Merge pull request spotify#1160 from spotify/dxia/patch1

Fix bug: use scoped GoogleCredentials

Author: davidxia

helios-client/src/main/java/com/spotify/helios/client/GoogleCredentialsAccessTokenProvider.java

@@ -25,6 +25,7 @@
 
 import com.google.auth.oauth2.AccessToken;
 import com.google.auth.oauth2.GoogleCredentials;
+import com.google.common.annotations.VisibleForTesting;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.IOException;
@@ -50,7 +51,7 @@ class GoogleCredentialsAccessTokenProvider {
    *
    * @return Return an AccessToken or null
    */
-  static AccessToken getAccessToken(List<String> scopes) throws IOException {
+  static AccessToken getAccessToken(final List<String> scopes) throws IOException {
     GoogleCredentials credentials = null;
 
     // first check whether the environment variable is set
@@ -70,16 +71,21 @@ static AccessToken getAccessToken(List<String> scopes) throws IOException {
       log.debug("Using Google Application Default Credentials");
     }
 
+    return getAccessToken(credentials, scopes);
+  }
+
+  @VisibleForTesting
+  static AccessToken getAccessToken(final GoogleCredentials credentials,
+                                    final List<String> scopes) throws IOException {
     if (credentials == null) {
       return null;
     }
 
-    if (!scopes.isEmpty()) {
-      credentials.createScoped(scopes);
-    }
-    credentials.refresh();
+    final GoogleCredentials newCredentials =
+        scopes.isEmpty() ? credentials : credentials.createScoped(scopes);
+    newCredentials.refresh();
 
-    return credentials.getAccessToken();
+    return newCredentials.getAccessToken();
   }
 
   static AccessToken getAccessToken() throws IOException {

helios-client/src/test/java/com/spotify/helios/client/GoogleCredentialsAccessTokenProviderTest.java

@@ -0,0 +1,46 @@
+/*-
+ * -\-\-
+ * Helios Client
+ * --
+ * Copyright (C) 2016 - 2017 Spotify AB
+ * --
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * -/-/-
+ */
+
+package com.spotify.helios.client;
+
+import static java.util.Collections.singletonList;
+import static org.mockito.Matchers.anyCollectionOf;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import com.google.auth.oauth2.GoogleCredentials;
+import java.util.List;
+import org.junit.Test;
+
+public class GoogleCredentialsAccessTokenProviderTest {
+
+  @Test
+  public void getAccessToken() throws Exception {
+    final GoogleCredentials credentials = mock(GoogleCredentials.class);
+    final GoogleCredentials scopedCredentials = mock(GoogleCredentials.class);
+    when(credentials.createScoped(anyCollectionOf(String.class))).thenReturn(scopedCredentials);
+    final List<String> scopes = singletonList("somescope");
+    GoogleCredentialsAccessTokenProvider.getAccessToken(credentials, scopes);
+    verify(credentials).createScoped(scopes);
+    verify(scopedCredentials).refresh();
+  }
+
+}