Implement get public & private credentials.

PiperOrigin-RevId: 478522128

presence/implementation/advertisement_factory_test.cc

@@ -39,9 +39,9 @@ using ::testing::status::StatusIs;
 class MockCredentialManager : public CredentialManagerImpl {
  public:
   MOCK_METHOD(absl::StatusOr<std::string>, GetBaseEncryptedMetadataKey,
-              (const IdentityType& identity), (override));
+              (IdentityType identity), (override));
   MOCK_METHOD(absl::StatusOr<std::string>, EncryptDataElements,
-              (const IdentityType& identity, absl::string_view salt,
+              (IdentityType identity, absl::string_view salt,
                absl::string_view data_elements),
               (override));
 };
@@ -70,9 +70,9 @@ TEST(AdvertisementFactory, CreateAdvertisementFromPrivateIdentity) {
   absl::StatusOr<BleAdvertisementData> result =
       factory.CreateAdvertisement(request);
 
-  EXPECT_OK(result);
+  ASSERT_OK(result);
   auto service_data = result->service_data;
-  EXPECT_EQ(service_data.size(), 1);
+  ASSERT_EQ(service_data.size(), 1);
   for (auto i : service_data) {
     EXPECT_EQ(i.first.Get16BitAsString(), "FCF1");
     auto advertisement = absl::BytesToHexString(i.second.AsStringView());

presence/implementation/credential_manager.h

@@ -44,34 +44,36 @@ class CredentialManager {
   // The user’s own public credentials won’t be saved on local credential
   // storage.
   virtual void GenerateCredentials(
-      nearby::internal::DeviceMetadata device_metadata,
-      std::string manager_app_id,
-      std::vector<nearby::internal::IdentityType> identity_types,
+      const nearby::internal::DeviceMetadata& device_metadata,
+      absl::string_view manager_app_id,
+      const std::vector<nearby::internal::IdentityType>& identity_types,
       int credential_life_cycle_days, int contiguous_copy_of_credentials,
       GenerateCredentialsCallback credentials_generated_cb) = 0;
 
   // Update remote public credentials.
   virtual void UpdateRemotePublicCredentials(
-      std::string manager_app_id, std::string account_name,
-      std::vector<nearby::internal::PublicCredential> remote_public_creds,
+      absl::string_view manager_app_id, absl::string_view account_name,
+      const std::vector<nearby::internal::PublicCredential>&
+          remote_public_creds,
       UpdateRemotePublicCredentialsCallback credentials_updated_cb) = 0;
 
   // Used to fetch private creds when broadcasting.
   virtual void GetPrivateCredentials(
-      CredentialSelector credential_selector,
+      const CredentialSelector& credential_selector,
       GetPrivateCredentialsResultCallback callback) = 0;
 
   // Used to fetch remote public creds when scanning.
   virtual void GetPublicCredentials(
-      CredentialSelector credential_selector,
+      const CredentialSelector& credential_selector,
       PublicCredentialType public_credential_type,
       GetPublicCredentialsResultCallback callback) = 0;
 
   // Decrypts the device metadata from a public credential.
   // Returns an empty string if decryption fails.
   virtual std::string DecryptDeviceMetadata(
-      std::string device_metadata_encryption_key, std::string authenticity_key,
-      std::string device_metadata_string) = 0;
+      absl::string_view device_metadata_encryption_key,
+      absl::string_view authenticity_key,
+      absl::string_view device_metadata_string) = 0;
 
   // Decrypts Data Elements from an NP advertisement.
   // Returns an error if `metadata_key` is not associated with any known
@@ -83,12 +85,12 @@ class CredentialManager {
   // Returns encrypted metadata key associated with `identity` for Base NP
   // advertisement.
   virtual absl::StatusOr<std::string> GetBaseEncryptedMetadataKey(
-      const nearby::internal::IdentityType& identity) = 0;
+      nearby::internal::IdentityType identity) = 0;
 
   // Encrypts `data_elements` using certificate associated with `identity` and
   // `salt`.
   virtual absl::StatusOr<std::string> EncryptDataElements(
-      const nearby::internal::IdentityType& identity, absl::string_view salt,
+      nearby::internal::IdentityType identity, absl::string_view salt,
       absl::string_view data_elements) = 0;
 };
 

presence/implementation/credential_manager_impl.cc

@@ -19,12 +19,14 @@
 #include <utility>
 #include <vector>
 
+#include "absl/strings/string_view.h"
 #include "internal/crypto/aead.h"
 #include "internal/crypto/ec_private_key.h"
 #include "internal/crypto/hkdf.h"
 #include "internal/platform/base64_utils.h"
 #include "internal/platform/implementation/crypto.h"
 #include "internal/platform/logging.h"
+#include "internal/proto/credential.proto.h"
 #include "presence/implementation/encryption.h"
 
 namespace nearby {
@@ -43,9 +45,9 @@ constexpr char kPairedKeyAliasPrefix[] = "nearby_presence_paired_key_alias_";
 }  // namespace
 
 void CredentialManagerImpl::GenerateCredentials(
-    DeviceMetadata device_metadata, std::string manager_app_id,
-    std::vector<IdentityType> identity_types, int credential_life_cycle_days,
-    int contiguous_copy_of_credentials,
+    const DeviceMetadata& device_metadata, absl::string_view manager_app_id,
+    const std::vector<IdentityType>& identity_types,
+    int credential_life_cycle_days, int contiguous_copy_of_credentials,
     GenerateCredentialsCallback credentials_generated_cb) {
   std::vector<PublicCredential> public_credentials;
   std::vector<PrivateCredential> private_credentials;
@@ -59,9 +61,10 @@ void CredentialManagerImpl::GenerateCredentials(
     for (int index = 0; index < contiguous_copy_of_credentials; index++) {
       auto public_private_credentials = CreatePrivateCredential(
           device_metadata, identity_type, start_time_millis, end_time_millis);
-      if (public_private_credentials.first != nullptr) {
-        private_credentials.push_back(*public_private_credentials.first);
-        public_credentials.push_back(*public_private_credentials.second);
+      if (public_private_credentials.second.identity_type() !=
+          IdentityType::IDENTITY_TYPE_UNSPECIFIED) {
+        private_credentials.push_back(public_private_credentials.first);
+        public_credentials.push_back(public_private_credentials.second);
       }
       start_time_millis += gap_millis;
       end_time_millis += gap_millis;
@@ -75,20 +78,19 @@ void CredentialManagerImpl::GenerateCredentials(
       std::move(credentials_generated_cb));
 }
 
-std::pair<std::unique_ptr<PrivateCredential>, std::unique_ptr<PublicCredential>>
-CredentialManagerImpl::CreatePrivateCredential(DeviceMetadata device_metadata,
-                                               IdentityType identity_type,
-                                               uint64_t start_time_ms,
-                                               uint64_t end_time_ms) {
-  auto private_credential_ptr = std::make_unique<PrivateCredential>();
-  private_credential_ptr->set_start_time_millis(start_time_ms);
-  private_credential_ptr->set_end_time_millis(end_time_ms);
-  private_credential_ptr->set_identity_type(identity_type);
+std::pair<PrivateCredential, PublicCredential>
+CredentialManagerImpl::CreatePrivateCredential(
+    const DeviceMetadata& device_metadata, IdentityType identity_type,
+    uint64_t start_time_ms, uint64_t end_time_ms) {
+  PrivateCredential private_credential;
+  private_credential.set_start_time_millis(start_time_ms);
+  private_credential.set_end_time_millis(end_time_ms);
+  private_credential.set_identity_type(identity_type);
 
   // Creates an AES key to encrypt the whole broadcast.
   std::string secret_key =
       Encryption::GenerateRandomByteArray(kAuthenticityKeyByteSize);
-  private_credential_ptr->set_authenticity_key(secret_key);
+  private_credential.set_authenticity_key(secret_key);
 
   // Uses SHA-256 algorithm to generate the credential ID from the authenticity
   // key
@@ -97,7 +99,7 @@ CredentialManagerImpl::CreatePrivateCredential(DeviceMetadata device_metadata,
   // ByteArray.
   CHECK(!secret_id.Empty()) << "Crypto::Sha256 failed!";
 
-  private_credential_ptr->set_secret_id(secret_id.AsStringView());
+  private_credential.set_secret_id(secret_id.AsStringView());
 
   std::string alias = Base64Utils::Encode(secret_id);
   auto prefixedAlias = kPairedKeyAliasPrefix + alias;
@@ -106,67 +108,66 @@ CredentialManagerImpl::CreatePrivateCredential(DeviceMetadata device_metadata,
   auto key_pair = crypto::ECPrivateKey::Create();
   std::vector<uint8_t> private_key;
   key_pair->ExportPrivateKey(&private_key);
-  private_credential_ptr->set_verification_key(
+  private_credential.set_verification_key(
       std::string(private_key.begin(), private_key.end()));
 
   // Create an AES key to encrypt the device metadata.
   auto metadata_key =
       Encryption::GenerateRandomByteArray(kAuthenticityKeyByteSize);
-  private_credential_ptr->set_metadata_encryption_key(metadata_key);
+  private_credential.set_metadata_encryption_key(metadata_key);
 
   // set device meta data
-  *(private_credential_ptr->mutable_device_metadata()) = device_metadata;
+  *(private_credential.mutable_device_metadata()) = device_metadata;
 
   // Generate the public credential
   std::vector<uint8_t> public_key;
   key_pair->ExportPublicKey(&public_key);
-  auto public_credential_ptr =
-      CreatePublicCredential(private_credential_ptr.get(), &public_key);
 
-  return std::pair<std::unique_ptr<PrivateCredential>,
-                   std::unique_ptr<PublicCredential>>(
-      std::move(private_credential_ptr), std::move(public_credential_ptr));
+  return std::pair<PrivateCredential, PublicCredential>(
+      private_credential,
+      CreatePublicCredential(private_credential, public_key));
 }
 
-std::unique_ptr<PublicCredential> CredentialManagerImpl::CreatePublicCredential(
-    PrivateCredential* private_credential, std::vector<uint8_t>* public_key) {
-  auto public_credential_ptr = std::make_unique<PublicCredential>();
-
-  public_credential_ptr->set_identity_type(private_credential->identity_type());
-  public_credential_ptr->set_secret_id(private_credential->secret_id());
-  public_credential_ptr->set_authenticity_key(
-      private_credential->authenticity_key());
-  public_credential_ptr->set_start_time_millis(
-      private_credential->start_time_millis());
-  public_credential_ptr->set_end_time_millis(
-      private_credential->end_time_millis());
+PublicCredential CredentialManagerImpl::CreatePublicCredential(
+    const PrivateCredential& private_credential,
+    const std::vector<uint8_t>& public_key) {
+  PublicCredential public_credential;
+  public_credential.set_identity_type(private_credential.identity_type());
+  public_credential.set_secret_id(private_credential.secret_id());
+  public_credential.set_authenticity_key(private_credential.authenticity_key());
+  public_credential.set_start_time_millis(
+      private_credential.start_time_millis());
+  public_credential.set_end_time_millis(private_credential.end_time_millis());
   // set up the public key
-  public_credential_ptr->set_verification_key(
-      std::string(public_key->begin(), public_key->end()));
+  public_credential.set_verification_key(
+      std::string(public_key.begin(), public_key.end()));
 
   auto metadata_encryption_key_tag =
-      Crypto::Sha256(private_credential->metadata_encryption_key());
-  public_credential_ptr->set_metadata_encryption_key_tag(
+      Crypto::Sha256(private_credential.metadata_encryption_key());
+  public_credential.set_metadata_encryption_key_tag(
       metadata_encryption_key_tag.AsStringView());
 
   // Encrypt the device metadata
   auto encrypted_meta_data = EncryptDeviceMetadata(
-      private_credential->metadata_encryption_key(),
-      private_credential->authenticity_key(),
-      private_credential->device_metadata().SerializeAsString());
+      private_credential.metadata_encryption_key(),
+      private_credential.authenticity_key(),
+      private_credential.device_metadata().SerializeAsString());
 
   if (encrypted_meta_data.empty()) {
     NEARBY_LOGS(ERROR) << "Fails to encrypt the device metadata.";
-    return std::unique_ptr<PublicCredential>(nullptr);
+    public_credential.set_identity_type(
+        IdentityType::IDENTITY_TYPE_UNSPECIFIED);
+    return public_credential;
   }
 
-  public_credential_ptr->set_encrypted_metadata_bytes(encrypted_meta_data);
-  return public_credential_ptr;
+  public_credential.set_encrypted_metadata_bytes(encrypted_meta_data);
+  return public_credential;
 }
 
 std::string CredentialManagerImpl::DecryptDeviceMetadata(
-    std::string device_metadata_encryption_key, std::string authenticity_key,
-    std::string device_metadata_string) {
+    absl::string_view device_metadata_encryption_key,
+    absl::string_view authenticity_key,
+    absl::string_view device_metadata_string) {
   crypto::Aead aead(crypto::Aead::AeadAlgorithm::AES_256_GCM);
 
   std::vector<uint8_t> derived_key =
@@ -188,8 +189,9 @@ std::string CredentialManagerImpl::DecryptDeviceMetadata(
 }
 
 std::string CredentialManagerImpl::EncryptDeviceMetadata(
-    std::string device_metadata_encryption_key, std::string authenticity_key,
-    std::string device_metadata_string) {
+    absl::string_view device_metadata_encryption_key,
+    absl::string_view authenticity_key,
+    absl::string_view device_metadata_string) {
   crypto::Aead aead(crypto::Aead::AeadAlgorithm::AES_256_GCM);
 
   std::vector<uint8_t> derived_key =
@@ -213,7 +215,7 @@ std::string CredentialManagerImpl::EncryptDeviceMetadata(
 }
 
 std::vector<uint8_t> CredentialManagerImpl::ExtendMetadataEncryptionKey(
-    std::string device_metadata_encryption_key) {
+    absl::string_view device_metadata_encryption_key) {
   return crypto::HkdfSha256(
       std::vector<uint8_t>(device_metadata_encryption_key.begin(),
                            device_metadata_encryption_key.end()),
@@ -221,5 +223,20 @@ std::vector<uint8_t> CredentialManagerImpl::ExtendMetadataEncryptionKey(
       /*info=*/absl::Span<uint8_t>(), kNearbyPresenceNumBytesAesGcmKeySize);
 }
 
+void CredentialManagerImpl::GetPrivateCredentials(
+    const CredentialSelector& credential_selector,
+    GetPrivateCredentialsResultCallback callback) {
+  credential_storage_ptr_->GetPrivateCredentials(credential_selector,
+                                                 std::move(callback));
+}
+
+void CredentialManagerImpl::GetPublicCredentials(
+    const CredentialSelector& credential_selector,
+    PublicCredentialType public_credential_type,
+    GetPublicCredentialsResultCallback callback) {
+  credential_storage_ptr_->GetPublicCredentials(
+      credential_selector, public_credential_type, std::move(callback));
+}
+
 }  // namespace presence
 }  // namespace nearby

presence/implementation/credential_manager_impl.h

@@ -54,31 +54,32 @@ class CredentialManagerImpl : public CredentialManager {
   static constexpr int kAesGcmIVSize = 12;
 
   void GenerateCredentials(
-      nearby::internal::DeviceMetadata device_metadata,
-      std::string manager_app_id,
-      std::vector<nearby::internal::IdentityType> identity_types,
-      int credential_life_cycle_days,
-      int contiguous_copy_of_credentials,
+      const nearby::internal::DeviceMetadata& device_metadata,
+      absl::string_view manager_app_id,
+      const std::vector<nearby::internal::IdentityType>& identity_types,
+      int credential_life_cycle_days, int contiguous_copy_of_credentials,
       GenerateCredentialsCallback credentials_generated_cb) override;
 
   void UpdateRemotePublicCredentials(
-      std::string manager_app_id, std::string account_name,
-      std::vector<nearby::internal::PublicCredential> remote_public_creds,
+      absl::string_view manager_app_id, absl::string_view account_name,
+      const std::vector<nearby::internal::PublicCredential>&
+          remote_public_creds,
       UpdateRemotePublicCredentialsCallback credentials_updated_cb) override{};
 
   void GetPrivateCredentials(
-      CredentialSelector credential_selector,
-      GetPrivateCredentialsResultCallback callback) override{};
+      const CredentialSelector& credential_selector,
+      GetPrivateCredentialsResultCallback callback) override;
 
   // Used to fetch remote public creds when scanning.
   void GetPublicCredentials(
-      CredentialSelector credential_selector,
+      const CredentialSelector& credential_selector,
       PublicCredentialType public_credential_type,
-      GetPublicCredentialsResultCallback callback) override{};
+      GetPublicCredentialsResultCallback callback) override;
 
   std::string DecryptDeviceMetadata(
-      std::string device_metadata_encryption_key, std::string authenticity_key,
-      std::string device_metadata_string) override;
+      absl::string_view device_metadata_encryption_key,
+      absl::string_view authenticity_key,
+      absl::string_view device_metadata_string) override;
 
   absl::StatusOr<std::string> DecryptDataElements(
       absl::string_view metadata_key, absl::string_view salt,
@@ -87,34 +88,36 @@ class CredentialManagerImpl : public CredentialManager {
   }
 
   absl::StatusOr<std::string> GetBaseEncryptedMetadataKey(
-      const nearby::internal::IdentityType& identity) override {
+      nearby::internal::IdentityType identity) override {
     return absl::UnimplementedError(
         "GetBaseEncryptedMetadataKey unimplemented");
   }
 
   absl::StatusOr<std::string> EncryptDataElements(
-      const nearby::internal::IdentityType& identity, absl::string_view salt,
+      nearby::internal::IdentityType identity, absl::string_view salt,
       absl::string_view data_elements) override {
     return absl::UnimplementedError("EncryptDataElements unimplemented");
   }
 
-  std::pair<std::unique_ptr<nearby::internal::PrivateCredential>,
-            std::unique_ptr<nearby::internal::PublicCredential>>
-  CreatePrivateCredential(nearby::internal::DeviceMetadata device_metadata,
-                          nearby::internal::IdentityType identity_type,
-                          uint64_t start_time_ms, uint64_t end_time_ms);
+  std::pair<nearby::internal::PrivateCredential,
+            nearby::internal::PublicCredential>
+  CreatePrivateCredential(
+      const nearby::internal::DeviceMetadata& device_metadata,
+      nearby::internal::IdentityType identity_type, uint64_t start_time_ms,
+      uint64_t end_time_ms);
 
-  std::unique_ptr<nearby::internal::PublicCredential> CreatePublicCredential(
-      nearby::internal::PrivateCredential* private_credential_ptr,
-      std::vector<uint8_t>* public_key);
+  nearby::internal::PublicCredential CreatePublicCredential(
+      const nearby::internal::PrivateCredential& private_credential,
+      const std::vector<uint8_t>& public_key);
 
-  std::string EncryptDeviceMetadata(std::string device_metadata_encryption_key,
-                                    std::string authenticity_key,
-                                    std::string device_metadata_string);
+  virtual std::string EncryptDeviceMetadata(
+      absl::string_view device_metadata_encryption_key,
+      absl::string_view authenticity_key,
+      absl::string_view device_metadata_string);
 
   // Extend the key from 16 bytes to 32 bytes.
   std::vector<uint8_t> ExtendMetadataEncryptionKey(
-      std::string device_metadata_encryption_key);
+      absl::string_view device_metadata_encryption_key);
 
  private:
   std::unique_ptr<location::nearby::CredentialStorageImpl>

presence/implementation/credential_manager_impl_test.cc

@@ -15,6 +15,7 @@
 #include "presence/implementation/credential_manager_impl.h"
 
 #include <memory>
+#include <string>
 #include <utility>
 #include <vector>
 
@@ -50,6 +51,14 @@ DeviceMetadata CreateTestDeviceMetadata() {
   return device_metadata;
 }
 
+CredentialSelector BuildDefaultCredentialSelector() {
+  CredentialSelector credential_selector;
+  credential_selector.manager_app_id = "TEST_MANAGER_APP";
+  credential_selector.account_name = "test_account";
+  credential_selector.identity_type = IDENTITY_TYPE_PRIVATE;
+  return credential_selector;
+}
+
 class CredentialManagerImplTest : public ::testing::Test {
  public:
   class MockCredentialStorage : public location::nearby::CredentialStorageImpl {
@@ -66,12 +75,23 @@ class CredentialManagerImplTest : public ::testing::Test {
                 (override));
   };
 
+  class MockCredentialManager : public CredentialManagerImpl {
+   public:
+    MOCK_METHOD(std::string, EncryptDeviceMetadata,
+                (absl::string_view device_metadata_encryption_key,
+                 absl::string_view authenticity_key,
+                 absl::string_view device_metadata_string),
+                (override));
+  };
+
   CredentialManagerImplTest() {
     mock_credential_storage_ptr_ = std::make_unique<MockCredentialStorage>();
+    mock_credential_manager_ptr_ = std::make_unique<MockCredentialManager>();
   }
 
  protected:
   std::unique_ptr<MockCredentialStorage> mock_credential_storage_ptr_;
+  std::unique_ptr<MockCredentialManager> mock_credential_manager_ptr_;
 };
 
 TEST(CredentialManagerImpl, CreateOneCredentialSuccessfully) {
@@ -82,43 +102,43 @@ TEST(CredentialManagerImpl, CreateOneCredentialSuccessfully) {
       device_metadata, IDENTITY_TYPE_PRIVATE, /* start_time_ms= */ 0,
       /* end_time_ms= */ 1000);
 
-  PrivateCredential* private_credential = credentials.first.get();
+  PrivateCredential private_credential = credentials.first;
 
   // Verify the private credential.
-  EXPECT_THAT(private_credential->device_metadata(),
+  EXPECT_THAT(private_credential.device_metadata(),
               EqualsProto(device_metadata));
-  EXPECT_EQ(private_credential->identity_type(), IDENTITY_TYPE_PRIVATE);
-  EXPECT_FALSE(private_credential->secret_id().empty());
-  EXPECT_EQ(private_credential->start_time_millis(), 0);
-  EXPECT_EQ(private_credential->end_time_millis(), 1000);
-  EXPECT_EQ(private_credential->authenticity_key().size(),
+  EXPECT_EQ(private_credential.identity_type(), IDENTITY_TYPE_PRIVATE);
+  EXPECT_FALSE(private_credential.secret_id().empty());
+  EXPECT_EQ(private_credential.start_time_millis(), 0);
+  EXPECT_EQ(private_credential.end_time_millis(), 1000);
+  EXPECT_EQ(private_credential.authenticity_key().size(),
             CredentialManagerImpl::kAuthenticityKeyByteSize);
-  EXPECT_FALSE(private_credential->verification_key().empty());
-  EXPECT_EQ(private_credential->metadata_encryption_key().size(),
+  EXPECT_FALSE(private_credential.verification_key().empty());
+  EXPECT_EQ(private_credential.metadata_encryption_key().size(),
             CredentialManagerImpl::kAuthenticityKeyByteSize);
 
-  PublicCredential* public_credential = credentials.second.get();
+  PublicCredential public_credential = credentials.second;
   // Verify the public credential.
-  EXPECT_EQ(public_credential->identity_type(), IDENTITY_TYPE_PRIVATE);
-  EXPECT_FALSE(public_credential->secret_id().empty());
-  EXPECT_EQ(private_credential->authenticity_key(),
-            public_credential->authenticity_key());
-  EXPECT_EQ(public_credential->start_time_millis(), 0);
-  EXPECT_EQ(public_credential->end_time_millis(), 1000);
-  EXPECT_EQ(Crypto::Sha256(private_credential->metadata_encryption_key())
+  EXPECT_EQ(public_credential.identity_type(), IDENTITY_TYPE_PRIVATE);
+  EXPECT_FALSE(public_credential.secret_id().empty());
+  EXPECT_EQ(private_credential.authenticity_key(),
+            public_credential.authenticity_key());
+  EXPECT_EQ(public_credential.start_time_millis(), 0);
+  EXPECT_EQ(public_credential.end_time_millis(), 1000);
+  EXPECT_EQ(Crypto::Sha256(private_credential.metadata_encryption_key())
                 .AsStringView(),
-            public_credential->metadata_encryption_key_tag());
-  EXPECT_FALSE(public_credential->verification_key().empty());
-  EXPECT_FALSE(public_credential->encrypted_metadata_bytes().empty());
+            public_credential.metadata_encryption_key_tag());
+  EXPECT_FALSE(public_credential.verification_key().empty());
+  EXPECT_FALSE(public_credential.encrypted_metadata_bytes().empty());
 
   // Decrypt the device metadata
 
   auto decrypted_device_metadata = credential_manager.DecryptDeviceMetadata(
-      private_credential->metadata_encryption_key(),
-      public_credential->authenticity_key(),
-      public_credential->encrypted_metadata_bytes());
+      private_credential.metadata_encryption_key(),
+      public_credential.authenticity_key(),
+      public_credential.encrypted_metadata_bytes());
 
-  EXPECT_EQ(private_credential->device_metadata().SerializeAsString(),
+  EXPECT_EQ(private_credential.device_metadata().SerializeAsString(),
             decrypted_device_metadata);
 }
 
@@ -189,6 +209,162 @@ TEST(CredentialManagerImpl, GenerateCredentialsSuccessfullyButStoreFailed) {
       credentials_generated_cb);
   EXPECT_TRUE(publicCredentials.empty());
 }
+
+TEST(CredentialManagerImpl, GetPrivateCredentialsFailed) {
+  std::vector<PrivateCredential> private_credentials;
+  auto get_credentials_fetched_cb =
+      [&private_credentials](std::vector<PrivateCredential> credentials) {
+        private_credentials = credentials;
+      };
+  CredentialOperationStatus get_credentials_status =
+      CredentialOperationStatus::kSucceeded;
+  auto get_credentials_failed_cb =
+      [&get_credentials_status](CredentialOperationStatus status) {
+        get_credentials_status = status;
+      };
+
+  GetPrivateCredentialsResultCallback get_private_credentials_result_callback;
+  get_private_credentials_result_callback.get_credentials_failed_cb =
+      get_credentials_failed_cb;
+  get_private_credentials_result_callback.credentials_fetched_cb =
+      get_credentials_fetched_cb;
+
+  CredentialSelector credential_selector;
+  credential_selector.manager_app_id = "TEST_MANAGER_APP";
+  credential_selector.account_name = "test_account";
+  credential_selector.identity_type = IDENTITY_TYPE_PRIVATE;
+
+  CredentialManagerImpl credential_manager;
+  credential_manager.GetPrivateCredentials(
+      credential_selector, get_private_credentials_result_callback);
+  EXPECT_EQ(get_credentials_status, CredentialOperationStatus::kFailed);
+  EXPECT_TRUE(private_credentials.empty());
+}
+
+TEST(CredentialManagerImpl, GetPublicCredentialsFailed) {
+  std::vector<PublicCredential> public_credentials;
+  auto get_credentials_fetched_cb =
+      [&public_credentials](std::vector<PublicCredential> credentials) {
+        public_credentials = credentials;
+      };
+  CredentialOperationStatus get_credentials_status =
+      CredentialOperationStatus::kSucceeded;
+  auto get_credentials_failed_cb =
+      [&get_credentials_status](CredentialOperationStatus status) {
+        get_credentials_status = status;
+      };
+
+  GetPublicCredentialsResultCallback get_public_credentials_result_callback;
+  get_public_credentials_result_callback.get_credentials_failed_cb =
+      get_credentials_failed_cb;
+  get_public_credentials_result_callback.credentials_fetched_cb =
+      get_credentials_fetched_cb;
+
+  CredentialSelector credential_selector;
+  credential_selector.manager_app_id = "TEST_MANAGER_APP";
+  credential_selector.account_name = "test_account";
+  credential_selector.identity_type = IDENTITY_TYPE_PRIVATE;
+
+  CredentialManagerImpl credential_manager;
+  credential_manager.GetPublicCredentials(
+      credential_selector, PublicCredentialType::kLocalPublicCredential,
+      get_public_credentials_result_callback);
+  EXPECT_EQ(get_credentials_status, CredentialOperationStatus::kFailed);
+  EXPECT_TRUE(public_credentials.empty());
+}
+
+TEST(CredentialManagerImpl, GetCredentialsSuccessfully) {
+  DeviceMetadata device_metadata = CreateTestDeviceMetadata();
+
+  std::vector<nearby::internal::PublicCredential> publicCredentials;
+
+  auto create_creds_callback_lambda =
+      [&publicCredentials](
+          std::vector<nearby::internal::PublicCredential> credentials) {
+        publicCredentials = credentials;
+      };
+  GenerateCredentialsCallback generate_credentials_callback;
+  generate_credentials_callback.credentials_generated_cb =
+      create_creds_callback_lambda;
+
+  CredentialManagerImpl credential_manager;
+  std::vector<IdentityType> identity_types{IDENTITY_TYPE_PRIVATE};
+  credential_manager.GenerateCredentials(
+      device_metadata, "TEST_MANAGER_APP", identity_types, 1, 1,
+      std::move(generate_credentials_callback));
+  EXPECT_EQ(publicCredentials.size(), 1);
+
+  std::vector<PrivateCredential> private_credentials;
+  auto get_credentials_fetched_cb =
+      [&private_credentials](std::vector<PrivateCredential> credentials) {
+        private_credentials = credentials;
+      };
+  CredentialOperationStatus get_credentials_status =
+      CredentialOperationStatus::kSucceeded;
+  auto get_credentials_failed_cb =
+      [&get_credentials_status](CredentialOperationStatus status) {
+        get_credentials_status = status;
+      };
+
+  GetPrivateCredentialsResultCallback get_private_credentials_result_callback;
+  get_private_credentials_result_callback.get_credentials_failed_cb =
+      get_credentials_failed_cb;
+  get_private_credentials_result_callback.credentials_fetched_cb =
+      get_credentials_fetched_cb;
+
+  CredentialSelector credential_selector = BuildDefaultCredentialSelector();
+  credential_manager.GetPrivateCredentials(
+      credential_selector, std::move(get_private_credentials_result_callback));
+  EXPECT_EQ(get_credentials_status, CredentialOperationStatus::kSucceeded);
+  EXPECT_FALSE(private_credentials.empty());
+}
+
+TEST(CredentialManagerImpl, PublicCredentialsFailEncryption) {
+  DeviceMetadata device_metadata = CreateTestDeviceMetadata();
+
+  std::vector<nearby::internal::PublicCredential> publicCredentials;
+
+  GenerateCredentialsCallback generate_credentials_callback;
+  generate_credentials_callback.credentials_generated_cb =
+      [&publicCredentials](
+          std::vector<nearby::internal::PublicCredential> credentials) {
+        publicCredentials = credentials;
+      };
+
+  auto credential_manager_ptr =
+      std::make_unique<CredentialManagerImplTest::MockCredentialManager>();
+  EXPECT_CALL(*credential_manager_ptr, EncryptDeviceMetadata)
+      .WillOnce(::testing::Invoke(
+          [](absl::string_view device_metadata_encryption_key,
+             absl::string_view authenticity_key,
+             absl::string_view device_metadata_string) { return ""; }));
+
+  std::vector<IdentityType> identity_types{IDENTITY_TYPE_PRIVATE};
+  credential_manager_ptr->GenerateCredentials(
+      device_metadata, "TEST_MANAGER_APP", identity_types, 1, 1,
+      std::move(generate_credentials_callback));
+  EXPECT_TRUE(publicCredentials.empty());
+}
+
+TEST(CredentialManagerImpl, UnimplementedFunctions) {
+  CredentialManagerImpl credential_manager;
+  constexpr absl::string_view metadata_key = "metadata_key";
+  constexpr absl::string_view salt = "salt";
+  constexpr absl::string_view data_elements = "data_elements";
+  IdentityType identity = IDENTITY_TYPE_PRIVATE;
+  EXPECT_THAT(
+      credential_manager.EncryptDataElements(identity, salt, data_elements),
+      absl::Status(absl::StatusCode::kUnimplemented,
+                   "EncryptDataElements unimplemented"));
+  EXPECT_THAT(
+      credential_manager.DecryptDataElements(metadata_key, salt, data_elements),
+      absl::Status(absl::StatusCode::kUnimplemented,
+                   "DecryptDataElements unimplemented"));
+  EXPECT_THAT(credential_manager.GetBaseEncryptedMetadataKey(identity),
+              absl::Status(absl::StatusCode::kUnimplemented,
+                           "GetBaseEncryptedMetadataKey unimplemented"));
+}
+
 }  // namespace
 
 }  // namespace presence