feat(phase1): add image storage utilities

- Create backend/services/image_storage.py with 4 core functions:
  - sanitize_filename(): remove unsafe chars, limit to 255 chars, convert to lowercase
  - get_unique_filename(): handle collisions with UUID suffix (format: {name}_{uuid8}_{variant}.jpg)
  - ensure_image_directories(): create /images/ root and category subdirs on startup
  - save_image(): save bytes to /images/{category}/{filename}, returns relative path
- Create comprehensive test suite (22 tests) covering all functionality
- Integrate ensure_image_directories() into FastAPI startup event
- Directory structure: /images/{category}/{filename}
- Collision handling: auto-suffix with UUID if filename exists
- All tests passing, pathlib.Path for safe operations
This commit is contained in:
2026-04-20 21:57:26 +03:00
parent 39fab336ba
commit ea49cd6e4a
4487 changed files with 1305959 additions and 4 deletions

View File

@@ -0,0 +1,25 @@
# Copyright 2024 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
"""Google Auth AIO Library for Python."""
import logging
from google.auth import version as google_auth_version
__version__ = google_auth_version.__version__
# Set default logging handler to avoid "No handler found" warnings.
logging.getLogger(__name__).addHandler(logging.NullHandler())

View File

@@ -0,0 +1,62 @@
# Copyright 2025 Google Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
"""Helper functions for commonly used utilities."""
import logging
from typing import Any
from google.auth import _helpers
async def _parse_response_async(response: Any) -> Any:
"""
Parses an async response, attempting to decode JSON.
Args:
response: The response object to parse. This can be any type, but
it is expected to have a `json()` method if it contains JSON.
Returns:
The parsed response. If the response contains valid JSON, the
decoded JSON object (e.g., a dictionary) is returned.
If the response does not have a `json()` method or if the JSON
decoding fails, None is returned.
"""
try:
json_response = await response.json()
return json_response
except Exception:
# TODO(https://github.com/googleapis/google-auth-library-python/issues/1745):
# Parse and return response payload as json based on different content types.
return None
async def response_log_async(logger: logging.Logger, response: Any) -> None:
"""
Logs an Async HTTP response at the DEBUG level if logging is enabled.
Args:
logger: The logging.Logger instance to use.
response: The HTTP response object to log.
"""
if _helpers.is_logging_enabled(logger):
# TODO(https://github.com/googleapis/google-auth-library-python/issues/1755):
# Parsing the response for async streaming logging results in
# the stream to be empty downstream. For now, we will not be logging
# the response for async responses until we investigate further.
# json_response = await _parse_response_async(response)
json_response = None
_helpers._response_log_base(logger, json_response)

View File

@@ -0,0 +1,143 @@
# Copyright 2024 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
"""Interfaces for asynchronous credentials."""
from google.auth import _helpers
from google.auth import exceptions
from google.auth._credentials_base import _BaseCredentials
class Credentials(_BaseCredentials):
"""Base class for all asynchronous credentials.
All credentials have a :attr:`token` that is used for authentication and
may also optionally set an :attr:`expiry` to indicate when the token will
no longer be valid.
Most credentials will be :attr:`invalid` until :meth:`refresh` is called.
Credentials can do this automatically before the first HTTP request in
:meth:`before_request`.
Although the token and expiration will change as the credentials are
:meth:`refreshed <refresh>` and used, credentials should be considered
immutable. Various credentials will accept configuration such as private
keys, scopes, and other options. These options are not changeable after
construction. Some classes will provide mechanisms to copy the credentials
with modifications such as :meth:`ScopedCredentials.with_scopes`.
"""
def __init__(self):
super(Credentials, self).__init__()
async def apply(self, headers, token=None):
"""Apply the token to the authentication header.
Args:
headers (Mapping): The HTTP request headers.
token (Optional[str]): If specified, overrides the current access
token.
"""
self._apply(headers, token=token)
async def refresh(self, request):
"""Refreshes the access token.
Args:
request (google.auth.aio.transport.Request): The object used to make
HTTP requests.
Raises:
google.auth.exceptions.RefreshError: If the credentials could
not be refreshed.
"""
raise NotImplementedError("Refresh must be implemented")
async def before_request(self, request, method, url, headers):
"""Performs credential-specific before request logic.
Refreshes the credentials if necessary, then calls :meth:`apply` to
apply the token to the authentication header.
Args:
request (google.auth.aio.transport.Request): The object used to make
HTTP requests.
method (str): The request's HTTP method or the RPC method being
invoked.
url (str): The request's URI or the RPC service's URI.
headers (Mapping): The request's headers.
"""
await self.apply(headers)
class StaticCredentials(Credentials):
"""Asynchronous Credentials representing an immutable access token.
The credentials are considered immutable except the tokens which can be
configured in the constructor ::
credentials = StaticCredentials(token="token123")
StaticCredentials does not support :meth `refresh` and assumes that the configured
token is valid and not expired. StaticCredentials will never attempt to
refresh the token.
"""
def __init__(self, token):
"""
Args:
token (str): The access token.
"""
super(StaticCredentials, self).__init__()
self.token = token
@_helpers.copy_docstring(Credentials)
async def refresh(self, request):
raise exceptions.InvalidOperation("Static credentials cannot be refreshed.")
# Note: before_request should never try to refresh access tokens.
# StaticCredentials intentionally does not support it.
@_helpers.copy_docstring(Credentials)
async def before_request(self, request, method, url, headers):
await self.apply(headers)
class AnonymousCredentials(Credentials):
"""Asynchronous Credentials that do not provide any authentication information.
These are useful in the case of services that support anonymous access or
local service emulators that do not use credentials.
"""
async def refresh(self, request):
"""Raises :class:``InvalidOperation``, anonymous credentials cannot be
refreshed."""
raise exceptions.InvalidOperation("Anonymous credentials cannot be refreshed.")
async def apply(self, headers, token=None):
"""Anonymous credentials do nothing to the request.
The optional ``token`` argument is not supported.
Raises:
google.auth.exceptions.InvalidValue: If a token was specified.
"""
if token is not None:
raise exceptions.InvalidValue("Anonymous credentials don't support tokens.")
async def before_request(self, request, method, url, headers):
"""Anonymous credentials do nothing to the request."""
pass

View File

@@ -0,0 +1,144 @@
# Copyright 2024 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
"""Transport - Asynchronous HTTP client library support.
:mod:`google.auth.aio` is designed to work with various asynchronous client libraries such
as aiohttp. In order to work across these libraries with different
interfaces some abstraction is needed.
This module provides two interfaces that are implemented by transport adapters
to support HTTP libraries. :class:`Request` defines the interface expected by
:mod:`google.auth` to make asynchronous requests. :class:`Response` defines the interface
for the return value of :class:`Request`.
"""
import abc
from typing import AsyncGenerator, Mapping, Optional
import google.auth.transport
_DEFAULT_TIMEOUT_SECONDS = 180
DEFAULT_RETRYABLE_STATUS_CODES = google.auth.transport.DEFAULT_RETRYABLE_STATUS_CODES
"""Sequence[int]: HTTP status codes indicating a request can be retried.
"""
DEFAULT_MAX_RETRY_ATTEMPTS = 3
"""int: How many times to retry a request."""
class Response(metaclass=abc.ABCMeta):
"""Asynchronous HTTP Response Interface."""
@property
@abc.abstractmethod
def status_code(self) -> int:
"""
The HTTP response status code.
Returns:
int: The HTTP response status code.
"""
raise NotImplementedError("status_code must be implemented.")
@property
@abc.abstractmethod
def headers(self) -> Mapping[str, str]:
"""The HTTP response headers.
Returns:
Mapping[str, str]: The HTTP response headers.
"""
raise NotImplementedError("headers must be implemented.")
@abc.abstractmethod
async def content(self, chunk_size: int) -> AsyncGenerator[bytes, None]:
"""The raw response content.
Args:
chunk_size (int): The size of each chunk.
Yields:
AsyncGenerator[bytes, None]: An asynchronous generator yielding
response chunks as bytes.
"""
raise NotImplementedError("content must be implemented.")
@abc.abstractmethod
async def read(self) -> bytes:
"""Read the entire response content as bytes.
Returns:
bytes: The entire response content.
"""
raise NotImplementedError("read must be implemented.")
@abc.abstractmethod
async def close(self):
"""Close the response after it is fully consumed to resource."""
raise NotImplementedError("close must be implemented.")
class Request(metaclass=abc.ABCMeta):
"""Interface for a callable that makes HTTP requests.
Specific transport implementations should provide an implementation of
this that adapts their specific request / response API.
.. automethod:: __call__
"""
@abc.abstractmethod
async def __call__(
self,
url: str,
method: str,
body: Optional[bytes],
headers: Optional[Mapping[str, str]],
timeout: float,
**kwargs
) -> Response:
"""Make an HTTP request.
Args:
url (str): The URI to be requested.
method (str): The HTTP method to use for the request. Defaults
to 'GET'.
body (Optional[bytes]): The payload / body in HTTP request.
headers (Mapping[str, str]): Request headers.
timeout (float): The number of seconds to wait for a
response from the server. If not specified or if None, the
transport-specific default timeout will be used.
kwargs: Additional arguments passed on to the transport's
request method.
Returns:
google.auth.aio.transport.Response: The HTTP response.
Raises:
google.auth.exceptions.TransportError: If any exception occurred.
"""
# pylint: disable=redundant-returns-doc, missing-raises-doc
# (pylint doesn't play well with abstract docstrings.)
raise NotImplementedError("__call__ must be implemented.")
async def close(self) -> None:
"""
Close the underlying session.
"""
raise NotImplementedError("close must be implemented.")

View File

@@ -0,0 +1,205 @@
# Copyright 2024 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
"""Transport adapter for Asynchronous HTTP Requests based on aiohttp."""
import asyncio
import logging
from typing import AsyncGenerator, Mapping, Optional, TYPE_CHECKING, Union
try:
import aiohttp # type: ignore
except ImportError as caught_exc: # pragma: NO COVER
raise ImportError(
"The aiohttp library is not installed from please install the aiohttp package to use the aiohttp transport."
) from caught_exc
from google.auth import _helpers
from google.auth import exceptions
from google.auth.aio import _helpers as _helpers_async
from google.auth.aio import transport
if TYPE_CHECKING: # pragma: NO COVER
from aiohttp import ClientTimeout # type: ignore
else:
try:
from aiohttp import ClientTimeout
except (ImportError, AttributeError):
ClientTimeout = None
_LOGGER = logging.getLogger(__name__)
class Response(transport.Response):
"""
Represents an HTTP response and its data. It is returned by ``google.auth.aio.transport.sessions.AsyncAuthorizedSession``.
Args:
response (aiohttp.ClientResponse): An instance of aiohttp.ClientResponse.
Attributes:
status_code (int): The HTTP status code of the response.
headers (Mapping[str, str]): The HTTP headers of the response.
"""
def __init__(self, response: aiohttp.ClientResponse):
self._response = response
@property
@_helpers.copy_docstring(transport.Response)
def status_code(self) -> int:
return self._response.status
@property
@_helpers.copy_docstring(transport.Response)
def headers(self) -> Mapping[str, str]:
return {key: value for key, value in self._response.headers.items()}
@_helpers.copy_docstring(transport.Response)
async def content(self, chunk_size: int = 1024) -> AsyncGenerator[bytes, None]:
try:
async for chunk in self._response.content.iter_chunked(
chunk_size
): # pragma: no branch
yield chunk
except aiohttp.ClientPayloadError as exc:
raise exceptions.ResponseError(
"Failed to read from the payload stream."
) from exc
@_helpers.copy_docstring(transport.Response)
async def read(self) -> bytes:
try:
return await self._response.read()
except aiohttp.ClientResponseError as exc:
raise exceptions.ResponseError("Failed to read the response body.") from exc
@_helpers.copy_docstring(transport.Response)
async def close(self):
self._response.close()
class Request(transport.Request):
"""Asynchronous Requests request adapter.
This class is used internally for making requests using aiohttp
in a consistent way. If you use :class:`google.auth.aio.transport.sessions.AsyncAuthorizedSession`
you do not need to construct or use this class directly.
This class can be useful if you want to configure a Request callable
with a custom ``aiohttp.ClientSession`` in :class:`AuthorizedSession` or if
you want to manually refresh a :class:`~google.auth.aio.credentials.Credentials` instance::
import aiohttp
import google.auth.aio.transport.aiohttp
# Default example:
request = google.auth.aio.transport.aiohttp.Request()
await credentials.refresh(request)
# Custom aiohttp Session Example:
session = session=aiohttp.ClientSession(auto_decompress=False)
request = google.auth.aio.transport.aiohttp.Request(session=session)
auth_session = google.auth.aio.transport.sessions.AsyncAuthorizedSession(auth_request=request)
Args:
session (aiohttp.ClientSession): An instance :class:`aiohttp.ClientSession` used
to make HTTP requests. If not specified, a session will be created.
.. automethod:: __call__
"""
def __init__(self, session: Optional[aiohttp.ClientSession] = None):
self._session = session
self._closed = False
async def __call__(
self,
url: str,
method: str = "GET",
body: Optional[bytes] = None,
headers: Optional[Mapping[str, str]] = None,
timeout: Union[float, ClientTimeout] = transport._DEFAULT_TIMEOUT_SECONDS,
**kwargs,
) -> transport.Response:
"""
Make an HTTP request using aiohttp.
Args:
url (str): The URL to be requested.
method (Optional[str]):
The HTTP method to use for the request. Defaults to 'GET'.
body (Optional[bytes]):
The payload or body in HTTP request.
headers (Optional[Mapping[str, str]]):
Request headers.
timeout (float): The number of seconds to wait for a
response from the server. If not specified or if None, the
requests default timeout will be used.
kwargs: Additional arguments passed through to the underlying
aiohttp :meth:`aiohttp.Session.request` method.
Returns:
google.auth.aio.transport.Response: The HTTP response.
Raises:
- google.auth.exceptions.TransportError: If the request fails or if the session is closed.
- google.auth.exceptions.TimeoutError: If the request times out.
"""
try:
if self._closed:
raise exceptions.TransportError("session is closed.")
if not self._session:
self._session = aiohttp.ClientSession()
if isinstance(timeout, aiohttp.ClientTimeout):
client_timeout = timeout
else:
client_timeout = aiohttp.ClientTimeout(total=timeout)
_helpers.request_log(_LOGGER, method, url, body, headers)
response = await self._session.request(
method,
url,
data=body,
headers=headers,
timeout=client_timeout,
**kwargs,
)
await _helpers_async.response_log_async(_LOGGER, response)
return Response(response)
except aiohttp.ClientError as caught_exc:
client_exc = exceptions.TransportError(f"Failed to send request to {url}.")
raise client_exc from caught_exc
except asyncio.TimeoutError as caught_exc:
if isinstance(timeout, aiohttp.ClientTimeout):
timeout_seconds = timeout.total
else:
timeout_seconds = timeout
timeout_exc = exceptions.TimeoutError(
f"Request timed out after {timeout_seconds} seconds."
)
raise timeout_exc from caught_exc
async def close(self) -> None:
"""
Close the underlying aiohttp session to release the acquired resources.
"""
if not self._closed and self._session:
await self._session.close()
self._closed = True

View File

@@ -0,0 +1,197 @@
# Copyright 2026 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
"""
Helper functions for mTLS in async for discovery of certs.
"""
import asyncio
import contextlib
import logging
import os
import ssl
import tempfile
from typing import Optional
from google.auth import exceptions
import google.auth.transport._mtls_helper
import google.auth.transport.mtls
_LOGGER = logging.getLogger(__name__)
@contextlib.contextmanager
def _create_temp_file(content: bytes):
"""Creates a temporary file with the given content.
Args:
content (bytes): The content to write to the file.
Yields:
str: The path to the temporary file.
"""
# Create a temporary file that is readable only by the owner.
fd, file_path = tempfile.mkstemp()
try:
with os.fdopen(fd, "wb") as f:
f.write(content)
yield file_path
finally:
# Securely delete the file after use.
if os.path.exists(file_path):
os.remove(file_path)
def make_client_cert_ssl_context(
cert_bytes: bytes, key_bytes: bytes, passphrase: Optional[bytes] = None
) -> ssl.SSLContext:
"""Creates an SSLContext with the given client certificate and key.
This function writes the certificate and key to temporary files so that
ssl.create_default_context can load them, as the ssl module requires
file paths for client certificates. These temporary files are deleted
immediately after the SSL context is created.
Args:
cert_bytes (bytes): The client certificate content in PEM format.
key_bytes (bytes): The client private key content in PEM format.
passphrase (Optional[bytes]): The passphrase for the private key, if any.
Returns:
ssl.SSLContext: The configured SSL context with client certificate.
Raises:
google.auth.exceptions.TransportError: If there is an error loading the certificate.
"""
with _create_temp_file(cert_bytes) as cert_path, _create_temp_file(
key_bytes
) as key_path:
try:
context = ssl.create_default_context(ssl.Purpose.SERVER_AUTH)
context.load_cert_chain(
certfile=cert_path, keyfile=key_path, password=passphrase
)
return context
except (ssl.SSLError, OSError, IOError, ValueError, RuntimeError) as exc:
raise exceptions.TransportError(
"Failed to load client certificate and key for mTLS."
) from exc
async def _run_in_executor(func, *args):
"""Run a blocking function in an executor to avoid blocking the event loop.
This implements the non-blocking execution strategy for disk I/O operations.
"""
try:
# For python versions 3.9 and newer versions
return await asyncio.to_thread(func, *args)
except AttributeError:
# Fallback for older Python versions
loop = asyncio.get_running_loop()
return await loop.run_in_executor(None, func, *args)
def default_client_cert_source():
"""Get a callback which returns the default client SSL credentials.
Returns:
Awaitable[Callable[[], Tuple[bytes, bytes]]]: A callback which returns the default
client certificate bytes and private key bytes, both in PEM format.
Raises:
google.auth.exceptions.DefaultClientCertSourceError: If the default
client SSL credentials don't exist or are malformed.
"""
if not google.auth.transport.mtls.has_default_client_cert_source(
include_context_aware=False
):
raise exceptions.MutualTLSChannelError(
"Default client cert source doesn't exist"
)
async def callback():
try:
_, cert_bytes, key_bytes = await get_client_cert_and_key()
except (OSError, RuntimeError, ValueError) as caught_exc:
new_exc = exceptions.MutualTLSChannelError(caught_exc)
raise new_exc from caught_exc
return cert_bytes, key_bytes
return callback
async def get_client_ssl_credentials(
certificate_config_path=None,
):
"""Returns the client side certificate, private key and passphrase.
We look for certificates and keys with the following order of priority:
1. Certificate and key specified by certificate_config.json.
Currently, only X.509 workload certificates are supported.
Args:
certificate_config_path (str): The certificate_config.json file path.
Returns:
Tuple[bool, bytes, bytes, bytes]:
A boolean indicating if cert, key and passphrase are obtained, the
cert bytes and key bytes both in PEM format, and passphrase bytes.
Raises:
google.auth.exceptions.ClientCertError: if problems occurs when getting
the cert, key and passphrase.
"""
# Attempt to retrieve X.509 Workload cert and key.
cert, key = await _run_in_executor(
google.auth.transport._mtls_helper._get_workload_cert_and_key,
certificate_config_path,
False,
)
if cert and key:
return True, cert, key, None
return False, None, None, None
async def get_client_cert_and_key(client_cert_callback=None):
"""Returns the client side certificate and private key. The function first
tries to get certificate and key from client_cert_callback; if the callback
is None or doesn't provide certificate and key, the function tries application
default SSL credentials.
Args:
client_cert_callback (Optional[Callable[[], (bytes, bytes)]]): An
optional callback which returns client certificate bytes and private
key bytes both in PEM format.
Returns:
Tuple[bool, bytes, bytes]:
A boolean indicating if cert and key are obtained, the cert bytes
and key bytes both in PEM format.
Raises:
google.auth.exceptions.ClientCertError: if problems occurs when getting
the cert and key.
"""
if client_cert_callback:
result = client_cert_callback()
try:
cert, key = await result
except TypeError:
cert, key = result
return True, cert, key
has_cert, cert, key, _ = await get_client_ssl_credentials()
return has_cert, cert, key

View File

@@ -0,0 +1,576 @@
# Copyright 2024 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
import asyncio
from contextlib import asynccontextmanager
import functools
import time
from typing import Mapping, Optional, TYPE_CHECKING, Union
from google.auth import _exponential_backoff, exceptions
from google.auth.aio import transport
from google.auth.aio.credentials import Credentials
from google.auth.aio.transport import mtls
from google.auth.exceptions import TimeoutError
import google.auth.transport._mtls_helper
if TYPE_CHECKING: # pragma: NO COVER
import aiohttp
from aiohttp import ClientTimeout # type: ignore
else:
try:
import aiohttp
from aiohttp import ClientTimeout
except (ImportError, AttributeError):
ClientTimeout = None
# Tracks the internal aiohttp installation and usage
try:
from google.auth.aio.transport.aiohttp import Request as AiohttpRequest
AIOHTTP_INSTALLED = True
except ImportError: # pragma: NO COVER
AIOHTTP_INSTALLED = False
@asynccontextmanager
async def timeout_guard(timeout):
"""
timeout_guard is an asynchronous context manager to apply a timeout to an asynchronous block of code.
Args:
timeout (float): The time in seconds before the context manager times out.
Raises:
google.auth.exceptions.TimeoutError: If the code within the context exceeds the provided timeout.
Usage:
async with timeout_guard(10) as with_timeout:
await with_timeout(async_function())
"""
start = time.monotonic()
total_timeout = timeout
def _remaining_time():
elapsed = time.monotonic() - start
remaining = total_timeout - elapsed
if remaining <= 0:
raise TimeoutError(
f"Context manager exceeded the configured timeout of {total_timeout}s."
)
return remaining
async def with_timeout(coro):
try:
remaining = _remaining_time()
response = await asyncio.wait_for(coro, remaining)
return response
except (asyncio.TimeoutError, TimeoutError) as e:
raise TimeoutError(
f"The operation {coro} exceeded the configured timeout of {total_timeout}s."
) from e
try:
yield with_timeout
finally:
_remaining_time()
class AsyncAuthorizedSession:
"""This is an asynchronous implementation of :class:`google.auth.requests.AuthorizedSession` class.
We utilize an instance of a class that implements :class:`google.auth.aio.transport.Request` configured
by the caller or otherwise default to `google.auth.aio.transport.aiohttp.Request` if the external aiohttp
package is installed.
A Requests Session class with credentials.
This class is used to perform asynchronous requests to API endpoints that require
authorization::
import aiohttp
from google.auth.aio.transport import sessions
async with sessions.AsyncAuthorizedSession(credentials) as authed_session:
response = await authed_session.request(
'GET', 'https://www.googleapis.com/storage/v1/b')
The underlying :meth:`request` implementation handles adding the
credentials' headers to the request and refreshing credentials as needed.
Args:
credentials (google.auth.aio.credentials.Credentials):
The credentials to add to the request.
auth_request (Optional[google.auth.aio.transport.Request]):
An instance of a class that implements
:class:`~google.auth.aio.transport.Request` used to make requests
and refresh credentials. If not passed,
an instance of :class:`~google.auth.aio.transport.aiohttp.Request`
is created.
Raises:
- google.auth.exceptions.TransportError: If `auth_request` is `None`
and the external package `aiohttp` is not installed.
- google.auth.exceptions.InvalidType: If the provided credentials are
not of type `google.auth.aio.credentials.Credentials`.
"""
def __init__(
self, credentials: Credentials, auth_request: Optional[transport.Request] = None
):
if not isinstance(credentials, Credentials):
raise exceptions.InvalidType(
f"The configured credentials of type {type(credentials)} are invalid and must be of type `google.auth.aio.credentials.Credentials`"
)
self._credentials = credentials
_auth_request = auth_request
if not _auth_request and AIOHTTP_INSTALLED:
_auth_request = AiohttpRequest()
self._is_mtls = False
self._mtls_init_task = None
self._cached_cert = None
if _auth_request is None:
raise exceptions.TransportError(
"`auth_request` must either be configured or the external package `aiohttp` must be installed to use the default value."
)
self._auth_request = _auth_request
async def configure_mtls_channel(self, client_cert_callback=None):
"""Configure the client certificate and key for SSL connection.
The function does nothing unless `GOOGLE_API_USE_CLIENT_CERTIFICATE` is
explicitly set to `true`. In this case if client certificate and key are
successfully obtained (from the given client_cert_callback or from application
default SSL credentials), the underlying transport will be reconfigured
to use mTLS.
Note: This function does nothing if the `aiohttp` library is not
installed.
Important: Calling this method will close any ongoing API requests associated
with the current session. To ensure a smooth transition, it is recommended
to call this during session initialization.
Args:
client_cert_callback (Optional[Callable[[], (bytes, bytes)]]):
The optional callback returns the client certificate and private
key bytes both in PEM format.
If the callback is None, application default SSL credentials
will be used.
Raises:
google.auth.exceptions.MutualTLSChannelError: If mutual TLS channel
creation failed for any reason.
"""
if self._mtls_init_task is None:
async def _do_configure():
# Run the blocking check in an executor
use_client_cert = await mtls._run_in_executor(
google.auth.transport._mtls_helper.check_use_client_cert
)
if not use_client_cert:
self._is_mtls = False
return
try:
(
self._is_mtls,
cert,
key,
) = await mtls.get_client_cert_and_key(client_cert_callback)
if self._is_mtls:
self._cached_cert = cert
ssl_context = await mtls._run_in_executor(
mtls.make_client_cert_ssl_context, cert, key
)
# Re-create the auth request with the new SSL context
if AIOHTTP_INSTALLED and isinstance(
self._auth_request, AiohttpRequest
):
connector = aiohttp.TCPConnector(ssl=ssl_context)
new_session = aiohttp.ClientSession(connector=connector)
old_auth_request = self._auth_request
self._auth_request = AiohttpRequest(session=new_session)
await old_auth_request.close()
except (
exceptions.ClientCertError,
ImportError,
OSError,
) as caught_exc:
new_exc = exceptions.MutualTLSChannelError(caught_exc)
raise new_exc from caught_exc
self._mtls_init_task = asyncio.create_task(_do_configure())
return await self._mtls_init_task
async def request(
self,
method: str,
url: str,
data: Optional[bytes] = None,
headers: Optional[Mapping[str, str]] = None,
max_allowed_time: float = transport._DEFAULT_TIMEOUT_SECONDS,
timeout: Union[float, ClientTimeout] = transport._DEFAULT_TIMEOUT_SECONDS,
total_attempts: Optional[int] = transport.DEFAULT_MAX_RETRY_ATTEMPTS,
**kwargs,
) -> transport.Response:
"""
Args:
method (str): The http method used to make the request.
url (str): The URI to be requested.
data (Optional[bytes]): The payload or body in HTTP request.
headers (Optional[Mapping[str, str]]): Request headers.
timeout (float, aiohttp.ClientTimeout):
The amount of time in seconds to wait for the server response
with each individual request.
max_allowed_time (float):
If the method runs longer than this, a ``Timeout`` exception is
automatically raised. Unlike the ``timeout`` parameter, this
value applies to the total method execution time, even if
multiple requests are made under the hood.
total_attempts (int):
The total number of retry attempts.
Mind that it is not guaranteed that the timeout error is raised
at ``max_allowed_time``. It might take longer, for example, if
an underlying request takes a lot of time, but the request
itself does not timeout, e.g. if a large file is being
transmitted. The timeout error will be raised after such
request completes.
Returns:
google.auth.aio.transport.Response: The HTTP response.
Raises:
google.auth.exceptions.TimeoutError: If the method does not complete within
the configured `max_allowed_time` or the request exceeds the configured
`timeout`.
"""
if self._mtls_init_task:
try:
await self._mtls_init_task
except Exception:
# Suppress all exceptions from the background mTLS initialization task,
# allowing the request to fail naturally elsewhere.
pass
retries = _exponential_backoff.AsyncExponentialBackoff(
total_attempts=total_attempts,
)
if headers is None:
headers = {}
async with timeout_guard(max_allowed_time) as with_timeout:
await with_timeout(
# Note: before_request will attempt to refresh credentials if expired.
self._credentials.before_request(
self._auth_request, method, url, headers
)
)
actual_timeout: float = 0.0
if ClientTimeout is not None and isinstance(timeout, ClientTimeout):
actual_timeout = timeout.total if timeout.total is not None else 0.0
elif isinstance(timeout, (int, float)):
actual_timeout = float(timeout)
# Workaround issue in python 3.9 related to code coverage by adding `# pragma: no branch`
# See https://github.com/googleapis/gapic-generator-python/pull/1174#issuecomment-1025132372
async for _ in retries: # pragma: no branch
response = await with_timeout(
self._auth_request(
url, method, data, headers, actual_timeout, **kwargs
)
)
if response.status_code not in transport.DEFAULT_RETRYABLE_STATUS_CODES:
break
return response
@functools.wraps(request)
async def get(
self,
url: str,
data: Optional[bytes] = None,
headers: Optional[Mapping[str, str]] = None,
max_allowed_time: float = transport._DEFAULT_TIMEOUT_SECONDS,
timeout: Union[float, ClientTimeout] = transport._DEFAULT_TIMEOUT_SECONDS,
total_attempts: Optional[int] = transport.DEFAULT_MAX_RETRY_ATTEMPTS,
**kwargs,
) -> transport.Response:
"""
Args:
url (str): The URI to be requested.
data (Optional[bytes]): The payload or body in HTTP request.
headers (Optional[Mapping[str, str]]): Request headers.
max_allowed_time (float):
If the method runs longer than this, a ``Timeout`` exception is
automatically raised. Unlike the ``timeout`` parameter, this
value applies to the total method execution time, even if
multiple requests are made under the hood.
timeout (float, aiohttp.ClientTimeout):
The amount of time in seconds to wait for the server response
with each individual request.
total_attempts (int):
The total number of retry attempts.
Mind that it is not guaranteed that the timeout error is raised
at ``max_allowed_time``. It might take longer, for example, if
an underlying request takes a lot of time, but the request
itself does not timeout, e.g. if a large file is being
transmitted. The timeout error will be raised after such
request completes.
Returns:
google.auth.aio.transport.Response: The HTTP response.
Raises:
google.auth.exceptions.TimeoutError: If the method does not complete within
the configured `max_allowed_time` or the request exceeds the configured
`timeout`.
"""
return await self.request(
"GET",
url,
data,
headers,
max_allowed_time,
timeout,
total_attempts,
**kwargs,
)
@functools.wraps(request)
async def post(
self,
url: str,
data: Optional[bytes] = None,
headers: Optional[Mapping[str, str]] = None,
max_allowed_time: float = transport._DEFAULT_TIMEOUT_SECONDS,
timeout: Union[float, ClientTimeout] = transport._DEFAULT_TIMEOUT_SECONDS,
total_attempts: Optional[int] = transport.DEFAULT_MAX_RETRY_ATTEMPTS,
**kwargs,
) -> transport.Response:
"""
Args:
url (str): The URI to be requested.
data (Optional[bytes]): The payload or body in HTTP request.
headers (Optional[Mapping[str, str]]): Request headers.
max_allowed_time (float):
If the method runs longer than this, a ``Timeout`` exception is
automatically raised. Unlike the ``timeout`` parameter, this
value applies to the total method execution time, even if
multiple requests are made under the hood.
timeout (float, aiohttp.ClientTimeout):
The amount of time in seconds to wait for the server response
with each individual request.
total_attempts (int):
The total number of retry attempts.
Mind that it is not guaranteed that the timeout error is raised
at ``max_allowed_time``. It might take longer, for example, if
an underlying request takes a lot of time, but the request
itself does not timeout, e.g. if a large file is being
transmitted. The timeout error will be raised after such
request completes.
Returns:
google.auth.aio.transport.Response: The HTTP response.
Raises:
google.auth.exceptions.TimeoutError: If the method does not complete within
the configured `max_allowed_time` or the request exceeds the configured
`timeout`.
"""
return await self.request(
"POST",
url,
data,
headers,
max_allowed_time,
timeout,
total_attempts,
**kwargs,
)
@functools.wraps(request)
async def put(
self,
url: str,
data: Optional[bytes] = None,
headers: Optional[Mapping[str, str]] = None,
max_allowed_time: float = transport._DEFAULT_TIMEOUT_SECONDS,
timeout: Union[float, ClientTimeout] = transport._DEFAULT_TIMEOUT_SECONDS,
total_attempts: Optional[int] = transport.DEFAULT_MAX_RETRY_ATTEMPTS,
**kwargs,
) -> transport.Response:
"""
Args:
url (str): The URI to be requested.
data (Optional[bytes]): The payload or body in HTTP request.
headers (Optional[Mapping[str, str]]): Request headers.
max_allowed_time (float):
If the method runs longer than this, a ``Timeout`` exception is
automatically raised. Unlike the ``timeout`` parameter, this
value applies to the total method execution time, even if
multiple requests are made under the hood.
timeout (float, aiohttp.ClientTimeout):
The amount of time in seconds to wait for the server response
with each individual request.
total_attempts (int):
The total number of retry attempts.
Mind that it is not guaranteed that the timeout error is raised
at ``max_allowed_time``. It might take longer, for example, if
an underlying request takes a lot of time, but the request
itself does not timeout, e.g. if a large file is being
transmitted. The timeout error will be raised after such
request completes.
Returns:
google.auth.aio.transport.Response: The HTTP response.
Raises:
google.auth.exceptions.TimeoutError: If the method does not complete within
the configured `max_allowed_time` or the request exceeds the configured
`timeout`.
"""
return await self.request(
"PUT",
url,
data,
headers,
max_allowed_time,
timeout,
total_attempts,
**kwargs,
)
@functools.wraps(request)
async def patch(
self,
url: str,
data: Optional[bytes] = None,
headers: Optional[Mapping[str, str]] = None,
max_allowed_time: float = transport._DEFAULT_TIMEOUT_SECONDS,
timeout: Union[float, ClientTimeout] = transport._DEFAULT_TIMEOUT_SECONDS,
total_attempts: Optional[int] = transport.DEFAULT_MAX_RETRY_ATTEMPTS,
**kwargs,
) -> transport.Response:
"""
Args:
url (str): The URI to be requested.
data (Optional[bytes]): The payload or body in HTTP request.
headers (Optional[Mapping[str, str]]): Request headers.
max_allowed_time (float):
If the method runs longer than this, a ``Timeout`` exception is
automatically raised. Unlike the ``timeout`` parameter, this
value applies to the total method execution time, even if
multiple requests are made under the hood.
timeout (float, aiohttp.ClientTimeout):
The amount of time in seconds to wait for the server response
with each individual request.
total_attempts (int):
The total number of retry attempts.
Mind that it is not guaranteed that the timeout error is raised
at ``max_allowed_time``. It might take longer, for example, if
an underlying request takes a lot of time, but the request
itself does not timeout, e.g. if a large file is being
transmitted. The timeout error will be raised after such
request completes.
Returns:
google.auth.aio.transport.Response: The HTTP response.
Raises:
google.auth.exceptions.TimeoutError: If the method does not complete within
the configured `max_allowed_time` or the request exceeds the configured
`timeout`.
"""
return await self.request(
"PATCH",
url,
data,
headers,
max_allowed_time,
timeout,
total_attempts,
**kwargs,
)
@functools.wraps(request)
async def delete(
self,
url: str,
data: Optional[bytes] = None,
headers: Optional[Mapping[str, str]] = None,
max_allowed_time: float = transport._DEFAULT_TIMEOUT_SECONDS,
timeout: Union[float, ClientTimeout] = transport._DEFAULT_TIMEOUT_SECONDS,
total_attempts: Optional[int] = transport.DEFAULT_MAX_RETRY_ATTEMPTS,
**kwargs,
) -> transport.Response:
"""
Args:
url (str): The URI to be requested.
data (Optional[bytes]): The payload or body in HTTP request.
headers (Optional[Mapping[str, str]]): Request headers.
max_allowed_time (float):
If the method runs longer than this, a ``Timeout`` exception is
automatically raised. Unlike the ``timeout`` parameter, this
value applies to the total method execution time, even if
multiple requests are made under the hood.
timeout (float, aiohttp.ClientTimeout):
The amount of time in seconds to wait for the server response
with each individual request.
total_attempts (int):
The total number of retry attempts.
Mind that it is not guaranteed that the timeout error is raised
at ``max_allowed_time``. It might take longer, for example, if
an underlying request takes a lot of time, but the request
itself does not timeout, e.g. if a large file is being
transmitted. The timeout error will be raised after such
request completes.
Returns:
google.auth.aio.transport.Response: The HTTP response.
Raises:
google.auth.exceptions.TimeoutError: If the method does not complete within
the configured `max_allowed_time` or the request exceeds the configured
`timeout`.
"""
return await self.request(
"DELETE",
url,
data,
headers,
max_allowed_time,
timeout,
total_attempts,
**kwargs,
)
@property
def is_mtls(self):
"""Indicates if mutual TLS is enabled."""
return self._is_mtls
async def close(self) -> None:
"""
Close the underlying auth request session.
"""
await self._auth_request.close()