Skip to content
This repository was archived by the owner on Jul 6, 2023. It is now read-only.

Commit 1fd37ac

Browse files
gcf-owl-bot[bot]gcf-owl-bot[bot]
authored
feat: add always_use_jwt_access (#44)
... chore: update gapic-generator-ruby to the latest commit chore: release gapic-generator-typescript 1.5.0 Committer: @miraleung PiperOrigin-RevId: 380641501 Source-Link: googleapis/googleapis@076f7e9 Source-Link: https://github.com/googleapis/googleapis-gen/commit/27e4c88b4048e5f56508d4e1aa417d60a3380892
1 parent 7358e87 commit 1fd37ac

7 files changed

Lines changed: 40 additions & 124 deletions

File tree

‎.coveragerc‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22
branch = True
33

44
[report]
5-
fail_under = 100
65
show_missing = True
76
omit =
87
google/cloud/managedidentities/__init__.py

‎google/cloud/managedidentities_v1/services/managed_identities_service/transports/base.py‎

Lines changed: 14 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
from google.api_core import retry as retries # type: ignore
2626
from google.api_core import operations_v1 # type: ignore
2727
from google.auth import credentials as ga_credentials # type: ignore
28+
from google.oauth2 import service_account # type: ignore
2829

2930
from google.cloud.managedidentities_v1.types import managed_identities_service
3031
from google.cloud.managedidentities_v1.types import resource
@@ -48,8 +49,6 @@
4849
except pkg_resources.DistributionNotFound: # pragma: NO COVER
4950
_GOOGLE_AUTH_VERSION = None
5051

51-
_API_CORE_VERSION = google.api_core.__version__
52-
5352

5453
class ManagedIdentitiesServiceTransport(abc.ABC):
5554
"""Abstract transport class for ManagedIdentitiesService."""
@@ -67,6 +66,7 @@ def __init__(
6766
scopes: Optional[Sequence[str]] = None,
6867
quota_project_id: Optional[str] = None,
6968
client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO,
69+
always_use_jwt_access: Optional[bool] = False,
7070
**kwargs,
7171
) -> None:
7272
"""Instantiate the transport.
@@ -90,6 +90,8 @@ def __init__(
9090
API requests. If ``None``, then default info will be used.
9191
Generally, you only need to set this if you're developing
9292
your own client library.
93+
always_use_jwt_access (Optional[bool]): Whether self signed JWT should
94+
be used for service account credentials.
9395
"""
9496
# Save the hostname. Default to port 443 (HTTPS) if none is specified.
9597
if ":" not in host:
@@ -118,13 +120,20 @@ def __init__(
118120
**scopes_kwargs, quota_project_id=quota_project_id
119121
)
120122

123+
# If the credentials is service account credentials, then always try to use self signed JWT.
124+
if (
125+
always_use_jwt_access
126+
and isinstance(credentials, service_account.Credentials)
127+
and hasattr(service_account.Credentials, "with_always_use_jwt_access")
128+
):
129+
credentials = credentials.with_always_use_jwt_access(True)
130+
121131
# Save the credentials.
122132
self._credentials = credentials
123133

124-
# TODO(busunkim): These two class methods are in the base transport
134+
# TODO(busunkim): This method is in the base transport
125135
# to avoid duplicating code across the transport classes. These functions
126-
# should be deleted once the minimum required versions of google-api-core
127-
# and google-auth are increased.
136+
# should be deleted once the minimum required versions of google-auth is increased.
128137

129138
# TODO: Remove this function once google-auth >= 1.25.0 is required
130139
@classmethod
@@ -145,27 +154,6 @@ def _get_scopes_kwargs(
145154

146155
return scopes_kwargs
147156

148-
# TODO: Remove this function once google-api-core >= 1.26.0 is required
149-
@classmethod
150-
def _get_self_signed_jwt_kwargs(
151-
cls, host: str, scopes: Optional[Sequence[str]]
152-
) -> Dict[str, Union[Optional[Sequence[str]], str]]:
153-
"""Returns kwargs to pass to grpc_helpers.create_channel depending on the google-api-core version"""
154-
155-
self_signed_jwt_kwargs: Dict[str, Union[Optional[Sequence[str]], str]] = {}
156-
157-
if _API_CORE_VERSION and (
158-
packaging.version.parse(_API_CORE_VERSION)
159-
>= packaging.version.parse("1.26.0")
160-
):
161-
self_signed_jwt_kwargs["default_scopes"] = cls.AUTH_SCOPES
162-
self_signed_jwt_kwargs["scopes"] = scopes
163-
self_signed_jwt_kwargs["default_host"] = cls.DEFAULT_HOST
164-
else:
165-
self_signed_jwt_kwargs["scopes"] = scopes or cls.AUTH_SCOPES
166-
167-
return self_signed_jwt_kwargs
168-
169157
def _prep_wrapped_messages(self, client_info):
170158
# Precompute the wrapped methods.
171159
self._wrapped_methods = {

‎google/cloud/managedidentities_v1/services/managed_identities_service/transports/grpc.py‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -187,6 +187,7 @@ def __init__(
187187
scopes=scopes,
188188
quota_project_id=quota_project_id,
189189
client_info=client_info,
190+
always_use_jwt_access=True,
190191
)
191192

192193
if not self._grpc_channel:
@@ -242,14 +243,14 @@ def create_channel(
242243
and ``credentials_file`` are passed.
243244
"""
244245

245-
self_signed_jwt_kwargs = cls._get_self_signed_jwt_kwargs(host, scopes)
246-
247246
return grpc_helpers.create_channel(
248247
host,
249248
credentials=credentials,
250249
credentials_file=credentials_file,
251250
quota_project_id=quota_project_id,
252-
**self_signed_jwt_kwargs,
251+
default_scopes=cls.AUTH_SCOPES,
252+
scopes=scopes,
253+
default_host=cls.DEFAULT_HOST,
253254
**kwargs,
254255
)
255256

‎google/cloud/managedidentities_v1/services/managed_identities_service/transports/grpc_asyncio.py‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -115,14 +115,14 @@ def create_channel(
115115
aio.Channel: A gRPC AsyncIO channel object.
116116
"""
117117

118-
self_signed_jwt_kwargs = cls._get_self_signed_jwt_kwargs(host, scopes)
119-
120118
return grpc_helpers_async.create_channel(
121119
host,
122120
credentials=credentials,
123121
credentials_file=credentials_file,
124122
quota_project_id=quota_project_id,
125-
**self_signed_jwt_kwargs,
123+
default_scopes=cls.AUTH_SCOPES,
124+
scopes=scopes,
125+
default_host=cls.DEFAULT_HOST,
126126
**kwargs,
127127
)
128128

@@ -233,6 +233,7 @@ def __init__(
233233
scopes=scopes,
234234
quota_project_id=quota_project_id,
235235
client_info=client_info,
236+
always_use_jwt_access=True,
236237
)
237238

238239
if not self._grpc_channel:

‎setup.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
release_status = "Development Status :: 5 - Production/Stable"
2626
url = "https://github.com/googleapis/python-managed-identities"
2727
dependencies = [
28-
"google-api-core[grpc] >= 1.22.2, < 2.0.0dev",
28+
"google-api-core[grpc] >= 1.26.0, <2.0.0dev",
2929
"libcst >= 0.2.5",
3030
"proto-plus >= 1.4.0",
3131
"packaging >= 14.3",

‎testing/constraints-3.6.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
#
2020
# e.g., if setup.py has "foo >= 1.14.0, < 2.0.0dev",
2121
# Then this file should have foo==1.14.0
22-
google-api-core==1.22.2
22+
google-api-core==1.26.0
2323
libcst==0.2.5
2424
proto-plus==1.4.0
2525
packaging==14.3

‎tests/unit/gapic/managedidentities_v1/test_managed_identities_service.py‎

Lines changed: 16 additions & 89 deletions
Original file line numberDiff line numberDiff line change
@@ -44,9 +44,6 @@
4444
from google.cloud.managedidentities_v1.services.managed_identities_service import (
4545
transports,
4646
)
47-
from google.cloud.managedidentities_v1.services.managed_identities_service.transports.base import (
48-
_API_CORE_VERSION,
49-
)
5047
from google.cloud.managedidentities_v1.services.managed_identities_service.transports.base import (
5148
_GOOGLE_AUTH_VERSION,
5249
)
@@ -59,8 +56,9 @@
5956
import google.auth
6057

6158

62-
# TODO(busunkim): Once google-api-core >= 1.26.0 is required:
63-
# - Delete all the api-core and auth "less than" test cases
59+
# TODO(busunkim): Once google-auth >= 1.25.0 is required transitively
60+
# through google-api-core:
61+
# - Delete the auth "less than" test cases
6462
# - Delete these pytest markers (Make the "greater than or equal to" tests the default).
6563
requires_google_auth_lt_1_25_0 = pytest.mark.skipif(
6664
packaging.version.parse(_GOOGLE_AUTH_VERSION) >= packaging.version.parse("1.25.0"),
@@ -71,16 +69,6 @@
7169
reason="This test requires google-auth >= 1.25.0",
7270
)
7371

74-
requires_api_core_lt_1_26_0 = pytest.mark.skipif(
75-
packaging.version.parse(_API_CORE_VERSION) >= packaging.version.parse("1.26.0"),
76-
reason="This test requires google-api-core < 1.26.0",
77-
)
78-
79-
requires_api_core_gte_1_26_0 = pytest.mark.skipif(
80-
packaging.version.parse(_API_CORE_VERSION) < packaging.version.parse("1.26.0"),
81-
reason="This test requires google-api-core >= 1.26.0",
82-
)
83-
8472

8573
def client_cert_source_callback():
8674
return b"cert bytes", b"key bytes"
@@ -145,6 +133,19 @@ def test_managed_identities_service_client_from_service_account_info(client_clas
145133
assert client.transport._host == "managedidentities.googleapis.com:443"
146134

147135

136+
@pytest.mark.parametrize(
137+
"client_class",
138+
[ManagedIdentitiesServiceClient, ManagedIdentitiesServiceAsyncClient,],
139+
)
140+
def test_managed_identities_service_client_service_account_always_use_jwt(client_class):
141+
with mock.patch.object(
142+
service_account.Credentials, "with_always_use_jwt_access", create=True
143+
) as use_jwt:
144+
creds = service_account.Credentials(None, None, None)
145+
client = client_class(credentials=creds)
146+
use_jwt.assert_called_with(True)
147+
148+
148149
@pytest.mark.parametrize(
149150
"client_class",
150151
[ManagedIdentitiesServiceClient, ManagedIdentitiesServiceAsyncClient,],
@@ -3155,7 +3156,6 @@ def test_managed_identities_service_transport_auth_adc_old_google_auth(transport
31553156
(transports.ManagedIdentitiesServiceGrpcAsyncIOTransport, grpc_helpers_async),
31563157
],
31573158
)
3158-
@requires_api_core_gte_1_26_0
31593159
def test_managed_identities_service_transport_create_channel(
31603160
transport_class, grpc_helpers
31613161
):
@@ -3186,79 +3186,6 @@ def test_managed_identities_service_transport_create_channel(
31863186
)
31873187

31883188

3189-
@pytest.mark.parametrize(
3190-
"transport_class,grpc_helpers",
3191-
[
3192-
(transports.ManagedIdentitiesServiceGrpcTransport, grpc_helpers),
3193-
(transports.ManagedIdentitiesServiceGrpcAsyncIOTransport, grpc_helpers_async),
3194-
],
3195-
)
3196-
@requires_api_core_lt_1_26_0
3197-
def test_managed_identities_service_transport_create_channel_old_api_core(
3198-
transport_class, grpc_helpers
3199-
):
3200-
# If credentials and host are not provided, the transport class should use
3201-
# ADC credentials.
3202-
with mock.patch.object(
3203-
google.auth, "default", autospec=True
3204-
) as adc, mock.patch.object(
3205-
grpc_helpers, "create_channel", autospec=True
3206-
) as create_channel:
3207-
creds = ga_credentials.AnonymousCredentials()
3208-
adc.return_value = (creds, None)
3209-
transport_class(quota_project_id="octopus")
3210-
3211-
create_channel.assert_called_with(
3212-
"managedidentities.googleapis.com:443",
3213-
credentials=creds,
3214-
credentials_file=None,
3215-
quota_project_id="octopus",
3216-
scopes=("https://www.googleapis.com/auth/cloud-platform",),
3217-
ssl_credentials=None,
3218-
options=[
3219-
("grpc.max_send_message_length", -1),
3220-
("grpc.max_receive_message_length", -1),
3221-
],
3222-
)
3223-
3224-
3225-
@pytest.mark.parametrize(
3226-
"transport_class,grpc_helpers",
3227-
[
3228-
(transports.ManagedIdentitiesServiceGrpcTransport, grpc_helpers),
3229-
(transports.ManagedIdentitiesServiceGrpcAsyncIOTransport, grpc_helpers_async),
3230-
],
3231-
)
3232-
@requires_api_core_lt_1_26_0
3233-
def test_managed_identities_service_transport_create_channel_user_scopes(
3234-
transport_class, grpc_helpers
3235-
):
3236-
# If credentials and host are not provided, the transport class should use
3237-
# ADC credentials.
3238-
with mock.patch.object(
3239-
google.auth, "default", autospec=True
3240-
) as adc, mock.patch.object(
3241-
grpc_helpers, "create_channel", autospec=True
3242-
) as create_channel:
3243-
creds = ga_credentials.AnonymousCredentials()
3244-
adc.return_value = (creds, None)
3245-
3246-
transport_class(quota_project_id="octopus", scopes=["1", "2"])
3247-
3248-
create_channel.assert_called_with(
3249-
"managedidentities.googleapis.com:443",
3250-
credentials=creds,
3251-
credentials_file=None,
3252-
quota_project_id="octopus",
3253-
scopes=["1", "2"],
3254-
ssl_credentials=None,
3255-
options=[
3256-
("grpc.max_send_message_length", -1),
3257-
("grpc.max_receive_message_length", -1),
3258-
],
3259-
)
3260-
3261-
32623189
@pytest.mark.parametrize(
32633190
"transport_class",
32643191
[

0 commit comments

Comments
 (0)