURL = ts.URL + "/impersonate"
	f.CredentialSource.URL = ts.URL + "/token"
	f.TokenURL = ts.URL + "/sts"
	b, err = json.Marshal(f)
	if err != nil {
		t.Fatal(err)
	}

	creds, err := DetectDefault(&DetectOptions{
		CredentialsJSON:  b,
		Scopes:           []string{"https://www.googleapis.com/auth/cloud-platform"},
		UseSelfSignedJWT: true,
	})
	if err != nil {
		t.Fatal(err)
	}
	got, err := creds.UniverseDomain(ctx)
	if err != nil {
		t.Fatal(err)
	}
	if want := "googleapis.com"; got != want {
		t.Fatalf("got %q, want %q", got, want)
	}
	tok, err := creds.Token(ctx)
	if err != nil {
		t.Fatalf("creds.Token() = %v", err)
	}
	if want := "a_fake_token"; tok.Value != want {
		t.Fatalf("got %q, want %q", tok.Value, want)
	}
	if want := internal.TokenTypeBearer; tok.Type != want {
		t.Fatalf("got %q, want %q", tok.Type, want)
	}
}
func TestDefaultCredentials_ExternalAccountAuthorizedUserKey(t *testing.T) {
	b, err := os.ReadFile("../internal/testdata/exaccount_user.json")
	if err != nil {
		t.Fatal(err)
	}
	f, err := credsfile.ParseExternalAccountAuthorizedUser(b)
	if err != nil {
		t.Fatal(err)
	}
	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		defer r.Body.Close()
		if got, want := r.URL.Path, "/sts"; got != want {
			t.Errorf("got %q, want %q", got, want)
		}
		r.ParseForm()
		if got, want := r.Form.Get("refresh_token"), "refreshing"; got != want {
			t.Errorf("got %q, want %q", got, want)
		}
		if got, want := r.Form.Get("grant_type"), "refresh_token"; got != want {
			t.Errorf("got %q, want %q", got, want)
		}

		resp := &struct {
			AccessToken string `json:"access_token"`
			ExpiresIn   int    `json:"expires_in"`
		}{
			AccessToken: "a_fake_token",
			ExpiresIn:   60,
		}
		if err := json.NewEncoder(w).Encode(&resp); err != nil {
			t.Error(err)
		}
	}))
	f.TokenURL = ts.URL + "/sts"
	b, err = json.Marshal(f)
	if err != nil {
		t.Fatal(err)
	}

	creds, err := DetectDefault(&DetectOptions{
		CredentialsJSON:  b,
		Scopes:           []string{"https://www.googleapis.com/auth/cloud-platform"},
		UseSelfSignedJWT: true,
	})
	if err != nil {
		t.Fatal(err)
	}
	tok, err := creds.Token(context.Background())
	if err != nil {
		t.Fatalf("creds.Token() = %v", err)
	}
	if want := "a_fake_token"; tok.Value != want {
		t.Fatalf("got %q, want %q", tok.Value, want)
	}
	if want := internal.TokenTypeBearer; tok.Type != want {
		t.Fatalf("got %q, want %q", tok.Type, want)
	}
}

func TestDefaultCredentials_Fails(t *testing.T) {
	t.Setenv(credsfile.GoogleAppCredsEnvVar, "nothingToSeeHere")
	t.Setenv("HOME", "nothingToSeeHere")
	t.Setenv("APPDATA", "nothingToSeeHere")
	allowOnGCECheck = false
	defer func() { allowOnGCECheck = true }()
	if _, err := DetectDefault(&DetectOptions{
		Scopes: []string{"https://www.googleapis.com/auth/cloud-platform"},
	}); !strings.Contains(err.Error(), adcSetupURL) {
		t.Fatalf("got %v, wanted to contain %v", err, adcSetupURL)
	}
}

func TestDefaultCredentials_BadFiletype(t *testing.T) {
	if _, err := DetectDefault(&DetectOptions{
		CredentialsJSON: []byte(`{"type":"42"}`),
		Scopes:          []string{"https://www.googleapis.com/auth/cloud-platform"},
	}); err == nil {
		t.Fatal("got nil, want non-nil err")
	}
}

func TestDefaultCredentials_BadFileName(t *testing.T) {
	if _, err := DetectDefault(&DetectOptions{
		CredentialsFile: "a/bad/filepath",
		Scopes:          []string{"https://www.googleapis.com/auth/cloud-platform"},
	}); err == nil {
		t.Fatal("got nil, want non-nil err")
	}
}

func TestDefaultCredentials_Validate(t *testing.T) {
	tests := []struct {
		name string
		opts *DetectOptions
	}{
		{
			name: "missing options",
		},
		{
			name: "scope and audience provided",
			opts: &DetectOptions{
				Scopes:   []string{"scope"},
				Audience: "aud",
			},
		},
		{
			name: "file and json provided",
			opts: &DetectOptions{
				Scopes:          []string{"scope"},
				CredentialsFile: "path",
				CredentialsJSON: []byte(`{"some":"json"}`),
			},
		},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			if _, err := DetectDefault(tt.opts); err == nil {
				t.Error("got nil, want an error")
			}
		})
	}
}

func TestDefaultCredentials_UniverseDomain(t *testing.T) {
	ctx := context.Background()
	tests := []struct {
		name string
		opts *DetectOptions
		want string
	}{
		{
			name: "service account json",
			opts: &DetectOptions{
				CredentialsFile: "../internal/testdata/sa.json",
			},
			want: "googleapis.com",
		},
		{
			name: "service account json with file universe domain",
			opts: &DetectOptions{
				CredentialsFile:  "../internal/testdata/sa_universe_domain.json",
				UseSelfSignedJWT: true,
			},
			want: "example.com",
		},
		{
			name: "service account json with options universe domain",
			opts: &DetectOptions{
				CredentialsFile:  "../internal/testdata/sa.json",
				UseSelfSignedJWT: true,
				UniverseDomain:   "foo.com",
			},
			want: "foo.com",
		},
		{
			name: "service account json with file and options universe domain",
			opts: &DetectOptions{
				CredentialsFile:  "../internal/testdata/sa_universe_domain.json",
				UseSelfSignedJWT: true,
				UniverseDomain:   "foo.com",
			},
			want: "foo.com",
		},
		{
			name: "user json",
			opts: &DetectOptions{
				CredentialsFile: "../internal/testdata/user.json",
				TokenURL:        "example.com",
			},
			want: "googleapis.com",
		},
		{
			name: "user json with options universe domain",
			opts: &DetectOptions{
				CredentialsFile: "../internal/testdata/user.json",
				UniverseDomain:  "foo.com",
			},
			want: "googleapis.com",
		},
		{
			name: "user json with file universe domain",
			opts: &DetectOptions{
				CredentialsFile: "../internal/testdata/user_universe_domain.json",
				TokenURL:        "example.com",
			},
			want: "example.com",
		},
		{
			name: "user json with file and options universe domain",
			opts: &DetectOptions{
				CredentialsFile: "../internal/testdata/user_universe_domain.json",
				UniverseDomain:  "foo.com",
			},
			want: "example.com",
		},
		{
			name: "external account json",
			opts: &DetectOptions{
				CredentialsFile: "../internal/testdata/exaccount_url.json",
			},
			want: "googleapis.com",
		},
		{
			name: "external account json with file universe domain",
			opts: &DetectOptions{
				CredentialsFile: "../internal/testdata/exaccount_url_universe_domain.json",
			},
			want: "example.com",
		},
		{
			name: "external account json with options universe domain",
			opts: &DetectOptions{
				CredentialsFile: "../internal/testdata/exaccount_url.json",
				UniverseDomain:  "foo.com",
			},
			want: "foo.com",
		},
		{
			name: "external account json with file and options universe domain",
			opts: &DetectOptions{
				CredentialsFile: "../internal/testdata/exaccount_url_universe_domain.json",
				UniverseDomain:  "foo.com",
			},
			want: "foo.com",
		},
		{
			name: "external account user json",
			opts: &DetectOptions{
				CredentialsFile: "../internal/testdata/exaccount_user.json",
			},
			want: "googleapis.com",
		},
		{
			name: "external account user json with file universe domain",
			opts: &DetectOptions{
				CredentialsFile: "../internal/testdata/exaccount_user_universe_domain.json",
			},
			want: "example.com",
		},
		{
			name: "external account user json with options universe domain",
			opts: &DetectOptions{
				CredentialsFile: "../internal/testdata/exaccount_user.json",
				UniverseDomain:  "foo.com",
			},
			want: "googleapis.com",
		},
		{
			name: "external account user json with file and options universe domain",
			opts: &DetectOptions{
				CredentialsFile: "../internal/testdata/exaccount_user_universe_domain.json",
				UniverseDomain:  "foo.com",
			},
			want: "example.com",
		},
		{
			name: "impersonated service account json",
			opts: &DetectOptions{
				CredentialsFile:  "../internal/testdata/imp.json",
				UseSelfSignedJWT: true,
			},
			want: "googleapis.com",
		},
		{
			name: "impersonated service account json with file universe domain",
			opts: &DetectOptions{
				CredentialsFile: "../internal/testdata/imp_universe_domain.json",
			},
			want: "example.com",
		},
		{
			name: "impersonated service account json with options universe domain",
			opts: &DetectOptions{
				CredentialsFile:  "../internal/testdata/imp.json",
				UseSelfSignedJWT: true,
				UniverseDomain:   "foo.com",
			},
			want: "foo.com",
		},
		{
			name: "impersonated service account json with file and options universe domain",
			opts: &DetectOptions{
				CredentialsFile: "../internal/testdata/imp_universe_domain.json",
				UniverseDomain:  "foo.com",
			},
			want: "foo.com",
		},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			creds, err := DetectDefault(tt.opts)
			if err != nil {
				t.Fatalf("%v", err)
			}
			ud, err := creds.UniverseDomain(ctx)
			if err != nil {
				t.Fatal(err)
			}
			if ud != tt.want {
				t.Fatalf("got %q, want %q", ud, tt.want)
			}
		})
	}
}