Merge branch 'feat/gapic-centralization-api-core-mtls' into feat/gapic-generator-centralization-mtls

Author: hebaalazzeh

packages/google-api-core/google/api_core/gapic_v1/client_cert.py

@@ -67,13 +67,16 @@ def get_client_cert_source(
     Returns:
         Callable[[], Tuple[bytes, bytes]] or None: The client cert source to be used by the client.
     """
-    client_cert_source = None
     if use_cert_flag:
         if provided_cert_source:
-            client_cert_source = provided_cert_source
+            return provided_cert_source
         elif (
             hasattr(mtls, "has_default_client_cert_source")
             and mtls.has_default_client_cert_source()
         ):
-            client_cert_source = mtls.default_client_cert_source()
-    return client_cert_source
+            return mtls.default_client_cert_source()
+        else:
+            raise ValueError(
+                "Client certificate is required for mTLS, but no client certificate source was provided or found."
+            )
+    return None

packages/google-api-core/tests/unit/gapic/test_client_cert.py

@@ -54,24 +54,31 @@
         "fallback_env_false_uppercase",
         "fallback_env_unset",
         "fallback_env_unsupported",
-    ]
+    ],
 )
 def test_use_client_cert_effective(has_method, method_val, env_val, expected):
     # Mock hasattr to control whether should_use_client_cert exists
     original_hasattr = hasattr
+
     def custom_hasattr(obj, name):
         if obj is mtls and name == "should_use_client_cert":
             return has_method
         return original_hasattr(obj, name)
 
     with mock.patch("google.api_core.gapic_v1.client_cert.hasattr", custom_hasattr):
-        with mock.patch("google.auth.transport.mtls.should_use_client_cert", create=True, return_value=method_val):
+        with mock.patch(
+            "google.auth.transport.mtls.should_use_client_cert",
+            create=True,
+            return_value=method_val,
+        ):
             env = {}
             if env_val is not None:
                 env["GOOGLE_API_USE_CLIENT_CERTIFICATE"] = env_val
             with mock.patch.dict(os.environ, env, clear=True):
                 if expected == "value_error":
-                    with pytest.raises(ValueError, match="must be either `true` or `false`"):
+                    with pytest.raises(
+                        ValueError, match="must be either `true` or `false`"
+                    ):
                         use_client_cert_effective()
                 else:
                     assert use_client_cert_effective() is (expected == "true")
@@ -84,24 +91,41 @@ def custom_hasattr(obj, name):
         (b"provided", False, True, b"default", None),
         (b"provided", True, True, b"default", b"provided"),
         (None, True, True, b"default", b"default"),
-        (None, True, False, b"default", None),
+        (None, True, False, b"default", "value_error"),
     ],
     ids=[
         "use_cert_false_no_provided",
         "use_cert_false_with_provided",
         "use_cert_true_with_provided",
         "use_cert_true_no_provided_default_avail",
         "use_cert_true_no_provided_default_unavail",
-    ]
+    ],
 )
-def test_get_client_cert_source(provided, use_cert, has_default_avail, default_val, expected):
+def test_get_client_cert_source(
+    provided, use_cert, has_default_avail, default_val, expected
+):
     original_hasattr = hasattr
+
     def custom_hasattr(obj, name):
         if obj is mtls and name == "has_default_client_cert_source":
             return has_default_avail
         return original_hasattr(obj, name)
 
     with mock.patch("google.api_core.gapic_v1.client_cert.hasattr", custom_hasattr):
-        with mock.patch("google.auth.transport.mtls.has_default_client_cert_source", create=True, return_value=has_default_avail):
-            with mock.patch("google.auth.transport.mtls.default_client_cert_source", create=True, return_value=default_val):
-                assert get_client_cert_source(provided, use_cert) == expected
+        with mock.patch(
+            "google.auth.transport.mtls.has_default_client_cert_source",
+            create=True,
+            return_value=has_default_avail,
+        ):
+            with mock.patch(
+                "google.auth.transport.mtls.default_client_cert_source",
+                create=True,
+                return_value=default_val,
+            ):
+                if expected == "value_error":
+                    with pytest.raises(
+                        ValueError, match="Client certificate is required for mTLS"
+                    ):
+                        get_client_cert_source(provided, use_cert)
+                else:
+                    assert get_client_cert_source(provided, use_cert) == expected

packages/google-api-core/tests/unit/gapic/test_config_helpers.py

@@ -31,7 +31,11 @@
         ({"GOOGLE_API_USE_MTLS_ENDPOINT": "always"}, False, (False, "always", None)),
         ({"GOOGLE_API_USE_MTLS_ENDPOINT": "auto"}, False, (False, "auto", None)),
         ({"GOOGLE_API_USE_MTLS_ENDPOINT": "invalid"}, False, "mutual_tls_error"),
-        ({"GOOGLE_CLOUD_UNIVERSE_DOMAIN": "foo.com"}, False, (False, "auto", "foo.com")),
+        (
+            {"GOOGLE_CLOUD_UNIVERSE_DOMAIN": "foo.com"},
+            False,
+            (False, "auto", "foo.com"),
+        ),
     ],
     ids=[
         "default_env",
@@ -41,13 +45,18 @@
         "mtls_auto",
         "mtls_invalid",
         "universe_domain",
-    ]
+    ],
 )
 def test_read_environment_variables(env, mock_cert_val, expected):
-    with mock.patch("google.api_core.gapic_v1.config_helpers.use_client_cert_effective", return_value=mock_cert_val):
+    with mock.patch(
+        "google.api_core.gapic_v1.config_helpers.use_client_cert_effective",
+        return_value=mock_cert_val,
+    ):
         with mock.patch.dict(os.environ, env, clear=True):
             if expected == "mutual_tls_error":
-                with pytest.raises(MutualTLSChannelError, match="must be `never`, `auto` or `always`"):
+                with pytest.raises(
+                    MutualTLSChannelError, match="must be `never`, `auto` or `always`"
+                ):
                     read_environment_variables()
             else:
                 assert read_environment_variables() == expected