Add urllib3 AuthorizedHttp (#19)
diff --git a/docs/conf.py b/docs/conf.py
index ccd864a..b70918f 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -363,7 +363,10 @@
# Example configuration for intersphinx: refer to the Python standard library.
-intersphinx_mapping = {'https://docs.python.org/3.5': None}
+intersphinx_mapping = {
+ 'python': ('https://docs.python.org/3.5', None),
+ 'urllib3': ('https://urllib3.readthedocs.io/en/latest', None),
+}
# Autodoc config
autoclass_content = 'both'
diff --git a/google/auth/transport/__init__.py b/google/auth/transport/__init__.py
index 50b1c43..d73c63c 100644
--- a/google/auth/transport/__init__.py
+++ b/google/auth/transport/__init__.py
@@ -27,6 +27,15 @@
import abc
import six
+from six.moves import http_client
+
+DEFAULT_REFRESH_STATUS_CODES = (http_client.UNAUTHORIZED,)
+"""Sequence[int]: Which HTTP status code indicate that credentials should be
+refreshed and a request should be retried.
+"""
+
+DEFAULT_MAX_REFRESH_ATTEMPTS = 2
+"""int: How many times to refresh the credentials and retry a request."""
@six.add_metaclass(abc.ABCMeta)
diff --git a/google/auth/transport/urllib3.py b/google/auth/transport/urllib3.py
index be6e55b..9d417b5 100644
--- a/google/auth/transport/urllib3.py
+++ b/google/auth/transport/urllib3.py
@@ -18,6 +18,18 @@
import logging
+
+# Certifi is Mozilla's certificate bundle. Urllib3 needs a certificate bundle
+# to verify HTTPS requests, and certifi is the recommended and most reliable
+# way to get a root certificate bundle. See
+# http://urllib3.readthedocs.io/en/latest/user-guide.html\
+# #certificate-verification
+# For more details.
+try:
+ import certifi
+except ImportError: # pragma: NO COVER
+ certifi = None
+
import urllib3
import urllib3.exceptions
@@ -27,7 +39,7 @@
_LOGGER = logging.getLogger(__name__)
-class Response(transport.Response):
+class _Response(transport.Response):
"""urllib3 transport response adapter.
Args:
@@ -50,7 +62,22 @@
class Request(transport.Request):
- """urllib3 request adapter
+ """urllib3 request adapter.
+
+ This class is used internally for making requests using various transports
+ in a consistent way. If you use :class:`AuthorizedHttp` you do not need
+ to construct or use this class directly.
+
+ This class can be useful if you want to manually refresh a
+ :class:`~google.auth.credentials.Credentials` instance::
+
+ import google.auth.transport.urllib3
+ import urllib3
+
+ http = urllib3.PoolManager()
+ request = google.auth.transport.urllib3.Request(http)
+
+ credentials.refresh(request)
Args:
http (urllib3.request.RequestMethods): An instance of any urllib3
@@ -79,7 +106,7 @@
urllib3 :meth:`urlopen` method.
Returns:
- Response: The HTTP response.
+ google.auth.transport.Response: The HTTP response.
Raises:
google.auth.exceptions.TransportError: If any exception occurred.
@@ -93,6 +120,129 @@
_LOGGER.debug('Making request: %s %s', method, url)
response = self.http.request(
method, url, body=body, headers=headers, **kwargs)
- return Response(response)
+ return _Response(response)
except urllib3.exceptions.HTTPError as exc:
raise exceptions.TransportError(exc)
+
+
+def _make_default_http():
+ if certifi is not None:
+ return urllib3.PoolManager(
+ cert_reqs='CERT_REQUIRED',
+ ca_certs=certifi.where())
+ else:
+ return urllib3.PoolManager()
+
+
+class AuthorizedHttp(urllib3.request.RequestMethods):
+ """A urllib3 HTTP class with credentials.
+
+ This class is used to perform requests to API endpoints that require
+ authorization::
+
+ from google.auth.transport.urllib3 import AuthorizedHttp
+
+ authed_http = AuthorizedHttp(credentials)
+
+ response = authed_http.request(
+ 'GET', 'https://www.googleapis.com/storage/v1/b')
+
+ This class implements :class:`urllib3.request.RequestMethods` and can be
+ used just like any other :class:`urllib3.PoolManager`.
+
+ The underlying :meth:`urlopen` implementation handles adding the
+ credentials' headers to the request and refreshing credentials as needed.
+
+ Args:
+ credentials (google.auth.credentials.Credentials): The credentials to
+ add to the request.
+ http (urllib3.PoolManager): The underlying HTTP object to
+ use to make requests. If not specified, a
+ :class:`urllib3.PoolManager` instance will be constructed with
+ sane defaults.
+ refresh_status_codes (Sequence[int]): Which HTTP status codes indicate
+ that credentials should be refreshed and the request should be
+ retried.
+ max_refresh_attempts (int): The maximum number of times to attempt to
+ refresh the credentials and retry the request.
+ """
+ def __init__(self, credentials, http=None,
+ refresh_status_codes=transport.DEFAULT_REFRESH_STATUS_CODES,
+ max_refresh_attempts=transport.DEFAULT_MAX_REFRESH_ATTEMPTS):
+
+ if http is None:
+ http = _make_default_http()
+
+ self.http = http
+ self.credentials = credentials
+ self._refresh_status_codes = refresh_status_codes
+ self._max_refresh_attempts = max_refresh_attempts
+ # Request instance used by internal methods (for example,
+ # credentials.refresh).
+ self._request = Request(self.http)
+
+ def urlopen(self, method, url, body=None, headers=None, **kwargs):
+ """Implementation of urllib3's urlopen."""
+
+ # Use a kwarg for this instead of an attribute to maintain
+ # thread-safety.
+ _credential_refresh_attempt = kwargs.pop(
+ '_credential_refresh_attempt', 0)
+
+ if headers is None:
+ headers = self.headers
+
+ # Make a copy of the headers. They will be modified by the credentials
+ # and we want to pass the original headers if we recurse.
+ request_headers = headers.copy()
+
+ self.credentials.before_request(
+ self._request, method, url, request_headers)
+
+ response = self.http.urlopen(
+ method, url, body=body, headers=request_headers, **kwargs)
+
+ # If the response indicated that the credentials needed to be
+ # refreshed, then refresh the credentials and re-attempt the
+ # request.
+ # A stored token may expire between the time it is retrieved and
+ # the time the request is made, so we may need to try twice.
+ # The reason urllib3's retries aren't used is because they
+ # don't allow you to modify the request headers. :/
+ if (response.status in self._refresh_status_codes
+ and _credential_refresh_attempt < self._max_refresh_attempts):
+
+ _LOGGER.info(
+ 'Refreshing credentials due to a %s response. Attempt %s/%s.',
+ response.status, _credential_refresh_attempt + 1,
+ self._max_refresh_attempts)
+
+ self.credentials.refresh(self._request)
+
+ # Recurse. Pass in the original headers, not our modified set.
+ return self.urlopen(
+ method, url, body=body, headers=headers,
+ _credential_refresh_attempt=_credential_refresh_attempt + 1,
+ **kwargs)
+
+ return response
+
+ # Proxy methods for compliance with the urllib3.PoolManager interface
+
+ def __enter__(self):
+ """Proxy to ``self.http``."""
+ return self.http.__enter__()
+
+ def __exit__(self, exc_type, exc_val, exc_tb):
+ """Proxy to ``self.http``."""
+ return self.http.__exit__(exc_type, exc_val, exc_tb)
+
+ @property
+ def headers(self):
+ """Proxy to ``self.http``."""
+ return self.http.headers
+
+ @headers.setter
+ def headers(self, value):
+ """Proxy to ``self.http``."""
+ self.http.headers = value
diff --git a/tests/transport/test_urllib3.py b/tests/transport/test_urllib3.py
index bdd5ac9..d35a759 100644
--- a/tests/transport/test_urllib3.py
+++ b/tests/transport/test_urllib3.py
@@ -13,6 +13,7 @@
# limitations under the License.
import mock
+from six.moves import http_client
import urllib3
import google.auth.transport.urllib3
@@ -24,10 +25,113 @@
http = urllib3.PoolManager()
return google.auth.transport.urllib3.Request(http)
+ def test_timeout(self):
+ http = mock.Mock()
+ request = google.auth.transport.urllib3.Request(http)
+ request(url='http://example.com', method='GET', timeout=5)
-def test_timeout():
- http = mock.Mock()
- request = google.auth.transport.urllib3.Request(http)
- request(url='http://example.com', method='GET', timeout=5)
+ assert http.request.call_args[1]['timeout'] == 5
- assert http.request.call_args[1]['timeout'] == 5
+
+def test__make_default_http_with_certfi():
+ http = google.auth.transport.urllib3._make_default_http()
+ assert 'cert_reqs' in http.connection_pool_kw
+
+
+@mock.patch.object(google.auth.transport.urllib3, 'certifi', new=None)
+def test__make_default_http_without_certfi():
+ http = google.auth.transport.urllib3._make_default_http()
+ assert 'cert_reqs' not in http.connection_pool_kw
+
+
+class MockCredentials(object):
+ def __init__(self, token='token'):
+ self.token = token
+
+ def apply(self, headers):
+ headers['authorization'] = self.token
+
+ def before_request(self, request, method, url, headers):
+ self.apply(headers)
+
+ def refresh(self, request):
+ self.token += '1'
+
+
+class MockHttp(object):
+ def __init__(self, responses, headers=None):
+ self.responses = responses
+ self.requests = []
+ self.headers = headers or {}
+
+ def urlopen(self, method, url, body=None, headers=None, **kwargs):
+ self.requests.append((method, url, body, headers, kwargs))
+ return self.responses.pop(0)
+
+
+class MockResponse(object):
+ def __init__(self, status=http_client.OK, data=None):
+ self.status = status
+ self.data = data
+
+
+class TestAuthorizedHttp(object):
+ TEST_URL = 'http://example.com'
+
+ def test_authed_http_defaults(self):
+ authed_http = google.auth.transport.urllib3.AuthorizedHttp(
+ mock.sentinel.credentials)
+
+ assert authed_http.credentials == mock.sentinel.credentials
+ assert isinstance(authed_http.http, urllib3.PoolManager)
+
+ def test_urlopen_no_refresh(self):
+ mock_credentials = mock.Mock(wraps=MockCredentials())
+ mock_response = MockResponse()
+ mock_http = MockHttp([mock_response])
+
+ authed_http = google.auth.transport.urllib3.AuthorizedHttp(
+ mock_credentials, http=mock_http)
+
+ response = authed_http.urlopen('GET', self.TEST_URL)
+
+ assert response == mock_response
+ assert mock_credentials.before_request.called
+ assert not mock_credentials.refresh.called
+ assert mock_http.requests == [
+ ('GET', self.TEST_URL, None, {'authorization': 'token'}, {})]
+
+ def test_urlopen_refresh(self):
+ mock_credentials = mock.Mock(wraps=MockCredentials())
+ mock_final_response = MockResponse(status=http_client.OK)
+ # First request will 401, second request will succeed.
+ mock_http = MockHttp([
+ MockResponse(status=http_client.UNAUTHORIZED),
+ mock_final_response])
+
+ authed_http = google.auth.transport.urllib3.AuthorizedHttp(
+ mock_credentials, http=mock_http)
+
+ response = authed_http.urlopen('GET', 'http://example.com')
+
+ assert response == mock_final_response
+ assert mock_credentials.before_request.call_count == 2
+ assert mock_credentials.refresh.called
+ assert mock_http.requests == [
+ ('GET', self.TEST_URL, None, {'authorization': 'token'}, {}),
+ ('GET', self.TEST_URL, None, {'authorization': 'token1'}, {})]
+
+ def test_proxies(self):
+ mock_http = mock.MagicMock()
+
+ authed_http = google.auth.transport.urllib3.AuthorizedHttp(
+ None, http=mock_http)
+
+ with authed_http:
+ pass
+
+ assert mock_http.__enter__.called
+ assert mock_http.__exit__.called
+
+ authed_http.headers = mock.sentinel.headers
+ assert authed_http.headers == mock_http.headers
diff --git a/tox.ini b/tox.ini
index 5f2df1c..ffaef94 100644
--- a/tox.ini
+++ b/tox.ini
@@ -9,6 +9,7 @@
pytest-cov
pytest-localserver
urllib3
+ certifi
commands =
py.test --cov=google.auth --cov=google.oauth2 --cov=tests {posargs:tests}
