fix(compute): correctly specify scopes when fetching token (#735)

stephenplusplus · web-flow · commit 4803e3cb4b46 · 2019-06-18T16:19:36.000-04:00
diff --git a/src/auth/computeclient.ts b/src/auth/computeclient.ts
@@ -80,13 +80,15 @@ export class Compute extends OAuth2Client {
     const tokenPath = `service-accounts/${this.serviceAccountEmail}/token`;
     let data: CredentialRequest;
     try {
-      data = await gcpMetadata.instance({
+      const instanceOptions: gcpMetadata.Options = {
         property: tokenPath,
-        params: {
-          scopes: this.scopes,
-          // TODO: clean up before submit, fix upstream type bug
-        } as {},
-      });
+      };
+      if (this.scopes.length > 0) {
+        instanceOptions.params = {
+          scopes: this.scopes.join(','),
+        };
+      }
+      data = await gcpMetadata.instance(instanceOptions);
     } catch (e) {
       e.message = `Could not refresh access token: ${e.message}`;
       this.wrapError(e);
diff --git a/test/test.compute.ts b/test/test.compute.ts
@@ -29,7 +29,7 @@ const tokenPath = `${BASE_PATH}/instance/service-accounts/default/token`;
 function mockToken(statusCode = 200, scopes?: string[]) {
   let path = tokenPath;
   if (scopes && scopes.length > 0) {
-    path += '?' + qs.stringify({scopes});
+    path += `?scopes=${encodeURIComponent(scopes.join(','))}`;
   }
   return nock(HOST_ADDRESS)
     .get(path, undefined, {reqheaders: HEADERS})
@@ -68,15 +68,25 @@ it('should get an access token for the first request', async () => {
   assert.strictEqual(compute.credentials.access_token, 'abc123');
 });
 
-it('should include scopes when asking for the token', async () => {
+it('should URI-encode and comma-separate scopes when fetching the token', async () => {
   const scopes = [
     'https://www.googleapis.com/reader',
     'https://www.googleapis.com/auth/plus',
   ];
-  const nockScopes = [mockToken(200, scopes), mockExample()];
+
+  const path = `${tokenPath}?scopes=${encodeURIComponent(scopes.join(','))}`;
+
+  const tokenFetchNock = nock(HOST_ADDRESS)
+    .get(path, undefined, {reqheaders: HEADERS})
+    .reply(200, {access_token: 'abc123', expires_in: 10000}, HEADERS);
+  const apiRequestNock = mockExample();
+
   const compute = new Compute({scopes});
   await compute.request({url});
-  nockScopes.forEach(s => s.done());
+
+  tokenFetchNock.done();
+  apiRequestNock.done();
+
   assert.strictEqual(compute.credentials.access_token, 'abc123');
 });
 
