Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(storage): store credentials as auth.Credentials #11121

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

chore(storage): store credentials as auth.Credentials #11121

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e81012e
chore(storage): store credentials as auth.Credentials
BrennaEpp Nov 12, 2024
5b942db
Merge branch 'main' into new-auth
BrennaEpp Nov 12, 2024
9f635fb
go mod tidy
BrennaEpp Nov 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions storage/bucket.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -200,11 +200,11 @@ func (b *BucketHandle) SignedURL(object string, opts *SignedURLOptions) (string,
newopts.GoogleAccessID = id
}
if newopts.SignBytes == nil && len(newopts.PrivateKey) == 0 {
if b.c.creds != nil && len(b.c.creds.JSON) > 0 {
if b.c.creds != nil && len(b.c.creds.JSON()) > 0 {
var sa struct {
PrivateKey string `json:"private_key"`
}
err := json.Unmarshal(b.c.creds.JSON, &sa)
err := json.Unmarshal(b.c.creds.JSON(), &sa)
if err == nil && sa.PrivateKey != "" {
newopts.PrivateKey = []byte(sa.PrivateKey)
}
Expand Down Expand Up @@ -248,11 +248,11 @@ func (b *BucketHandle) GenerateSignedPostPolicyV4(object string, opts *PostPolic
newopts.GoogleAccessID = id
}
if newopts.SignBytes == nil && newopts.SignRawBytes == nil && len(newopts.PrivateKey) == 0 {
if b.c.creds != nil && len(b.c.creds.JSON) > 0 {
if b.c.creds != nil && len(b.c.creds.JSON()) > 0 {
var sa struct {
PrivateKey string `json:"private_key"`
}
err := json.Unmarshal(b.c.creds.JSON, &sa)
err := json.Unmarshal(b.c.creds.JSON(), &sa)
if err == nil && sa.PrivateKey != "" {
newopts.PrivateKey = []byte(sa.PrivateKey)
}
Expand All @@ -270,14 +270,14 @@ func (b *BucketHandle) GenerateSignedPostPolicyV4(object string, opts *PostPolic
func (b *BucketHandle) detectDefaultGoogleAccessID() (string, error) {
returnErr := errors.New("no credentials found on client and not on GCE (Google Compute Engine)")

if b.c.creds != nil && len(b.c.creds.JSON) > 0 {
if b.c.creds != nil && len(b.c.creds.JSON()) > 0 {
var sa struct {
ClientEmail string `json:"client_email"`
SAImpersonationURL string `json:"service_account_impersonation_url"`
CredType string `json:"type"`
}

err := json.Unmarshal(b.c.creds.JSON, &sa)
err := json.Unmarshal(b.c.creds.JSON(), &sa)
if err != nil {
returnErr = err
} else {
Expand Down
6 changes: 2 additions & 4 deletions storage/bucket_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,12 +20,12 @@ import (
"testing"
"time"

"cloud.google.com/go/auth"
"cloud.google.com/go/compute/metadata"
"cloud.google.com/go/internal/testutil"
"cloud.google.com/go/storage/internal/apiv2/storagepb"
"github.com/google/go-cmp/cmp"
gax "github.com/googleapis/gax-go/v2"
"golang.org/x/oauth2/google"
"google.golang.org/api/googleapi"
"google.golang.org/api/option"
raw "google.golang.org/api/storage/v1"
Expand Down Expand Up @@ -1292,9 +1292,7 @@ func TestDetectDefaultGoogleAccessID(t *testing.T) {
t.Run(tc.name, func(t *testing.T) {
bucket := BucketHandle{
c: &Client{
creds: &google.Credentials{
JSON: []byte(tc.creds(tc.serviceAccount)),
},
creds: auth.NewCredentials(&auth.CredentialsOptions{JSON: []byte(tc.creds(tc.serviceAccount))}),
},
name: "my-bucket",
}
Expand Down
4 changes: 2 additions & 2 deletions storage/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,8 @@ retract [v1.25.0, v1.27.0] // due to https://github.com/googleapis/google-cloud-

require (
cloud.google.com/go v0.116.0
cloud.google.com/go/auth v0.10.0
cloud.google.com/go/auth/oauth2adapt v0.2.5
cloud.google.com/go/compute/metadata v0.5.2
cloud.google.com/go/iam v1.2.1
cloud.google.com/go/longrunning v0.6.1
Expand All @@ -30,8 +32,6 @@ require (

require (
cel.dev/expr v0.16.1 // indirect
cloud.google.com/go/auth v0.10.0 // indirect
cloud.google.com/go/auth/oauth2adapt v0.2.5 // indirect
cloud.google.com/go/monitoring v1.21.1 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.24.1 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.48.1 // indirect
Expand Down
11 changes: 6 additions & 5 deletions storage/http_client.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,11 +31,12 @@ import (
"strings"
"time"

"cloud.google.com/go/auth"
"cloud.google.com/go/auth/oauth2adapt"
"cloud.google.com/go/iam/apiv1/iampb"
"cloud.google.com/go/internal/optional"
"cloud.google.com/go/internal/trace"
"github.com/googleapis/gax-go/v2/callctx"
"golang.org/x/oauth2/google"
"google.golang.org/api/googleapi"
"google.golang.org/api/iterator"
"google.golang.org/api/option"
Expand All @@ -48,7 +49,7 @@ import (
// httpStorageClient is the HTTP-JSON API implementation of the transport-agnostic
// storageClient interface.
type httpStorageClient struct {
creds *google.Credentials
creds *auth.Credentials
hc *http.Client
xmlHost string
raw *raw.Service
Expand All @@ -65,7 +66,7 @@ func newHTTPStorageClient(ctx context.Context, opts ...storageOption) (storageCl
o := s.clientOption
config := newStorageConfig(o...)

var creds *google.Credentials
var creds *auth.Credentials
// In general, it is recommended to use raw.NewService instead of htransport.NewClient
// since raw.NewService configures the correct default endpoints when initializing the
// internal http client. However, in our case, "NewRangeReader" in reader.go needs to
Expand All @@ -85,8 +86,8 @@ func newHTTPStorageClient(ctx context.Context, opts ...storageOption) (storageCl
// client which does not auth with ADC or other common conventions.
c, err := transport.Creds(ctx, o...)
if err == nil {
creds = c
o = append(o, internaloption.WithCredentials(creds))
creds = oauth2adapt.AuthCredentialsFromOauth2Credentials(c)
o = append(o, internaloption.WithCredentials(c))
}
} else {
var hostURL *url.URL
Expand Down
16 changes: 12 additions & 4 deletions storage/integration_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,8 @@ import (
"testing"
"time"

"cloud.google.com/go/auth"
"cloud.google.com/go/auth/oauth2adapt"
"cloud.google.com/go/httpreplay"
"cloud.google.com/go/iam"
"cloud.google.com/go/iam/apiv1/iampb"
Expand Down Expand Up @@ -5537,7 +5539,7 @@ func TestIntegration_SignedURL_WithCreds(t *testing.T) {
if err := verifySignedURL(url, nil, contents); err != nil {
t.Fatalf("problem with the signed URL: %v", err)
}
}, option.WithCredentials(creds))
}, option.WithAuthCredentials(creds))
}

func TestIntegration_SignedURL_DefaultSignBytes(t *testing.T) {
Expand Down Expand Up @@ -5639,7 +5641,7 @@ func TestIntegration_PostPolicyV4_WithCreds(t *testing.T) {
}
})
}
}, option.WithCredentials(creds))
}, option.WithAuthCredentials(creds))

}

Expand Down Expand Up @@ -5880,7 +5882,7 @@ func verifyPostPolicy(pv4 *PostPolicyV4, obj *ObjectHandle, bytesToWrite []byte,
})
}

func findTestCredentials(ctx context.Context, envVar string, scopes ...string) (*google.Credentials, error) {
func findTestCredentials(ctx context.Context, envVar string, scopes ...string) (*auth.Credentials, error) {
key := os.Getenv(envVar)
var opts []option.ClientOption
if len(scopes) > 0 {
Expand All @@ -5889,7 +5891,13 @@ func findTestCredentials(ctx context.Context, envVar string, scopes ...string) (
if key != "" {
opts = append(opts, option.WithCredentialsFile(key))
}
return transport.Creds(ctx, opts...)

c, err := transport.Creds(ctx, opts...)
if err != nil {
return nil, err
}

return oauth2adapt.AuthCredentialsFromOauth2Credentials(c), nil
}

type testHelper struct {
Expand Down
12 changes: 7 additions & 5 deletions storage/storage.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,12 +38,13 @@ import (
"time"
"unicode/utf8"

"cloud.google.com/go/auth"
"cloud.google.com/go/auth/oauth2adapt"
"cloud.google.com/go/internal/optional"
"cloud.google.com/go/internal/trace"
"cloud.google.com/go/storage/internal"
"cloud.google.com/go/storage/internal/apiv2/storagepb"
"github.com/googleapis/gax-go/v2"
"golang.org/x/oauth2/google"
"google.golang.org/api/googleapi"
"google.golang.org/api/option"
"google.golang.org/api/option/internaloption"
Expand Down Expand Up @@ -112,7 +113,7 @@ type Client struct {
// xmlHost is the default host used for XML requests.
xmlHost string
// May be nil.
creds *google.Credentials
creds *auth.Credentials
retry *retryConfig

// tc is the transport-agnostic client implemented with either gRPC or HTTP.
Expand All @@ -129,7 +130,7 @@ type Client struct {
// You may configure the client by passing in options from the [google.golang.org/api/option]
// package. You may also use options defined in this package, such as [WithJSONReads].
func NewClient(ctx context.Context, opts ...option.ClientOption) (*Client, error) {
var creds *google.Credentials
var creds *auth.Credentials

// In general, it is recommended to use raw.NewService instead of htransport.NewClient
// since raw.NewService configures the correct default endpoints when initializing the
Expand All @@ -151,9 +152,10 @@ func NewClient(ctx context.Context, opts ...option.ClientOption) (*Client, error
// client which does not auth with ADC or other common conventions.
c, err := transport.Creds(ctx, opts...)
if err == nil {
creds = c
opts = append(opts, internaloption.WithCredentials(creds))
creds = oauth2adapt.AuthCredentialsFromOauth2Credentials(c)
opts = append(opts, internaloption.WithCredentials(c))
}

} else {
var hostURL *url.URL

Expand Down
Loading