Skip to content
This repository was archived by the owner on Sep 5, 2023. It is now read-only.

Commit 421b7fc

Browse files
gcf-owl-bot[bot]gcf-owl-bot[bot]
authored
feat: add always_use_jwt_access (#170)
... chore: update gapic-generator-ruby to the latest commit chore: release gapic-generator-typescript 1.5.0 Committer: @miraleung PiperOrigin-RevId: 380641501 Source-Link: googleapis/googleapis@076f7e9 Source-Link: https://github.com/googleapis/googleapis-gen/commit/27e4c88b4048e5f56508d4e1aa417d60a3380892
1 parent 41a3975 commit 421b7fc

14 files changed

Lines changed: 131 additions & 371 deletions

File tree

‎google/cloud/securitycenter_v1/services/security_center/transports/base.py‎

Lines changed: 14 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
from google.api_core import retry as retries # type: ignore
2626
from google.api_core import operations_v1 # type: ignore
2727
from google.auth import credentials as ga_credentials # type: ignore
28+
from google.oauth2 import service_account # type: ignore
2829

2930
from google.cloud.securitycenter_v1.types import finding
3031
from google.cloud.securitycenter_v1.types import finding as gcs_finding
@@ -63,8 +64,6 @@
6364
except pkg_resources.DistributionNotFound: # pragma: NO COVER
6465
_GOOGLE_AUTH_VERSION = None
6566

66-
_API_CORE_VERSION = google.api_core.__version__
67-
6867

6968
class SecurityCenterTransport(abc.ABC):
7069
"""Abstract transport class for SecurityCenter."""
@@ -82,6 +81,7 @@ def __init__(
8281
scopes: Optional[Sequence[str]] = None,
8382
quota_project_id: Optional[str] = None,
8483
client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO,
84+
always_use_jwt_access: Optional[bool] = False,
8585
**kwargs,
8686
) -> None:
8787
"""Instantiate the transport.
@@ -105,6 +105,8 @@ def __init__(
105105
API requests. If ``None``, then default info will be used.
106106
Generally, you only need to set this if you're developing
107107
your own client library.
108+
always_use_jwt_access (Optional[bool]): Whether self signed JWT should
109+
be used for service account credentials.
108110
"""
109111
# Save the hostname. Default to port 443 (HTTPS) if none is specified.
110112
if ":" not in host:
@@ -133,13 +135,20 @@ def __init__(
133135
**scopes_kwargs, quota_project_id=quota_project_id
134136
)
135137

138+
# If the credentials is service account credentials, then always try to use self signed JWT.
139+
if (
140+
always_use_jwt_access
141+
and isinstance(credentials, service_account.Credentials)
142+
and hasattr(service_account.Credentials, "with_always_use_jwt_access")
143+
):
144+
credentials = credentials.with_always_use_jwt_access(True)
145+
136146
# Save the credentials.
137147
self._credentials = credentials
138148

139-
# TODO(busunkim): These two class methods are in the base transport
149+
# TODO(busunkim): This method is in the base transport
140150
# to avoid duplicating code across the transport classes. These functions
141-
# should be deleted once the minimum required versions of google-api-core
142-
# and google-auth are increased.
151+
# should be deleted once the minimum required versions of google-auth is increased.
143152

144153
# TODO: Remove this function once google-auth >= 1.25.0 is required
145154
@classmethod
@@ -160,27 +169,6 @@ def _get_scopes_kwargs(
160169

161170
return scopes_kwargs
162171

163-
# TODO: Remove this function once google-api-core >= 1.26.0 is required
164-
@classmethod
165-
def _get_self_signed_jwt_kwargs(
166-
cls, host: str, scopes: Optional[Sequence[str]]
167-
) -> Dict[str, Union[Optional[Sequence[str]], str]]:
168-
"""Returns kwargs to pass to grpc_helpers.create_channel depending on the google-api-core version"""
169-
170-
self_signed_jwt_kwargs: Dict[str, Union[Optional[Sequence[str]], str]] = {}
171-
172-
if _API_CORE_VERSION and (
173-
packaging.version.parse(_API_CORE_VERSION)
174-
>= packaging.version.parse("1.26.0")
175-
):
176-
self_signed_jwt_kwargs["default_scopes"] = cls.AUTH_SCOPES
177-
self_signed_jwt_kwargs["scopes"] = scopes
178-
self_signed_jwt_kwargs["default_host"] = cls.DEFAULT_HOST
179-
else:
180-
self_signed_jwt_kwargs["scopes"] = scopes or cls.AUTH_SCOPES
181-
182-
return self_signed_jwt_kwargs
183-
184172
def _prep_wrapped_messages(self, client_info):
185173
# Precompute the wrapped methods.
186174
self._wrapped_methods = {

‎google/cloud/securitycenter_v1/services/security_center/transports/grpc.py‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -168,6 +168,7 @@ def __init__(
168168
scopes=scopes,
169169
quota_project_id=quota_project_id,
170170
client_info=client_info,
171+
always_use_jwt_access=True,
171172
)
172173

173174
if not self._grpc_channel:
@@ -223,14 +224,14 @@ def create_channel(
223224
and ``credentials_file`` are passed.
224225
"""
225226

226-
self_signed_jwt_kwargs = cls._get_self_signed_jwt_kwargs(host, scopes)
227-
228227
return grpc_helpers.create_channel(
229228
host,
230229
credentials=credentials,
231230
credentials_file=credentials_file,
232231
quota_project_id=quota_project_id,
233-
**self_signed_jwt_kwargs,
232+
default_scopes=cls.AUTH_SCOPES,
233+
scopes=scopes,
234+
default_host=cls.DEFAULT_HOST,
234235
**kwargs,
235236
)
236237

‎google/cloud/securitycenter_v1/services/security_center/transports/grpc_asyncio.py‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -96,14 +96,14 @@ def create_channel(
9696
aio.Channel: A gRPC AsyncIO channel object.
9797
"""
9898

99-
self_signed_jwt_kwargs = cls._get_self_signed_jwt_kwargs(host, scopes)
100-
10199
return grpc_helpers_async.create_channel(
102100
host,
103101
credentials=credentials,
104102
credentials_file=credentials_file,
105103
quota_project_id=quota_project_id,
106-
**self_signed_jwt_kwargs,
104+
default_scopes=cls.AUTH_SCOPES,
105+
scopes=scopes,
106+
default_host=cls.DEFAULT_HOST,
107107
**kwargs,
108108
)
109109

@@ -214,6 +214,7 @@ def __init__(
214214
scopes=scopes,
215215
quota_project_id=quota_project_id,
216216
client_info=client_info,
217+
always_use_jwt_access=True,
217218
)
218219

219220
if not self._grpc_channel:

‎google/cloud/securitycenter_v1beta1/services/security_center/transports/base.py‎

Lines changed: 14 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
from google.api_core import retry as retries # type: ignore
2626
from google.api_core import operations_v1 # type: ignore
2727
from google.auth import credentials as ga_credentials # type: ignore
28+
from google.oauth2 import service_account # type: ignore
2829

2930
from google.cloud.securitycenter_v1beta1.types import finding
3031
from google.cloud.securitycenter_v1beta1.types import finding as gcs_finding
@@ -60,8 +61,6 @@
6061
except pkg_resources.DistributionNotFound: # pragma: NO COVER
6162
_GOOGLE_AUTH_VERSION = None
6263

63-
_API_CORE_VERSION = google.api_core.__version__
64-
6564

6665
class SecurityCenterTransport(abc.ABC):
6766
"""Abstract transport class for SecurityCenter."""
@@ -79,6 +78,7 @@ def __init__(
7978
scopes: Optional[Sequence[str]] = None,
8079
quota_project_id: Optional[str] = None,
8180
client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO,
81+
always_use_jwt_access: Optional[bool] = False,
8282
**kwargs,
8383
) -> None:
8484
"""Instantiate the transport.
@@ -102,6 +102,8 @@ def __init__(
102102
API requests. If ``None``, then default info will be used.
103103
Generally, you only need to set this if you're developing
104104
your own client library.
105+
always_use_jwt_access (Optional[bool]): Whether self signed JWT should
106+
be used for service account credentials.
105107
"""
106108
# Save the hostname. Default to port 443 (HTTPS) if none is specified.
107109
if ":" not in host:
@@ -130,13 +132,20 @@ def __init__(
130132
**scopes_kwargs, quota_project_id=quota_project_id
131133
)
132134

135+
# If the credentials is service account credentials, then always try to use self signed JWT.
136+
if (
137+
always_use_jwt_access
138+
and isinstance(credentials, service_account.Credentials)
139+
and hasattr(service_account.Credentials, "with_always_use_jwt_access")
140+
):
141+
credentials = credentials.with_always_use_jwt_access(True)
142+
133143
# Save the credentials.
134144
self._credentials = credentials
135145

136-
# TODO(busunkim): These two class methods are in the base transport
146+
# TODO(busunkim): This method is in the base transport
137147
# to avoid duplicating code across the transport classes. These functions
138-
# should be deleted once the minimum required versions of google-api-core
139-
# and google-auth are increased.
148+
# should be deleted once the minimum required versions of google-auth is increased.
140149

141150
# TODO: Remove this function once google-auth >= 1.25.0 is required
142151
@classmethod
@@ -157,27 +166,6 @@ def _get_scopes_kwargs(
157166

158167
return scopes_kwargs
159168

160-
# TODO: Remove this function once google-api-core >= 1.26.0 is required
161-
@classmethod
162-
def _get_self_signed_jwt_kwargs(
163-
cls, host: str, scopes: Optional[Sequence[str]]
164-
) -> Dict[str, Union[Optional[Sequence[str]], str]]:
165-
"""Returns kwargs to pass to grpc_helpers.create_channel depending on the google-api-core version"""
166-
167-
self_signed_jwt_kwargs: Dict[str, Union[Optional[Sequence[str]], str]] = {}
168-
169-
if _API_CORE_VERSION and (
170-
packaging.version.parse(_API_CORE_VERSION)
171-
>= packaging.version.parse("1.26.0")
172-
):
173-
self_signed_jwt_kwargs["default_scopes"] = cls.AUTH_SCOPES
174-
self_signed_jwt_kwargs["scopes"] = scopes
175-
self_signed_jwt_kwargs["default_host"] = cls.DEFAULT_HOST
176-
else:
177-
self_signed_jwt_kwargs["scopes"] = scopes or cls.AUTH_SCOPES
178-
179-
return self_signed_jwt_kwargs
180-
181169
def _prep_wrapped_messages(self, client_info):
182170
# Precompute the wrapped methods.
183171
self._wrapped_methods = {

‎google/cloud/securitycenter_v1beta1/services/security_center/transports/grpc.py‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -165,6 +165,7 @@ def __init__(
165165
scopes=scopes,
166166
quota_project_id=quota_project_id,
167167
client_info=client_info,
168+
always_use_jwt_access=True,
168169
)
169170

170171
if not self._grpc_channel:
@@ -220,14 +221,14 @@ def create_channel(
220221
and ``credentials_file`` are passed.
221222
"""
222223

223-
self_signed_jwt_kwargs = cls._get_self_signed_jwt_kwargs(host, scopes)
224-
225224
return grpc_helpers.create_channel(
226225
host,
227226
credentials=credentials,
228227
credentials_file=credentials_file,
229228
quota_project_id=quota_project_id,
230-
**self_signed_jwt_kwargs,
229+
default_scopes=cls.AUTH_SCOPES,
230+
scopes=scopes,
231+
default_host=cls.DEFAULT_HOST,
231232
**kwargs,
232233
)
233234

‎google/cloud/securitycenter_v1beta1/services/security_center/transports/grpc_asyncio.py‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -93,14 +93,14 @@ def create_channel(
9393
aio.Channel: A gRPC AsyncIO channel object.
9494
"""
9595

96-
self_signed_jwt_kwargs = cls._get_self_signed_jwt_kwargs(host, scopes)
97-
9896
return grpc_helpers_async.create_channel(
9997
host,
10098
credentials=credentials,
10199
credentials_file=credentials_file,
102100
quota_project_id=quota_project_id,
103-
**self_signed_jwt_kwargs,
101+
default_scopes=cls.AUTH_SCOPES,
102+
scopes=scopes,
103+
default_host=cls.DEFAULT_HOST,
104104
**kwargs,
105105
)
106106

@@ -211,6 +211,7 @@ def __init__(
211211
scopes=scopes,
212212
quota_project_id=quota_project_id,
213213
client_info=client_info,
214+
always_use_jwt_access=True,
214215
)
215216

216217
if not self._grpc_channel:

‎google/cloud/securitycenter_v1p1beta1/services/security_center/transports/base.py‎

Lines changed: 14 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
from google.api_core import retry as retries # type: ignore
2626
from google.api_core import operations_v1 # type: ignore
2727
from google.auth import credentials as ga_credentials # type: ignore
28+
from google.oauth2 import service_account # type: ignore
2829

2930
from google.cloud.securitycenter_v1p1beta1.types import finding
3031
from google.cloud.securitycenter_v1p1beta1.types import finding as gcs_finding
@@ -65,8 +66,6 @@
6566
except pkg_resources.DistributionNotFound: # pragma: NO COVER
6667
_GOOGLE_AUTH_VERSION = None
6768

68-
_API_CORE_VERSION = google.api_core.__version__
69-
7069

7170
class SecurityCenterTransport(abc.ABC):
7271
"""Abstract transport class for SecurityCenter."""
@@ -84,6 +83,7 @@ def __init__(
8483
scopes: Optional[Sequence[str]] = None,
8584
quota_project_id: Optional[str] = None,
8685
client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO,
86+
always_use_jwt_access: Optional[bool] = False,
8787
**kwargs,
8888
) -> None:
8989
"""Instantiate the transport.
@@ -107,6 +107,8 @@ def __init__(
107107
API requests. If ``None``, then default info will be used.
108108
Generally, you only need to set this if you're developing
109109
your own client library.
110+
always_use_jwt_access (Optional[bool]): Whether self signed JWT should
111+
be used for service account credentials.
110112
"""
111113
# Save the hostname. Default to port 443 (HTTPS) if none is specified.
112114
if ":" not in host:
@@ -135,13 +137,20 @@ def __init__(
135137
**scopes_kwargs, quota_project_id=quota_project_id
136138
)
137139

140+
# If the credentials is service account credentials, then always try to use self signed JWT.
141+
if (
142+
always_use_jwt_access
143+
and isinstance(credentials, service_account.Credentials)
144+
and hasattr(service_account.Credentials, "with_always_use_jwt_access")
145+
):
146+
credentials = credentials.with_always_use_jwt_access(True)
147+
138148
# Save the credentials.
139149
self._credentials = credentials
140150

141-
# TODO(busunkim): These two class methods are in the base transport
151+
# TODO(busunkim): This method is in the base transport
142152
# to avoid duplicating code across the transport classes. These functions
143-
# should be deleted once the minimum required versions of google-api-core
144-
# and google-auth are increased.
153+
# should be deleted once the minimum required versions of google-auth is increased.
145154

146155
# TODO: Remove this function once google-auth >= 1.25.0 is required
147156
@classmethod
@@ -162,27 +171,6 @@ def _get_scopes_kwargs(
162171

163172
return scopes_kwargs
164173

165-
# TODO: Remove this function once google-api-core >= 1.26.0 is required
166-
@classmethod
167-
def _get_self_signed_jwt_kwargs(
168-
cls, host: str, scopes: Optional[Sequence[str]]
169-
) -> Dict[str, Union[Optional[Sequence[str]], str]]:
170-
"""Returns kwargs to pass to grpc_helpers.create_channel depending on the google-api-core version"""
171-
172-
self_signed_jwt_kwargs: Dict[str, Union[Optional[Sequence[str]], str]] = {}
173-
174-
if _API_CORE_VERSION and (
175-
packaging.version.parse(_API_CORE_VERSION)
176-
>= packaging.version.parse("1.26.0")
177-
):
178-
self_signed_jwt_kwargs["default_scopes"] = cls.AUTH_SCOPES
179-
self_signed_jwt_kwargs["scopes"] = scopes
180-
self_signed_jwt_kwargs["default_host"] = cls.DEFAULT_HOST
181-
else:
182-
self_signed_jwt_kwargs["scopes"] = scopes or cls.AUTH_SCOPES
183-
184-
return self_signed_jwt_kwargs
185-
186174
def _prep_wrapped_messages(self, client_info):
187175
# Precompute the wrapped methods.
188176
self._wrapped_methods = {

‎google/cloud/securitycenter_v1p1beta1/services/security_center/transports/grpc.py‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -170,6 +170,7 @@ def __init__(
170170
scopes=scopes,
171171
quota_project_id=quota_project_id,
172172
client_info=client_info,
173+
always_use_jwt_access=True,
173174
)
174175

175176
if not self._grpc_channel:
@@ -225,14 +226,14 @@ def create_channel(
225226
and ``credentials_file`` are passed.
226227
"""
227228

228-
self_signed_jwt_kwargs = cls._get_self_signed_jwt_kwargs(host, scopes)
229-
230229
return grpc_helpers.create_channel(
231230
host,
232231
credentials=credentials,
233232
credentials_file=credentials_file,
234233
quota_project_id=quota_project_id,
235-
**self_signed_jwt_kwargs,
234+
default_scopes=cls.AUTH_SCOPES,
235+
scopes=scopes,
236+
default_host=cls.DEFAULT_HOST,
236237
**kwargs,
237238
)
238239

0 commit comments

Comments
 (0)