fix: add default filter when there are no filters

go.mod

@@ -34,7 +34,7 @@ require (
 	go.opentelemetry.io/otel v1.29.0 // indirect
 	go.opentelemetry.io/otel/metric v1.29.0 // indirect
 	go.opentelemetry.io/otel/trace v1.29.0 // indirect
-	golang.org/x/sync v0.10.0 // indirect
+	golang.org/x/sync v0.8.0 // indirect
 	golang.org/x/time v0.6.0 // indirect
 	google.golang.org/genproto v0.0.0-20240903143218-8af14fe29dc1 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20240903143218-8af14fe29dc1 // indirect
@@ -55,10 +55,10 @@ require (
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/stretchr/testify v1.9.0
-	golang.org/x/crypto v0.31.0 // indirect
-	golang.org/x/net v0.33.0 // indirect
-	golang.org/x/sys v0.28.0 // indirect
-	golang.org/x/text v0.21.0 // indirect
+	golang.org/x/crypto v0.26.0 // indirect
+	golang.org/x/net v0.28.0 // indirect
+	golang.org/x/sys v0.24.0 // indirect
+	golang.org/x/text v0.17.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1 // indirect
 	google.golang.org/grpc v1.66.0
 	google.golang.org/protobuf v1.34.2

go.sum

@@ -215,8 +215,8 @@ go.uber.org/goleak v1.1.12/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
-golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
+golang.org/x/crypto v0.26.0 h1:RrRspgV4mU+YwB4FYnuBoKsUapNIL5cohGAmSH3azsw=
+golang.org/x/crypto v0.26.0/go.mod h1:GY7jblb9wI+FOo5y8/S2oY4zWP07AkOJ4+jxCqdqn54=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
@@ -234,8 +234,8 @@ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I=
-golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
+golang.org/x/net v0.28.0 h1:a9JDOJc5GMUJ0+UDqmLT86WiEy7iWyIhz8gz8E4e5hE=
+golang.org/x/net v0.28.0/go.mod h1:yqtgsTWOOnlGLG9GFRrK3++bGOUEkNBoHZc8MEDWPNg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.22.0 h1:BzDx2FehcG7jJwgWLELCdmLuxk2i+x9UDpSiss2u0ZA=
 golang.org/x/oauth2 v0.22.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
@@ -243,18 +243,18 @@ golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
-golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
+golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
-golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.24.0 h1:Twjiwq9dn6R1fQcyiK+wQyHWfaz/BJB+YIpzU/Cv3Xg=
+golang.org/x/sys v0.24.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
-golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
+golang.org/x/text v0.17.0 h1:XtiM5bkSOt+ewxlOE/aE/AKEHibwj/6gvWMl9Rsh0Qc=
+golang.org/x/text v0.17.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
 golang.org/x/time v0.6.0 h1:eTDhh4ZXt5Qf0augr54TN6suAUudPcawVZeIAPU7D4U=
 golang.org/x/time v0.6.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

internal/credential/config.go

@@ -98,7 +98,6 @@ func (c *Config) toCredentials() *credentials {
 func (c *Config) clone() *Config {
 	return &Config{
 		ProjectId:              c.ProjectId,
-		Zone:                   c.Zone,
 		PrivateKey:             c.PrivateKey,
 		PrivateKeyId:           c.PrivateKeyId,
 		ClientEmail:            c.ClientEmail,

internal/credential/rotate.go

@@ -6,10 +6,8 @@ package credential
 import (
 	"context"
 	"encoding/json"
-	"errors"
 	"fmt"
 	"slices"
-	"time"
 
 	admin "cloud.google.com/go/iam/admin/apiv1"
 	"cloud.google.com/go/iam/admin/apiv1/adminpb"
@@ -21,20 +19,9 @@ import (
 )
 
 const (
-	// ComputeInstancesListPermission is the IAM permission required
-	// to list compute instances.
-	ComputeInstancesListPermission = "compute.instances.list"
-	// IAMServiceAccountKeysCreatePermission is the IAM permission
-	// required to create a service account key.
-	// This permission is required to rotate service account keys.
+	ComputeInstancesListPermission        = "compute.instances.list"
 	IAMServiceAccountKeysCreatePermission = "iam.serviceAccountKeys.create"
-	// IAMServiceAccountKeysDeletePermission is the IAM permission
-	// required to delete a service account key.
-	// This permission is required to rotate service account keys.
 	IAMServiceAccountKeysDeletePermission = "iam.serviceAccountKeys.delete"
-	// validateServiceAccountKeyTimeout is the timeout for validating
-	// a service account key.
-	validateServiceAccountKeyTimeout = 5 * time.Second
 )
 
 // ServiceAccountPrivateKey represents a decoded PrivateKeyData
@@ -53,10 +40,6 @@ type ServiceAccountPrivateKey struct {
 	ClientX509CertURL       string `json:"client_x509_cert_url"`
 }
 
-// ValidateCredsCallback is called to validate the credentials after rotating the service account key.
-// The callback should return an error if the credentials are invalid.
-type ValidateCredsCallback func(*Config, ...option.ClientOption) error
-
 // RotateServiceAccountKey takes the private key from this credentials config
 // and first creates a new private key and private key id, then deletes the
 // old private key.
@@ -64,12 +47,7 @@ type ValidateCredsCallback func(*Config, ...option.ClientOption) error
 // If deletion of the old private key is successful, the new private key and
 // private key id are written into the credentials config and nil is returned.
 // On any error, the old credentials are not overwritten.
-func (c *Config) RotateServiceAccountKey(
-	ctx context.Context,
-	permissions []string,
-	validateCredsCallback ValidateCredsCallback,
-	opts ...option.ClientOption,
-) error {
+func (c *Config) RotateServiceAccountKey(ctx context.Context, permissions []string, opts ...option.ClientOption) error {
 	if c.PrivateKey == "" {
 		return status.Error(codes.InvalidArgument, "cannot rotate credentials when private key is not set")
 	}
@@ -126,10 +104,10 @@ func (c *Config) RotateServiceAccountKey(
 	clientOptions = []option.ClientOption{option.WithTokenSource(newCreds.TokenSource)}
 	clientOptions = append(clientOptions, opts...)
 
-	// Validate the new service account key
-	err = newConfig.ValidateServiceAccountKey(ctx, permissions, validateCredsCallback, clientOptions...)
+	// Validate that the new credentials have the necessary permissions.
+	_, err = newConfig.ValidateIamPermissions(ctx, permissions, clientOptions...)
 	if err != nil {
-		return status.Errorf(codes.PermissionDenied, "error validating rotated service account key: %v", err)
+		return status.Errorf(codes.PermissionDenied, "error testing IAM permissions with rotated service account key: %v", err)
 	}
 
 	iamClient, err = admin.NewIamClient(ctx, clientOptions...)
@@ -150,32 +128,6 @@ func (c *Config) RotateServiceAccountKey(
 	return nil
 }
 
-// ValidateServiceAccountKey validates the service account key by checking the IAM permissions
-// and calling the validation callback.
-// The function will retry validation until the timeout is reached.
-func (c *Config) ValidateServiceAccountKey(
-	ctx context.Context,
-	permissions []string,
-	validateCredsCallback ValidateCredsCallback,
-	opts ...option.ClientOption) error {
-	var validatePermissionsErr error
-	var validationCallbackErr error
-
-	for start := time.Now(); time.Since(start) < validateServiceAccountKeyTimeout; time.Sleep(200 * time.Millisecond) {
-		_, validatePermissionsErr = c.ValidateIamPermissions(ctx, permissions, opts...)
-
-		if validateCredsCallback != nil {
-			validationCallbackErr = validateCredsCallback(c, opts...)
-		}
-
-		if validatePermissionsErr == nil && validationCallbackErr == nil {
-			return nil
-		}
-	}
-
-	return errors.Join(validatePermissionsErr, validationCallbackErr)
-}
-
 func (c *Config) DeletePrivateKey(ctx context.Context, opts ...option.ClientOption) error {
 	if c.PrivateKey == "" {
 		return status.Error(codes.InvalidArgument, "cannot delete credentials when private key is not set")
@@ -220,7 +172,18 @@ func (c *Config) ValidateIamPermissions(ctx context.Context, permissions []strin
 		return nil, status.Error(codes.InvalidArgument, "permissions are required")
 	}
 
-	rmClient, err := resourcemanager.NewProjectsClient(ctx, opts...)
+	creds, err := c.GenerateCredentials(ctx)
+	if err != nil {
+		return nil, status.Errorf(codes.Unauthenticated, "error generating credentials: %v", err)
+	}
+	if creds.TokenSource == nil {
+		return nil, status.Error(codes.Unauthenticated, "error generating credentials: token source is nil")
+	}
+
+	clientOptions := []option.ClientOption{option.WithTokenSource(creds.TokenSource)}
+	clientOptions = append(clientOptions, opts...)
+
+	rmClient, err := resourcemanager.NewProjectsClient(ctx, clientOptions...)
 	if err != nil {
 		return nil, status.Errorf(codes.Internal, "failed to create Resource Manager client: %v", err)
 	}

internal/credential/rotate_test.go

@@ -128,14 +128,8 @@ func TestRotateServiceAccountKey(t *testing.T) {
 				IAMServiceAccountKeysCreatePermission,
 				IAMServiceAccountKeysDeletePermission,
 			}
-			validateCredsCallbackCalled := false
 
-			validateCredsCallBack := func(c *Config, opts ...googleOption.ClientOption) error {
-				validateCredsCallbackCalled = true
-				return nil
-			}
-
-			err = tt.config.RotateServiceAccountKey(ctx, permissions, validateCredsCallBack, testOptions...)
+			err = tt.config.RotateServiceAccountKey(ctx, permissions, testOptions...)
 			if tt.expectedError != nil {
 				require.ErrorContains(t, err, tt.expectedError.Error())
 				require.Equal(t, initialClientEmail, tt.config.ClientEmail)
@@ -149,7 +143,6 @@ func TestRotateServiceAccountKey(t *testing.T) {
 			require.NotEmpty(t, tt.config.PrivateKeyId)
 			require.NotEqual(t, initialPrivateKey, tt.config.PrivateKey)
 			require.NotEqual(t, initialPrivateKeyId, tt.config.PrivateKeyId)
-			require.True(t, validateCredsCallbackCalled)
 		})
 	}
 }
@@ -190,6 +183,16 @@ func TestValidateIamPermissions(t *testing.T) {
 			wantErr:     true,
 			expectedErr: "permissions are required",
 		},
+		{
+			name: "Failed to Generate Credentials",
+			config: &Config{
+				ProjectId:  "test-project-id",
+				PrivateKey: "test-private-key",
+			},
+			permissions: []string{"permission1", "permission2"},
+			wantErr:     true,
+			expectedErr: "failed to generate credentials",
+		},
 		{
 			name: "Failed to Test IAM Permissions",
 			config: &Config{

internal/credential/state.go

@@ -38,11 +38,7 @@ func NewPersistedState(opt ...Option) (*PersistedState, error) {
 }
 
 // RotateCreds rotates the credentials for the GCP catalog and updates the last rotated time.
-func (s *PersistedState) RotateCreds(
-	ctx context.Context,
-	permissions []string,
-	validateCredsCallback ValidateCredsCallback,
-	opts ...option.ClientOption) error {
+func (s *PersistedState) RotateCreds(ctx context.Context, permissions []string, opts ...option.ClientOption) error {
 	if s.CredentialsConfig == nil {
 		return status.Error(codes.InvalidArgument, "missing credentials config")
 	}
@@ -50,7 +46,7 @@ func (s *PersistedState) RotateCreds(
 		return status.Error(codes.InvalidArgument, "cannot rotate non-rotatable credentials")
 	}
 
-	err := s.CredentialsConfig.RotateServiceAccountKey(ctx, permissions, validateCredsCallback, opts...)
+	err := s.CredentialsConfig.RotateServiceAccountKey(ctx, permissions, opts...)
 	if err != nil {
 		return status.Errorf(codes.Internal, "failed to rotate credentials: %v", err)
 	}

plugin/service/host/plugin.go

@@ -87,22 +87,8 @@ func (p *HostPlugin) OnCreateCatalog(ctx context.Context, req *pb.OnCreateCatalo
 		credential.IAMServiceAccountKeysDeletePermission,
 	}
 
-	if !credState.CredentialsConfig.IsRotatable() && !catalogAttributes.DisableCredentialRotation {
-		return nil, status.Error(codes.InvalidArgument, "cannot rotate credentials for non-rotatable credentials")
-	}
-
 	if credState.CredentialsConfig.IsRotatable() && !catalogAttributes.DisableCredentialRotation {
-		state, err := newGCPCatalogPersistedState(
-			append([]gcpCatalogPersistedStateOption{
-				withCredentials(credState),
-			}, p.testCatalogStateOpts...)...,
-		)
-		if err != nil {
-			return nil, status.Errorf(codes.Internal, "error setting up persisted state: %s", err)
-		}
-		validateCredsCallback := state.ValidateCredsCallbackFn(ctx, p.testGCPClientOpts...)
-
-		if err := credState.RotateCreds(ctx, permissions, validateCredsCallback, p.testGCPClientOpts...); err != nil {
+		if err := credState.RotateCreds(ctx, permissions, p.testGCPClientOpts...); err != nil {
 			return nil, err
 		}
 	}
@@ -229,17 +215,7 @@ func (p *HostPlugin) OnUpdateCatalog(ctx context.Context, req *pb.OnUpdateCatalo
 		// If we're enabling rotation now but didn't before, or have
 		// freshly replaced credentials, we can rotate here.
 		if !newCatalogAttributes.DisableCredentialRotation && credState.CredsLastRotatedTime.IsZero() {
-			state, err := newGCPCatalogPersistedState(
-				append([]gcpCatalogPersistedStateOption{
-					withCredentials(credState),
-				}, p.testCatalogStateOpts...)...,
-			)
-			if err != nil {
-				return nil, status.Errorf(codes.Internal, "error setting up persisted state: %s", err)
-			}
-			validateCredsCallback := state.ValidateCredsCallbackFn(ctx, p.testGCPClientOpts...)
-
-			if err := credState.RotateCreds(ctx, permissions, validateCredsCallback, p.testGCPClientOpts...); err != nil {
+			if err := credState.RotateCreds(ctx, permissions, p.testGCPClientOpts...); err != nil {
 				return nil, err
 			}
 		}

plugin/service/host/plugin_test.go

@@ -878,53 +878,6 @@ func TestCreateCatalog(t *testing.T) {
 				},
 			},
 		},
-		{
-			name: "create with application default credentials and credential rotation disabled",
-			req: &pb.OnCreateCatalogRequest{
-				Catalog: &hostcatalogs.HostCatalog{
-					Attrs: &hostcatalogs.HostCatalog_Attributes{
-						Attributes: &structpb.Struct{
-							Fields: map[string]*structpb.Value{
-								cred.ConstProjectId:                 structpb.NewStringValue("test-project"),
-								cred.ConstZone:                      structpb.NewStringValue("us-central1-a"),
-								cred.ConstDisableCredentialRotation: structpb.NewBoolValue(true),
-							},
-						},
-					},
-				},
-			},
-			catalogOpts: []gcpCatalogPersistedStateOption{
-				withTestInstancesAPIFunc(newTestMockInstances(ctx,
-					nil,
-					testMockInstancesWithListInstancesOutput(&computepb.InstanceList{}),
-					testMockInstancesWithListInstancesError(nil),
-				)),
-			},
-			expectedRsp: &pb.OnCreateCatalogResponse{
-				Persisted: &pb.HostCatalogPersisted{
-					Secrets: &structpb.Struct{
-						Fields: map[string]*structpb.Value{},
-					},
-				},
-			},
-		},
-		{
-			name: "create with application default credentials and credential rotation enabled",
-			req: &pb.OnCreateCatalogRequest{
-				Catalog: &hostcatalogs.HostCatalog{
-					Attrs: &hostcatalogs.HostCatalog_Attributes{
-						Attributes: &structpb.Struct{
-							Fields: map[string]*structpb.Value{
-								cred.ConstProjectId:                 structpb.NewStringValue("test-project"),
-								cred.ConstZone:                      structpb.NewStringValue("us-central1-a"),
-								cred.ConstDisableCredentialRotation: structpb.NewBoolValue(false),
-							},
-						},
-					},
-				},
-			},
-			expectedErr: "cannot rotate credentials for non-rotatable credentials",
-		},
 	}
 
 	for _, tc := range cases {

plugin/service/host/state.go

@@ -13,7 +13,6 @@ import (
 	"github.com/googleapis/gax-go/v2"
 	"github.com/hashicorp/boundary-plugin-gcp/internal/credential"
 	pb "github.com/hashicorp/boundary/sdk/pbs/plugin"
-	"google.golang.org/api/iterator"
 	"google.golang.org/api/option"
 	"google.golang.org/protobuf/types/known/structpb"
 )
@@ -100,30 +99,3 @@ func (s *gcpCatalogPersistedState) InstancesClient(
 
 	return client, nil
 }
-
-// validateCredsCallbackFn returns a ValidateCredsCallback function that
-// validates the credentials by listing instances in the project and zone.
-func (s *gcpCatalogPersistedState) ValidateCredsCallbackFn(
-	ctx context.Context,
-	opts ...option.ClientOption,
-) credential.ValidateCredsCallback {
-	return func(config *credential.Config, opts ...option.ClientOption) error {
-		s.CredentialsConfig = config
-		instancesClient, err := s.InstancesClient(ctx, opts...)
-		if err != nil {
-			return fmt.Errorf("error creating instances client: %w", err)
-		}
-
-		it := instancesClient.List(ctx, &computepb.ListInstancesRequest{
-			Project: s.CredentialsConfig.ProjectId,
-			Zone:    s.CredentialsConfig.Zone,
-		})
-
-		_, err = it.Next()
-		if err != nil && err != iterator.Done {
-			return fmt.Errorf("error listing instances: %w", err)
-		}
-
-		return nil
-	}
-}

plugin/service/host/state_test.go

@@ -5,11 +5,9 @@ package host
 
 import (
 	"context"
-	"errors"
 	"testing"
 	"time"
 
-	computepb "cloud.google.com/go/compute/apiv1/computepb"
 	"github.com/hashicorp/boundary-plugin-gcp/internal/credential"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -89,44 +87,3 @@ func TestInstancesClient(t *testing.T) {
 		assert.Contains(t, err.Error(), "error creating instances client")
 	})
 }
-func TestValidateCredsCallbackFn(t *testing.T) {
-	ctx := context.Background()
-	cred := &credential.PersistedState{
-		CredentialsConfig: &credential.Config{
-			ProjectId: "test-project-id",
-			Zone:      "test-zone",
-		},
-	}
-	state := &gcpCatalogPersistedState{PersistedState: cred}
-
-	t.Run("List instances error", func(t *testing.T) {
-		state.testInstancesAPIFunc = newTestMockInstances(ctx,
-			nil,
-			testMockInstancesWithListInstancesOutput(nil),
-			testMockInstancesWithListInstancesError(errors.New("error listing instances")),
-		)
-
-		callback := state.ValidateCredsCallbackFn(ctx)
-		err := callback(&credential.Config{
-			ProjectId: "test-project-id",
-			Zone:      "test-zone",
-		})
-		assert.Error(t, err)
-		assert.Contains(t, err.Error(), "error listing instances")
-	})
-
-	t.Run("Success", func(t *testing.T) {
-		state.testInstancesAPIFunc = newTestMockInstances(ctx,
-			nil,
-			testMockInstancesWithListInstancesOutput(&computepb.InstanceList{}),
-			testMockInstancesWithListInstancesError(nil),
-		)
-
-		callback := state.ValidateCredsCallbackFn(ctx)
-		err := callback(&credential.Config{
-			ProjectId: "test-project-id",
-			Zone:      "test-zone",
-		})
-		assert.NoError(t, err)
-	})
-}