File manager - Edit - /home/u478019808/domains/bestandroidphones.store/public_html/static/img/logo/gcs_oauth2_boto_plugin.zip
Back
PK �+�Z}�� � ( __pycache__/oauth2_helper.cpython-39.pycnu �[��� a ��3f\! � @ s� d Z ddlmZ ddlZddlZddlZddlZddlZddlZddl m Z ddl Z ddl mZ dZdadadZdZd Zd Ze jjfd d �Zddd�Zdd� Zdd� ZdS )z3Helper routines to facilitate use of oauth2_client.� )�absolute_importN)� oauth2_client)�inputzutf-8z)https://accounts.google.com/o/oauth2/authz#https://oauth2.googleapis.com/token� notasecretzurn:ietf:wg:oauth:2.0:oobc C s� d}| � ddd�}|dkrF| �dd�r<tj| � dd�d�}qdt�� }n |dkrXt�� }n td| ��d}d}d}d}| �d d �r�| �d d �r�| � d d �}t| � d d ��}| � d d d�}| � d d d�}| � ddt�}| � ddt�} |tj j k�r,| � ddd�} | � ddd�} t � | d��} | � � } W d � n1 �s60 Y d}z| �t�} d}W n t�yj Y n0 |�r�zt�| �}W n t�y� td| ��Y n0 dD ] }||v�r�td| |f ���q�tj|||| | �d dd� ||||d� S | � dd t�}tj| | |||| | �d dd� ||||d� S n�|tj jk�r�| � dd tj� d t��}|�s`td ��| � dd tj� d!t ��}| � d d"�}|d#k�r�d}|�s�td$��tj | ||| � dd%�||| �d dd� |||||d&� S td'��dS )(zBCreate a client type based on credentials supplied in boto config.N�OAuth2� token_cache� file_systemZtoken_cache_path_pattern)� path_pattern� in_memoryz6Invalid value for config option OAuth2/token_cache: %s�Boto�proxy� proxy_port� proxy_user� proxy_pass�provider_authorization_uri�provider_token_uri� Credentials�gs_service_client_id� �gs_service_key_file�rbFTz/Could not parse JSON keyfile "%s" as valid JSON)� client_id� client_email�private_key_id� private_keyzFThe JSON private key file at %s did not contain the required entry: %s�https_validate_certificates)�access_token_cache�auth_uri� token_uri�"disable_ssl_certificate_validation� proxy_hostr r r � gs_service_key_file_passwordr �OAUTH2_CLIENT_IDz�client_id for your application obtained from https://console.developers.google.com must be set in a boto config or with OAUTH2_CLIENT_ID environment variable or with gcs_oauth2_boto_plugin.SetFallbackClientIdAndSecret function.� client_secret�OAUTH2_CLIENT_SECRET�ca_certificates_file�systemz�client_secret for your application obtained from https://console.developers.google.com must be set in a boto config or with OAUTH2_CLIENT_SECRET environment variable or with gcs_oauth2_boto_plugin.SetFallbackClientIdAndSecret function.�gs_oauth2_refresh_token)r r r r r r r � ca_certs_filezTYou have attempted to create an OAuth2 client without setting up OAuth2 credentials.) �get� has_optionr �FileSystemTokenCache�InMemoryTokenCache� Exception�int�(GOOGLE_OAUTH2_PROVIDER_AUTHORIZATION_URI� GOOGLE_OAUTH2_PROVIDER_TOKEN_URI� CredTypes�OAUTH2_SERVICE_ACCOUNT�io�open�read�decode�UTF8�UnicodeDecodeError�json�loads� ValueError� OAuth2JsonServiceAccountClient�getbool�#GOOGLE_OAUTH2_DEFAULT_FILE_PASSWORD�OAuth2ServiceAccountClient�OAUTH2_USER_ACCOUNT�os�environ� CLIENT_ID� CLIENT_SECRET� get_value�OAuth2UserAccountClient)�config� cred_typer Ztoken_cache_typer r r r r r �service_client_id�private_key_filename�private_key_filer �keyfile_is_utf8� json_key_dict� json_entry� key_file_passr r# r( � rP �V/opt/gsutil/third_party/gcs-oauth2-boto-plugin/gcs_oauth2_boto_plugin/oauth2_helper.py�OAuth2ClientFromBotoConfig, s� � �� � ��( � � ����� ���� � �� rR Fc C s� t jj| j| j|| j| jtd�}|�� }|r>t j � d| � nt j � d| � t j � d� |r~t j |ddd�s~t j � d| � t�d � td �}|j|| �� d �}|jS ) zHRun the OAuth2 flow to fetch a refresh token. Returns the refresh token.)r r � redirect_uriz�Attempting to launch a browser with the OAuth2 approval dialog at URL: %s [Note: due to a Python bug, you may see a spurious error message "object is not callable [...] in [...] Popen.__del__" which can be ignored.] z6Please navigate your browser to the following URL: %s z�In your browser you should see a page that requests you to authorize access to Google Cloud Platform APIs and Services on your behalf. After you approve, an authorization code will be displayed. � T)�new� autoraisez]Launching browser appears to have failed; please navigate a browser to the following URL: %s � z Enter the authorization code: )�http)� oauth2client�client�OAuth2WebServerFlowr r# r r �OOB_REDIRECT_URI�step1_get_authorize_url�sys�stdout�write� webbrowserr4 �time�sleepr �step2_exchange�CreateHttpRequest� refresh_token)rZ �scopesZlaunch_browser�flowZ approval_url�code� credentialsrP rP rQ �OAuth2ApprovalFlow� s> ��������� rk c C s | a |ad S �N)rC rD )r r# rP rP rQ � SetFallbackClientIdAndSecret� s rm c C s | t _d S rl )r �token_exchange_lock)�lockrP rP rQ �SetLock� s rp )F) �__doc__� __future__r r3 r9 rA r^ rb ra �gcs_oauth2_boto_pluginr �oauth2client.clientrY � six.movesr r7 rC rD r/ r0 r> r\ r1 r@ rR rk rm rp rP rP rP rQ �<module> s0 ��� v $PK �+�ZC�!� � # __pycache__/__init__.cpython-39.pycnu �[��� a ��3f � @ s8 d Z ddlmZ ddlmZ ddlmZ ddlmZ dS )zJPlugin for Boto auth plugin framework, used with GCP OAuth2.0 credentials.� )�absolute_import)� oauth2_plugin)� SetFallbackClientIdAndSecret)�SetLockN)�__doc__� __future__r �gcs_oauth2_boto_pluginr Z$gcs_oauth2_boto_plugin.oauth2_helperr r � r r �Q/opt/gsutil/third_party/gcs-oauth2-boto-plugin/gcs_oauth2_boto_plugin/__init__.py�<module> s PK �+�Zϒ W% % ( __pycache__/oauth2_plugin.cpython-39.pycnu �[��� a ��3f� � @ s` d Z ddlmZ ddlZddlmZ ddlmZ daG dd� dej j �Z G d d � d ej j �Z dS ) z7Boto auth plugin for OAuth2.0 for Google Cloud Storage.� )�absolute_importN)� oauth2_client)� oauth2_helperFc @ s( e Zd ZdZddgZdd� Zdd� ZdS ) � OAuth2Authz=AuthHandler for working with OAuth2 user account credentials.� google-oauth2�s3c C sT d | _ |jdkr@|�dd�r*t�|�| _ n|�dd�r@t �� | _ | j sPtj�� �d S )N�google� Credentials�gs_oauth2_refresh_token� GoogleCompute�service_account) r �name� has_optionr �OAuth2ClientFromBotoConfigZCreateOAuth2GCEClient�boto� auth_handler�NotReadyToAuthenticate��self�path�config�provider� r �V/opt/gsutil/third_party/gcs-oauth2-boto-plugin/gcs_oauth2_boto_plugin/oauth2_plugin.py�__init__ s zOAuth2Auth.__init__c C s | j �� |jd< d S �N� Authorization�r ZGetAuthorizationHeader�headers�r � http_requestr r r �add_auth* s �zOAuth2Auth.add_authN��__name__� __module__� __qualname__�__doc__� capabilityr r! r r r r r s r c @ s( e Zd ZdZddgZdd� Zdd� ZdS ) �OAuth2ServiceAccountAuthz@AuthHandler for working with OAuth2 service account credentials.r r c C s> |j dkr0|�dd�r0tj|tjjd�| _dan tj � � �d S )Nr r �gs_service_key_file)Z cred_typeT) r r r r r � CredTypes�OAUTH2_SERVICE_ACCOUNT�IS_SERVICE_ACCOUNTr r r r r r r r 4 s �� z!OAuth2ServiceAccountAuth.__init__c C s | j �� |jd< d S r r r r r r r! D s �z!OAuth2ServiceAccountAuth.add_authNr" r r r r r( / s r( ) r& � __future__r �boto.auth_handlerr �gcs_oauth2_boto_pluginr r r, r � AuthHandlerr r( r r r r �<module> s PK �+�Z���§q �q ( __pycache__/oauth2_client.cpython-39.pycnu �[��� a ��3fX~ � @ s� d Z ddlmZ ddlZddlZddlmZ ddlZddlZddl Z ddl Z ddl Z ddl Z e j �d�r�ddlZe je j �d�7 _ddlZddlZddlZddlZddlmZ ddlZddlmZ ddlm Z dd l m Z dd l m!Z! dd l"m#Z# ddl$Z$dd l$m%Z% dd l&m'Z' e�(d�Z)e �*� Z+dZ,dZ-dZ.e-Z/dZ0e,e.gZ1dZ2e2d Z3ddiZ4ej#j5Z6G dd� de7�Z8G dd� de9�Z:G dd � d e:�Z;G d d � d e7�Z<G d d � d e<�Z=G d!d"� d"e<�Z>G d#d$� d$e<�Z?G d%d&� d&e j@e jA�ZBG d'd(� d(e#jC�ZDdEd)d*�ZEG d+d,� d,e7�ZFG d-d.� d.eF�ZGG d/d0� d0eG�ZHG d1d2� d2eG�ZIG d3d4� d4e9�ZJG d5d6� d6e9�ZKG d7d8� d8e9�ZLG d9d:� d:e9�ZMG d;d<� d<eF�ZNG d=d>� d>eF�ZOd?d@� ZPdAdB� ZQG dCdD� dDe7�ZRdS )Fa An OAuth2 client library. This library provides a client implementation of the OAuth2 protocol (see https://developers.google.com/storage/docs/authentication.html#oauth). **** Experimental API **** This module is experimental and is subject to modification or removal without notice. � )�absolute_importN)�sha1� USER_AGENT)� reauth_creds)�_helpers)�base)�Request��AuthorizedHttp)�service_account)�BytesIO)�urllib� oauth2_clientz.https://www.googleapis.com/auth/cloud-platformz7https://www.googleapis.com/auth/devstorage.full_controlz/https://www.googleapis.com/auth/accounts.reauth� notasecretz http://metadata.google.internalz;/computeMetadata/v1/instance/service-accounts/default/tokenzMetadata-Flavor�Googlec @ s e Zd ZdZdZdZdZdS )� CredTypes�HMACzOAuth 2.0 Service AccountzOauth 2.0 User Account�GCEN)�__name__� __module__� __qualname__r �OAUTH2_SERVICE_ACCOUNT�OAUTH2_USER_ACCOUNTr � r r �V/opt/gsutil/third_party/gcs-oauth2-boto-plugin/gcs_oauth2_boto_plugin/oauth2_client.pyr d s r c @ s e Zd ZdZdS )�Errorz%Base exception for the OAuth2 module.N�r r r �__doc__r r r r r k s r c @ s e Zd ZdZdS )� AuthorizationCodeExchangeErrorzDError trying to exchange an authorization code into a refresh token.Nr r r r r r p s r c @ s e Zd ZdZdd� Zdd� ZdS )� TokenCachez"Interface for OAuth2 token caches.c C s t �d S �N��NotImplementedError��self�key�valuer r r �PutTokenx s zTokenCache.PutTokenc C s t �d S r r! �r$ r% r r r �GetToken{ s zTokenCache.GetTokenN�r r r r r' r) r r r r r u s r c @ s e Zd ZdZdd� Zdd� ZdS )�NoopTokenCachez6A stub implementation of TokenCache that does nothing.c C s d S r r r# r r r r' � s zNoopTokenCache.PutTokenc C s d S r r r( r r r r) � s zNoopTokenCache.GetTokenNr* r r r r r+ s r+ c s0 e Zd ZdZ� fdd�Zdd� Zdd� Z� ZS )�InMemoryTokenCachezAn in-memory token cache. The cache is implemented by a python dict, and inherits the thread-safety properties of dict. c s t t| ��� t� | _d S r )�superr, �__init__�dict�cache�r$ �� __class__r r r. � s zInMemoryTokenCache.__init__c C s t �d|� || j|< d S )Nz#InMemoryTokenCache.PutToken: key=%s)�LOG�debugr0 r# r r r r' � s zInMemoryTokenCache.PutTokenc C s, | j �|d �}t�d||d u r"dnd� |S )Nz-InMemoryTokenCache.GetToken: key=%s%s present� not� )r0 �getr4 r5 r# r r r r) � s �zInMemoryTokenCache.GetToken)r r r r r. r' r) � __classcell__r r r2 r r, � s r, c s: e Zd ZdZd � fdd� Zdd� Zdd� Zd d � Z� ZS ) �FileSystemTokenCacheaj An implementation of a token cache that persists tokens on disk. Each token object in the cache is stored in serialized form in a separate file. The cache file's name can be configured via a path pattern that is parameterized by the key under which a value is cached and optionally the current processes uid as obtained by os.getuid(). Since file names are generally publicly visible in the system, it is important that the cache key does not leak information about the token's value. If client code computes cache keys from token values, a cryptographically strong one-way function must be used. Nc s0 t t| ��� || _|s,tj�t�� d�| _dS )a� Creates a FileSystemTokenCache. Args: path_pattern: Optional string argument to specify the path pattern for cache files. The argument should be a path with format placeholders '%(key)s' and optionally '%(uid)s'. If the argument is omitted, the default pattern <tmpdir>/oauth2client-tokencache.%(uid)s.%(key)s is used, where <tmpdir> is replaced with the system temp dir as obtained from tempfile.gettempdir(). z(oauth2_client-tokencache.%(uid)s.%(key)sN) r- r: r. � path_pattern�os�path�join�tempfile� gettempdir)r$ r; r2 r r r. � s �z FileSystemTokenCache.__init__c C s2 d}zt t�� �}W n Y n0 | j||d� S )N�_)r% �uid)�strr< �getuidr; )r$ r% rB r r r � CacheFileName� s z"FileSystemTokenCache.CacheFileNamec C s | � |�}t�d||� zt�|� W n Y n0 tjtjB tjB }ttd�rZ|tj O }ttd�rn|tj O }zt� ||d�}W n8 t t fy� } z t�d||� W Y d}~dS d}~0 0 t�|d�}|�� }t|tj�r�|�d�}|�t�|�� |�� dS ) a Serializes the value to the key's filename. To ensure that written tokens aren't leaked to a different users, we a) unlink an existing cache file, if any (to ensure we don't fall victim to symlink attacks and the like), b) create a new file with O_CREAT | O_EXCL (to ensure nobody is trying to race us) If either of these steps fail, we simply give up (but log a warning). Not caching access tokens is not catastrophic, and failure to create a file can happen for either of the following reasons: - someone is attacking us as above, in which case we want to default to safe operation (not write the token); - another legitimate process is racing us; in this case one of the two will win and write the access token, which is fine; - we don't have permission to remove the old file or write to the specified directory, in which case we can't recover Args: key: the hash key to store. value: the access_token value to serialize. z4FileSystemTokenCache.PutToken: key=%s, cache_file=%s� O_NOINHERIT�O_BINARYi� zAFileSystemTokenCache.PutToken: Failed to create cache file %s: %sNzw+b�utf-8)rE r4 r5 r< �unlink�O_RDWR�O_CREAT�O_EXCL�hasattrrF rG �open�OSError�IOError�warning�fdopen� Serialize� isinstance�six� text_type�encode�write� ensure_binary�close) r$ r% r& � cache_file�flags�fd�e�f� serializedr r r r' � s4 � � z FileSystemTokenCache.PutTokenc C s� d}| � |�}z"t|�}t�|�� �}|�� W nr ttfyr } z&|jtj kr^t � d||� W Y d}~n:d}~0 t y� } zt � d||� W Y d}~n d}~0 0 t � d||du r�dnd|� |S )z<Returns a deserialized access token from the key's filename.Nz?FileSystemTokenCache.GetToken: Failed to read cache file %s: %szTFileSystemTokenCache.GetToken: Failed to read cache file %s (possibly corrupted): %sz?FileSystemTokenCache.GetToken: key=%s%s present (cache_file=%s)r6 r7 )rE rN � AccessToken� UnSerialize�readrZ rP rO �errno�ENOENTr4 rQ � Exceptionr5 )r$ r% r& r[ r_ r^ r r r r) � s& ���z FileSystemTokenCache.GetToken)N) r r r r r. rE r' r) r9 r r r2 r r: � s 6r: c @ s: e Zd ZdZdd� Zedd� �Zdd� Zed d d ��Z dS ) � PKCS12Signerz%Signer for a p12 service account key.c C s || _ d S r )�_keyr( r r r r. s zPKCS12Signer.__init__c C s d S r r r1 r r r �key_id s zPKCS12Signer.key_idc C s* t �|�}ddlm} | j�||j|j�S )Nr )�_cryptography_rsa)r �to_bytes�google.auth.cryptrj rh �sign�_PADDING�_SHA256)r$ �messagerj r r r rm ! s �zPKCS12Signer.signNc C sV ~dd� |D �\}}ddl m} z |�||�\}}}| |�W S td��Y n0 d S )Nc s s | ]}t �|�V qd S r )r rk )�.0�kr r r � <genexpr>, � z+PKCS12Signer.from_string.<locals>.<genexpr>r )�pkcs12z<Unable to load the keyfile, Invalid password or PKCS12 data.)�,cryptography.hazmat.primitives.serializationru �load_key_and_certificates�GsInvalidRefreshTokenError)�cls� key_stringsri � key_string�passwordru r% rA r r r � from_string) s zPKCS12Signer.from_string)N) r r r r r. �propertyri rm � classmethodr} r r r r rg s rg c @ sB e Zd ZdZdZdd� Zedd� �Zedd� �Ze d d d ��Z d S ) �P12Credentialsa google-auth service account credentials for p12 keys. p12 keys are not supported by the google-auth service account credentials. gsutil uses oauth2client to support p12 key users. Since oauth2client was deprecated and bundling it is security concern, we decided to support p12 in gsutil codebase. We prefer not adding it to the google-auth library because p12 is not supported from the beginning by google-auth. GCP strongly suggests users to use the JSON format. gsutil has to support it to not break users. )�service_account_email� token_uri�scopesc C s t | |d�S )N)�httpr )r$ r� r r r � authorizeC s zP12Credentials.authorizec C s | j S r )�tokenr1 r r r � access_tokenF s zP12Credentials.access_tokenc C s | j S r )�expiryr1 r r r � token_expiryJ s zP12Credentials.token_expiryNc sV |pt }t�||f�}� fdd�| jD �}|rBtd�d�|����| |fi � ��}|S )Nc s g | ]}|� vr|�qS r r )rq r_ ��kwargsr r � <listcomp>V rt zHP12Credentials.from_service_account_pkcs12_keystring.<locals>.<listcomp>zMissing fields: {}.z, )�#GOOGLE_OAUTH2_DEFAULT_FILE_PASSWORDrg r} �_REQUIRED_FIELDS�MissingFieldsError�formatr> )ry r{ r| r� �signer�missing_fields�credsr r� r �%from_service_account_pkcs12_keystringN s �z4P12Credentials.from_service_account_pkcs12_keystring)N) r r r r r� r� r~ r� r� r r� r r r r r� 6 s �r� c K s6 zt j| |fi |��W S ty0 td��Y n0 dS )zOCreates a service account credentials from a p12 key and handles import errors.zapyca/cryptography is not available. Either install it, or please consider using the .json keyfileN)r� r� � ImportError�MissingDependencyError)r{ r| r� r r r �"CreateP12ServiceAccountCredentials] s �� �r� c @ sP e Zd ZdZdejddddddddf dd�Zdd� Zdd � Zd d � Zd d � Z dS )� OAuth2Clientz Common logic for OAuth2 clients.NFc C s` || _ || _|| _|| _|p t� | _|| _| | _|rV|rVtj tj j ||| | dd�| _ nd | _ d S )NT)� proxy_user� proxy_pass� proxy_rdns) �auth_urir� �cache_key_base�datetime_strategyr, �access_token_cache�"disable_ssl_certificate_validation� ca_certs_file�httplib2� ProxyInfo�socks�PROXY_TYPE_HTTP� _proxy_info) r$ r� r� r� r� r� r� � proxy_host� proxy_portr� r� r� r r r r. j s � zOAuth2Client.__init__c C s t j| j| j| jd�S )N)�ca_certsr� � proxy_info)r� �Httpr� r� r� r1 r r r �CreateHttpRequest� s �z OAuth2Client.CreateHttpRequestc C s� t �� z�| �� }t�d|� | j�|�}t�d|� |du sF|�� r�|du rRdn|j}t�d� | j |d�}t�d|� | j� ||� |W t � � S t � � 0 dS )a� Obtains an access token for this client. This client's access token cache is first checked for an existing, not-yet-expired access token. If none is found, the client obtains a fresh access token from the OAuth2 provider's token endpoint. Returns: The cached or freshly obtained AccessToken. Raises: oauth2client.client.AccessTokenRefreshError if an error occurs. z)GetAccessToken: checking cache for key %sz$GetAccessToken: token from cache: %sNz.GetAccessToken: fetching fresh access token...�� rapt_tokenz&GetAccessToken: fresh access token: %s) �token_exchange_lock�acquire�CacheKeyr4 r5 r� r) � ShouldRefreshr� �FetchAccessTokenr' �release)r$ � cache_keyr� �raptr r r �GetAccessToken� s �zOAuth2Client.GetAccessTokenc C s: t � }t| jtj�r"| j�d�}n| j}|�|� |�� S )aM Computes a cache key. The cache key is computed as the SHA1 hash of the refresh token for user accounts, or the hash of the gs_service_client_id for service accounts, which satisfies the FileSystemTokenCache requirement that cache keys do not leak information about token values. Returns: A hash key. rH )r rT r� rU rV rW �update� hexdigest)r$ �h�valr r r r� � s zOAuth2Client.CacheKeyc C s d| � � j S )z�Gets the access token HTTP authorization header value. Returns: The value of an Authorization HTTP header that authenticates requests with an OAuth2 access token. z Bearer %s)r� r� r1 r r r �GetAuthorizationHeader� s z#OAuth2Client.GetAuthorizationHeader) r r r r �datetimer. r� r� r� r� r r r r r� g s � r� c sB e Zd ZdZdddejddddddf � fdd� Zddd�Z� ZS ) � _BaseOAuth2ServiceAccountClienta� Base class for OAuth2ServiceAccountClients. Args: client_id: The OAuth2 client ID of this client. access_token_cache: An optional instance of a TokenCache. If omitted or None, an InMemoryTokenCache is used. auth_uri: The URI for OAuth2 authorization. token_uri: The URI used to refresh access tokens. datetime_strategy: datetime module strategy to use. disable_ssl_certificate_validation: True if certifications should not be validated. proxy_host: An optional string specifying the host name of an HTTP proxy to be used. proxy_port: An optional int specifying the port number of an HTTP proxy to be used. proxy_user: An optional string specifying the user name for interacting with the HTTP proxy. proxy_pass: An optional string specifying the password for interacting with the HTTP proxy. ca_certs_file: The cacerts.txt file to use. NFc s0 t t| �j||||||||| | | d� || _d S )N� r� r� r� r� r� r� r� r� r� r� r� )r- r� r. � _client_id) r$ � client_idr� r� r� r� r� r� r� r� r� r� r2 r r r. � s �z(_BaseOAuth2ServiceAccountClient.__init__c C sB | � � }| �� }t|t�r"t|�}|�|� t|j|j| j |d�S )N�r� r� ) �GetCredentialsr� rT r� �GoogleAuthRequest�refreshra r� r� r� )r$ r� � credentials�requestr r r r� � s �z0_BaseOAuth2ServiceAccountClient.FetchAccessToken)N)r r r r r� r. r� r9 r r r2 r r� � s �r� c s@ e Zd ZdZdddejddddddf � fdd� Zdd� Z� ZS )�OAuth2ServiceAccountClientz9An OAuth2 service account client using .p12 or .pem keys.NFc s6 t t| �j||||||| | | | | d� || _|| _dS )aB Creates an OAuth2ServiceAccountClient. Args: client_id: The OAuth2 client ID of this client. private_key: The private key associated with this service account. password: The private key password used for the crypto signer. Keyword arguments match the _BaseOAuth2ServiceAccountClient class. � r� r� r� r� r� r� r� r� r� r� N)r- r� r. � _private_key� _password)r$ r� � private_keyr| r� r� r� r� r� r� r� r� r� r� r2 r r r. � s � z#OAuth2ServiceAccountClient.__init__c C s t | j| jtg| j| jd�S )N)r� r� r� )r� r� r� � DEFAULT_SCOPEr� r� r1 r r r r� s z)OAuth2ServiceAccountClient.GetCredentials�r r r r r� r. r� r9 r r r2 r r� � s �!r� c s@ e Zd ZdZdddejddddddf � fdd� Zdd� Z� ZS )� OAuth2JsonServiceAccountClientz2An OAuth2 service account client using .json keys.NFc sR t t| �j|d |||||||| | | d� || _|d | _|d | _|d | _dS )a Creates an OAuth2JsonServiceAccountClient. Args: json_key_dict: dictionary from the json private key file. Includes: client_id: The OAuth2 client ID of this client. client_email: The email associated with this client. private_key_id: The private key id associated with this service account. private_key_pkcs8_text: The pkcs8 text containing the private key data. Keyword arguments match the _BaseOAuth2ServiceAccountClient class. r� r� � client_email�private_key_idr� N)r- r� r. �_json_key_dict�_service_account_email�_private_key_idZ_private_key_pkcs8_text) r$ � json_key_dictr� r� r� r� r� r� r� r� r� r� r2 r r r. # s" � z'OAuth2JsonServiceAccountClient.__init__c C s t j| jtg| jd�S )N)r� r� )�_ServiceAccountCredentials�from_json_keyfile_dictr� r� r� r1 r r r r� I s �z-OAuth2JsonServiceAccountClient.GetCredentialsr� r r r2 r r� s �&r� c s e Zd ZdZ� fdd�Z� ZS )�GsAccessTokenRefreshErrorz-Transient error when requesting access token.c s t t| ��|� d S r )r- r� r. �r$ r^ r2 r r r. Q s z"GsAccessTokenRefreshError.__init__)r r r r r. r9 r r r2 r r� N s r� c s e Zd Z� fdd�Z� ZS )rx c s t t| ��|� d S r )r- rx r. r� r2 r r r. W s z#GsInvalidRefreshTokenError.__init__�r r r r. r9 r r r2 r rx U s rx c s e Zd Z� fdd�Z� ZS )r� c s t t| ��|� d S r )r- r� r. r� r2 r r r. ] s z MissingDependencyError.__init__r� r r r2 r r� [ s r� c s e Zd Z� fdd�Z� ZS )r� c s t t| ��|� d S r )r- r� r. r� r2 r r r. c s zMissingFieldsError.__init__r� r r r2 r r� a s r� c sd e Zd ZdZddejddddddf � fdd� Zdd� Zeje e j � dd d �d d �dd d��Z � ZS )�OAuth2UserAccountClientzAn OAuth2 client.NFc sB t t| �j||||||| | | | | d� || _|| _|| _|| _dS )aA Creates an OAuth2UserAccountClient. Args: token_uri: The URI used to refresh access tokens. client_id: The OAuth2 client ID of this client. client_secret: The OAuth2 client secret of this client. refresh_token: The token used to refresh the access token. auth_uri: The URI for OAuth2 authorization. access_token_cache: An optional instance of a TokenCache. If omitted or None, an InMemoryTokenCache is used. datetime_strategy: datetime module strategy to use. disable_ssl_certificate_validation: True if certifications should not be validated. proxy_host: An optional string specifying the host name of an HTTP proxy to be used. proxy_port: An optional int specifying the port number of an HTTP proxy to be used. proxy_user: An optional string specifying the user name for interacting with the HTTP proxy. proxy_pass: An optional string specifying the password for interacting with the HTTP proxy. ca_certs_file: The cacerts.txt file to use. r� N)r- r� r. r� r� � client_secret� refresh_token)r$ r� r� r� r� r� r� r� r� r� r� r� r� r� r2 r r r. j s" � z OAuth2UserAccountClient.__init__c C s. | � � }t�|j| j| j| j|j| jd�}|S )zAFetches a credentials objects from the provider's token endpoint.N) r� r �Oauth2WithReauthCredentialsr� r� r� r� r� r� )r$ r� r� r r r r� � s �z&OAuth2UserAccountClient.GetCredentials�OAuth2�oauth2_refresh_retries� � ��tries� timeout_secsc C s� zP| � � }tjd| j| j| jd| jdt|d� }|�|� t |j |j | j |j d�W S tjjy� } z@d|jv rxt|��n d|jv r�t�d� t|��n� W Y d}~n d}~0 0 dS )a Fetches an access token from the provider's token endpoint. Fetches an access token from this client's OAuth2 provider's token endpoint. Args: rapt_token: (str) The RAPT to be passed when refreshing the access token. Returns: The fetched AccessToken. N)r� r� r� zInvalid response 403� invalid_grantz� Attempted to retrieve an access token from an invalid refresh token. Two common cases in which you will see this error are: 1. Your refresh token was revoked. 2. Your refresh token was typed incorrectly. )r� r r� r� r� r� r� � RAPT_SCOPESr� ra r� r� r� r� � oauth2client�client�AccessTokenRefreshErrorrp r� r4 �inforx )r$ r� r� r� r^ r r r r� � s6 � � z(OAuth2UserAccountClient.FetchAccessToken)N)r r r r r� r. r� �retry_decorator�retryr� �boto�configr8 r� r9 r r r2 r r� g s �. �r� c s: e Zd ZdZ� fdd�Zejeddd�d dd ��Z� Z S ) �OAuth2GCEClientz OAuth2 client for GCE instance.c s t t| �jdt� d� d S )Nr7 )r� r� )r- r� r. r, r1 r2 r r r. � s �zOAuth2GCEClient.__init__r� r� r� Nc C s� ~d}z,t �� }|jtddtd�\}}t�|�}W n, ty^ } zt|��W Y d}~n d}~0 0 |j dkr�t � |�}t |d t j �� t j|�dd�d� | jdd �S dS ) a Fetches an access token from the provider's token endpoint. Fetches an access token from the GCE metadata server. Args: rapt_token: (str) Ignored for this class. Service accounts don't use reauth credentials. Returns: The fetched AccessToken. N�GET)�method�body�headers�� r� � expires_inr ��secondsr� )r� r� r� �META_TOKEN_URI� META_HEADERSrU � ensure_textrf r� �status�json�loadsra r� �now� timedeltar8 r� )r$ r� �responser� �contentr^ �dr r r r� � s( � ��z OAuth2GCEClient.FetchAccessToken)N) r r r r r. r� r� r� r� r9 r r r2 r r� � s r� c C st z"t �� } | �t�\}}|jdkW S t jtjfy> Y dS tyn } zt � d|� W Y d}~dS d}~0 0 dS )z;Returns True if running on a GCE instance, otherwise False.r� FzSFailed to determine whether we're running on GCE, so we'llassume that we aren't: %sN) r� r� r� �METADATA_SERVERr� �ServerNotFoundError�socket�errorrf r4 rQ )r� r rA r^ r r r �_IsGCE s �r c C s t � r t� S d S r )r r� r r r r �CreateOAuth2GCEClient s r c @ sV e Zd ZdZejdfdd�Zedd� �Zdd� Zdd d �Z d d � Z dd� Z dd� Z dS )ra z$Encapsulates an OAuth2 access token.Nc C s || _ || _|| _|| _d S r )r� r� r� r� )r$ r� r� r� r� r r r r. # s zAccessToken.__init__c C s� dd� }t j�| �}d|vs$|d s(dS d}||d�}|rhz tjdd� |�d�D �� }W n Y dS 0 ||d �}t||d�||d �S ) z7Creates an AccessToken object from its serialized form.c S s | � |d g�d S )Nr )r8 )r r% r r r �GetValue3 s z)AccessToken.UnSerialize.<locals>.GetValuer� Nr� c S s g | ] }t |��qS r )�int)rq �nr r r r� = rt z+AccessToken.UnSerialize.<locals>.<listcomp>�,r� r� )r �parse�parse_qsr� �splitra )�queryr �kvr� Z expiry_tupler� r r r rb / s � zAccessToken.UnSerializec C sj d| j i}| jrN| j}|j|j|j|j|j|j|jf}d� dd� |D ��|d< | j r^| j |d< t j � |�S )z6Serializes this object as URI-encoded key-value pairs.r� r c S s g | ] }t |��qS r )rC )rq �ir r r r� K rt z)AccessToken.Serialize.<locals>.<listcomp>r� r� )r� r� �year�month�day�hour�minute�second� microsecondr> r� r r � urlencode)r$ r �tZtuplr r r rS C s zAccessToken.Serialize�, c C s* | j du rdS | j�� tj|d� | j kS )ac Whether the access token needs to be refreshed. Args: time_delta: refresh access token when it expires within time_delta secs. Returns: True if the token is expired or about to expire, False if the token should be expected to work. Note that the token may still be rejected, e.g. if it has been revoked server-side. NFr� )r� r� �utcnowr� r )r$ � time_deltar r r r� P s ��zAccessToken.ShouldRefreshc C s | j |j ko| j|jkS r �r� r� �r$ �otherr r r �__eq__` s zAccessToken.__eq__c C s | � |� S r )r# r! r r r �__ne__c s zAccessToken.__ne__c C s d| j | jf S )Nz!AccessToken(token=%s, expiry=%sZ)r r1 r r r �__str__f s zAccessToken.__str__)r ) r r r r r� r. � staticmethodrb rS r� r# r$ r% r r r r ra s � ra )N)Sr � __future__r r� rd �hashlibr r� �loggingr< r r? � threading�environr8 r� � UserAgentr� �oauth2client.clientr� Z oauth2client.service_account� google_reauthr Z retry_decorator.retry_decoratorr� � google.authr rl r � crypt_base�google_auth_httplib2r r� r � google.oauth2r rU r � six.movesr � getLoggerr4 �Lockr� ZCLOUD_PLATFORM_SCOPEZFULL_CONTROL_SCOPEZ REAUTH_SCOPEr� r� r� r r� r� �ServiceAccountCredentialsr� �objectr rf r r r r+ r, r: �Signer�FromServiceAccountMixinrg � Credentialsr� r� r� r� r� r� r� rx r� r� r� r� r r ra r r r r �<module> s� �� v!' `1(.q.PK �+�Z�Ëv� � oauth2_plugin.pynu �[��� # Copyright 2014 Google Inc. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. """Boto auth plugin for OAuth2.0 for Google Cloud Storage.""" from __future__ import absolute_import import boto.auth_handler from gcs_oauth2_boto_plugin import oauth2_client from gcs_oauth2_boto_plugin import oauth2_helper IS_SERVICE_ACCOUNT = False class OAuth2Auth(boto.auth_handler.AuthHandler): """AuthHandler for working with OAuth2 user account credentials.""" capability = ['google-oauth2', 's3'] def __init__(self, path, config, provider): self.oauth2_client = None if provider.name == 'google': if config.has_option('Credentials', 'gs_oauth2_refresh_token'): self.oauth2_client = oauth2_helper.OAuth2ClientFromBotoConfig(config) elif config.has_option('GoogleCompute', 'service_account'): self.oauth2_client = oauth2_client.CreateOAuth2GCEClient() if not self.oauth2_client: raise boto.auth_handler.NotReadyToAuthenticate() def add_auth(self, http_request): http_request.headers['Authorization'] = ( self.oauth2_client.GetAuthorizationHeader()) class OAuth2ServiceAccountAuth(boto.auth_handler.AuthHandler): """AuthHandler for working with OAuth2 service account credentials.""" capability = ['google-oauth2', 's3'] def __init__(self, path, config, provider): if (provider.name == 'google' and config.has_option('Credentials', 'gs_service_key_file')): self.oauth2_client = oauth2_helper.OAuth2ClientFromBotoConfig( config, cred_type=oauth2_client.CredTypes.OAUTH2_SERVICE_ACCOUNT) # If we make it to this point, then we will later attempt to authenticate # as a service account based on how the boto auth plugins work. This is # global so that command.py can access this value once it's set. # TODO: replace this approach with a way to get the current plugin # from boto so that we don't have to have global variables. global IS_SERVICE_ACCOUNT IS_SERVICE_ACCOUNT = True else: raise boto.auth_handler.NotReadyToAuthenticate() def add_auth(self, http_request): http_request.headers['Authorization'] = ( self.oauth2_client.GetAuthorizationHeader()) PK �+�Z��sX~ X~ oauth2_client.pynu �[��� # Copyright 2014 Google Inc. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. """An OAuth2 client library. This library provides a client implementation of the OAuth2 protocol (see https://developers.google.com/storage/docs/authentication.html#oauth). **** Experimental API **** This module is experimental and is subject to modification or removal without notice. """ # This implementation is a wrapper around the oauth2client implementation # that implements caching of access tokens independent of refresh # tokens (in the python API client oauth2client, there is a single class that # encapsulates both refresh and access tokens). from __future__ import absolute_import import datetime import errno from hashlib import sha1 import json import logging import os import socket import tempfile import threading # pylint: disable=g-import-not-at-top if os.environ.get('USER_AGENT'): import boto boto.UserAgent += os.environ.get('USER_AGENT') # pylint: disable=g-bad-import-order import boto import httplib2 import oauth2client.client import oauth2client.service_account from google_reauth import reauth_creds import retry_decorator.retry_decorator from google.auth import _helpers from google.auth.crypt import base as crypt_base from google_auth_httplib2 import Request as GoogleAuthRequest from google_auth_httplib2 import AuthorizedHttp from google.oauth2 import service_account import six from six import BytesIO from six.moves import urllib LOG = logging.getLogger('oauth2_client') # Lock used for checking/exchanging refresh token, so multithreaded # operation doesn't attempt concurrent refreshes. token_exchange_lock = threading.Lock() CLOUD_PLATFORM_SCOPE = 'https://www.googleapis.com/auth/cloud-platform' FULL_CONTROL_SCOPE = 'https://www.googleapis.com/auth/devstorage.full_control' REAUTH_SCOPE = 'https://www.googleapis.com/auth/accounts.reauth' DEFAULT_SCOPE = FULL_CONTROL_SCOPE GOOGLE_OAUTH2_DEFAULT_FILE_PASSWORD = 'notasecret' # Note that these scopes don't necessarily correspond to the refresh token # being used. This list is is used for obtaining the RAPT in the reauth # flow, to determine which challenges should be used. We define this at module # level to allow us to override it for other applications if needed. RAPT_SCOPES = [CLOUD_PLATFORM_SCOPE, REAUTH_SCOPE] METADATA_SERVER = 'http://metadata.google.internal' META_TOKEN_URI = (METADATA_SERVER + '/computeMetadata/v1/instance/' 'service-accounts/default/token') META_HEADERS = { 'Metadata-Flavor': 'Google' } # pylint: disable=invalid-name _ServiceAccountCredentials = ( oauth2client.service_account.ServiceAccountCredentials) # pylint: enable=invalid-name # Note: this is copied from gsutil's gslib.cred_types. It should be kept in # sync. Also note that this library does not use HMAC, but it's preserved from # gsutil's copy to maintain compatibility. class CredTypes(object): HMAC = 'HMAC' OAUTH2_SERVICE_ACCOUNT = 'OAuth 2.0 Service Account' OAUTH2_USER_ACCOUNT = 'Oauth 2.0 User Account' GCE = 'GCE' class Error(Exception): """Base exception for the OAuth2 module.""" pass class AuthorizationCodeExchangeError(Error): """Error trying to exchange an authorization code into a refresh token.""" pass class TokenCache(object): """Interface for OAuth2 token caches.""" def PutToken(self, key, value): raise NotImplementedError def GetToken(self, key): raise NotImplementedError class NoopTokenCache(TokenCache): """A stub implementation of TokenCache that does nothing.""" def PutToken(self, key, value): pass def GetToken(self, key): return None class InMemoryTokenCache(TokenCache): """An in-memory token cache. The cache is implemented by a python dict, and inherits the thread-safety properties of dict. """ def __init__(self): super(InMemoryTokenCache, self).__init__() self.cache = dict() def PutToken(self, key, value): LOG.debug('InMemoryTokenCache.PutToken: key=%s', key) self.cache[key] = value def GetToken(self, key): value = self.cache.get(key, None) LOG.debug('InMemoryTokenCache.GetToken: key=%s%s present', key, ' not' if value is None else '') return value class FileSystemTokenCache(TokenCache): """An implementation of a token cache that persists tokens on disk. Each token object in the cache is stored in serialized form in a separate file. The cache file's name can be configured via a path pattern that is parameterized by the key under which a value is cached and optionally the current processes uid as obtained by os.getuid(). Since file names are generally publicly visible in the system, it is important that the cache key does not leak information about the token's value. If client code computes cache keys from token values, a cryptographically strong one-way function must be used. """ def __init__(self, path_pattern=None): """Creates a FileSystemTokenCache. Args: path_pattern: Optional string argument to specify the path pattern for cache files. The argument should be a path with format placeholders '%(key)s' and optionally '%(uid)s'. If the argument is omitted, the default pattern <tmpdir>/oauth2client-tokencache.%(uid)s.%(key)s is used, where <tmpdir> is replaced with the system temp dir as obtained from tempfile.gettempdir(). """ super(FileSystemTokenCache, self).__init__() self.path_pattern = path_pattern if not path_pattern: self.path_pattern = os.path.join( tempfile.gettempdir(), 'oauth2_client-tokencache.%(uid)s.%(key)s') def CacheFileName(self, key): uid = '_' try: # os.getuid() doesn't seem to work in Windows uid = str(os.getuid()) except: # pylint: disable=bare-except pass return self.path_pattern % {'key': key, 'uid': uid} def PutToken(self, key, value): """Serializes the value to the key's filename. To ensure that written tokens aren't leaked to a different users, we a) unlink an existing cache file, if any (to ensure we don't fall victim to symlink attacks and the like), b) create a new file with O_CREAT | O_EXCL (to ensure nobody is trying to race us) If either of these steps fail, we simply give up (but log a warning). Not caching access tokens is not catastrophic, and failure to create a file can happen for either of the following reasons: - someone is attacking us as above, in which case we want to default to safe operation (not write the token); - another legitimate process is racing us; in this case one of the two will win and write the access token, which is fine; - we don't have permission to remove the old file or write to the specified directory, in which case we can't recover Args: key: the hash key to store. value: the access_token value to serialize. """ cache_file = self.CacheFileName(key) LOG.debug('FileSystemTokenCache.PutToken: key=%s, cache_file=%s', key, cache_file) try: os.unlink(cache_file) except: # pylint: disable=bare-except # Ignore failure to unlink the file; if the file exists and can't be # unlinked, the subsequent open with O_CREAT | O_EXCL will fail. pass flags = os.O_RDWR | os.O_CREAT | os.O_EXCL # Accommodate Windows; stolen from python2.6/tempfile.py. if hasattr(os, 'O_NOINHERIT'): flags |= os.O_NOINHERIT if hasattr(os, 'O_BINARY'): flags |= os.O_BINARY try: fd = os.open(cache_file, flags, 0o600) except (OSError, IOError) as e: LOG.warning('FileSystemTokenCache.PutToken: ' 'Failed to create cache file %s: %s', cache_file, e) return f = os.fdopen(fd, 'w+b') serialized = value.Serialize() if isinstance(serialized, six.text_type): serialized = serialized.encode('utf-8') f.write(six.ensure_binary(serialized)) f.close() def GetToken(self, key): """Returns a deserialized access token from the key's filename.""" value = None cache_file = self.CacheFileName(key) try: f = open(cache_file) value = AccessToken.UnSerialize(f.read()) f.close() except (IOError, OSError) as e: if e.errno != errno.ENOENT: LOG.warning('FileSystemTokenCache.GetToken: ' 'Failed to read cache file %s: %s', cache_file, e) except Exception as e: # pylint: disable=broad-except LOG.warning('FileSystemTokenCache.GetToken: ' 'Failed to read cache file %s (possibly corrupted): %s', cache_file, e) LOG.debug('FileSystemTokenCache.GetToken: key=%s%s present (cache_file=%s)', key, ' not' if value is None else '', cache_file) return value class PKCS12Signer(crypt_base.Signer, crypt_base.FromServiceAccountMixin): """Signer for a p12 service account key.""" def __init__(self, key): self._key = key # Defined in crypt_base.Signer interface. # It is not used by p12 service account keys. @property def key_id(self): return None def sign(self, message): message = _helpers.to_bytes(message) from google.auth.crypt import _cryptography_rsa # pylint: disable=g-import-not-at-top return self._key.sign( message, _cryptography_rsa._PADDING, # pylint: disable=protected-access _cryptography_rsa._SHA256) # pylint: disable=protected-access @classmethod def from_string(cls, key_strings, key_id=None): del key_id #Unused key_string, password = (_helpers.to_bytes(k) for k in key_strings) # Cryptography package is not bundled with gsutil, Keeping it at top would throw error. from cryptography.hazmat.primitives.serialization import pkcs12 # pylint: disable=g-import-not-at-top try: key, _, _ = pkcs12.load_key_and_certificates(key_string, password) return cls(key) except: raise GsInvalidRefreshTokenError('Unable to load the keyfile, Invalid password or PKCS12 data.') class P12Credentials(service_account.Credentials): """google-auth service account credentials for p12 keys. p12 keys are not supported by the google-auth service account credentials. gsutil uses oauth2client to support p12 key users. Since oauth2client was deprecated and bundling it is security concern, we decided to support p12 in gsutil codebase. We prefer not adding it to the google-auth library because p12 is not supported from the beginning by google-auth. GCP strongly suggests users to use the JSON format. gsutil has to support it to not break users. """ _REQUIRED_FIELDS = ('service_account_email', 'token_uri', 'scopes') def authorize(self, http): return AuthorizedHttp(self, http=http) @property def access_token(self): return self.token @property def token_expiry(self): return self.expiry @classmethod def from_service_account_pkcs12_keystring(cls, key_string, password=None, **kwargs): password = password or GOOGLE_OAUTH2_DEFAULT_FILE_PASSWORD signer = PKCS12Signer.from_string((key_string, password)) missing_fields = [f for f in cls._REQUIRED_FIELDS if f not in kwargs] if missing_fields: raise MissingFieldsError('Missing fields: {}.'.format( ', '.join(missing_fields))) creds = cls(signer, **kwargs) return creds def CreateP12ServiceAccountCredentials(key_string, password=None, **kwargs): """Creates a service account credentials from a p12 key and handles import errors.""" try: return P12Credentials.from_service_account_pkcs12_keystring( key_string, password, **kwargs) except ImportError: raise MissingDependencyError( ('pyca/cryptography is not available. Either install it, or please consider using the .json keyfile')) class OAuth2Client(object): """Common logic for OAuth2 clients.""" def __init__(self, cache_key_base, access_token_cache=None, datetime_strategy=datetime.datetime, auth_uri=None, token_uri=None, disable_ssl_certificate_validation=False, proxy_host=None, proxy_port=None, proxy_user=None, proxy_pass=None, ca_certs_file=None): # datetime_strategy is used to invoke utcnow() on; it is injected into the # constructor for unit testing purposes. self.auth_uri = auth_uri self.token_uri = token_uri self.cache_key_base = cache_key_base self.datetime_strategy = datetime_strategy self.access_token_cache = access_token_cache or InMemoryTokenCache() self.disable_ssl_certificate_validation = disable_ssl_certificate_validation self.ca_certs_file = ca_certs_file if proxy_host and proxy_port: self._proxy_info = httplib2.ProxyInfo(httplib2.socks.PROXY_TYPE_HTTP, proxy_host, proxy_port, proxy_user=proxy_user, proxy_pass=proxy_pass, proxy_rdns=True) else: self._proxy_info = None def CreateHttpRequest(self): return httplib2.Http( ca_certs=self.ca_certs_file, disable_ssl_certificate_validation=( self.disable_ssl_certificate_validation), proxy_info=self._proxy_info) def GetAccessToken(self): """Obtains an access token for this client. This client's access token cache is first checked for an existing, not-yet-expired access token. If none is found, the client obtains a fresh access token from the OAuth2 provider's token endpoint. Returns: The cached or freshly obtained AccessToken. Raises: oauth2client.client.AccessTokenRefreshError if an error occurs. """ # Ensure only one thread at a time attempts to get (and possibly refresh) # the access token. This doesn't prevent concurrent refresh attempts across # multiple gsutil instances, but at least protects against multiple threads # simultaneously attempting to refresh when gsutil -m is used. token_exchange_lock.acquire() try: cache_key = self.CacheKey() LOG.debug('GetAccessToken: checking cache for key %s', cache_key) access_token = self.access_token_cache.GetToken(cache_key) LOG.debug('GetAccessToken: token from cache: %s', access_token) if access_token is None or access_token.ShouldRefresh(): rapt = None if access_token is None else access_token.rapt_token LOG.debug('GetAccessToken: fetching fresh access token...') access_token = self.FetchAccessToken(rapt_token=rapt) LOG.debug('GetAccessToken: fresh access token: %s', access_token) self.access_token_cache.PutToken(cache_key, access_token) return access_token finally: token_exchange_lock.release() def CacheKey(self): """Computes a cache key. The cache key is computed as the SHA1 hash of the refresh token for user accounts, or the hash of the gs_service_client_id for service accounts, which satisfies the FileSystemTokenCache requirement that cache keys do not leak information about token values. Returns: A hash key. """ h = sha1() # Unicode objects (i.e. strings in Python 3) must be encoded before hashing if isinstance(self.cache_key_base, six.text_type): val = self.cache_key_base.encode('utf-8') else: val = self.cache_key_base h.update(val) return h.hexdigest() def GetAuthorizationHeader(self): """Gets the access token HTTP authorization header value. Returns: The value of an Authorization HTTP header that authenticates requests with an OAuth2 access token. """ return 'Bearer %s' % self.GetAccessToken().token class _BaseOAuth2ServiceAccountClient(OAuth2Client): """Base class for OAuth2ServiceAccountClients. Args: client_id: The OAuth2 client ID of this client. access_token_cache: An optional instance of a TokenCache. If omitted or None, an InMemoryTokenCache is used. auth_uri: The URI for OAuth2 authorization. token_uri: The URI used to refresh access tokens. datetime_strategy: datetime module strategy to use. disable_ssl_certificate_validation: True if certifications should not be validated. proxy_host: An optional string specifying the host name of an HTTP proxy to be used. proxy_port: An optional int specifying the port number of an HTTP proxy to be used. proxy_user: An optional string specifying the user name for interacting with the HTTP proxy. proxy_pass: An optional string specifying the password for interacting with the HTTP proxy. ca_certs_file: The cacerts.txt file to use. """ def __init__(self, client_id, access_token_cache=None, auth_uri=None, token_uri=None, datetime_strategy=datetime.datetime, disable_ssl_certificate_validation=False, proxy_host=None, proxy_port=None, proxy_user=None, proxy_pass=None, ca_certs_file=None): super(_BaseOAuth2ServiceAccountClient, self).__init__( cache_key_base=client_id, auth_uri=auth_uri, token_uri=token_uri, access_token_cache=access_token_cache, datetime_strategy=datetime_strategy, disable_ssl_certificate_validation=disable_ssl_certificate_validation, proxy_host=proxy_host, proxy_port=proxy_port, proxy_user=proxy_user, proxy_pass=proxy_pass, ca_certs_file=ca_certs_file) self._client_id = client_id def FetchAccessToken(self, rapt_token=None): credentials = self.GetCredentials() request = self.CreateHttpRequest() if isinstance(credentials, P12Credentials): request = GoogleAuthRequest(request) credentials.refresh(request) return AccessToken(credentials.access_token, credentials.token_expiry, datetime_strategy=self.datetime_strategy, rapt_token=rapt_token) class OAuth2ServiceAccountClient(_BaseOAuth2ServiceAccountClient): """An OAuth2 service account client using .p12 or .pem keys.""" def __init__(self, client_id, private_key, password, access_token_cache=None, auth_uri=None, token_uri=None, datetime_strategy=datetime.datetime, disable_ssl_certificate_validation=False, proxy_host=None, proxy_port=None, proxy_user=None, proxy_pass=None, ca_certs_file=None): # Avoid long repeated kwargs list. # pylint: disable=g-doc-args """Creates an OAuth2ServiceAccountClient. Args: client_id: The OAuth2 client ID of this client. private_key: The private key associated with this service account. password: The private key password used for the crypto signer. Keyword arguments match the _BaseOAuth2ServiceAccountClient class. """ # pylint: enable=g-doc-args super(OAuth2ServiceAccountClient, self).__init__( client_id, auth_uri=auth_uri, token_uri=token_uri, access_token_cache=access_token_cache, datetime_strategy=datetime_strategy, disable_ssl_certificate_validation=disable_ssl_certificate_validation, proxy_host=proxy_host, proxy_port=proxy_port, proxy_user=proxy_user, proxy_pass=proxy_pass, ca_certs_file=ca_certs_file) self._private_key = private_key self._password = password def GetCredentials(self): return CreateP12ServiceAccountCredentials(self._private_key, self._password, scopes=[DEFAULT_SCOPE], service_account_email=self._client_id, token_uri=self.token_uri) class OAuth2JsonServiceAccountClient(_BaseOAuth2ServiceAccountClient): """An OAuth2 service account client using .json keys.""" def __init__(self, json_key_dict, access_token_cache=None, auth_uri=None, token_uri=None, datetime_strategy=datetime.datetime, disable_ssl_certificate_validation=False, proxy_host=None, proxy_port=None, proxy_user=None, proxy_pass=None, ca_certs_file=None): # Avoid long repeated kwargs list. # pylint: disable=g-doc-args """Creates an OAuth2JsonServiceAccountClient. Args: json_key_dict: dictionary from the json private key file. Includes: client_id: The OAuth2 client ID of this client. client_email: The email associated with this client. private_key_id: The private key id associated with this service account. private_key_pkcs8_text: The pkcs8 text containing the private key data. Keyword arguments match the _BaseOAuth2ServiceAccountClient class. """ # pylint: enable=g-doc-args super(OAuth2JsonServiceAccountClient, self).__init__( json_key_dict['client_id'], auth_uri=auth_uri, token_uri=token_uri, access_token_cache=access_token_cache, datetime_strategy=datetime_strategy, disable_ssl_certificate_validation=disable_ssl_certificate_validation, proxy_host=proxy_host, proxy_port=proxy_port, proxy_user=proxy_user, proxy_pass=proxy_pass, ca_certs_file=ca_certs_file) self._json_key_dict = json_key_dict self._service_account_email = json_key_dict['client_email'] self._private_key_id = json_key_dict['private_key_id'] self._private_key_pkcs8_text = json_key_dict['private_key'] def GetCredentials(self): return _ServiceAccountCredentials.from_json_keyfile_dict( self._json_key_dict, scopes=[DEFAULT_SCOPE], token_uri=self.token_uri) class GsAccessTokenRefreshError(Exception): """Transient error when requesting access token.""" def __init__(self, e): super(GsAccessTokenRefreshError, self).__init__(e) class GsInvalidRefreshTokenError(Exception): def __init__(self, e): super(GsInvalidRefreshTokenError, self).__init__(e) class MissingDependencyError(Exception): def __init__(self, e): super(MissingDependencyError, self).__init__(e) class MissingFieldsError(Exception): def __init__(self, e): super(MissingFieldsError, self).__init__(e) class OAuth2UserAccountClient(OAuth2Client): """An OAuth2 client.""" def __init__(self, token_uri, client_id, client_secret, refresh_token, auth_uri=None, access_token_cache=None, datetime_strategy=datetime.datetime, disable_ssl_certificate_validation=False, proxy_host=None, proxy_port=None, proxy_user=None, proxy_pass=None, ca_certs_file=None): """Creates an OAuth2UserAccountClient. Args: token_uri: The URI used to refresh access tokens. client_id: The OAuth2 client ID of this client. client_secret: The OAuth2 client secret of this client. refresh_token: The token used to refresh the access token. auth_uri: The URI for OAuth2 authorization. access_token_cache: An optional instance of a TokenCache. If omitted or None, an InMemoryTokenCache is used. datetime_strategy: datetime module strategy to use. disable_ssl_certificate_validation: True if certifications should not be validated. proxy_host: An optional string specifying the host name of an HTTP proxy to be used. proxy_port: An optional int specifying the port number of an HTTP proxy to be used. proxy_user: An optional string specifying the user name for interacting with the HTTP proxy. proxy_pass: An optional string specifying the password for interacting with the HTTP proxy. ca_certs_file: The cacerts.txt file to use. """ super(OAuth2UserAccountClient, self).__init__( cache_key_base=refresh_token, auth_uri=auth_uri, token_uri=token_uri, access_token_cache=access_token_cache, datetime_strategy=datetime_strategy, disable_ssl_certificate_validation=disable_ssl_certificate_validation, proxy_host=proxy_host, proxy_port=proxy_port, proxy_user=proxy_user, proxy_pass=proxy_pass, ca_certs_file=ca_certs_file) self.token_uri = token_uri self.client_id = client_id self.client_secret = client_secret self.refresh_token = refresh_token def GetCredentials(self): """Fetches a credentials objects from the provider's token endpoint.""" access_token = self.GetAccessToken() credentials = reauth_creds.Oauth2WithReauthCredentials( access_token.token, self.client_id, self.client_secret, self.refresh_token, access_token.expiry, self.token_uri, None) # user_agent return credentials @retry_decorator.retry( GsAccessTokenRefreshError, tries=boto.config.get('OAuth2', 'oauth2_refresh_retries', 6), timeout_secs=1) def FetchAccessToken(self, rapt_token=None): """Fetches an access token from the provider's token endpoint. Fetches an access token from this client's OAuth2 provider's token endpoint. Args: rapt_token: (str) The RAPT to be passed when refreshing the access token. Returns: The fetched AccessToken. """ try: http = self.CreateHttpRequest() credentials = reauth_creds.Oauth2WithReauthCredentials( None, # access_token self.client_id, self.client_secret, self.refresh_token, None, # token_expiry self.token_uri, None, # user_agent scopes=RAPT_SCOPES, rapt_token=rapt_token) credentials.refresh(http) return AccessToken( credentials.access_token, credentials.token_expiry, datetime_strategy=self.datetime_strategy, rapt_token=credentials.rapt_token) except oauth2client.client.AccessTokenRefreshError as e: if 'Invalid response 403' in e.message: # This is the most we can do at the moment to accurately detect rate # limiting errors since they come back as 403s with no further # information. raise GsAccessTokenRefreshError(e) elif 'invalid_grant' in e.message: LOG.info(""" Attempted to retrieve an access token from an invalid refresh token. Two common cases in which you will see this error are: 1. Your refresh token was revoked. 2. Your refresh token was typed incorrectly. """) raise GsInvalidRefreshTokenError(e) else: raise class OAuth2GCEClient(OAuth2Client): """OAuth2 client for GCE instance.""" def __init__(self): super(OAuth2GCEClient, self).__init__( cache_key_base='', # Only InMemoryTokenCache can be used with empty cache_key_base. access_token_cache=InMemoryTokenCache()) @retry_decorator.retry(GsAccessTokenRefreshError, tries=6, timeout_secs=1) def FetchAccessToken(self, rapt_token=None): """Fetches an access token from the provider's token endpoint. Fetches an access token from the GCE metadata server. Args: rapt_token: (str) Ignored for this class. Service accounts don't use reauth credentials. Returns: The fetched AccessToken. """ del rapt_token # Unused for service account credentials. # Note that rapt_token is used only for user credentials, and thus should # always be None in the context of GCE (service account) credentials. response = None try: http = httplib2.Http() response, content = http.request(META_TOKEN_URI, method='GET', body=None, headers=META_HEADERS) content = six.ensure_text(content) except Exception as e: raise GsAccessTokenRefreshError(e) if response.status == 200: d = json.loads(content) return AccessToken( d['access_token'], datetime.datetime.now() + datetime.timedelta(seconds=d.get('expires_in', 0)), datetime_strategy=self.datetime_strategy, rapt_token=None) def _IsGCE(): """Returns True if running on a GCE instance, otherwise False.""" try: http = httplib2.Http() response, _ = http.request(METADATA_SERVER) return response.status == 200 except (httplib2.ServerNotFoundError, socket.error): # We might see something like "No route to host" propagated as a socket # error. We might also catch transient socket errors, but at that point # we're going to fail anyway, just with a different error message. With # this approach, we'll avoid having to enumerate all possible non-transient # socket errors. return False except Exception as e: # pylint: disable=broad-except LOG.warning("Failed to determine whether we're running on GCE, so we'll" "assume that we aren't: %s", e) return False return False def CreateOAuth2GCEClient(): return OAuth2GCEClient() if _IsGCE() else None class AccessToken(object): """Encapsulates an OAuth2 access token.""" def __init__(self, token, expiry, datetime_strategy=datetime.datetime, rapt_token=None): self.token = token self.expiry = expiry self.datetime_strategy = datetime_strategy # RAPT isn't technically part of the access token, but we can use the # RAPT from an expired access token when refreshing to get a new access # token. This allows users to only answer reauth challenges when the RAPT # expires (usually ~once a day), as opposed to every time the access token # expires (usually after an hour). self.rapt_token = rapt_token @staticmethod def UnSerialize(query): """Creates an AccessToken object from its serialized form.""" def GetValue(d, key): return (d.get(key, [None]))[0] kv = urllib.parse.parse_qs(query) if 'token' not in kv or not kv['token']: return None expiry = None expiry_tuple = GetValue(kv, 'expiry') if expiry_tuple: try: expiry = datetime.datetime( *[int(n) for n in expiry_tuple.split(',')]) except: # pylint: disable=bare-except return None rapt_token = GetValue(kv, 'rapt_token') return AccessToken(GetValue(kv, 'token'), expiry, rapt_token=rapt_token) def Serialize(self): """Serializes this object as URI-encoded key-value pairs.""" # There's got to be a better way to serialize a datetime. Unfortunately, # there is no reliable way to convert into a unix epoch. kv = {'token': self.token} if self.expiry: t = self.expiry tupl = (t.year, t.month, t.day, t.hour, t.minute, t.second, t.microsecond) kv['expiry'] = ','.join([str(i) for i in tupl]) if self.rapt_token: kv['rapt_token'] = self.rapt_token return urllib.parse.urlencode(kv) def ShouldRefresh(self, time_delta=300): """Whether the access token needs to be refreshed. Args: time_delta: refresh access token when it expires within time_delta secs. Returns: True if the token is expired or about to expire, False if the token should be expected to work. Note that the token may still be rejected, e.g. if it has been revoked server-side. """ if self.expiry is None: return False return (self.datetime_strategy.utcnow() + datetime.timedelta(seconds=time_delta) > self.expiry) def __eq__(self, other): return self.token == other.token and self.expiry == other.expiry def __ne__(self, other): return not self.__eq__(other) def __str__(self): return 'AccessToken(token=%s, expiry=%sZ)' % (self.token, self.expiry) PK �+�Z�%�\! \! oauth2_helper.pynu �[��� # Copyright 2014 Google Inc. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. """Helper routines to facilitate use of oauth2_client.""" from __future__ import absolute_import import io import json import os import sys import time import webbrowser from gcs_oauth2_boto_plugin import oauth2_client import oauth2client.client from six.moves import input # pylint: disable=redefined-builtin UTF8 = 'utf-8' CLIENT_ID = None CLIENT_SECRET = None GOOGLE_OAUTH2_PROVIDER_AUTHORIZATION_URI = ( 'https://accounts.google.com/o/oauth2/auth') GOOGLE_OAUTH2_PROVIDER_TOKEN_URI = ( 'https://oauth2.googleapis.com/token') GOOGLE_OAUTH2_DEFAULT_FILE_PASSWORD = 'notasecret' OOB_REDIRECT_URI = 'urn:ietf:wg:oauth:2.0:oob' def OAuth2ClientFromBotoConfig( config, cred_type=oauth2_client.CredTypes.OAUTH2_USER_ACCOUNT): """Create a client type based on credentials supplied in boto config.""" token_cache = None token_cache_type = config.get('OAuth2', 'token_cache', 'file_system') if token_cache_type == 'file_system': if config.has_option('OAuth2', 'token_cache_path_pattern'): token_cache = oauth2_client.FileSystemTokenCache( path_pattern=config.get('OAuth2', 'token_cache_path_pattern')) else: token_cache = oauth2_client.FileSystemTokenCache() elif token_cache_type == 'in_memory': token_cache = oauth2_client.InMemoryTokenCache() else: raise Exception( 'Invalid value for config option OAuth2/token_cache: %s' % token_cache_type) proxy_host = None proxy_port = None proxy_user = None proxy_pass = None if (config.has_option('Boto', 'proxy') and config.has_option('Boto', 'proxy_port')): proxy_host = config.get('Boto', 'proxy') proxy_port = int(config.get('Boto', 'proxy_port')) proxy_user = config.get('Boto', 'proxy_user', None) proxy_pass = config.get('Boto', 'proxy_pass', None) provider_authorization_uri = config.get( 'OAuth2', 'provider_authorization_uri', GOOGLE_OAUTH2_PROVIDER_AUTHORIZATION_URI) provider_token_uri = config.get( 'OAuth2', 'provider_token_uri', GOOGLE_OAUTH2_PROVIDER_TOKEN_URI) if cred_type == oauth2_client.CredTypes.OAUTH2_SERVICE_ACCOUNT: service_client_id = config.get('Credentials', 'gs_service_client_id', '') private_key_filename = config.get('Credentials', 'gs_service_key_file', '') with io.open(private_key_filename, 'rb') as private_key_file: private_key = private_key_file.read() keyfile_is_utf8 = False try: private_key = private_key.decode(UTF8) # P12 keys won't be encoded as UTF8 bytes. keyfile_is_utf8 = True except UnicodeDecodeError: pass if keyfile_is_utf8: try: json_key_dict = json.loads(private_key) except ValueError: raise Exception('Could not parse JSON keyfile "%s" as valid JSON' % private_key_filename) for json_entry in ('client_id', 'client_email', 'private_key_id', 'private_key'): if json_entry not in json_key_dict: raise Exception('The JSON private key file at %s ' 'did not contain the required entry: %s' % (private_key_filename, json_entry)) return oauth2_client.OAuth2JsonServiceAccountClient( json_key_dict, access_token_cache=token_cache, auth_uri=provider_authorization_uri, token_uri=provider_token_uri, disable_ssl_certificate_validation=not(config.getbool( 'Boto', 'https_validate_certificates', True)), proxy_host=proxy_host, proxy_port=proxy_port, proxy_user=proxy_user, proxy_pass=proxy_pass) else: key_file_pass = config.get('Credentials', 'gs_service_key_file_password', GOOGLE_OAUTH2_DEFAULT_FILE_PASSWORD) return oauth2_client.OAuth2ServiceAccountClient( service_client_id, private_key, key_file_pass, access_token_cache=token_cache, auth_uri=provider_authorization_uri, token_uri=provider_token_uri, disable_ssl_certificate_validation=not(config.getbool( 'Boto', 'https_validate_certificates', True)), proxy_host=proxy_host, proxy_port=proxy_port, proxy_user=proxy_user, proxy_pass=proxy_pass) elif cred_type == oauth2_client.CredTypes.OAUTH2_USER_ACCOUNT: client_id = config.get('OAuth2', 'client_id', os.environ.get('OAUTH2_CLIENT_ID', CLIENT_ID)) if not client_id: raise Exception( 'client_id for your application obtained from ' 'https://console.developers.google.com must be set in a boto config ' 'or with OAUTH2_CLIENT_ID environment variable or with ' 'gcs_oauth2_boto_plugin.SetFallbackClientIdAndSecret function.') client_secret = config.get('OAuth2', 'client_secret', os.environ.get('OAUTH2_CLIENT_SECRET', CLIENT_SECRET)) ca_certs_file = config.get_value('Boto', 'ca_certificates_file') if ca_certs_file == 'system': ca_certs_file = None if not client_secret: raise Exception( 'client_secret for your application obtained from ' 'https://console.developers.google.com must be set in a boto config ' 'or with OAUTH2_CLIENT_SECRET environment variable or with ' 'gcs_oauth2_boto_plugin.SetFallbackClientIdAndSecret function.') return oauth2_client.OAuth2UserAccountClient( provider_token_uri, client_id, client_secret, config.get('Credentials', 'gs_oauth2_refresh_token'), auth_uri=provider_authorization_uri, access_token_cache=token_cache, disable_ssl_certificate_validation=not(config.getbool( 'Boto', 'https_validate_certificates', True)), proxy_host=proxy_host, proxy_port=proxy_port, proxy_user=proxy_user, proxy_pass=proxy_pass, ca_certs_file=ca_certs_file) else: raise Exception('You have attempted to create an OAuth2 client without ' 'setting up OAuth2 credentials.') def OAuth2ApprovalFlow(client, scopes, launch_browser=False): """Run the OAuth2 flow to fetch a refresh token. Returns the refresh token.""" flow = oauth2client.client.OAuth2WebServerFlow( client.client_id, client.client_secret, scopes, auth_uri=client.auth_uri, token_uri=client.token_uri, redirect_uri=OOB_REDIRECT_URI) approval_url = flow.step1_get_authorize_url() if launch_browser: sys.stdout.write( 'Attempting to launch a browser with the OAuth2 approval dialog at ' 'URL: %s\n\n' '[Note: due to a Python bug, you may see a spurious error message ' '"object is not\ncallable [...] in [...] Popen.__del__" which can be ' 'ignored.]\n\n' % approval_url) else: sys.stdout.write( 'Please navigate your browser to the following URL:\n%s\n' % approval_url) sys.stdout.write( 'In your browser you should see a page that requests you to authorize ' 'access to Google Cloud Platform APIs and Services on your behalf. ' 'After you approve, an authorization code will be displayed.\n\n') if (launch_browser and not webbrowser.open(approval_url, new=1, autoraise=True)): sys.stdout.write( 'Launching browser appears to have failed; please navigate a browser ' 'to the following URL:\n%s\n' % approval_url) # Short delay; webbrowser.open on linux insists on printing out a message # which we don't want to run into the prompt for the auth code. time.sleep(2) code = input('Enter the authorization code: ') credentials = flow.step2_exchange(code, http=client.CreateHttpRequest()) return credentials.refresh_token def SetFallbackClientIdAndSecret(client_id, client_secret): global CLIENT_ID global CLIENT_SECRET CLIENT_ID = client_id CLIENT_SECRET = client_secret def SetLock(lock): oauth2_client.token_exchange_lock = lock PK �+�Zq�77 77 test_oauth2_client.pynu �[��� # Copyright 2014 Google Inc. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. """Unit tests for oauth2_client and related classes.""" from __future__ import absolute_import import datetime import logging import os import stat import sys import unittest from freezegun import freeze_time from gcs_oauth2_boto_plugin import oauth2_client import httplib2 try: from unittest import mock except ImportError: import mock LOG = logging.getLogger('test_oauth2_client') ACCESS_TOKEN = 'abc123' RAPT_TOKEN = 'rapt123' TOKEN_URI = 'https://provider.example.com/oauth/provider?mode=token' AUTH_URI = 'https://provider.example.com/oauth/provider?mode=authorize' DEFAULT_CA_CERTS_FILE = os.path.abspath( os.path.join('gslib', 'data', 'cacerts.txt')) IS_WINDOWS = 'win32' in str(sys.platform).lower() class MockDateTime(object): def __init__(self): self.mock_now = None def utcnow(self): # pylint: disable=invalid-name return self.mock_now class MockOAuth2ServiceAccountClient(oauth2_client.OAuth2ServiceAccountClient): """Mock service account client for testing OAuth2 with service accounts.""" def __init__(self, client_id, private_key, password, auth_uri, token_uri, datetime_strategy): super(MockOAuth2ServiceAccountClient, self).__init__( client_id, private_key, password, auth_uri=auth_uri, token_uri=token_uri, datetime_strategy=datetime_strategy, ca_certs_file=DEFAULT_CA_CERTS_FILE) self.Reset() def Reset(self): self.fetched_token = False def FetchAccessToken(self, rapt_token=None): self.fetched_token = True return oauth2_client.AccessToken( ACCESS_TOKEN, GetExpiry(self.datetime_strategy, 3600), datetime_strategy=self.datetime_strategy, rapt_token=None) class MockOAuth2UserAccountClient(oauth2_client.OAuth2UserAccountClient): """Mock user account client for testing OAuth2 with user accounts.""" def __init__(self, token_uri, client_id, client_secret, refresh_token, auth_uri, datetime_strategy): super(MockOAuth2UserAccountClient, self).__init__( token_uri, client_id, client_secret, refresh_token, auth_uri=auth_uri, datetime_strategy=datetime_strategy, ca_certs_file=DEFAULT_CA_CERTS_FILE) self.Reset() def Reset(self): self.fetched_token = False def FetchAccessToken(self, rapt_token=None): self.fetched_token = True return oauth2_client.AccessToken( ACCESS_TOKEN, GetExpiry(self.datetime_strategy, 3600), datetime_strategy=self.datetime_strategy, rapt_token=RAPT_TOKEN if rapt_token is None else rapt_token) def GetExpiry(datetime_strategy, length_in_seconds): token_expiry = (datetime_strategy.utcnow() + datetime.timedelta(seconds=length_in_seconds)) return token_expiry def CreateMockUserAccountClient(mock_datetime): return MockOAuth2UserAccountClient( TOKEN_URI, 'clid', 'clsecret', 'ref_token_abc123', AUTH_URI, mock_datetime) def CreateMockServiceAccountClient(mock_datetime): return MockOAuth2ServiceAccountClient( 'clid', 'private_key', 'password', AUTH_URI, TOKEN_URI, mock_datetime) class OAuth2AccountClientTest(unittest.TestCase): """Unit tests for OAuth2UserAccountClient and OAuth2ServiceAccountClient.""" def setUp(self): self.tempdirs = [] self.mock_datetime = MockDateTime() self.start_time = datetime.datetime(2011, 3, 1, 11, 25, 13, 300826) self.mock_datetime.mock_now = self.start_time def testGetAccessTokenUserAccount(self): self.client = CreateMockUserAccountClient(self.mock_datetime) self._RunGetAccessTokenTest(expected_rapt=RAPT_TOKEN) def testGetAccessTokenServiceAccount(self): self.client = CreateMockServiceAccountClient(self.mock_datetime) self._RunGetAccessTokenTest() def _RunGetAccessTokenTest(self, expected_rapt=None): """Tests access token gets with self.client.""" access_token_1 = 'abc123' self.assertFalse(self.client.fetched_token) token_1 = self.client.GetAccessToken() # There's no access token in the cache; verify that we fetched a fresh # token. self.assertTrue(self.client.fetched_token) self.assertEqual(access_token_1, token_1.token) self.assertEqual(self.start_time + datetime.timedelta(minutes=60), token_1.expiry) self.assertEqual(token_1.rapt_token, expected_rapt) # Advance time by less than expiry time, and fetch another token. self.client.Reset() self.mock_datetime.mock_now = ( self.start_time + datetime.timedelta(minutes=55)) token_2 = self.client.GetAccessToken() # Since the access token wasn't expired, we get the cache token, and there # was no refresh request. self.assertEqual(token_1, token_2) self.assertEqual(access_token_1, token_2.token) self.assertFalse(self.client.fetched_token) # Advance time past expiry time, and fetch another token. self.client.Reset() self.mock_datetime.mock_now = ( self.start_time + datetime.timedelta(minutes=55, seconds=1)) self.client.datetime_strategy = self.mock_datetime token_3 = self.client.GetAccessToken() # This should have resulted in a refresh request and a fresh access token. self.assertTrue(self.client.fetched_token) self.assertEqual( self.mock_datetime.mock_now + datetime.timedelta(minutes=60), token_3.expiry) self.assertEqual(token_3.rapt_token, expected_rapt) class TestCreateP12ServiceAccountCredentials(unittest.TestCase): @mock.patch.object(oauth2_client.PKCS12Signer, 'from_string') def test_from_service_account_pkcs12_keystring(self, mock_signer): mock_signer.return_value = 'MOCK_SIGNER' with mock.patch.object(oauth2_client.P12Credentials, '__init__') as mock_p12creds: mock_p12creds.return_value = None oauth2_client.P12Credentials.from_service_account_pkcs12_keystring( 'MY_KEY', service_account_email='test@google.com', token_uri= 'TOKEN_URI', scopes= ['MYSCOPEEEEE'] ) mock_p12creds.assert_called_once_with('MOCK_SIGNER', service_account_email='test@google.com', token_uri= 'TOKEN_URI', scopes= ['MYSCOPEEEEE']) @mock.patch.object(oauth2_client.PKCS12Signer, 'from_string') def test_from_service_account_pkcs12_keystring_raises_missing_field(self, mock_signer): mock_signer.return_value = 'MOCK_SIGNER' with self.assertRaises(oauth2_client.MissingFieldsError) as exc: oauth2_client.P12Credentials.from_service_account_pkcs12_keystring( 'MY_KEY', token_uri= 'TOKEN_URI', scopes= ['MYSCOPEEEEE'] ) class AccessTokenTest(unittest.TestCase): """Unit tests for access token functions.""" def testShouldRefresh(self): """Tests that token.ShouldRefresh returns the correct value.""" mock_datetime = MockDateTime() start = datetime.datetime(2011, 3, 1, 11, 25, 13, 300826) expiry = start + datetime.timedelta(minutes=60) token = oauth2_client.AccessToken( 'foo', expiry, datetime_strategy=mock_datetime) mock_datetime.mock_now = start self.assertFalse(token.ShouldRefresh()) mock_datetime.mock_now = start + datetime.timedelta(minutes=54) self.assertFalse(token.ShouldRefresh()) mock_datetime.mock_now = start + datetime.timedelta(minutes=55) self.assertFalse(token.ShouldRefresh()) mock_datetime.mock_now = start + datetime.timedelta( minutes=55, seconds=1) self.assertTrue(token.ShouldRefresh()) mock_datetime.mock_now = start + datetime.timedelta( minutes=61) self.assertTrue(token.ShouldRefresh()) mock_datetime.mock_now = start + datetime.timedelta(minutes=58) self.assertFalse(token.ShouldRefresh(time_delta=120)) mock_datetime.mock_now = start + datetime.timedelta( minutes=58, seconds=1) self.assertTrue(token.ShouldRefresh(time_delta=120)) def testShouldRefreshNoExpiry(self): """Tests token.ShouldRefresh with no expiry time.""" mock_datetime = MockDateTime() start = datetime.datetime(2011, 3, 1, 11, 25, 13, 300826) token = oauth2_client.AccessToken( 'foo', None, datetime_strategy=mock_datetime) mock_datetime.mock_now = start self.assertFalse(token.ShouldRefresh()) mock_datetime.mock_now = start + datetime.timedelta( minutes=472) self.assertFalse(token.ShouldRefresh()) def testSerialization(self): """Tests token serialization.""" expiry = datetime.datetime(2011, 3, 1, 11, 25, 13, 300826) token = oauth2_client.AccessToken('foo', expiry, rapt_token=RAPT_TOKEN) serialized_token = token.Serialize() LOG.debug('testSerialization: serialized_token=%s', serialized_token) token2 = oauth2_client.AccessToken.UnSerialize(serialized_token) self.assertEqual(token, token2) class FileSystemTokenCacheTest(unittest.TestCase): """Unit tests for FileSystemTokenCache.""" def setUp(self): self.cache = oauth2_client.FileSystemTokenCache() self.start_time = datetime.datetime(2011, 3, 1, 10, 25, 13, 300826) self.token_1 = oauth2_client.AccessToken( 'token1', self.start_time, rapt_token=RAPT_TOKEN) self.token_2 = oauth2_client.AccessToken( 'token2', self.start_time + datetime.timedelta(seconds=492), rapt_token=RAPT_TOKEN) self.key = 'token1key' def tearDown(self): try: os.unlink(self.cache.CacheFileName(self.key)) except: # pylint: disable=bare-except pass def testPut(self): self.cache.PutToken(self.key, self.token_1) # Assert that the cache file exists and has correct permissions. if not IS_WINDOWS: self.assertEqual( 0o600, stat.S_IMODE(os.stat(self.cache.CacheFileName(self.key)).st_mode)) def testPutGet(self): """Tests putting and getting various tokens.""" # No cache file present. self.assertEqual(None, self.cache.GetToken(self.key)) # Put a token self.cache.PutToken(self.key, self.token_1) cached_token = self.cache.GetToken(self.key) self.assertEqual(self.token_1, cached_token) # Put a different token self.cache.PutToken(self.key, self.token_2) cached_token = self.cache.GetToken(self.key) self.assertEqual(self.token_2, cached_token) def testGetBadFile(self): f = open(self.cache.CacheFileName(self.key), 'w') f.write('blah') f.close() self.assertEqual(None, self.cache.GetToken(self.key)) def testCacheFileName(self): """Tests configuring the cache with a specific file name.""" cache = oauth2_client.FileSystemTokenCache( path_pattern='/var/run/ccache/token.%(uid)s.%(key)s') if IS_WINDOWS: uid = '_' else: uid = os.getuid() self.assertEqual('/var/run/ccache/token.%s.abc123' % uid, cache.CacheFileName('abc123')) cache = oauth2_client.FileSystemTokenCache( path_pattern='/var/run/ccache/token.%(key)s') self.assertEqual('/var/run/ccache/token.abc123', cache.CacheFileName('abc123')) class RefreshTokenTest(unittest.TestCase): """Unit tests for refresh tokens.""" def setUp(self): self.mock_datetime = MockDateTime() self.start_time = datetime.datetime(2011, 3, 1, 10, 25, 13, 300826) self.mock_datetime.mock_now = self.start_time self.client = CreateMockUserAccountClient(self.mock_datetime) def testUniqeId(self): cred_id = self.client.CacheKey() self.assertEqual('0720afed6871f12761fbea3271f451e6ba184bf5', cred_id) def testGetAuthorizationHeader(self): self.assertEqual('Bearer %s' % ACCESS_TOKEN, self.client.GetAuthorizationHeader()) class FakeResponse(object): def __init__(self, status): self._status = status @property def status(self): return self._status class OAuth2GCEClientTest(unittest.TestCase): """Unit tests for OAuth2GCEClient.""" def setUp(self): patcher = mock.patch( 'gcs_oauth2_boto_plugin.oauth2_client.httplib2.Http', autospec=True) self.addCleanup(patcher.stop) self.mocked_http_class = patcher.start() self.mock_http = self.mocked_http_class.return_value @freeze_time('2014-03-26 01:01:01') def testFetchAccessToken(self): token = 'my_token' self.mock_http.request.return_value = ( FakeResponse(200), '{"access_token":"%(TOKEN)s", "expires_in": %(EXPIRES_IN)d}' % { 'TOKEN': token, 'EXPIRES_IN': 42 }) client = oauth2_client.OAuth2GCEClient() self.assertEqual( str(client.FetchAccessToken()), 'AccessToken(token=%s, expiry=2014-03-26 01:01:43Z)' % token) self.mock_http.request.assert_called_with( oauth2_client.META_TOKEN_URI, method='GET', body=None, headers=oauth2_client.META_HEADERS) def testIsGCENotFound(self): self.mock_http.request.return_value = (FakeResponse(404), '') self.assertFalse(oauth2_client._IsGCE()) self.mock_http.request.assert_called_once_with( oauth2_client.METADATA_SERVER) def testIsGCEServerNotFound(self): self.mock_http.request.side_effect = httplib2.ServerNotFoundError() self.assertFalse(oauth2_client._IsGCE()) self.mock_http.request.assert_called_once_with( oauth2_client.METADATA_SERVER) def testIsGCETrue(self): self.mock_http.request.return_value = (FakeResponse(200), '') self.assertTrue(oauth2_client._IsGCE()) self.mock_http.request.assert_called_once_with( oauth2_client.METADATA_SERVER) if __name__ == '__main__': unittest.main() PK �+�ZH�'� __init__.pynu �[��� # Copyright 2014 Google Inc. All Rights Reserved. # # Permission is hereby granted, free of charge, to any person obtaining a # copy of this software and associated documentation files (the # "Software"), to deal in the Software without restriction, including # without limitation the rights to use, copy, modify, merge, publish, dis- # tribute, sublicense, and/or sell copies of the Software, and to permit # persons to whom the Software is furnished to do so, subject to the fol- # lowing conditions: # # The above copyright notice and this permission notice shall be included # in all copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS # OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABIL- # ITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT # SHALL THE AUTHOR BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, # WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS # IN THE SOFTWARE. """Plugin for Boto auth plugin framework, used with GCP OAuth2.0 credentials.""" from __future__ import absolute_import # Import this module so that users can simply import the top-level module. Once # imported, boto will pick up our subclasses of AuthHandler. from gcs_oauth2_boto_plugin import oauth2_plugin from gcs_oauth2_boto_plugin.oauth2_helper import SetFallbackClientIdAndSecret from gcs_oauth2_boto_plugin.oauth2_helper import SetLock PK �+�Z}�� � ( __pycache__/oauth2_helper.cpython-39.pycnu �[��� PK �+�ZC�!� � # __pycache__/__init__.cpython-39.pycnu �[��� PK �+�Zϒ W% % ( P __pycache__/oauth2_plugin.cpython-39.pycnu �[��� PK �+�Z���§q �q ( � __pycache__/oauth2_client.cpython-39.pycnu �[��� PK �+�Z�Ëv� � ̒ oauth2_plugin.pynu �[��� PK �+�Z��sX~ X~ �� oauth2_client.pynu �[��� PK �+�Z�%�\! \! T oauth2_helper.pynu �[��� PK �+�Zq�77 77 �= test_oauth2_client.pynu �[��� PK �+�ZH�'� lu __init__.pynu �[��� PK + �{
| ver. 1.4 |
Github
|
.
| PHP 8.2.28 | Generation time: 0.04 |
proxy
|
phpinfo
|
Settings