Skip to content

Commit 85bfaff

Browse files
sachinprosachinpro
authored
feat: implemented MakeUserAccountCredentials (googleapis#16090)
1 parent 695af07 commit 85bfaff

9 files changed

Lines changed: 140 additions & 0 deletions

‎google/cloud/credentials.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
namespace google {
2929
namespace cloud {
3030
GOOGLE_CLOUD_CPP_INLINE_NAMESPACE_BEGIN
31+
class Credentials;
3132
namespace internal {
3233
class CredentialsVisitor;
3334
} // namespace internal

‎google/cloud/internal/credentials_impl.cc‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,12 @@ std::shared_ptr<Credentials> MakeErrorCredentials(Status error_status) {
3333
std::move(error_status));
3434
}
3535

36+
std::shared_ptr<Credentials> MakeUserAccountCredentials(std::string json_object,
37+
Options opts) {
38+
return std::make_shared<AuthorizedUserConfig>(std::move(json_object),
39+
std::move(opts));
40+
}
41+
3642
Options PopulateAuthOptions(Options options) {
3743
// First set any defaults that may be missing.
3844
options =
@@ -106,6 +112,11 @@ ApiKeyConfig::ApiKeyConfig(std::string api_key, Options opts)
106112
ComputeEngineCredentialsConfig::ComputeEngineCredentialsConfig(Options opts)
107113
: options_(PopulateAuthOptions(std::move(opts))) {}
108114

115+
AuthorizedUserConfig::AuthorizedUserConfig(std::string json_object,
116+
Options opts)
117+
: json_object_(std::move(json_object)),
118+
options_(PopulateAuthOptions(std::move(opts))) {}
119+
109120
} // namespace internal
110121
GOOGLE_CLOUD_CPP_INLINE_NAMESPACE_END
111122
} // namespace cloud

‎google/cloud/internal/credentials_impl.h‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,9 +41,22 @@ class ServiceAccountConfig;
4141
class ExternalAccountConfig;
4242
class ApiKeyConfig;
4343
class ComputeEngineCredentialsConfig;
44+
class AuthorizedUserConfig;
4445

4546
std::shared_ptr<Credentials> MakeErrorCredentials(Status error_status);
4647

48+
/**
49+
* Creates user account credentials from a user account JSON key.
50+
*
51+
* User account credentials contain a refresh token, client ID, and client
52+
* secret, typically obtained via OAuth 2.0 authorization flow.
53+
*
54+
* @param json_object the user account configuration as a JSON string.
55+
* @param opts optional configuration values.
56+
*/
57+
std::shared_ptr<Credentials> MakeUserAccountCredentials(std::string json_object,
58+
Options opts = {});
59+
4760
class CredentialsVisitor {
4861
public:
4962
virtual ~CredentialsVisitor() = default;
@@ -56,6 +69,7 @@ class CredentialsVisitor {
5669
virtual void visit(ExternalAccountConfig const&) = 0;
5770
virtual void visit(ApiKeyConfig const&) = 0;
5871
virtual void visit(ComputeEngineCredentialsConfig const&) = 0;
72+
virtual void visit(AuthorizedUserConfig const&) = 0;
5973

6074
static void dispatch(Credentials const& credentials,
6175
CredentialsVisitor& visitor);
@@ -206,6 +220,21 @@ class ComputeEngineCredentialsConfig : public Credentials {
206220
Options options_;
207221
};
208222

223+
class AuthorizedUserConfig : public Credentials {
224+
public:
225+
AuthorizedUserConfig(std::string json_object, Options opts);
226+
~AuthorizedUserConfig() override = default;
227+
228+
std::string const& json_object() const { return json_object_; }
229+
Options const& options() const { return options_; }
230+
231+
private:
232+
void dispatch(CredentialsVisitor& v) const override { v.visit(*this); }
233+
234+
std::string json_object_;
235+
Options options_;
236+
};
237+
209238
/// A helper function to initialize Auth options.
210239
Options PopulateAuthOptions(Options options);
211240

‎google/cloud/internal/credentials_impl_test.cc‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,17 @@ TEST(Credentials, ApiKeyCredentials) {
124124
EXPECT_EQ("api-key", visitor.api_key);
125125
}
126126

127+
TEST(Credentials, AuthorizedUserCredentials) {
128+
auto credentials = MakeUserAccountCredentials(
129+
"test-only-invalid", Options{}.set<ScopesOption>({"scope1", "scope2"}));
130+
TestCredentialsVisitor visitor;
131+
CredentialsVisitor::dispatch(*credentials, visitor);
132+
ASSERT_EQ("AuthorizedUserConfig", visitor.name);
133+
EXPECT_EQ("test-only-invalid", visitor.json_object);
134+
EXPECT_THAT(visitor.options.get<ScopesOption>(),
135+
ElementsAre("scope1", "scope2"));
136+
}
137+
127138
TEST(PopulateAuthOptions, EmptyOptions) {
128139
auto result_options = PopulateAuthOptions(Options{});
129140

‎google/cloud/internal/unified_grpc_credentials.cc‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -153,6 +153,14 @@ std::shared_ptr<GrpcAuthenticationStrategy> CreateAuthenticationStrategy(
153153
void visit(ComputeEngineCredentialsConfig const&) override {
154154
result = std::make_unique<GrpcComputeEngineAuthentication>(options);
155155
}
156+
void visit(AuthorizedUserConfig const&) override {
157+
result = std::make_unique<GrpcErrorCredentialsAuthentication>(
158+
ErrorCredentialsConfig{UnimplementedError(
159+
"User account credentials (MakeUserAccountCredentials) are not "
160+
"supported with gRPC transport. Use Google Default Credentials "
161+
"or Access Token Credentials instead.",
162+
GCP_ERROR_INFO())});
163+
}
156164

157165
} visitor(std::move(cq), std::move(options));
158166

‎google/cloud/internal/unified_grpc_credentials_test.cc‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -146,6 +146,18 @@ TEST(UnifiedGrpcCredentialsTest, WithApiKeyCredentials) {
146146
EXPECT_THAT(headers, Contains(Pair("x-goog-api-key", "api-key")));
147147
}
148148

149+
TEST(UnifiedGrpcCredentialsTest, WithAuthorizedUserCredentials) {
150+
CompletionQueue cq;
151+
auto creds = AuthorizedUserConfig("{}", Options{});
152+
auto auth = CreateAuthenticationStrategy(creds, cq);
153+
ASSERT_THAT(auth, NotNull());
154+
EXPECT_TRUE(auth->RequiresConfigureContext());
155+
156+
grpc::ClientContext context;
157+
auto configured_context = auth->ConfigureContext(context);
158+
EXPECT_THAT(configured_context, StatusIs(StatusCode::kUnimplemented));
159+
}
160+
149161
TEST(UnifiedGrpcCredentialsTest, LoadCAInfoNotSet) {
150162
auto contents = LoadCAInfo(Options{});
151163
EXPECT_FALSE(contents.has_value());

‎google/cloud/internal/unified_rest_credentials.cc‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
#include "google/cloud/internal/oauth2_access_token_credentials.h"
2020
#include "google/cloud/internal/oauth2_anonymous_credentials.h"
2121
#include "google/cloud/internal/oauth2_api_key_credentials.h"
22+
#include "google/cloud/internal/oauth2_authorized_user_credentials.h"
2223
#include "google/cloud/internal/oauth2_compute_engine_credentials.h"
2324
#include "google/cloud/internal/oauth2_decorate_credentials.h"
2425
#include "google/cloud/internal/oauth2_error_credentials.h"
@@ -35,6 +36,7 @@ namespace {
3536

3637
using ::google::cloud::internal::AccessTokenConfig;
3738
using ::google::cloud::internal::ApiKeyConfig;
39+
using ::google::cloud::internal::AuthorizedUserConfig;
3840
using ::google::cloud::internal::ComputeEngineCredentialsConfig;
3941
using ::google::cloud::internal::CredentialsVisitor;
4042
using ::google::cloud::internal::ErrorCredentialsConfig;
@@ -153,6 +155,19 @@ std::shared_ptr<oauth2_internal::Credentials> MapCredentials(
153155
Decorate(std::move(creds), std::move(client_factory_), cfg.options());
154156
}
155157

158+
void visit(AuthorizedUserConfig const& cfg) override {
159+
auto info = oauth2_internal::ParseAuthorizedUserCredentials(
160+
cfg.json_object(), "MakeUserAccountCredentials");
161+
if (!info) {
162+
result = MakeErrorCredentials(std::move(info).status());
163+
return;
164+
}
165+
auto creds = std::make_shared<oauth2_internal::AuthorizedUserCredentials>(
166+
*info, cfg.options(), client_factory_);
167+
result =
168+
Decorate(std::move(creds), std::move(client_factory_), cfg.options());
169+
}
170+
156171
private:
157172
oauth2_internal::HttpClientFactory client_factory_;
158173
};

‎google/cloud/internal/unified_rest_credentials_test.cc‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -438,6 +438,44 @@ TEST(UnifiedRestCredentialsTest, ServiceAccount) {
438438
EXPECT_EQ(access_token->token, *jwt);
439439
}
440440

441+
TEST(UnifiedRestCredentialsTest, AuthorizedUser) {
442+
auto const token_uri = std::string{"https://user-refresh.example.com"};
443+
auto const contents = nlohmann::json{
444+
{"client_id", "a-client-id.example.com"},
445+
{"client_secret", "a-123456ABCDEF"},
446+
{"refresh_token", "1/THETOKEN"},
447+
{"type", "authorized_user"},
448+
{"token_uri", token_uri},
449+
};
450+
451+
auto const now = std::chrono::system_clock::now();
452+
453+
MockClientFactory client_factory;
454+
EXPECT_CALL(client_factory, Call).WillOnce([token_uri]() {
455+
auto client = std::make_unique<MockRestClient>();
456+
using FormDataType = std::vector<std::pair<std::string, std::string>>;
457+
auto expected_request = Property(&RestRequest::path, token_uri);
458+
auto expected_form_data = MatcherCast<FormDataType const&>(IsSupersetOf({
459+
Pair("grant_type", "refresh_token"),
460+
Pair("client_id", "a-client-id.example.com"),
461+
Pair("client_secret", "a-123456ABCDEF"),
462+
Pair("refresh_token", "1/THETOKEN"),
463+
}));
464+
EXPECT_CALL(*client, Post(_, expected_request, expected_form_data))
465+
.WillOnce(Return(
466+
Status{StatusCode::kPermissionDenied, "uh-oh - user refresh"}));
467+
return client;
468+
});
469+
470+
auto const config =
471+
internal::AuthorizedUserConfig(contents.dump(), Options{});
472+
auto credentials = MapCredentials(config, client_factory.AsStdFunction());
473+
474+
auto access_token = credentials->GetToken(now);
475+
EXPECT_THAT(access_token,
476+
StatusIs(StatusCode::kPermissionDenied, "uh-oh - user refresh"));
477+
}
478+
441479
TEST(UnifiedRestCredentialsTest, ExternalAccount) {
442480
// This sets up a mocked request for the subject token.
443481
auto const subject_url = std::string{"https://test-only-oidc.example.com/"};
@@ -487,6 +525,16 @@ TEST(UnifiedRestCredentialsTest, ExternalAccount) {
487525
StatusIs(StatusCode::kPermissionDenied, "uh-oh - STS exchange"));
488526
}
489527

528+
TEST(UnifiedRestCredentialsTest, AuthorizedUserParseError) {
529+
MockClientFactory client_factory;
530+
EXPECT_CALL(client_factory, Call).Times(0);
531+
532+
auto const config = internal::AuthorizedUserConfig("invalid-json", Options{});
533+
auto credentials = MapCredentials(config, client_factory.AsStdFunction());
534+
auto access_token = credentials->GetToken(std::chrono::system_clock::now());
535+
EXPECT_THAT(access_token, Not(IsOk()));
536+
}
537+
490538
TEST(UnifiedRestCredentialsTest, ApiKey) {
491539
auto creds = MakeApiKeyCredentials("api-key");
492540
ASSERT_THAT(creds, NotNull());

‎google/cloud/testing_util/credentials.h‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,11 @@ struct TestCredentialsVisitor : public internal::CredentialsVisitor {
7272
name = "ComputeEngineCredentialsConfig";
7373
options = cfg.options();
7474
}
75+
void visit(internal::AuthorizedUserConfig const& cfg) override {
76+
name = "AuthorizedUserConfig";
77+
json_object = cfg.json_object();
78+
options = cfg.options();
79+
}
7580
};
7681

7782
} // namespace testing_util

0 commit comments

Comments
 (0)