|
22 | 22 | import base64 |
23 | 23 | import http.client as http_client |
24 | 24 | import json |
| 25 | +import os |
25 | 26 |
|
26 | 27 | from google.auth import _exponential_backoff |
27 | 28 | from google.auth import _helpers |
28 | 29 | from google.auth import credentials |
29 | 30 | from google.auth import crypt |
30 | 31 | from google.auth import exceptions |
| 32 | +from google.auth.transport import mtls |
31 | 33 |
|
32 | 34 | IAM_RETRY_CODES = { |
33 | 35 | http_client.INTERNAL_SERVER_ERROR, |
|
38 | 40 |
|
39 | 41 | _IAM_SCOPE = ["https://www.googleapis.com/auth/iam"] |
40 | 42 |
|
41 | | -_IAM_ENDPOINT = ( |
42 | | - "https://iamcredentials.googleapis.com/v1/projects/-" |
43 | | - + "/serviceAccounts/{}:generateAccessToken" |
44 | | -) |
45 | | - |
46 | | -_IAM_SIGN_ENDPOINT = ( |
47 | | - "https://iamcredentials.googleapis.com/v1/projects/-" |
48 | | - + "/serviceAccounts/{}:signBlob" |
49 | | -) |
50 | | - |
51 | | -_IAM_SIGNJWT_ENDPOINT = ( |
52 | | - "https://iamcredentials.googleapis.com/v1/projects/-" |
53 | | - + "/serviceAccounts/{}:signJwt" |
54 | | -) |
55 | | - |
56 | | -_IAM_IDTOKEN_ENDPOINT = ( |
57 | | - "https://iamcredentials.googleapis.com/v1/" |
58 | | - + "projects/-/serviceAccounts/{}:generateIdToken" |
59 | | -) |
| 43 | +# 1. Determine if we should use mTLS. |
| 44 | +# Note: We only support automatic mTLS on the default googleapis.com universe. |
| 45 | +if hasattr(mtls, "should_use_client_cert"): |
| 46 | + use_client_cert = mtls.should_use_client_cert() |
| 47 | +else: # pragma: NO COVER |
| 48 | + # if unsupported, fallback to reading from env var |
| 49 | + use_client_cert = ( |
| 50 | + os.getenv("GOOGLE_API_USE_CLIENT_CERTIFICATE", "false").lower() == "true" |
| 51 | + ) |
| 52 | + |
| 53 | +# 2. Construct the template domain using the library's DEFAULT_UNIVERSE_DOMAIN constant. |
| 54 | +# This ensures that the .replace() calls in the classes will work correctly. |
| 55 | +if use_client_cert: |
| 56 | + # We use the .mtls. prefix only for the default universe template |
| 57 | + _IAM_DOMAIN = f"iamcredentials.mtls.{credentials.DEFAULT_UNIVERSE_DOMAIN}" |
| 58 | +else: |
| 59 | + _IAM_DOMAIN = f"iamcredentials.{credentials.DEFAULT_UNIVERSE_DOMAIN}" |
| 60 | + |
| 61 | +# 3. Create the common base URL template |
| 62 | +# We use double brackets {{}} so .format() can be called later for the email. |
| 63 | +_IAM_BASE_URL = f"https://{_IAM_DOMAIN}/v1/projects/-/serviceAccounts/{{}}" |
| 64 | + |
| 65 | +# 4. Define the endpoints as templates |
| 66 | +_IAM_ENDPOINT = _IAM_BASE_URL + ":generateAccessToken" |
| 67 | +_IAM_SIGN_ENDPOINT = _IAM_BASE_URL + ":signBlob" |
| 68 | +_IAM_SIGNJWT_ENDPOINT = _IAM_BASE_URL + ":signJwt" |
| 69 | +_IAM_IDTOKEN_ENDPOINT = _IAM_BASE_URL + ":generateIdToken" |
60 | 70 |
|
61 | 71 |
|
62 | 72 | class Signer(crypt.Signer): |
|
0 commit comments