Skip to content
This repository was archived by the owner on Dec 31, 2023. It is now read-only.

Commit 1f55871

Browse files
gcf-owl-bot[bot]gcf-owl-bot[bot]
authored
feat: add always_use_jwt_access (#147)
... chore: update gapic-generator-ruby to the latest commit chore: release gapic-generator-typescript 1.5.0 Committer: @miraleung PiperOrigin-RevId: 380641501 Source-Link: googleapis/googleapis@076f7e9 Source-Link: https://github.com/googleapis/googleapis-gen/commit/27e4c88b4048e5f56508d4e1aa417d60a3380892
1 parent dfb075f commit 1f55871

7 files changed

Lines changed: 39 additions & 124 deletions

File tree

‎.coveragerc‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22
branch = True
33

44
[report]
5-
fail_under = 100
65
show_missing = True
76
omit =
87
google/cloud/devtools/containeranalysis/__init__.py

‎google/cloud/devtools/containeranalysis_v1/services/container_analysis/transports/base.py‎

Lines changed: 14 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
from google.api_core import gapic_v1 # type: ignore
2525
from google.api_core import retry as retries # type: ignore
2626
from google.auth import credentials as ga_credentials # type: ignore
27+
from google.oauth2 import service_account # type: ignore
2728

2829
from google.cloud.devtools.containeranalysis_v1.types import containeranalysis
2930
from google.iam.v1 import iam_policy_pb2 # type: ignore
@@ -47,8 +48,6 @@
4748
except pkg_resources.DistributionNotFound: # pragma: NO COVER
4849
_GOOGLE_AUTH_VERSION = None
4950

50-
_API_CORE_VERSION = google.api_core.__version__
51-
5251

5352
class ContainerAnalysisTransport(abc.ABC):
5453
"""Abstract transport class for ContainerAnalysis."""
@@ -66,6 +65,7 @@ def __init__(
6665
scopes: Optional[Sequence[str]] = None,
6766
quota_project_id: Optional[str] = None,
6867
client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO,
68+
always_use_jwt_access: Optional[bool] = False,
6969
**kwargs,
7070
) -> None:
7171
"""Instantiate the transport.
@@ -89,6 +89,8 @@ def __init__(
8989
API requests. If ``None``, then default info will be used.
9090
Generally, you only need to set this if you're developing
9191
your own client library.
92+
always_use_jwt_access (Optional[bool]): Whether self signed JWT should
93+
be used for service account credentials.
9294
"""
9395
# Save the hostname. Default to port 443 (HTTPS) if none is specified.
9496
if ":" not in host:
@@ -117,13 +119,20 @@ def __init__(
117119
**scopes_kwargs, quota_project_id=quota_project_id
118120
)
119121

122+
# If the credentials is service account credentials, then always try to use self signed JWT.
123+
if (
124+
always_use_jwt_access
125+
and isinstance(credentials, service_account.Credentials)
126+
and hasattr(service_account.Credentials, "with_always_use_jwt_access")
127+
):
128+
credentials = credentials.with_always_use_jwt_access(True)
129+
120130
# Save the credentials.
121131
self._credentials = credentials
122132

123-
# TODO(busunkim): These two class methods are in the base transport
133+
# TODO(busunkim): This method is in the base transport
124134
# to avoid duplicating code across the transport classes. These functions
125-
# should be deleted once the minimum required versions of google-api-core
126-
# and google-auth are increased.
135+
# should be deleted once the minimum required versions of google-auth is increased.
127136

128137
# TODO: Remove this function once google-auth >= 1.25.0 is required
129138
@classmethod
@@ -144,27 +153,6 @@ def _get_scopes_kwargs(
144153

145154
return scopes_kwargs
146155

147-
# TODO: Remove this function once google-api-core >= 1.26.0 is required
148-
@classmethod
149-
def _get_self_signed_jwt_kwargs(
150-
cls, host: str, scopes: Optional[Sequence[str]]
151-
) -> Dict[str, Union[Optional[Sequence[str]], str]]:
152-
"""Returns kwargs to pass to grpc_helpers.create_channel depending on the google-api-core version"""
153-
154-
self_signed_jwt_kwargs: Dict[str, Union[Optional[Sequence[str]], str]] = {}
155-
156-
if _API_CORE_VERSION and (
157-
packaging.version.parse(_API_CORE_VERSION)
158-
>= packaging.version.parse("1.26.0")
159-
):
160-
self_signed_jwt_kwargs["default_scopes"] = cls.AUTH_SCOPES
161-
self_signed_jwt_kwargs["scopes"] = scopes
162-
self_signed_jwt_kwargs["default_host"] = cls.DEFAULT_HOST
163-
else:
164-
self_signed_jwt_kwargs["scopes"] = scopes or cls.AUTH_SCOPES
165-
166-
return self_signed_jwt_kwargs
167-
168156
def _prep_wrapped_messages(self, client_info):
169157
# Precompute the wrapped methods.
170158
self._wrapped_methods = {

‎google/cloud/devtools/containeranalysis_v1/services/container_analysis/transports/grpc.py‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -165,6 +165,7 @@ def __init__(
165165
scopes=scopes,
166166
quota_project_id=quota_project_id,
167167
client_info=client_info,
168+
always_use_jwt_access=True,
168169
)
169170

170171
if not self._grpc_channel:
@@ -220,14 +221,14 @@ def create_channel(
220221
and ``credentials_file`` are passed.
221222
"""
222223

223-
self_signed_jwt_kwargs = cls._get_self_signed_jwt_kwargs(host, scopes)
224-
225224
return grpc_helpers.create_channel(
226225
host,
227226
credentials=credentials,
228227
credentials_file=credentials_file,
229228
quota_project_id=quota_project_id,
230-
**self_signed_jwt_kwargs,
229+
default_scopes=cls.AUTH_SCOPES,
230+
scopes=scopes,
231+
default_host=cls.DEFAULT_HOST,
231232
**kwargs,
232233
)
233234

‎google/cloud/devtools/containeranalysis_v1/services/container_analysis/transports/grpc_asyncio.py‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -94,14 +94,14 @@ def create_channel(
9494
aio.Channel: A gRPC AsyncIO channel object.
9595
"""
9696

97-
self_signed_jwt_kwargs = cls._get_self_signed_jwt_kwargs(host, scopes)
98-
9997
return grpc_helpers_async.create_channel(
10098
host,
10199
credentials=credentials,
102100
credentials_file=credentials_file,
103101
quota_project_id=quota_project_id,
104-
**self_signed_jwt_kwargs,
102+
default_scopes=cls.AUTH_SCOPES,
103+
scopes=scopes,
104+
default_host=cls.DEFAULT_HOST,
105105
**kwargs,
106106
)
107107

@@ -211,6 +211,7 @@ def __init__(
211211
scopes=scopes,
212212
quota_project_id=quota_project_id,
213213
client_info=client_info,
214+
always_use_jwt_access=True,
214215
)
215216

216217
if not self._grpc_channel:

‎setup.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
version = "2.3.0"
2626
release_status = "Development Status :: 5 - Production/Stable"
2727
dependencies = [
28-
"google-api-core[grpc] >= 1.22.2, < 2.0.0dev",
28+
"google-api-core[grpc] >= 1.26.0, <2.0.0dev",
2929
"grpc-google-iam-v1 >= 0.12.3, < 0.13dev",
3030
"proto-plus >= 1.4.0",
3131
"packaging >= 14.3",

‎testing/constraints-3.6.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
#
66
# e.g., if setup.py has "foo >= 1.14.0, < 2.0.0dev",
77
# Then this file should have foo==1.14.0
8-
google-api-core==1.22.2
8+
google-api-core==1.26.0
99
grpc-google-iam-v1==0.12.3
1010
proto-plus==1.4.0
1111
libcst==0.2.5

‎tests/unit/gapic/containeranalysis_v1/test_container_analysis.py‎

Lines changed: 15 additions & 89 deletions
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,6 @@
4040
from google.cloud.devtools.containeranalysis_v1.services.container_analysis import (
4141
transports,
4242
)
43-
from google.cloud.devtools.containeranalysis_v1.services.container_analysis.transports.base import (
44-
_API_CORE_VERSION,
45-
)
4643
from google.cloud.devtools.containeranalysis_v1.services.container_analysis.transports.base import (
4744
_GOOGLE_AUTH_VERSION,
4845
)
@@ -55,8 +52,9 @@
5552
import google.auth
5653

5754

58-
# TODO(busunkim): Once google-api-core >= 1.26.0 is required:
59-
# - Delete all the api-core and auth "less than" test cases
55+
# TODO(busunkim): Once google-auth >= 1.25.0 is required transitively
56+
# through google-api-core:
57+
# - Delete the auth "less than" test cases
6058
# - Delete these pytest markers (Make the "greater than or equal to" tests the default).
6159
requires_google_auth_lt_1_25_0 = pytest.mark.skipif(
6260
packaging.version.parse(_GOOGLE_AUTH_VERSION) >= packaging.version.parse("1.25.0"),
@@ -67,16 +65,6 @@
6765
reason="This test requires google-auth >= 1.25.0",
6866
)
6967

70-
requires_api_core_lt_1_26_0 = pytest.mark.skipif(
71-
packaging.version.parse(_API_CORE_VERSION) >= packaging.version.parse("1.26.0"),
72-
reason="This test requires google-api-core < 1.26.0",
73-
)
74-
75-
requires_api_core_gte_1_26_0 = pytest.mark.skipif(
76-
packaging.version.parse(_API_CORE_VERSION) < packaging.version.parse("1.26.0"),
77-
reason="This test requires google-api-core >= 1.26.0",
78-
)
79-
8068

8169
def client_cert_source_callback():
8270
return b"cert bytes", b"key bytes"
@@ -140,6 +128,18 @@ def test_container_analysis_client_from_service_account_info(client_class):
140128
assert client.transport._host == "containeranalysis.googleapis.com:443"
141129

142130

131+
@pytest.mark.parametrize(
132+
"client_class", [ContainerAnalysisClient, ContainerAnalysisAsyncClient,]
133+
)
134+
def test_container_analysis_client_service_account_always_use_jwt(client_class):
135+
with mock.patch.object(
136+
service_account.Credentials, "with_always_use_jwt_access", create=True
137+
) as use_jwt:
138+
creds = service_account.Credentials(None, None, None)
139+
client = client_class(credentials=creds)
140+
use_jwt.assert_called_with(True)
141+
142+
143143
@pytest.mark.parametrize(
144144
"client_class", [ContainerAnalysisClient, ContainerAnalysisAsyncClient,]
145145
)
@@ -1627,7 +1627,6 @@ def test_container_analysis_transport_auth_adc_old_google_auth(transport_class):
16271627
(transports.ContainerAnalysisGrpcAsyncIOTransport, grpc_helpers_async),
16281628
],
16291629
)
1630-
@requires_api_core_gte_1_26_0
16311630
def test_container_analysis_transport_create_channel(transport_class, grpc_helpers):
16321631
# If credentials and host are not provided, the transport class should use
16331632
# ADC credentials.
@@ -1656,79 +1655,6 @@ def test_container_analysis_transport_create_channel(transport_class, grpc_helpe
16561655
)
16571656

16581657

1659-
@pytest.mark.parametrize(
1660-
"transport_class,grpc_helpers",
1661-
[
1662-
(transports.ContainerAnalysisGrpcTransport, grpc_helpers),
1663-
(transports.ContainerAnalysisGrpcAsyncIOTransport, grpc_helpers_async),
1664-
],
1665-
)
1666-
@requires_api_core_lt_1_26_0
1667-
def test_container_analysis_transport_create_channel_old_api_core(
1668-
transport_class, grpc_helpers
1669-
):
1670-
# If credentials and host are not provided, the transport class should use
1671-
# ADC credentials.
1672-
with mock.patch.object(
1673-
google.auth, "default", autospec=True
1674-
) as adc, mock.patch.object(
1675-
grpc_helpers, "create_channel", autospec=True
1676-
) as create_channel:
1677-
creds = ga_credentials.AnonymousCredentials()
1678-
adc.return_value = (creds, None)
1679-
transport_class(quota_project_id="octopus")
1680-
1681-
create_channel.assert_called_with(
1682-
"containeranalysis.googleapis.com:443",
1683-
credentials=creds,
1684-
credentials_file=None,
1685-
quota_project_id="octopus",
1686-
scopes=("https://www.googleapis.com/auth/cloud-platform",),
1687-
ssl_credentials=None,
1688-
options=[
1689-
("grpc.max_send_message_length", -1),
1690-
("grpc.max_receive_message_length", -1),
1691-
],
1692-
)
1693-
1694-
1695-
@pytest.mark.parametrize(
1696-
"transport_class,grpc_helpers",
1697-
[
1698-
(transports.ContainerAnalysisGrpcTransport, grpc_helpers),
1699-
(transports.ContainerAnalysisGrpcAsyncIOTransport, grpc_helpers_async),
1700-
],
1701-
)
1702-
@requires_api_core_lt_1_26_0
1703-
def test_container_analysis_transport_create_channel_user_scopes(
1704-
transport_class, grpc_helpers
1705-
):
1706-
# If credentials and host are not provided, the transport class should use
1707-
# ADC credentials.
1708-
with mock.patch.object(
1709-
google.auth, "default", autospec=True
1710-
) as adc, mock.patch.object(
1711-
grpc_helpers, "create_channel", autospec=True
1712-
) as create_channel:
1713-
creds = ga_credentials.AnonymousCredentials()
1714-
adc.return_value = (creds, None)
1715-
1716-
transport_class(quota_project_id="octopus", scopes=["1", "2"])
1717-
1718-
create_channel.assert_called_with(
1719-
"containeranalysis.googleapis.com:443",
1720-
credentials=creds,
1721-
credentials_file=None,
1722-
quota_project_id="octopus",
1723-
scopes=["1", "2"],
1724-
ssl_credentials=None,
1725-
options=[
1726-
("grpc.max_send_message_length", -1),
1727-
("grpc.max_receive_message_length", -1),
1728-
],
1729-
)
1730-
1731-
17321658
@pytest.mark.parametrize(
17331659
"transport_class",
17341660
[

0 commit comments

Comments
 (0)