update tests

Author: ohmayr

packages/gapic-generator/noxfile.py

@@ -476,6 +476,16 @@ def showcase_mtls(
         )
 
 
+# TODO(Phase 3): Remove showcase_pqc once grpcio >= 1.83.0 is enforced by default in google-api-core.
+@nox.session(python=NEWEST_PYTHON)
+def showcase_pqc(session):
+    """Run the Showcase PQC verification test suite against grpcio 1.83+."""
+    with showcase_library(session):
+        session.install("pytest", "pytest-asyncio", "pyopenssl")
+        session.install("--pre", "--upgrade", "grpcio>=1.83.0rc0", "grpcio-status>=1.83.0rc0")
+        session.run("py.test", "--quiet", "--mtls", "-s", *(session.posargs or ["tests/system/test_pqc.py"]))
+
+
 def run_showcase_unit_tests(session, fail_under=100, rest_async_io_enabled=False):
     session.install(
         "coverage",

packages/gapic-generator/tests/system/test_pqc.py

@@ -13,7 +13,6 @@
 # limitations under the License.
 
 import pytest
-import requests
 from google import showcase
 
 
@@ -23,14 +22,17 @@ def run_pqc_test(use_mtls):
         pytest.skip("PQC integration test requires mTLS (--mtls flag) to be enabled.")
 
 
-@pytest.mark.parametrize(
-    "transport_fixture",
-    ["intercepted_echo_grpc", "intercepted_echo_rest"]
-)
-def test_pqc_negotiated_group(run_pqc_test, request, transport_fixture):
-    """Verifies that the generated client library negotiates PQC (X25519MLKEM768) with Showcase server."""
-    client, interceptor = request.getfixturevalue(transport_fixture)
+def _require_pqc_support(transport_name):
+    # TODO(Phase 3): Remove this check once grpcio >= 1.83.0 is enforced across all client libraries.
+    if transport_name == "grpc":
+        import grpc
+        from packaging.version import Version
+        if Version(grpc.__version__) < Version("1.83.0rc0"):
+            pytest.skip(f"gRPC PQC negotiation requires grpcio >= 1.83.0 (current: {grpc.__version__})")
 
+
+def _verify_pqc_negotiated_group(client, interceptor, transport_name):
+    _require_pqc_support(transport_name)
     # Make secure call using standard GAPIC client library fixture
     response = client.echo(request=showcase.EchoRequest(content="Verify PQC connection."))
     assert response.content == "Verify PQC connection."
@@ -47,52 +49,22 @@ def test_pqc_negotiated_group(run_pqc_test, request, transport_fixture):
     assert negotiated_group is not None, "Failed: Showcase server did not return negotiated TLS group header."
     assert supported_groups is not None, "Failed: Showcase server did not return client advertised supported groups."
 
-    print(f"\n[PQC Verification] ({transport_fixture}) Negotiated TLS Group: {negotiated_group}")
-    print(f"[PQC Verification] ({transport_fixture}) Client Advertised Supported Groups: {supported_groups}")
+    print(f"\n[PQC Verification] ({transport_name}) Negotiated TLS Group: {negotiated_group}")
+    print(f"[PQC Verification] ({transport_name}) Client Advertised Supported Groups: {supported_groups}")
 
     # Enforce PQC compliance (X25519MLKEM768 or Kyber)
     assert "MLKEM" in negotiated_group or "Kyber" in negotiated_group, \
-        f"Failed: {transport_fixture} Connection is NOT PQC-compliant! Negotiated: {negotiated_group}"
-
-
-def test_google_auth_transport_pqc(run_pqc_test):
-    """Verifies that google-auth transport adapter negotiates PQC (X25519MLKEM768) with Showcase server."""
-    import google.auth.transport.requests
-    from conftest import HostNameIgnoringAdapter
-
-    # 1. Initialize requests Session with mTLS certs
-    session = requests.Session()
-    cert_path = "/usr/local/google/home/omairn/git/googleapis/google-cloud-python-dev2/packages/gapic-generator/tests/cert/mtls.crt"
-    key_path = "/usr/local/google/home/omairn/git/googleapis/google-cloud-python-dev2/packages/gapic-generator/tests/cert/mtls.key"
-
-    session.verify = cert_path
-    session.cert = (cert_path, key_path)
-    session.mount("https://", HostNameIgnoringAdapter())
+        f"Failed: {transport_name} Connection is NOT PQC-compliant! Negotiated: {negotiated_group}"
 
-    # 2. Wrap session in google-auth transport adapter
-    auth_transport = google.auth.transport.requests.Request(session=session)
 
-    # 3. Serialize request body
-    req = showcase.EchoRequest(content="Verify google-auth transport PQC connection.")
-    body = showcase.EchoRequest.to_json(req, including_default_value_fields=False).encode("utf-8")
+def test_pqc_grpc(run_pqc_test, intercepted_echo_grpc):
+    """Verifies that the gRPC client library negotiates PQC (X25519MLKEM768) with Showcase server."""
+    client, interceptor = intercepted_echo_grpc
+    _verify_pqc_negotiated_group(client, interceptor, "grpc")
 
-    # 4. Execute request through google-auth's transport layer
-    url = "https://localhost:7469/v1beta1/echo:echo"
-    headers = {
-        "Content-Type": "application/json",
-        "x-goog-api-client": "gapic/1.0 rest/1.0",
-    }
 
-    response = auth_transport(url=url, method="POST", body=body, headers=headers)
-    assert response.status == 200, f"Failed: status={response.status}, body={response.data}"
+def test_pqc_rest(run_pqc_test, intercepted_echo_rest):
+    """Verifies that the REST client library negotiates PQC (X25519MLKEM768) with Showcase server."""
+    client, interceptor = intercepted_echo_rest
+    _verify_pqc_negotiated_group(client, interceptor, "rest")
 
-    # 5. Extract and verify negotiated TLS group returned by Showcase
-    negotiated_group = response.headers.get("x-showcase-tls-group")
-    supported_groups = response.headers.get("x-showcase-tls-client-supported-groups")
-
-    assert negotiated_group is not None, "Failed: Showcase server did not return negotiated TLS group header."
-    print(f"\n[google-auth Transport PQC] Negotiated TLS Group: {negotiated_group}")
-    print(f"[google-auth Transport PQC] Client Advertised Supported Groups: {supported_groups}")
-
-    assert "MLKEM" in negotiated_group or "Kyber" in negotiated_group, \
-        f"Failed: google-auth Transport is NOT PQC-compliant! Negotiated: {negotiated_group}"