fix: fix error in sign_bytes

googleapis · Oct 29, 2021 · bb797fb · bb797fb
1 parent 8f1e9cf
commit bb797fb
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 0 deletions.
diff --git a/google/auth/impersonated_credentials.py b/google/auth/impersonated_credentials.py
@@ -290,6 +290,11 @@ def sign_bytes(self, message):
             url=iam_sign_endpoint, headers=headers, json=body
         )
 
+        if response.status_code != http_client.OK:
+            raise exceptions.TransportError(
+                "Error calling sign_bytes: {}".format(response.json())
+            )
+
         return base64.b64decode(response.json()["signedBlob"])
 
     @property

diff --git a/tests/test_impersonated_credentials.py b/tests/test_impersonated_credentials.py
@@ -345,6 +345,19 @@ def test_sign_bytes(self, mock_donor_credentials, mock_authorizedsession_sign):
         signature = credentials.sign_bytes(b"signed bytes")
         assert signature == b"signature"
 
+    def test_sign_bytes_failure(self):
+        credentials = self.make_credentials(lifetime=None)
+
+        with mock.patch(
+            "google.auth.transport.requests.AuthorizedSession.request", autospec=True
+        ) as auth_session:
+            data = {"error": {"code": 403, "message": "unauthorized"}}
+            auth_session.return_value = MockResponse(data, http_client.FORBIDDEN)
+
+            with pytest.raises(exceptions.TransportError) as excinfo:
+                credentials.sign_bytes(b"foo")
+            assert excinfo.match("{'error': {'code': 403, 'message': 'unauthorized'}")
+
     def test_with_quota_project(self):
         credentials = self.make_credentials()