@Test
public void testAuthTestServiceAccountUsageFailure() {

  final String serviceAccount = "foo@bar.iam.gserviceaccount.com";
  final String principal = "baz@example.com";
  final TestServiceAccountUsageAuthorizationResponse response = TestServiceAccountUsageAuthorizationResponse.builder()
      .authorized(false)
      .serviceAccount(serviceAccount)
      .principal(principal)
      .message("foobar")
      .build();
  when(client.testServiceAccountUsageAuthorization(serviceAccount, principal))
      .thenReturn(CompletableFuture.completedFuture(response));
  try {
    CliMain.run(cliContext, "auth", "test", "--service-account", serviceAccount, "--principal", principal);
    fail();
  } catch (CliExitException e) {
    assertThat(e.status(), is(ExitStatus.UnknownError));
  }
  verify(client).testServiceAccountUsageAuthorization(serviceAccount, principal);
  verify(cliOutput).printMessage("The principal " + principal + " is not authorized to use the service account "
                                 + serviceAccount + ". " + response.message().orElse(""));
}