remove usage of appengine to get rid of unsafe imports

google/downscope/downscoping.go

@@ -42,16 +42,13 @@ import (
 	"io/ioutil"
 	"net/http"
 	"net/url"
-	"strings"
 	"time"
 
 	"golang.org/x/oauth2"
 )
 
-const (
+var (
-	universeDomainPlaceholder       = "UNIVERSE_DOMAIN"
+	identityBindingEndpoint = "https://sts.googleapis.com/v1/token"
-	identityBindingEndpointTemplate = "https://sts.UNIVERSE_DOMAIN/v1/token"
-	universeDomainDefault           = "googleapis.com"
 )
 
 type accessBoundary struct {
@@ -108,18 +105,6 @@ type DownscopingConfig struct {
 	// access (or set of accesses) that the new token has to a given resource.
 	// There can be a maximum of 10 AccessBoundaryRules.
 	Rules []AccessBoundaryRule
-	// UniverseDomain is the default service domain for a given Cloud universe.
-	// The default value is "googleapis.com". Optional.
-	UniverseDomain string
-}
-
-// identityBindingEndpoint returns the identity binding endpoint with the
-// configured universe domain.
-func (dc *DownscopingConfig) identityBindingEndpoint() string {
-	if dc.UniverseDomain == "" {
-		return strings.Replace(identityBindingEndpointTemplate, universeDomainPlaceholder, universeDomainDefault, 1)
-	}
-	return strings.Replace(identityBindingEndpointTemplate, universeDomainPlaceholder, dc.UniverseDomain, 1)
 }
 
 // A downscopingTokenSource is used to retrieve a downscoped token with restricted
@@ -129,9 +114,6 @@ type downscopingTokenSource struct {
 	ctx context.Context
 	// config holds the information necessary to generate a downscoped Token.
 	config DownscopingConfig
-	// identityBindingEndpoint is the identity binding endpoint with the
-	// configured universe domain.
-	identityBindingEndpoint string
 }
 
 // NewTokenSource returns a configured downscopingTokenSource.
@@ -153,11 +135,7 @@ func NewTokenSource(ctx context.Context, conf DownscopingConfig) (oauth2.TokenSo
 			return nil, fmt.Errorf("downscope: all rules must provide at least one permission: %+v", val)
 		}
 	}
-	return downscopingTokenSource{
+	return downscopingTokenSource{ctx: ctx, config: conf}, nil
-		ctx:                     ctx,
-		config:                  conf,
-		identityBindingEndpoint: conf.identityBindingEndpoint(),
-	}, nil
 }
 
 // Token() uses a downscopingTokenSource to generate an oauth2 Token.
@@ -193,7 +171,7 @@ func (dts downscopingTokenSource) Token() (*oauth2.Token, error) {
 	form.Add("options", string(b))
 
 	myClient := oauth2.NewClient(dts.ctx, nil)
-	resp, err := myClient.PostForm(dts.identityBindingEndpoint, form)
+	resp, err := myClient.PostForm(identityBindingEndpoint, form)
 	if err != nil {
 		return nil, fmt.Errorf("unable to generate POST Request %v", err)
 	}

google/downscope/downscoping_test.go

@@ -38,43 +38,18 @@ func Test_DownscopedTokenSource(t *testing.T) {
 		w.Write([]byte(standardRespBody))
 
 	}))
-	myTok := oauth2.Token{AccessToken: "Mellon"}
+	new := []AccessBoundaryRule{
-	tmpSrc := oauth2.StaticTokenSource(&myTok)
-	rules := []AccessBoundaryRule{
 		{
 			AvailableResource:    "test1",
 			AvailablePermissions: []string{"Perm1", "Perm2"},
 		},
 	}
-	dts := downscopingTokenSource{
+	myTok := oauth2.Token{AccessToken: "Mellon"}
-		ctx: context.Background(),
+	tmpSrc := oauth2.StaticTokenSource(&myTok)
-		config: DownscopingConfig{
+	dts := downscopingTokenSource{context.Background(), DownscopingConfig{tmpSrc, new}}
-			RootSource: tmpSrc,
+	identityBindingEndpoint = ts.URL
-			Rules:      rules,
-		},
-		identityBindingEndpoint: ts.URL,
-	}
 	_, err := dts.Token()
 	if err != nil {
 		t.Fatalf("NewDownscopedTokenSource failed with error: %v", err)
 	}
 }
-
-func Test_DownscopingConfig(t *testing.T) {
-	tests := []struct {
-		universeDomain string
-		want           string
-	}{
-		{"", "https://sts.googleapis.com/v1/token"},
-		{"googleapis.com", "https://sts.googleapis.com/v1/token"},
-		{"example.com", "https://sts.example.com/v1/token"},
-	}
-	for _, tt := range tests {
-		c := DownscopingConfig{
-			UniverseDomain: tt.universeDomain,
-		}
-		if got := c.identityBindingEndpoint(); got != tt.want {
-			t.Errorf("got %q, want %q", got, tt.want)
-		}
-	}
-}

google/internal/externalaccount/executablecredsource.go

@@ -19,7 +19,7 @@ import (
 	"time"
 )
 
-var serviceAccountImpersonationRE = regexp.MustCompile("https://iamcredentials\\..+/v1/projects/-/serviceAccounts/(.*@.*):generateAccessToken")
+var serviceAccountImpersonationRE = regexp.MustCompile("https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/(.*@.*):generateAccessToken")
 
 const (
 	executableSupportedMaxVersion = 1

google/internal/externalaccount/executablecredsource_test.go

@@ -1021,37 +1021,3 @@ func TestRetrieveOutputFileSubjectTokenJwt(t *testing.T) {
 		})
 	}
 }
-
-func TestServiceAccountImpersonationRE(t *testing.T) {
-	tests := []struct {
-		name                           string
-		serviceAccountImpersonationURL string
-		want                           string
-	}{
-		{
-			name:                           "universe domain Google Default Universe (GDU) googleapis.com",
-			serviceAccountImpersonationURL: "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/test@project.iam.gserviceaccount.com:generateAccessToken",
-			want:                           "test@project.iam.gserviceaccount.com",
-		},
-		{
-			name:                           "email does not match",
-			serviceAccountImpersonationURL: "test@project.iam.gserviceaccount.com",
-			want:                           "",
-		},
-		{
-			name:                           "universe domain non-GDU",
-			serviceAccountImpersonationURL: "https://iamcredentials.apis-tpclp.goog/v1/projects/-/serviceAccounts/test@project.iam.gserviceaccount.com:generateAccessToken",
-			want:                           "test@project.iam.gserviceaccount.com",
-		},
-	}
-	for _, tt := range tests {
-		matches := serviceAccountImpersonationRE.FindStringSubmatch(tt.serviceAccountImpersonationURL)
-		if matches == nil {
-			if tt.want != "" {
-				t.Errorf("%q: got nil, want %q", tt.name, tt.want)
-			}
-		} else if matches[1] != tt.want {
-			t.Errorf("%q: got %q, want %q", tt.name, matches[1], tt.want)
-		}
-	}
-}