fix: extra credential generation

When rotating credentials, `ValidatePermission` function generates a credentials but credentials are already passed to it with client.Options. This is currently causing a bug where GCP sometimes does not accept the second generated token

internal/credential/rotate.go

@@ -167,23 +167,16 @@ func (c *Config) DeletePrivateKey(ctx context.Context, opts ...option.ClientOpti
 
 // ValidateIamPermissions tests the IAM permissions for the credentials.
 // It returns the granted permissions if successful.
+//
+// The caller needs to ensure either a token source is passed in for
+// authentication or authentication is provided by Application Default
+// Credentials
 func (c *Config) ValidateIamPermissions(ctx context.Context, permissions []string, opts ...option.ClientOption) ([]string, error) {
 	if len(permissions) == 0 {
 		return nil, status.Error(codes.InvalidArgument, "permissions are required")
 	}
 
-	creds, err := c.GenerateCredentials(ctx)
-	if err != nil {
-		return nil, status.Errorf(codes.Unauthenticated, "error generating credentials: %v", err)
-	}
-	if creds.TokenSource == nil {
-		return nil, status.Error(codes.Unauthenticated, "error generating credentials: token source is nil")
-	}
-
-	clientOptions := []option.ClientOption{option.WithTokenSource(creds.TokenSource)}
-	clientOptions = append(clientOptions, opts...)
-
-	rmClient, err := resourcemanager.NewProjectsClient(ctx, clientOptions...)
+	rmClient, err := resourcemanager.NewProjectsClient(ctx, opts...)
 	if err != nil {
 		return nil, status.Errorf(codes.Internal, "failed to create Resource Manager client: %v", err)
 	}

internal/credential/rotate_test.go

@@ -183,16 +183,6 @@ func TestValidateIamPermissions(t *testing.T) {
 			wantErr:     true,
 			expectedErr: "permissions are required",
 		},
-		{
-			name: "Failed to Generate Credentials",
-			config: &Config{
-				ProjectId:  "test-project-id",
-				PrivateKey: "test-private-key",
-			},
-			permissions: []string{"permission1", "permission2"},
-			wantErr:     true,
-			expectedErr: "failed to generate credentials",
-		},
 		{
 			name: "Failed to Test IAM Permissions",
 			config: &Config{

plugin/service/host/attributes.go

@@ -108,7 +108,7 @@ func buildListInstancesRequest(attributes *SetAttributes, catalog *CatalogAttrib
 		return nil, fmt.Errorf("error building filters: %w", err)
 	}
 
-	if len(filters) > 0 {
+	if len(filters) > 1 {
 		filters := strings.Join(filters, " AND ")
 		request.Filter = &filters
 	}

plugin/service/host/attributes_test.go

@@ -183,23 +183,6 @@ func TestBuildListInstancesRequest(t *testing.T) {
 			},
 			expectedErrContains: "error building filters",
 		},
-		{
-			name: "valid request with no filters",
-			attributes: &SetAttributes{
-				Filters: []string{},
-			},
-			catalog: &CatalogAttributes{
-				CredentialAttributes: &cred.CredentialAttributes{
-					ProjectId: "test-12345",
-					Zone:      "us-central-1a",
-				},
-			},
-			expected: &computepb.ListInstancesRequest{
-				Project: "test-12345",
-				Zone:    "us-central-1a",
-				Filter:  stringPtr("status = running"),
-			},
-		},
 	}
 
 	for _, tc := range cases {