Skip to content

Commit d5d0977

Browse files
scotthartscotthart
authored
impl(oauth2): relocate base oauth credentials (#8220)
1 parent 9c1b651 commit d5d0977

6 files changed

Lines changed: 210 additions & 0 deletions

File tree

‎google/cloud/CMakeLists.txt‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -634,6 +634,10 @@ if (GOOGLE_CLOUD_CPP_ENABLE_REST)
634634
internal/curl_wrappers.h
635635
internal/http_payload.cc
636636
internal/http_payload.h
637+
internal/oauth2_credentials.cc
638+
internal/oauth2_credentials.h
639+
internal/oauth2_error_credentials.cc
640+
internal/oauth2_error_credentials.h
637641
internal/rest_client.cc
638642
internal/rest_client.h
639643
internal/rest_options.h

‎google/cloud/google_cloud_cpp_rest_internal.bzl‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@ google_cloud_cpp_rest_internal_hdrs = [
2424
"internal/curl_options.h",
2525
"internal/curl_wrappers.h",
2626
"internal/http_payload.h",
27+
"internal/oauth2_credentials.h",
28+
"internal/oauth2_error_credentials.h",
2729
"internal/rest_client.h",
2830
"internal/rest_options.h",
2931
"internal/rest_request.h",
@@ -37,6 +39,8 @@ google_cloud_cpp_rest_internal_srcs = [
3739
"internal/curl_impl.cc",
3840
"internal/curl_wrappers.cc",
3941
"internal/http_payload.cc",
42+
"internal/oauth2_credentials.cc",
43+
"internal/oauth2_error_credentials.cc",
4044
"internal/rest_client.cc",
4145
"internal/rest_request.cc",
4246
"internal/rest_response.cc",

‎google/cloud/internal/oauth2_credentials.cc‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
// Copyright 2019 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// https://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
#include "google/cloud/internal/oauth2_credentials.h"
16+
17+
namespace google {
18+
namespace cloud {
19+
namespace oauth2_internal {
20+
GOOGLE_CLOUD_CPP_INLINE_NAMESPACE_BEGIN
21+
22+
StatusOr<std::vector<std::uint8_t>> Credentials::SignBlob(
23+
std::string const&, std::string const&) const {
24+
return Status(StatusCode::kUnimplemented,
25+
"The current credentials cannot sign blobs locally");
26+
}
27+
28+
GOOGLE_CLOUD_CPP_INLINE_NAMESPACE_END
29+
} // namespace oauth2_internal
30+
} // namespace cloud
31+
} // namespace google

‎google/cloud/internal/oauth2_credentials.h‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
// Copyright 2018 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// https://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
#ifndef GOOGLE_CLOUD_CPP_GOOGLE_CLOUD_INTERNAL_OAUTH2_CREDENTIALS_H
16+
#define GOOGLE_CLOUD_CPP_GOOGLE_CLOUD_INTERNAL_OAUTH2_CREDENTIALS_H
17+
18+
#include "google/cloud/status.h"
19+
#include "google/cloud/status_or.h"
20+
#include "google/cloud/version.h"
21+
#include <string>
22+
#include <vector>
23+
24+
namespace google {
25+
namespace cloud {
26+
namespace oauth2_internal {
27+
GOOGLE_CLOUD_CPP_INLINE_NAMESPACE_BEGIN
28+
/**
29+
* Interface for OAuth 2.0 credentials for use with Google's Unified Auth Client
30+
* (GUAC) library. Internally, GUAC credentials are mapped to the appropriate
31+
* OAuth 2.0 credential for use with GCP services with a REST API.
32+
*
33+
* Instantiating a specific kind of `Credentials` should usually be done via the
34+
* GUAC convenience methods declared in google/cloud/credentials.h.
35+
*
36+
* @see https://cloud.google.com/docs/authentication/ for an overview of
37+
* authenticating to Google Cloud Platform APIs.
38+
*/
39+
class Credentials {
40+
public:
41+
virtual ~Credentials() = default;
42+
43+
/**
44+
* Attempts to obtain a value for the Authorization HTTP header.
45+
*
46+
* If unable to obtain a value for the Authorization header, which could
47+
* happen for `Credentials` that need to be periodically refreshed, the
48+
* underlying `Status` will indicate failure details from the refresh HTTP
49+
* request. Otherwise, the returned value will contain the Authorization
50+
* header to be used in HTTP requests.
51+
*/
52+
virtual StatusOr<std::pair<std::string, std::string>>
53+
AuthorizationHeader() = 0;
54+
55+
/**
56+
* Try to sign @p string_to_sign using @p service_account.
57+
*
58+
* Some %Credentials types can locally sign a blob, most often just on behalf
59+
* of an specific service account. This function returns an error if the
60+
* credentials cannot sign the blob at all, or if the service account is a
61+
* mismatch.
62+
*/
63+
virtual StatusOr<std::vector<std::uint8_t>> SignBlob(
64+
std::string const& signing_service_account,
65+
std::string const& string_to_sign) const;
66+
67+
/// Return the account's email associated with these credentials, if any.
68+
virtual std::string AccountEmail() const { return std::string{}; }
69+
70+
/// Return the account's key_id associated with these credentials, if any.
71+
virtual std::string KeyId() const { return std::string{}; }
72+
};
73+
74+
GOOGLE_CLOUD_CPP_INLINE_NAMESPACE_END
75+
} // namespace oauth2_internal
76+
} // namespace cloud
77+
} // namespace google
78+
79+
#endif // GOOGLE_CLOUD_CPP_GOOGLE_CLOUD_INTERNAL_OAUTH2_CREDENTIALS_H

‎google/cloud/internal/oauth2_error_credentials.cc‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
// Copyright 2021 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// https://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
#include "google/cloud/internal/oauth2_error_credentials.h"
16+
17+
namespace google {
18+
namespace cloud {
19+
namespace oauth2_internal {
20+
GOOGLE_CLOUD_CPP_INLINE_NAMESPACE_BEGIN
21+
22+
StatusOr<std::pair<std::string, std::string>>
23+
ErrorCredentials::AuthorizationHeader() {
24+
return status_;
25+
}
26+
27+
GOOGLE_CLOUD_CPP_INLINE_NAMESPACE_END
28+
} // namespace oauth2_internal
29+
} // namespace cloud
30+
} // namespace google

‎google/cloud/internal/oauth2_error_credentials.h‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
// Copyright 2021 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// https://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
#ifndef GOOGLE_CLOUD_CPP_GOOGLE_CLOUD_INTERNAL_OAUTH2_ERROR_CREDENTIALS_H
16+
#define GOOGLE_CLOUD_CPP_GOOGLE_CLOUD_INTERNAL_OAUTH2_ERROR_CREDENTIALS_H
17+
18+
#include "google/cloud/internal/oauth2_credentials.h"
19+
#include "google/cloud/version.h"
20+
21+
namespace google {
22+
namespace cloud {
23+
namespace oauth2_internal {
24+
GOOGLE_CLOUD_CPP_INLINE_NAMESPACE_BEGIN
25+
26+
/**
27+
* Report errors loading credentials when the RPC is called.
28+
*
29+
* With the "unified authentication client" approach the application just
30+
* declares its *intent*, e.g., "load the default credentials", the actual work
31+
* is delayed and depends on how the client library is implemented. We also want
32+
* the behavior with gRPC and REST to be as similar as possible.
33+
*
34+
* For some credential types (e.g. service account impersonation) there may be
35+
* problems with the credentials that are not manifest until after several RPCs
36+
* succeed.
37+
*
38+
* For gRPC, creating the credentials always succeeds, but using them may fail.
39+
*
40+
* With REST we typically validate the credentials when loaded, and then again
41+
* when we try to use them.
42+
*
43+
* This last approach was problematic, because it made some credentials fail
44+
* early. This class allows us to treat all credentials, including REST
45+
* credentials that failed to load as "evaluated at RPC time".
46+
*/
47+
class ErrorCredentials : public oauth2_internal::Credentials {
48+
public:
49+
explicit ErrorCredentials(Status status) : status_(std::move(status)) {}
50+
51+
StatusOr<std::pair<std::string, std::string>> AuthorizationHeader() override;
52+
53+
private:
54+
Status status_;
55+
};
56+
57+
GOOGLE_CLOUD_CPP_INLINE_NAMESPACE_END
58+
} // namespace oauth2_internal
59+
} // namespace cloud
60+
} // namespace google
61+
62+
#endif // GOOGLE_CLOUD_CPP_GOOGLE_CLOUD_INTERNAL_OAUTH2_ERROR_CREDENTIALS_H

0 commit comments

Comments
 (0)