Merge pull request #1479 from dhermes/oauth2client-2.0

Upgrading to oauth2client 2.0.

Author: dhermes

gcloud/credentials.py

@@ -29,7 +29,7 @@
 from oauth2client import client
 from oauth2client.client import _get_application_default_credential_from_file
 from oauth2client import crypt
-from oauth2client import service_account
+from oauth2client.service_account import ServiceAccountCredentials
 try:
     from oauth2client.appengine import AppAssertionCredentials as _GAECreds
 except ImportError:
@@ -95,7 +95,7 @@ def get_credentials():
     :rtype: :class:`oauth2client.client.GoogleCredentials`,
             :class:`oauth2client.contrib.appengine.AppAssertionCredentials`,
             :class:`oauth2client.contrib.gce.AppAssertionCredentials`,
-            :class:`oauth2client.service_account._ServiceAccountCredentials`
+            :class:`oauth2client.service_account.ServiceAccountCredentials`
     :returns: A new credentials instance corresponding to the implicit
               environment.
     """
@@ -120,7 +120,7 @@ def get_for_service_account_json(json_credentials_path, scope=None):
                   particular API.)
 
     :rtype: :class:`oauth2client.client.GoogleCredentials`,
-            :class:`oauth2client.service_account._ServiceAccountCredentials`
+            :class:`oauth2client.service_account.ServiceAccountCredentials`
     :returns: New service account or Google (for a user JSON key file)
               credentials object.
     """
@@ -154,21 +154,18 @@ def get_for_service_account_p12(client_email, private_key_path, scope=None):
                   scope is required for the different levels of access to any
                   particular API.)
 
-    :rtype: :class:`oauth2client.client.SignedJwtAssertionCredentials`
-    :returns: A new ``SignedJwtAssertionCredentials`` instance with the
+    :rtype: :class:`oauth2client.service_account.ServiceAccountCredentials`
+    :returns: A new ``ServiceAccountCredentials`` instance with the
               needed service account settings.
     """
-    return client.SignedJwtAssertionCredentials(
-        service_account_name=client_email,
-        private_key=open(private_key_path, 'rb').read(),
-        scope=scope)
+    return ServiceAccountCredentials.from_p12_keyfile(
+        client_email, private_key_path, scopes=scope)
 
 
 def _get_pem_key(credentials):
     """Gets private key for a PEM payload from a credentials object.
 
-    :type credentials: :class:`client.SignedJwtAssertionCredentials`,
-                       :class:`service_account._ServiceAccountCredentials`
+    :type credentials: :class:`service_account.ServiceAccountCredentials`,
     :param credentials: The credentials used to create a private key
                         for signing text.
 
@@ -177,12 +174,14 @@ def _get_pem_key(credentials):
     :raises: `TypeError` if `credentials` is the wrong type.
              `EnvironmentError` if `crypto` did not import successfully.
     """
-    if isinstance(credentials, client.SignedJwtAssertionCredentials):
-        # Take our PKCS12 (.p12) text and convert to PEM text.
-        pem_text = crypt.pkcs12_key_as_pem(credentials.private_key,
-                                           credentials.private_key_password)
-    elif isinstance(credentials, service_account._ServiceAccountCredentials):
-        pem_text = credentials._private_key_pkcs8_text
+    if isinstance(credentials, ServiceAccountCredentials):
+        if credentials._private_key_pkcs12 is not None:
+            # Take our PKCS12 (.p12) text and convert to PEM text.
+            pem_text = crypt.pkcs12_key_as_pem(
+                credentials._private_key_pkcs12,
+                credentials._private_key_password)
+        else:
+            pem_text = credentials._private_key_pkcs8_pem
     else:
         raise TypeError((credentials,
                          'not a valid service account credentials type'))
@@ -196,8 +195,7 @@ def _get_pem_key(credentials):
 def _get_signature_bytes(credentials, string_to_sign):
     """Uses crypto attributes of credentials to sign a string/bytes.
 
-    :type credentials: :class:`client.SignedJwtAssertionCredentials`,
-                       :class:`service_account._ServiceAccountCredentials`,
+    :type credentials: :class:`service_account.ServiceAccountCredentials`,
                        :class:`_GAECreds`
     :param credentials: The credentials used for signing text (typically
                         involves the creation of a PKey).
@@ -227,8 +225,7 @@ def _get_signature_bytes(credentials, string_to_sign):
 def _get_service_account_name(credentials):
     """Determines service account name from a credentials object.
 
-    :type credentials: :class:`client.SignedJwtAssertionCredentials`,
-                       :class:`service_account._ServiceAccountCredentials`,
+    :type credentials: :class:`service_account.ServiceAccountCredentials`,
                        :class:`_GAECreds`
     :param credentials: The credentials used to determine the service
                         account name.
@@ -239,10 +236,8 @@ def _get_service_account_name(credentials):
              account type.
     """
     service_account_name = None
-    if isinstance(credentials, client.SignedJwtAssertionCredentials):
-        service_account_name = credentials.service_account_name
-    elif isinstance(credentials, service_account._ServiceAccountCredentials):
-        service_account_name = credentials._service_account_email
+    if isinstance(credentials, ServiceAccountCredentials):
+        service_account_name = credentials.service_account_email
     elif isinstance(credentials, _GAECreds):
         service_account_name = app_identity.get_service_account_name()
 
@@ -255,8 +250,7 @@ def _get_service_account_name(credentials):
 def _get_signed_query_params(credentials, expiration, string_to_sign):
     """Gets query parameters for creating a signed URL.
 
-    :type credentials: :class:`client.SignedJwtAssertionCredentials`,
-                       :class:`service_account._ServiceAccountCredentials`
+    :type credentials: :class:`service_account.ServiceAccountCredentials`
     :param credentials: The credentials used to create a private key
                         for signing text.
 

gcloud/test_credentials.py

@@ -90,47 +90,31 @@ def _callFUT(self, client_email, private_key_path, scope=None):
     def test_it(self):
         from gcloud import credentials as MUT
         from gcloud._testing import _Monkey
-        from gcloud._testing import _NamedTemporaryFile
 
         CLIENT_EMAIL = 'phred@example.com'
-        PRIVATE_KEY = b'SEEkR1t'
-        client = _Client()
-        with _Monkey(MUT, client=client):
-            with _NamedTemporaryFile() as temp:
-                with open(temp.name, 'wb') as file_obj:
-                    file_obj.write(PRIVATE_KEY)
-                found = self._callFUT(CLIENT_EMAIL, temp.name)
+        MOCK_FILENAME = 'foo.path'
+        MOCK_CRED_CLASS = _MockServiceAccountCredentials()
+        with _Monkey(MUT, ServiceAccountCredentials=MOCK_CRED_CLASS):
+            found = self._callFUT(CLIENT_EMAIL, MOCK_FILENAME)
 
-        self.assertTrue(found is client._signed)
-        expected_called_with = {
-            'service_account_name': CLIENT_EMAIL,
-            'private_key': PRIVATE_KEY,
-            'scope': None,
-        }
-        self.assertEqual(client._called_with, expected_called_with)
+        self.assertTrue(found is MOCK_CRED_CLASS._result)
+        self.assertEqual(MOCK_CRED_CLASS.p12_called,
+                         [(CLIENT_EMAIL, MOCK_FILENAME, None)])
 
     def test_it_with_scope(self):
         from gcloud import credentials as MUT
         from gcloud._testing import _Monkey
-        from gcloud._testing import _NamedTemporaryFile
 
         CLIENT_EMAIL = 'phred@example.com'
-        PRIVATE_KEY = b'SEEkR1t'
         SCOPE = 'SCOPE'
-        client = _Client()
-        with _Monkey(MUT, client=client):
-            with _NamedTemporaryFile() as temp:
-                with open(temp.name, 'wb') as file_obj:
-                    file_obj.write(PRIVATE_KEY)
-                found = self._callFUT(CLIENT_EMAIL, temp.name, SCOPE)
+        MOCK_FILENAME = 'foo.path'
+        MOCK_CRED_CLASS = _MockServiceAccountCredentials()
+        with _Monkey(MUT, ServiceAccountCredentials=MOCK_CRED_CLASS):
+            found = self._callFUT(CLIENT_EMAIL, MOCK_FILENAME, SCOPE)
 
-        self.assertTrue(found is client._signed)
-        expected_called_with = {
-            'service_account_name': CLIENT_EMAIL,
-            'private_key': PRIVATE_KEY,
-            'scope': SCOPE,
-        }
-        self.assertEqual(client._called_with, expected_called_with)
+        self.assertTrue(found is MOCK_CRED_CLASS._result)
+        self.assertEqual(MOCK_CRED_CLASS.p12_called,
+                         [(CLIENT_EMAIL, MOCK_FILENAME, SCOPE)])
 
 
 class Test_get_for_service_account_json(unittest2.TestCase):
@@ -279,8 +263,7 @@ def _run_with_fake_crypto(self, credentials, private_key_text,
             result = self._callFUT(credentials, string_to_sign)
 
         if crypt._pkcs12_key_as_pem_called:
-            self.assertEqual(crypt._private_key_text,
-                             base64.b64encode(private_key_text))
+            self.assertEqual(crypt._private_key_text, private_key_text)
             self.assertEqual(crypt._private_key_password, 'notasecret')
             self.assertEqual(openssl_crypto._loaded,
                              [(openssl_crypto.FILETYPE_PEM, _Crypt._KEY)])
@@ -296,22 +279,28 @@ def _run_with_fake_crypto(self, credentials, private_key_text,
         self.assertEqual(result, sign_result)
 
     def test_p12_type(self):
-        from oauth2client.client import SignedJwtAssertionCredentials
+        from oauth2client.service_account import ServiceAccountCredentials
         ACCOUNT_NAME = 'dummy_service_account_name'
         PRIVATE_KEY_TEXT = b'dummy_private_key_text'
         STRING_TO_SIGN = b'dummy_signature'
-        CREDENTIALS = SignedJwtAssertionCredentials(
-            ACCOUNT_NAME, PRIVATE_KEY_TEXT, [])
+        SIGNER = object()
+        CREDENTIALS = ServiceAccountCredentials(
+            ACCOUNT_NAME, SIGNER)
+        CREDENTIALS._private_key_pkcs12 = PRIVATE_KEY_TEXT
+        CREDENTIALS._private_key_password = 'notasecret'
         self._run_with_fake_crypto(CREDENTIALS, PRIVATE_KEY_TEXT,
                                    STRING_TO_SIGN)
 
     def test_p12_type_non_bytes_to_sign(self):
-        from oauth2client.client import SignedJwtAssertionCredentials
+        from oauth2client.service_account import ServiceAccountCredentials
         ACCOUNT_NAME = 'dummy_service_account_name'
         PRIVATE_KEY_TEXT = b'dummy_private_key_text'
         STRING_TO_SIGN = u'dummy_signature'
-        CREDENTIALS = SignedJwtAssertionCredentials(
-            ACCOUNT_NAME, PRIVATE_KEY_TEXT, [])
+        SIGNER = object()
+        CREDENTIALS = ServiceAccountCredentials(
+            ACCOUNT_NAME, SIGNER)
+        CREDENTIALS._private_key_pkcs12 = PRIVATE_KEY_TEXT
+        CREDENTIALS._private_key_password = 'notasecret'
         self._run_with_fake_crypto(CREDENTIALS, PRIVATE_KEY_TEXT,
                                    STRING_TO_SIGN)
 
@@ -321,21 +310,16 @@ def test_json_type(self):
 
         PRIVATE_KEY_TEXT = 'dummy_private_key_pkcs8_text'
         STRING_TO_SIGN = b'dummy_signature'
-
-        def _get_private_key(private_key_pkcs8_text):
-            return private_key_pkcs8_text
-
-        with _Monkey(service_account, _get_private_key=_get_private_key):
-            CREDENTIALS = service_account._ServiceAccountCredentials(
-                'dummy_service_account_id', 'dummy_service_account_email',
-                'dummy_private_key_id', PRIVATE_KEY_TEXT, [])
-
+        SIGNER = object()
+        CREDENTIALS = service_account.ServiceAccountCredentials(
+            'dummy_service_account_email', SIGNER)
+        CREDENTIALS._private_key_pkcs8_pem = PRIVATE_KEY_TEXT
         self._run_with_fake_crypto(CREDENTIALS, PRIVATE_KEY_TEXT,
                                    STRING_TO_SIGN)
 
     def test_gae_type(self):
         # Relies on setUp fixing up App Engine imports.
-        from oauth2client.appengine import AppAssertionCredentials
+        from oauth2client.contrib.appengine import AppAssertionCredentials
         from gcloud._testing import _Monkey
         from gcloud import credentials
 
@@ -387,33 +371,20 @@ def test_bad_type(self):
                                         None, None, None)
         self.assertRaises(ValueError, self._callFUT, CREDENTIALS)
 
-    def test_p12_type(self):
-        from oauth2client.client import SignedJwtAssertionCredentials
-        SERVICE_ACCOUNT_NAME = 'SERVICE_ACCOUNT_NAME'
-        CREDENTIALS = SignedJwtAssertionCredentials(SERVICE_ACCOUNT_NAME,
-                                                    b'bogus_key', [])
-        found = self._callFUT(CREDENTIALS)
-        self.assertEqual(found, SERVICE_ACCOUNT_NAME)
-
-    def test_json_type(self):
+    def test_service_account_type(self):
         from oauth2client import service_account
-        from gcloud._testing import _Monkey
-
-        def _get_private_key(private_key_pkcs8_text):
-            return private_key_pkcs8_text
 
         SERVICE_ACCOUNT_NAME = 'SERVICE_ACCOUNT_NAME'
-        with _Monkey(service_account, _get_private_key=_get_private_key):
-            CREDENTIALS = service_account._ServiceAccountCredentials(
-                'bogus_id', SERVICE_ACCOUNT_NAME, 'bogus_id',
-                'bogus_key_text', [])
+        SIGNER = object()
+        CREDENTIALS = service_account.ServiceAccountCredentials(
+            SERVICE_ACCOUNT_NAME, SIGNER)
 
         found = self._callFUT(CREDENTIALS)
         self.assertEqual(found, SERVICE_ACCOUNT_NAME)
 
     def test_gae_type(self):
         # Relies on setUp fixing up App Engine imports.
-        from oauth2client.appengine import AppAssertionCredentials
+        from oauth2client.contrib.appengine import AppAssertionCredentials
         from gcloud._testing import _Monkey
         from gcloud import credentials
 
@@ -483,25 +454,26 @@ def test_bad_argument(self):
         self.assertRaises(TypeError, self._callFUT, None)
 
     def test_signed_jwt_for_p12(self):
-        import base64
-        from oauth2client import client
+        from oauth2client import service_account
         from gcloud._testing import _Monkey
         from gcloud import credentials as MUT
 
-        scopes = []
         PRIVATE_KEY = b'dummy_private_key_text'
-        credentials = client.SignedJwtAssertionCredentials(
-            'dummy_service_account_name', PRIVATE_KEY, scopes)
+        SIGNER = object()
+        credentials = service_account.ServiceAccountCredentials(
+            'dummy_service_account_email', SIGNER)
+        credentials._private_key_pkcs12 = PRIVATE_KEY
+        credentials._private_key_password = password = 'password-nope'
+
         crypt = _Crypt()
         load_result = object()
         openssl_crypto = _OpenSSLCrypto(load_result, None)
 
         with _Monkey(MUT, crypt=crypt, crypto=openssl_crypto):
             result = self._callFUT(credentials)
 
-        self.assertEqual(crypt._private_key_text,
-                         base64.b64encode(PRIVATE_KEY))
-        self.assertEqual(crypt._private_key_password, 'notasecret')
+        self.assertEqual(crypt._private_key_text, PRIVATE_KEY)
+        self.assertEqual(crypt._private_key_password, password)
         self.assertEqual(result, load_result)
         self.assertEqual(openssl_crypto._loaded,
                          [(openssl_crypto.FILETYPE_PEM, _Crypt._KEY)])
@@ -515,14 +487,10 @@ def test_service_account_via_json_key(self):
         scopes = []
 
         PRIVATE_TEXT = 'dummy_private_key_pkcs8_text'
-
-        def _get_private_key(private_key_pkcs8_text):
-            return private_key_pkcs8_text
-
-        with _Monkey(service_account, _get_private_key=_get_private_key):
-            credentials = service_account._ServiceAccountCredentials(
-                'dummy_service_account_id', 'dummy_service_account_email',
-                'dummy_private_key_id', PRIVATE_TEXT, scopes)
+        SIGNER = object()
+        credentials = service_account.ServiceAccountCredentials(
+            'dummy_service_account_email', SIGNER, scopes=scopes)
+        credentials._private_key_pkcs8_pem = PRIVATE_TEXT
 
         load_result = object()
         openssl_crypto = _OpenSSLCrypto(load_result, None)
@@ -541,14 +509,11 @@ def test_without_pyopenssl(self):
         from gcloud import credentials as credentials_mod
 
         PRIVATE_TEXT = 'dummy_private_key_pkcs8_text'
+        SIGNER = object()
 
-        def _get_private_key(private_key_pkcs8_text):
-            return private_key_pkcs8_text
-
-        with _Monkey(service_account, _get_private_key=_get_private_key):
-            credentials = service_account._ServiceAccountCredentials(
-                'dummy_service_account_id', 'dummy_service_account_email',
-                'dummy_private_key_id', PRIVATE_TEXT, '')
+        credentials = service_account.ServiceAccountCredentials(
+            'dummy_service_account_email', SIGNER)
+        credentials._private_key_pkcs8_pem = PRIVATE_TEXT
 
         with _Monkey(credentials_mod, crypto=None):
             with self.assertRaises(EnvironmentError):
@@ -648,6 +613,7 @@ def create_scoped(self, scopes):
 
 
 class _Client(object):
+
     def __init__(self):
         self._signed = _Credentials()
 
@@ -659,10 +625,6 @@ def get_application_default():
 
         self.GoogleCredentials = GoogleCredentials
 
-    def SignedJwtAssertionCredentials(self, **kw):
-        self._called_with = kw
-        return self._signed
-
 
 class _Crypt(object):
 
@@ -724,3 +686,14 @@ def non_transactional(*args, **kwargs):
         def do_nothing_wrapper(func):
             return func
         return do_nothing_wrapper
+
+
+class _MockServiceAccountCredentials(object):
+
+    def __init__(self):
+        self.p12_called = []
+        self._result = _Credentials()
+
+    def from_p12_keyfile(self, email, path, scopes=None):
+        self.p12_called.append((email, path, scopes))
+        return self._result