fix: allowing missing expire time in response

google/auth/pluggable.py

@@ -301,11 +301,7 @@ def _parse_subject_token(self, response):
                     response["code"], response["message"]
                 )
             )
-        if "expiration_time" not in response:
-            raise ValueError(
-                "The executable response is missing the expiration_time field."
-            )
-        if response["expiration_time"] < time.time():
+        if "expiration_time" in response and response["expiration_time"] < time.time():
             raise exceptions.RefreshError(
                 "The token returned by the executable is expired."
             )

tests/test_pluggable.py

@@ -630,7 +630,7 @@ def test_retrieve_subject_token_missing_error_code_message(self):
             )
 
     @mock.patch.dict(os.environ, {"GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES": "1"})
-    def test_retrieve_subject_token_missing_expiration_time(self):
+    def test_retrieve_subject_token_missing_expiration_time_should_pass(self):
         EXECUTABLE_SUCCESSFUL_OIDC_RESPONSE = {
             "version": 1,
             "success": True,
@@ -646,14 +646,7 @@ def test_retrieve_subject_token_missing_expiration_time(self):
                 returncode=0,
             ),
         ):
-            credentials = self.make_pluggable(credential_source=self.CREDENTIAL_SOURCE)
-
-            with pytest.raises(ValueError) as excinfo:
-                _ = credentials.retrieve_subject_token(None)
-
-            assert excinfo.match(
-                r"The executable response is missing the expiration_time field."
-            )
+            self.make_pluggable(credential_source=self.CREDENTIAL_SOURCE)
 
     @mock.patch.dict(os.environ, {"GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES": "1"})
     def test_retrieve_subject_token_missing_token_type(self):