wp-stateless / lib / Google / vendor / google / auth / src / Credentials / ServiceAccountCredentials.php

ServiceAccountCredentials.php in WP-Stateless – Google Cloud Storage 2.1.4, at lib/Google/vendor/google/auth/src/Credentials/ServiceAccountCredentials.php

174 lines 5.2 KB

Raw Download Zip

1	<?php
2	/*
3	* Copyright 2015 Google Inc.
4	*
5	* Licensed under the Apache License, Version 2.0 (the "License");
6	* you may not use this file except in compliance with the License.
7	* You may obtain a copy of the License at
8	*
9	* http://www.apache.org/licenses/LICENSE-2.0
10	*
11	* Unless required by applicable law or agreed to in writing, software
12	* distributed under the License is distributed on an "AS IS" BASIS,
13	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14	* See the License for the specific language governing permissions and
15	* limitations under the License.
16	*/
17
18	namespace Google\Auth\Credentials;
19
20	use Google\Auth\CredentialsLoader;
21	use Google\Auth\OAuth2;
22
23	/**
24	* ServiceAccountCredentials supports authorization using a Google service
25	* account.
26	*
27	* (cf https://developers.google.com/accounts/docs/OAuth2ServiceAccount)
28	*
29	* It's initialized using the json key file that's downloadable from developer
30	* console, which should contain a private_key and client_email fields that it
31	* uses.
32	*
33	* Use it with AuthTokenMiddleware to authorize http requests:
34	*
35	* use Google\Auth\Credentials\ServiceAccountCredentials;
36	* use Google\Auth\Middleware\AuthTokenMiddleware;
37	* use GuzzleHttp\Client;
38	* use GuzzleHttp\HandlerStack;
39	*
40	* $sa = new ServiceAccountCredentials(
41	* 'https://www.googleapis.com/auth/taskqueue',
42	* '/path/to/your/json/key_file.json'
43	* );
44	* $middleware = new AuthTokenMiddleware($sa);
45	* $stack = HandlerStack::create();
46	* $stack->push($middleware);
47	*
48	* $client = new Client([
49	* 'handler' => $stack,
50	* 'base_uri' => 'https://www.googleapis.com/taskqueue/v1beta2/projects/',
51	* 'auth' => 'google_auth' // authorize all requests
52	* ]);
53	*
54	* $res = $client->get('myproject/taskqueues/myqueue');
55	*/
56	class ServiceAccountCredentials extends CredentialsLoader
57	{
58	/**
59	* The OAuth2 instance used to conduct authorization.
60	*/
61	protected $auth;
62
63	/**
64	* Create a new ServiceAccountCredentials.
65	*
66	* @param string\|array $scope the scope of the access request, expressed
67	* either as an Array or as a space-delimited String.
68	*
69	* @param string\|array $jsonKey JSON credential file path or JSON credentials
70	* as an associative array
71	*
72	* @param string $sub an email address account to impersonate, in situations when
73	* the service account has been delegated domain wide access.
74	*/
75	public function __construct(
76	$scope,
77	$jsonKey,
78	$sub = null
79	) {
80	if (is_string($jsonKey)) {
81	if (!file_exists($jsonKey)) {
82	throw new \InvalidArgumentException('file does not exist');
83	}
84	$jsonKeyStream = file_get_contents($jsonKey);
85	if (!$jsonKey = json_decode($jsonKeyStream, true)) {
86	throw new \LogicException('invalid json for auth config');
87	}
88	}
89	if (!array_key_exists('client_email', $jsonKey)) {
90	throw new \InvalidArgumentException(
91	'json key is missing the client_email field');
92	}
93	if (!array_key_exists('private_key', $jsonKey)) {
94	throw new \InvalidArgumentException(
95	'json key is missing the private_key field');
96	}
97	$this->auth = new OAuth2([
98	'audience' => self::TOKEN_CREDENTIAL_URI,
99	'issuer' => $jsonKey['client_email'],
100	'scope' => $scope,
101	'signingAlgorithm' => 'RS256',
102	'signingKey' => $jsonKey['private_key'],
103	'sub' => $sub,
104	'tokenCredentialUri' => self::TOKEN_CREDENTIAL_URI
105	]);
106	}
107
108	/**
109	* Implements FetchAuthTokenInterface#fetchAuthToken.
110	*/
111	public function fetchAuthToken(callable $httpHandler = null)
112	{
113	return $this->auth->fetchAuthToken($httpHandler);
114	}
115
116	/**
117	* Implements FetchAuthTokenInterface#getCacheKey.
118	*/
119	public function getCacheKey()
120	{
121	$key = $this->auth->getIssuer() . ':' . $this->auth->getCacheKey();
122	if ($sub = $this->auth->getSub()) {
123	$key .= ':' . $sub;
124	}
125	return $key;
126	}
127
128	/**
129	* Implements FetchAuthTokenInterface#getLastReceivedToken.
130	*/
131	public function getLastReceivedToken()
132	{
133	return $this->auth->getLastReceivedToken();
134	}
135
136	/**
137	* Updates metadata with the authorization token
138	*
139	* @param array $metadata metadata hashmap
140	* @param string $authUri optional auth uri
141	* @param callable $httpHandler callback which delivers psr7 request
142	*
143	* @return array updated metadata hashmap
144	*/
145	public function updateMetadata(
146	$metadata,
147	$authUri = null,
148	callable $httpHandler = null
149	) {
150	// scope exists. use oauth implementation
151	$scope = $this->auth->getScope();
152	if (!is_null($scope)) {
153	return parent::updateMetadata($metadata, $authUri, $httpHandler);
154	}
155
156	// no scope found. create jwt with the auth uri
157	$credJson = array(
158	'private_key' => $this->auth->getSigningKey(),
159	'client_email' => $this->auth->getIssuer(),
160	);
161	$jwtCreds = new ServiceAccountJwtAccessCredentials($credJson);
162	return $jwtCreds->updateMetadata($metadata, $authUri, $httpHandler);
163	}
164
165	/**
166	* @param string $sub an email address account to impersonate, in situations when
167	* the service account has been delegated domain wide access.
168	*/
169	public function setSub($sub)
170	{
171	$this->auth->setSub($sub);
172	}
173	}
174