← All changes
|
includes/sdk/google/google/auth/src/ApplicationDefaultCredentials.php
+92
-63
1.2.10
→
1.4.1
View file →
| @@ -14,22 +14,26 @@ | ||
| 14 | 14 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 15 | 15 | * See the License for the specific language governing permissions and |
| 16 | 16 | * limitations under the License. |
| 17 | 17 | */ |
| 18 | -namespace Dudlewebs\WPMCS\Google\Auth; | |
| 18 | +namespace Dudlewebs\WPMCS\GCP\Google\Auth; | |
| 19 | 19 | |
| 20 | 20 | use DomainException; |
| 21 | -use Dudlewebs\WPMCS\Google\Auth\Credentials\AppIdentityCredentials; | |
| 22 | -use Dudlewebs\WPMCS\Google\Auth\Credentials\GCECredentials; | |
| 23 | -use Dudlewebs\WPMCS\Google\Auth\Credentials\ServiceAccountCredentials; | |
| 24 | -use Dudlewebs\WPMCS\Google\Auth\HttpHandler\HttpClientCache; | |
| 25 | -use Dudlewebs\WPMCS\Google\Auth\HttpHandler\HttpHandlerFactory; | |
| 26 | -use Dudlewebs\WPMCS\Google\Auth\Middleware\AuthTokenMiddleware; | |
| 27 | -use Dudlewebs\WPMCS\Google\Auth\Middleware\ProxyAuthTokenMiddleware; | |
| 28 | -use Dudlewebs\WPMCS\Google\Auth\Subscriber\AuthTokenSubscriber; | |
| 29 | -use Dudlewebs\WPMCS\GuzzleHttp\Client; | |
| 21 | +use Dudlewebs\WPMCS\GCP\Google\Auth\Credentials\AppIdentityCredentials; | |
| 22 | +use Dudlewebs\WPMCS\GCP\Google\Auth\Credentials\GCECredentials; | |
| 23 | +use Dudlewebs\WPMCS\GCP\Google\Auth\Credentials\ImpersonatedServiceAccountCredentials; | |
| 24 | +use Dudlewebs\WPMCS\GCP\Google\Auth\Credentials\ServiceAccountCredentials; | |
| 25 | +use Dudlewebs\WPMCS\GCP\Google\Auth\Credentials\UserRefreshCredentials; | |
| 26 | +use Dudlewebs\WPMCS\GCP\Google\Auth\HttpHandler\HttpClientCache; | |
| 27 | +use Dudlewebs\WPMCS\GCP\Google\Auth\HttpHandler\HttpHandlerFactory; | |
| 28 | +use Dudlewebs\WPMCS\GCP\Google\Auth\Logging\StdOutLogger; | |
| 29 | +use Dudlewebs\WPMCS\GCP\Google\Auth\Middleware\AuthTokenMiddleware; | |
| 30 | +use Dudlewebs\WPMCS\GCP\Google\Auth\Middleware\ProxyAuthTokenMiddleware; | |
| 31 | +use Dudlewebs\WPMCS\GCP\Google\Auth\Subscriber\AuthTokenSubscriber; | |
| 32 | +use Dudlewebs\WPMCS\GCP\GuzzleHttp\Client; | |
| 30 | 33 | use InvalidArgumentException; |
| 31 | -use Dudlewebs\WPMCS\Psr\Cache\CacheItemPoolInterface; | |
| 34 | +use Dudlewebs\WPMCS\GCP\Psr\Cache\CacheItemPoolInterface; | |
| 35 | +use Dudlewebs\WPMCS\GCP\Psr\Log\LoggerInterface; | |
| 32 | 36 | /** |
| 33 | 37 | * ApplicationDefaultCredentials obtains the default credentials for |
| 34 | 38 | * authorizing a request to a Google service. |
| 35 | 39 | * |
| @@ -67,8 +71,9 @@ | ||
| 67 | 71 | * ``` |
| 68 | 72 | */ |
| 69 | 73 | class ApplicationDefaultCredentials |
| 70 | 74 | { |
| 75 | + private const SDK_DEBUG_ENV_VAR = 'GOOGLE_SDK_PHP_LOGGING'; | |
| 71 | 76 | /** |
| 72 | 77 | * @deprecated |
| 73 | 78 | * |
| 74 | 79 | * Obtains an AuthTokenSubscriber that uses the default FetchAuthTokenInterface |
| @@ -78,11 +83,11 @@ | ||
| 78 | 83 | * this does not fallback to the compute engine defaults. |
| 79 | 84 | * |
| 80 | 85 | * @param string|string[] $scope the scope of the access request, expressed |
| 81 | 86 | * either as an Array or as a space-delimited String. |
| 82 | - * @param callable $httpHandler callback which delivers psr7 request | |
| 83 | - * @param array<mixed> $cacheConfig configuration for the cache when it's present | |
| 84 | - * @param CacheItemPoolInterface $cache A cache implementation, may be | |
| 87 | + * @param callable|null $httpHandler callback which delivers psr7 request | |
| 88 | + * @param array<mixed>|null $cacheConfig configuration for the cache when it's present | |
| 89 | + * @param CacheItemPoolInterface|null $cache A cache implementation, may be | |
| 85 | 90 | * provided if you have one already available for use. |
| 86 | 91 | * @return AuthTokenSubscriber |
| 87 | 92 | * @throws DomainException if no implementation can be obtained. |
| 88 | 93 | */ |
| @@ -88,11 +93,11 @@ | ||
| 88 | 93 | */ |
| 89 | 94 | public static function getSubscriber( |
| 90 | 95 | // @phpstan-ignore-line |
| 91 | 96 | $scope = null, |
| 92 | - callable $httpHandler = null, | |
| 93 | - array $cacheConfig = null, | |
| 94 | - CacheItemPoolInterface $cache = null | |
| 97 | + ?callable $httpHandler = null, | |
| 98 | + ?array $cacheConfig = null, | |
| 99 | + ?CacheItemPoolInterface $cache = null | |
| 95 | 100 | ) |
| 96 | 101 | { |
| 97 | 102 | $creds = self::getCredentials($scope, $httpHandler, $cacheConfig, $cache); |
| 98 | 103 | /** @phpstan-ignore-next-line */ |
| @@ -106,11 +111,11 @@ | ||
| 106 | 111 | * this does not fallback to the compute engine defaults. |
| 107 | 112 | * |
| 108 | 113 | * @param string|string[] $scope the scope of the access request, expressed |
| 109 | 114 | * either as an Array or as a space-delimited String. |
| 110 | - * @param callable $httpHandler callback which delivers psr7 request | |
| 111 | - * @param array<mixed> $cacheConfig configuration for the cache when it's present | |
| 112 | - * @param CacheItemPoolInterface $cache A cache implementation, may be | |
| 115 | + * @param callable|null $httpHandler callback which delivers psr7 request | |
| 116 | + * @param array<mixed>|null $cacheConfig configuration for the cache when it's present | |
| 117 | + * @param CacheItemPoolInterface|null $cache A cache implementation, may be | |
| 113 | 118 | * provided if you have one already available for use. |
| 114 | 119 | * @param string $quotaProject specifies a project to bill for access |
| 115 | 120 | * charges associated with the request. |
| 116 | 121 | * @return AuthTokenMiddleware |
| @@ -115,9 +120,9 @@ | ||
| 115 | 120 | * charges associated with the request. |
| 116 | 121 | * @return AuthTokenMiddleware |
| 117 | 122 | * @throws DomainException if no implementation can be obtained. |
| 118 | 123 | */ |
| 119 | - public static function getMiddleware($scope = null, callable $httpHandler = null, array $cacheConfig = null, CacheItemPoolInterface $cache = null, $quotaProject = null) | |
| 124 | + public static function getMiddleware($scope = null, ?callable $httpHandler = null, ?array $cacheConfig = null, ?CacheItemPoolInterface $cache = null, $quotaProject = null) | |
| 120 | 125 | { |
| 121 | 126 | $creds = self::getCredentials($scope, $httpHandler, $cacheConfig, $cache, $quotaProject); |
| 122 | 127 | return new AuthTokenMiddleware($creds, $httpHandler); |
| 123 | 128 | } |
| @@ -126,40 +131,41 @@ | ||
| 126 | 131 | * in this environment. |
| 127 | 132 | * |
| 128 | 133 | * @param string|string[] $scope the scope of the access request, expressed |
| 129 | 134 | * either as an Array or as a space-delimited String. |
| 130 | - * @param callable $httpHandler callback which delivers psr7 request | |
| 131 | - * @param array<mixed> $cacheConfig configuration for the cache when it's present | |
| 132 | - * @param CacheItemPoolInterface $cache A cache implementation, may be | |
| 135 | + * @param callable|null $httpHandler callback which delivers psr7 request | |
| 136 | + * @param array<mixed>|null $cacheConfig configuration for the cache when it's present | |
| 137 | + * @param CacheItemPoolInterface|null $cache A cache implementation, may be | |
| 133 | 138 | * provided if you have one already available for use. |
| 134 | - * @param string $quotaProject specifies a project to bill for access | |
| 139 | + * @param string|null $quotaProject specifies a project to bill for access | |
| 135 | 140 | * charges associated with the request. |
| 136 | - * @param string|string[] $defaultScope The default scope to use if no | |
| 141 | + * @param string|string[]|null $defaultScope The default scope to use if no | |
| 137 | 142 | * user-defined scopes exist, expressed either as an Array or as a |
| 138 | 143 | * space-delimited string. |
| 139 | - * @param string $universeDomain Specifies a universe domain to use for the | |
| 140 | - * calling client library | |
| 144 | + * @param string|null $universeDomain Specifies a universe domain to use for the | |
| 145 | + * calling client library. | |
| 146 | + * @param null|false|LoggerInterface $logger A PSR3 compliant LoggerInterface. | |
| 141 | 147 | * |
| 142 | 148 | * @return FetchAuthTokenInterface |
| 143 | 149 | * @throws DomainException if no implementation can be obtained. |
| 144 | 150 | */ |
| 145 | - public static function getCredentials($scope = null, callable $httpHandler = null, array $cacheConfig = null, CacheItemPoolInterface $cache = null, $quotaProject = null, $defaultScope = null, string $universeDomain = null) | |
| 151 | + public static function getCredentials($scope = null, ?callable $httpHandler = null, ?array $cacheConfig = null, ?CacheItemPoolInterface $cache = null, $quotaProject = null, $defaultScope = null, ?string $universeDomain = null, null|false|LoggerInterface $logger = null) | |
| 146 | 152 | { |
| 147 | 153 | $creds = null; |
| 148 | 154 | $jsonKey = CredentialsLoader::fromEnv() ?: CredentialsLoader::fromWellKnownFile(); |
| 149 | 155 | $anyScope = $scope ?: $defaultScope; |
| 150 | 156 | if (!$httpHandler) { |
| 151 | - if (!$client = HttpClientCache::getHttpClient()) { | |
| 157 | + if (!($client = HttpClientCache::getHttpClient())) { | |
| 152 | 158 | $client = new Client(); |
| 153 | 159 | HttpClientCache::setHttpClient($client); |
| 154 | 160 | } |
| 155 | - $httpHandler = HttpHandlerFactory::build($client); | |
| 161 | + $httpHandler = HttpHandlerFactory::build($client, $logger); | |
| 156 | 162 | } |
| 157 | - if (is_null($quotaProject)) { | |
| 163 | + if (\is_null($quotaProject)) { | |
| 158 | 164 | // if a quota project isn't specified, try to get one from the env var |
| 159 | 165 | $quotaProject = CredentialsLoader::quotaProjectFromEnv(); |
| 160 | 166 | } |
| 161 | - if (!is_null($jsonKey)) { | |
| 167 | + if (!\is_null($jsonKey)) { | |
| 162 | 168 | if ($quotaProject) { |
| 163 | 169 | $jsonKey['quota_project_id'] = $quotaProject; |
| 164 | 170 | } |
| 165 | 171 | if ($universeDomain) { |
| @@ -172,12 +178,12 @@ | ||
| 172 | 178 | $creds = new GCECredentials(null, $anyScope, null, $quotaProject, null, $universeDomain); |
| 173 | 179 | $creds->setIsOnGce(\true); |
| 174 | 180 | // save the credentials a trip to the metadata server |
| 175 | 181 | } |
| 176 | - if (is_null($creds)) { | |
| 182 | + if (\is_null($creds)) { | |
| 177 | 183 | throw new DomainException(self::notFound()); |
| 178 | 184 | } |
| 179 | - if (!is_null($cache)) { | |
| 185 | + if (!\is_null($cache)) { | |
| 180 | 186 | $creds = new FetchAuthTokenCache($creds, $cacheConfig, $cache); |
| 181 | 187 | } |
| 182 | 188 | return $creds; |
| 183 | 189 | } |
| @@ -189,16 +195,16 @@ | ||
| 189 | 195 | * If supplied, $targetAudience is used to set the "aud" on the resulting |
| 190 | 196 | * ID token. |
| 191 | 197 | * |
| 192 | 198 | * @param string $targetAudience The audience for the ID token. |
| 193 | - * @param callable $httpHandler callback which delivers psr7 request | |
| 194 | - * @param array<mixed> $cacheConfig configuration for the cache when it's present | |
| 195 | - * @param CacheItemPoolInterface $cache A cache implementation, may be | |
| 199 | + * @param callable|null $httpHandler callback which delivers psr7 request | |
| 200 | + * @param array<mixed>|null $cacheConfig configuration for the cache when it's present | |
| 201 | + * @param CacheItemPoolInterface|null $cache A cache implementation, may be | |
| 196 | 202 | * provided if you have one already available for use. |
| 197 | 203 | * @return AuthTokenMiddleware |
| 198 | 204 | * @throws DomainException if no implementation can be obtained. |
| 199 | 205 | */ |
| 200 | - public static function getIdTokenMiddleware($targetAudience, callable $httpHandler = null, array $cacheConfig = null, CacheItemPoolInterface $cache = null) | |
| 206 | + public static function getIdTokenMiddleware($targetAudience, ?callable $httpHandler = null, ?array $cacheConfig = null, ?CacheItemPoolInterface $cache = null) | |
| 201 | 207 | { |
| 202 | 208 | $creds = self::getIdTokenCredentials($targetAudience, $httpHandler, $cacheConfig, $cache); |
| 203 | 209 | return new AuthTokenMiddleware($creds, $httpHandler); |
| 204 | 210 | } |
| @@ -210,16 +216,16 @@ | ||
| 210 | 216 | * If supplied, $targetAudience is used to set the "aud" on the resulting |
| 211 | 217 | * ID token. |
| 212 | 218 | * |
| 213 | 219 | * @param string $targetAudience The audience for the ID token. |
| 214 | - * @param callable $httpHandler callback which delivers psr7 request | |
| 215 | - * @param array<mixed> $cacheConfig configuration for the cache when it's present | |
| 216 | - * @param CacheItemPoolInterface $cache A cache implementation, may be | |
| 220 | + * @param callable|null $httpHandler callback which delivers psr7 request | |
| 221 | + * @param array<mixed>|null $cacheConfig configuration for the cache when it's present | |
| 222 | + * @param CacheItemPoolInterface|null $cache A cache implementation, may be | |
| 217 | 223 | * provided if you have one already available for use. |
| 218 | 224 | * @return ProxyAuthTokenMiddleware |
| 219 | 225 | * @throws DomainException if no implementation can be obtained. |
| 220 | 226 | */ |
| 221 | - public static function getProxyIdTokenMiddleware($targetAudience, callable $httpHandler = null, array $cacheConfig = null, CacheItemPoolInterface $cache = null) | |
| 227 | + public static function getProxyIdTokenMiddleware($targetAudience, ?callable $httpHandler = null, ?array $cacheConfig = null, ?CacheItemPoolInterface $cache = null) | |
| 222 | 228 | { |
| 223 | 229 | $creds = self::getIdTokenCredentials($targetAudience, $httpHandler, $cacheConfig, $cache); |
| 224 | 230 | return new ProxyAuthTokenMiddleware($creds, $httpHandler); |
| 225 | 231 | } |
| @@ -228,52 +234,75 @@ | ||
| 228 | 234 | * in this environment, configured with a $targetAudience for fetching an ID |
| 229 | 235 | * token. |
| 230 | 236 | * |
| 231 | 237 | * @param string $targetAudience The audience for the ID token. |
| 232 | - * @param callable $httpHandler callback which delivers psr7 request | |
| 233 | - * @param array<mixed> $cacheConfig configuration for the cache when it's present | |
| 234 | - * @param CacheItemPoolInterface $cache A cache implementation, may be | |
| 238 | + * @param callable|null $httpHandler callback which delivers psr7 request | |
| 239 | + * @param array<mixed>|null $cacheConfig configuration for the cache when it's present | |
| 240 | + * @param CacheItemPoolInterface|null $cache A cache implementation, may be | |
| 235 | 241 | * provided if you have one already available for use. |
| 236 | 242 | * @return FetchAuthTokenInterface |
| 237 | 243 | * @throws DomainException if no implementation can be obtained. |
| 238 | 244 | * @throws InvalidArgumentException if JSON "type" key is invalid |
| 239 | 245 | */ |
| 240 | - public static function getIdTokenCredentials($targetAudience, callable $httpHandler = null, array $cacheConfig = null, CacheItemPoolInterface $cache = null) | |
| 246 | + public static function getIdTokenCredentials($targetAudience, ?callable $httpHandler = null, ?array $cacheConfig = null, ?CacheItemPoolInterface $cache = null) | |
| 241 | 247 | { |
| 242 | 248 | $creds = null; |
| 243 | 249 | $jsonKey = CredentialsLoader::fromEnv() ?: CredentialsLoader::fromWellKnownFile(); |
| 244 | 250 | if (!$httpHandler) { |
| 245 | - if (!$client = HttpClientCache::getHttpClient()) { | |
| 251 | + if (!($client = HttpClientCache::getHttpClient())) { | |
| 246 | 252 | $client = new Client(); |
| 247 | 253 | HttpClientCache::setHttpClient($client); |
| 248 | 254 | } |
| 249 | 255 | $httpHandler = HttpHandlerFactory::build($client); |
| 250 | 256 | } |
| 251 | - if (!is_null($jsonKey)) { | |
| 252 | - if (!array_key_exists('type', $jsonKey)) { | |
| 257 | + if (!\is_null($jsonKey)) { | |
| 258 | + if (!\array_key_exists('type', $jsonKey)) { | |
| 253 | 259 | throw new \InvalidArgumentException('json key is missing the type field'); |
| 254 | 260 | } |
| 255 | - if ($jsonKey['type'] == 'authorized_user') { | |
| 256 | - throw new InvalidArgumentException('ID tokens are not supported for end user credentials'); | |
| 257 | - } | |
| 258 | - if ($jsonKey['type'] != 'service_account') { | |
| 259 | - throw new InvalidArgumentException('invalid value in the type field'); | |
| 260 | - } | |
| 261 | - $creds = new ServiceAccountCredentials(null, $jsonKey, null, $targetAudience); | |
| 261 | + $creds = match ($jsonKey['type']) { | |
| 262 | + 'authorized_user' => new UserRefreshCredentials(null, $jsonKey, $targetAudience), | |
| 263 | + 'impersonated_service_account' => new ImpersonatedServiceAccountCredentials(null, $jsonKey, $targetAudience), | |
| 264 | + 'service_account' => new ServiceAccountCredentials(null, $jsonKey, null, $targetAudience), | |
| 265 | + default => throw new InvalidArgumentException('invalid value in the type field'), | |
| 266 | + }; | |
| 262 | 267 | } elseif (self::onGce($httpHandler, $cacheConfig, $cache)) { |
| 263 | 268 | $creds = new GCECredentials(null, null, $targetAudience); |
| 264 | 269 | $creds->setIsOnGce(\true); |
| 265 | 270 | // save the credentials a trip to the metadata server |
| 266 | 271 | } |
| 267 | - if (is_null($creds)) { | |
| 272 | + if (\is_null($creds)) { | |
| 268 | 273 | throw new DomainException(self::notFound()); |
| 269 | 274 | } |
| 270 | - if (!is_null($cache)) { | |
| 275 | + if (!\is_null($cache)) { | |
| 271 | 276 | $creds = new FetchAuthTokenCache($creds, $cacheConfig, $cache); |
| 272 | 277 | } |
| 273 | 278 | return $creds; |
| 274 | 279 | } |
| 275 | 280 | /** |
| 281 | + * Returns a StdOutLogger instance | |
| 282 | + * | |
| 283 | + * @internal | |
| 284 | + * | |
| 285 | + * @return null|LoggerInterface | |
| 286 | + */ | |
| 287 | + public static function getDefaultLogger() : null|LoggerInterface | |
| 288 | + { | |
| 289 | + $loggingFlag = \getenv(self::SDK_DEBUG_ENV_VAR); | |
| 290 | + // Env var is not set | |
| 291 | + if (empty($loggingFlag)) { | |
| 292 | + return null; | |
| 293 | + } | |
| 294 | + $loggingFlag = \strtolower($loggingFlag); | |
| 295 | + // Env Var is not true | |
| 296 | + if ($loggingFlag !== 'true') { | |
| 297 | + if ($loggingFlag !== 'false') { | |
| 298 | + \trigger_error('The ' . self::SDK_DEBUG_ENV_VAR . ' is set, but it is set to another value than false or true. Logging is disabled'); | |
| 299 | + } | |
| 300 | + return null; | |
| 301 | + } | |
| 302 | + return new StdOutLogger(); | |
| 303 | + } | |
| 304 | + /** | |
| 276 | 305 | * @return string |
| 277 | 306 | */ |
| 278 | 307 | private static function notFound() |
| 279 | 308 | { |
| @@ -282,14 +311,14 @@ | ||
| 282 | 311 | $msg .= 'https://cloud.google.com/docs/authentication/external/set-up-adc'; |
| 283 | 312 | return $msg; |
| 284 | 313 | } |
| 285 | 314 | /** |
| 286 | - * @param callable $httpHandler | |
| 287 | - * @param array<mixed> $cacheConfig | |
| 288 | - * @param CacheItemPoolInterface $cache | |
| 315 | + * @param callable|null $httpHandler | |
| 316 | + * @param array<mixed>|null $cacheConfig | |
| 317 | + * @param CacheItemPoolInterface|null $cache | |
| 289 | 318 | * @return bool |
| 290 | 319 | */ |
| 291 | - private static function onGce(callable $httpHandler = null, array $cacheConfig = null, CacheItemPoolInterface $cache = null) | |
| 320 | + private static function onGce(?callable $httpHandler = null, ?array $cacheConfig = null, ?CacheItemPoolInterface $cache = null) | |
| 292 | 321 | { |
| 293 | 322 | $gceCacheConfig = []; |
| 294 | 323 | foreach (['lifetime', 'prefix'] as $key) { |
| 295 | 324 | if (isset($cacheConfig['gce_' . $key])) { |