wp-stateless / lib / Google / vendor / google / auth / src / ApplicationDefaultCredentials.php

ApplicationDefaultCredentials.php in WP-Stateless – Google Cloud Storage 3.0.3, at lib/Google/vendor/google/auth/src/ApplicationDefaultCredentials.php

280 lines 10.7 KB

Raw Download Zip

1	<?php
2	/*
3	* Copyright 2015 Google Inc.
4	*
5	* Licensed under the Apache License, Version 2.0 (the "License");
6	* you may not use this file except in compliance with the License.
7	* You may obtain a copy of the License at
8	*
9	* http://www.apache.org/licenses/LICENSE-2.0
10	*
11	* Unless required by applicable law or agreed to in writing, software
12	* distributed under the License is distributed on an "AS IS" BASIS,
13	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14	* See the License for the specific language governing permissions and
15	* limitations under the License.
16	*/
17
18	namespace Google\Auth;
19
20	use DomainException;
21	use Google\Auth\Credentials\AppIdentityCredentials;
22	use Google\Auth\Credentials\GCECredentials;
23	use Google\Auth\Credentials\ServiceAccountCredentials;
24	use Google\Auth\HttpHandler\HttpClientCache;
25	use Google\Auth\HttpHandler\HttpHandlerFactory;
26	use Google\Auth\Middleware\AuthTokenMiddleware;
27	use Google\Auth\Subscriber\AuthTokenSubscriber;
28	use GuzzleHttp\Client;
29	use InvalidArgumentException;
30	use Psr\Cache\CacheItemPoolInterface;
31
32	/**
33	* ApplicationDefaultCredentials obtains the default credentials for
34	* authorizing a request to a Google service.
35	*
36	* Application Default Credentials are described here:
37	* https://developers.google.com/accounts/docs/application-default-credentials
38	*
39	* This class implements the search for the application default credentials as
40	* described in the link.
41	*
42	* It provides three factory methods:
43	* - #get returns the computed credentials object
44	* - #getSubscriber returns an AuthTokenSubscriber built from the credentials object
45	* - #getMiddleware returns an AuthTokenMiddleware built from the credentials object
46	*
47	* This allows it to be used as follows with GuzzleHttp\Client:
48	*
49	* ```
50	* use Google\Auth\ApplicationDefaultCredentials;
51	* use GuzzleHttp\Client;
52	* use GuzzleHttp\HandlerStack;
53	*
54	* $middleware = ApplicationDefaultCredentials::getMiddleware(
55	* 'https://www.googleapis.com/auth/taskqueue'
56	* );
57	* $stack = HandlerStack::create();
58	* $stack->push($middleware);
59	*
60	* $client = new Client([
61	* 'handler' => $stack,
62	* 'base_uri' => 'https://www.googleapis.com/taskqueue/v1beta2/projects/',
63	* 'auth' => 'google_auth' // authorize all requests
64	* ]);
65	*
66	* $res = $client->get('myproject/taskqueues/myqueue');
67	* ```
68	*/
69	class ApplicationDefaultCredentials
70	{
71	/**
72	* Obtains an AuthTokenSubscriber that uses the default FetchAuthTokenInterface
73	* implementation to use in this environment.
74	*
75	* If supplied, $scope is used to in creating the credentials instance if
76	* this does not fallback to the compute engine defaults.
77	*
78	* @param string\|array scope the scope of the access request, expressed
79	* either as an Array or as a space-delimited String.
80	* @param callable $httpHandler callback which delivers psr7 request
81	* @param array $cacheConfig configuration for the cache when it's present
82	* @param CacheItemPoolInterface $cache A cache implementation, may be
83	* provided if you have one already available for use.
84	* @return AuthTokenSubscriber
85	* @throws DomainException if no implementation can be obtained.
86	*/
87	public static function getSubscriber(
88	$scope = null,
89	callable $httpHandler = null,
90	array $cacheConfig = null,
91	CacheItemPoolInterface $cache = null
92	) {
93	$creds = self::getCredentials($scope, $httpHandler, $cacheConfig, $cache);
94
95	return new AuthTokenSubscriber($creds, $httpHandler);
96	}
97
98	/**
99	* Obtains an AuthTokenMiddleware that uses the default FetchAuthTokenInterface
100	* implementation to use in this environment.
101	*
102	* If supplied, $scope is used to in creating the credentials instance if
103	* this does not fallback to the compute engine defaults.
104	*
105	* @param string\|array scope the scope of the access request, expressed
106	* either as an Array or as a space-delimited String.
107	* @param callable $httpHandler callback which delivers psr7 request
108	* @param array $cacheConfig configuration for the cache when it's present
109	* @param CacheItemPoolInterface $cache A cache implementation, may be
110	* provided if you have one already available for use.
111	* @return AuthTokenMiddleware
112	* @throws DomainException if no implementation can be obtained.
113	*/
114	public static function getMiddleware(
115	$scope = null,
116	callable $httpHandler = null,
117	array $cacheConfig = null,
118	CacheItemPoolInterface $cache = null
119	) {
120	$creds = self::getCredentials($scope, $httpHandler, $cacheConfig, $cache);
121
122	return new AuthTokenMiddleware($creds, $httpHandler);
123	}
124
125	/**
126	* Obtains an AuthTokenMiddleware which will fetch an access token to use in
127	* the Authorization header. The middleware is configured with the default
128	* FetchAuthTokenInterface implementation to use in this environment.
129	*
130	* If supplied, $scope is used to in creating the credentials instance if
131	* this does not fallback to the Compute Engine defaults.
132	*
133	* @param string\|array scope the scope of the access request, expressed
134	* either as an Array or as a space-delimited String.
135	* @param callable $httpHandler callback which delivers psr7 request
136	* @param array $cacheConfig configuration for the cache when it's present
137	* @param CacheItemPoolInterface $cache A cache implementation, may be
138	* provided if you have one already available for use.
139	* @param string $quotaProject specifies a project to bill for access
140	* charges associated with the request.
141	*
142	* @return CredentialsLoader
143	* @throws DomainException if no implementation can be obtained.
144	*/
145	public static function getCredentials(
146	$scope = null,
147	callable $httpHandler = null,
148	array $cacheConfig = null,
149	CacheItemPoolInterface $cache = null,
150	$quotaProject = null
151	) {
152	$creds = null;
153	$jsonKey = CredentialsLoader::fromEnv()
154	?: CredentialsLoader::fromWellKnownFile();
155
156	if (!$httpHandler) {
157	if (!($client = HttpClientCache::getHttpClient())) {
158	$client = new Client();
159	HttpClientCache::setHttpClient($client);
160	}
161
162	$httpHandler = HttpHandlerFactory::build($client);
163	}
164
165	if (!is_null($jsonKey)) {
166	$jsonKey['quota_project'] = $quotaProject;
167	$creds = CredentialsLoader::makeCredentials($scope, $jsonKey);
168	} elseif (AppIdentityCredentials::onAppEngine() && !GCECredentials::onAppEngineFlexible()) {
169	$creds = new AppIdentityCredentials($scope);
170	} elseif (GCECredentials::onGce($httpHandler)) {
171	$creds = new GCECredentials(null, $scope, null, $quotaProject);
172	}
173
174	if (is_null($creds)) {
175	throw new DomainException(self::notFound());
176	}
177	if (!is_null($cache)) {
178	$creds = new FetchAuthTokenCache($creds, $cacheConfig, $cache);
179	}
180	return $creds;
181	}
182
183	/**
184	* Obtains an AuthTokenMiddleware which will fetch an ID token to use in the
185	* Authorization header. The middleware is configured with the default
186	* FetchAuthTokenInterface implementation to use in this environment.
187	*
188	* If supplied, $targetAudience is used to set the "aud" on the resulting
189	* ID token.
190	*
191	* @param string $targetAudience The audience for the ID token.
192	* @param callable $httpHandler callback which delivers psr7 request
193	* @param array $cacheConfig configuration for the cache when it's present
194	* @param CacheItemPoolInterface $cache A cache implementation, may be
195	* provided if you have one already available for use.
196	* @return AuthTokenMiddleware
197	* @throws DomainException if no implementation can be obtained.
198	*/
199	public static function getIdTokenMiddleware(
200	$targetAudience,
201	callable $httpHandler = null,
202	array $cacheConfig = null,
203	CacheItemPoolInterface $cache = null
204	) {
205	$creds = self::getIdTokenCredentials($targetAudience, $httpHandler, $cacheConfig, $cache);
206
207	return new AuthTokenMiddleware($creds, $httpHandler);
208	}
209
210	/**
211	* Obtains the default FetchAuthTokenInterface implementation to use
212	* in this environment, configured with a $targetAudience for fetching an ID
213	* token.
214	*
215	* @param string $targetAudience The audience for the ID token.
216	* @param callable $httpHandler callback which delivers psr7 request
217	* @param array $cacheConfig configuration for the cache when it's present
218	* @param CacheItemPoolInterface $cache A cache implementation, may be
219	* provided if you have one already available for use.
220	* @return CredentialsLoader
221	* @throws DomainException if no implementation can be obtained.
222	* @throws InvalidArgumentException if JSON "type" key is invalid
223	*/
224	public static function getIdTokenCredentials(
225	$targetAudience,
226	callable $httpHandler = null,
227	array $cacheConfig = null,
228	CacheItemPoolInterface $cache = null
229	) {
230	$creds = null;
231	$jsonKey = CredentialsLoader::fromEnv()
232	?: CredentialsLoader::fromWellKnownFile();
233
234	if (!$httpHandler) {
235	if (!($client = HttpClientCache::getHttpClient())) {
236	$client = new Client();
237	HttpClientCache::setHttpClient($client);
238	}
239
240	$httpHandler = HttpHandlerFactory::build($client);
241	}
242
243	if (!is_null($jsonKey)) {
244	if (!array_key_exists('type', $jsonKey)) {
245	throw new \InvalidArgumentException('json key is missing the type field');
246	}
247
248	if ($jsonKey['type'] == 'authorized_user') {
249	throw new InvalidArgumentException('ID tokens are not supported for end user credentials');
250	}
251
252	if ($jsonKey['type'] != 'service_account') {
253	throw new InvalidArgumentException('invalid value in the type field');
254	}
255
256	$creds = new ServiceAccountCredentials(null, $jsonKey, null, $targetAudience);
257	} elseif (GCECredentials::onGce($httpHandler)) {
258	$creds = new GCECredentials(null, null, $targetAudience);
259	}
260
261	if (is_null($creds)) {
262	throw new DomainException(self::notFound());
263	}
264	if (!is_null($cache)) {
265	$creds = new FetchAuthTokenCache($creds, $cacheConfig, $cache);
266	}
267	return $creds;
268	}
269
270	private static function notFound()
271	{
272	$msg = 'Could not load the default credentials. Browse to ';
273	$msg .= 'https://developers.google.com';
274	$msg .= '/accounts/docs/application-default-credentials';
275	$msg .= ' for more information';
276
277	return $msg;
278	}
279	}
280