Skip to content

Commit 5c69e8c

Browse files
gcf-owl-bot[bot]gcf-owl-bot[bot]
authored
fix: disable always_use_jwt_access (#39)
fix: disable always_use_jwt_access Committer: @busunkim96 PiperOrigin-RevId: 382142900 Source-Link: googleapis/googleapis@513440f Source-Link: googleapis/googleapis-gen@7b1e2c3
1 parent 07ec580 commit 5c69e8c

File tree

4 files changed

+31
-7
lines changed

4 files changed

+31
-7
lines changed

‎packages/google-cloud-policy-troubleshooter/google/cloud/policytroubleshooter_v1/services/iam_checker/transports/base.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@ def __init__(
9898
scopes_kwargs = self._get_scopes_kwargs(self._host, scopes)
9999

100100
# Save the scopes.
101-
self._scopes = scopes or self.AUTH_SCOPES
101+
self._scopes = scopes
102102

103103
# If no credentials are provided, then determine the appropriate
104104
# defaults.

‎packages/google-cloud-policy-troubleshooter/google/cloud/policytroubleshooter_v1/services/iam_checker/transports/grpc.py‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,7 @@ def __init__(
5959
client_cert_source_for_mtls: Callable[[], Tuple[bytes, bytes]] = None,
6060
quota_project_id: Optional[str] = None,
6161
client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO,
62+
always_use_jwt_access: Optional[bool] = False,
6263
) -> None:
6364
"""Instantiate the transport.
6465
@@ -99,6 +100,8 @@ def __init__(
99100
API requests. If ``None``, then default info will be used.
100101
Generally, you only need to set this if you're developing
101102
your own client library.
103+
always_use_jwt_access (Optional[bool]): Whether self signed JWT should
104+
be used for service account credentials.
102105
103106
Raises:
104107
google.auth.exceptions.MutualTLSChannelError: If mutual TLS transport
@@ -151,7 +154,7 @@ def __init__(
151154
scopes=scopes,
152155
quota_project_id=quota_project_id,
153156
client_info=client_info,
154-
always_use_jwt_access=True,
157+
always_use_jwt_access=always_use_jwt_access,
155158
)
156159

157160
if not self._grpc_channel:

‎packages/google-cloud-policy-troubleshooter/google/cloud/policytroubleshooter_v1/services/iam_checker/transports/grpc_asyncio.py‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,7 @@ def __init__(
105105
client_cert_source_for_mtls: Callable[[], Tuple[bytes, bytes]] = None,
106106
quota_project_id=None,
107107
client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO,
108+
always_use_jwt_access: Optional[bool] = False,
108109
) -> None:
109110
"""Instantiate the transport.
110111
@@ -146,6 +147,8 @@ def __init__(
146147
API requests. If ``None``, then default info will be used.
147148
Generally, you only need to set this if you're developing
148149
your own client library.
150+
always_use_jwt_access (Optional[bool]): Whether self signed JWT should
151+
be used for service account credentials.
149152
150153
Raises:
151154
google.auth.exceptions.MutualTlsChannelError: If mutual TLS transport
@@ -197,7 +200,7 @@ def __init__(
197200
scopes=scopes,
198201
quota_project_id=quota_project_id,
199202
client_info=client_info,
200-
always_use_jwt_access=True,
203+
always_use_jwt_access=always_use_jwt_access,
201204
)
202205

203206
if not self._grpc_channel:

‎packages/google-cloud-policy-troubleshooter/tests/unit/gapic/policytroubleshooter_v1/test_iam_checker.py‎

Lines changed: 22 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,25 @@ def test_iam_checker_client_service_account_always_use_jwt(client_class):
122122
) as use_jwt:
123123
creds = service_account.Credentials(None, None, None)
124124
client = client_class(credentials=creds)
125-
use_jwt.assert_called_with(True)
125+
use_jwt.assert_not_called()
126+
127+
128+
@pytest.mark.parametrize(
129+
"transport_class,transport_name",
130+
[
131+
(transports.IamCheckerGrpcTransport, "grpc"),
132+
(transports.IamCheckerGrpcAsyncIOTransport, "grpc_asyncio"),
133+
],
134+
)
135+
def test_iam_checker_client_service_account_always_use_jwt_true(
136+
transport_class, transport_name
137+
):
138+
with mock.patch.object(
139+
service_account.Credentials, "with_always_use_jwt_access", create=True
140+
) as use_jwt:
141+
creds = service_account.Credentials(None, None, None)
142+
transport = transport_class(credentials=creds, always_use_jwt_access=True)
143+
use_jwt.assert_called_once_with(True)
126144

127145

128146
@pytest.mark.parametrize("client_class", [IamCheckerClient, IamCheckerAsyncClient,])
@@ -814,7 +832,7 @@ def test_iam_checker_grpc_transport_client_cert_source_for_mtls(transport_class)
814832
"squid.clam.whelk:443",
815833
credentials=cred,
816834
credentials_file=None,
817-
scopes=("https://www.googleapis.com/auth/cloud-platform",),
835+
scopes=None,
818836
ssl_credentials=mock_ssl_channel_creds,
819837
quota_project_id=None,
820838
options=[
@@ -918,7 +936,7 @@ def test_iam_checker_transport_channel_mtls_with_client_cert_source(transport_cl
918936
"mtls.squid.clam.whelk:443",
919937
credentials=cred,
920938
credentials_file=None,
921-
scopes=("https://www.googleapis.com/auth/cloud-platform",),
939+
scopes=None,
922940
ssl_credentials=mock_ssl_cred,
923941
quota_project_id=None,
924942
options=[
@@ -962,7 +980,7 @@ def test_iam_checker_transport_channel_mtls_with_adc(transport_class):
962980
"mtls.squid.clam.whelk:443",
963981
credentials=mock_cred,
964982
credentials_file=None,
965-
scopes=("https://www.googleapis.com/auth/cloud-platform",),
983+
scopes=None,
966984
ssl_credentials=mock_ssl_cred,
967985
quota_project_id=None,
968986
options=[

0 commit comments

Comments
 (0)