增加环绕侦察场景适配

This commit is contained in:
2026-01-08 15:44:38 +08:00
parent 3eba1f962b
commit 10c5bb5a8a
5441 changed files with 40219 additions and 379695 deletions

View File

@@ -27,10 +27,14 @@ class Python37DeprecationWarning(DeprecationWarning): # pragma: NO COVER
pass
# Checks if the current runtime is Python 3.7.
if sys.version_info.major == 3 and sys.version_info.minor == 7: # pragma: NO COVER
message = (
"After January 1, 2024, new releases of this library will drop support "
"for Python 3.7."
)
warnings.warn(message, Python37DeprecationWarning)
# Raise warnings for deprecated versions
eol_message = """
You are using a Python version {} past its end of life. Google will update
google-auth with critical bug fixes on a best-effort basis, but not
with any other fixes or features. Please upgrade your Python version,
and then update google-auth.
"""
if sys.version_info.major == 3 and sys.version_info.minor == 8: # pragma: NO COVER
warnings.warn(eol_message.format("3.8"), FutureWarning)
elif sys.version_info.major == 3 and sys.version_info.minor == 9: # pragma: NO COVER
warnings.warn(eol_message.format("3.9"), FutureWarning)

View File

@@ -256,7 +256,11 @@ def _token_endpoint_request(
an error.
"""
response_status_ok, response_data, retryable_error = _token_endpoint_request_no_throw(
(
response_status_ok,
response_data,
retryable_error,
) = _token_endpoint_request_no_throw(
request,
token_uri,
body,
@@ -568,9 +572,11 @@ def _lookup_trust_boundary_request(request, url, can_retry=True, headers=None):
google.auth.exceptions.RefreshError: If the token endpoint returned
an error.
"""
response_status_ok, response_data, retryable_error = _lookup_trust_boundary_request_no_throw(
request, url, can_retry, headers
)
(
response_status_ok,
response_data,
retryable_error,
) = _lookup_trust_boundary_request_no_throw(request, url, can_retry, headers)
if not response_status_ok:
_handle_error_response(response_data, retryable_error)
return response_data

View File

@@ -127,7 +127,11 @@ async def _token_endpoint_request(
an error.
"""
response_status_ok, response_data, retryable_error = await _token_endpoint_request_no_throw(
(
response_status_ok,
response_data,
retryable_error,
) = await _token_endpoint_request_no_throw(
request,
token_uri,
body,

View File

@@ -252,8 +252,10 @@ async def fetch_id_token(request, audience):
info = json.load(f)
if info.get("type") == "service_account":
credentials = service_account.IDTokenCredentials.from_service_account_info(
info, target_audience=audience
credentials = (
service_account.IDTokenCredentials.from_service_account_info(
info, target_audience=audience
)
)
await credentials.refresh(request)
return credentials.token

View File

@@ -290,9 +290,11 @@ async def refresh_grant(
if rapt_token:
body["rapt"] = rapt_token
response_status_ok, response_data, retryable_error = await _client_async._token_endpoint_request_no_throw(
request, token_uri, body
)
(
response_status_ok,
response_data,
retryable_error,
) = await _client_async._token_endpoint_request_no_throw(request, token_uri, body)
if (
not response_status_ok
and response_data.get("error") == reauth._REAUTH_NEEDED_ERROR

View File

@@ -141,7 +141,10 @@ class Credentials(credentials.ReadOnlyScoped, credentials.CredentialsWithQuotaPr
self.expiry = expiry
self._refresh_token = refresh_token
self._id_token = id_token
self._scopes = scopes
if scopes is not None and isinstance(scopes, set):
self._scopes = list(scopes)
else:
self._scopes = scopes
self._default_scopes = default_scopes
self._granted_scopes = granted_scopes
self._token_uri = token_uri
@@ -207,7 +210,7 @@ class Credentials(credentials.ReadOnlyScoped, credentials.CredentialsWithQuotaPr
@property
def scopes(self):
"""Optional[str]: The OAuth 2.0 permission scopes."""
"""Optional[Sequence[str]]: The OAuth 2.0 permission scopes."""
return self._scopes
@property

View File

@@ -54,14 +54,17 @@ library like `CacheControl`_ to create a cache-aware
http://openid.net/specs/openid-connect-core-1_0.html#IDToken
.. _CacheControl: https://cachecontrol.readthedocs.io
"""
from __future__ import annotations
import http.client as http_client
import json
import os
from typing import Any, Mapping, Union
from google.auth import environment_vars
from google.auth import exceptions
from google.auth import jwt
from google.auth import transport
# The URL that provides public certificates for verifying ID tokens issued
@@ -81,7 +84,7 @@ _GOOGLE_ISSUERS = ["accounts.google.com", "https://accounts.google.com"]
def _fetch_certs(request, certs_url):
"""Fetches certificates.
Google-style cerificate endpoints return JSON in the format of
Google-style certificate endpoints return JSON in the format of
``{'key id': 'x509 certificate'}`` or a certificate array according
to the JWK spec (see https://tools.ietf.org/html/rfc7517).
@@ -105,12 +108,12 @@ def _fetch_certs(request, certs_url):
def verify_token(
id_token,
request,
audience=None,
certs_url=_GOOGLE_OAUTH2_CERTS_URL,
clock_skew_in_seconds=0,
):
id_token: Union[str, bytes],
request: transport.Request,
audience: Union[str, list[str], None] = None,
certs_url: str = _GOOGLE_OAUTH2_CERTS_URL,
clock_skew_in_seconds: int = 0,
) -> Mapping[str, Any]:
"""Verifies an ID token and returns the decoded token.
Args:

View File

@@ -330,7 +330,11 @@ def refresh_grant(
body["rapt"] = rapt_token
metrics_header = {metrics.API_CLIENT_HEADER: metrics.token_request_user()}
response_status_ok, response_data, retryable_error = _client._token_endpoint_request_no_throw(
(
response_status_ok,
response_data,
retryable_error,
) = _client._token_endpoint_request_no_throw(
request, token_uri, body, headers=metrics_header
)

View File

@@ -434,7 +434,7 @@ class Credentials(
return metrics.CRED_TYPE_SA_ASSERTION
@_helpers.copy_docstring(credentials.CredentialsWithTrustBoundary)
def _refresh_token(self, request):
def _perform_refresh_token(self, request):
if self._always_use_jwt_access and not self._jwt_credentials:
# If self signed jwt should be used but jwt credential is not
# created, try to create one with scopes
@@ -482,7 +482,6 @@ class Credentials(
self._jwt_credentials is None
or self._jwt_credentials._audience != audience
):
self._jwt_credentials = jwt.Credentials.from_signing_credentials(
self, audience
)

View File

@@ -57,7 +57,7 @@ class Client(utils.OAuthClientAuthHandler):
super(Client, self).__init__(client_authentication)
self._token_exchange_endpoint = token_exchange_endpoint
def _make_request(self, request, headers, request_body):
def _make_request(self, request, headers, request_body, url=None):
# Initialize request headers.
request_headers = _URLENCODED_HEADERS.copy()
@@ -69,9 +69,12 @@ class Client(utils.OAuthClientAuthHandler):
# Apply OAuth client authentication.
self.apply_client_authentication_options(request_headers, request_body)
# Use default token exchange endpoint if no url is provided.
url = url or self._token_exchange_endpoint
# Execute request.
response = request(
url=self._token_exchange_endpoint,
url=url,
method="POST",
headers=request_headers,
body=urllib.parse.urlencode(request_body).encode("utf-8"),
@@ -87,10 +90,12 @@ class Client(utils.OAuthClientAuthHandler):
if response.status != http_client.OK:
utils.handle_error_response(response_body)
response_data = json.loads(response_body)
# A successful token revocation returns an empty response body.
if not response_body:
return {}
# Return successful response.
return response_data
# Other successful responses should be valid JSON.
return json.loads(response_body)
def exchange_token(
self,
@@ -174,3 +179,23 @@ class Client(utils.OAuthClientAuthHandler):
None,
{"grant_type": "refresh_token", "refresh_token": refresh_token},
)
def revoke_token(self, request, token, token_type_hint, revoke_url):
"""Revokes the provided token based on the RFC7009 spec.
Args:
request (google.auth.transport.Request): A callable used to make
HTTP requests.
token (str): The OAuth 2.0 token to revoke.
token_type_hint (str): Hint for the type of token being revoked.
revoke_url (str): The STS endpoint URL for revoking tokens.
Raises:
google.auth.exceptions.OAuthError: If the token revocation endpoint
returned an error.
"""
request_body = {"token": token}
if token_type_hint:
request_body["token_type_hint"] = token_type_hint
return self._make_request(request, None, request_body, revoke_url)

View File

@@ -20,7 +20,7 @@ class WebAuthnHandler(abc.ABC):
class PluginHandler(WebAuthnHandler):
"""Offloads WebAuthn get reqeust to a pluggable command-line tool.
"""Offloads WebAuthn get request to a pluggable command-line tool.
Offloads WebAuthn get to a plugin which takes the form of a
command-line tool. The command-line tool is configurable via the