wp-stateless / lib / Google / vendor / google / auth / src / Credentials / ServiceAccountCredentials.php

ServiceAccountCredentials.php in WP-Stateless – Google Cloud Storage 3.0.3, at lib/Google/vendor/google/auth/src/Credentials/ServiceAccountCredentials.php

260 lines 7.7 KB

Raw Download Zip

1	<?php
2	/*
3	* Copyright 2015 Google Inc.
4	*
5	* Licensed under the Apache License, Version 2.0 (the "License");
6	* you may not use this file except in compliance with the License.
7	* You may obtain a copy of the License at
8	*
9	* http://www.apache.org/licenses/LICENSE-2.0
10	*
11	* Unless required by applicable law or agreed to in writing, software
12	* distributed under the License is distributed on an "AS IS" BASIS,
13	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14	* See the License for the specific language governing permissions and
15	* limitations under the License.
16	*/
17
18	namespace Google\Auth\Credentials;
19
20	use Google\Auth\CredentialsLoader;
21	use Google\Auth\GetQuotaProjectInterface;
22	use Google\Auth\OAuth2;
23	use Google\Auth\ProjectIdProviderInterface;
24	use Google\Auth\ServiceAccountSignerTrait;
25	use Google\Auth\SignBlobInterface;
26	use InvalidArgumentException;
27
28	/**
29	* ServiceAccountCredentials supports authorization using a Google service
30	* account.
31	*
32	* (cf https://developers.google.com/accounts/docs/OAuth2ServiceAccount)
33	*
34	* It's initialized using the json key file that's downloadable from developer
35	* console, which should contain a private_key and client_email fields that it
36	* uses.
37	*
38	* Use it with AuthTokenMiddleware to authorize http requests:
39	*
40	* use Google\Auth\Credentials\ServiceAccountCredentials;
41	* use Google\Auth\Middleware\AuthTokenMiddleware;
42	* use GuzzleHttp\Client;
43	* use GuzzleHttp\HandlerStack;
44	*
45	* $sa = new ServiceAccountCredentials(
46	* 'https://www.googleapis.com/auth/taskqueue',
47	* '/path/to/your/json/key_file.json'
48	* );
49	* $middleware = new AuthTokenMiddleware($sa);
50	* $stack = HandlerStack::create();
51	* $stack->push($middleware);
52	*
53	* $client = new Client([
54	* 'handler' => $stack,
55	* 'base_uri' => 'https://www.googleapis.com/taskqueue/v1beta2/projects/',
56	* 'auth' => 'google_auth' // authorize all requests
57	* ]);
58	*
59	* $res = $client->get('myproject/taskqueues/myqueue');
60	*/
61	class ServiceAccountCredentials extends CredentialsLoader implements
62	GetQuotaProjectInterface,
63	SignBlobInterface,
64	ProjectIdProviderInterface
65	{
66	use ServiceAccountSignerTrait;
67
68	/**
69	* The OAuth2 instance used to conduct authorization.
70	*
71	* @var OAuth2
72	*/
73	protected $auth;
74
75	/**
76	* The quota project associated with the JSON credentials
77	*
78	* @var string
79	*/
80	protected $quotaProject;
81
82	/*
83	* @var string\|null
84	*/
85	protected $projectId;
86
87	/**
88	* Create a new ServiceAccountCredentials.
89	*
90	* @param string\|array $scope the scope of the access request, expressed
91	* either as an Array or as a space-delimited String.
92	* @param string\|array $jsonKey JSON credential file path or JSON credentials
93	* as an associative array
94	* @param string $sub an email address account to impersonate, in situations when
95	* the service account has been delegated domain wide access.
96	* @param string $targetAudience The audience for the ID token.
97	*/
98	public function __construct(
99	$scope,
100	$jsonKey,
101	$sub = null,
102	$targetAudience = null
103	) {
104	if (is_string($jsonKey)) {
105	if (!file_exists($jsonKey)) {
106	throw new \InvalidArgumentException('file does not exist');
107	}
108	$jsonKeyStream = file_get_contents($jsonKey);
109	if (!$jsonKey = json_decode($jsonKeyStream, true)) {
110	throw new \LogicException('invalid json for auth config');
111	}
112	}
113	if (!array_key_exists('client_email', $jsonKey)) {
114	throw new \InvalidArgumentException(
115	'json key is missing the client_email field'
116	);
117	}
118	if (!array_key_exists('private_key', $jsonKey)) {
119	throw new \InvalidArgumentException(
120	'json key is missing the private_key field'
121	);
122	}
123	if (array_key_exists('quota_project', $jsonKey)) {
124	$this->quotaProject = (string) $jsonKey['quota_project'];
125	}
126	if ($scope && $targetAudience) {
127	throw new InvalidArgumentException(
128	'Scope and targetAudience cannot both be supplied'
129	);
130	}
131	$additionalClaims = [];
132	if ($targetAudience) {
133	$additionalClaims = ['target_audience' => $targetAudience];
134	}
135	$this->auth = new OAuth2([
136	'audience' => self::TOKEN_CREDENTIAL_URI,
137	'issuer' => $jsonKey['client_email'],
138	'scope' => $scope,
139	'signingAlgorithm' => 'RS256',
140	'signingKey' => $jsonKey['private_key'],
141	'sub' => $sub,
142	'tokenCredentialUri' => self::TOKEN_CREDENTIAL_URI,
143	'additionalClaims' => $additionalClaims,
144	]);
145
146	$this->projectId = isset($jsonKey['project_id'])
147	? $jsonKey['project_id']
148	: null;
149	}
150
151	/**
152	* @param callable $httpHandler
153	*
154	* @return array A set of auth related metadata, containing the following
155	* keys:
156	* - access_token (string)
157	* - expires_in (int)
158	* - token_type (string)
159	*/
160	public function fetchAuthToken(callable $httpHandler = null)
161	{
162	return $this->auth->fetchAuthToken($httpHandler);
163	}
164
165	/**
166	* @return string
167	*/
168	public function getCacheKey()
169	{
170	$key = $this->auth->getIssuer() . ':' . $this->auth->getCacheKey();
171	if ($sub = $this->auth->getSub()) {
172	$key .= ':' . $sub;
173	}
174
175	return $key;
176	}
177
178	/**
179	* @return array
180	*/
181	public function getLastReceivedToken()
182	{
183	return $this->auth->getLastReceivedToken();
184	}
185
186	/**
187	* Get the project ID from the service account keyfile.
188	*
189	* Returns null if the project ID does not exist in the keyfile.
190	*
191	* @param callable $httpHandler Not used by this credentials type.
192	* @return string\|null
193	*/
194	public function getProjectId(callable $httpHandler = null)
195	{
196	return $this->projectId;
197	}
198
199	/**
200	* Updates metadata with the authorization token.
201	*
202	* @param array $metadata metadata hashmap
203	* @param string $authUri optional auth uri
204	* @param callable $httpHandler callback which delivers psr7 request
205	* @return array updated metadata hashmap
206	*/
207	public function updateMetadata(
208	$metadata,
209	$authUri = null,
210	callable $httpHandler = null
211	) {
212	// scope exists. use oauth implementation
213	$scope = $this->auth->getScope();
214	if (!is_null($scope)) {
215	return parent::updateMetadata($metadata, $authUri, $httpHandler);
216	}
217
218	// no scope found. create jwt with the auth uri
219	$credJson = array(
220	'private_key' => $this->auth->getSigningKey(),
221	'client_email' => $this->auth->getIssuer(),
222	);
223	$jwtCreds = new ServiceAccountJwtAccessCredentials($credJson);
224
225	return $jwtCreds->updateMetadata($metadata, $authUri, $httpHandler);
226	}
227
228	/**
229	* @param string $sub an email address account to impersonate, in situations when
230	* the service account has been delegated domain wide access.
231	*/
232	public function setSub($sub)
233	{
234	$this->auth->setSub($sub);
235	}
236
237	/**
238	* Get the client name from the keyfile.
239	*
240	* In this case, it returns the keyfile's client_email key.
241	*
242	* @param callable $httpHandler Not used by this credentials type.
243	* @return string
244	*/
245	public function getClientName(callable $httpHandler = null)
246	{
247	return $this->auth->getIssuer();
248	}
249
250	/**
251	* Get the quota project used for this API request
252	*
253	* @return string\|null
254	*/
255	public function getQuotaProject()
256	{
257	return $this->quotaProject;
258	}
259	}
260