authorizer / vendor / google / auth / src / ApplicationDefaultCredentials.php

ApplicationDefaultCredentials.php in Authorizer 3.6.0, at vendor/google/auth/src/ApplicationDefaultCredentials.php

347 lines 13.3 KB

Raw Download Zip

1	<?php
2	/*
3	* Copyright 2015 Google Inc.
4	*
5	* Licensed under the Apache License, Version 2.0 (the "License");
6	* you may not use this file except in compliance with the License.
7	* You may obtain a copy of the License at
8	*
9	* http://www.apache.org/licenses/LICENSE-2.0
10	*
11	* Unless required by applicable law or agreed to in writing, software
12	* distributed under the License is distributed on an "AS IS" BASIS,
13	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14	* See the License for the specific language governing permissions and
15	* limitations under the License.
16	*/
17
18	namespace Google\Auth;
19
20	use DomainException;
21	use Google\Auth\Credentials\AppIdentityCredentials;
22	use Google\Auth\Credentials\GCECredentials;
23	use Google\Auth\Credentials\ServiceAccountCredentials;
24	use Google\Auth\HttpHandler\HttpClientCache;
25	use Google\Auth\HttpHandler\HttpHandlerFactory;
26	use Google\Auth\Middleware\AuthTokenMiddleware;
27	use Google\Auth\Middleware\ProxyAuthTokenMiddleware;
28	use Google\Auth\Subscriber\AuthTokenSubscriber;
29	use GuzzleHttp\Client;
30	use InvalidArgumentException;
31	use Psr\Cache\CacheItemPoolInterface;
32
33	/**
34	* ApplicationDefaultCredentials obtains the default credentials for
35	* authorizing a request to a Google service.
36	*
37	* Application Default Credentials are described here:
38	* https://developers.google.com/accounts/docs/application-default-credentials
39	*
40	* This class implements the search for the application default credentials as
41	* described in the link.
42	*
43	* It provides three factory methods:
44	* - #get returns the computed credentials object
45	* - #getSubscriber returns an AuthTokenSubscriber built from the credentials object
46	* - #getMiddleware returns an AuthTokenMiddleware built from the credentials object
47	*
48	* This allows it to be used as follows with GuzzleHttp\Client:
49	*
50	* ```
51	* use Google\Auth\ApplicationDefaultCredentials;
52	* use GuzzleHttp\Client;
53	* use GuzzleHttp\HandlerStack;
54	*
55	* $middleware = ApplicationDefaultCredentials::getMiddleware(
56	* 'https://www.googleapis.com/auth/taskqueue'
57	* );
58	* $stack = HandlerStack::create();
59	* $stack->push($middleware);
60	*
61	* $client = new Client([
62	* 'handler' => $stack,
63	* 'base_uri' => 'https://www.googleapis.com/taskqueue/v1beta2/projects/',
64	* 'auth' => 'google_auth' // authorize all requests
65	* ]);
66	*
67	* $res = $client->get('myproject/taskqueues/myqueue');
68	* ```
69	*/
70	class ApplicationDefaultCredentials
71	{
72	/**
73	* @deprecated
74	*
75	* Obtains an AuthTokenSubscriber that uses the default FetchAuthTokenInterface
76	* implementation to use in this environment.
77	*
78	* If supplied, $scope is used to in creating the credentials instance if
79	* this does not fallback to the compute engine defaults.
80	*
81	* @param string\|string[] $scope the scope of the access request, expressed
82	* either as an Array or as a space-delimited String.
83	* @param callable $httpHandler callback which delivers psr7 request
84	* @param array<mixed> $cacheConfig configuration for the cache when it's present
85	* @param CacheItemPoolInterface $cache A cache implementation, may be
86	* provided if you have one already available for use.
87	* @return AuthTokenSubscriber
88	* @throws DomainException if no implementation can be obtained.
89	*/
90	public static function getSubscriber(// @phpstan-ignore-line
91	$scope = null,
92	callable $httpHandler = null,
93	array $cacheConfig = null,
94	CacheItemPoolInterface $cache = null
95	) {
96	$creds = self::getCredentials($scope, $httpHandler, $cacheConfig, $cache);
97
98	/** @phpstan-ignore-next-line */
99	return new AuthTokenSubscriber($creds, $httpHandler);
100	}
101
102	/**
103	* Obtains an AuthTokenMiddleware that uses the default FetchAuthTokenInterface
104	* implementation to use in this environment.
105	*
106	* If supplied, $scope is used to in creating the credentials instance if
107	* this does not fallback to the compute engine defaults.
108	*
109	* @param string\|string[] $scope the scope of the access request, expressed
110	* either as an Array or as a space-delimited String.
111	* @param callable $httpHandler callback which delivers psr7 request
112	* @param array<mixed> $cacheConfig configuration for the cache when it's present
113	* @param CacheItemPoolInterface $cache A cache implementation, may be
114	* provided if you have one already available for use.
115	* @param string $quotaProject specifies a project to bill for access
116	* charges associated with the request.
117	* @return AuthTokenMiddleware
118	* @throws DomainException if no implementation can be obtained.
119	*/
120	public static function getMiddleware(
121	$scope = null,
122	callable $httpHandler = null,
123	array $cacheConfig = null,
124	CacheItemPoolInterface $cache = null,
125	$quotaProject = null
126	) {
127	$creds = self::getCredentials($scope, $httpHandler, $cacheConfig, $cache, $quotaProject);
128
129	return new AuthTokenMiddleware($creds, $httpHandler);
130	}
131
132	/**
133	* Obtains the default FetchAuthTokenInterface implementation to use
134	* in this environment.
135	*
136	* @param string\|string[] $scope the scope of the access request, expressed
137	* either as an Array or as a space-delimited String.
138	* @param callable $httpHandler callback which delivers psr7 request
139	* @param array<mixed> $cacheConfig configuration for the cache when it's present
140	* @param CacheItemPoolInterface $cache A cache implementation, may be
141	* provided if you have one already available for use.
142	* @param string $quotaProject specifies a project to bill for access
143	* charges associated with the request.
144	* @param string\|string[] $defaultScope The default scope to use if no
145	* user-defined scopes exist, expressed either as an Array or as a
146	* space-delimited string.
147	*
148	* @return FetchAuthTokenInterface
149	* @throws DomainException if no implementation can be obtained.
150	*/
151	public static function getCredentials(
152	$scope = null,
153	callable $httpHandler = null,
154	array $cacheConfig = null,
155	CacheItemPoolInterface $cache = null,
156	$quotaProject = null,
157	$defaultScope = null
158	) {
159	$creds = null;
160	$jsonKey = CredentialsLoader::fromEnv()
161	?: CredentialsLoader::fromWellKnownFile();
162	$anyScope = $scope ?: $defaultScope;
163
164	if (!$httpHandler) {
165	if (!($client = HttpClientCache::getHttpClient())) {
166	$client = new Client();
167	HttpClientCache::setHttpClient($client);
168	}
169
170	$httpHandler = HttpHandlerFactory::build($client);
171	}
172
173	if (!is_null($jsonKey)) {
174	if ($quotaProject) {
175	$jsonKey['quota_project_id'] = $quotaProject;
176	}
177	$creds = CredentialsLoader::makeCredentials(
178	$scope,
179	$jsonKey,
180	$defaultScope
181	);
182	} elseif (AppIdentityCredentials::onAppEngine() && !GCECredentials::onAppEngineFlexible()) {
183	$creds = new AppIdentityCredentials($anyScope);
184	} elseif (self::onGce($httpHandler, $cacheConfig, $cache)) {
185	$creds = new GCECredentials(null, $anyScope, null, $quotaProject);
186	$creds->setIsOnGce(true); // save the credentials a trip to the metadata server
187	}
188
189	if (is_null($creds)) {
190	throw new DomainException(self::notFound());
191	}
192	if (!is_null($cache)) {
193	$creds = new FetchAuthTokenCache($creds, $cacheConfig, $cache);
194	}
195	return $creds;
196	}
197
198	/**
199	* Obtains an AuthTokenMiddleware which will fetch an ID token to use in the
200	* Authorization header. The middleware is configured with the default
201	* FetchAuthTokenInterface implementation to use in this environment.
202	*
203	* If supplied, $targetAudience is used to set the "aud" on the resulting
204	* ID token.
205	*
206	* @param string $targetAudience The audience for the ID token.
207	* @param callable $httpHandler callback which delivers psr7 request
208	* @param array<mixed> $cacheConfig configuration for the cache when it's present
209	* @param CacheItemPoolInterface $cache A cache implementation, may be
210	* provided if you have one already available for use.
211	* @return AuthTokenMiddleware
212	* @throws DomainException if no implementation can be obtained.
213	*/
214	public static function getIdTokenMiddleware(
215	$targetAudience,
216	callable $httpHandler = null,
217	array $cacheConfig = null,
218	CacheItemPoolInterface $cache = null
219	) {
220	$creds = self::getIdTokenCredentials($targetAudience, $httpHandler, $cacheConfig, $cache);
221
222	return new AuthTokenMiddleware($creds, $httpHandler);
223	}
224
225	/**
226	* Obtains an ProxyAuthTokenMiddleware which will fetch an ID token to use in the
227	* Authorization header. The middleware is configured with the default
228	* FetchAuthTokenInterface implementation to use in this environment.
229	*
230	* If supplied, $targetAudience is used to set the "aud" on the resulting
231	* ID token.
232	*
233	* @param string $targetAudience The audience for the ID token.
234	* @param callable $httpHandler callback which delivers psr7 request
235	* @param array<mixed> $cacheConfig configuration for the cache when it's present
236	* @param CacheItemPoolInterface $cache A cache implementation, may be
237	* provided if you have one already available for use.
238	* @return ProxyAuthTokenMiddleware
239	* @throws DomainException if no implementation can be obtained.
240	*/
241	public static function getProxyIdTokenMiddleware(
242	$targetAudience,
243	callable $httpHandler = null,
244	array $cacheConfig = null,
245	CacheItemPoolInterface $cache = null
246	) {
247	$creds = self::getIdTokenCredentials($targetAudience, $httpHandler, $cacheConfig, $cache);
248
249	return new ProxyAuthTokenMiddleware($creds, $httpHandler);
250	}
251
252	/**
253	* Obtains the default FetchAuthTokenInterface implementation to use
254	* in this environment, configured with a $targetAudience for fetching an ID
255	* token.
256	*
257	* @param string $targetAudience The audience for the ID token.
258	* @param callable $httpHandler callback which delivers psr7 request
259	* @param array<mixed> $cacheConfig configuration for the cache when it's present
260	* @param CacheItemPoolInterface $cache A cache implementation, may be
261	* provided if you have one already available for use.
262	* @return FetchAuthTokenInterface
263	* @throws DomainException if no implementation can be obtained.
264	* @throws InvalidArgumentException if JSON "type" key is invalid
265	*/
266	public static function getIdTokenCredentials(
267	$targetAudience,
268	callable $httpHandler = null,
269	array $cacheConfig = null,
270	CacheItemPoolInterface $cache = null
271	) {
272	$creds = null;
273	$jsonKey = CredentialsLoader::fromEnv()
274	?: CredentialsLoader::fromWellKnownFile();
275
276	if (!$httpHandler) {
277	if (!($client = HttpClientCache::getHttpClient())) {
278	$client = new Client();
279	HttpClientCache::setHttpClient($client);
280	}
281
282	$httpHandler = HttpHandlerFactory::build($client);
283	}
284
285	if (!is_null($jsonKey)) {
286	if (!array_key_exists('type', $jsonKey)) {
287	throw new \InvalidArgumentException('json key is missing the type field');
288	}
289
290	if ($jsonKey['type'] == 'authorized_user') {
291	throw new InvalidArgumentException('ID tokens are not supported for end user credentials');
292	}
293
294	if ($jsonKey['type'] != 'service_account') {
295	throw new InvalidArgumentException('invalid value in the type field');
296	}
297
298	$creds = new ServiceAccountCredentials(null, $jsonKey, null, $targetAudience);
299	} elseif (self::onGce($httpHandler, $cacheConfig, $cache)) {
300	$creds = new GCECredentials(null, null, $targetAudience);
301	$creds->setIsOnGce(true); // save the credentials a trip to the metadata server
302	}
303
304	if (is_null($creds)) {
305	throw new DomainException(self::notFound());
306	}
307	if (!is_null($cache)) {
308	$creds = new FetchAuthTokenCache($creds, $cacheConfig, $cache);
309	}
310	return $creds;
311	}
312
313	/**
314	* @return string
315	*/
316	private static function notFound()
317	{
318	$msg = 'Could not load the default credentials. Browse to ';
319	$msg .= 'https://developers.google.com';
320	$msg .= '/accounts/docs/application-default-credentials';
321	$msg .= ' for more information';
322
323	return $msg;
324	}
325
326	/**
327	* @param callable $httpHandler
328	* @param array<mixed> $cacheConfig
329	* @param CacheItemPoolInterface $cache
330	* @return bool
331	*/
332	private static function onGce(
333	callable $httpHandler = null,
334	array $cacheConfig = null,
335	CacheItemPoolInterface $cache = null
336	) {
337	$gceCacheConfig = [];
338	foreach (['lifetime', 'prefix'] as $key) {
339	if (isset($cacheConfig['gce_' . $key])) {
340	$gceCacheConfig[$key] = $cacheConfig['gce_' . $key];
341	}
342	}
343
344	return (new GCECache($gceCacheConfig, $cache))->onGce($httpHandler);
345	}
346	}
347