Upgrade 3rd packages
BUG=461614
R=nodir@chromium.org
Review URL: https://codereview.chromium.org/1085893002
git-svn-id: svn://svn.chromium.org/chrome/trunk/tools/depot_tools@294835 0039d316-1c4b-4281-b951-d872f2087c98
diff --git a/third_party/google_api_python_client/MODIFICATIONS.diff b/third_party/google_api_python_client/MODIFICATIONS.diff
new file mode 100644
index 0000000..efa382a
--- /dev/null
+++ b/third_party/google_api_python_client/MODIFICATIONS.diff
@@ -0,0 +1,125 @@
+diff --git a/third_party/google_api_python_client/apiclient/__init__.py b/third_party/google_api_python_client/apiclient/__init__.py
+index 5efb142..acb1a23 100644
+--- a/third_party/google_api_python_client/apiclient/__init__.py
++++ b/third_party/google_api_python_client/apiclient/__init__.py
+@@ -3,7 +3,7 @@
+ import googleapiclient
+
+ try:
+- import oauth2client
++ from third_party import oauth2client
+ except ImportError:
+ raise RuntimeError(
+ 'Previous version of google-api-python-client detected; due to a '
+diff --git a/third_party/google_api_python_client/googleapiclient/channel.py b/third_party/google_api_python_client/googleapiclient/channel.py
+index 68a3b89..4626094 100644
+--- a/third_party/google_api_python_client/googleapiclient/channel.py
++++ b/third_party/google_api_python_client/googleapiclient/channel.py
+@@ -60,7 +60,7 @@ import datetime
+ import uuid
+
+ from googleapiclient import errors
+-from ...oauth2client import util
++from third_party.oauth2client import util
+
+
+ # The unix time epoch starts at midnight 1970.
+diff --git a/third_party/google_api_python_client/googleapiclient/discovery.py b/third_party/google_api_python_client/googleapiclient/discovery.py
+index 3ddac57..0e9e5cf 100644
+--- a/third_party/google_api_python_client/googleapiclient/discovery.py
++++ b/third_party/google_api_python_client/googleapiclient/discovery.py
+@@ -47,9 +47,9 @@ except ImportError:
+ from cgi import parse_qsl
+
+ # Third-party imports
+-from ... import httplib2
++from third_party import httplib2
++from third_party.uritemplate import uritemplate
+ import mimeparse
+-from ... import uritemplate
+
+ # Local imports
+ from googleapiclient.errors import HttpError
+@@ -65,9 +65,9 @@ from googleapiclient.model import JsonModel
+ from googleapiclient.model import MediaModel
+ from googleapiclient.model import RawModel
+ from googleapiclient.schema import Schemas
+-from oauth2client.client import GoogleCredentials
+-from oauth2client.util import _add_query_parameter
+-from oauth2client.util import positional
++from third_party.oauth2client.client import GoogleCredentials
++from third_party.oauth2client.util import _add_query_parameter
++from third_party.oauth2client.util import positional
+
+
+ # The client library requires a version of httplib2 that supports RETRIES.
+diff --git a/third_party/google_api_python_client/googleapiclient/errors.py b/third_party/google_api_python_client/googleapiclient/errors.py
+index a1999fd..18c52e6 100644
+--- a/third_party/google_api_python_client/googleapiclient/errors.py
++++ b/third_party/google_api_python_client/googleapiclient/errors.py
+@@ -24,7 +24,7 @@ __author__ = 'jcgregorio@google.com (Joe Gregorio)'
+
+ import json
+
+-from ...oauth2client import util
++from third_party.oauth2client import util
+
+
+ class Error(Exception):
+diff --git a/third_party/google_api_python_client/googleapiclient/http.py b/third_party/google_api_python_client/googleapiclient/http.py
+index 8638279..d2ce70c 100644
+--- a/third_party/google_api_python_client/googleapiclient/http.py
++++ b/third_party/google_api_python_client/googleapiclient/http.py
+@@ -25,7 +25,6 @@ import StringIO
+ import base64
+ import copy
+ import gzip
+-import httplib2
+ import json
+ import logging
+ import mimeparse
+@@ -49,7 +48,8 @@ from errors import ResumableUploadError
+ from errors import UnexpectedBodyError
+ from errors import UnexpectedMethodError
+ from model import JsonModel
+-from ...oauth2client import util
++from third_party import httplib2
++from third_party.oauth2client import util
+
+
+ DEFAULT_CHUNK_SIZE = 512*1024
+diff --git a/third_party/google_api_python_client/googleapiclient/sample_tools.py b/third_party/google_api_python_client/googleapiclient/sample_tools.py
+index cbd6d6f..cc0790b 100644
+--- a/third_party/google_api_python_client/googleapiclient/sample_tools.py
++++ b/third_party/google_api_python_client/googleapiclient/sample_tools.py
+@@ -22,13 +22,13 @@ __all__ = ['init']
+
+
+ import argparse
+-import httplib2
+ import os
+
+ from googleapiclient import discovery
+-from ...oauth2client import client
+-from ...oauth2client import file
+-from ...oauth2client import tools
++from third_party import httplib2
++from third_party.oauth2client import client
++from third_party.oauth2client import file
++from third_party.oauth2client import tools
+
+
+ def init(argv, name, version, doc, filename, scope=None, parents=[], discovery_filename=None):
+diff --git a/third_party/google_api_python_client/googleapiclient/schema.py b/third_party/google_api_python_client/googleapiclient/schema.py
+index af41317..92543ec 100644
+--- a/third_party/google_api_python_client/googleapiclient/schema.py
++++ b/third_party/google_api_python_client/googleapiclient/schema.py
+@@ -63,7 +63,7 @@ __author__ = 'jcgregorio@google.com (Joe Gregorio)'
+
+ import copy
+
+-from oauth2client import util
++from third_party.oauth2client import util
+
+
+ class Schemas(object):
diff --git a/third_party/google_api_python_client/README.chromium b/third_party/google_api_python_client/README.chromium
index eb7a00d..a7e9583 100644
--- a/third_party/google_api_python_client/README.chromium
+++ b/third_party/google_api_python_client/README.chromium
@@ -3,4 +3,8 @@
Revision: 49d45a6c3318b75e551c3022020f46c78655f365
License: Apache License, Version 2.0 (the "License")
-No local changes
+Local modifications:
+See also MODIFICATIONS.diff
+
+Notes:
+Requires the httplib2 and oauth2client library.
diff --git a/third_party/google_api_python_client/apiclient/__init__.py b/third_party/google_api_python_client/apiclient/__init__.py
index 5efb142..acb1a23 100644
--- a/third_party/google_api_python_client/apiclient/__init__.py
+++ b/third_party/google_api_python_client/apiclient/__init__.py
@@ -3,7 +3,7 @@
import googleapiclient
try:
- import oauth2client
+ from third_party import oauth2client
except ImportError:
raise RuntimeError(
'Previous version of google-api-python-client detected; due to a '
diff --git a/third_party/google_api_python_client/googleapiclient/channel.py b/third_party/google_api_python_client/googleapiclient/channel.py
index 68a3b89..4626094 100644
--- a/third_party/google_api_python_client/googleapiclient/channel.py
+++ b/third_party/google_api_python_client/googleapiclient/channel.py
@@ -60,7 +60,7 @@
import uuid
from googleapiclient import errors
-from ...oauth2client import util
+from third_party.oauth2client import util
# The unix time epoch starts at midnight 1970.
diff --git a/third_party/google_api_python_client/googleapiclient/discovery.py b/third_party/google_api_python_client/googleapiclient/discovery.py
index 3ddac57..0e9e5cf 100644
--- a/third_party/google_api_python_client/googleapiclient/discovery.py
+++ b/third_party/google_api_python_client/googleapiclient/discovery.py
@@ -47,9 +47,9 @@
from cgi import parse_qsl
# Third-party imports
-from ... import httplib2
+from third_party import httplib2
+from third_party.uritemplate import uritemplate
import mimeparse
-from ... import uritemplate
# Local imports
from googleapiclient.errors import HttpError
@@ -65,9 +65,9 @@
from googleapiclient.model import MediaModel
from googleapiclient.model import RawModel
from googleapiclient.schema import Schemas
-from oauth2client.client import GoogleCredentials
-from oauth2client.util import _add_query_parameter
-from oauth2client.util import positional
+from third_party.oauth2client.client import GoogleCredentials
+from third_party.oauth2client.util import _add_query_parameter
+from third_party.oauth2client.util import positional
# The client library requires a version of httplib2 that supports RETRIES.
diff --git a/third_party/google_api_python_client/googleapiclient/errors.py b/third_party/google_api_python_client/googleapiclient/errors.py
index a1999fd..18c52e6 100644
--- a/third_party/google_api_python_client/googleapiclient/errors.py
+++ b/third_party/google_api_python_client/googleapiclient/errors.py
@@ -24,7 +24,7 @@
import json
-from ...oauth2client import util
+from third_party.oauth2client import util
class Error(Exception):
diff --git a/third_party/google_api_python_client/googleapiclient/http.py b/third_party/google_api_python_client/googleapiclient/http.py
index 8638279..d2ce70c 100644
--- a/third_party/google_api_python_client/googleapiclient/http.py
+++ b/third_party/google_api_python_client/googleapiclient/http.py
@@ -25,7 +25,6 @@
import base64
import copy
import gzip
-import httplib2
import json
import logging
import mimeparse
@@ -49,7 +48,8 @@
from errors import UnexpectedBodyError
from errors import UnexpectedMethodError
from model import JsonModel
-from ...oauth2client import util
+from third_party import httplib2
+from third_party.oauth2client import util
DEFAULT_CHUNK_SIZE = 512*1024
diff --git a/third_party/google_api_python_client/googleapiclient/sample_tools.py b/third_party/google_api_python_client/googleapiclient/sample_tools.py
index cbd6d6f..cc0790b 100644
--- a/third_party/google_api_python_client/googleapiclient/sample_tools.py
+++ b/third_party/google_api_python_client/googleapiclient/sample_tools.py
@@ -22,13 +22,13 @@
import argparse
-import httplib2
import os
from googleapiclient import discovery
-from ...oauth2client import client
-from ...oauth2client import file
-from ...oauth2client import tools
+from third_party import httplib2
+from third_party.oauth2client import client
+from third_party.oauth2client import file
+from third_party.oauth2client import tools
def init(argv, name, version, doc, filename, scope=None, parents=[], discovery_filename=None):
diff --git a/third_party/google_api_python_client/googleapiclient/schema.py b/third_party/google_api_python_client/googleapiclient/schema.py
index af41317..92543ec 100644
--- a/third_party/google_api_python_client/googleapiclient/schema.py
+++ b/third_party/google_api_python_client/googleapiclient/schema.py
@@ -63,7 +63,7 @@
import copy
-from oauth2client import util
+from third_party.oauth2client import util
class Schemas(object):
diff --git a/third_party/oauth2client/README.chromium b/third_party/oauth2client/README.chromium
index ea15b96..bfc4a01 100644
--- a/third_party/oauth2client/README.chromium
+++ b/third_party/oauth2client/README.chromium
@@ -1,7 +1,7 @@
Name: oauth2client
Short Name: oauth2client
-URL: https://pypi.python.org/packages/source/o/oauth2client/oauth2client-1.2.tar.gz
-Version: 1.2
+URL: https://pypi.python.org/packages/source/o/oauth2client/oauth2client-1.4.7.tar.gz
+Version: 1.4.7
License: Apache License 2.0
Description:
diff --git a/third_party/oauth2client/__init__.py b/third_party/oauth2client/__init__.py
index ac84748..fea30ca 100644
--- a/third_party/oauth2client/__init__.py
+++ b/third_party/oauth2client/__init__.py
@@ -1,5 +1,8 @@
-__version__ = "1.2"
+"""Client library for using OAuth2, especially with Google APIs."""
+
+__version__ = '1.4.7'
GOOGLE_AUTH_URI = 'https://accounts.google.com/o/oauth2/auth'
+GOOGLE_DEVICE_URI = 'https://accounts.google.com/o/oauth2/device/code'
GOOGLE_REVOKE_URI = 'https://accounts.google.com/o/oauth2/revoke'
-GOOGLE_TOKEN_URI = 'https://accounts.google.com/o/oauth2/token'
+GOOGLE_TOKEN_URI = 'https://accounts.google.com/o/oauth2/token'
\ No newline at end of file
diff --git a/third_party/oauth2client/anyjson.py b/third_party/oauth2client/anyjson.py
deleted file mode 100644
index ae21c33..0000000
--- a/third_party/oauth2client/anyjson.py
+++ /dev/null
@@ -1,32 +0,0 @@
-# Copyright (C) 2010 Google Inc.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-"""Utility module to import a JSON module
-
-Hides all the messy details of exactly where
-we get a simplejson module from.
-"""
-
-__author__ = 'jcgregorio@google.com (Joe Gregorio)'
-
-
-try: # pragma: no cover
- # Should work for Python2.6 and higher.
- import json as simplejson
-except ImportError: # pragma: no cover
- try:
- import simplejson
- except ImportError:
- # Try to import from django, should work on App Engine
- from django.utils import simplejson
diff --git a/third_party/oauth2client/appengine.py b/third_party/oauth2client/appengine.py
index 5cd3f4b..4131513 100644
--- a/third_party/oauth2client/appengine.py
+++ b/third_party/oauth2client/appengine.py
@@ -1,4 +1,4 @@
-# Copyright (C) 2010 Google Inc.
+# Copyright 2014 Google Inc. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@@ -19,14 +19,14 @@
__author__ = 'jcgregorio@google.com (Joe Gregorio)'
-import base64
import cgi
-import httplib2
+import json
import logging
import os
import pickle
import threading
-import time
+
+import httplib2
from google.appengine.api import app_identity
from google.appengine.api import memcache
@@ -41,7 +41,6 @@
from oauth2client import clientsecrets
from oauth2client import util
from oauth2client import xsrfutil
-from oauth2client.anyjson import simplejson
from oauth2client.client import AccessTokenRefreshError
from oauth2client.client import AssertionCredentials
from oauth2client.client import Credentials
@@ -159,15 +158,20 @@
Args:
scope: string or iterable of strings, scope(s) of the credentials being
requested.
+ **kwargs: optional keyword args, including:
+ service_account_id: service account id of the application. If None or
+ unspecified, the default service account for the app is used.
"""
self.scope = util.scopes_to_string(scope)
+ self._kwargs = kwargs
+ self.service_account_id = kwargs.get('service_account_id', None)
# Assertion type is no longer used, but still in the parent class signature.
super(AppAssertionCredentials, self).__init__(None)
@classmethod
- def from_json(cls, json):
- data = simplejson.loads(json)
+ def from_json(cls, json_data):
+ data = json.loads(json_data)
return AppAssertionCredentials(data['scope'])
def _refresh(self, http_request):
@@ -186,11 +190,22 @@
"""
try:
scopes = self.scope.split()
- (token, _) = app_identity.get_access_token(scopes)
- except app_identity.Error, e:
+ (token, _) = app_identity.get_access_token(
+ scopes, service_account_id=self.service_account_id)
+ except app_identity.Error as e:
raise AccessTokenRefreshError(str(e))
self.access_token = token
+ @property
+ def serialization_data(self):
+ raise NotImplementedError('Cannot serialize credentials for AppEngine.')
+
+ def create_scoped_required(self):
+ return not self.scope
+
+ def create_scoped(self, scopes):
+ return AppAssertionCredentials(scopes, **self._kwargs)
+
class FlowProperty(db.Property):
"""App Engine datastore Property for Flow.
@@ -434,6 +449,7 @@
entity_key = db.Key.from_path(self._model.kind(), self._key_name)
db.delete(entity_key)
+ @db.non_transactional(allow_existing=True)
def locked_get(self):
"""Retrieve Credential from datastore.
@@ -456,6 +472,7 @@
credentials.set_store(self)
return credentials
+ @db.non_transactional(allow_existing=True)
def locked_put(self, credentials):
"""Write a Credentials to the datastore.
@@ -468,6 +485,7 @@
if self._cache:
self._cache.set(self._key_name, credentials.to_json())
+ @db.non_transactional(allow_existing=True)
def locked_delete(self):
"""Delete Credential from datastore."""
@@ -553,16 +571,14 @@
Instantiate and then use with oauth_required or oauth_aware
as decorators on webapp.RequestHandler methods.
- Example:
+ ::
decorator = OAuth2Decorator(
client_id='837...ent.com',
client_secret='Qh...wwI',
scope='https://www.googleapis.com/auth/plus')
-
class MainHandler(webapp.RequestHandler):
-
@decorator.oauth_required
def get(self):
http = decorator.http()
@@ -650,8 +666,9 @@
provided to this constructor. A string indicating the name of the field
on the _credentials_class where a Credentials object will be stored.
Defaults to 'credentials'.
- **kwargs: dict, Keyword arguments are be passed along as kwargs to the
- OAuth2WebServerFlow constructor.
+ **kwargs: dict, Keyword arguments are passed along as kwargs to
+ the OAuth2WebServerFlow constructor.
+
"""
self._tls = threading.local()
self.flow = None
@@ -798,14 +815,18 @@
url = self.flow.step1_get_authorize_url()
return str(url)
- def http(self):
+ def http(self, *args, **kwargs):
"""Returns an authorized http instance.
Must only be called from within an @oauth_required decorated method, or
from within an @oauth_aware decorated method where has_credentials()
returns True.
+
+ Args:
+ *args: Positional arguments passed to httplib2.Http constructor.
+ **kwargs: Positional arguments passed to httplib2.Http constructor.
"""
- return self.credentials.authorize(httplib2.Http())
+ return self.credentials.authorize(httplib2.Http(*args, **kwargs))
@property
def callback_path(self):
@@ -824,7 +845,8 @@
def callback_handler(self):
"""RequestHandler for the OAuth 2.0 redirect callback.
- Usage:
+ Usage::
+
app = webapp.WSGIApplication([
('/index', MyIndexHandler),
...,
@@ -858,7 +880,7 @@
user)
if decorator._token_response_param and credentials.token_response:
- resp_json = simplejson.dumps(credentials.token_response)
+ resp_json = json.dumps(credentials.token_response)
redirect_uri = util._add_query_parameter(
redirect_uri, decorator._token_response_param, resp_json)
@@ -887,24 +909,23 @@
Uses a clientsecrets file as the source for all the information when
constructing an OAuth2Decorator.
- Example:
+ ::
decorator = OAuth2DecoratorFromClientSecrets(
os.path.join(os.path.dirname(__file__), 'client_secrets.json')
scope='https://www.googleapis.com/auth/plus')
-
class MainHandler(webapp.RequestHandler):
-
@decorator.oauth_required
def get(self):
http = decorator.http()
# http is authorized with the user's Credentials and can be used
# in API calls
+
"""
@util.positional(3)
- def __init__(self, filename, scope, message=None, cache=None):
+ def __init__(self, filename, scope, message=None, cache=None, **kwargs):
"""Constructor
Args:
@@ -917,17 +938,20 @@
decorator.
cache: An optional cache service client that implements get() and set()
methods. See clientsecrets.loadfile() for details.
+ **kwargs: dict, Keyword arguments are passed along as kwargs to
+ the OAuth2WebServerFlow constructor.
"""
client_type, client_info = clientsecrets.loadfile(filename, cache=cache)
if client_type not in [
clientsecrets.TYPE_WEB, clientsecrets.TYPE_INSTALLED]:
raise InvalidClientSecretsError(
- 'OAuth2Decorator doesn\'t support this OAuth 2.0 flow.')
- constructor_kwargs = {
- 'auth_uri': client_info['auth_uri'],
- 'token_uri': client_info['token_uri'],
- 'message': message,
- }
+ "OAuth2Decorator doesn't support this OAuth 2.0 flow.")
+ constructor_kwargs = dict(kwargs)
+ constructor_kwargs.update({
+ 'auth_uri': client_info['auth_uri'],
+ 'token_uri': client_info['token_uri'],
+ 'message': message,
+ })
revoke_uri = client_info.get('revoke_uri')
if revoke_uri is not None:
constructor_kwargs['revoke_uri'] = revoke_uri
@@ -960,4 +984,4 @@
"""
return OAuth2DecoratorFromClientSecrets(filename, scope,
- message=message, cache=cache)
+ message=message, cache=cache)
\ No newline at end of file
diff --git a/third_party/oauth2client/client.py b/third_party/oauth2client/client.py
index 6901f3f..8fe28a3 100644
--- a/third_party/oauth2client/client.py
+++ b/third_party/oauth2client/client.py
@@ -1,4 +1,4 @@
-# Copyright (C) 2010 Google Inc.
+# Copyright 2014 Google Inc. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@@ -20,44 +20,48 @@
__author__ = 'jcgregorio@google.com (Joe Gregorio)'
import base64
-import clientsecrets
+import collections
import copy
import datetime
-from .. import httplib2
+import json
import logging
+import os
+import socket
import sys
+import tempfile
import time
-import urllib
-import urlparse
+import shutil
+from .. import httplib2
+from . import clientsecrets
from . import GOOGLE_AUTH_URI
+from . import GOOGLE_DEVICE_URI
from . import GOOGLE_REVOKE_URI
from . import GOOGLE_TOKEN_URI
from . import util
-from .anyjson import simplejson
+from third_party import six
+from third_party.six.moves import urllib
HAS_OPENSSL = False
HAS_CRYPTO = False
try:
- from . import crypt
+ from oauth2client import crypt
HAS_CRYPTO = True
if crypt.OpenSSLVerifier is not None:
HAS_OPENSSL = True
except ImportError:
pass
-try:
- from urlparse import parse_qsl
-except ImportError:
- from cgi import parse_qsl
-
logger = logging.getLogger(__name__)
# Expiry is stored in RFC3339 UTC format
EXPIRY_FORMAT = '%Y-%m-%dT%H:%M:%SZ'
# Which certs to use to validate id_tokens received.
-ID_TOKEN_VERIFICATON_CERTS = 'https://www.googleapis.com/oauth2/v1/certs'
+ID_TOKEN_VERIFICATION_CERTS = 'https://www.googleapis.com/oauth2/v1/certs'
+# This symbol previously had a typo in the name; we keep the old name
+# around for now, but will remove it in the future.
+ID_TOKEN_VERIFICATON_CERTS = ID_TOKEN_VERIFICATION_CERTS
# Constant to use for the out of band OAuth 2.0 flow.
OOB_CALLBACK_URN = 'urn:ietf:wg:oauth:2.0:oob'
@@ -65,6 +69,42 @@
# Google Data client libraries may need to set this to [401, 403].
REFRESH_STATUS_CODES = [401]
+# The value representing user credentials.
+AUTHORIZED_USER = 'authorized_user'
+
+# The value representing service account credentials.
+SERVICE_ACCOUNT = 'service_account'
+
+# The environment variable pointing the file with local
+# Application Default Credentials.
+GOOGLE_APPLICATION_CREDENTIALS = 'GOOGLE_APPLICATION_CREDENTIALS'
+# The ~/.config subdirectory containing gcloud credentials. Intended
+# to be swapped out in tests.
+_CLOUDSDK_CONFIG_DIRECTORY = 'gcloud'
+
+# The error message we show users when we can't find the Application
+# Default Credentials.
+ADC_HELP_MSG = (
+ 'The Application Default Credentials are not available. They are available '
+ 'if running in Google Compute Engine. Otherwise, the environment variable '
+ + GOOGLE_APPLICATION_CREDENTIALS +
+ ' must be defined pointing to a file defining the credentials. See '
+ 'https://developers.google.com/accounts/docs/application-default-credentials' # pylint:disable=line-too-long
+ ' for more information.')
+
+# The access token along with the seconds in which it expires.
+AccessTokenInfo = collections.namedtuple(
+ 'AccessTokenInfo', ['access_token', 'expires_in'])
+
+DEFAULT_ENV_NAME = 'UNKNOWN'
+
+# If set to True _get_environment avoid GCE check (_detect_gce_environment)
+NO_GCE_CHECK = os.environ.setdefault('NO_GCE_CHECK', 'False')
+
+class SETTINGS(object):
+ """Settings namespace for globally defined values."""
+ env_name = None
+
class Error(Exception):
"""Base error for this module."""
@@ -91,13 +131,25 @@
class VerifyJwtTokenError(Error):
- """Could on retrieve certificates for validation."""
+ """Could not retrieve certificates for validation."""
class NonAsciiHeaderError(Error):
"""Header names and values must be ASCII strings."""
+class ApplicationDefaultCredentialsError(Error):
+ """Error retrieving the Application Default Credentials."""
+
+
+class OAuth2DeviceCodeError(Error):
+ """Error trying to retrieve a device code."""
+
+
+class CryptoUnavailableError(Error, NotImplementedError):
+ """Raised when a crypto library is required, but none is available."""
+
+
def _abstract():
raise NotImplementedError('You need to override this function')
@@ -125,11 +177,12 @@
an HTTP transport.
Subclasses must also specify a classmethod named 'from_json' that takes a JSON
- string as input and returns an instaniated Credentials object.
+ string as input and returns an instantiated Credentials object.
"""
NON_SERIALIZED_MEMBERS = ['store']
+
def authorize(self, http):
"""Take an httplib2.Http instance (or equivalent) and authorizes it.
@@ -143,6 +196,7 @@
"""
_abstract()
+
def refresh(self, http):
"""Forces a refresh of the access_token.
@@ -152,6 +206,7 @@
"""
_abstract()
+
def revoke(self, http):
"""Revokes a refresh_token and makes the credentials void.
@@ -161,6 +216,7 @@
"""
_abstract()
+
def apply(self, headers):
"""Add the authorization to the headers.
@@ -184,12 +240,16 @@
for member in strip:
if member in d:
del d[member]
- if 'token_expiry' in d and isinstance(d['token_expiry'], datetime.datetime):
+ if (d.get('token_expiry') and
+ isinstance(d['token_expiry'], datetime.datetime)):
d['token_expiry'] = d['token_expiry'].strftime(EXPIRY_FORMAT)
# Add in information we will need later to reconsistitue this instance.
d['_class'] = t.__name__
d['_module'] = t.__module__
- return simplejson.dumps(d)
+ for key, val in d.items():
+ if isinstance(val, bytes):
+ d[key] = val.decode('utf-8')
+ return json.dumps(d)
def to_json(self):
"""Creating a JSON representation of an instance of Credentials.
@@ -212,14 +272,16 @@
An instance of the subclass of Credentials that was serialized with
to_json().
"""
- data = simplejson.loads(s)
+ if six.PY3 and isinstance(s, bytes):
+ s = s.decode('utf-8')
+ data = json.loads(s)
# Find and call the right classmethod from_json() to restore the object.
module = data['_module']
try:
m = __import__(module)
except ImportError:
# In case there's an object from the old package structure, update it
- module = module.replace('.apiclient', '')
+ module = module.replace('.googleapiclient', '')
m = __import__(module)
m = __import__(module, fromlist=module.split('.')[:-1])
@@ -228,13 +290,13 @@
return from_json(s)
@classmethod
- def from_json(cls, s):
+ def from_json(cls, unused_data):
"""Instantiate a Credentials object from a JSON description of it.
The JSON should have been produced by calling .to_json() on the object.
Args:
- data: dict, A deserialized JSON object.
+ unused_data: dict, A deserialized JSON object.
Returns:
An instance of a Credentials subclass.
@@ -356,8 +418,10 @@
"""
clean = {}
try:
- for k, v in headers.iteritems():
- clean[str(k)] = str(v)
+ for k, v in six.iteritems(headers):
+ clean_k = k if isinstance(k, bytes) else str(k).encode('ascii')
+ clean_v = v if isinstance(v, bytes) else str(v).encode('ascii')
+ clean[clean_k] = clean_v
except UnicodeEncodeError:
raise NonAsciiHeaderError(k + ': ' + v)
return clean
@@ -373,11 +437,11 @@
Returns:
The same URI but with the new query parameters added.
"""
- parts = list(urlparse.urlparse(uri))
- query_params = dict(parse_qsl(parts[4])) # 4 is the index of the query part
+ parts = urllib.parse.urlparse(uri)
+ query_params = dict(urllib.parse.parse_qsl(parts.query))
query_params.update(params)
- parts[4] = urllib.urlencode(query_params)
- return urlparse.urlunparse(parts)
+ new_parts = parts._replace(query=urllib.parse.urlencode(query_params))
+ return urllib.parse.urlunparse(new_parts)
class OAuth2Credentials(Credentials):
@@ -445,22 +509,23 @@
it.
Args:
- http: An instance of httplib2.Http
- or something that acts like it.
+ http: An instance of ``httplib2.Http`` or something that acts
+ like it.
Returns:
A modified instance of http that was passed in.
- Example:
+ Example::
h = httplib2.Http()
h = credentials.authorize(h)
- You can't create a new OAuth subclass of httplib2.Authenication
+ You can't create a new OAuth subclass of httplib2.Authentication
because it never gets passed the absolute URI, which is needed for
signing. So instead we have to overload 'request' with a closure
that adds in the Authorization header and then calls the original
version of 'request()'.
+
"""
request_orig = http.request
@@ -473,10 +538,12 @@
logger.info('Attempting refresh to obtain initial access_token')
self._refresh(request_orig)
- # Modify the request headers to add the appropriate
+ # Clone and modify the request headers to add the appropriate
# Authorization header.
if headers is None:
headers = {}
+ else:
+ headers = dict(headers)
self.apply(headers)
if self.user_agent is not None:
@@ -489,7 +556,7 @@
redirections, connection_type)
if resp.status in REFRESH_STATUS_CODES:
- logger.info('Refreshing due to a %s' % str(resp.status))
+ logger.info('Refreshing due to a %s', resp.status)
self._refresh(request_orig)
self.apply(headers)
return request_orig(uri, method, body, clean_headers(headers),
@@ -545,13 +612,15 @@
Returns:
An instance of a Credentials subclass.
"""
- data = simplejson.loads(s)
- if 'token_expiry' in data and not isinstance(data['token_expiry'],
- datetime.datetime):
+ if six.PY3 and isinstance(s, bytes):
+ s = s.decode('utf-8')
+ data = json.loads(s)
+ if (data.get('token_expiry') and
+ not isinstance(data['token_expiry'], datetime.datetime)):
try:
data['token_expiry'] = datetime.datetime.strptime(
data['token_expiry'], EXPIRY_FORMAT)
- except:
+ except ValueError:
data['token_expiry'] = None
retval = cls(
data['access_token'],
@@ -586,11 +655,24 @@
return True
return False
+ def get_access_token(self, http=None):
+ """Return the access token and its expiration information.
+
+ If the token does not exist, get one.
+ If the token expired, refresh it.
+ """
+ if not self.access_token or self.access_token_expired:
+ if not http:
+ http = httplib2.Http()
+ self.refresh(http)
+ return AccessTokenInfo(access_token=self.access_token,
+ expires_in=self._expires_in())
+
def set_store(self, store):
"""Set the Storage for the credential.
Args:
- store: Storage, an implementation of Stroage object.
+ store: Storage, an implementation of Storage object.
This is needed to store the latest access_token if it
has expired and been refreshed. This implementation uses
locking to check for updates before updating the
@@ -598,6 +680,25 @@
"""
self.store = store
+ def _expires_in(self):
+ """Return the number of seconds until this token expires.
+
+ If token_expiry is in the past, this method will return 0, meaning the
+ token has already expired.
+ If token_expiry is None, this method will return None. Note that returning
+ 0 in such a case would not be fair: the token may still be valid;
+ we just don't know anything about it.
+ """
+ if self.token_expiry:
+ now = datetime.datetime.utcnow()
+ if self.token_expiry > now:
+ time_delta = self.token_expiry - now
+ # TODO(orestica): return time_delta.total_seconds()
+ # once dropping support for Python 2.6
+ return time_delta.days * 86400 + time_delta.seconds
+ else:
+ return 0
+
def _updateFromCredential(self, other):
"""Update this Credential from another instance."""
self.__dict__.update(other.__getstate__())
@@ -615,7 +716,7 @@
def _generate_refresh_request_body(self):
"""Generate the body that will be used in the refresh request."""
- body = urllib.urlencode({
+ body = urllib.parse.urlencode({
'grant_type': 'refresh_token',
'client_id': self.client_id,
'client_secret': self.client_secret,
@@ -679,9 +780,10 @@
logger.info('Refreshing access_token')
resp, content = http_request(
self.token_uri, method='POST', body=body, headers=headers)
+ if six.PY3 and isinstance(content, bytes):
+ content = content.decode('utf-8')
if resp.status == 200:
- # TODO(jcgregorio) Raise an error if loads fails?
- d = simplejson.loads(content)
+ d = json.loads(content)
self.token_response = d
self.access_token = d['access_token']
self.refresh_token = d.get('refresh_token', self.refresh_token)
@@ -690,35 +792,40 @@
seconds=int(d['expires_in'])) + datetime.datetime.utcnow()
else:
self.token_expiry = None
+ # On temporary refresh errors, the user does not actually have to
+ # re-authorize, so we unflag here.
+ self.invalid = False
if self.store:
self.store.locked_put(self)
else:
# An {'error':...} response body means the token is expired or revoked,
# so we flag the credentials as such.
- logger.info('Failed to retrieve access token: %s' % content)
+ logger.info('Failed to retrieve access token: %s', content)
error_msg = 'Invalid response %s.' % resp['status']
try:
- d = simplejson.loads(content)
+ d = json.loads(content)
if 'error' in d:
error_msg = d['error']
+ if 'error_description' in d:
+ error_msg += ': ' + d['error_description']
self.invalid = True
if self.store:
self.store.locked_put(self)
- except StandardError:
+ except (TypeError, ValueError):
pass
raise AccessTokenRefreshError(error_msg)
def _revoke(self, http_request):
- """Revokes the refresh_token and deletes the store if available.
+ """Revokes this credential and deletes the stored copy (if it exists).
Args:
http_request: callable, a callable that matches the method signature of
httplib2.Http.request, used to make the revoke request.
"""
- self._do_revoke(http_request, self.refresh_token)
+ self._do_revoke(http_request, self.refresh_token or self.access_token)
def _do_revoke(self, http_request, token):
- """Revokes the credentials and deletes the store if available.
+ """Revokes this credential and deletes the stored copy (if it exists).
Args:
http_request: callable, a callable that matches the method signature of
@@ -738,10 +845,10 @@
else:
error_msg = 'Invalid response %s.' % resp.status
try:
- d = simplejson.loads(content)
+ d = json.loads(content)
if 'error' in d:
error_msg = d['error']
- except StandardError:
+ except (TypeError, ValueError):
pass
raise TokenRevokeError(error_msg)
@@ -763,7 +870,8 @@
AccessTokenCredentials objects may be safely pickled and unpickled.
- Usage:
+ Usage::
+
credentials = AccessTokenCredentials('<an access token>',
'my-user-agent/1.0')
http = httplib2.Http()
@@ -799,10 +907,12 @@
@classmethod
def from_json(cls, s):
- data = simplejson.loads(s)
+ if six.PY3 and isinstance(s, bytes):
+ s = s.decode('utf-8')
+ data = json.loads(s)
retval = AccessTokenCredentials(
- data['access_token'],
- data['user_agent'])
+ data['access_token'],
+ data['user_agent'])
return retval
def _refresh(self, http_request):
@@ -819,7 +929,434 @@
self._do_revoke(http_request, self.access_token)
-class AssertionCredentials(OAuth2Credentials):
+def _detect_gce_environment(urlopen=None):
+ """Determine if the current environment is Compute Engine.
+
+ Args:
+ urlopen: Optional argument. Function used to open a connection to a URL.
+
+ Returns:
+ Boolean indicating whether or not the current environment is Google
+ Compute Engine.
+ """
+ urlopen = urlopen or urllib.request.urlopen
+ # Note: the explicit `timeout` below is a workaround. The underlying
+ # issue is that resolving an unknown host on some networks will take
+ # 20-30 seconds; making this timeout short fixes the issue, but
+ # could lead to false negatives in the event that we are on GCE, but
+ # the metadata resolution was particularly slow. The latter case is
+ # "unlikely".
+ try:
+ response = urlopen('http://169.254.169.254/', timeout=1)
+ return response.info().get('Metadata-Flavor', '') == 'Google'
+ except socket.timeout:
+ logger.info('Timeout attempting to reach GCE metadata service.')
+ return False
+ except urllib.error.URLError as e:
+ if isinstance(getattr(e, 'reason', None), socket.timeout):
+ logger.info('Timeout attempting to reach GCE metadata service.')
+ return False
+
+
+def _get_environment(urlopen=None):
+ """Detect the environment the code is being run on.
+
+ Args:
+ urlopen: Optional argument. Function used to open a connection to a URL.
+
+ Returns:
+ The value of SETTINGS.env_name after being set. If already
+ set, simply returns the value.
+ """
+ if SETTINGS.env_name is not None:
+ return SETTINGS.env_name
+
+ # None is an unset value, not the default.
+ SETTINGS.env_name = DEFAULT_ENV_NAME
+
+ server_software = os.environ.get('SERVER_SOFTWARE', '')
+ if server_software.startswith('Google App Engine/'):
+ SETTINGS.env_name = 'GAE_PRODUCTION'
+ elif server_software.startswith('Development/'):
+ SETTINGS.env_name = 'GAE_LOCAL'
+ elif NO_GCE_CHECK != 'True' and _detect_gce_environment(urlopen=urlopen):
+ SETTINGS.env_name = 'GCE_PRODUCTION'
+
+ return SETTINGS.env_name
+
+
+class GoogleCredentials(OAuth2Credentials):
+ """Application Default Credentials for use in calling Google APIs.
+
+ The Application Default Credentials are being constructed as a function of
+ the environment where the code is being run.
+ More details can be found on this page:
+ https://developers.google.com/accounts/docs/application-default-credentials
+
+ Here is an example of how to use the Application Default Credentials for a
+ service that requires authentication:
+
+ from googleapiclient.discovery import build
+ from oauth2client.client import GoogleCredentials
+
+ credentials = GoogleCredentials.get_application_default()
+ service = build('compute', 'v1', credentials=credentials)
+
+ PROJECT = 'bamboo-machine-422'
+ ZONE = 'us-central1-a'
+ request = service.instances().list(project=PROJECT, zone=ZONE)
+ response = request.execute()
+
+ print(response)
+ """
+
+ def __init__(self, access_token, client_id, client_secret, refresh_token,
+ token_expiry, token_uri, user_agent,
+ revoke_uri=GOOGLE_REVOKE_URI):
+ """Create an instance of GoogleCredentials.
+
+ This constructor is not usually called by the user, instead
+ GoogleCredentials objects are instantiated by
+ GoogleCredentials.from_stream() or
+ GoogleCredentials.get_application_default().
+
+ Args:
+ access_token: string, access token.
+ client_id: string, client identifier.
+ client_secret: string, client secret.
+ refresh_token: string, refresh token.
+ token_expiry: datetime, when the access_token expires.
+ token_uri: string, URI of token endpoint.
+ user_agent: string, The HTTP User-Agent to provide for this application.
+ revoke_uri: string, URI for revoke endpoint.
+ Defaults to GOOGLE_REVOKE_URI; a token can't be revoked if this is None.
+ """
+ super(GoogleCredentials, self).__init__(
+ access_token, client_id, client_secret, refresh_token, token_expiry,
+ token_uri, user_agent, revoke_uri=revoke_uri)
+
+ def create_scoped_required(self):
+ """Whether this Credentials object is scopeless.
+
+ create_scoped(scopes) method needs to be called in order to create
+ a Credentials object for API calls.
+ """
+ return False
+
+ def create_scoped(self, scopes):
+ """Create a Credentials object for the given scopes.
+
+ The Credentials type is preserved.
+ """
+ return self
+
+ @property
+ def serialization_data(self):
+ """Get the fields and their values identifying the current credentials."""
+ return {
+ 'type': 'authorized_user',
+ 'client_id': self.client_id,
+ 'client_secret': self.client_secret,
+ 'refresh_token': self.refresh_token
+ }
+
+ @staticmethod
+ def _implicit_credentials_from_gae(env_name=None):
+ """Attempts to get implicit credentials in Google App Engine env.
+
+ If the current environment is not detected as App Engine, returns None,
+ indicating no Google App Engine credentials can be detected from the
+ current environment.
+
+ Args:
+ env_name: String, indicating current environment.
+
+ Returns:
+ None, if not in GAE, else an appengine.AppAssertionCredentials object.
+ """
+ env_name = env_name or _get_environment()
+ if env_name not in ('GAE_PRODUCTION', 'GAE_LOCAL'):
+ return None
+
+ return _get_application_default_credential_GAE()
+
+ @staticmethod
+ def _implicit_credentials_from_gce(env_name=None):
+ """Attempts to get implicit credentials in Google Compute Engine env.
+
+ If the current environment is not detected as Compute Engine, returns None,
+ indicating no Google Compute Engine credentials can be detected from the
+ current environment.
+
+ Args:
+ env_name: String, indicating current environment.
+
+ Returns:
+ None, if not in GCE, else a gce.AppAssertionCredentials object.
+ """
+ env_name = env_name or _get_environment()
+ if env_name != 'GCE_PRODUCTION':
+ return None
+
+ return _get_application_default_credential_GCE()
+
+ @staticmethod
+ def _implicit_credentials_from_files(env_name=None):
+ """Attempts to get implicit credentials from local credential files.
+
+ First checks if the environment variable GOOGLE_APPLICATION_CREDENTIALS
+ is set with a filename and then falls back to a configuration file (the
+ "well known" file) associated with the 'gcloud' command line tool.
+
+ Args:
+ env_name: Unused argument.
+
+ Returns:
+ Credentials object associated with the GOOGLE_APPLICATION_CREDENTIALS
+ file or the "well known" file if either exist. If neither file is
+ define, returns None, indicating no credentials from a file can
+ detected from the current environment.
+ """
+ credentials_filename = _get_environment_variable_file()
+ if not credentials_filename:
+ credentials_filename = _get_well_known_file()
+ if os.path.isfile(credentials_filename):
+ extra_help = (' (produced automatically when running'
+ ' "gcloud auth login" command)')
+ else:
+ credentials_filename = None
+ else:
+ extra_help = (' (pointed to by ' + GOOGLE_APPLICATION_CREDENTIALS +
+ ' environment variable)')
+
+ if not credentials_filename:
+ return
+
+ try:
+ return _get_application_default_credential_from_file(credentials_filename)
+ except (ApplicationDefaultCredentialsError, ValueError) as error:
+ _raise_exception_for_reading_json(credentials_filename, extra_help, error)
+
+ @classmethod
+ def _get_implicit_credentials(cls):
+ """Gets credentials implicitly from the environment.
+
+ Checks environment in order of precedence:
+ - Google App Engine (production and testing)
+ - Environment variable GOOGLE_APPLICATION_CREDENTIALS pointing to
+ a file with stored credentials information.
+ - Stored "well known" file associated with `gcloud` command line tool.
+ - Google Compute Engine production environment.
+
+ Exceptions:
+ ApplicationDefaultCredentialsError: raised when the credentials fail
+ to be retrieved.
+ """
+ env_name = _get_environment()
+
+ # Environ checks (in order). Assumes each checker takes `env_name`
+ # as a kwarg.
+ environ_checkers = [
+ cls._implicit_credentials_from_gae,
+ cls._implicit_credentials_from_files,
+ cls._implicit_credentials_from_gce,
+ ]
+
+ for checker in environ_checkers:
+ credentials = checker(env_name=env_name)
+ if credentials is not None:
+ return credentials
+
+ # If no credentials, fail.
+ raise ApplicationDefaultCredentialsError(ADC_HELP_MSG)
+
+ @staticmethod
+ def get_application_default():
+ """Get the Application Default Credentials for the current environment.
+
+ Exceptions:
+ ApplicationDefaultCredentialsError: raised when the credentials fail
+ to be retrieved.
+ """
+ return GoogleCredentials._get_implicit_credentials()
+
+ @staticmethod
+ def from_stream(credential_filename):
+ """Create a Credentials object by reading the information from a given file.
+
+ It returns an object of type GoogleCredentials.
+
+ Args:
+ credential_filename: the path to the file from where the credentials
+ are to be read
+
+ Exceptions:
+ ApplicationDefaultCredentialsError: raised when the credentials fail
+ to be retrieved.
+ """
+
+ if credential_filename and os.path.isfile(credential_filename):
+ try:
+ return _get_application_default_credential_from_file(
+ credential_filename)
+ except (ApplicationDefaultCredentialsError, ValueError) as error:
+ extra_help = ' (provided as parameter to the from_stream() method)'
+ _raise_exception_for_reading_json(credential_filename,
+ extra_help,
+ error)
+ else:
+ raise ApplicationDefaultCredentialsError(
+ 'The parameter passed to the from_stream() '
+ 'method should point to a file.')
+
+
+def _save_private_file(filename, json_contents):
+ """Saves a file with read-write permissions on for the owner.
+
+ Args:
+ filename: String. Absolute path to file.
+ json_contents: JSON serializable object to be saved.
+ """
+ temp_filename = tempfile.mktemp()
+ file_desc = os.open(temp_filename, os.O_WRONLY | os.O_CREAT, 0o600)
+ with os.fdopen(file_desc, 'w') as file_handle:
+ json.dump(json_contents, file_handle, sort_keys=True,
+ indent=2, separators=(',', ': '))
+ shutil.move(temp_filename, filename)
+
+
+def save_to_well_known_file(credentials, well_known_file=None):
+ """Save the provided GoogleCredentials to the well known file.
+
+ Args:
+ credentials:
+ the credentials to be saved to the well known file;
+ it should be an instance of GoogleCredentials
+ well_known_file:
+ the name of the file where the credentials are to be saved;
+ this parameter is supposed to be used for testing only
+ """
+ # TODO(orestica): move this method to tools.py
+ # once the argparse import gets fixed (it is not present in Python 2.6)
+
+ if well_known_file is None:
+ well_known_file = _get_well_known_file()
+
+ credentials_data = credentials.serialization_data
+ _save_private_file(well_known_file, credentials_data)
+
+
+def _get_environment_variable_file():
+ application_default_credential_filename = (
+ os.environ.get(GOOGLE_APPLICATION_CREDENTIALS,
+ None))
+
+ if application_default_credential_filename:
+ if os.path.isfile(application_default_credential_filename):
+ return application_default_credential_filename
+ else:
+ raise ApplicationDefaultCredentialsError(
+ 'File ' + application_default_credential_filename + ' (pointed by ' +
+ GOOGLE_APPLICATION_CREDENTIALS +
+ ' environment variable) does not exist!')
+
+
+def _get_well_known_file():
+ """Get the well known file produced by command 'gcloud auth login'."""
+ # TODO(orestica): Revisit this method once gcloud provides a better way
+ # of pinpointing the exact location of the file.
+
+ WELL_KNOWN_CREDENTIALS_FILE = 'application_default_credentials.json'
+
+ if os.name == 'nt':
+ try:
+ default_config_path = os.path.join(os.environ['APPDATA'],
+ _CLOUDSDK_CONFIG_DIRECTORY)
+ except KeyError:
+ # This should never happen unless someone is really messing with things.
+ drive = os.environ.get('SystemDrive', 'C:')
+ default_config_path = os.path.join(drive, '\\',
+ _CLOUDSDK_CONFIG_DIRECTORY)
+ else:
+ default_config_path = os.path.join(os.path.expanduser('~'),
+ '.config',
+ _CLOUDSDK_CONFIG_DIRECTORY)
+
+ default_config_path = os.path.join(default_config_path,
+ WELL_KNOWN_CREDENTIALS_FILE)
+
+ return default_config_path
+
+
+def _get_application_default_credential_from_file(filename):
+ """Build the Application Default Credentials from file."""
+
+ from oauth2client import service_account
+
+ # read the credentials from the file
+ with open(filename) as file_obj:
+ client_credentials = json.load(file_obj)
+
+ credentials_type = client_credentials.get('type')
+ if credentials_type == AUTHORIZED_USER:
+ required_fields = set(['client_id', 'client_secret', 'refresh_token'])
+ elif credentials_type == SERVICE_ACCOUNT:
+ required_fields = set(['client_id', 'client_email', 'private_key_id',
+ 'private_key'])
+ else:
+ raise ApplicationDefaultCredentialsError(
+ "'type' field should be defined (and have one of the '" +
+ AUTHORIZED_USER + "' or '" + SERVICE_ACCOUNT + "' values)")
+
+ missing_fields = required_fields.difference(client_credentials.keys())
+
+ if missing_fields:
+ _raise_exception_for_missing_fields(missing_fields)
+
+ if client_credentials['type'] == AUTHORIZED_USER:
+ return GoogleCredentials(
+ access_token=None,
+ client_id=client_credentials['client_id'],
+ client_secret=client_credentials['client_secret'],
+ refresh_token=client_credentials['refresh_token'],
+ token_expiry=None,
+ token_uri=GOOGLE_TOKEN_URI,
+ user_agent='Python client library')
+ else: # client_credentials['type'] == SERVICE_ACCOUNT
+ return service_account._ServiceAccountCredentials(
+ service_account_id=client_credentials['client_id'],
+ service_account_email=client_credentials['client_email'],
+ private_key_id=client_credentials['private_key_id'],
+ private_key_pkcs8_text=client_credentials['private_key'],
+ scopes=[])
+
+
+def _raise_exception_for_missing_fields(missing_fields):
+ raise ApplicationDefaultCredentialsError(
+ 'The following field(s) must be defined: ' + ', '.join(missing_fields))
+
+
+def _raise_exception_for_reading_json(credential_file,
+ extra_help,
+ error):
+ raise ApplicationDefaultCredentialsError(
+ 'An error was encountered while reading json file: '+
+ credential_file + extra_help + ': ' + str(error))
+
+
+def _get_application_default_credential_GAE():
+ from oauth2client.appengine import AppAssertionCredentials
+
+ return AppAssertionCredentials([])
+
+
+def _get_application_default_credential_GCE():
+ from oauth2client.gce import AppAssertionCredentials
+
+ return AppAssertionCredentials([])
+
+
+class AssertionCredentials(GoogleCredentials):
"""Abstract Credentials object used for OAuth 2.0 assertion grants.
This credential does not require a flow to instantiate because it
@@ -859,7 +1396,7 @@
def _generate_refresh_request_body(self):
assertion = self._generate_assertion()
- body = urllib.urlencode({
+ body = urllib.parse.urlencode({
'assertion': assertion,
'grant_type': 'urn:ietf:params:oauth:grant-type:jwt-bearer',
})
@@ -882,141 +1419,157 @@
self._do_revoke(http_request, self.access_token)
-if HAS_CRYPTO:
- # PyOpenSSL and PyCrypto are not prerequisites for oauth2client, so if it is
- # missing then don't create the SignedJwtAssertionCredentials or the
- # verify_id_token() method.
+def _RequireCryptoOrDie():
+ """Ensure we have a crypto library, or throw CryptoUnavailableError.
- class SignedJwtAssertionCredentials(AssertionCredentials):
- """Credentials object used for OAuth 2.0 Signed JWT assertion grants.
+ The oauth2client.crypt module requires either PyCrypto or PyOpenSSL
+ to be available in order to function, but these are optional
+ dependencies.
+ """
+ if not HAS_CRYPTO:
+ raise CryptoUnavailableError('No crypto library available')
- This credential does not require a flow to instantiate because it represents
- a two legged flow, and therefore has all of the required information to
- generate and refresh its own access tokens.
- SignedJwtAssertionCredentials requires either PyOpenSSL, or PyCrypto 2.6 or
- later. For App Engine you may also consider using AppAssertionCredentials.
- """
+class SignedJwtAssertionCredentials(AssertionCredentials):
+ """Credentials object used for OAuth 2.0 Signed JWT assertion grants.
- MAX_TOKEN_LIFETIME_SECS = 3600 # 1 hour in seconds
+ This credential does not require a flow to instantiate because it
+ represents a two legged flow, and therefore has all of the required
+ information to generate and refresh its own access tokens.
- @util.positional(4)
- def __init__(self,
- service_account_name,
- private_key,
- scope,
- private_key_password='notasecret',
- user_agent=None,
- token_uri=GOOGLE_TOKEN_URI,
- revoke_uri=GOOGLE_REVOKE_URI,
- **kwargs):
- """Constructor for SignedJwtAssertionCredentials.
+ SignedJwtAssertionCredentials requires either PyOpenSSL, or PyCrypto
+ 2.6 or later. For App Engine you may also consider using
+ AppAssertionCredentials.
+ """
- Args:
- service_account_name: string, id for account, usually an email address.
- private_key: string, private key in PKCS12 or PEM format.
- scope: string or iterable of strings, scope(s) of the credentials being
- requested.
- private_key_password: string, password for private_key, unused if
- private_key is in PEM format.
- user_agent: string, HTTP User-Agent to provide for this application.
- token_uri: string, URI for token endpoint. For convenience
- defaults to Google's endpoints but any OAuth 2.0 provider can be used.
- revoke_uri: string, URI for revoke endpoint.
- kwargs: kwargs, Additional parameters to add to the JWT token, for
- example sub=joe@xample.org."""
+ MAX_TOKEN_LIFETIME_SECS = 3600 # 1 hour in seconds
- super(SignedJwtAssertionCredentials, self).__init__(
- None,
- user_agent=user_agent,
- token_uri=token_uri,
- revoke_uri=revoke_uri,
- )
-
- self.scope = util.scopes_to_string(scope)
-
- # Keep base64 encoded so it can be stored in JSON.
- self.private_key = base64.b64encode(private_key)
-
- self.private_key_password = private_key_password
- self.service_account_name = service_account_name
- self.kwargs = kwargs
-
- @classmethod
- def from_json(cls, s):
- data = simplejson.loads(s)
- retval = SignedJwtAssertionCredentials(
- data['service_account_name'],
- base64.b64decode(data['private_key']),
- data['scope'],
- private_key_password=data['private_key_password'],
- user_agent=data['user_agent'],
- token_uri=data['token_uri'],
- **data['kwargs']
- )
- retval.invalid = data['invalid']
- retval.access_token = data['access_token']
- return retval
-
- def _generate_assertion(self):
- """Generate the assertion that will be used in the request."""
- now = long(time.time())
- payload = {
- 'aud': self.token_uri,
- 'scope': self.scope,
- 'iat': now,
- 'exp': now + SignedJwtAssertionCredentials.MAX_TOKEN_LIFETIME_SECS,
- 'iss': self.service_account_name
- }
- payload.update(self.kwargs)
- logger.debug(str(payload))
-
- private_key = base64.b64decode(self.private_key)
- return crypt.make_signed_jwt(crypt.Signer.from_string(
- private_key, self.private_key_password), payload)
-
- # Only used in verify_id_token(), which is always calling to the same URI
- # for the certs.
- _cached_http = httplib2.Http(MemoryCache())
-
- @util.positional(2)
- def verify_id_token(id_token, audience, http=None,
- cert_uri=ID_TOKEN_VERIFICATON_CERTS):
- """Verifies a signed JWT id_token.
-
- This function requires PyOpenSSL and because of that it does not work on
- App Engine.
+ @util.positional(4)
+ def __init__(self,
+ service_account_name,
+ private_key,
+ scope,
+ private_key_password='notasecret',
+ user_agent=None,
+ token_uri=GOOGLE_TOKEN_URI,
+ revoke_uri=GOOGLE_REVOKE_URI,
+ **kwargs):
+ """Constructor for SignedJwtAssertionCredentials.
Args:
- id_token: string, A Signed JWT.
- audience: string, The audience 'aud' that the token should be for.
- http: httplib2.Http, instance to use to make the HTTP request. Callers
- should supply an instance that has caching enabled.
- cert_uri: string, URI of the certificates in JSON format to
- verify the JWT against.
-
- Returns:
- The deserialized JSON in the JWT.
+ service_account_name: string, id for account, usually an email address.
+ private_key: string, private key in PKCS12 or PEM format.
+ scope: string or iterable of strings, scope(s) of the credentials being
+ requested.
+ private_key_password: string, password for private_key, unused if
+ private_key is in PEM format.
+ user_agent: string, HTTP User-Agent to provide for this application.
+ token_uri: string, URI for token endpoint. For convenience
+ defaults to Google's endpoints but any OAuth 2.0 provider can be used.
+ revoke_uri: string, URI for revoke endpoint.
+ kwargs: kwargs, Additional parameters to add to the JWT token, for
+ example sub=joe@xample.org.
Raises:
- oauth2client.crypt.AppIdentityError if the JWT fails to verify.
+ CryptoUnavailableError if no crypto library is available.
"""
- if http is None:
- http = _cached_http
+ _RequireCryptoOrDie()
+ super(SignedJwtAssertionCredentials, self).__init__(
+ None,
+ user_agent=user_agent,
+ token_uri=token_uri,
+ revoke_uri=revoke_uri,
+ )
- resp, content = http.request(cert_uri)
+ self.scope = util.scopes_to_string(scope)
- if resp.status == 200:
- certs = simplejson.loads(content)
- return crypt.verify_signed_jwt_with_certs(id_token, certs, audience)
- else:
- raise VerifyJwtTokenError('Status code: %d' % resp.status)
+ # Keep base64 encoded so it can be stored in JSON.
+ self.private_key = base64.b64encode(private_key)
+ if isinstance(self.private_key, six.text_type):
+ self.private_key = self.private_key.encode('utf-8')
+
+ self.private_key_password = private_key_password
+ self.service_account_name = service_account_name
+ self.kwargs = kwargs
+
+ @classmethod
+ def from_json(cls, s):
+ data = json.loads(s)
+ retval = SignedJwtAssertionCredentials(
+ data['service_account_name'],
+ base64.b64decode(data['private_key']),
+ data['scope'],
+ private_key_password=data['private_key_password'],
+ user_agent=data['user_agent'],
+ token_uri=data['token_uri'],
+ **data['kwargs']
+ )
+ retval.invalid = data['invalid']
+ retval.access_token = data['access_token']
+ return retval
+
+ def _generate_assertion(self):
+ """Generate the assertion that will be used in the request."""
+ now = int(time.time())
+ payload = {
+ 'aud': self.token_uri,
+ 'scope': self.scope,
+ 'iat': now,
+ 'exp': now + SignedJwtAssertionCredentials.MAX_TOKEN_LIFETIME_SECS,
+ 'iss': self.service_account_name
+ }
+ payload.update(self.kwargs)
+ logger.debug(str(payload))
+
+ private_key = base64.b64decode(self.private_key)
+ return crypt.make_signed_jwt(crypt.Signer.from_string(
+ private_key, self.private_key_password), payload)
+
+# Only used in verify_id_token(), which is always calling to the same URI
+# for the certs.
+_cached_http = httplib2.Http(MemoryCache())
+
+@util.positional(2)
+def verify_id_token(id_token, audience, http=None,
+ cert_uri=ID_TOKEN_VERIFICATION_CERTS):
+ """Verifies a signed JWT id_token.
+
+ This function requires PyOpenSSL and because of that it does not work on
+ App Engine.
+
+ Args:
+ id_token: string, A Signed JWT.
+ audience: string, The audience 'aud' that the token should be for.
+ http: httplib2.Http, instance to use to make the HTTP request. Callers
+ should supply an instance that has caching enabled.
+ cert_uri: string, URI of the certificates in JSON format to
+ verify the JWT against.
+
+ Returns:
+ The deserialized JSON in the JWT.
+
+ Raises:
+ oauth2client.crypt.AppIdentityError: if the JWT fails to verify.
+ CryptoUnavailableError: if no crypto library is available.
+ """
+ _RequireCryptoOrDie()
+ if http is None:
+ http = _cached_http
+
+ resp, content = http.request(cert_uri)
+
+ if resp.status == 200:
+ certs = json.loads(content.decode('utf-8'))
+ return crypt.verify_signed_jwt_with_certs(id_token, certs, audience)
+ else:
+ raise VerifyJwtTokenError('Status code: %d' % resp.status)
def _urlsafe_b64decode(b64string):
# Guard against unicode strings, which base64 can't handle.
- b64string = b64string.encode('ascii')
- padded = b64string + '=' * (4 - len(b64string) % 4)
+ if isinstance(b64string, six.text_type):
+ b64string = b64string.encode('ascii')
+ padded = b64string + b'=' * (4 - len(b64string) % 4)
return base64.urlsafe_b64decode(padded)
@@ -1026,18 +1579,21 @@
Does the extraction w/o checking the signature.
Args:
- id_token: string, OAuth 2.0 id_token.
+ id_token: string or bytestring, OAuth 2.0 id_token.
Returns:
object, The deserialized JSON payload.
"""
- segments = id_token.split('.')
+ if type(id_token) == bytes:
+ segments = id_token.split(b'.')
+ else:
+ segments = id_token.split(u'.')
- if (len(segments) != 3):
+ if len(segments) != 3:
raise VerifyJwtTokenError(
- 'Wrong number of segments in token: %s' % id_token)
+ 'Wrong number of segments in token: %s' % id_token)
- return simplejson.loads(_urlsafe_b64decode(segments[1]))
+ return json.loads(_urlsafe_b64decode(segments[1]).decode('utf-8'))
def _parse_exchange_token_response(content):
@@ -1055,11 +1611,12 @@
"""
resp = {}
try:
- resp = simplejson.loads(content)
- except StandardError:
+ resp = json.loads(content.decode('utf-8'))
+ except Exception:
# different JSON libs raise different exceptions,
# so we just do a catch-all here
- resp = dict(parse_qsl(content))
+ content = content.decode('utf-8')
+ resp = dict(urllib.parse.parse_qsl(content))
# some providers respond with 'expires', others with 'expires_in'
if resp and 'expires' in resp:
@@ -1073,14 +1630,15 @@
redirect_uri='postmessage', http=None,
user_agent=None, token_uri=GOOGLE_TOKEN_URI,
auth_uri=GOOGLE_AUTH_URI,
- revoke_uri=GOOGLE_REVOKE_URI):
+ revoke_uri=GOOGLE_REVOKE_URI,
+ device_uri=GOOGLE_DEVICE_URI):
"""Exchanges an authorization code for an OAuth2Credentials object.
Args:
client_id: string, client identifier.
client_secret: string, client secret.
scope: string or iterable of strings, scope(s) to request.
- code: string, An authroization code, most likely passed down from
+ code: string, An authorization code, most likely passed down from
the client
redirect_uri: string, this is generally set to 'postmessage' to match the
redirect_uri that the client specified
@@ -1091,6 +1649,8 @@
defaults to Google's endpoints but any OAuth 2.0 provider can be used.
revoke_uri: string, URI for revoke endpoint. For convenience
defaults to Google's endpoints but any OAuth 2.0 provider can be used.
+ device_uri: string, URI for device authorization endpoint. For convenience
+ defaults to Google's endpoints but any OAuth 2.0 provider can be used.
Returns:
An OAuth2Credentials object.
@@ -1102,7 +1662,7 @@
flow = OAuth2WebServerFlow(client_id, client_secret, scope,
redirect_uri=redirect_uri, user_agent=user_agent,
auth_uri=auth_uri, token_uri=token_uri,
- revoke_uri=revoke_uri)
+ revoke_uri=revoke_uri, device_uri=device_uri)
credentials = flow.step2_exchange(code, http=http)
return credentials
@@ -1113,7 +1673,8 @@
message = None,
redirect_uri='postmessage',
http=None,
- cache=None):
+ cache=None,
+ device_uri=None):
"""Returns OAuth2Credentials from a clientsecrets file and an auth code.
Will create the right kind of Flow based on the contents of the clientsecrets
@@ -1133,6 +1694,7 @@
http: httplib2.Http, optional http instance to use to do the fetch
cache: An optional cache service client that implements get() and set()
methods. See clientsecrets.loadfile() for details.
+ device_uri: string, OAuth 2.0 device authorization endpoint
Returns:
An OAuth2Credentials object.
@@ -1145,11 +1707,49 @@
invalid.
"""
flow = flow_from_clientsecrets(filename, scope, message=message, cache=cache,
- redirect_uri=redirect_uri)
+ redirect_uri=redirect_uri,
+ device_uri=device_uri)
credentials = flow.step2_exchange(code, http=http)
return credentials
+class DeviceFlowInfo(collections.namedtuple('DeviceFlowInfo', (
+ 'device_code', 'user_code', 'interval', 'verification_url',
+ 'user_code_expiry'))):
+ """Intermediate information the OAuth2 for devices flow."""
+
+ @classmethod
+ def FromResponse(cls, response):
+ """Create a DeviceFlowInfo from a server response.
+
+ The response should be a dict containing entries as described here:
+
+ http://tools.ietf.org/html/draft-ietf-oauth-v2-05#section-3.7.1
+ """
+ # device_code, user_code, and verification_url are required.
+ kwargs = {
+ 'device_code': response['device_code'],
+ 'user_code': response['user_code'],
+ }
+ # The response may list the verification address as either
+ # verification_url or verification_uri, so we check for both.
+ verification_url = response.get(
+ 'verification_url', response.get('verification_uri'))
+ if verification_url is None:
+ raise OAuth2DeviceCodeError(
+ 'No verification_url provided in server response')
+ kwargs['verification_url'] = verification_url
+ # expires_in and interval are optional.
+ kwargs.update({
+ 'interval': response.get('interval'),
+ 'user_code_expiry': None,
+ })
+ if 'expires_in' in response:
+ kwargs['user_code_expiry'] = datetime.datetime.now() + datetime.timedelta(
+ seconds=int(response['expires_in']))
+
+ return cls(**kwargs)
+
class OAuth2WebServerFlow(Flow):
"""Does the Web Server Flow for OAuth 2.0.
@@ -1163,6 +1763,8 @@
auth_uri=GOOGLE_AUTH_URI,
token_uri=GOOGLE_TOKEN_URI,
revoke_uri=GOOGLE_REVOKE_URI,
+ login_hint=None,
+ device_uri=GOOGLE_DEVICE_URI,
**kwargs):
"""Constructor for OAuth2WebServerFlow.
@@ -1185,6 +1787,11 @@
defaults to Google's endpoints but any OAuth 2.0 provider can be used.
revoke_uri: string, URI for revoke endpoint. For convenience
defaults to Google's endpoints but any OAuth 2.0 provider can be used.
+ login_hint: string, Either an email address or domain. Passing this hint
+ will either pre-fill the email box on the sign-in form or select the
+ proper multi-login session, thereby simplifying the login flow.
+ device_uri: string, URI for device authorization endpoint. For convenience
+ defaults to Google's endpoints but any OAuth 2.0 provider can be used.
**kwargs: dict, The keyword arguments are all optional and required
parameters for the OAuth calls.
"""
@@ -1192,10 +1799,12 @@
self.client_secret = client_secret
self.scope = util.scopes_to_string(scope)
self.redirect_uri = redirect_uri
+ self.login_hint = login_hint
self.user_agent = user_agent
self.auth_uri = auth_uri
self.token_uri = token_uri
self.revoke_uri = revoke_uri
+ self.device_uri = device_uri
self.params = {
'access_type': 'offline',
'response_type': 'code',
@@ -1216,8 +1825,9 @@
A URI as a string to redirect the user to begin the authorization flow.
"""
if redirect_uri is not None:
- logger.warning(('The redirect_uri parameter for'
- 'OAuth2WebServerFlow.step1_get_authorize_url is deprecated. Please'
+ logger.warning((
+ 'The redirect_uri parameter for '
+ 'OAuth2WebServerFlow.step1_get_authorize_url is deprecated. Please '
'move to passing the redirect_uri in via the constructor.'))
self.redirect_uri = redirect_uri
@@ -1229,45 +1839,107 @@
'redirect_uri': self.redirect_uri,
'scope': self.scope,
}
+ if self.login_hint is not None:
+ query_params['login_hint'] = self.login_hint
query_params.update(self.params)
return _update_query_params(self.auth_uri, query_params)
+ @util.positional(1)
+ def step1_get_device_and_user_codes(self, http=None):
+ """Returns a user code and the verification URL where to enter it
+
+ Returns:
+ A user code as a string for the user to authorize the application
+ An URL as a string where the user has to enter the code
+ """
+ if self.device_uri is None:
+ raise ValueError('The value of device_uri must not be None.')
+
+ body = urllib.parse.urlencode({
+ 'client_id': self.client_id,
+ 'scope': self.scope,
+ })
+ headers = {
+ 'content-type': 'application/x-www-form-urlencoded',
+ }
+
+ if self.user_agent is not None:
+ headers['user-agent'] = self.user_agent
+
+ if http is None:
+ http = httplib2.Http()
+
+ resp, content = http.request(self.device_uri, method='POST', body=body,
+ headers=headers)
+ if resp.status == 200:
+ try:
+ flow_info = json.loads(content)
+ except ValueError as e:
+ raise OAuth2DeviceCodeError(
+ 'Could not parse server response as JSON: "%s", error: "%s"' % (
+ content, e))
+ return DeviceFlowInfo.FromResponse(flow_info)
+ else:
+ error_msg = 'Invalid response %s.' % resp.status
+ try:
+ d = json.loads(content)
+ if 'error' in d:
+ error_msg += ' Error: %s' % d['error']
+ except ValueError:
+ # Couldn't decode a JSON response, stick with the default message.
+ pass
+ raise OAuth2DeviceCodeError(error_msg)
+
@util.positional(2)
- def step2_exchange(self, code, http=None):
- """Exhanges a code for OAuth2Credentials.
+ def step2_exchange(self, code=None, http=None, device_flow_info=None):
+ """Exchanges a code for OAuth2Credentials.
Args:
- code: string or dict, either the code as a string, or a dictionary
- of the query parameters to the redirect_uri, which contains
- the code.
- http: httplib2.Http, optional http instance to use to do the fetch
+
+ code: string, a dict-like object, or None. For a non-device
+ flow, this is either the response code as a string, or a
+ dictionary of query parameters to the redirect_uri. For a
+ device flow, this should be None.
+ http: httplib2.Http, optional http instance to use when fetching
+ credentials.
+ device_flow_info: DeviceFlowInfo, return value from step1 in the
+ case of a device flow.
Returns:
An OAuth2Credentials object that can be used to authorize requests.
Raises:
- FlowExchangeError if a problem occured exchanging the code for a
- refresh_token.
+ FlowExchangeError: if a problem occurred exchanging the code for a
+ refresh_token.
+ ValueError: if code and device_flow_info are both provided or both
+ missing.
+
"""
+ if code is None and device_flow_info is None:
+ raise ValueError('No code or device_flow_info provided.')
+ if code is not None and device_flow_info is not None:
+ raise ValueError('Cannot provide both code and device_flow_info.')
- if not (isinstance(code, str) or isinstance(code, unicode)):
+ if code is None:
+ code = device_flow_info.device_code
+ elif not isinstance(code, six.string_types):
if 'code' not in code:
- if 'error' in code:
- error_msg = code['error']
- else:
- error_msg = 'No code was supplied in the query parameters.'
- raise FlowExchangeError(error_msg)
- else:
- code = code['code']
+ raise FlowExchangeError(code.get(
+ 'error', 'No code was supplied in the query parameters.'))
+ code = code['code']
- body = urllib.urlencode({
- 'grant_type': 'authorization_code',
+ post_data = {
'client_id': self.client_id,
'client_secret': self.client_secret,
'code': code,
- 'redirect_uri': self.redirect_uri,
'scope': self.scope,
- })
+ }
+ if device_flow_info is not None:
+ post_data['grant_type'] = 'http://oauth.net/grant_type/device/1.0'
+ else:
+ post_data['grant_type'] = 'authorization_code'
+ post_data['redirect_uri'] = self.redirect_uri
+ body = urllib.parse.urlencode(post_data)
headers = {
'content-type': 'application/x-www-form-urlencoded',
}
@@ -1284,26 +1956,31 @@
if resp.status == 200 and 'access_token' in d:
access_token = d['access_token']
refresh_token = d.get('refresh_token', None)
+ if not refresh_token:
+ logger.info(
+ 'Received token response with no refresh_token. Consider '
+ "reauthenticating with approval_prompt='force'.")
token_expiry = None
if 'expires_in' in d:
token_expiry = datetime.datetime.utcnow() + datetime.timedelta(
seconds=int(d['expires_in']))
+ extracted_id_token = None
if 'id_token' in d:
- d['id_token'] = _extract_id_token(d['id_token'])
+ extracted_id_token = _extract_id_token(d['id_token'])
logger.info('Successfully retrieved access token')
return OAuth2Credentials(access_token, self.client_id,
self.client_secret, refresh_token, token_expiry,
self.token_uri, self.user_agent,
revoke_uri=self.revoke_uri,
- id_token=d.get('id_token', None),
+ id_token=extracted_id_token,
token_response=d)
else:
- logger.info('Failed to retrieve access token: %s' % content)
+ logger.info('Failed to retrieve access token: %s', content)
if 'error' in d:
# you never know what those providers got to say
- error_msg = unicode(d['error'])
+ error_msg = str(d['error']) + str(d.get('error_description', ''))
else:
error_msg = 'Invalid response: %s.' % str(resp.status)
raise FlowExchangeError(error_msg)
@@ -1311,7 +1988,8 @@
@util.positional(2)
def flow_from_clientsecrets(filename, scope, redirect_uri=None,
- message=None, cache=None):
+ message=None, cache=None, login_hint=None,
+ device_uri=None):
"""Create a Flow from a clientsecrets file.
Will create the right kind of Flow based on the contents of the clientsecrets
@@ -1329,6 +2007,11 @@
provided then clientsecrets.InvalidClientSecretsError will be raised.
cache: An optional cache service client that implements get() and set()
methods. See clientsecrets.loadfile() for details.
+ login_hint: string, Either an email address or domain. Passing this hint
+ will either pre-fill the email box on the sign-in form or select the
+ proper multi-login session, thereby simplifying the login flow.
+ device_uri: string, URI for device authorization endpoint. For convenience
+ defaults to Google's endpoints but any OAuth 2.0 provider can be used.
Returns:
A Flow object.
@@ -1345,10 +2028,13 @@
'redirect_uri': redirect_uri,
'auth_uri': client_info['auth_uri'],
'token_uri': client_info['token_uri'],
+ 'login_hint': login_hint,
}
revoke_uri = client_info.get('revoke_uri')
if revoke_uri is not None:
constructor_kwargs['revoke_uri'] = revoke_uri
+ if device_uri is not None:
+ constructor_kwargs['device_uri'] = device_uri
return OAuth2WebServerFlow(
client_info['client_id'], client_info['client_secret'],
scope, **constructor_kwargs)
@@ -1360,4 +2046,4 @@
raise
else:
raise UnknownClientSecretsFlowError(
- 'This OAuth 2.0 flow is unsupported: %r' % client_type)
+ 'This OAuth 2.0 flow is unsupported: %r' % client_type)
\ No newline at end of file
diff --git a/third_party/oauth2client/clientsecrets.py b/third_party/oauth2client/clientsecrets.py
index ac99aae..af079ec 100644
--- a/third_party/oauth2client/clientsecrets.py
+++ b/third_party/oauth2client/clientsecrets.py
@@ -1,4 +1,4 @@
-# Copyright (C) 2011 Google Inc.
+# Copyright 2014 Google Inc. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@@ -20,8 +20,10 @@
__author__ = 'jcgregorio@google.com (Joe Gregorio)'
+import json
-from anyjson import simplejson
+from third_party import six
+
# Properties that make a client_secrets.json file valid.
TYPE_WEB = 'web'
@@ -68,11 +70,21 @@
def _validate_clientsecrets(obj):
- if obj is None or len(obj) != 1:
- raise InvalidClientSecretsError('Invalid file format.')
- client_type = obj.keys()[0]
- if client_type not in VALID_CLIENT.keys():
- raise InvalidClientSecretsError('Unknown client type: %s.' % client_type)
+ _INVALID_FILE_FORMAT_MSG = (
+ 'Invalid file format. See '
+ 'https://developers.google.com/api-client-library/'
+ 'python/guide/aaa_client_secrets')
+
+ if obj is None:
+ raise InvalidClientSecretsError(_INVALID_FILE_FORMAT_MSG)
+ if len(obj) != 1:
+ raise InvalidClientSecretsError(
+ _INVALID_FILE_FORMAT_MSG + ' '
+ 'Expected a JSON object with a single property for a "web" or '
+ '"installed" application')
+ client_type = tuple(obj)[0]
+ if client_type not in VALID_CLIENT:
+ raise InvalidClientSecretsError('Unknown client type: %s.' % (client_type,))
client_info = obj[client_type]
for prop_name in VALID_CLIENT[client_type]['required']:
if prop_name not in client_info:
@@ -87,22 +99,19 @@
def load(fp):
- obj = simplejson.load(fp)
+ obj = json.load(fp)
return _validate_clientsecrets(obj)
def loads(s):
- obj = simplejson.loads(s)
+ obj = json.loads(s)
return _validate_clientsecrets(obj)
def _loadfile(filename):
try:
- fp = file(filename, 'r')
- try:
- obj = simplejson.load(fp)
- finally:
- fp.close()
+ with open(filename, 'r') as fp:
+ obj = json.load(fp)
except IOError:
raise InvalidClientSecretsError('File not found: "%s"' % filename)
return _validate_clientsecrets(obj)
@@ -114,10 +123,12 @@
Typical cache storage would be App Engine memcache service,
but you can pass in any other cache client that implements
these methods:
- - get(key, namespace=ns)
- - set(key, value, namespace=ns)
- Usage:
+ * ``get(key, namespace=ns)``
+ * ``set(key, value, namespace=ns)``
+
+ Usage::
+
# without caching
client_type, client_info = loadfile('secrets.json')
# using App Engine memcache service
@@ -150,4 +161,4 @@
obj = {client_type: client_info}
cache.set(filename, obj, namespace=_SECRET_NAMESPACE)
- return obj.iteritems().next()
+ return next(six.iteritems(obj))
\ No newline at end of file
diff --git a/third_party/oauth2client/crypt.py b/third_party/oauth2client/crypt.py
index 2d31815..b5b8cab 100644
--- a/third_party/oauth2client/crypt.py
+++ b/third_party/oauth2client/crypt.py
@@ -1,7 +1,6 @@
-#!/usr/bin/python2.4
# -*- coding: utf-8 -*-
#
-# Copyright (C) 2011 Google Inc.
+# Copyright 2014 Google Inc. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@@ -14,13 +13,15 @@
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
+"""Crypto-related routines for oauth2client."""
import base64
-import hashlib
+import json
import logging
+import sys
import time
-from anyjson import simplejson
+from third_party import six
CLOCK_SKEW_SECS = 300 # 5 minutes in seconds
@@ -38,7 +39,6 @@
try:
from OpenSSL import crypto
-
class OpenSSLVerifier(object):
"""Verifies the signature on a message."""
@@ -62,6 +62,8 @@
key that this object was constructed with.
"""
try:
+ if isinstance(message, six.text_type):
+ message = message.encode('utf-8')
crypto.verify(self._pubkey, signature, message, 'sha256')
return True
except:
@@ -104,15 +106,17 @@
"""Signs a message.
Args:
- message: string, Message to be signed.
+ message: bytes, Message to be signed.
Returns:
string, The signature of the message for the given key.
"""
+ if isinstance(message, six.text_type):
+ message = message.encode('utf-8')
return crypto.sign(self._key, message, 'sha256')
@staticmethod
- def from_string(key, password='notasecret'):
+ def from_string(key, password=b'notasecret'):
"""Construct a Signer instance from a string.
Args:
@@ -125,21 +129,45 @@
Raises:
OpenSSL.crypto.Error if the key can't be parsed.
"""
- if key.startswith('-----BEGIN '):
- pkey = crypto.load_privatekey(crypto.FILETYPE_PEM, key)
+ parsed_pem_key = _parse_pem_key(key)
+ if parsed_pem_key:
+ pkey = crypto.load_privatekey(crypto.FILETYPE_PEM, parsed_pem_key)
else:
+ if isinstance(password, six.text_type):
+ password = password.encode('utf-8')
pkey = crypto.load_pkcs12(key, password).get_privatekey()
return OpenSSLSigner(pkey)
+
+ def pkcs12_key_as_pem(private_key_text, private_key_password):
+ """Convert the contents of a PKCS12 key to PEM using OpenSSL.
+
+ Args:
+ private_key_text: String. Private key.
+ private_key_password: String. Password for PKCS12.
+
+ Returns:
+ String. PEM contents of ``private_key_text``.
+ """
+ decoded_body = base64.b64decode(private_key_text)
+ if isinstance(private_key_password, six.string_types):
+ private_key_password = private_key_password.encode('ascii')
+
+ pkcs12 = crypto.load_pkcs12(decoded_body, private_key_password)
+ return crypto.dump_privatekey(crypto.FILETYPE_PEM,
+ pkcs12.get_privatekey())
except ImportError:
OpenSSLVerifier = None
OpenSSLSigner = None
+ def pkcs12_key_as_pem(*args, **kwargs):
+ raise NotImplementedError('pkcs12_key_as_pem requires OpenSSL.')
try:
from Crypto.PublicKey import RSA
from Crypto.Hash import SHA256
from Crypto.Signature import PKCS1_v1_5
+ from Crypto.Util.asn1 import DerSequence
class PyCryptoVerifier(object):
@@ -181,14 +209,17 @@
Returns:
Verifier instance.
-
- Raises:
- NotImplementedError if is_x509_cert is true.
"""
if is_x509_cert:
- raise NotImplementedError(
- 'X509 certs are not supported by the PyCrypto library. '
- 'Try using PyOpenSSL if native code is an option.')
+ if isinstance(key_pem, six.text_type):
+ key_pem = key_pem.encode('ascii')
+ pemLines = key_pem.replace(b' ', b'').split()
+ certDer = _urlsafe_b64decode(b''.join(pemLines[1:-1]))
+ certSeq = DerSequence()
+ certSeq.decode(certDer)
+ tbsSeq = DerSequence()
+ tbsSeq.decode(certSeq[0])
+ pubkey = RSA.importKey(tbsSeq[6])
else:
pubkey = RSA.importKey(key_pem)
return PyCryptoVerifier(pubkey)
@@ -214,6 +245,8 @@
Returns:
string, The signature of the message for the given key.
"""
+ if isinstance(message, six.text_type):
+ message = message.encode('utf-8')
return PKCS1_v1_5.new(self._key).sign(SHA256.new(message))
@staticmethod
@@ -230,11 +263,12 @@
Raises:
NotImplementedError if they key isn't in PEM format.
"""
- if key.startswith('-----BEGIN '):
- pkey = RSA.importKey(key)
+ parsed_pem_key = _parse_pem_key(key)
+ if parsed_pem_key:
+ pkey = RSA.importKey(parsed_pem_key)
else:
raise NotImplementedError(
- 'PKCS12 format is not supported by the PyCrpto library. '
+ 'PKCS12 format is not supported by the PyCrypto library. '
'Try converting to a "PEM" '
'(openssl pkcs12 -in xxxxx.p12 -nodes -nocerts > privatekey.pem) '
'or using PyOpenSSL if native code is an option.')
@@ -256,19 +290,39 @@
'PyOpenSSL, or PyCrypto 2.6 or later')
+def _parse_pem_key(raw_key_input):
+ """Identify and extract PEM keys.
+
+ Determines whether the given key is in the format of PEM key, and extracts
+ the relevant part of the key if it is.
+
+ Args:
+ raw_key_input: The contents of a private key file (either PEM or PKCS12).
+
+ Returns:
+ string, The actual key if the contents are from a PEM file, or else None.
+ """
+ offset = raw_key_input.find(b'-----BEGIN ')
+ if offset != -1:
+ return raw_key_input[offset:]
+
+
def _urlsafe_b64encode(raw_bytes):
- return base64.urlsafe_b64encode(raw_bytes).rstrip('=')
+ if isinstance(raw_bytes, six.text_type):
+ raw_bytes = raw_bytes.encode('utf-8')
+ return base64.urlsafe_b64encode(raw_bytes).decode('ascii').rstrip('=')
def _urlsafe_b64decode(b64string):
# Guard against unicode strings, which base64 can't handle.
- b64string = b64string.encode('ascii')
- padded = b64string + '=' * (4 - len(b64string) % 4)
+ if isinstance(b64string, six.text_type):
+ b64string = b64string.encode('ascii')
+ padded = b64string + b'=' * (4 - len(b64string) % 4)
return base64.urlsafe_b64decode(padded)
def _json_encode(data):
- return simplejson.dumps(data, separators = (',', ':'))
+ return json.dumps(data, separators=(',', ':'))
def make_signed_jwt(signer, payload):
@@ -286,8 +340,8 @@
header = {'typ': 'JWT', 'alg': 'RS256'}
segments = [
- _urlsafe_b64encode(_json_encode(header)),
- _urlsafe_b64encode(_json_encode(payload)),
+ _urlsafe_b64encode(_json_encode(header)),
+ _urlsafe_b64encode(_json_encode(payload)),
]
signing_input = '.'.join(segments)
@@ -318,9 +372,8 @@
"""
segments = jwt.split('.')
- if (len(segments) != 3):
- raise AppIdentityError(
- 'Wrong number of segments in token: %s' % jwt)
+ if len(segments) != 3:
+ raise AppIdentityError('Wrong number of segments in token: %s' % jwt)
signed = '%s.%s' % (segments[0], segments[1])
signature = _urlsafe_b64decode(segments[2])
@@ -328,15 +381,15 @@
# Parse token.
json_body = _urlsafe_b64decode(segments[1])
try:
- parsed = simplejson.loads(json_body)
+ parsed = json.loads(json_body.decode('utf-8'))
except:
raise AppIdentityError('Can\'t parse token: %s' % json_body)
# Check signature.
verified = False
- for (keyname, pem) in certs.items():
+ for pem in certs.values():
verifier = Verifier.from_string(pem, True)
- if (verifier.verify(signed, signature)):
+ if verifier.verify(signed, signature):
verified = True
break
if not verified:
@@ -349,21 +402,20 @@
earliest = iat - CLOCK_SKEW_SECS
# Check expiration timestamp.
- now = long(time.time())
+ now = int(time.time())
exp = parsed.get('exp')
if exp is None:
raise AppIdentityError('No exp field in token: %s' % json_body)
if exp >= now + MAX_TOKEN_LIFETIME_SECS:
- raise AppIdentityError(
- 'exp field too far in future: %s' % json_body)
+ raise AppIdentityError('exp field too far in future: %s' % json_body)
latest = exp + CLOCK_SKEW_SECS
if now < earliest:
raise AppIdentityError('Token used too early, %d < %d: %s' %
- (now, earliest, json_body))
+ (now, earliest, json_body))
if now > latest:
raise AppIdentityError('Token used too late, %d > %d: %s' %
- (now, latest, json_body))
+ (now, latest, json_body))
# Check audience.
if audience is not None:
@@ -372,6 +424,6 @@
raise AppIdentityError('No aud field in token: %s' % json_body)
if aud != audience:
raise AppIdentityError('Wrong recipient, %s != %s: %s' %
- (aud, audience, json_body))
+ (aud, audience, json_body))
- return parsed
+ return parsed
\ No newline at end of file
diff --git a/third_party/oauth2client/devshell.py b/third_party/oauth2client/devshell.py
new file mode 100644
index 0000000..69d3808
--- /dev/null
+++ b/third_party/oauth2client/devshell.py
@@ -0,0 +1,135 @@
+# Copyright 2015 Google Inc. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""OAuth 2.0 utitilies for Google Developer Shell environment."""
+
+import json
+import os
+
+from . import client
+
+
+DEVSHELL_ENV = 'DEVSHELL_CLIENT_PORT'
+
+
+class Error(Exception):
+ """Errors for this module."""
+ pass
+
+
+class CommunicationError(Error):
+ """Errors for communication with the Developer Shell server."""
+
+
+class NoDevshellServer(Error):
+ """Error when no Developer Shell server can be contacted."""
+
+
+# The request for credential information to the Developer Shell client socket is
+# always an empty PBLite-formatted JSON object, so just define it as a constant.
+CREDENTIAL_INFO_REQUEST_JSON = '[]'
+
+
+class CredentialInfoResponse(object):
+ """Credential information response from Developer Shell server.
+
+ The credential information response from Developer Shell socket is a
+ PBLite-formatted JSON array with fields encoded by their index in the array:
+ * Index 0 - user email
+ * Index 1 - default project ID. None if the project context is not known.
+ * Index 2 - OAuth2 access token. None if there is no valid auth context.
+ """
+
+ def __init__(self, json_string):
+ """Initialize the response data from JSON PBLite array."""
+ pbl = json.loads(json_string)
+ if not isinstance(pbl, list):
+ raise ValueError('Not a list: ' + str(pbl))
+ pbl_len = len(pbl)
+ self.user_email = pbl[0] if pbl_len > 0 else None
+ self.project_id = pbl[1] if pbl_len > 1 else None
+ self.access_token = pbl[2] if pbl_len > 2 else None
+
+
+def _SendRecv():
+ """Communicate with the Developer Shell server socket."""
+
+ port = int(os.getenv(DEVSHELL_ENV, 0))
+ if port == 0:
+ raise NoDevshellServer()
+
+ import socket
+
+ sock = socket.socket()
+ sock.connect(('localhost', port))
+
+ data = CREDENTIAL_INFO_REQUEST_JSON
+ msg = '%s\n%s' % (len(data), data)
+ sock.sendall(msg.encode())
+
+ header = sock.recv(6).decode()
+ if '\n' not in header:
+ raise CommunicationError('saw no newline in the first 6 bytes')
+ len_str, json_str = header.split('\n', 1)
+ to_read = int(len_str) - len(json_str)
+ if to_read > 0:
+ json_str += sock.recv(to_read, socket.MSG_WAITALL).decode()
+
+ return CredentialInfoResponse(json_str)
+
+
+class DevshellCredentials(client.GoogleCredentials):
+ """Credentials object for Google Developer Shell environment.
+
+ This object will allow a Google Developer Shell session to identify its user
+ to Google and other OAuth 2.0 servers that can verify assertions. It can be
+ used for the purpose of accessing data stored under the user account.
+
+ This credential does not require a flow to instantiate because it represents
+ a two legged flow, and therefore has all of the required information to
+ generate and refresh its own access tokens.
+ """
+
+ def __init__(self, user_agent=None):
+ super(DevshellCredentials, self).__init__(
+ None, # access_token, initialized below
+ None, # client_id
+ None, # client_secret
+ None, # refresh_token
+ None, # token_expiry
+ None, # token_uri
+ user_agent)
+ self._refresh(None)
+
+ def _refresh(self, http_request):
+ self.devshell_response = _SendRecv()
+ self.access_token = self.devshell_response.access_token
+
+ @property
+ def user_email(self):
+ return self.devshell_response.user_email
+
+ @property
+ def project_id(self):
+ return self.devshell_response.project_id
+
+ @classmethod
+ def from_json(cls, json_data):
+ raise NotImplementedError(
+ 'Cannot load Developer Shell credentials from JSON.')
+
+ @property
+ def serialization_data(self):
+ raise NotImplementedError(
+ 'Cannot serialize Developer Shell credentials.')
diff --git a/third_party/oauth2client/django_orm.py b/third_party/oauth2client/django_orm.py
index d54d20c..ffbcf92 100644
--- a/third_party/oauth2client/django_orm.py
+++ b/third_party/oauth2client/django_orm.py
@@ -1,4 +1,4 @@
-# Copyright (C) 2010 Google Inc.
+# Copyright 2014 Google Inc. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@@ -116,14 +116,21 @@
credential.set_store(self)
return credential
- def locked_put(self, credentials):
+ def locked_put(self, credentials, overwrite=False):
"""Write a Credentials to the datastore.
Args:
credentials: Credentials, the credentials to store.
+ overwrite: Boolean, indicates whether you would like these credentials to
+ overwrite any existing stored credentials.
"""
args = {self.key_name: self.key_value}
- entity = self.model_class(**args)
+
+ if overwrite:
+ entity, unused_is_new = self.model_class.objects.get_or_create(**args)
+ else:
+ entity = self.model_class(**args)
+
setattr(entity, self.property_name, credentials)
entity.save()
@@ -131,4 +138,4 @@
"""Delete Credentials from the datastore."""
query = {self.key_name: self.key_value}
- entities = self.model_class.objects.filter(**query).delete()
+ entities = self.model_class.objects.filter(**query).delete()
\ No newline at end of file
diff --git a/third_party/oauth2client/file.py b/third_party/oauth2client/file.py
index 1895f94..4337fcf 100644
--- a/third_party/oauth2client/file.py
+++ b/third_party/oauth2client/file.py
@@ -1,4 +1,4 @@
-# Copyright (C) 2010 Google Inc.
+# Copyright 2014 Google Inc. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@@ -21,12 +21,10 @@
__author__ = 'jcgregorio@google.com (Joe Gregorio)'
import os
-import stat
import threading
-from anyjson import simplejson
-from client import Storage as BaseStorage
from client import Credentials
+from client import Storage as BaseStorage
class CredentialsFileSymbolicLinkError(Exception):
@@ -92,7 +90,7 @@
simple version of "touch" to ensure the file has been created.
"""
if not os.path.exists(self._filename):
- old_umask = os.umask(0177)
+ old_umask = os.umask(0o177)
try:
open(self._filename, 'a+b').close()
finally:
@@ -110,7 +108,7 @@
self._create_file_if_needed()
self._validate_file()
- f = open(self._filename, 'wb')
+ f = open(self._filename, 'w')
f.write(credentials.to_json())
f.close()
@@ -121,4 +119,4 @@
credentials: Credentials, the credentials to store.
"""
- os.unlink(self._filename)
+ os.unlink(self._filename)
\ No newline at end of file
diff --git a/third_party/oauth2client/gce.py b/third_party/oauth2client/gce.py
index c7fd7c1..ebd14e3 100644
--- a/third_party/oauth2client/gce.py
+++ b/third_party/oauth2client/gce.py
@@ -1,4 +1,4 @@
-# Copyright (C) 2012 Google Inc.
+# Copyright 2014 Google Inc. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@@ -19,14 +19,13 @@
__author__ = 'jcgregorio@google.com (Joe Gregorio)'
-import httplib2
+import json
import logging
-import uritemplate
+from third_party.six.moves import urllib
-from oauth2client import util
-from oauth2client.anyjson import simplejson
-from oauth2client.client import AccessTokenRefreshError
-from oauth2client.client import AssertionCredentials
+from third_party.oauth2client import util
+from third_party.oauth2client.client import AccessTokenRefreshError
+from third_party.oauth2client.client import AssertionCredentials
logger = logging.getLogger(__name__)
@@ -57,13 +56,14 @@
requested.
"""
self.scope = util.scopes_to_string(scope)
+ self.kwargs = kwargs
# Assertion type is no longer used, but still in the parent class signature.
super(AppAssertionCredentials, self).__init__(None)
@classmethod
- def from_json(cls, json):
- data = simplejson.loads(json)
+ def from_json(cls, json_data):
+ data = json.loads(json_data)
return AppAssertionCredentials(data['scope'])
def _refresh(self, http_request):
@@ -78,13 +78,28 @@
Raises:
AccessTokenRefreshError: When the refresh fails.
"""
- uri = uritemplate.expand(META, {'scope': self.scope})
+ query = '?scope=%s' % urllib.parse.quote(self.scope, '')
+ uri = META.replace('{?scope}', query)
response, content = http_request(uri)
if response.status == 200:
try:
- d = simplejson.loads(content)
- except StandardError, e:
+ d = json.loads(content)
+ except Exception as e:
raise AccessTokenRefreshError(str(e))
self.access_token = d['accessToken']
else:
+ if response.status == 404:
+ content += (' This can occur if a VM was created'
+ ' with no service account or scopes.')
raise AccessTokenRefreshError(content)
+
+ @property
+ def serialization_data(self):
+ raise NotImplementedError(
+ 'Cannot serialize credentials for GCE service accounts.')
+
+ def create_scoped_required(self):
+ return not self.scope
+
+ def create_scoped(self, scopes):
+ return AppAssertionCredentials(scopes, **self.kwargs)
\ No newline at end of file
diff --git a/third_party/oauth2client/keyring_storage.py b/third_party/oauth2client/keyring_storage.py
index efe2949..512ac77 100644
--- a/third_party/oauth2client/keyring_storage.py
+++ b/third_party/oauth2client/keyring_storage.py
@@ -1,4 +1,4 @@
-# Copyright (C) 2012 Google Inc.
+# Copyright 2014 Google Inc. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@@ -19,11 +19,12 @@
__author__ = 'jcgregorio@google.com (Joe Gregorio)'
-import keyring
import threading
-from client import Storage as BaseStorage
+import keyring
+
from client import Credentials
+from client import Storage as BaseStorage
class Storage(BaseStorage):
@@ -106,4 +107,4 @@
Args:
credentials: Credentials, the credentials to store.
"""
- keyring.set_password(self._service_name, self._user_name, '')
+ keyring.set_password(self._service_name, self._user_name, '')
\ No newline at end of file
diff --git a/third_party/oauth2client/locked_file.py b/third_party/oauth2client/locked_file.py
index 858b702..fa2c6c1 100644
--- a/third_party/oauth2client/locked_file.py
+++ b/third_party/oauth2client/locked_file.py
@@ -1,4 +1,4 @@
-# Copyright 2011 Google Inc.
+# Copyright 2014 Google Inc. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@@ -17,17 +17,21 @@
This module first tries to use fcntl locking to ensure serialized access
to a file, then falls back on a lock file if that is unavialable.
-Usage:
+Usage::
+
f = LockedFile('filename', 'r+b', 'rb')
f.open_and_lock()
if f.is_locked():
- print 'Acquired filename with r+b mode'
+ print('Acquired filename with r+b mode')
f.file_handle().write('locked data')
else:
- print 'Aquired filename with rb mode'
+ print('Acquired filename with rb mode')
f.unlock_and_close()
+
"""
+from __future__ import print_function
+
__author__ = 'cache@google.com (David T McWherter)'
import errno
@@ -70,6 +74,7 @@
self._mode = mode
self._fallback_mode = fallback_mode
self._fh = None
+ self._lock_fd = None
def is_locked(self):
"""Was the file locked."""
@@ -122,7 +127,7 @@
validate_file(self._filename)
try:
self._fh = open(self._filename, self._mode)
- except IOError, e:
+ except IOError as e:
# If we can't access with _mode, try _fallback_mode and don't lock.
if e.errno == errno.EACCES:
self._fh = open(self._filename, self._fallback_mode)
@@ -137,12 +142,12 @@
self._locked = True
break
- except OSError, e:
+ except OSError as e:
if e.errno != errno.EEXIST:
raise
if (time.time() - start_time) >= timeout:
- logger.warn('Could not acquire lock %s in %s seconds' % (
- lock_filename, timeout))
+ logger.warn('Could not acquire lock %s in %s seconds',
+ lock_filename, timeout)
# Close the file and open in fallback_mode.
if self._fh:
self._fh.close()
@@ -192,9 +197,9 @@
validate_file(self._filename)
try:
self._fh = open(self._filename, self._mode)
- except IOError, e:
+ except IOError as e:
# If we can't access with _mode, try _fallback_mode and don't lock.
- if e.errno == errno.EACCES:
+ if e.errno in (errno.EPERM, errno.EACCES):
self._fh = open(self._filename, self._fallback_mode)
return
@@ -204,16 +209,16 @@
fcntl.lockf(self._fh.fileno(), fcntl.LOCK_EX)
self._locked = True
return
- except IOError, e:
+ except IOError as e:
# If not retrying, then just pass on the error.
if timeout == 0:
- raise e
+ raise
if e.errno != errno.EACCES:
- raise e
+ raise
# We could not acquire the lock. Try again.
if (time.time() - start_time) >= timeout:
- logger.warn('Could not lock %s in %s seconds' % (
- self._filename, timeout))
+ logger.warn('Could not lock %s in %s seconds',
+ self._filename, timeout)
if self._fh:
self._fh.close()
self._fh = open(self._filename, self._fallback_mode)
@@ -267,7 +272,7 @@
validate_file(self._filename)
try:
self._fh = open(self._filename, self._mode)
- except IOError, e:
+ except IOError as e:
# If we can't access with _mode, try _fallback_mode and don't lock.
if e.errno == errno.EACCES:
self._fh = open(self._filename, self._fallback_mode)
@@ -284,9 +289,9 @@
pywintypes.OVERLAPPED())
self._locked = True
return
- except pywintypes.error, e:
+ except pywintypes.error as e:
if timeout == 0:
- raise e
+ raise
# If the error is not that the file is already in use, raise.
if e[0] != _Win32Opener.FILE_IN_USE_ERROR:
@@ -308,7 +313,7 @@
try:
hfile = win32file._get_osfhandle(self._fh.fileno())
win32file.UnlockFileEx(hfile, 0, -0x10000, pywintypes.OVERLAPPED())
- except pywintypes.error, e:
+ except pywintypes.error as e:
if e[0] != _Win32Opener.FILE_ALREADY_UNLOCKED_ERROR:
raise
self._locked = False
@@ -370,4 +375,4 @@
def unlock_and_close(self):
"""Unlock and close a file."""
- self._opener.unlock_and_close()
+ self._opener.unlock_and_close()
\ No newline at end of file
diff --git a/third_party/oauth2client/multistore_file.py b/third_party/oauth2client/multistore_file.py
index ea89027..5008c00 100644
--- a/third_party/oauth2client/multistore_file.py
+++ b/third_party/oauth2client/multistore_file.py
@@ -1,4 +1,4 @@
-# Copyright 2011 Google Inc.
+# Copyright 2014 Google Inc. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@@ -19,39 +19,41 @@
both in a single process and across processes.
The credential themselves are keyed off of:
+
* client_id
* user_agent
* scope
-The format of the stored data is like so:
-{
- 'file_version': 1,
- 'data': [
- {
- 'key': {
- 'clientId': '<client id>',
- 'userAgent': '<user agent>',
- 'scope': '<scope>'
- },
- 'credential': {
- # JSON serialized Credentials.
+The format of the stored data is like so::
+
+ {
+ 'file_version': 1,
+ 'data': [
+ {
+ 'key': {
+ 'clientId': '<client id>',
+ 'userAgent': '<user agent>',
+ 'scope': '<scope>'
+ },
+ 'credential': {
+ # JSON serialized Credentials.
+ }
}
- }
- ]
-}
+ ]
+ }
+
"""
__author__ = 'jbeda@google.com (Joe Beda)'
-import base64
import errno
+import json
import logging
import os
import threading
-from anyjson import simplejson
-from .client import Storage as BaseStorage
from .client import Credentials
+from .client import Storage as BaseStorage
from . import util
from locked_file import LockedFile
@@ -64,12 +66,10 @@
class Error(Exception):
"""Base error for this module."""
- pass
class NewerCredentialStoreError(Error):
- """The credential store is a newer version that supported."""
- pass
+ """The credential store is a newer version than supported."""
@util.positional(4)
@@ -193,7 +193,7 @@
This will create the file if necessary.
"""
- self._file = LockedFile(filename, 'r+b', 'rb')
+ self._file = LockedFile(filename, 'r+', 'r')
self._thread_lock = threading.Lock()
self._read_only = False
self._warn_on_readonly = warn_on_readonly
@@ -271,7 +271,7 @@
simple version of "touch" to ensure the file has been created.
"""
if not os.path.exists(self._file.filename()):
- old_umask = os.umask(0177)
+ old_umask = os.umask(0o177)
try:
open(self._file.filename(), 'a+b').close()
finally:
@@ -280,13 +280,23 @@
def _lock(self):
"""Lock the entire multistore."""
self._thread_lock.acquire()
- self._file.open_and_lock()
+ try:
+ self._file.open_and_lock()
+ except IOError as e:
+ if e.errno == errno.ENOSYS:
+ logger.warn('File system does not support locking the credentials '
+ 'file.')
+ elif e.errno == errno.ENOLCK:
+ logger.warn('File system is out of resources for writing the '
+ 'credentials file (is your disk full?).')
+ else:
+ raise
if not self._file.is_locked():
self._read_only = True
if self._warn_on_readonly:
logger.warn('The credentials file (%s) is not writable. Opening in '
'read-only mode. Any refreshed credentials will only be '
- 'valid for this run.' % self._file.filename())
+ 'valid for this run.', self._file.filename())
if os.path.getsize(self._file.filename()) == 0:
logger.debug('Initializing empty multistore file')
# The multistore is empty so write out an empty file.
@@ -315,7 +325,7 @@
"""
assert self._thread_lock.locked()
self._file.file_handle().seek(0)
- return simplejson.load(self._file.file_handle())
+ return json.load(self._file.file_handle())
def _locked_json_write(self, data):
"""Write a JSON serializable data structure to the multistore.
@@ -329,7 +339,7 @@
if self._read_only:
return
self._file.file_handle().seek(0)
- simplejson.dump(data, self._file.file_handle(), sort_keys=True, indent=2)
+ json.dump(data, self._file.file_handle(), sort_keys=True, indent=2, separators=(',', ': '))
self._file.file_handle().truncate()
def _refresh_data_cache(self):
@@ -387,7 +397,7 @@
raw_key = cred_entry['key']
key = util.dict_to_tuple_key(raw_key)
credential = None
- credential = Credentials.new_from_json(simplejson.dumps(cred_entry['credential']))
+ credential = Credentials.new_from_json(json.dumps(cred_entry['credential']))
return (key, credential)
def _write(self):
@@ -400,7 +410,7 @@
raw_data['data'] = raw_creds
for (cred_key, cred) in self._data.items():
raw_key = dict(cred_key)
- raw_cred = simplejson.loads(cred.to_json())
+ raw_cred = json.loads(cred.to_json())
raw_creds.append({'key': raw_key, 'credential': raw_cred})
self._locked_json_write(raw_data)
@@ -462,4 +472,4 @@
Returns:
A Storage object that can be used to get/set this cred
"""
- return self._Storage(self, key)
+ return self._Storage(self, key)
\ No newline at end of file
diff --git a/third_party/oauth2client/old_run.py b/third_party/oauth2client/old_run.py
index da23358..221fff8 100644
--- a/third_party/oauth2client/old_run.py
+++ b/third_party/oauth2client/old_run.py
@@ -1,4 +1,4 @@
-# Copyright (C) 2013 Google Inc.
+# Copyright 2014 Google Inc. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@@ -15,6 +15,7 @@
"""This module holds the old run() function which is deprecated, the
tools.run_flow() function should be used in its place."""
+from __future__ import print_function
import logging
import socket
@@ -22,9 +23,9 @@
import webbrowser
import gflags
-
-from oauth2client import client
-from oauth2client import util
+from third_party.six.moves import input
+from third_party.oauth2client import client
+from third_party.oauth2client import util
from tools import ClientRedirectHandler
from tools import ClientRedirectServer
@@ -48,39 +49,38 @@
def run(flow, storage, http=None):
"""Core code for a command-line application.
- The run() function is called from your application and runs through all
- the steps to obtain credentials. It takes a Flow argument and attempts to
- open an authorization server page in the user's default web browser. The
- server asks the user to grant your application access to the user's data.
- If the user grants access, the run() function returns new credentials. The
- new credentials are also stored in the Storage argument, which updates the
- file associated with the Storage object.
+ The ``run()`` function is called from your application and runs
+ through all the steps to obtain credentials. It takes a ``Flow``
+ argument and attempts to open an authorization server page in the
+ user's default web browser. The server asks the user to grant your
+ application access to the user's data. If the user grants access,
+ the ``run()`` function returns new credentials. The new credentials
+ are also stored in the ``storage`` argument, which updates the file
+ associated with the ``Storage`` object.
It presumes it is run from a command-line application and supports the
following flags:
- --auth_host_name: Host name to use when running a local web server
- to handle redirects during OAuth authorization.
- (default: 'localhost')
+ ``--auth_host_name`` (string, default: ``localhost``)
+ Host name to use when running a local web server to handle
+ redirects during OAuth authorization.
- --auth_host_port: Port to use when running a local web server to handle
- redirects during OAuth authorization.;
- repeat this option to specify a list of values
- (default: '[8080, 8090]')
- (an integer)
+ ``--auth_host_port`` (integer, default: ``[8080, 8090]``)
+ Port to use when running a local web server to handle redirects
+ during OAuth authorization. Repeat this option to specify a list
+ of values.
- --[no]auth_local_webserver: Run a local web server to handle redirects
- during OAuth authorization.
- (default: 'true')
+ ``--[no]auth_local_webserver`` (boolean, default: ``True``)
+ Run a local web server to handle redirects during OAuth authorization.
- Since it uses flags make sure to initialize the gflags module before
- calling run().
+ Since it uses flags make sure to initialize the ``gflags`` module before
+ calling ``run()``.
Args:
flow: Flow, an OAuth 2.0 Flow to step through.
- storage: Storage, a Storage to store the credential in.
- http: An instance of httplib2.Http.request
- or something that acts like it.
+ storage: Storage, a ``Storage`` to store the credential in.
+ http: An instance of ``httplib2.Http.request`` or something that acts
+ like it.
Returns:
Credentials, the obtained credential.
@@ -96,20 +96,20 @@
try:
httpd = ClientRedirectServer((FLAGS.auth_host_name, port),
ClientRedirectHandler)
- except socket.error, e:
+ except socket.error as e:
pass
else:
success = True
break
FLAGS.auth_local_webserver = success
if not success:
- print 'Failed to start a local webserver listening on either port 8080'
- print 'or port 9090. Please check your firewall settings and locally'
- print 'running programs that may be blocking or using those ports.'
- print
- print 'Falling back to --noauth_local_webserver and continuing with',
- print 'authorization.'
- print
+ print('Failed to start a local webserver listening on either port 8080')
+ print('or port 9090. Please check your firewall settings and locally')
+ print('running programs that may be blocking or using those ports.')
+ print()
+ print('Falling back to --noauth_local_webserver and continuing with')
+ print('authorization.')
+ print()
if FLAGS.auth_local_webserver:
oauth_callback = 'http://%s:%s/' % (FLAGS.auth_host_name, port_number)
@@ -120,20 +120,20 @@
if FLAGS.auth_local_webserver:
webbrowser.open(authorize_url, new=1, autoraise=True)
- print 'Your browser has been opened to visit:'
- print
- print ' ' + authorize_url
- print
- print 'If your browser is on a different machine then exit and re-run'
- print 'this application with the command-line parameter '
- print
- print ' --noauth_local_webserver'
- print
+ print('Your browser has been opened to visit:')
+ print()
+ print(' ' + authorize_url)
+ print()
+ print('If your browser is on a different machine then exit and re-run')
+ print('this application with the command-line parameter ')
+ print()
+ print(' --noauth_local_webserver')
+ print()
else:
- print 'Go to the following link in your browser:'
- print
- print ' ' + authorize_url
- print
+ print('Go to the following link in your browser:')
+ print()
+ print(' ' + authorize_url)
+ print()
code = None
if FLAGS.auth_local_webserver:
@@ -143,18 +143,18 @@
if 'code' in httpd.query_params:
code = httpd.query_params['code']
else:
- print 'Failed to find "code" in the query parameters of the redirect.'
+ print('Failed to find "code" in the query parameters of the redirect.')
sys.exit('Try running with --noauth_local_webserver.')
else:
- code = raw_input('Enter verification code: ').strip()
+ code = input('Enter verification code: ').strip()
try:
credential = flow.step2_exchange(code, http=http)
- except client.FlowExchangeError, e:
+ except client.FlowExchangeError as e:
sys.exit('Authentication has failed: %s' % e)
storage.put(credential)
credential.set_store(storage)
- print 'Authentication successful.'
+ print('Authentication successful.')
- return credential
+ return credential
\ No newline at end of file
diff --git a/third_party/oauth2client/service_account.py b/third_party/oauth2client/service_account.py
new file mode 100644
index 0000000..b6b694c
--- /dev/null
+++ b/third_party/oauth2client/service_account.py
@@ -0,0 +1,139 @@
+# Copyright 2014 Google Inc. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""A service account credentials class.
+
+This credentials class is implemented on top of rsa library.
+"""
+
+import base64
+import json
+import time
+
+from pyasn1.codec.ber import decoder
+from pyasn1_modules.rfc5208 import PrivateKeyInfo
+import rsa
+
+from . import GOOGLE_REVOKE_URI
+from . import GOOGLE_TOKEN_URI
+from . import util
+from client import AssertionCredentials
+from third_party import six
+
+
+class _ServiceAccountCredentials(AssertionCredentials):
+ """Class representing a service account (signed JWT) credential."""
+
+ MAX_TOKEN_LIFETIME_SECS = 3600 # 1 hour in seconds
+
+ def __init__(self, service_account_id, service_account_email, private_key_id,
+ private_key_pkcs8_text, scopes, user_agent=None,
+ token_uri=GOOGLE_TOKEN_URI, revoke_uri=GOOGLE_REVOKE_URI,
+ **kwargs):
+
+ super(_ServiceAccountCredentials, self).__init__(
+ None, user_agent=user_agent, token_uri=token_uri, revoke_uri=revoke_uri)
+
+ self._service_account_id = service_account_id
+ self._service_account_email = service_account_email
+ self._private_key_id = private_key_id
+ self._private_key = _get_private_key(private_key_pkcs8_text)
+ self._private_key_pkcs8_text = private_key_pkcs8_text
+ self._scopes = util.scopes_to_string(scopes)
+ self._user_agent = user_agent
+ self._token_uri = token_uri
+ self._revoke_uri = revoke_uri
+ self._kwargs = kwargs
+
+ def _generate_assertion(self):
+ """Generate the assertion that will be used in the request."""
+
+ header = {
+ 'alg': 'RS256',
+ 'typ': 'JWT',
+ 'kid': self._private_key_id
+ }
+
+ now = int(time.time())
+ payload = {
+ 'aud': self._token_uri,
+ 'scope': self._scopes,
+ 'iat': now,
+ 'exp': now + _ServiceAccountCredentials.MAX_TOKEN_LIFETIME_SECS,
+ 'iss': self._service_account_email
+ }
+ payload.update(self._kwargs)
+
+ assertion_input = (_urlsafe_b64encode(header) + b'.' +
+ _urlsafe_b64encode(payload))
+
+ # Sign the assertion.
+ rsa_bytes = rsa.pkcs1.sign(assertion_input, self._private_key, 'SHA-256')
+ signature = base64.urlsafe_b64encode(rsa_bytes).rstrip(b'=')
+
+ return assertion_input + b'.' + signature
+
+ def sign_blob(self, blob):
+ # Ensure that it is bytes
+ try:
+ blob = blob.encode('utf-8')
+ except AttributeError:
+ pass
+ return (self._private_key_id,
+ rsa.pkcs1.sign(blob, self._private_key, 'SHA-256'))
+
+ @property
+ def service_account_email(self):
+ return self._service_account_email
+
+ @property
+ def serialization_data(self):
+ return {
+ 'type': 'service_account',
+ 'client_id': self._service_account_id,
+ 'client_email': self._service_account_email,
+ 'private_key_id': self._private_key_id,
+ 'private_key': self._private_key_pkcs8_text
+ }
+
+ def create_scoped_required(self):
+ return not self._scopes
+
+ def create_scoped(self, scopes):
+ return _ServiceAccountCredentials(self._service_account_id,
+ self._service_account_email,
+ self._private_key_id,
+ self._private_key_pkcs8_text,
+ scopes,
+ user_agent=self._user_agent,
+ token_uri=self._token_uri,
+ revoke_uri=self._revoke_uri,
+ **self._kwargs)
+
+
+def _urlsafe_b64encode(data):
+ return base64.urlsafe_b64encode(
+ json.dumps(data, separators=(',', ':')).encode('UTF-8')).rstrip(b'=')
+
+
+def _get_private_key(private_key_pkcs8_text):
+ """Get an RSA private key object from a pkcs8 representation."""
+
+ if not isinstance(private_key_pkcs8_text, six.binary_type):
+ private_key_pkcs8_text = private_key_pkcs8_text.encode('ascii')
+ der = rsa.pem.load_pem(private_key_pkcs8_text, 'PRIVATE KEY')
+ asn1_private_key, _ = decoder.decode(der, asn1Spec=PrivateKeyInfo())
+ return rsa.PrivateKey.load_pkcs1(
+ asn1_private_key.getComponentByName('privateKey').asOctets(),
+ format='DER')
\ No newline at end of file
diff --git a/third_party/oauth2client/tools.py b/third_party/oauth2client/tools.py
index 12c68bf..3df1bbe 100644
--- a/third_party/oauth2client/tools.py
+++ b/third_party/oauth2client/tools.py
@@ -1,4 +1,4 @@
-# Copyright (C) 2013 Google Inc.
+# Copyright 2014 Google Inc. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@@ -19,27 +19,22 @@
the same directory.
"""
+from __future__ import print_function
+
__author__ = 'jcgregorio@google.com (Joe Gregorio)'
__all__ = ['argparser', 'run_flow', 'run', 'message_if_missing']
-
-import BaseHTTPServer
-import argparse
-import httplib2
import logging
-import os
import socket
import sys
-import webbrowser
-from oauth2client import client
-from oauth2client import file
-from oauth2client import util
+from third_party.six.moves import BaseHTTPServer
+from third_party.six.moves import urllib
+from third_party.six.moves import input
-try:
- from urlparse import parse_qsl
-except ImportError:
- from cgi import parse_qsl
+from . import client
+from . import util
+
_CLIENT_SECRETS_MESSAGE = """WARNING: Please configure OAuth 2.0
@@ -52,20 +47,27 @@
"""
-# run_parser is an ArgumentParser that contains command-line options expected
+def _CreateArgumentParser():
+ try:
+ import argparse
+ except ImportError:
+ return None
+ parser = argparse.ArgumentParser(add_help=False)
+ parser.add_argument('--auth_host_name', default='localhost',
+ help='Hostname when running a local web server.')
+ parser.add_argument('--noauth_local_webserver', action='store_true',
+ default=False, help='Do not run a local web server.')
+ parser.add_argument('--auth_host_port', default=[8080, 8090], type=int,
+ nargs='*', help='Port web server should listen on.')
+ parser.add_argument('--logging_level', default='ERROR',
+ choices=['DEBUG', 'INFO', 'WARNING', 'ERROR', 'CRITICAL'],
+ help='Set the logging level of detail.')
+ return parser
+
+# argparser is an ArgumentParser that contains command-line options expected
# by tools.run(). Pass it in as part of the 'parents' argument to your own
# ArgumentParser.
-argparser = argparse.ArgumentParser(add_help=False)
-argparser.add_argument('--auth_host_name', default='localhost',
- help='Hostname when running a local web server.')
-argparser.add_argument('--noauth_local_webserver', action='store_true',
- default=False, help='Do not run a local web server.')
-argparser.add_argument('--auth_host_port', default=[8080, 8090], type=int,
- nargs='*', help='Port web server should listen on.')
-argparser.add_argument('--logging_level', default='ERROR',
- choices=['DEBUG', 'INFO', 'WARNING', 'ERROR',
- 'CRITICAL'],
- help='Set the logging level of detail.')
+argparser = _CreateArgumentParser()
class ClientRedirectServer(BaseHTTPServer.HTTPServer):
@@ -84,72 +86,75 @@
into the servers query_params and then stops serving.
"""
- def do_GET(s):
+ def do_GET(self):
"""Handle a GET request.
Parses the query parameters and prints a message
if the flow has completed. Note that we can't detect
if an error occurred.
"""
- s.send_response(200)
- s.send_header("Content-type", "text/html")
- s.end_headers()
- query = s.path.split('?', 1)[-1]
- query = dict(parse_qsl(query))
- s.server.query_params = query
- s.wfile.write("<html><head><title>Authentication Status</title></head>")
- s.wfile.write("<body><p>The authentication flow has completed.</p>")
- s.wfile.write("</body></html>")
+ self.send_response(200)
+ self.send_header("Content-type", "text/html")
+ self.end_headers()
+ query = self.path.split('?', 1)[-1]
+ query = dict(urllib.parse.parse_qsl(query))
+ self.server.query_params = query
+ self.wfile.write(b"<html><head><title>Authentication Status</title></head>")
+ self.wfile.write(b"<body><p>The authentication flow has completed.</p>")
+ self.wfile.write(b"</body></html>")
def log_message(self, format, *args):
"""Do not log messages to stdout while running as command line program."""
- pass
@util.positional(3)
def run_flow(flow, storage, flags, http=None):
"""Core code for a command-line application.
- The run() function is called from your application and runs through all the
- steps to obtain credentials. It takes a Flow argument and attempts to open an
- authorization server page in the user's default web browser. The server asks
- the user to grant your application access to the user's data. If the user
- grants access, the run() function returns new credentials. The new credentials
- are also stored in the Storage argument, which updates the file associated
- with the Storage object.
+ The ``run()`` function is called from your application and runs
+ through all the steps to obtain credentials. It takes a ``Flow``
+ argument and attempts to open an authorization server page in the
+ user's default web browser. The server asks the user to grant your
+ application access to the user's data. If the user grants access,
+ the ``run()`` function returns new credentials. The new credentials
+ are also stored in the ``storage`` argument, which updates the file
+ associated with the ``Storage`` object.
It presumes it is run from a command-line application and supports the
following flags:
- --auth_host_name: Host name to use when running a local web server
- to handle redirects during OAuth authorization.
- (default: 'localhost')
+ ``--auth_host_name`` (string, default: ``localhost``)
+ Host name to use when running a local web server to handle
+ redirects during OAuth authorization.
- --auth_host_port: Port to use when running a local web server to handle
- redirects during OAuth authorization.;
- repeat this option to specify a list of values
- (default: '[8080, 8090]')
- (an integer)
+ ``--auth_host_port`` (integer, default: ``[8080, 8090]``)
+ Port to use when running a local web server to handle redirects
+ during OAuth authorization. Repeat this option to specify a list
+ of values.
- --[no]auth_local_webserver: Run a local web server to handle redirects
- during OAuth authorization.
- (default: 'true')
+ ``--[no]auth_local_webserver`` (boolean, default: ``True``)
+ Run a local web server to handle redirects during OAuth authorization.
- The tools module defines an ArgumentParser the already contains the flag
- definitions that run() requires. You can pass that ArgumentParser to your
- ArgumentParser constructor:
- parser = argparse.ArgumentParser(description=__doc__,
- formatter_class=argparse.RawDescriptionHelpFormatter,
- parents=[tools.run_parser])
- flags = parser.parse_args(argv)
+
+
+ The tools module defines an ``ArgumentParser`` the already contains the flag
+ definitions that ``run()`` requires. You can pass that ``ArgumentParser`` to your
+ ``ArgumentParser`` constructor::
+
+ parser = argparse.ArgumentParser(description=__doc__,
+ formatter_class=argparse.RawDescriptionHelpFormatter,
+ parents=[tools.argparser])
+ flags = parser.parse_args(argv)
Args:
flow: Flow, an OAuth 2.0 Flow to step through.
- storage: Storage, a Storage to store the credential in.
- flags: argparse.ArgumentParser, the command-line flags.
- http: An instance of httplib2.Http.request
- or something that acts like it.
+ storage: Storage, a ``Storage`` to store the credential in.
+ flags: ``argparse.Namespace``, The command-line flags. This is the
+ object returned from calling ``parse_args()`` on
+ ``argparse.ArgumentParser`` as described above.
+ http: An instance of ``httplib2.Http.request`` or something that
+ acts like it.
Returns:
Credentials, the obtained credential.
@@ -163,20 +168,20 @@
try:
httpd = ClientRedirectServer((flags.auth_host_name, port),
ClientRedirectHandler)
- except socket.error, e:
+ except socket.error:
pass
else:
success = True
break
flags.noauth_local_webserver = not success
if not success:
- print 'Failed to start a local webserver listening on either port 8080'
- print 'or port 9090. Please check your firewall settings and locally'
- print 'running programs that may be blocking or using those ports.'
- print
- print 'Falling back to --noauth_local_webserver and continuing with',
- print 'authorization.'
- print
+ print('Failed to start a local webserver listening on either port 8080')
+ print('or port 9090. Please check your firewall settings and locally')
+ print('running programs that may be blocking or using those ports.')
+ print()
+ print('Falling back to --noauth_local_webserver and continuing with')
+ print('authorization.')
+ print()
if not flags.noauth_local_webserver:
oauth_callback = 'http://%s:%s/' % (flags.auth_host_name, port_number)
@@ -186,21 +191,22 @@
authorize_url = flow.step1_get_authorize_url()
if not flags.noauth_local_webserver:
+ import webbrowser
webbrowser.open(authorize_url, new=1, autoraise=True)
- print 'Your browser has been opened to visit:'
- print
- print ' ' + authorize_url
- print
- print 'If your browser is on a different machine then exit and re-run this'
- print 'application with the command-line parameter '
- print
- print ' --noauth_local_webserver'
- print
+ print('Your browser has been opened to visit:')
+ print()
+ print(' ' + authorize_url)
+ print()
+ print('If your browser is on a different machine then exit and re-run this')
+ print('application with the command-line parameter ')
+ print()
+ print(' --noauth_local_webserver')
+ print()
else:
- print 'Go to the following link in your browser:'
- print
- print ' ' + authorize_url
- print
+ print('Go to the following link in your browser:')
+ print()
+ print(' ' + authorize_url)
+ print()
code = None
if not flags.noauth_local_webserver:
@@ -210,19 +216,19 @@
if 'code' in httpd.query_params:
code = httpd.query_params['code']
else:
- print 'Failed to find "code" in the query parameters of the redirect.'
+ print('Failed to find "code" in the query parameters of the redirect.')
sys.exit('Try running with --noauth_local_webserver.')
else:
- code = raw_input('Enter verification code: ').strip()
+ code = input('Enter verification code: ').strip()
try:
credential = flow.step2_exchange(code, http=http)
- except client.FlowExchangeError, e:
+ except client.FlowExchangeError as e:
sys.exit('Authentication has failed: %s' % e)
storage.put(credential)
credential.set_store(storage)
- print 'Authentication successful.'
+ print('Authentication successful.')
return credential
@@ -233,11 +239,11 @@
return _CLIENT_SECRETS_MESSAGE % filename
try:
- from old_run import run
- from old_run import FLAGS
+ from oauth2client.old_run import run
+ from oauth2client.old_run import FLAGS
except ImportError:
def run(*args, **kwargs):
raise NotImplementedError(
'The gflags library must be installed to use tools.run(). '
'Please install gflags or preferrably switch to using '
- 'tools.run_flow().')
+ 'tools.run_flow().')
\ No newline at end of file
diff --git a/third_party/oauth2client/util.py b/third_party/oauth2client/util.py
index 90dff15..b0963ef 100644
--- a/third_party/oauth2client/util.py
+++ b/third_party/oauth2client/util.py
@@ -1,6 +1,6 @@
#!/usr/bin/env python
#
-# Copyright 2010 Google Inc.
+# Copyright 2014 Google Inc. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@@ -17,26 +17,27 @@
"""Common utility library."""
-__author__ = ['rafek@google.com (Rafe Kaplan)',
- 'guido@google.com (Guido van Rossum)',
-]
-__all__ = [
- 'positional',
- 'POSITIONAL_WARNING',
- 'POSITIONAL_EXCEPTION',
- 'POSITIONAL_IGNORE',
+__author__ = [
+ 'rafek@google.com (Rafe Kaplan)',
+ 'guido@google.com (Guido van Rossum)',
]
+__all__ = [
+ 'positional',
+ 'POSITIONAL_WARNING',
+ 'POSITIONAL_EXCEPTION',
+ 'POSITIONAL_IGNORE',
+]
+
+import functools
import inspect
import logging
+import sys
import types
-import urllib
-import urlparse
-try:
- from urlparse import parse_qsl
-except ImportError:
- from cgi import parse_qsl
+from third_party import six
+from third_party.six.moves import urllib
+
logger = logging.getLogger(__name__)
@@ -51,56 +52,58 @@
def positional(max_positional_args):
"""A decorator to declare that only the first N arguments my be positional.
- This decorator makes it easy to support Python 3 style key-word only
- parameters. For example, in Python 3 it is possible to write:
+ This decorator makes it easy to support Python 3 style keyword-only
+ parameters. For example, in Python 3 it is possible to write::
def fn(pos1, *, kwonly1=None, kwonly1=None):
...
- All named parameters after * must be a keyword:
+ All named parameters after ``*`` must be a keyword::
fn(10, 'kw1', 'kw2') # Raises exception.
fn(10, kwonly1='kw1') # Ok.
- Example:
- To define a function like above, do:
+ Example
+ ^^^^^^^
- @positional(1)
- def fn(pos1, kwonly1=None, kwonly2=None):
+ To define a function like above, do::
+
+ @positional(1)
+ def fn(pos1, kwonly1=None, kwonly2=None):
+ ...
+
+ If no default value is provided to a keyword argument, it becomes a required
+ keyword argument::
+
+ @positional(0)
+ def fn(required_kw):
+ ...
+
+ This must be called with the keyword parameter::
+
+ fn() # Raises exception.
+ fn(10) # Raises exception.
+ fn(required_kw=10) # Ok.
+
+ When defining instance or class methods always remember to account for
+ ``self`` and ``cls``::
+
+ class MyClass(object):
+
+ @positional(2)
+ def my_method(self, pos1, kwonly1=None):
...
- If no default value is provided to a keyword argument, it becomes a required
- keyword argument:
-
- @positional(0)
- def fn(required_kw):
+ @classmethod
+ @positional(2)
+ def my_method(cls, pos1, kwonly1=None):
...
- This must be called with the keyword parameter:
-
- fn() # Raises exception.
- fn(10) # Raises exception.
- fn(required_kw=10) # Ok.
-
- When defining instance or class methods always remember to account for
- 'self' and 'cls':
-
- class MyClass(object):
-
- @positional(2)
- def my_method(self, pos1, kwonly1=None):
- ...
-
- @classmethod
- @positional(2)
- def my_method(cls, pos1, kwonly1=None):
- ...
-
The positional decorator behavior is controlled by
- util.positional_parameters_enforcement, which may be set to
- POSITIONAL_EXCEPTION, POSITIONAL_WARNING or POSITIONAL_IGNORE to raise an
- exception, log a warning, or do nothing, respectively, if a declaration is
- violated.
+ ``util.positional_parameters_enforcement``, which may be set to
+ ``POSITIONAL_EXCEPTION``, ``POSITIONAL_WARNING`` or
+ ``POSITIONAL_IGNORE`` to raise an exception, log a warning, or do
+ nothing, respectively, if a declaration is violated.
Args:
max_positional_arguments: Maximum number of positional arguments. All
@@ -114,8 +117,10 @@
TypeError if a key-word only argument is provided as a positional
parameter, but only if util.positional_parameters_enforcement is set to
POSITIONAL_EXCEPTION.
+
"""
def positional_decorator(wrapped):
+ @functools.wraps(wrapped)
def positional_wrapper(*args, **kwargs):
if len(args) > max_positional_args:
plural_s = ''
@@ -132,7 +137,7 @@
return wrapped(*args, **kwargs)
return positional_wrapper
- if isinstance(max_positional_args, (int, long)):
+ if isinstance(max_positional_args, six.integer_types):
return positional_decorator
else:
args, _, _, defaults = inspect.getargspec(max_positional_args)
@@ -152,7 +157,7 @@
Returns:
The scopes formatted as a single string.
"""
- if isinstance(scopes, types.StringTypes):
+ if isinstance(scopes, six.string_types):
return scopes
else:
return ' '.join(scopes)
@@ -189,8 +194,8 @@
if value is None:
return url
else:
- parsed = list(urlparse.urlparse(url))
- q = dict(parse_qsl(parsed[4]))
+ parsed = list(urllib.parse.urlparse(url))
+ q = dict(urllib.parse.parse_qsl(parsed[4]))
q[name] = value
- parsed[4] = urllib.urlencode(q)
- return urlparse.urlunparse(parsed)
+ parsed[4] = urllib.parse.urlencode(q)
+ return urllib.parse.urlunparse(parsed)
\ No newline at end of file
diff --git a/third_party/oauth2client/xsrfutil.py b/third_party/oauth2client/xsrfutil.py
index 7e1fe5c..bea7c87 100644
--- a/third_party/oauth2client/xsrfutil.py
+++ b/third_party/oauth2client/xsrfutil.py
@@ -1,6 +1,5 @@
-#!/usr/bin/python2.5
#
-# Copyright 2010 the Melange authors.
+# Copyright 2014 the Melange authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@@ -17,25 +16,36 @@
"""Helper methods for creating & verifying XSRF tokens."""
__authors__ = [
- '"Doug Coker" <dcoker@google.com>',
- '"Joe Gregorio" <jcgregorio@google.com>',
+ '"Doug Coker" <dcoker@google.com>',
+ '"Joe Gregorio" <jcgregorio@google.com>',
]
import base64
import hmac
-import os # for urandom
import time
+import six
from oauth2client import util
# Delimiter character
-DELIMITER = ':'
+DELIMITER = b':'
+
# 1 hour in seconds
DEFAULT_TIMEOUT_SECS = 1*60*60
+
+def _force_bytes(s):
+ if isinstance(s, bytes):
+ return s
+ s = str(s)
+ if isinstance(s, six.text_type):
+ return s.encode('utf-8')
+ return s
+
+
@util.positional(2)
def generate_token(key, user_id, action_id="", when=None):
"""Generates a URL-safe token for the given user, action, time tuple.
@@ -51,18 +61,16 @@
Returns:
A string XSRF protection token.
"""
- when = when or int(time.time())
- digester = hmac.new(key)
- digester.update(str(user_id))
+ when = _force_bytes(when or int(time.time()))
+ digester = hmac.new(_force_bytes(key))
+ digester.update(_force_bytes(user_id))
digester.update(DELIMITER)
- digester.update(action_id)
+ digester.update(_force_bytes(action_id))
digester.update(DELIMITER)
- digester.update(str(when))
+ digester.update(when)
digest = digester.digest()
- token = base64.urlsafe_b64encode('%s%s%d' % (digest,
- DELIMITER,
- when))
+ token = base64.urlsafe_b64encode(digest + DELIMITER + when)
return token
@@ -87,8 +95,8 @@
if not token:
return False
try:
- decoded = base64.urlsafe_b64decode(str(token))
- token_time = long(decoded.split(DELIMITER)[-1])
+ decoded = base64.urlsafe_b64decode(token)
+ token_time = int(decoded.split(DELIMITER)[-1])
except (TypeError, ValueError):
return False
if current_time is None:
@@ -105,9 +113,6 @@
# Perform constant time comparison to avoid timing attacks
different = 0
- for x, y in zip(token, expected_token):
- different |= ord(x) ^ ord(y)
- if different:
- return False
-
- return True
+ for x, y in zip(bytearray(token), bytearray(expected_token)):
+ different |= x ^ y
+ return not different
\ No newline at end of file
