wp-stateless / lib / Google / vendor / google / auth / src / Credentials / ServiceAccountJwtAccessCredentials.php

ServiceAccountJwtAccessCredentials.php in WP-Stateless – Google Cloud Storage 3.0.3, at lib/Google/vendor/google/auth/src/Credentials/ServiceAccountJwtAccessCredentials.php

192 lines 5.4 KB

Raw Download Zip

1	<?php
2	/*
3	* Copyright 2015 Google Inc.
4	*
5	* Licensed under the Apache License, Version 2.0 (the "License");
6	* you may not use this file except in compliance with the License.
7	* You may obtain a copy of the License at
8	*
9	* http://www.apache.org/licenses/LICENSE-2.0
10	*
11	* Unless required by applicable law or agreed to in writing, software
12	* distributed under the License is distributed on an "AS IS" BASIS,
13	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14	* See the License for the specific language governing permissions and
15	* limitations under the License.
16	*/
17
18	namespace Google\Auth\Credentials;
19
20	use Google\Auth\CredentialsLoader;
21	use Google\Auth\GetQuotaProjectInterface;
22	use Google\Auth\OAuth2;
23	use Google\Auth\ProjectIdProviderInterface;
24	use Google\Auth\ServiceAccountSignerTrait;
25	use Google\Auth\SignBlobInterface;
26
27	/**
28	* Authenticates requests using Google's Service Account credentials via
29	* JWT Access.
30	*
31	* This class allows authorizing requests for service accounts directly
32	* from credentials from a json key file downloaded from the developer
33	* console (via 'Generate new Json Key'). It is not part of any OAuth2
34	* flow, rather it creates a JWT and sends that as a credential.
35	*/
36	class ServiceAccountJwtAccessCredentials extends CredentialsLoader implements
37	GetQuotaProjectInterface,
38	SignBlobInterface,
39	ProjectIdProviderInterface
40	{
41	use ServiceAccountSignerTrait;
42
43	/**
44	* The OAuth2 instance used to conduct authorization.
45	*
46	* @var OAuth2
47	*/
48	protected $auth;
49
50	/**
51	* The quota project associated with the JSON credentials
52	*/
53	protected $quotaProject;
54
55	/**
56	* Create a new ServiceAccountJwtAccessCredentials.
57	*
58	* @param string\|array $jsonKey JSON credential file path or JSON credentials
59	* as an associative array
60	*/
61	public function __construct($jsonKey)
62	{
63	if (is_string($jsonKey)) {
64	if (!file_exists($jsonKey)) {
65	throw new \InvalidArgumentException('file does not exist');
66	}
67	$jsonKeyStream = file_get_contents($jsonKey);
68	if (!$jsonKey = json_decode($jsonKeyStream, true)) {
69	throw new \LogicException('invalid json for auth config');
70	}
71	}
72	if (!array_key_exists('client_email', $jsonKey)) {
73	throw new \InvalidArgumentException(
74	'json key is missing the client_email field'
75	);
76	}
77	if (!array_key_exists('private_key', $jsonKey)) {
78	throw new \InvalidArgumentException(
79	'json key is missing the private_key field'
80	);
81	}
82	if (array_key_exists('quota_project', $jsonKey)) {
83	$this->quotaProject = (string) $jsonKey['quota_project'];
84	}
85	$this->auth = new OAuth2([
86	'issuer' => $jsonKey['client_email'],
87	'sub' => $jsonKey['client_email'],
88	'signingAlgorithm' => 'RS256',
89	'signingKey' => $jsonKey['private_key'],
90	]);
91
92	$this->projectId = isset($jsonKey['project_id'])
93	? $jsonKey['project_id']
94	: null;
95	}
96
97	/**
98	* Updates metadata with the authorization token.
99	*
100	* @param array $metadata metadata hashmap
101	* @param string $authUri optional auth uri
102	* @param callable $httpHandler callback which delivers psr7 request
103	* @return array updated metadata hashmap
104	*/
105	public function updateMetadata(
106	$metadata,
107	$authUri = null,
108	callable $httpHandler = null
109	) {
110	if (empty($authUri)) {
111	return $metadata;
112	}
113
114	$this->auth->setAudience($authUri);
115
116	return parent::updateMetadata($metadata, $authUri, $httpHandler);
117	}
118
119	/**
120	* Implements FetchAuthTokenInterface#fetchAuthToken.
121	*
122	* @param callable $httpHandler
123	*
124	* @return array\|void A set of auth related metadata, containing the
125	* following keys:
126	* - access_token (string)
127	*/
128	public function fetchAuthToken(callable $httpHandler = null)
129	{
130	$audience = $this->auth->getAudience();
131	if (empty($audience)) {
132	return null;
133	}
134
135	$access_token = $this->auth->toJwt();
136
137	return array('access_token' => $access_token);
138	}
139
140	/**
141	* @return string
142	*/
143	public function getCacheKey()
144	{
145	return $this->auth->getCacheKey();
146	}
147
148	/**
149	* @return array
150	*/
151	public function getLastReceivedToken()
152	{
153	return $this->auth->getLastReceivedToken();
154	}
155
156	/**
157	* Get the project ID from the service account keyfile.
158	*
159	* Returns null if the project ID does not exist in the keyfile.
160	*
161	* @param callable $httpHandler Not used by this credentials type.
162	* @return string\|null
163	*/
164	public function getProjectId(callable $httpHandler = null)
165	{
166	return $this->projectId;
167	}
168
169	/**
170	* Get the client name from the keyfile.
171	*
172	* In this case, it returns the keyfile's client_email key.
173	*
174	* @param callable $httpHandler Not used by this credentials type.
175	* @return string
176	*/
177	public function getClientName(callable $httpHandler = null)
178	{
179	return $this->auth->getIssuer();
180	}
181
182	/**
183	* Get the quota project used for this API request
184	*
185	* @return string\|null
186	*/
187	public function getQuotaProject()
188	{
189	return $this->quotaProject;
190	}
191	}
192