feat: support HTTP path for unix scheme in token-url using fragments (#4950)

* Supporting path for UDS endpoint in token-url

* PR comments

Author: vadlakondaswetha

internal/auth/token_source.go

@@ -47,7 +47,27 @@ func newProxyTokenSource(
 				return dialer.DialContext(ctx, u.Scheme, u.Path)
 			},
 		}
-		endpoint = "http://unix?" + u.RawQuery
+		if escapedFragment := u.EscapedFragment(); escapedFragment != "" {
+			relURL, err := url.Parse(escapedFragment)
+			if err != nil {
+				return nil, fmt.Errorf("parsing fragment %q: %w", escapedFragment, err)
+			}
+			targetURL := url.URL{
+				Scheme:   "http",
+				Host:     "unix",
+				Path:     relURL.Path,
+				RawPath:  relURL.RawPath,
+				RawQuery: relURL.RawQuery,
+			}
+			endpoint = targetURL.String()
+		} else {
+			targetURL := url.URL{
+				Scheme:   "http",
+				Host:     "unix",
+				RawQuery: u.RawQuery,
+			}
+			endpoint = targetURL.String()
+		}
 	}
 
 	ts = proxyTokenSource{

internal/auth/token_source_test.go

@@ -17,24 +17,35 @@ package auth
 import (
 	"context"
 	"encoding/json"
+	"fmt"
+	"net"
 	"net/http"
 	"net/http/httptest"
+	"os"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/oauth2"
 )
 
-func Test_NewTokenSourceFromURL_Success(t *testing.T) {
-	// Create fake token server.
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+func tokenHandler(accessToken string) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
 		token := oauth2.Token{
-			AccessToken: "test-access-token",
+			AccessToken: accessToken,
 			TokenType:   "Bearer",
 		}
-		require.NoError(t, json.NewEncoder(w).Encode(token))
-	}))
+		_ = json.NewEncoder(w).Encode(token)
+	}
+}
+
+func startFakeTCPTokenServer(accessToken string) *httptest.Server {
+	return httptest.NewServer(tokenHandler(accessToken))
+}
+
+func Test_NewTokenSourceFromURL_Success(t *testing.T) {
+	accessToken := "test-access-token"
+	server := startFakeTCPTokenServer(accessToken)
 	defer server.Close()
 
 	ts, err := NewTokenSourceFromURL(context.Background(), server.URL, false)
@@ -44,7 +55,7 @@ func Test_NewTokenSourceFromURL_Success(t *testing.T) {
 	// Fetch token
 	token, err := ts.Token()
 	assert.NoError(t, err)
-	assert.Equal(t, "test-access-token", token.AccessToken)
+	assert.Equal(t, accessToken, token.AccessToken)
 }
 
 func Test_NewTokenSourceFromURL_InvalidURL(t *testing.T) {
@@ -86,3 +97,109 @@ func TestProxyTokenSource_TokenFetch_InvalidJSON(t *testing.T) {
 	assert.Contains(t, err.Error(), "decode body")
 	assert.Nil(t, token)
 }
+
+func startFakeUDSTokenServer(t *testing.T, listener net.Listener, expectedEscapedPath, expectedQuery, accessToken string) *http.Server {
+	server := &http.Server{
+		Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			assert.Equal(t, expectedEscapedPath, r.URL.EscapedPath())
+			assert.Equal(t, expectedQuery, r.URL.RawQuery)
+			assert.Equal(t, "unix", r.Host)
+			tokenHandler(accessToken)(w, r)
+		}),
+	}
+	go func() {
+		_ = server.Serve(listener)
+	}()
+	return server
+}
+
+func Test_NewTokenSourceFromURL_UnixSocket_WithFragment_Success(t *testing.T) {
+	// Create a temp file for the socket.
+	tmpFile, err := os.CreateTemp("", "gcsfuse-uds-test-*.sock")
+	require.NoError(t, err)
+	socketPath := tmpFile.Name()
+	require.NoError(t, tmpFile.Close())
+	require.NoError(t, os.Remove(socketPath)) // remove it so net.Listen can create it
+	defer func() { _ = os.Remove(socketPath) }()
+
+	listener, err := net.Listen("unix", socketPath)
+	require.NoError(t, err)
+	defer func() { _ = listener.Close() }()
+
+	expectedEscapedPath := "/computeMetadata/v1/instance/service-accounts/default/token"
+	expectedQuery := "foo=bar&baz=qux"
+	accessToken := "uds-access-token"
+
+	server := startFakeUDSTokenServer(t, listener, expectedEscapedPath, expectedQuery, accessToken)
+	defer func() { _ = server.Close() }()
+
+	// unix:///path/to/socket#/http_path?query
+	tokenURL := fmt.Sprintf("unix://%s#%s?%s", socketPath, expectedEscapedPath, expectedQuery)
+	ts, err := NewTokenSourceFromURL(context.Background(), tokenURL, false)
+	require.NoError(t, err)
+	require.NotNil(t, ts)
+
+	token, err := ts.Token()
+	assert.NoError(t, err)
+	assert.Equal(t, accessToken, token.AccessToken)
+}
+
+func Test_NewTokenSourceFromURL_UnixSocket_WithFragment_EscapedChars_Success(t *testing.T) {
+	tmpFile, err := os.CreateTemp("", "gcsfuse-uds-test-*.sock")
+	require.NoError(t, err)
+	socketPath := tmpFile.Name()
+	require.NoError(t, tmpFile.Close())
+	require.NoError(t, os.Remove(socketPath))
+	defer func() { _ = os.Remove(socketPath) }()
+
+	listener, err := net.Listen("unix", socketPath)
+	require.NoError(t, err)
+	defer func() { _ = listener.Close() }()
+
+	// Path contains escaped slash (%2F) and query contains escaped space (%20)
+	expectedEscapedPath := "/computeMetadata%2Fv1%2Finstance%2Fservice-accounts%2Fdefault%2Ftoken"
+	expectedQuery := "foo=bar%20baz"
+	accessToken := "uds-access-token-escaped"
+
+	server := startFakeUDSTokenServer(t, listener, expectedEscapedPath, expectedQuery, accessToken)
+	defer func() { _ = server.Close() }()
+
+	tokenURL := fmt.Sprintf("unix://%s#%s?%s", socketPath, expectedEscapedPath, expectedQuery)
+	ts, err := NewTokenSourceFromURL(context.Background(), tokenURL, false)
+	require.NoError(t, err)
+	require.NotNil(t, ts)
+
+	token, err := ts.Token()
+	assert.NoError(t, err)
+	assert.Equal(t, accessToken, token.AccessToken)
+}
+
+func Test_NewTokenSourceFromURL_UnixSocket_BackwardCompatibility_Success(t *testing.T) {
+	tmpFile, err := os.CreateTemp("", "gcsfuse-uds-test-*.sock")
+	require.NoError(t, err)
+	socketPath := tmpFile.Name()
+	require.NoError(t, tmpFile.Close())
+	require.NoError(t, os.Remove(socketPath))
+	defer func() { _ = os.Remove(socketPath) }()
+
+	listener, err := net.Listen("unix", socketPath)
+	require.NoError(t, err)
+	defer func() { _ = listener.Close() }()
+
+	expectedEscapedPath := "/"
+	expectedQuery := "foo=bar"
+	accessToken := "uds-access-token-compat"
+
+	server := startFakeUDSTokenServer(t, listener, expectedEscapedPath, expectedQuery, accessToken)
+	defer func() { _ = server.Close() }()
+
+	// unix:///path/to/socket?query (old way, but with query)
+	tokenURL := fmt.Sprintf("unix://%s?%s", socketPath, expectedQuery)
+	ts, err := NewTokenSourceFromURL(context.Background(), tokenURL, false)
+	require.NoError(t, err)
+	require.NotNil(t, ts)
+
+	token, err := ts.Token()
+	assert.NoError(t, err)
+	assert.Equal(t, accessToken, token.AccessToken)
+}