Almost all tests working for GoogleAuth

Author: bshaffer

UPGRADING.md

@@ -305,8 +305,6 @@ A trait is a better fit as it's a utility class.
    <td><code>Credentials\GCECredentials</code>
 <p>
    => <code>Credentials\ComputeCredentials</code>
-<p>
-   => <code>Credentials\MetadataCredentials</code>
    </td>
    <td>"Compute" represents a suite of products (App Engine, Compute Engine, Cloud Functions, Cloud Run) which all have a metadata server, and so use these credentials.
 <p>
@@ -637,6 +635,18 @@ Proper caching should make this unnecessary
 Proper caching should make this unnecessary
    </td>
   </tr>
+  <tr>
+  <td><code>GCECredentials</code>
+<p>
+<code>:: getTokenUri</code>
+<p>
+<code>:: getClientNameUri</code>
+   </td>
+   <td><strong>not needed</strong>
+<p>
+The URIs used to call the metadata server is implementation detail, and does not need to be public
+   </td>
+  </tr>
   <tr>
    <td><code>SignBlobInterface</code>
 <p>

src/Auth/Credentials/ComputeCredentials.php

@@ -89,21 +89,6 @@ class ComputeCredentials implements
      */
     private const FLAVOR_HEADER = 'Metadata-Flavor';
 
-    /**
-     * Flag used to ensure that the onGCE test is only done once;.
-     *
-     * @var bool
-     */
-    private $hasCheckedOnGce = false;
-
-    /**
-     * Flag that stores the value of the onGCE check.
-     *
-     * @var bool
-     */
-    private $isOnGce = false;
-
-
     /**
      * @var string|null
      */
@@ -168,15 +153,7 @@ public function __construct(array $options = [])
             );
         }
 
-        $tokenUri = self::getTokenUri($options['serviceAccountIdentity']);
-        if ($options['scope']) {
-            if (is_string($options['scope'])) {
-                $options['scope'] = explode(' ', $options['scope']);
-            }
-
-            $options['scope'] = implode(',', $options['scope']);
-            $tokenUri = $tokenUri . '?scopes='. $options['scope'];
-        } elseif ($options['targetAudience']) {
+        if ($options['targetAudience']) {
             $tokenUri = self::getIdTokenUri($options['serviceAccountIdentity']);
             $tokenUri = sprintf(
                 'http://%s/computeMetadata/%s?audience=%s',
@@ -185,6 +162,16 @@ public function __construct(array $options = [])
                 $options['targetAudience']
             );
             $this->targetAudience = $options['targetAudience'];
+        } else {
+            $tokenUri = self::getAccessTokenUri($options['serviceAccountIdentity']);
+            if ($options['scope']) {
+                if (is_string($options['scope'])) {
+                    $options['scope'] = explode(' ', $options['scope']);
+                }
+
+                $options['scope'] = implode(',', $options['scope']);
+                $tokenUri = $tokenUri . '?scopes='. $options['scope'];
+            }
         }
 
         $this->tokenUri = $tokenUri;
@@ -202,7 +189,7 @@ public function __construct(array $options = [])
      * @return string
      */
 
-    public static function getTokenUri(
+    private static function getAccessTokenUri(
         string $serviceAccountIdentity = null
     ): string {
         $base = 'http://' . self::METADATA_IP . '/computeMetadata/';
@@ -301,10 +288,6 @@ public static function onCompute(ClientInterface $httpClient): bool
      */
     public function fetchAuthToken(): array
     {
-        if (!$this->isOnGce($this->httpClient)) {
-            return [];  // return an empty array with no access token
-        }
-
         $response = $this->getFromMetadata($this->tokenUri);
 
         if ($this->targetAudience) {
@@ -336,10 +319,6 @@ public function getClientEmail(): string
             return $this->clientEmail;
         }
 
-        if (!$this->isOnGce($this->httpClient)) {
-            return '';
-        }
-
         return $this->clientEmail = $this->getFromMetadata(
             self::getClientEmailUri($this->serviceAccountIdentity)
         );
@@ -380,10 +359,6 @@ public function getProjectId(): ?string
             return $this->projectId;
         }
 
-        if (!$this->isOnGce($this->httpClient)) {
-            return null;
-        }
-
         return $this->projectId = $this->getFromMetadata(
             self::getProjectIdUri()
         );
@@ -399,16 +374,6 @@ public function getQuotaProject(): ?string
         return $this->quotaProject;
     }
 
-    private function isOnGce(): bool
-    {
-        if (!$this->hasCheckedOnGce) {
-            $this->isOnGce = self::onGce($this->httpClient);
-            $this->hasCheckedOnGce = true;
-        }
-
-        return $this->isOnGce;
-    }
-
     /**
      * Fetch the value of a GCE metadata server URI.
      *
@@ -417,8 +382,7 @@ private function isOnGce(): bool
      */
     private function getFromMetadata($uri)
     {
-        $httpClient = $this->httpClient;
-        $resp = $httpClient(
+        $resp = $this->httpClient->send(
             new Request(
                 'GET',
                 $uri,

src/Auth/Credentials/ServiceAccountCredentials.php

@@ -62,7 +62,9 @@ class ServiceAccountCredentials implements
     CredentialsInterface,
     SignBlobInterface
 {
-    use CredentialsTrait;
+    use CredentialsTrait {
+        CredentialsTrait::getRequestMetadata as traitGetRequestMetadata;
+    }
     use PrivateKeySignBlobTrait;
     use ServiceAccountApiSignBlobTrait;
 
@@ -170,11 +172,7 @@ public function __construct($jsonKey, array $options = [])
      */
     public function fetchAuthToken(): array
     {
-        // If self-signed JWTs are being used, fetch the last received token
-        // from memory. Else, fetch it from OAuth2
-        return $this->useSelfSignedJwt()
-            ? $this->lastReceivedJwtAccessToken
-            : $this->oauth2->getLastReceivedToken();
+        return $this->oauth2->fetchAuthToken();
     }
 
     /**
@@ -190,31 +188,27 @@ public function getProjectId(): ?string
     }
 
     /**
-     * Updates metadata with the authorization token.
+     * Returns request metadata with the authorization token.
      *
-     * @param array $metadata metadata hashmap
-     * @param string $authUri optional auth uri
      * @param callable $httpHandler callback which delivers psr7 request
-     * @return array updated metadata hashmap
+     * @return array metadata hashmap for request headers
      */
-    public function updateMetadata(
-        $metadata,
-        $authUri = null,
-        callable $httpHandler = null
-    ) {
+    public function getRequestMetadata(
+        ClientInterface $httpHandler = null
+    ): array {
         // scope exists. use oauth implementation
         if (!$this->useSelfSignedJwt()) {
-            return parent::updateMetadata($metadata, $authUri, $httpHandler);
+            return $this->traitGetRequestMetadata($httpHandler);
         }
 
         // no scope found. create jwt with the auth uri
         $credJson = array(
-            'private_key' => $this->auth->getSigningKey(),
-            'client_email' => $this->auth->getIssuer(),
+            'private_key' => $this->oauth2->getSigningKey(),
+            'client_email' => $this->oauth2->getIssuer(),
         );
         $jwtCreds = new ServiceAccountJwtAccessCredentials($credJson);
 
-        $updatedMetadata = $jwtCreds->updateMetadata($metadata, $authUri, $httpHandler);
+        $updatedMetadata = $jwtCreds->getRequestMetadata($httpHandler);
 
         if ($lastReceivedToken = $jwtCreds->getLastReceivedToken()) {
             // Keep self-signed JWTs in memory as the last received token
@@ -230,7 +224,7 @@ public function updateMetadata(
      */
     public function setSub($sub)
     {
-        $this->auth->setSub($sub);
+        $this->oauth2->setSub($sub);
     }
 
     /**
@@ -274,7 +268,7 @@ public function getClientEmail(): string
 
     private function useSelfSignedJwt()
     {
-        return is_null($this->auth->getScope());
+        return is_null($this->oauth2->getScope());
     }
 
     /**

src/Auth/GoogleAuth.php

@@ -24,11 +24,13 @@
 use Google\Auth\Credentials\ServiceAccountCredentials;
 use Google\Auth\Credentials\ServiceAccountJwtAccessCredentials;
 use Google\Auth\Credentials\CredentialsInterface;
+use Google\Auth\Credentials\UserRefreshCredentials;
 use Google\Auth\Http\ClientFactory;
 use Google\Cache\MemoryCacheItemPool;
 use GuzzleHttp\Psr7\Request;
 use InvalidArgumentException;
 use Psr\Cache\CacheItemPoolInterface;
+use RuntimeException;
 
 /**
  * GoogleAuth obtains the default credentials for
@@ -110,10 +112,9 @@ public function __construct(array $options = [])
             'cacheLifetime' => 1500,
             'cachePrefix' => '',
         ];
-
         $this->httpClient = $options['httpClient'] ?: ClientFactory::build();
         $this->cache = $options['cache'] ?: new MemoryCacheItemPool();
-        $this->cacheLifetme = $options['cacheLifetime'];
+        $this->cacheLifetime = $options['cacheLifetime'];
         $this->cachePrefix = $options['cachePrefix'];
     }
 
@@ -131,8 +132,11 @@ public function __construct(array $options = [])
      *      @type string $targetAudience The audience for the ID token.
      *      @type string $audience
      *      @type string $quotaProject specifies a project to bill for access
-     *        charges associated with the request.
+     *             charges associated with the request.
      *      @type string $subject
+     *      @type string|array $defaultScope The default scope to use if no
+     *             user-defined scopes exist, expressed either as an Array or as
+     *             a space-delimited string.
      * }
      * @return CredentialsInterface
      * @throws DomainException if no implementation can be obtained.
@@ -146,7 +150,9 @@ public function makeCredentials(array $options = []): CredentialsInterface
             'quotaProject' => null,
             'subject' => null,
             'credentialsFile' => null,
+            'defaultScope' => null,
         ];
+        $anyScope = $options['scope'] ?: $options['defaultScope'];
         if (is_null($options['credentialsFile'])) {
             $jsonKey = $this->fromEnv() ?: $this->fromWellKnownFile();
         } else {
@@ -165,7 +171,7 @@ public function makeCredentials(array $options = []): CredentialsInterface
 
             // Set quota project on jsonKey if passed in
             if (isset($options['quotaProject'])) {
-                $jsonKey['quota_project'] = $options['quotaProject'];
+                $jsonKey['quota_project_id'] = $options['quotaProject'];
             }
 
             switch ($jsonKey['type']) {
@@ -194,7 +200,8 @@ public function makeCredentials(array $options = []): CredentialsInterface
                         );
                     }
                     $creds = new UserRefreshCredentials($jsonKey, [
-                        'scope' => $options['scope'],
+                        'scope' => $anyScope,
+                        'httpClient' => $this->httpClient,
                     ]);
                     break;
                 default:
@@ -204,9 +211,10 @@ public function makeCredentials(array $options = []): CredentialsInterface
             }
         } elseif ($this->onCompute()) {
             $creds = new ComputeCredentials([
-                'scope' => $options['scope'],
+                'scope' => $anyScope,
                 'quotaProject' => $options['quotaProject'],
                 'httpClient' => $this->httpClient,
+                'targetAudience' => $options['targetAudience'],
             ]);
         }
 
@@ -229,14 +237,15 @@ public function makeCredentials(array $options = []): CredentialsInterface
      */
     public function onCompute(): bool
     {
-        $cacheItem = $this->cache->getItem(self::ON_COMPUTE_CACHE_KEY);
+        $cacheItem = $this->cache->getItem(
+            $this->cachePrefix . self::ON_COMPUTE_CACHE_KEY
+        );
 
         if ($cacheItem->isHit()) {
             return $cacheItem->get();
         }
 
         $onCompute = ComputeCredentials::onCompute($this->httpClient);
-
         $cacheItem->set($onCompute);
         $cacheItem->expiresAfter($this->cacheLifetime);
         $this->cache->save($cacheItem);
@@ -283,13 +292,13 @@ private function getCerts(string $location, string $cacheKey): array {
 
         $gotNewCerts = false;
         if (!$certs) {
-            $certs = $this->retrieveCertsFromLocation($location, $options);
+            $certs = $this->retrieveCertsFromLocation($location);
 
             $gotNewCerts = true;
         }
 
         if (!isset($certs['keys'])) {
-            if ($location !== self::IAP_CERT_URL) {
+            if ($location !== self::IAP_JWK_URI) {
                 throw new InvalidArgumentException(
                     'federated sign-on certs expects "keys" to be set'
                 );
@@ -353,7 +362,7 @@ private function retrieveCertsFromLocation(string $url): array
      */
     private function getCacheKeyFromCertLocation($certsLocation)
     {
-        $key = $certsLocation === self::FEDERATED_SIGNON_CERT_URL
+        $key = $certsLocation === self::OIDC_CERT_URI
             ? 'federated_signon_certs_v3'
             : sha1($certsLocation);