Fix bug in fake KMS implementation in Python.

does_support should always return False for other KMSs.

PiperOrigin-RevId: 519765775

2 files changed, 8 insertions, 0 deletions

diff --git a/python/tink/testing/fake_kms.py b/python/tink/testing/fake_kms.py
index d3048f1b1..bc6875a4c 100644
--- a/python/tink/testing/fake_kms.py
+++ b/python/tink/testing/fake_kms.py
@@ -38,6 +38,8 @@ class FakeKmsClient(_kms_aead_key_manager.KmsClient):
       raise tink.TinkError('invalid key URI')
 
   def does_support(self, key_uri: str) -> bool:
+    if not key_uri.startswith(FAKE_KMS_PREFIX):
+      return False
     if not self._key_uri:
       return True
     return key_uri == self._key_uri
diff --git a/python/tink/testing/fake_kms_test.py b/python/tink/testing/fake_kms_test.py
index 9913e34d0..ae866295c 100644
--- a/python/tink/testing/fake_kms_test.py
+++ b/python/tink/testing/fake_kms_test.py
@@ -31,6 +31,12 @@ def setUpModule():
 
 class FakeKmsTest(absltest.TestCase):
 
+  def test_fake_kms_doesn_not_support_other_kms(self):
+    client = fake_kms.FakeKmsClient()
+    self.assertFalse(
+        client.does_support('aws-kms://arn:aws:kms:us-east-2:12345:key/12345')
+    )
+
   def test_fake_kms_aead_encrypt_decrypt(self):
     template = aead.aead_key_templates.create_kms_aead_key_template(
         key_uri=KEY_URI)