refactor: organize plugin to support multiple services (#1)

Co-authored-by: Michael Li <michael.li@hashicorp.com>

internal/credential/attributes.go

@@ -0,0 +1,93 @@
+package credential
+
+import (
+	"fmt"
+
+	"github.com/aws/aws-sdk-go/aws/endpoints"
+	"github.com/hashicorp/boundary-plugin-host-aws/internal/errors"
+	"github.com/hashicorp/boundary-plugin-host-aws/internal/values"
+	"github.com/hashicorp/go-secure-stdlib/awsutil"
+	"google.golang.org/protobuf/types/known/structpb"
+)
+
+// CredentialAttributes contains attributes used for AWS credentials
+type CredentialAttributes struct {
+	// Region is the region associated with the aws credentials
+	Region string
+
+	// DisableCredentialRotation disables the rotation of aws secrets associated with the plugin
+	DisableCredentialRotation bool
+}
+
+// GetCredentialsConfig parses values out of a protobuf struct input and returns a
+// CredentialsConfig used for configuring an AWS session. An error is returned if
+// any of the following fields are missing from the protobuf struct input or have
+// invalid value types: access_key_id, secret_access_key. An error is returned if
+// any unrecognized fields are found in the protobuf struct input.
+func GetCredentialsConfig(in *structpb.Struct, region string) (*awsutil.CredentialsConfig, error) {
+	unknownFields := values.StructFields(in)
+	badFields := make(map[string]string)
+
+	accessKey, err := values.GetStringValue(in, ConstAccessKeyId, true)
+	if err != nil {
+		badFields[fmt.Sprintf("secrets.%s", ConstAccessKeyId)] = err.Error()
+	}
+	delete(unknownFields, ConstAccessKeyId)
+
+	secretKey, err := values.GetStringValue(in, ConstSecretAccessKey, true)
+	if err != nil {
+		badFields[fmt.Sprintf("secrets.%s", ConstSecretAccessKey)] = err.Error()
+	}
+	delete(unknownFields, ConstSecretAccessKey)
+
+	if region == "" {
+		badFields[fmt.Sprintf("attributes.%s", ConstRegion)] = err.Error()
+	}
+
+	for s := range unknownFields {
+		badFields[fmt.Sprintf("secrets.%s", s)] = "unrecognized field"
+	}
+
+	if len(badFields) > 0 {
+		return nil, errors.InvalidArgumentError("Error in the secrets provided", badFields)
+	}
+
+	return awsutil.NewCredentialsConfig(
+		awsutil.WithAccessKey(accessKey),
+		awsutil.WithSecretKey(secretKey),
+		awsutil.WithRegion(region),
+	)
+}
+
+// GetCredentialAttributes parses values out of a protobuf struct input and returns a
+// CredentialAttributes used for configuring an AWS session. An error is returned if
+// any of the following fields are missing from the protobuf struct input or have
+// invalid value types: region, disableCredentialRotation
+func GetCredentialAttributes(in *structpb.Struct) (*CredentialAttributes, error) {
+	badFields := make(map[string]string)
+
+	region, err := values.GetStringValue(in, ConstRegion, true)
+	if err != nil {
+		badFields[fmt.Sprintf("attributes.%s", ConstRegion)] = err.Error()
+	}
+
+	if region != "" {
+		if _, found := endpoints.PartitionForRegion(endpoints.DefaultPartitions(), region); !found {
+			badFields[fmt.Sprintf("attributes.%s", ConstRegion)] = fmt.Sprintf("not a valid region: %s", region)
+		}
+	}
+
+	disableCredentialRotation, err := values.GetBoolValue(in, ConstDisableCredentialRotation, false)
+	if err != nil {
+		badFields[fmt.Sprintf("attributes.%s", ConstDisableCredentialRotation)] = err.Error()
+	}
+
+	if len(badFields) > 0 {
+		return nil, errors.InvalidArgumentError("Error in the attributes provided", badFields)
+	}
+
+	return &CredentialAttributes{
+		Region:                    region,
+		DisableCredentialRotation: disableCredentialRotation,
+	}, nil
+}

internal/credential/attributes_test.go

@@ -0,0 +1,159 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package credential
+
+import (
+	"testing"
+
+	"github.com/hashicorp/go-secure-stdlib/awsutil"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/structpb"
+)
+
+func TestGetCredentialAttributes(t *testing.T) {
+	cases := []struct {
+		name                string
+		in                  map[string]any
+		expected            *CredentialAttributes
+		expectedErrContains string
+	}{
+		{
+			name:                "missing region",
+			in:                  map[string]any{},
+			expectedErrContains: "missing required value \"region\"",
+		},
+		{
+			name: "invalid aws region value",
+			in: map[string]any{
+				ConstRegion: "dne",
+			},
+			expectedErrContains: "not a valid region",
+		},
+		{
+			name: "bad value for disable_credential_rotation",
+			in: map[string]any{
+				ConstRegion:                    "us-west-2",
+				ConstDisableCredentialRotation: "sure",
+			},
+			expectedErrContains: "unexpected type for value \"disable_credential_rotation\": want bool, got string",
+		},
+		{
+			name: "default",
+			in: map[string]any{
+				ConstRegion: "us-west-2",
+			},
+			expected: &CredentialAttributes{
+				Region:                    "us-west-2",
+				DisableCredentialRotation: false,
+			},
+		},
+		{
+			name: "with disable_credential_rotation",
+			in: map[string]any{
+				ConstRegion:                    "us-west-2",
+				ConstDisableCredentialRotation: true,
+			},
+			expected: &CredentialAttributes{
+				Region:                    "us-west-2",
+				DisableCredentialRotation: true,
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			require := require.New(t)
+
+			input, err := structpb.NewStruct(tc.in)
+			require.NoError(err)
+
+			actual, err := GetCredentialAttributes(input)
+			if tc.expectedErrContains != "" {
+				require.Error(err)
+				require.Contains(err.Error(), tc.expectedErrContains)
+				require.Equal(status.Code(err), codes.InvalidArgument)
+				return
+			}
+
+			require.NoError(err)
+			require.EqualValues(tc.expected.Region, actual.Region)
+			require.EqualValues(tc.expected.DisableCredentialRotation, actual.DisableCredentialRotation)
+		})
+	}
+}
+
+func TestGetCredentialsConfig(t *testing.T) {
+	cases := []struct {
+		name                string
+		in                  map[string]any
+		region              string
+		expected            *awsutil.CredentialsConfig
+		expectedErrContains string
+	}{
+		{
+			name:                "missing access_key_id",
+			in:                  map[string]any{},
+			region:              "us-west-2",
+			expectedErrContains: "missing required value \"access_key_id\"",
+		},
+		{
+			name: "missing secret_access_key",
+			in: map[string]any{
+				ConstAccessKeyId: "foobar",
+			},
+			region:              "us-west-2",
+			expectedErrContains: "missing required value \"secret_access_key\"",
+		},
+		{
+			name: "unknown fields",
+			in: map[string]any{
+				ConstAccessKeyId:     "foobar",
+				ConstSecretAccessKey: "bazqux",
+				"foo":                true,
+				"bar":                true,
+			},
+			region:              "us-west-2",
+			expectedErrContains: "secrets.bar: unrecognized field, secrets.foo: unrecognized field",
+		},
+		{
+			name: "good",
+			in: map[string]any{
+				ConstAccessKeyId:     "foobar",
+				ConstSecretAccessKey: "bazqux",
+			},
+			region: "us-west-2",
+			expected: &awsutil.CredentialsConfig{
+				AccessKey: "foobar",
+				SecretKey: "bazqux",
+				Region:    "us-west-2",
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			require := require.New(t)
+
+			input, err := structpb.NewStruct(tc.in)
+			require.NoError(err)
+
+			actual, err := GetCredentialsConfig(input, tc.region)
+			if tc.expectedErrContains != "" {
+				require.Error(err)
+				require.Contains(err.Error(), tc.expectedErrContains)
+				require.Equal(status.Code(err), codes.InvalidArgument)
+				return
+			}
+
+			require.NoError(err)
+			require.Equal(tc.expected.AccessKey, actual.AccessKey)
+			require.Equal(tc.expected.SecretKey, actual.SecretKey)
+			require.Equal(tc.expected.Region, actual.Region)
+		})
+	}
+}

internal/credential/const.go

@@ -0,0 +1,18 @@
+package credential
+
+const (
+	// ConstAccessKey is the key for the region in the aws credentials.
+	ConstRegion = "region"
+
+	// ConstAccessKey is the key for the access key id in the aws credentials.
+	ConstAccessKeyId = "access_key_id"
+
+	// ConstSecretAccessKey is the key for the secret access key in the aws credentials.
+	ConstSecretAccessKey = "secret_access_key"
+
+	// ConstDisableCredentialRotation is the key for the disable credential rotation in the aws credentials.
+	ConstDisableCredentialRotation = "disable_credential_rotation"
+
+	// ConstCredsLastRotatedTime is the key for the last rotated time in the aws credentials.
+	ConstCredsLastRotatedTime = "creds_last_rotated_time"
+)

internal/credential/state.go

@@ -0,0 +1,289 @@
+package credential
+
+import (
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/aws/session"
+	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/hashicorp/boundary-plugin-host-aws/internal/values"
+	"github.com/hashicorp/go-secure-stdlib/awsutil"
+	"google.golang.org/protobuf/types/known/structpb"
+)
+
+// rotationWaitTimeout controls the time we wait for credential rotation to
+// succeed. This is important to ensure that rotated credentials can be used
+// right away.
+const rotationWaitTimeout = time.Second * 30
+
+type AwsCredentialPersistedStateOption func(s *AwsCredentialPersistedState) error
+
+// AwsCredentialPersistedState is the persisted state for the AWS credential.
+type AwsCredentialPersistedState struct {
+	// AccessKeyId is the access key id for the AWS credential.
+	AccessKeyId string
+	// SecretAccessKey is the secret access key for the AWS credential.
+	SecretAccessKey string
+	// CredsLastRotatedTime is the last rotation of aws secrets for the AWS credential.
+	CredsLastRotatedTime time.Time
+
+	// testOpts are options that should be used for testing only
+	testOpts []awsutil.Option
+
+	// Region is not a part of persisted state but if set is passed to clients
+	// created with this state
+	region string
+}
+
+// WithStateTestOpts enables unit testing different edge cases
+// when using CredentialsConfig. This should never be used in
+// production code. This should only be used in unit tests.
+func WithStateTestOpts(opts []awsutil.Option) AwsCredentialPersistedStateOption {
+	return func(s *AwsCredentialPersistedState) error {
+		s.testOpts = opts
+		return nil
+	}
+}
+
+// WithAccessKeyId sets the value for AccesskeyId in the storage persisted state.
+func WithAccessKeyId(x string) AwsCredentialPersistedStateOption {
+	return func(s *AwsCredentialPersistedState) error {
+		if s.AccessKeyId != "" {
+			return errors.New("access key id already set")
+		}
+
+		s.AccessKeyId = x
+		return nil
+	}
+}
+
+// WithSecretAccessKey sets the value for SecretAccessKey in the storage persisted state.
+func WithSecretAccessKey(x string) AwsCredentialPersistedStateOption {
+	return func(s *AwsCredentialPersistedState) error {
+		if s.SecretAccessKey != "" {
+			return errors.New("secret access key already set")
+		}
+
+		s.SecretAccessKey = x
+		return nil
+	}
+}
+
+// WithCredsLastRotatedTime sets the value for CredsLastRotatedTime in the storage persisted state.
+func WithCredsLastRotatedTime(t time.Time) AwsCredentialPersistedStateOption {
+	return func(s *AwsCredentialPersistedState) error {
+		if !s.CredsLastRotatedTime.IsZero() {
+			return errors.New("last rotation time already set")
+		}
+
+		s.CredsLastRotatedTime = t
+		return nil
+	}
+}
+
+// WithRegion sets the value for region in the storage persisted state.
+func WithRegion(with string) AwsCredentialPersistedStateOption {
+	return func(s *AwsCredentialPersistedState) error {
+		if s.region != "" {
+			return errors.New("region already set")
+		}
+
+		s.region = with
+		return nil
+	}
+}
+
+// NewAwsCredentialPersistedState returns a AwsCredentialPersistedState.
+// Supported options include: WithAccessKeyId, WithSecretAccessKey
+// WithCredsLastRotatedTime, & WithRegion.
+func NewAwsCredentialPersistedState(opts ...AwsCredentialPersistedStateOption) (*AwsCredentialPersistedState, error) {
+	s := new(AwsCredentialPersistedState)
+	for _, opt := range opts {
+		if err := opt(s); err != nil {
+			return nil, err
+		}
+	}
+
+	return s, nil
+}
+
+// ValidateCreds takes the access key and secret key from the persisted state
+// and runs sts.GetCallerIdentity for the current credentials, which is done
+// to check that the credentials are valid.
+func (s *AwsCredentialPersistedState) ValidateCreds() error {
+	c, err := awsutil.NewCredentialsConfig(append([]awsutil.Option{
+		awsutil.WithAccessKey(s.AccessKeyId),
+		awsutil.WithSecretKey(s.SecretAccessKey),
+		awsutil.WithRegion(s.region),
+	}, s.testOpts...)...)
+	if err != nil {
+		return fmt.Errorf("error loading credentials: %w", err)
+	}
+
+	if _, err := c.GetCallerIdentity(s.testOpts...); err != nil {
+		return fmt.Errorf("error validating credentials: %w", err)
+	}
+
+	return nil
+}
+
+// RotateCreds takes the access key and secret key from the persisted state and creates a new access/secret key,
+// then deletes the old access key. If deletion of the old access key is successful, the new access key/secret key are
+// written into the credentials config and the persisted state. On any error, the old credentials are not overwritten.
+// This ensures that any generated new secret key never leaves this function in case of an error, even though it will
+// still result in an extraneous access key existing.
+func (s *AwsCredentialPersistedState) RotateCreds() error {
+	c, err := awsutil.NewCredentialsConfig(append([]awsutil.Option{
+		awsutil.WithAccessKey(s.AccessKeyId),
+		awsutil.WithSecretKey(s.SecretAccessKey),
+		awsutil.WithRegion(s.region),
+	}, s.testOpts...)...)
+	if err != nil {
+		return fmt.Errorf("error loading credentials: %w", err)
+	}
+
+	if err := c.RotateKeys(append([]awsutil.Option{
+		awsutil.WithValidityCheckTimeout(rotationWaitTimeout),
+	}, s.testOpts...)...); err != nil {
+		return fmt.Errorf("error rotating credentials: %w", err)
+	}
+
+	s.AccessKeyId = c.AccessKey
+	s.SecretAccessKey = c.SecretKey
+	s.CredsLastRotatedTime = time.Now()
+
+	return nil
+}
+
+// ReplaceCreds replaces the access key in the state with a new key.
+// If the existing key was rotated at any point in time, it is
+// deleted first, otherwise it's left alone.
+func (s *AwsCredentialPersistedState) ReplaceCreds(accessKeyId, secretAccessKey string) error {
+	if accessKeyId == "" {
+		return errors.New("access key id cannot be empty")
+	}
+
+	if secretAccessKey == "" {
+		return errors.New("secret access key cannot be empty")
+	}
+
+	if accessKeyId == s.AccessKeyId {
+		return errors.New("attempting to replace access key with the same one")
+	}
+
+	if !s.CredsLastRotatedTime.IsZero() {
+		// Delete old/existing credentials. This is done with the same
+		// credentials to ensure that it has the proper permissions to do
+		// it.
+		if err := s.DeleteCreds(); err != nil {
+			return err
+		}
+	}
+
+	// Set the new attributes and clear the rotated time.
+	s.AccessKeyId = accessKeyId
+	s.SecretAccessKey = secretAccessKey
+	s.CredsLastRotatedTime = time.Time{}
+	return nil
+}
+
+// DeleteCreds deletes the credentials in the state. The access key
+// ID, secret access key, and rotation time fields are zeroed out in
+// the state just to ensure that they cannot be re-used after.
+func (s *AwsCredentialPersistedState) DeleteCreds() error {
+	c, err := awsutil.NewCredentialsConfig(append([]awsutil.Option{
+		awsutil.WithAccessKey(s.AccessKeyId),
+		awsutil.WithSecretKey(s.SecretAccessKey),
+		awsutil.WithRegion(s.region),
+	}, s.testOpts...)...)
+	if err != nil {
+		return fmt.Errorf("error loading credentials: %w", err)
+	}
+
+	if err := c.DeleteAccessKey(s.AccessKeyId, s.testOpts...); err != nil {
+		// Determine if the deletion error was due to a missing
+		// resource. If it was, just pass it.
+		var awsErr awserr.Error
+		if errors.As(err, &awsErr) {
+			if awsErr.Code() == iam.ErrCodeNoSuchEntityException {
+				s.AccessKeyId = ""
+				s.SecretAccessKey = ""
+				s.CredsLastRotatedTime = time.Time{}
+				return nil
+			}
+		}
+
+		// Otherwise treat it as an actual error.
+		return err
+	}
+
+	s.AccessKeyId = ""
+	s.SecretAccessKey = ""
+	s.CredsLastRotatedTime = time.Time{}
+	return nil
+}
+
+// GetSession returns a configured AWS session for the credentials in
+// the state.
+func (s *AwsCredentialPersistedState) GetSession() (*session.Session, error) {
+	c, err := awsutil.NewCredentialsConfig(append([]awsutil.Option{
+		awsutil.WithAccessKey(s.AccessKeyId),
+		awsutil.WithSecretKey(s.SecretAccessKey),
+		awsutil.WithRegion(s.region),
+	}, s.testOpts...)...)
+	if err != nil {
+		return nil, err
+	}
+
+	return c.GetSession()
+}
+
+// ToMap returns a map of the credentials stored in the persisted state,
+// which includes the following keys: access_key_id, secret_access_key,
+// & creds_last_rotated_time
+func (s *AwsCredentialPersistedState) ToMap() map[string]any {
+	return map[string]any{
+		ConstAccessKeyId:          s.AccessKeyId,
+		ConstSecretAccessKey:      s.SecretAccessKey,
+		ConstCredsLastRotatedTime: s.CredsLastRotatedTime.Format(time.RFC3339Nano),
+	}
+}
+
+// AwsCredentialPersistedStateFromProto parses values out of a protobuf struct input
+// and returns a AwsCredentialPersistedState used for configuring an AWS session.
+// An error is returned if any of the following fields are missing from the protobuf
+// struct input or have invalid value types: access_key_id, secret_access_key, &
+// creds_last_rotated_time.
+func AwsCredentialPersistedStateFromProto(in *structpb.Struct, opts ...AwsCredentialPersistedStateOption) (*AwsCredentialPersistedState, error) {
+	if in == nil {
+		return nil, errors.New("missing persisted secrets")
+	}
+
+	accessKeyId, err := values.GetStringValue(in, ConstAccessKeyId, true)
+	if err != nil {
+		return nil, fmt.Errorf("persisted state integrity error: %w", err)
+	}
+
+	secretAccessKey, err := values.GetStringValue(in, ConstSecretAccessKey, true)
+	if err != nil {
+		return nil, fmt.Errorf("persisted state integrity error: %w", err)
+	}
+
+	credsLastRotatedTime, err := values.GetTimeValue(in, ConstCredsLastRotatedTime)
+	if err != nil {
+		return nil, fmt.Errorf("persisted state integrity error: %w", err)
+	}
+
+	s, err := NewAwsCredentialPersistedState(opts...)
+	if err != nil {
+		return nil, err
+	}
+
+	s.AccessKeyId = accessKeyId
+	s.SecretAccessKey = secretAccessKey
+	s.CredsLastRotatedTime = credsLastRotatedTime
+
+	return s, nil
+}

internal/credential/state_test.go

@@ -0,0 +1,575 @@
+package credential
+
+import (
+	"errors"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/hashicorp/go-secure-stdlib/awsutil"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/types/known/structpb"
+)
+
+func TestNewAwsCredentialPersistedState(t *testing.T) {
+	staticTime := time.Now()
+
+	cases := []struct {
+		name        string
+		opts        []AwsCredentialPersistedStateOption
+		expected    *AwsCredentialPersistedState
+		expectedErr string
+	}{
+		{
+			name: "error",
+			opts: []AwsCredentialPersistedStateOption{
+				func(s *AwsCredentialPersistedState) error {
+					return errors.New(testOptionErr)
+				},
+			},
+			expectedErr: testOptionErr,
+		},
+		{
+			name: "access key id",
+			opts: []AwsCredentialPersistedStateOption{
+				WithAccessKeyId("foobar"),
+			},
+			expected: &AwsCredentialPersistedState{
+				AccessKeyId: "foobar",
+			},
+		},
+		{
+			name: "secret access key",
+			opts: []AwsCredentialPersistedStateOption{
+				WithSecretAccessKey("bazqux"),
+			},
+			expected: &AwsCredentialPersistedState{
+				SecretAccessKey: "bazqux",
+			},
+		},
+		{
+			name: "rotation time",
+			opts: []AwsCredentialPersistedStateOption{
+				WithCredsLastRotatedTime(staticTime),
+			},
+			expected: &AwsCredentialPersistedState{
+				CredsLastRotatedTime: staticTime,
+			},
+		},
+		{
+			name: "region key",
+			opts: []AwsCredentialPersistedStateOption{
+				WithRegion("foobar"),
+			},
+			expected: &AwsCredentialPersistedState{
+				region: "foobar",
+			},
+		},
+		{
+			name: "double set access key id",
+			opts: []AwsCredentialPersistedStateOption{
+				WithAccessKeyId("foobar"),
+				WithAccessKeyId("onetwo"),
+			},
+			expectedErr: "access key id already set",
+		},
+		{
+			name: "double set secret access key",
+			opts: []AwsCredentialPersistedStateOption{
+				WithSecretAccessKey("bazqux"),
+				WithSecretAccessKey("threefour"),
+			},
+			expectedErr: "secret access key already set",
+		},
+		{
+			name: "double set rotation time",
+			opts: []AwsCredentialPersistedStateOption{
+				WithCredsLastRotatedTime(staticTime),
+				WithCredsLastRotatedTime(time.Now()),
+			},
+			expectedErr: "last rotation time already set",
+		},
+		{
+			name: "double set region",
+			opts: []AwsCredentialPersistedStateOption{
+				WithRegion("foobar"),
+				WithRegion("barfoo"),
+			},
+			expectedErr: "region already set",
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			require := require.New(t)
+			actual, err := NewAwsCredentialPersistedState(tc.opts...)
+			if tc.expectedErr != "" {
+				require.EqualError(err, tc.expectedErr)
+				return
+			}
+
+			require.NoError(err)
+			require.Equal(tc.expected, actual)
+		})
+	}
+}
+
+func TestAwsCredentialPersistedStateFromProto(t *testing.T) {
+	cases := []struct {
+		name        string
+		in          map[string]any
+		opts        []AwsCredentialPersistedStateOption
+		expected    *AwsCredentialPersistedState
+		expectedErr string
+	}{
+		{
+			name:        "no secrets",
+			in:          nil,
+			expectedErr: "missing persisted secrets",
+		},
+		{
+			name:        "missing access key ID",
+			in:          map[string]any{},
+			expectedErr: "persisted state integrity error: missing required value \"access_key_id\"",
+		},
+		{
+			name: "missing secret access key",
+			in: map[string]any{
+				ConstAccessKeyId: "foobar",
+			},
+			expectedErr: "persisted state integrity error: missing required value \"secret_access_key\"",
+		},
+		{
+			name: "bad last rotated time",
+			in: map[string]any{
+				ConstAccessKeyId:          "foobar",
+				ConstSecretAccessKey:      "bazqux",
+				ConstCredsLastRotatedTime: "notatime",
+			},
+			expectedErr: "persisted state integrity error: could not parse time in value \"creds_last_rotated_time\": parsing time \"notatime\" as \"2006-01-02T15:04:05.999999999Z07:00\": cannot parse \"notatime\" as \"2006\"",
+		},
+		{
+			name: "option error",
+			in: map[string]any{
+				ConstAccessKeyId:          "foobar",
+				ConstSecretAccessKey:      "bazqux",
+				ConstCredsLastRotatedTime: "2006-01-02T15:04:05+07:00",
+			},
+			opts: []AwsCredentialPersistedStateOption{
+				func(s *AwsCredentialPersistedState) error {
+					return errors.New(testOptionErr)
+				},
+			},
+			expectedErr: testOptionErr,
+		},
+		{
+			name: "good with non-zero timestamp",
+			in: map[string]any{
+				ConstAccessKeyId:          "foobar",
+				ConstSecretAccessKey:      "bazqux",
+				ConstCredsLastRotatedTime: "2006-01-02T15:04:05+07:00",
+			},
+			expected: &AwsCredentialPersistedState{
+				AccessKeyId:     "foobar",
+				SecretAccessKey: "bazqux",
+				CredsLastRotatedTime: func() time.Time {
+					t, err := time.Parse(time.RFC3339, "2006-01-02T15:04:05+07:00")
+					if err != nil {
+						panic(err)
+					}
+					return t
+				}(),
+			},
+		},
+		{
+			name: "good with zero timestamp",
+			in: map[string]any{
+				ConstAccessKeyId:          "foobar",
+				ConstSecretAccessKey:      "bazqux",
+				ConstCredsLastRotatedTime: (time.Time{}).Format(time.RFC3339Nano),
+			},
+			expected: &AwsCredentialPersistedState{
+				AccessKeyId:          "foobar",
+				SecretAccessKey:      "bazqux",
+				CredsLastRotatedTime: time.Time{},
+			},
+		},
+		{
+			name: "good (ignoring non-test options)",
+			in: map[string]any{
+				ConstAccessKeyId:          "foobar",
+				ConstSecretAccessKey:      "bazqux",
+				ConstCredsLastRotatedTime: (time.Time{}).Format(time.RFC3339Nano),
+			},
+			opts: []AwsCredentialPersistedStateOption{
+				WithAccessKeyId("ignored"),
+				WithRegion("us-west-2"),
+			},
+			expected: &AwsCredentialPersistedState{
+				AccessKeyId:          "foobar",
+				SecretAccessKey:      "bazqux",
+				CredsLastRotatedTime: time.Time{},
+				region:               "us-west-2",
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			require := require.New(t)
+
+			var (
+				input *structpb.Struct
+				err   error
+			)
+			if tc.in != nil {
+				input, err = structpb.NewStruct(tc.in)
+				require.NoError(err)
+			}
+
+			actual, err := AwsCredentialPersistedStateFromProto(input, tc.opts...)
+			if tc.expectedErr != "" {
+				require.EqualError(err, tc.expectedErr)
+				return
+			}
+
+			require.NoError(err)
+			require.Equal(tc.expected.AccessKeyId, actual.AccessKeyId)
+			require.Equal(tc.expected.SecretAccessKey, actual.SecretAccessKey)
+			require.Equal(tc.expected.region, actual.region)
+		})
+	}
+}
+
+func TestAwsCatalogPersistedStateValidateCreds(t *testing.T) {
+	cases := []struct {
+		name        string
+		in          *AwsCredentialPersistedState
+		expectedErr string
+	}{
+		{
+			name: "could not load credentials",
+			in: &AwsCredentialPersistedState{
+				testOpts: []awsutil.Option{awsutil.MockOptionErr(errors.New(testOptionErr))},
+			},
+			expectedErr: fmt.Sprintf("error loading credentials: error reading options in NewCredentialsConfig: %s", testOptionErr),
+		},
+		{
+			name: "validation error",
+			in: &AwsCredentialPersistedState{
+				testOpts: []awsutil.Option{awsutil.WithSTSAPIFunc(awsutil.NewMockSTS(awsutil.WithGetCallerIdentityError(errors.New(testGetCallerIdentityErr))))},
+			},
+			expectedErr: fmt.Sprintf("error validating credentials: %s", testGetCallerIdentityErr),
+		},
+		{
+			name: "good",
+			in: &AwsCredentialPersistedState{
+				AccessKeyId:     "foobar",
+				SecretAccessKey: "bazqux",
+				testOpts:        []awsutil.Option{awsutil.WithSTSAPIFunc(awsutil.NewMockSTS())},
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			require := require.New(t)
+			err := tc.in.ValidateCreds()
+			if tc.expectedErr != "" {
+				require.EqualError(err, tc.expectedErr)
+				return
+			}
+
+			require.NoError(err)
+		})
+	}
+}
+
+func TestAwsCatalogPersistedStateRotateCreds(t *testing.T) {
+	cases := []struct {
+		name                       string
+		in                         *AwsCredentialPersistedState
+		expectedAccessKeyId        string
+		expectedSecretAccessKey    string
+		expectedNonZeroRotatedTime bool
+		expectedErr                string
+	}{
+		{
+			name: "could not load credentials",
+			in: &AwsCredentialPersistedState{
+				testOpts: []awsutil.Option{awsutil.MockOptionErr(errors.New(testOptionErr))},
+			},
+			expectedErr: fmt.Sprintf("error loading credentials: error reading options in NewCredentialsConfig: %s", testOptionErr),
+		},
+		{
+			name: "rotation error",
+			in: &AwsCredentialPersistedState{
+				AccessKeyId:     "foobar",
+				SecretAccessKey: "bazqux",
+				testOpts: []awsutil.Option{
+					awsutil.WithIAMAPIFunc(
+						awsutil.NewMockIAM(
+							awsutil.WithGetUserError(errors.New(testGetUserErr)),
+						),
+					),
+				},
+			},
+			expectedErr: fmt.Sprintf("error rotating credentials: error calling CreateAccessKey: error calling aws.GetUser: %s", testGetUserErr),
+		},
+		{
+			name: "good",
+			in: &AwsCredentialPersistedState{
+				AccessKeyId:     "foobar",
+				SecretAccessKey: "bazqux",
+				testOpts: []awsutil.Option{
+					awsutil.WithSTSAPIFunc(
+						awsutil.NewMockSTS(),
+					),
+					awsutil.WithIAMAPIFunc(
+						awsutil.NewMockIAM(
+							awsutil.WithGetUserOutput(
+								&iam.GetUserOutput{
+									User: &iam.User{
+										Arn:      aws.String("arn:aws:iam::123456789012:user/JohnDoe"),
+										UserId:   aws.String("AIDAJQABLZS4A3QDU576Q"),
+										UserName: aws.String("JohnDoe"),
+									},
+								},
+							),
+							awsutil.WithCreateAccessKeyOutput(
+								&iam.CreateAccessKeyOutput{
+									AccessKey: &iam.AccessKey{
+										AccessKeyId:     aws.String("one"),
+										SecretAccessKey: aws.String("two"),
+										UserName:        aws.String("JohnDoe"),
+									},
+								},
+							),
+						),
+					),
+				},
+			},
+			expectedAccessKeyId:        "one",
+			expectedSecretAccessKey:    "two",
+			expectedNonZeroRotatedTime: true,
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			require := require.New(t)
+			err := tc.in.RotateCreds()
+			if tc.expectedErr != "" {
+				require.EqualError(err, tc.expectedErr)
+				return
+			}
+
+			require.NoError(err)
+			require.Equal(tc.expectedAccessKeyId, tc.in.AccessKeyId)
+			require.Equal(tc.expectedSecretAccessKey, tc.in.SecretAccessKey)
+			require.Equal(tc.expectedNonZeroRotatedTime, !tc.in.CredsLastRotatedTime.IsZero())
+		})
+	}
+}
+
+func TestAwsCatalogPersistedStateReplaceCreds(t *testing.T) {
+	// NOTE: Not safe to run this test in parallel
+	state := new(testMockIAMState)
+	cases := []struct {
+		name                    string
+		in                      *AwsCredentialPersistedState
+		accessKeyId             string
+		secretAccessKey         string
+		expectedAccessKeyId     string
+		expectedSecretAccessKey string
+		expectedDeleteCalled    bool
+		expectedErr             string
+	}{
+		{
+			name:        "missing access key id",
+			in:          &AwsCredentialPersistedState{},
+			expectedErr: "access key id cannot be empty",
+		},
+		{
+			name:        "missing access key id",
+			in:          &AwsCredentialPersistedState{},
+			accessKeyId: "one",
+			expectedErr: "secret access key cannot be empty",
+		},
+		{
+			name: "identical access key id",
+			in: &AwsCredentialPersistedState{
+				AccessKeyId:     "foobar",
+				SecretAccessKey: "bazqux",
+			},
+			accessKeyId:     "foobar",
+			secretAccessKey: "bazqux",
+			expectedErr:     "attempting to replace access key with the same one",
+		},
+		{
+			name: "deletion error",
+			in: &AwsCredentialPersistedState{
+				AccessKeyId:          "foobar",
+				SecretAccessKey:      "bazqux",
+				CredsLastRotatedTime: time.Now(),
+				testOpts: []awsutil.Option{
+					awsutil.WithIAMAPIFunc(
+						awsutil.NewMockIAM(
+							awsutil.WithDeleteAccessKeyError(errors.New(testDeleteAccessKeyErr)),
+						),
+					),
+				},
+			},
+			accessKeyId:     "one",
+			secretAccessKey: "two",
+			expectedErr:     fmt.Sprintf("error deleting old access key: %s", testDeleteAccessKeyErr),
+		},
+		{
+			name: "good with delete of old rotated",
+			in: &AwsCredentialPersistedState{
+				AccessKeyId:          "foobar",
+				SecretAccessKey:      "bazqux",
+				CredsLastRotatedTime: time.Now(),
+				testOpts: []awsutil.Option{
+					awsutil.WithIAMAPIFunc(
+						newTestMockIAM(state),
+					),
+				},
+			},
+			accessKeyId:             "one",
+			secretAccessKey:         "two",
+			expectedAccessKeyId:     "one",
+			expectedSecretAccessKey: "two",
+			expectedDeleteCalled:    true,
+		},
+		{
+			name: "good without delete of old rotated",
+			in: &AwsCredentialPersistedState{
+				AccessKeyId:     "foobar",
+				SecretAccessKey: "bazqux",
+				testOpts: []awsutil.Option{
+					awsutil.WithIAMAPIFunc(
+						newTestMockIAM(state),
+					),
+				},
+			},
+			accessKeyId:             "one",
+			secretAccessKey:         "two",
+			expectedAccessKeyId:     "one",
+			expectedSecretAccessKey: "two",
+			expectedDeleteCalled:    false,
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			require := require.New(t)
+			state.Reset()
+			err := tc.in.ReplaceCreds(tc.accessKeyId, tc.secretAccessKey)
+			if tc.expectedErr != "" {
+				require.EqualError(err, tc.expectedErr)
+				return
+			}
+
+			require.NoError(err)
+			require.Equal(tc.expectedAccessKeyId, tc.in.AccessKeyId)
+			require.Equal(tc.expectedSecretAccessKey, tc.in.SecretAccessKey)
+			require.Zero(tc.in.CredsLastRotatedTime)
+			require.Equal(tc.expectedDeleteCalled, state.DeleteAccessKeyCalled)
+		})
+	}
+}
+
+func TestAwsCatalogPersistedStateDeleteCreds(t *testing.T) {
+	cases := []struct {
+		name        string
+		in          *AwsCredentialPersistedState
+		expectedErr string
+	}{
+		{
+			name: "could not load credentials",
+			in: &AwsCredentialPersistedState{
+				testOpts: []awsutil.Option{awsutil.MockOptionErr(errors.New(testOptionErr))},
+			},
+			expectedErr: fmt.Sprintf("error loading credentials: error reading options in NewCredentialsConfig: %s", testOptionErr),
+		},
+		{
+			name: "deletion error",
+			in: &AwsCredentialPersistedState{
+				AccessKeyId:     "foobar",
+				SecretAccessKey: "bazqux",
+				testOpts: []awsutil.Option{
+					awsutil.WithIAMAPIFunc(
+						awsutil.NewMockIAM(
+							awsutil.WithDeleteAccessKeyError(errors.New(testDeleteAccessKeyErr)),
+						),
+					),
+				},
+			},
+			expectedErr: fmt.Sprintf("error deleting old access key: %s", testDeleteAccessKeyErr),
+		},
+		{
+			name: "deletion error, but OK because key was just gone",
+			in: &AwsCredentialPersistedState{
+				AccessKeyId:     "foobar",
+				SecretAccessKey: "bazqux",
+				testOpts: []awsutil.Option{
+					awsutil.WithIAMAPIFunc(
+						awsutil.NewMockIAM(
+							awsutil.WithDeleteAccessKeyError(
+								awserr.New(iam.ErrCodeNoSuchEntityException, "", nil),
+							),
+						),
+					),
+				},
+			},
+		},
+		{
+			name: "good",
+			in: &AwsCredentialPersistedState{
+				AccessKeyId:     "foobar",
+				SecretAccessKey: "bazqux",
+				testOpts: []awsutil.Option{
+					awsutil.WithIAMAPIFunc(
+						awsutil.NewMockIAM(),
+					),
+				},
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			require := require.New(t)
+			err := tc.in.DeleteCreds()
+			if tc.expectedErr != "" {
+				require.EqualError(err, tc.expectedErr)
+				return
+			}
+
+			require.NoError(err)
+			require.Empty(tc.in.AccessKeyId)
+			require.Empty(tc.in.SecretAccessKey)
+			require.Zero(tc.in.CredsLastRotatedTime)
+		})
+	}
+}
+
+func TestAwsCatalogPersistedStateGetSessionErr(t *testing.T) {
+	require := require.New(t)
+	state := &AwsCredentialPersistedState{
+		testOpts: []awsutil.Option{awsutil.MockOptionErr(errors.New(testOptionErr))},
+	}
+
+	_, err := state.GetSession()
+	require.EqualError(err, fmt.Sprintf("error reading options in NewCredentialsConfig: %s", testOptionErr))
+}

internal/credential/testing.go

@@ -0,0 +1,47 @@
+package credential
+
+import (
+	"github.com/aws/aws-sdk-go/aws/session"
+	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/service/iam/iamiface"
+	"github.com/hashicorp/go-secure-stdlib/awsutil"
+)
+
+const (
+	testOptionErr            = "test option error"
+	testGetCallerIdentityErr = "test error for GetCallerIdentity"
+	testGetUserErr           = "test error for GetUser"
+	testDeleteAccessKeyErr   = "test error for DeleteAccessKey"
+)
+
+type testMockIAMState struct {
+	DeleteAccessKeyCalled bool
+}
+
+func (s *testMockIAMState) Reset() {
+	s.DeleteAccessKeyCalled = false
+}
+
+type testMockIAM struct {
+	iamiface.IAMAPI
+
+	State *testMockIAMState
+}
+
+func (m *testMockIAM) DeleteAccessKey(input *iam.DeleteAccessKeyInput) (*iam.DeleteAccessKeyOutput, error) {
+	m.State.DeleteAccessKeyCalled = true
+	return m.IAMAPI.DeleteAccessKey(input)
+}
+
+func newTestMockIAM(state *testMockIAMState, opts ...awsutil.MockIAMOption) awsutil.IAMAPIFunc {
+	return func(sess *session.Session) (iamiface.IAMAPI, error) {
+		m := &testMockIAM{
+			State: state,
+		}
+		f := awsutil.NewMockIAM(opts...)
+		var err error
+
+		m.IAMAPI, err = f(sess)
+		return m, err
+	}
+}

internal/errors/error.go

@@ -0,0 +1,23 @@
+package errors
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+// InvalidArgumentError returns an grpc invalid argument status error.
+func InvalidArgumentError(msg string, f map[string]string) error {
+	var fieldMsgs []string
+	for field, val := range f {
+		fieldMsgs = append(fieldMsgs, fmt.Sprintf("%s: %s", field, val))
+	}
+	if len(fieldMsgs) > 0 {
+		sort.Strings(fieldMsgs)
+		msg = fmt.Sprintf("%s: [%s]", msg, strings.Join(fieldMsgs, ", "))
+	}
+	return status.Error(codes.InvalidArgument, msg)
+}

internal/values/proto.go

@@ -0,0 +1,93 @@
+package values
+
+import (
+	"fmt"
+	"time"
+
+	"google.golang.org/protobuf/types/known/structpb"
+)
+
+// GetStringValue returns a string value and no error if the given key
+// is found in the provided proto struct input. An error is returned
+// if the key is not found or the value type is not a string. An error is
+// returned if the parameter argument "required" is set to true
+// and the value from the proto struct input is empty.
+func GetStringValue(in *structpb.Struct, k string, required bool) (string, error) {
+	mv := in.GetFields()
+	v, ok := mv[k]
+	if !ok {
+		if required {
+			return "", fmt.Errorf("missing required value %q", k)
+		}
+
+		return "", nil
+	}
+
+	s, ok := v.AsInterface().(string)
+	if !ok {
+		return "", fmt.Errorf("unexpected type for value %q: want string, got %T", k, v.AsInterface())
+	}
+
+	if s == "" && required {
+		return "", fmt.Errorf("value %q cannot be empty", k)
+	}
+
+	return s, nil
+}
+
+// GetBoolValue returns a boolean value and no error if the given key
+// is found in the provided proto struct input. An error is returned
+// if the key is not found or the value type is not a bool.
+func GetBoolValue(in *structpb.Struct, k string, required bool) (bool, error) {
+	mv := in.GetFields()
+	v, ok := mv[k]
+	if !ok {
+		if required {
+			return false, fmt.Errorf("missing required value %q", k)
+		}
+
+		return false, nil
+	}
+
+	b, ok := v.AsInterface().(bool)
+	if !ok {
+		return false, fmt.Errorf("unexpected type for value %q: want bool, got %T", k, v.AsInterface())
+	}
+
+	return b, nil
+}
+
+// GetTimeValue returns a time.Time value and no error if the given key
+// is found in the provided proto struct input. An error is returned
+// if the key is not found or the value type is not a parsable. The
+// expected time layout is RFC3339Nano.
+func GetTimeValue(in *structpb.Struct, k string) (time.Time, error) {
+	mv := in.GetFields()
+	v, ok := mv[k]
+	if !ok {
+		return time.Time{}, nil
+	}
+
+	tRaw, ok := v.AsInterface().(string)
+	if !ok {
+		return time.Time{}, fmt.Errorf("unexpected type for value %q: want string, got %T", k, v.AsInterface())
+	}
+
+	t, err := time.Parse(time.RFC3339Nano, tRaw)
+	if err != nil {
+		return time.Time{}, fmt.Errorf("could not parse time in value %q: %w", k, err)
+	}
+
+	return t, nil
+}
+
+// StructFields returns a map[string]struct{} of the
+// proto struct input.
+func StructFields(s *structpb.Struct) map[string]struct{} {
+	m := make(map[string]struct{}, len(s.GetFields()))
+	for k := range s.GetFields() {
+		m[k] = struct{}{}
+	}
+
+	return m
+}

internal/values/proto_test.go

@@ -0,0 +1,207 @@
+package values
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/types/known/structpb"
+)
+
+func TestGetStringValue(t *testing.T) {
+	cases := []struct {
+		name        string
+		in          map[string]any
+		key         string
+		required    bool
+		expected    string
+		expectedErr string
+	}{
+		{
+			name:        "required missing",
+			in:          map[string]any{},
+			key:         "foo",
+			required:    true,
+			expectedErr: "missing required value \"foo\"",
+		},
+		{
+			name:     "optional missing",
+			in:       map[string]any{},
+			key:      "foo",
+			expected: "",
+		},
+		{
+			name: "non-string value",
+			in: map[string]any{
+				"foo": 1,
+			},
+			key:         "foo",
+			expectedErr: "unexpected type for value \"foo\": want string, got float64",
+		},
+		{
+			name: "required empty",
+			in: map[string]any{
+				"foo": "",
+			},
+			key:         "foo",
+			required:    true,
+			expectedErr: "value \"foo\" cannot be empty",
+		},
+		{
+			name: "good",
+			in: map[string]any{
+				"foo": "bar",
+			},
+			key:      "foo",
+			expected: "bar",
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			require := require.New(t)
+
+			input, err := structpb.NewStruct(tc.in)
+			require.NoError(err)
+
+			actual, err := GetStringValue(input, tc.key, tc.required)
+			if tc.expectedErr != "" {
+				require.EqualError(err, tc.expectedErr)
+				return
+			}
+
+			require.NoError(err)
+			require.Equal(tc.expected, actual)
+		})
+	}
+}
+
+func TestGetBoolValue(t *testing.T) {
+	cases := []struct {
+		name        string
+		in          map[string]any
+		key         string
+		required    bool
+		expected    bool
+		expectedErr string
+	}{
+		{
+			name:        "required missing",
+			in:          map[string]any{},
+			key:         "foo",
+			required:    true,
+			expectedErr: "missing required value \"foo\"",
+		},
+		{
+			name:     "optional missing",
+			in:       map[string]any{},
+			key:      "foo",
+			expected: false,
+		},
+		{
+			name: "non-bool value",
+			in: map[string]any{
+				"foo": "bar",
+			},
+			key:         "foo",
+			expectedErr: "unexpected type for value \"foo\": want bool, got string",
+		},
+		{
+			name: "good",
+			in: map[string]any{
+				"foo": true,
+			},
+			key:      "foo",
+			expected: true,
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			require := require.New(t)
+
+			input, err := structpb.NewStruct(tc.in)
+			require.NoError(err)
+
+			actual, err := GetBoolValue(input, tc.key, tc.required)
+			if tc.expectedErr != "" {
+				require.EqualError(err, tc.expectedErr)
+				return
+			}
+
+			require.NoError(err)
+			require.Equal(tc.expected, actual)
+		})
+	}
+}
+
+func TestGetTimeValue(t *testing.T) {
+	staticTime := time.Now()
+
+	cases := []struct {
+		name        string
+		in          map[string]any
+		key         string
+		expected    time.Time
+		expectedErr string
+	}{
+		{
+			name:     "missing",
+			in:       map[string]any{},
+			key:      "foo",
+			expected: time.Time{},
+		},
+		{
+			name: "non-time value",
+			in: map[string]any{
+				"foo": 1,
+			},
+			key:         "foo",
+			expectedErr: "unexpected type for value \"foo\": want string, got float64",
+		},
+		{
+			name: "bad parse",
+			in: map[string]any{
+				"foo": "bar",
+			},
+			key:         "foo",
+			expectedErr: "could not parse time in value \"foo\": parsing time \"bar\" as \"2006-01-02T15:04:05.999999999Z07:00\": cannot parse \"bar\" as \"2006\"",
+		},
+		{
+			name: "good",
+			in: map[string]any{
+				"foo": staticTime.Format(time.RFC3339Nano),
+			},
+			key: "foo",
+			expected: func() time.Time {
+				u, err := time.Parse(time.RFC3339Nano, staticTime.Format(time.RFC3339Nano))
+				if err != nil {
+					panic(err)
+				}
+
+				return u
+			}(),
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			require := require.New(t)
+
+			input, err := structpb.NewStruct(tc.in)
+			require.NoError(err)
+
+			actual, err := GetTimeValue(input, tc.key)
+			if tc.expectedErr != "" {
+				require.EqualError(err, tc.expectedErr)
+				return
+			}
+
+			require.NoError(err)
+			require.Equal(tc.expected, actual)
+		})
+	}
+}