Validate projects

[TomAugspurger]

cc @DPGrev, this would have caught the issue earlier, if the cause of #218 is the same as mine.

[TomAugspurger]

cc @martindurant if you have a chance to weigh in on whether

GCSFileSystem(project="foo", token="google_default")

should raise when the google default returns a different project than what was requested in project=.

[martindurant]

A user can have access to multiple projects, so I'm not sure if we can be definitive about it, without trying something against the google api.

[TomAugspurger]

without trying something against the google api.

What do you mean by this? In this case, we are hitting the google API for authorization with google_default.

Concretely, on master we have this behavior.

In [1]: !gcloud config get-value project
pangeo-181919

In [2]: import gcsfs

In [3]: fs = gcsfs.GCSFileSystem(token="google_default", project="dask-demo-182016")
/Users/taugspurger/miniconda3/envs/filesystems/lib/python3.7/site-packages/google/auth/_default.py:69: UserWarning: Your application has authenticated using end user credentials from Google Cloud SDK. We recommend that most server applications use service accounts instead. If your application continues to use end user credentials from Cloud SDK, you might receive a "quota exceeded" or "API not enabled" error. For more information about service accounts, see https://cloud.google.com/docs/authentication/
  warnings.warn(_CLOUD_SDK_CREDENTIALS_WARNING)

In [4]: fs.project
Out[4]: 'pangeo-181919'

I think it's surprising that fs.project ends up as something other than what I passed to project.

When project is not specified, then inferring it from the google default makes complete sense.

[martindurant]

Oh, I see what you mean. Yes, we should error if we have tried setting a project, but the auth mechanism gives back another project.

[TomAugspurger]

Great, thanks for confirming!