V3 decommission storage oauth2

google/cloud/internal/curl_rest_client.cc

@@ -112,7 +112,10 @@ CurlRestClient::CurlRestClient(std::string endpoint_address,
     : endpoint_address_(std::move(endpoint_address)),
       handle_factory_(std::move(factory)),
       options_(std::move(options)) {
+  std::cout << __PRETTY_FUNCTION__ << std::endl;
   if (options_.has<UnifiedCredentialsOption>()) {
+    std::cout << __PRETTY_FUNCTION__ << ": has UnifiedCredentialsOption"
+              << std::endl;
     credentials_ = MapCredentials(*options_.get<UnifiedCredentialsOption>());
   }
 }
@@ -124,6 +127,7 @@ StatusOr<std::unique_ptr<CurlImpl>> CurlRestClient::CreateCurlImpl(
   auto impl =
       std::make_unique<CurlImpl>(std::move(handle), handle_factory_, options);
   if (credentials_) {
+    std::cout << __PRETTY_FUNCTION__ << ": has credentials_" << std::endl;
     auto auth_header =
         credentials_->AuthenticationHeader(std::chrono::system_clock::now());
     if (!auth_header.ok()) return std::move(auth_header).status();

google/cloud/internal/oauth2_access_token_credentials.cc

@@ -21,7 +21,9 @@ GOOGLE_CLOUD_CPP_INLINE_NAMESPACE_BEGIN
 
 AccessTokenCredentials::AccessTokenCredentials(
     google::cloud::AccessToken access_token)
-    : access_token_(std::move(access_token)) {}
+    : access_token_(std::move(access_token)) {
+  std::cout << __PRETTY_FUNCTION__ << std::endl;
+}
 
 StatusOr<AccessToken> AccessTokenCredentials::GetToken(
     std::chrono::system_clock::time_point /*tp*/) {

google/cloud/internal/oauth2_authorized_user_credentials.cc

@@ -92,10 +92,13 @@ AuthorizedUserCredentials::AuthorizedUserCredentials(
     HttpClientFactory client_factory)
     : info_(std::move(info)),
       options_(std::move(options)),
-      client_factory_(std::move(client_factory)) {}
+      client_factory_(std::move(client_factory)) {
+  std::cout << __PRETTY_FUNCTION__ << std::endl;
+}
 
 StatusOr<AccessToken> AuthorizedUserCredentials::GetToken(
     std::chrono::system_clock::time_point tp) {
+  std::cout << __PRETTY_FUNCTION__ << std::endl;
   rest_internal::RestRequest request;
   request.SetPath(info_.token_uri);
   request.AddHeader("content-type", "application/x-www-form-urlencoded");

google/cloud/internal/oauth2_cached_credentials.cc

@@ -41,6 +41,7 @@ CachedCredentials::~CachedCredentials() = default;
 StatusOr<AccessToken> CachedCredentials::GetToken(
     std::chrono::system_clock::time_point now) {
   std::lock_guard<std::mutex> lk(mu_);
+  std::cout << __PRETTY_FUNCTION__ << std::endl;
   if (!ExpiringSoon(token_, now)) return token_;
   auto refreshed = impl_->GetToken(now);
   if (!refreshed) {

google/cloud/internal/oauth2_compute_engine_credentials.cc

@@ -194,7 +194,9 @@ ComputeEngineCredentials::ComputeEngineCredentials(
     HttpClientFactory client_factory)
     : options_(std::move(options)),
       client_factory_(std::move(client_factory)),
-      service_account_email_(std::move(service_account_email)) {}
+      service_account_email_(std::move(service_account_email)) {
+  std::cout << __PRETTY_FUNCTION__ << std::endl;
+}
 
 StatusOr<AccessToken> ComputeEngineCredentials::GetToken(
     std::chrono::system_clock::time_point tp) {

google/cloud/internal/oauth2_credentials.cc

@@ -48,6 +48,7 @@ StatusOr<std::string> Credentials::project_id(
 
 StatusOr<std::pair<std::string, std::string>> Credentials::AuthenticationHeader(
     std::chrono::system_clock::time_point tp) {
+  std::cout << __PRETTY_FUNCTION__ << std::endl;
   auto token = GetToken(tp);
   if (!token) return std::move(token).status();
   if (token->token.empty()) return std::make_pair(std::string{}, std::string{});

google/cloud/internal/oauth2_logging_credentials.cc

@@ -33,6 +33,7 @@ LoggingCredentials::~LoggingCredentials() = default;
 
 StatusOr<AccessToken> LoggingCredentials::GetToken(
     std::chrono::system_clock::time_point now) {
+  std::cout << __PRETTY_FUNCTION__ << std::endl;
   auto token = impl_->GetToken(now);
   if (!token) {
     GCP_LOG(DEBUG) << __func__ << "(" << phase_ << ") failed "

google/cloud/internal/oauth2_service_account_credentials.cc

@@ -248,10 +248,13 @@ ServiceAccountCredentials::ServiceAccountCredentials(
           std::move(options),
           Options{}.set<ServiceAccountCredentialsTokenUriOption>(
               info_.token_uri))),
-      client_factory_(std::move(client_factory)) {}
+      client_factory_(std::move(client_factory)) {
+  std::cout << __PRETTY_FUNCTION__ << std::endl;
+}
 
 StatusOr<AccessToken> ServiceAccountCredentials::GetToken(
     std::chrono::system_clock::time_point tp) {
+  std::cout << __PRETTY_FUNCTION__ << std::endl;
   if (UseOAuth()) return GetTokenOAuth(tp);
   return GetTokenSelfSigned(tp);
 }

google/cloud/storage/benchmarks/throughput_experiment.cc

@@ -16,6 +16,7 @@
 #include "google/cloud/storage/benchmarks/benchmark_utils.h"
 #include "google/cloud/storage/client.h"
 #include "google/cloud/internal/make_status.h"
+#include "google/cloud/internal/unified_rest_credentials.h"
 #if GOOGLE_CLOUD_CPP_STORAGE_HAVE_GRPC
 #include "google/cloud/storage/internal/grpc/ctype_cord_workaround.h"
 #include "google/cloud/grpc_error_delegate.h"
@@ -260,8 +261,9 @@ class DownloadObjectLibcurl : public ThroughputExperiment {
       : endpoint_(options.rest_options.get<gcs::RestEndpointOption>()),
         target_api_version_path_(
             options.rest_options.get<gcs::internal::TargetApiVersionOption>()),
-        creds_(google::cloud::storage::oauth2::GoogleDefaultCredentials()
-                   .value()) {
+        // creds_(google::cloud::storage::oauth2::GoogleDefaultCredentials()
+        //            .value()) {
+        creds_(rest_internal::MapCredentials(*MakeGoogleDefaultCredentials())) {
     if (target_api_version_path_.empty()) {
       target_api_version_path_ = "v1";
     }
@@ -271,13 +273,14 @@ class DownloadObjectLibcurl : public ThroughputExperiment {
   ThroughputResult Run(std::string const& bucket_name,
                        std::string const& object_name,
                        ThroughputExperimentConfig const& config) override {
-    auto header = creds_->AuthorizationHeader();
-    if (!header) return {};
+    auto token = creds_->GetToken(std::chrono::system_clock::now());
+    if (!token) return {};
+    auto header = std::string{"Authorization: "} + token->token;
 
     auto const start = std::chrono::system_clock::now();
     auto timer = Timer::PerThread();
     struct curl_slist* slist1 = nullptr;
-    slist1 = curl_slist_append(slist1, header->c_str());
+    slist1 = curl_slist_append(slist1, header.c_str());
 
     auto* hnd = curl_easy_init();
     curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
@@ -339,7 +342,8 @@ class DownloadObjectLibcurl : public ThroughputExperiment {
  private:
   std::string endpoint_;
   std::string target_api_version_path_;
-  std::shared_ptr<google::cloud::storage::oauth2::Credentials> creds_;
+  // std::shared_ptr<google::cloud::storage::oauth2::Credentials> creds_;
+  std::shared_ptr<oauth2_internal::Credentials> creds_;
 };
 
 #if GOOGLE_CLOUD_CPP_STORAGE_HAVE_GRPC

google/cloud/storage/client.cc

@@ -16,10 +16,10 @@
 #include "google/cloud/storage/idempotency_policy.h"
 #include "google/cloud/storage/internal/base64.h"
 #include "google/cloud/storage/internal/connection_factory.h"
-#include "google/cloud/storage/internal/unified_rest_credentials.h"
-#include "google/cloud/storage/oauth2/credentials.h"
-#include "google/cloud/storage/oauth2/google_credentials.h"
-#include "google/cloud/storage/oauth2/service_account_credentials.h"
+// #include "google/cloud/storage/internal/unified_rest_credentials.h"
+// #include "google/cloud/storage/oauth2/credentials.h"
+// #include "google/cloud/storage/oauth2/google_credentials.h"
+// #include "google/cloud/storage/oauth2/service_account_credentials.h"
 #include "google/cloud/storage/options.h"
 #include "google/cloud/internal/absl_str_cat_quiet.h"
 #include "google/cloud/internal/absl_str_join_quiet.h"
@@ -33,6 +33,8 @@
 #include "google/cloud/internal/rest_options.h"
 #include "google/cloud/internal/rest_response.h"
 #include "google/cloud/internal/service_endpoint.h"
+#include "google/cloud/internal/sha256_hash.h"
+#include "google/cloud/internal/unified_rest_credentials.h"
 #include "google/cloud/log.h"
 #include "google/cloud/opentelemetry_options.h"
 #include "google/cloud/universe_domain_options.h"
@@ -52,6 +54,33 @@ namespace cloud {
 namespace storage {
 GOOGLE_CLOUD_CPP_INLINE_NAMESPACE_BEGIN
 
+namespace {
+class WrapRestCredentials {
+ public:
+  explicit WrapRestCredentials(
+      std::shared_ptr<oauth2_internal::Credentials> impl)
+      : impl_(std::move(impl)) {}
+
+  StatusOr<std::string> AuthorizationHeader() {
+    std::cout << __PRETTY_FUNCTION__ << std::endl;
+    return oauth2_internal::AuthenticationHeaderJoined(*impl_);
+  }
+
+  StatusOr<std::vector<std::uint8_t>> SignBlob(
+      SigningAccount const& signing_account, std::string const& blob) const {
+    return impl_->SignBlob(signing_account.value_or(impl_->AccountEmail()),
+                           blob);
+  }
+
+  std::string AccountEmail() const { return impl_->AccountEmail(); }
+  std::string KeyId() const { return impl_->KeyId(); }
+
+ private:
+  std::shared_ptr<oauth2_internal::Credentials> impl_;
+};
+
+}  // namespace
+
 using ::google::cloud::rest_internal::CurlHandle;
 
 static_assert(std::is_copy_constructible<storage::Client>::value,
@@ -249,19 +278,35 @@ std::string Client::SigningEmail(SigningAccount const& signing_account) const {
   if (signing_account.has_value()) {
     return signing_account.value();
   }
-  return connection_->options().get<Oauth2CredentialsOption>()->AccountEmail();
+
+  auto credentials = WrapRestCredentials(rest_internal::MapCredentials(
+      *connection_->options().get<UnifiedCredentialsOption>()));
+  return credentials.AccountEmail();
+
+  // return
+  // connection_->options().get<Oauth2CredentialsOption>()->AccountEmail();
 }
 
 StatusOr<Client::SignBlobResponseRaw> Client::SignBlobImpl(
     SigningAccount const& signing_account, std::string const& string_to_sign) {
-  auto credentials = connection_->options().get<Oauth2CredentialsOption>();
+  //  std::cout << __func__ << ": signing_account 1=" << signing_account.name()
+  //  << std::endl;
+
+  // auto credentials = connection_->options().get<Oauth2CredentialsOption>();
+  assert(connection_->options().has<UnifiedCredentialsOption>());
+  auto credentials = WrapRestCredentials(rest_internal::MapCredentials(
+      *connection_->options().get<UnifiedCredentialsOption>()));
+  //  std::cout << __func__ << ": signing_account 2=" << signing_account.name()
+  //  << std::endl;
 
   // First try to sign locally.
-  auto signed_blob = credentials->SignBlob(signing_account, string_to_sign);
+  auto signed_blob = credentials.SignBlob(signing_account, string_to_sign);
   if (signed_blob) {
-    return SignBlobResponseRaw{credentials->KeyId(), *std::move(signed_blob)};
+    //    std::cout << __func__ << ": signed locally" << std::endl;
+    return SignBlobResponseRaw{credentials.KeyId(), *std::move(signed_blob)};
   }
 
+  //  std::cout << __func__ << ": signed locally FAILED" << std::endl;
   // If signing locally fails that may be because the credentials do not
   // support signing, or because the signing account is different than the
   // credentials account. In either case, try to sign using the API.
@@ -338,8 +383,12 @@ StatusOr<std::string> Client::SignUrlV4(internal::V4SignUrlRequest request) {
 
 StatusOr<PolicyDocumentResult> Client::SignPolicyDocument(
     internal::PolicyDocumentRequest const& request) {
+  //  std::cout << __func__ << std::endl;
   SigningAccount const& signing_account = request.signing_account();
+  //  std::cout << __func__ << ": signing_account.name()=" <<
+  //  signing_account.name() << std::endl;
   auto signing_email = SigningEmail(signing_account);
+  //  std::cout << __func__ << ": signing_email=" << signing_email << std::endl;
 
   auto string_to_sign = request.StringToSign();
   auto base64_policy = internal::Base64Encode(string_to_sign);
@@ -480,8 +529,12 @@ Options ApplyPolicy(Options opts, IdempotencyPolicy const& p) {
   return opts;
 }
 
-Options DefaultOptions(std::shared_ptr<oauth2::Credentials> credentials,
+Options DefaultOptions(std::shared_ptr<oauth2_internal::Credentials>,
                        Options opts) {
+  return DefaultOptions(opts);
+}
+
+Options DefaultOptions(Options opts) {
   auto ud = GetEnv("GOOGLE_CLOUD_UNIVERSE_DOMAIN");
   if (ud && !ud->empty()) {
     opts.set<google::cloud::internal::UniverseDomainOption>(*std::move(ud));
@@ -491,38 +544,39 @@ Options DefaultOptions(std::shared_ptr<oauth2::Credentials> credentials,
   auto iam_ep = absl::StrCat(google::cloud::internal::UniverseDomainEndpoint(
                                  "https://iamcredentials.googleapis.com", opts),
                              "/v1");
-  auto o =
-      Options{}
-          .set<Oauth2CredentialsOption>(std::move(credentials))
-          .set<RestEndpointOption>(std::move(gcs_ep))
-          .set<IamEndpointOption>(std::move(iam_ep))
-          .set<TargetApiVersionOption>("v1")
-          .set<ConnectionPoolSizeOption>(DefaultConnectionPoolSize())
-          .set<DownloadBufferSizeOption>(
-              GOOGLE_CLOUD_CPP_STORAGE_DEFAULT_DOWNLOAD_BUFFER_SIZE)
-          .set<UploadBufferSizeOption>(
-              GOOGLE_CLOUD_CPP_STORAGE_DEFAULT_UPLOAD_BUFFER_SIZE)
-          .set<MaximumSimpleUploadSizeOption>(
-              GOOGLE_CLOUD_CPP_STORAGE_DEFAULT_MAXIMUM_SIMPLE_UPLOAD_SIZE)
-          .set<EnableCurlSslLockingOption>(true)
-          .set<EnableCurlSigpipeHandlerOption>(true)
-          .set<MaximumCurlSocketRecvSizeOption>(0)
-          .set<MaximumCurlSocketSendSizeOption>(0)
-          .set<TransferStallTimeoutOption>(std::chrono::seconds(
-              GOOGLE_CLOUD_CPP_STORAGE_DEFAULT_DOWNLOAD_STALL_TIMEOUT))
-          .set<TransferStallMinimumRateOption>(1)
-          .set<DownloadStallMinimumRateOption>(1)
-          .set<RetryPolicyOption>(
-              LimitedTimeRetryPolicy(
-                  STORAGE_CLIENT_DEFAULT_MAXIMUM_RETRY_PERIOD)
-                  .clone())
-          .set<BackoffPolicyOption>(
-              ExponentialBackoffPolicy(
-                  STORAGE_CLIENT_DEFAULT_INITIAL_BACKOFF_DELAY,
-                  STORAGE_CLIENT_DEFAULT_MAXIMUM_BACKOFF_DELAY,
-                  STORAGE_CLIENT_DEFAULT_BACKOFF_SCALING)
-                  .clone())
-          .set<IdempotencyPolicyOption>(AlwaysRetryIdempotencyPolicy().clone());
+  Options o;
+  if (!opts.has<UnifiedCredentialsOption>()) {
+    o.set<UnifiedCredentialsOption>(MakeGoogleDefaultCredentials());
+  }
+  o
+      // .set<Oauth2CredentialsOption>(std::move(credentials))
+      .set<RestEndpointOption>(std::move(gcs_ep))
+      .set<IamEndpointOption>(std::move(iam_ep))
+      .set<TargetApiVersionOption>("v1")
+      .set<ConnectionPoolSizeOption>(DefaultConnectionPoolSize())
+      .set<DownloadBufferSizeOption>(
+          GOOGLE_CLOUD_CPP_STORAGE_DEFAULT_DOWNLOAD_BUFFER_SIZE)
+      .set<UploadBufferSizeOption>(
+          GOOGLE_CLOUD_CPP_STORAGE_DEFAULT_UPLOAD_BUFFER_SIZE)
+      .set<MaximumSimpleUploadSizeOption>(
+          GOOGLE_CLOUD_CPP_STORAGE_DEFAULT_MAXIMUM_SIMPLE_UPLOAD_SIZE)
+      .set<EnableCurlSslLockingOption>(true)
+      .set<EnableCurlSigpipeHandlerOption>(true)
+      .set<MaximumCurlSocketRecvSizeOption>(0)
+      .set<MaximumCurlSocketSendSizeOption>(0)
+      .set<TransferStallTimeoutOption>(std::chrono::seconds(
+          GOOGLE_CLOUD_CPP_STORAGE_DEFAULT_DOWNLOAD_STALL_TIMEOUT))
+      .set<TransferStallMinimumRateOption>(1)
+      .set<DownloadStallMinimumRateOption>(1)
+      .set<RetryPolicyOption>(
+          LimitedTimeRetryPolicy(STORAGE_CLIENT_DEFAULT_MAXIMUM_RETRY_PERIOD)
+              .clone())
+      .set<BackoffPolicyOption>(
+          ExponentialBackoffPolicy(STORAGE_CLIENT_DEFAULT_INITIAL_BACKOFF_DELAY,
+                                   STORAGE_CLIENT_DEFAULT_MAXIMUM_BACKOFF_DELAY,
+                                   STORAGE_CLIENT_DEFAULT_BACKOFF_SCALING)
+              .clone())
+      .set<IdempotencyPolicyOption>(AlwaysRetryIdempotencyPolicy().clone());
 
   o = google::cloud::internal::MergeOptions(std::move(opts), std::move(o));
   // If the application did not set `DownloadStallTimeoutOption` then use the
@@ -596,22 +650,24 @@ Options DefaultOptions(std::shared_ptr<oauth2::Credentials> credentials,
 }
 
 Options DefaultOptionsWithCredentials(Options opts) {
-  if (opts.has<Oauth2CredentialsOption>()) {
-    auto credentials = opts.get<Oauth2CredentialsOption>();
-    return internal::DefaultOptions(std::move(credentials), std::move(opts));
-  }
+  // if (opts.has<Oauth2CredentialsOption>()) {
+  //   auto credentials = opts.get<Oauth2CredentialsOption>();
+  //   return internal::DefaultOptions(std::move(credentials), std::move(opts));
+  // }
   if (opts.has<UnifiedCredentialsOption>()) {
     auto credentials =
-        internal::MapCredentials(*opts.get<UnifiedCredentialsOption>());
+        rest_internal::MapCredentials(*opts.get<UnifiedCredentialsOption>());
     return internal::DefaultOptions(std::move(credentials), std::move(opts));
   }
   if (GetEmulator().has_value()) {
     return internal::DefaultOptions(
-        internal::MapCredentials(*google::cloud::MakeInsecureCredentials()),
+        rest_internal::MapCredentials(
+            *google::cloud::MakeInsecureCredentials()),
         std::move(opts));
   }
-  auto credentials =
-      internal::MapCredentials(*google::cloud::MakeGoogleDefaultCredentials(
+  std::cout << __func__ << ": MakeGoogleDefaultCredentials" << std::endl;
+  auto credentials = rest_internal::MapCredentials(
+      *google::cloud::MakeGoogleDefaultCredentials(
           google::cloud::internal::MakeAuthOptions(opts)));
   return internal::DefaultOptions(std::move(credentials), std::move(opts));
 }

google/cloud/storage/client.h

@@ -35,6 +35,7 @@
 #include "google/cloud/storage/upload_options.h"
 #include "google/cloud/storage/version.h"
 #include "google/cloud/internal/group_options.h"
+#include "google/cloud/internal/oauth2_credentials.h"
 #include "google/cloud/internal/throw_delegate.h"
 #include "google/cloud/options.h"
 #include "google/cloud/status.h"
@@ -67,8 +68,9 @@ Options ApplyPolicies(Options opts, P&& head, Policies&&... tail) {
   return ApplyPolicies(std::move(opts), std::forward<Policies>(tail)...);
 }
 
-Options DefaultOptions(std::shared_ptr<oauth2::Credentials> credentials,
-                       Options opts);
+Options DefaultOptions(
+    std::shared_ptr<oauth2_internal::Credentials> credentials, Options opts);
+Options DefaultOptions(Options opts = {});
 Options DefaultOptionsWithCredentials(Options opts);
 
 }  // namespace internal