From 761cdc898c69715e6775d2f5913ead1fca2def02 Mon Sep 17 00:00:00 2001
From: Megan Potter <57276408+feywind@users.noreply.github.com>
Date: Thu, 8 Feb 2024 16:53:59 -0500
Subject: [PATCH] fix: add option to disable emulator auth handling (temp fix)
 (#1861)

* fix: add option to disable emulator auth handling (temp fix)

* fix: update names to be more palatable(?)

* docs: fix incorrect comment
---
 src/pubsub.ts  | 26 ++++++++++++++++++++++++--
 test/pubsub.ts | 24 ++++++++++++++++++++++++
 2 files changed, 48 insertions(+), 2 deletions(-)

diff --git a/src/pubsub.ts b/src/pubsub.ts
index a0aa2876a..a2df1d01c 100644
--- a/src/pubsub.ts
+++ b/src/pubsub.ts
@@ -70,6 +70,21 @@ export type Omit<T, K extends keyof T> = Pick<T, Exclude<keyof T, K>>;
 
 export interface ClientConfig extends gax.GrpcClientOptions {
   apiEndpoint?: string;
+
+  /**
+   * Configures the emulator mode behaviour:
+   * - If false, disable emulator mode always
+   * - If true, enable emulator mode always
+   * - If unset, use heuristics to decide
+   * Emulator mode notably sets insecure SSL authentication so that you can
+   * try the library out without needing a cert.
+   *
+   * Also notably, if a TPC universeDomain is set, then this will be counted
+   * as !emulatorMode for the purposes of the heuristics. If you want emulator
+   * mode but with a TPC universe domain set, set this to true as well.
+   */
+  emulatorMode?: boolean;
+
   servicePath?: string;
   port?: string | number;
   sslCreds?: gax.grpc.ChannelCredentials;
@@ -798,9 +813,16 @@ export class PubSub {
     // If this looks like a GCP URL of some kind, don't go into emulator
     // mode. Otherwise, supply a fake SSL provider so a real cert isn't
     // required for running the emulator.
+    //
+    // Note that users can provide their own URL here, especially with
+    // TPC, so the emulatorMode flag lets them override this behaviour.
     const officialUrlMatch =
-      this.options.servicePath!.endsWith('.googleapis.com');
-    if (!officialUrlMatch) {
+      this.options.servicePath!.endsWith('.googleapis.com') ||
+      this.options.universeDomain;
+    if (
+      (!officialUrlMatch && this.options.emulatorMode !== false) ||
+      this.options.emulatorMode === true
+    ) {
       const grpcInstance = this.options.grpc || gax.grpc;
       this.options.sslCreds = grpcInstance.credentials.createInsecure();
       this.isEmulator = true;
diff --git a/test/pubsub.ts b/test/pubsub.ts
index 08803c0d8..d76312fd0 100644
--- a/test/pubsub.ts
+++ b/test/pubsub.ts
@@ -857,6 +857,30 @@ describe('PubSub', () => {
       assert.strictEqual(pubsub.isEmulator, true);
     });
 
+    it('should allow overriding fake cred mode (on)', () => {
+      pubsub!.options!.apiEndpoint = 'something.googleapis.com';
+      pubsub!.options!.emulatorMode = true;
+      pubsub.determineBaseUrl_?.();
+
+      assert.strictEqual(pubsub.options!.sslCreds, fakeCreds);
+      assert.strictEqual(pubsub.isEmulator, true);
+    });
+
+    it('should allow overriding fake cred mode (off)', () => {
+      const defaultBaseUrl_ = 'defaulturl';
+      const testingUrl = 'localhost:8085';
+
+      setHost(defaultBaseUrl_);
+      pubsub!.options!.apiEndpoint = testingUrl;
+      pubsub!.options!.emulatorMode = false;
+      pubsub.determineBaseUrl_?.();
+
+      assert.strictEqual(pubsub.options?.servicePath, 'localhost');
+      assert.strictEqual(pubsub.options.port, 8085);
+      assert.ok(pubsub.options.sslCreds === undefined);
+      assert.strictEqual(pubsub.isEmulator, false);
+    });
+
     it('should remove slashes from the baseUrl', () => {
       setHost('localhost:8080/');
       pubsub.determineBaseUrl_?.();