From bd3ec426685516af444abdc706f3d58ace03de2a Mon Sep 17 00:00:00 2001
From: Elim Tsiagbey <elim.tsiagbey@hashicorp.com>
Date: Fri, 13 Dec 2024 10:08:04 -0500
Subject: [PATCH] fix: extra credential generation

When rotating credentials, `ValidatePermission` function generates a credentials but credentials are already passed to it with client.Options. This is currently causing a bug where GCP sometimes does not accept the second generated token
---
 internal/credential/rotate.go      | 17 +++++------------
 internal/credential/rotate_test.go | 10 ----------
 2 files changed, 5 insertions(+), 22 deletions(-)

diff --git a/internal/credential/rotate.go b/internal/credential/rotate.go
index 8fe8c38..5e03c7b 100644
--- a/internal/credential/rotate.go
+++ b/internal/credential/rotate.go
@@ -167,23 +167,16 @@ func (c *Config) DeletePrivateKey(ctx context.Context, opts ...option.ClientOpti
 
 // ValidateIamPermissions tests the IAM permissions for the credentials.
 // It returns the granted permissions if successful.
+//
+// The caller needs to ensure either a token source is passed in for
+// authentication or authentication is provided by Application Default
+// Credentials
 func (c *Config) ValidateIamPermissions(ctx context.Context, permissions []string, opts ...option.ClientOption) ([]string, error) {
 	if len(permissions) == 0 {
 		return nil, status.Error(codes.InvalidArgument, "permissions are required")
 	}
 
-	creds, err := c.GenerateCredentials(ctx)
-	if err != nil {
-		return nil, status.Errorf(codes.Unauthenticated, "error generating credentials: %v", err)
-	}
-	if creds.TokenSource == nil {
-		return nil, status.Error(codes.Unauthenticated, "error generating credentials: token source is nil")
-	}
-
-	clientOptions := []option.ClientOption{option.WithTokenSource(creds.TokenSource)}
-	clientOptions = append(clientOptions, opts...)
-
-	rmClient, err := resourcemanager.NewProjectsClient(ctx, clientOptions...)
+	rmClient, err := resourcemanager.NewProjectsClient(ctx, opts...)
 	if err != nil {
 		return nil, status.Errorf(codes.Internal, "failed to create Resource Manager client: %v", err)
 	}
diff --git a/internal/credential/rotate_test.go b/internal/credential/rotate_test.go
index a13c3d1..d8fa8a8 100644
--- a/internal/credential/rotate_test.go
+++ b/internal/credential/rotate_test.go
@@ -183,16 +183,6 @@ func TestValidateIamPermissions(t *testing.T) {
 			wantErr:     true,
 			expectedErr: "permissions are required",
 		},
-		{
-			name: "Failed to Generate Credentials",
-			config: &Config{
-				ProjectId:  "test-project-id",
-				PrivateKey: "test-private-key",
-			},
-			permissions: []string{"permission1", "permission2"},
-			wantErr:     true,
-			expectedErr: "failed to generate credentials",
-		},
 		{
 			name: "Failed to Test IAM Permissions",
 			config: &Config{