Replace the Auth and Auth::TLS singletons

Use a builder pattern for creation and validation, in a manner that
allows also other authentication methods to be added in the future
besides the current TLS/SSL.

The main Auth instances are built early and then passed by not_null
const pointers, to avoid passing temporaries, replacing the previous
Auth::TLS instances passed by simple nullable const pointers. Where
needed, these passed Auth instances are also stored, by const ref.

Tests also build Auth instances as needed, either with the default
'no certification' or from the test environment arguments.

6 files changed, 37 insertions, 61 deletions

diff --git a/test/buildtool/execution_api/bazel/TARGETS b/test/buildtool/execution_api/bazel/TARGETS
index 17f02068..d3e42c6d 100644
--- a/test/buildtool/execution_api/bazel/TARGETS
+++ b/test/buildtool/execution_api/bazel/TARGETS
@@ -6,7 +6,7 @@
     [ ["@", "catch2", "", "catch2"]
     , ["@", "gsl", "", "gsl"]
     , ["utils", "catch-main-remote-execution"]
-    , ["@", "src", "src/buildtool/auth", "auth"]
+    , ["utils", "test_auth_config"]
     , ["@", "src", "src/buildtool/common", "common"]
     , ["@", "src", "src/buildtool/execution_api/bazel_msg", "bazel_msg"]
     , ["@", "src", "src/buildtool/execution_api/remote", "bazel_network"]
@@ -23,7 +23,7 @@
     [ ["@", "catch2", "", "catch2"]
     , ["utils", "catch-main-remote-execution"]
     , ["utils", "execution_bazel"]
-    , ["@", "src", "src/buildtool/auth", "auth"]
+    , ["utils", "test_auth_config"]
     , ["@", "src", "src/buildtool/common", "common"]
     , ["@", "src", "src/buildtool/execution_api/remote", "bazel_network"]
     , ["@", "src", "src/buildtool/execution_api/remote", "config"]
@@ -39,7 +39,7 @@
     [ ["@", "catch2", "", "catch2"]
     , ["utils", "catch-main-remote-execution"]
     , ["utils", "execution_bazel"]
-    , ["@", "src", "src/buildtool/auth", "auth"]
+    , ["utils", "test_auth_config"]
     , ["@", "src", "src/buildtool/common", "common"]
     , ["@", "src", "src/buildtool/execution_api/bazel_msg", "bazel_msg"]
     , ["@", "src", "src/buildtool/execution_api/remote", "bazel_network"]
@@ -56,7 +56,7 @@
     [ ["@", "catch2", "", "catch2"]
     , ["utils", "catch-main-remote-execution"]
     , ["utils", "execution_bazel"]
-    , ["@", "src", "src/buildtool/auth", "auth"]
+    , ["utils", "test_auth_config"]
     , ["@", "src", "src/buildtool/common", "common"]
     , ["@", "src", "src/buildtool/compatibility", "compatibility"]
     , ["@", "src", "src/buildtool/execution_api/bazel_msg", "bazel_msg"]
@@ -92,7 +92,7 @@
   , "private-deps":
     [ ["@", "catch2", "", "catch2"]
     , ["utils", "catch-main-remote-execution"]
-    , ["@", "src", "src/buildtool/auth", "auth"]
+    , ["utils", "test_auth_config"]
     , ["@", "src", "src/buildtool/execution_api/remote", "bazel"]
     , ["buildtool/execution_api/common", "api_test"]
     ]
diff --git a/test/buildtool/execution_api/bazel/bazel_api.test.cpp b/test/buildtool/execution_api/bazel/bazel_api.test.cpp
index af457066..073bf08d 100644
--- a/test/buildtool/execution_api/bazel/bazel_api.test.cpp
+++ b/test/buildtool/execution_api/bazel/bazel_api.test.cpp
@@ -13,29 +13,22 @@
 // limitations under the License.
 
 #include <cstdlib>
-#include <optional>
 #include <string>
 
 #include "catch2/catch_test_macros.hpp"
-#include "src/buildtool/auth/authentication.hpp"
 #include "src/buildtool/execution_api/remote/bazel/bazel_api.hpp"
 #include "src/buildtool/execution_api/remote/config.hpp"
 #include "test/buildtool/execution_api/common/api_test.hpp"
-#include "test/utils/test_env.hpp"
+#include "test/utils/remote_execution/test_auth_config.hpp"
 
 namespace {
 
 auto const kApiFactory = []() {
     static auto const& server = RemoteExecutionConfig::RemoteAddress();
-    std::optional<Auth::TLS> auth = {};
-    if (Auth::Instance().GetAuthMethod() == AuthMethod::kTLS) {
-        auth = Auth::TLS::Instance();
-    }
-    return IExecutionApi::Ptr{new BazelApi{"remote-execution",
-                                           server->host,
-                                           server->port,
-                                           auth ? &*auth : nullptr,
-                                           {}}};
+    auto auth_config = TestAuthConfig::ReadAuthConfigFromEnvironment();
+    REQUIRE(auth_config);
+    return IExecutionApi::Ptr{new BazelApi{
+        "remote-execution", server->host, server->port, &*auth_config, {}}};
 };
 
 }  // namespace
diff --git a/test/buildtool/execution_api/bazel/bazel_cas_client.test.cpp b/test/buildtool/execution_api/bazel/bazel_cas_client.test.cpp
index 069421c9..85a23590 100644
--- a/test/buildtool/execution_api/bazel/bazel_cas_client.test.cpp
+++ b/test/buildtool/execution_api/bazel/bazel_cas_client.test.cpp
@@ -13,19 +13,18 @@
 // limitations under the License.
 
 #include <functional>  // std::equal_to
-#include <optional>
 #include <string>
 #include <vector>
 
 #include "catch2/catch_test_macros.hpp"
 #include "gsl/gsl"
-#include "src/buildtool/auth/authentication.hpp"
 #include "src/buildtool/common/artifact_digest.hpp"
 #include "src/buildtool/execution_api/bazel_msg/bazel_blob_container.hpp"
 #include "src/buildtool/execution_api/remote/bazel/bazel_cas_client.hpp"
 #include "src/buildtool/execution_api/remote/bazel/bazel_execution_client.hpp"
 #include "src/buildtool/execution_api/remote/config.hpp"
 #include "src/buildtool/file_system/object_type.hpp"
+#include "test/utils/remote_execution/test_auth_config.hpp"
 
 TEST_CASE("Bazel internals: CAS Client", "[execution_api]") {
     auto const& info = RemoteExecutionConfig::RemoteAddress();
@@ -33,13 +32,11 @@ TEST_CASE("Bazel internals: CAS Client", "[execution_api]") {
     std::string instance_name{"remote-execution"};
     std::string content("test");
 
-    std::optional<Auth::TLS> auth = {};
-    if (Auth::Instance().GetAuthMethod() == AuthMethod::kTLS) {
-        auth = Auth::TLS::Instance();
-    }
+    auto auth_config = TestAuthConfig::ReadAuthConfigFromEnvironment();
+    REQUIRE(auth_config);
 
     // Create CAS client
-    BazelCasClient cas_client(info->host, info->port, auth ? &*auth : nullptr);
+    BazelCasClient cas_client(info->host, info->port, &*auth_config);
 
     SECTION("Valid digest and blob") {
         // digest of "test"
diff --git a/test/buildtool/execution_api/bazel/bazel_execution_client.test.cpp b/test/buildtool/execution_api/bazel/bazel_execution_client.test.cpp
index 50869542..fe9da14f 100755
--- a/test/buildtool/execution_api/bazel/bazel_execution_client.test.cpp
+++ b/test/buildtool/execution_api/bazel/bazel_execution_client.test.cpp
@@ -12,17 +12,15 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#include <optional>
 #include <string>
 
 #include "catch2/catch_test_macros.hpp"
-#include "src/buildtool/auth/authentication.hpp"
 #include "src/buildtool/common/artifact_digest.hpp"
 #include "src/buildtool/execution_api/remote/bazel/bazel_execution_client.hpp"
 #include "src/buildtool/execution_api/remote/config.hpp"
 #include "src/buildtool/file_system/object_type.hpp"
 #include "test/utils/remote_execution/bazel_action_creator.hpp"
-#include "test/utils/test_env.hpp"
+#include "test/utils/remote_execution/test_auth_config.hpp"
 
 TEST_CASE("Bazel internals: Execution Client", "[execution_api]") {
     auto const& info = RemoteExecutionConfig::RemoteAddress();
@@ -32,13 +30,11 @@ TEST_CASE("Bazel internals: Execution Client", "[execution_api]") {
     auto test_digest = static_cast<bazel_re::Digest>(
         ArtifactDigest::Create<ObjectType::File>(content));
 
-    std::optional<Auth::TLS> auth = {};
-    if (Auth::Instance().GetAuthMethod() == AuthMethod::kTLS) {
-        auth = Auth::TLS::Instance();
-    }
+    auto auth_config = TestAuthConfig::ReadAuthConfigFromEnvironment();
+    REQUIRE(auth_config);
 
     BazelExecutionClient execution_client(
-        info->host, info->port, auth ? &*auth : nullptr);
+        info->host, info->port, &*auth_config);
 
     ExecutionConfiguration config;
     config.skip_cache_lookup = false;
@@ -106,13 +102,11 @@ TEST_CASE("Bazel internals: Execution Client using env variables",
     auto test_digest = static_cast<bazel_re::Digest>(
         ArtifactDigest::Create<ObjectType::File>(content));
 
-    std::optional<Auth::TLS> auth = {};
-    if (Auth::Instance().GetAuthMethod() == AuthMethod::kTLS) {
-        auth = Auth::TLS::Instance();
-    }
+    auto auth_config = TestAuthConfig::ReadAuthConfigFromEnvironment();
+    REQUIRE(auth_config);
 
     BazelExecutionClient execution_client(
-        info->host, info->port, auth ? &*auth : nullptr);
+        info->host, info->port, &*auth_config);
 
     ExecutionConfiguration config;
     config.skip_cache_lookup = false;
diff --git a/test/buildtool/execution_api/bazel/bazel_network.test.cpp b/test/buildtool/execution_api/bazel/bazel_network.test.cpp
index 75821454..54d99305 100644
--- a/test/buildtool/execution_api/bazel/bazel_network.test.cpp
+++ b/test/buildtool/execution_api/bazel/bazel_network.test.cpp
@@ -26,18 +26,17 @@
 #include "src/buildtool/execution_api/remote/bazel/bazel_network.hpp"
 #include "src/buildtool/execution_api/remote/config.hpp"
 #include "src/buildtool/file_system/object_type.hpp"
+#include "test/utils/remote_execution/test_auth_config.hpp"
 
 constexpr std::size_t kLargeSize = GRPC_DEFAULT_MAX_RECV_MESSAGE_LENGTH + 1;
 
 TEST_CASE("Bazel network: write/read blobs", "[execution_api]") {
     auto const& info = RemoteExecutionConfig::RemoteAddress();
     std::string instance_name{"remote-execution"};
-    std::optional<Auth::TLS> auth = {};
-    if (Auth::Instance().GetAuthMethod() == AuthMethod::kTLS) {
-        auth = Auth::TLS::Instance();
-    }
-    auto network = BazelNetwork{
-        instance_name, info->host, info->port, auth ? &*auth : nullptr, {}};
+    auto auth_config = TestAuthConfig::ReadAuthConfigFromEnvironment();
+    REQUIRE(auth_config);
+    auto network =
+        BazelNetwork{instance_name, info->host, info->port, &*auth_config, {}};
 
     std::string content_foo("foo");
     std::string content_bar("bar");
@@ -82,12 +81,10 @@ TEST_CASE("Bazel network: read blobs with unknown size", "[execution_api]") {
 
     auto const& info = RemoteExecutionConfig::RemoteAddress();
     std::string instance_name{"remote-execution"};
-    std::optional<Auth::TLS> auth = {};
-    if (Auth::Instance().GetAuthMethod() == AuthMethod::kTLS) {
-        auth = Auth::TLS::Instance();
-    }
-    auto network = BazelNetwork{
-        instance_name, info->host, info->port, auth ? &*auth : nullptr, {}};
+    auto auth_config = TestAuthConfig::ReadAuthConfigFromEnvironment();
+    REQUIRE(auth_config);
+    auto network =
+        BazelNetwork{instance_name, info->host, info->port, &*auth_config, {}};
 
     std::string content_foo("foo");
     std::string content_bar(kLargeSize, 'x');  // single larger blob
diff --git a/test/buildtool/execution_api/bazel/bytestream_client.test.cpp b/test/buildtool/execution_api/bazel/bytestream_client.test.cpp
index b1c49947..9903039b 100644
--- a/test/buildtool/execution_api/bazel/bytestream_client.test.cpp
+++ b/test/buildtool/execution_api/bazel/bytestream_client.test.cpp
@@ -24,17 +24,15 @@
 #include "src/buildtool/execution_api/remote/bazel/bytestream_client.hpp"
 #include "src/buildtool/execution_api/remote/config.hpp"
 #include "src/buildtool/file_system/object_type.hpp"
+#include "test/utils/remote_execution/test_auth_config.hpp"
 
 constexpr std::size_t kLargeSize = GRPC_DEFAULT_MAX_RECV_MESSAGE_LENGTH + 1;
 
 TEST_CASE("ByteStream Client: Transfer single blob", "[execution_api]") {
     auto const& info = RemoteExecutionConfig::RemoteAddress();
-    std::optional<Auth::TLS> auth = {};
-    if (Auth::Instance().GetAuthMethod() == AuthMethod::kTLS) {
-        auth = Auth::TLS::Instance();
-    }
-    auto stream =
-        ByteStreamClient{info->host, info->port, auth ? &*auth : nullptr};
+    auto auth_config = TestAuthConfig::ReadAuthConfigFromEnvironment();
+    REQUIRE(auth_config);
+    auto stream = ByteStreamClient{info->host, info->port, &*auth_config};
     auto uuid = CreateUUIDVersion4(*CreateProcessUniqueId());
 
     SECTION("Upload small blob") {
@@ -112,12 +110,9 @@ TEST_CASE("ByteStream Client: Transfer single blob", "[execution_api]") {
 
 TEST_CASE("ByteStream Client: Transfer multiple blobs", "[execution_api]") {
     auto const& info = RemoteExecutionConfig::RemoteAddress();
-    std::optional<Auth::TLS> auth = {};
-    if (Auth::Instance().GetAuthMethod() == AuthMethod::kTLS) {
-        auth = Auth::TLS::Instance();
-    }
-    auto stream =
-        ByteStreamClient{info->host, info->port, auth ? &*auth : nullptr};
+    auto auth_config = TestAuthConfig::ReadAuthConfigFromEnvironment();
+    REQUIRE(auth_config);
+    auto stream = ByteStreamClient{info->host, info->port, &*auth_config};
     auto uuid = CreateUUIDVersion4(*CreateProcessUniqueId());
 
     SECTION("Upload small blobs") {