增加环绕侦察场景适配
This commit is contained in:
@@ -27,10 +27,14 @@ class Python37DeprecationWarning(DeprecationWarning): # pragma: NO COVER
|
||||
pass
|
||||
|
||||
|
||||
# Checks if the current runtime is Python 3.7.
|
||||
if sys.version_info.major == 3 and sys.version_info.minor == 7: # pragma: NO COVER
|
||||
message = (
|
||||
"After January 1, 2024, new releases of this library will drop support "
|
||||
"for Python 3.7."
|
||||
)
|
||||
warnings.warn(message, Python37DeprecationWarning)
|
||||
# Raise warnings for deprecated versions
|
||||
eol_message = """
|
||||
You are using a Python version {} past its end of life. Google will update
|
||||
google-auth with critical bug fixes on a best-effort basis, but not
|
||||
with any other fixes or features. Please upgrade your Python version,
|
||||
and then update google-auth.
|
||||
"""
|
||||
if sys.version_info.major == 3 and sys.version_info.minor == 8: # pragma: NO COVER
|
||||
warnings.warn(eol_message.format("3.8"), FutureWarning)
|
||||
elif sys.version_info.major == 3 and sys.version_info.minor == 9: # pragma: NO COVER
|
||||
warnings.warn(eol_message.format("3.9"), FutureWarning)
|
||||
|
||||
@@ -256,7 +256,11 @@ def _token_endpoint_request(
|
||||
an error.
|
||||
"""
|
||||
|
||||
response_status_ok, response_data, retryable_error = _token_endpoint_request_no_throw(
|
||||
(
|
||||
response_status_ok,
|
||||
response_data,
|
||||
retryable_error,
|
||||
) = _token_endpoint_request_no_throw(
|
||||
request,
|
||||
token_uri,
|
||||
body,
|
||||
@@ -568,9 +572,11 @@ def _lookup_trust_boundary_request(request, url, can_retry=True, headers=None):
|
||||
google.auth.exceptions.RefreshError: If the token endpoint returned
|
||||
an error.
|
||||
"""
|
||||
response_status_ok, response_data, retryable_error = _lookup_trust_boundary_request_no_throw(
|
||||
request, url, can_retry, headers
|
||||
)
|
||||
(
|
||||
response_status_ok,
|
||||
response_data,
|
||||
retryable_error,
|
||||
) = _lookup_trust_boundary_request_no_throw(request, url, can_retry, headers)
|
||||
if not response_status_ok:
|
||||
_handle_error_response(response_data, retryable_error)
|
||||
return response_data
|
||||
|
||||
@@ -127,7 +127,11 @@ async def _token_endpoint_request(
|
||||
an error.
|
||||
"""
|
||||
|
||||
response_status_ok, response_data, retryable_error = await _token_endpoint_request_no_throw(
|
||||
(
|
||||
response_status_ok,
|
||||
response_data,
|
||||
retryable_error,
|
||||
) = await _token_endpoint_request_no_throw(
|
||||
request,
|
||||
token_uri,
|
||||
body,
|
||||
|
||||
@@ -252,8 +252,10 @@ async def fetch_id_token(request, audience):
|
||||
|
||||
info = json.load(f)
|
||||
if info.get("type") == "service_account":
|
||||
credentials = service_account.IDTokenCredentials.from_service_account_info(
|
||||
info, target_audience=audience
|
||||
credentials = (
|
||||
service_account.IDTokenCredentials.from_service_account_info(
|
||||
info, target_audience=audience
|
||||
)
|
||||
)
|
||||
await credentials.refresh(request)
|
||||
return credentials.token
|
||||
|
||||
@@ -290,9 +290,11 @@ async def refresh_grant(
|
||||
if rapt_token:
|
||||
body["rapt"] = rapt_token
|
||||
|
||||
response_status_ok, response_data, retryable_error = await _client_async._token_endpoint_request_no_throw(
|
||||
request, token_uri, body
|
||||
)
|
||||
(
|
||||
response_status_ok,
|
||||
response_data,
|
||||
retryable_error,
|
||||
) = await _client_async._token_endpoint_request_no_throw(request, token_uri, body)
|
||||
if (
|
||||
not response_status_ok
|
||||
and response_data.get("error") == reauth._REAUTH_NEEDED_ERROR
|
||||
|
||||
@@ -141,7 +141,10 @@ class Credentials(credentials.ReadOnlyScoped, credentials.CredentialsWithQuotaPr
|
||||
self.expiry = expiry
|
||||
self._refresh_token = refresh_token
|
||||
self._id_token = id_token
|
||||
self._scopes = scopes
|
||||
if scopes is not None and isinstance(scopes, set):
|
||||
self._scopes = list(scopes)
|
||||
else:
|
||||
self._scopes = scopes
|
||||
self._default_scopes = default_scopes
|
||||
self._granted_scopes = granted_scopes
|
||||
self._token_uri = token_uri
|
||||
@@ -207,7 +210,7 @@ class Credentials(credentials.ReadOnlyScoped, credentials.CredentialsWithQuotaPr
|
||||
|
||||
@property
|
||||
def scopes(self):
|
||||
"""Optional[str]: The OAuth 2.0 permission scopes."""
|
||||
"""Optional[Sequence[str]]: The OAuth 2.0 permission scopes."""
|
||||
return self._scopes
|
||||
|
||||
@property
|
||||
|
||||
@@ -54,14 +54,17 @@ library like `CacheControl`_ to create a cache-aware
|
||||
http://openid.net/specs/openid-connect-core-1_0.html#IDToken
|
||||
.. _CacheControl: https://cachecontrol.readthedocs.io
|
||||
"""
|
||||
from __future__ import annotations
|
||||
|
||||
import http.client as http_client
|
||||
import json
|
||||
import os
|
||||
from typing import Any, Mapping, Union
|
||||
|
||||
from google.auth import environment_vars
|
||||
from google.auth import exceptions
|
||||
from google.auth import jwt
|
||||
from google.auth import transport
|
||||
|
||||
|
||||
# The URL that provides public certificates for verifying ID tokens issued
|
||||
@@ -81,7 +84,7 @@ _GOOGLE_ISSUERS = ["accounts.google.com", "https://accounts.google.com"]
|
||||
def _fetch_certs(request, certs_url):
|
||||
"""Fetches certificates.
|
||||
|
||||
Google-style cerificate endpoints return JSON in the format of
|
||||
Google-style certificate endpoints return JSON in the format of
|
||||
``{'key id': 'x509 certificate'}`` or a certificate array according
|
||||
to the JWK spec (see https://tools.ietf.org/html/rfc7517).
|
||||
|
||||
@@ -105,12 +108,12 @@ def _fetch_certs(request, certs_url):
|
||||
|
||||
|
||||
def verify_token(
|
||||
id_token,
|
||||
request,
|
||||
audience=None,
|
||||
certs_url=_GOOGLE_OAUTH2_CERTS_URL,
|
||||
clock_skew_in_seconds=0,
|
||||
):
|
||||
id_token: Union[str, bytes],
|
||||
request: transport.Request,
|
||||
audience: Union[str, list[str], None] = None,
|
||||
certs_url: str = _GOOGLE_OAUTH2_CERTS_URL,
|
||||
clock_skew_in_seconds: int = 0,
|
||||
) -> Mapping[str, Any]:
|
||||
"""Verifies an ID token and returns the decoded token.
|
||||
|
||||
Args:
|
||||
|
||||
@@ -330,7 +330,11 @@ def refresh_grant(
|
||||
body["rapt"] = rapt_token
|
||||
metrics_header = {metrics.API_CLIENT_HEADER: metrics.token_request_user()}
|
||||
|
||||
response_status_ok, response_data, retryable_error = _client._token_endpoint_request_no_throw(
|
||||
(
|
||||
response_status_ok,
|
||||
response_data,
|
||||
retryable_error,
|
||||
) = _client._token_endpoint_request_no_throw(
|
||||
request, token_uri, body, headers=metrics_header
|
||||
)
|
||||
|
||||
|
||||
@@ -434,7 +434,7 @@ class Credentials(
|
||||
return metrics.CRED_TYPE_SA_ASSERTION
|
||||
|
||||
@_helpers.copy_docstring(credentials.CredentialsWithTrustBoundary)
|
||||
def _refresh_token(self, request):
|
||||
def _perform_refresh_token(self, request):
|
||||
if self._always_use_jwt_access and not self._jwt_credentials:
|
||||
# If self signed jwt should be used but jwt credential is not
|
||||
# created, try to create one with scopes
|
||||
@@ -482,7 +482,6 @@ class Credentials(
|
||||
self._jwt_credentials is None
|
||||
or self._jwt_credentials._audience != audience
|
||||
):
|
||||
|
||||
self._jwt_credentials = jwt.Credentials.from_signing_credentials(
|
||||
self, audience
|
||||
)
|
||||
|
||||
@@ -57,7 +57,7 @@ class Client(utils.OAuthClientAuthHandler):
|
||||
super(Client, self).__init__(client_authentication)
|
||||
self._token_exchange_endpoint = token_exchange_endpoint
|
||||
|
||||
def _make_request(self, request, headers, request_body):
|
||||
def _make_request(self, request, headers, request_body, url=None):
|
||||
# Initialize request headers.
|
||||
request_headers = _URLENCODED_HEADERS.copy()
|
||||
|
||||
@@ -69,9 +69,12 @@ class Client(utils.OAuthClientAuthHandler):
|
||||
# Apply OAuth client authentication.
|
||||
self.apply_client_authentication_options(request_headers, request_body)
|
||||
|
||||
# Use default token exchange endpoint if no url is provided.
|
||||
url = url or self._token_exchange_endpoint
|
||||
|
||||
# Execute request.
|
||||
response = request(
|
||||
url=self._token_exchange_endpoint,
|
||||
url=url,
|
||||
method="POST",
|
||||
headers=request_headers,
|
||||
body=urllib.parse.urlencode(request_body).encode("utf-8"),
|
||||
@@ -87,10 +90,12 @@ class Client(utils.OAuthClientAuthHandler):
|
||||
if response.status != http_client.OK:
|
||||
utils.handle_error_response(response_body)
|
||||
|
||||
response_data = json.loads(response_body)
|
||||
# A successful token revocation returns an empty response body.
|
||||
if not response_body:
|
||||
return {}
|
||||
|
||||
# Return successful response.
|
||||
return response_data
|
||||
# Other successful responses should be valid JSON.
|
||||
return json.loads(response_body)
|
||||
|
||||
def exchange_token(
|
||||
self,
|
||||
@@ -174,3 +179,23 @@ class Client(utils.OAuthClientAuthHandler):
|
||||
None,
|
||||
{"grant_type": "refresh_token", "refresh_token": refresh_token},
|
||||
)
|
||||
|
||||
def revoke_token(self, request, token, token_type_hint, revoke_url):
|
||||
"""Revokes the provided token based on the RFC7009 spec.
|
||||
|
||||
Args:
|
||||
request (google.auth.transport.Request): A callable used to make
|
||||
HTTP requests.
|
||||
token (str): The OAuth 2.0 token to revoke.
|
||||
token_type_hint (str): Hint for the type of token being revoked.
|
||||
revoke_url (str): The STS endpoint URL for revoking tokens.
|
||||
|
||||
Raises:
|
||||
google.auth.exceptions.OAuthError: If the token revocation endpoint
|
||||
returned an error.
|
||||
"""
|
||||
request_body = {"token": token}
|
||||
if token_type_hint:
|
||||
request_body["token_type_hint"] = token_type_hint
|
||||
|
||||
return self._make_request(request, None, request_body, revoke_url)
|
||||
|
||||
@@ -20,7 +20,7 @@ class WebAuthnHandler(abc.ABC):
|
||||
|
||||
|
||||
class PluginHandler(WebAuthnHandler):
|
||||
"""Offloads WebAuthn get reqeust to a pluggable command-line tool.
|
||||
"""Offloads WebAuthn get request to a pluggable command-line tool.
|
||||
|
||||
Offloads WebAuthn get to a plugin which takes the form of a
|
||||
command-line tool. The command-line tool is configurable via the
|
||||
|
||||
Reference in New Issue
Block a user