test(oauth2): add unit test coverage for repeated 401 retry guard and non-mTLS actor token check

Author: macastelaz

google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/ExternalAccountCredentialsTest.java

@@ -960,6 +960,54 @@ public HttpTransport create() {
     assertEquals(mockTransport.getAccessToken(), accessToken.getTokenValue());
   }
 
+  @Test
+  void exchangeExternalCredentialForAccessToken_withMtls401Repeated_doesNotRetryIndefinitely() {
+    AtomicInteger rebuildCount = new AtomicInteger(0);
+    MockExternalAccountCredentialsTransport mockTransport =
+        new MockExternalAccountCredentialsTransport();
+    mockTransport.addResponseStatusCodeSequence(401, 401);
+
+    ContextRebuildableTransportFactory rebuildableFactory =
+        new ContextRebuildableTransportFactory() {
+          @Override
+          public synchronized void rebuildContext() throws IOException {
+            rebuildCount.incrementAndGet();
+          }
+
+          @Override
+          public HttpTransport create() {
+            return mockTransport;
+          }
+        };
+
+    ExternalAccountCredentials credential =
+        ExternalAccountCredentials.fromJson(buildJsonIdentityPoolCredential(), rebuildableFactory);
+    StsTokenExchangeRequest stsRequest =
+        StsTokenExchangeRequest.newBuilder("credential", "subjectTokenType").build();
+
+    assertThrows(
+        IOException.class, () -> credential.exchangeExternalCredentialForAccessToken(stsRequest));
+
+    assertEquals(1, rebuildCount.get());
+  }
+
+  @Test
+  void exchangeExternalCredentialForAccessToken_withNonRebuildableTransport401_doesNotRetry() {
+    MockExternalAccountCredentialsTransport mockTransport =
+        new MockExternalAccountCredentialsTransport();
+    mockTransport.addResponseStatusCodeSequence(401);
+
+    HttpTransportFactory standardFactory = () -> mockTransport;
+
+    ExternalAccountCredentials credential =
+        ExternalAccountCredentials.fromJson(buildJsonIdentityPoolCredential(), standardFactory);
+    StsTokenExchangeRequest stsRequest =
+        StsTokenExchangeRequest.newBuilder("credential", "subjectTokenType").build();
+
+    assertThrows(
+        IOException.class, () -> credential.exchangeExternalCredentialForAccessToken(stsRequest));
+  }
+
   @Test
   void exchangeExternalCredentialForAccessToken_withInternalOptions() throws IOException {
     ExternalAccountCredentials credential =

google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/IdentityPoolCredentialsTest.java

@@ -1557,6 +1557,30 @@ public com.google.api.client.http.HttpTransport create() {
     assertEquals("urn:ietf:params:oauth:token-type:jwt", query.get("actor_token_type"));
   }
 
+  @Test
+  void builder_actorTokenSupplierWithNonMtlsTransport_throws() {
+    MockExternalAccountCredentialsTransportFactory standardFactory =
+        new MockExternalAccountCredentialsTransportFactory();
+
+    IllegalArgumentException exception =
+        assertThrows(
+            IllegalArgumentException.class,
+            () ->
+                IdentityPoolCredentials.newBuilder()
+                    .setSubjectTokenSupplier(testProvider)
+                    .setActorTokenSupplier(testActorSupplier)
+                    .setActorTokenType("urn:ietf:params:oauth:token-type:jwt")
+                    .setAudience("audience")
+                    .setSubjectTokenType("subjectTokenType")
+                    .setTokenUrl("https://sts.googleapis.com/v1/token")
+                    .setHttpTransportFactory(standardFactory)
+                    .build());
+
+    assertEquals(
+        "Actor tokens are only supported for mTLS token exchanges. Please configure a certificate source or MtlsHttpTransportFactory.",
+        exception.getMessage());
+  }
+
   @Test
   void serialization_withX509Provider_succeeds() throws Exception {
     KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());