We ran into this trying to get gn check working for //third_party/boringssl. Patchset 3 of https://chromium-review.googlesource.com/c/chromium/src/+/1014028/3 should have a repro.

The problem appears to be that the test template on Android places the sources under a separate internal target, so the friend declaration does not match.
https://cs.chromium.org/chromium/src/testing/test.gni?rcl=1f4382b7fc13da2ec7563f7cd5556802d8794355&l=27

Is the expectation that people write down the inner target names too? That seems a bit awkward and abstraction-breaking. I could also imagine taking the test files and splitting them into a source_set that the test target depends on, but that's a bit of boilerplate.

Do GN targets track what template instantiated them? Maybe friend declarations should match those too. Or perhaps there should be a way for :foo_unittests to say "pass on my friend privileges to :foo_unittests__impl". (I don't think forward_variables_from would work because the friend variable is on the library target, not the test target.)