Merge pull request #14066 from thalesmg/20241023-r58-gprodu-nit-bad-service-account

fix(gcp pubsub): massage error reason when an invalid private key is in service account json

apps/emqx_bridge_gcp_pubsub/src/emqx_bridge_gcp_pubsub.app.src

@@ -1,6 +1,6 @@
 {application, emqx_bridge_gcp_pubsub, [
     {description, "EMQX Enterprise GCP Pub/Sub Bridge"},
-    {vsn, "0.3.3"},
+    {vsn, "0.3.4"},
     {registered, []},
     {applications, [
         kernel,

apps/emqx_bridge_gcp_pubsub/src/emqx_bridge_gcp_pubsub_client.erl

@@ -247,6 +247,13 @@ parse_jwt_config(ResourceId, #{
                 ?tp(error, gcp_pubsub_connector_startup_error, #{error => Error}),
                 throw("invalid private key in service account json")
         catch
+            error:function_clause ->
+                %% Function clause error inside `jose_jwk', nothing much to do...
+                %% Possibly `base64:mime_decode_binary/5' while trying to decode an
+                %% invalid private key that would probably not appear under normal
+                %% conditions...
+                ?tp(error, gcp_pubsub_connector_startup_error, #{error => invalid_private_key}),
+                throw("invalid private key in service account json");
             Kind:Reason ->
                 Error = {Kind, Reason},
                 ?tp(error, gcp_pubsub_connector_startup_error, #{error => Error}),

apps/emqx_bridge_gcp_pubsub/test/emqx_bridge_gcp_pubsub_producer_SUITE.erl

@@ -1080,7 +1080,7 @@ t_truncated_private_key(Config) ->
         fun(Res, Trace) ->
             ?assertMatch({ok, _}, Res),
             ?assertMatch(
-                [#{error := {error, function_clause}}],
+                [#{error := invalid_private_key}],
                 ?of_kind(gcp_pubsub_connector_startup_error, Trace)
             ),
             ok

apps/emqx_bridge_gcp_pubsub/test/emqx_bridge_v2_gcp_pubsub_producer_SUITE.erl

@@ -193,6 +193,16 @@ fixed_status_handler(StatusCode, FailureAttempts) ->
         end
     end.
 
+create_connector_api(Config) ->
+    emqx_bridge_v2_testlib:simplify_result(
+        emqx_bridge_v2_testlib:create_connector_api(Config)
+    ).
+
+create_action_api(Config) ->
+    emqx_bridge_v2_testlib:simplify_result(
+        emqx_bridge_v2_testlib:create_action_api(Config)
+    ).
+
 %%------------------------------------------------------------------------------
 %% Testcases
 %%------------------------------------------------------------------------------
@@ -327,3 +337,42 @@ t_backoff_retry(Config) ->
         []
     ),
     ok.
+
+%% Checks that we massage the error reason in case `jose_jwk:from_pem/1' raises a
+%% `function_clause' error.  Currently, this can be caused by deleting one line from the
+%% private key PEM in the service account JSON.  Instead of logging `{error,
+%% function_clause}', we transform it to something more soothing to the user's eyes.
+t_jose_jwk_function_clause(Config0) ->
+    ConnConfig0 = ?config(connector_config, Config0),
+    Config1 = proplists:delete(connector_config, Config0),
+    ConnConfig1 = maps:update_with(
+        <<"service_account_json">>,
+        fun(SABin) ->
+            #{<<"private_key">> := PKey0} =
+                SA0 =
+                emqx_utils_json:decode(SABin, [return_maps]),
+            Lines0 = binary:split(PKey0, <<"\n">>),
+            NumLines = length(Lines0),
+            {Lines1, [_ | Lines2]} = lists:split(NumLines div 2, Lines0),
+            Lines = iolist_to_binary(lists:join(<<"\n">>, Lines1 ++ Lines2)),
+            SA = SA0#{<<"private_key">> := Lines},
+            emqx_utils_json:encode(SA)
+        end,
+        ConnConfig0
+    ),
+    Config = [{connector_config, ConnConfig1} | Config1],
+    ?check_trace(
+        begin
+            {201, _} = create_connector_api(Config),
+            {201, _} = create_action_api(Config),
+            ok
+        end,
+        fun(Trace) ->
+            ?assertMatch(
+                [#{error := invalid_private_key} | _],
+                ?of_kind(gcp_pubsub_connector_startup_error, Trace)
+            ),
+            ok
+        end
+    ),
+    ok.