fog-google 1.8.2 → 1.12.0

data/lib/fog/google/requests/sql/list_backup_runs.rb

@@ -17,7 +17,9 @@ module Fog
 
       class Mock
         def list_backup_runs(_instance_id, _backup_configuration_id)
+          # :no-coverage:
           Fog::Mock.not_implemented
+          # :no-coverage:
         end
       end
     end

data/lib/fog/google/requests/sql/list_flags.rb

@@ -14,7 +14,9 @@ module Fog
 
       class Mock
         def list_flags
+          # :no-coverage:
           Fog::Mock.not_implemented
+          # :no-coverage:
         end
       end
     end

data/lib/fog/google/requests/sql/list_instances.rb

@@ -17,7 +17,9 @@ module Fog
 
       class Mock
         def list_instances(_options: {})
+          # :no-coverage:
           Fog::Mock.not_implemented
+          # :no-coverage:
         end
       end
     end

data/lib/fog/google/requests/sql/list_operations.rb

@@ -18,7 +18,9 @@ module Fog
 
       class Mock
         def list_operations(_instance_id, _options: {})
+          # :no-coverage:
           Fog::Mock.not_implemented
+          # :no-coverage:
         end
       end
     end

data/lib/fog/google/requests/sql/list_ssl_certs.rb

@@ -14,7 +14,9 @@ module Fog
 
       class Mock
         def list_ssl_certs(_instance_id)
+          # :no-coverage:
           Fog::Mock.not_implemented
+          # :no-coverage:
         end
       end
     end

data/lib/fog/google/requests/sql/list_tiers.rb

@@ -14,7 +14,9 @@ module Fog
 
       class Mock
         def list_tiers
+          # :no-coverage:
           Fog::Mock.not_implemented
+          # :no-coverage:
         end
       end
     end

data/lib/fog/google/requests/sql/list_users.rb

@@ -14,7 +14,9 @@ module Fog
 
       class Mock
         def list_operations(_instance_id)
+          # :no-coverage:
           Fog::Mock.not_implemented
+          # :no-coverage:
         end
       end
     end

data/lib/fog/google/requests/sql/reset_instance_ssl_config.rb

@@ -16,7 +16,9 @@ module Fog
 
       class Mock
         def reset_instance_ssl_config(_instance_id)
+          # :no-coverage:
           Fog::Mock.not_implemented
+          # :no-coverage:
         end
       end
     end

data/lib/fog/google/requests/sql/restart_instance.rb

@@ -14,7 +14,9 @@ module Fog
 
       class Mock
         def restart_instance(_instance_id)
+          # :no-coverage:
           Fog::Mock.not_implemented
+          # :no-coverage:
         end
       end
     end

data/lib/fog/google/requests/sql/restore_instance_backup.rb

@@ -21,7 +21,9 @@ module Fog
 
       class Mock
         def restore_instance_backup(_instance_id, _backup_run_id)
+          # :no-coverage:
           Fog::Mock.not_implemented
+          # :no-coverage:
         end
       end
     end

data/lib/fog/google/requests/sql/update_instance.rb

@@ -21,7 +21,9 @@ module Fog
 
       class Mock
         def update_instance(_instance_id, _settings_version, _tier, _settings = {})
+          # :no-coverage:
           Fog::Mock.not_implemented
+          # :no-coverage:
         end
       end
     end

data/lib/fog/google/requests/sql/update_user.rb

@@ -17,7 +17,9 @@ module Fog
 
       class Mock
         def update_user(_instance_id, _host, _name, _user)
+          # :no-coverage:
           Fog::Mock.not_implemented
+          # :no-coverage:
         end
       end
     end

data/lib/fog/google/shared.rb

@@ -1,3 +1,5 @@
+require "google-cloud-env"
+
 module Fog
   module Google
     module Shared
@@ -14,61 +16,43 @@ module Fog
         @project = project
         @api_version = api_version
         @api_url = base_url + api_version + "/projects/"
+        # google-cloud-env allows us to figure out which GCP runtime we're running in and query metadata
+        # e.g. whether we're running in GCE/GKE/AppEngine or what region the instance is running in
+        @google_cloud_env = ::Google::Cloud::Env.get
       end
 
       ##
       # Initializes the Google API Client
       #
       # @param [Hash] options Google API options
+      # @option options [Bool]   :google_application_default Explicitly use application default credentials
       # @option options [Google::Auth|Signet] :google_auth Manually created authorization to use
-      # @option options [String] :google_client_email A @developer.gserviceaccount.com email address to use
-      # @option options [String] :google_key_location The location of a pkcs12 key file
-      # @option options [String] :google_key_string The content of the pkcs12 key file
       # @option options [String] :google_json_key_location The location of a JSON key file
       # @option options [String] :google_json_key_string The content of the JSON key file
       # @option options [String] :google_api_scope_url The access scope URLs
       # @option options [String] :app_name The app name to set in the user agent
       # @option options [String] :app_version The app version to set in the user agent
-      # @option options [Google::APIClient] :google_client Existing Google API Client
       # @option options [Hash] :google_client_options A hash to send additional options to Google API Client
       # @return [Google::APIClient] Google API Client
       # @raises [ArgumentError] If there is any missing argument
       def initialize_google_client(options)
         # NOTE: loaded here to avoid requiring this as a core Fog dependency
         begin
-          # Because of how Google API gem was rewritten, we get to do all sorts
-          # of funky things, like this nonsense.
+          # TODO: google-api-client is in gemspec now, re-assess if this initialization logic is still needed
           require "google/apis/monitoring_#{Fog::Google::Monitoring::GOOGLE_MONITORING_API_VERSION}"
           require "google/apis/compute_#{Fog::Compute::Google::GOOGLE_COMPUTE_API_VERSION}"
           require "google/apis/dns_#{Fog::DNS::Google::GOOGLE_DNS_API_VERSION}"
           require "google/apis/pubsub_#{Fog::Google::Pubsub::GOOGLE_PUBSUB_API_VERSION}"
           require "google/apis/sqladmin_#{Fog::Google::SQL::GOOGLE_SQL_API_VERSION}"
           require "google/apis/storage_#{Fog::Storage::GoogleJSON::GOOGLE_STORAGE_JSON_API_VERSION}"
+          require "google/apis/iamcredentials_#{Fog::Storage::GoogleJSON::GOOGLE_STORAGE_JSON_IAM_API_VERSION}"
           require "googleauth"
         rescue LoadError => error
           Fog::Errors::Error.new("Please install the google-api-client (>= 0.9) gem before using this provider")
           raise error
         end
 
-        # Users can no longer provide their own clients due to rewrite of auth
-        # in https://github.com/google/google-api-ruby-client/ version 0.9.
-        if options[:google_client]
-          raise ArgumentError.new("Deprecated argument no longer works: google_client")
-        end
-
-        # They can also no longer use pkcs12 files, because Google's new auth
-        # library doesn't support them either.
-        if options[:google_key_location]
-          raise ArgumentError.new("Deprecated argument no longer works: google_key_location")
-        end
-        if options[:google_key_string]
-          raise ArgumentError.new("Deprecated argument no longer works: google_key_string")
-        end
-
-        # Validate required arguments
-        unless options[:google_api_scope_url]
-          raise ArgumentError.new("Missing required arguments: google_api_scope_url")
-        end
+        validate_client_options(options)
 
         application_name = "fog"
         unless options[:app_name].nil?
@@ -78,41 +62,21 @@ module Fog
         ::Google::Apis::ClientOptions.default.application_name = application_name
         ::Google::Apis::ClientOptions.default.application_version = Fog::Google::VERSION
 
-        auth = nil
-        if options[:google_json_key_location] || options[:google_json_key_string]
-          if options[:google_json_key_location]
-            json_key_location = File.expand_path(options[:google_json_key_location])
-            json_key = File.open(json_key_location, "r", &:read)
-          else
-            json_key = options[:google_json_key_string]
-          end
-
-          json_key_hash = Fog::JSON.decode(json_key)
-          unless json_key_hash.key?("client_email") || json_key_hash.key?("private_key")
-            raise ArgumentError.new("Invalid Google JSON key")
-          end
-
-          options[:google_client_email] = json_key_hash["client_email"]
-          unless options[:google_client_email]
-            raise ArgumentError.new("Missing required arguments: google_client_email")
-          end
+        if ENV["DEBUG"]
+          ::Google::Apis.logger = ::Logger.new(::STDERR)
+          ::Google::Apis.logger.level = ::Logger::DEBUG
+        end
 
-          if ENV["DEBUG"]
-            ::Google::Apis.logger = ::Logger.new(::STDERR)
-            ::Google::Apis.logger.level = ::Logger::DEBUG
-          end
+        auth = nil
 
-          auth = ::Google::Auth::ServiceAccountCredentials.make_creds(
-            :json_key_io => StringIO.new(json_key_hash.to_json),
-            :scope => options[:google_api_scope_url]
-          )
+        if options[:google_json_key_location] || options[:google_json_key_string]
+          auth = process_key_auth(options)
         elsif options[:google_auth]
           auth = options[:google_auth]
+        elsif options[:google_application_default]
+          auth = process_application_default_auth(options)
         else
-          raise ArgumentError.new(
-            "Missing required arguments: google_json_key_location, "\
-            "google_json_key_string or google_auth"
-          )
+          auth = process_fallback_auth(options)
         end
 
         ::Google::Apis::RequestOptions.default.authorization = auth
@@ -188,6 +152,102 @@ module Fog
 
         response
       end
+
+      private
+
+      # Helper method to process application default authentication
+      #
+      # @param [Hash]  options - client options hash
+      # @return [Google::Auth::DefaultCredentials] - google auth object
+      def process_application_default_auth(options)
+        ::Google::Auth.get_application_default(options[:google_api_scope_url])
+      end
+
+      # Helper method to process fallback authentication
+      # Current fallback is application default authentication
+      #
+      # @param [Hash]  options - client options hash
+      # @return [Google::Auth::DefaultCredentials] - google auth object
+      def process_fallback_auth(options)
+        Fog::Logger.warning(
+          "Didn't detect any client auth settings, " \
+          "trying to fall back to application default credentials..."
+        )
+        begin
+          return process_application_default_auth(options)
+        rescue
+          raise Fog::Errors::Error.new(
+            "Fallback auth failed, could not configure authentication for Fog client.\n" \
+              "Check your auth options, must be one of:\n" \
+              "- :google_json_key_location,\n" \
+              "- :google_json_key_string,\n" \
+              "- :google_auth,\n" \
+              "- :google_application_default,\n" \
+              "If credentials are valid - please, file a bug to fog-google." \
+          )
+        end
+      end
+
+      # Helper method to process key authentication
+      #
+      # @param [Hash]  options - client options hash
+      # @return [Google::Auth::ServiceAccountCredentials] - google auth object
+      def process_key_auth(options)
+        if options[:google_json_key_location]
+          json_key = File.read(File.expand_path(options[:google_json_key_location]))
+        elsif options[:google_json_key_string]
+          json_key = options[:google_json_key_string]
+        end
+
+        validate_json_credentials(json_key)
+
+        ::Google::Auth::ServiceAccountCredentials.make_creds(
+          :json_key_io => StringIO.new(json_key),
+          :scope => options[:google_api_scope_url]
+        )
+      end
+
+      # Helper method to sort out deprecated and missing auth options
+      #
+      # @param [Hash]  options - client options hash
+      def validate_client_options(options)
+        # Users can no longer provide their own clients due to rewrite of auth
+        # in https://github.com/google/google-api-ruby-client/ version 0.9.
+        if options[:google_client]
+          raise ArgumentError.new("Deprecated argument no longer works: google_client")
+        end
+
+        # They can also no longer use pkcs12 files, because Google's new auth
+        # library doesn't support them either.
+        if options[:google_key_location]
+          raise ArgumentError.new("Deprecated auth method no longer works: google_key_location")
+        end
+        if options[:google_key_string]
+          raise ArgumentError.new("Deprecated auth method no longer works: google_key_string")
+        end
+
+        # Google client email option is no longer needed
+        if options[:google_client_email]
+          Fog::Logger.deprecation("Argument no longer needed for auth: google_client_email")
+        end
+
+        # Validate required arguments
+        unless options[:google_api_scope_url]
+          raise ArgumentError.new("Missing required arguments: google_api_scope_url")
+        end
+      end
+
+      # Helper method to checks whether the necessary fields are present in
+      # JSON key credentials
+      #
+      # @param [String]  json_key - Google json auth key string
+      def validate_json_credentials(json_key)
+        json_key_hash = Fog::JSON.decode(json_key)
+
+        unless json_key_hash.key?("client_email") || json_key_hash.key?("private_key")
+          raise ArgumentError.new("Invalid Google JSON key")
+        end
+      end
     end
   end
 end

data/lib/fog/google/sql.rb

@@ -8,9 +8,9 @@ module Fog
       recognizes(
         :app_name,
         :app_version,
+        :google_application_default,
         :google_auth,
         :google_client,
-        :google_client_email,
         :google_client_options,
         :google_key_location,
         :google_key_string,

data/lib/fog/google/version.rb

@@ -1,5 +1,5 @@
 module Fog
   module Google
-    VERSION = "1.8.2".freeze
+    VERSION = "1.12.0".freeze
   end
 end

data/lib/fog/storage/google_json.rb

@@ -9,9 +9,9 @@ module Fog
       recognizes(
         :app_name,
         :app_version,
+        :google_application_default,
         :google_auth,
         :google_client,
-        :google_client_email,
         :google_client_options,
         :google_key_location,
         :google_key_string,
@@ -27,6 +27,10 @@ module Fog
       GOOGLE_STORAGE_JSON_BASE_URL = "https://www.googleapis.com/storage/".freeze
       GOOGLE_STORAGE_BUCKET_BASE_URL = "https://storage.googleapis.com/".freeze
 
+      # Version of IAM API used for blob signing, see Fog::Storage::GoogleJSON::Real#iam_signer
+      GOOGLE_STORAGE_JSON_IAM_API_VERSION = "v1".freeze
+      GOOGLE_STORAGE_JSON_IAM_API_SCOPE_URLS = %w(https://www.googleapis.com/auth/devstorage.full_control).freeze
+
       # TODO: Come up with a way to only request a subset of permissions.
       # https://cloud.google.com/storage/docs/json_api/v1/how-tos/authorizing
       GOOGLE_STORAGE_JSON_API_SCOPE_URLS = %w(https://www.googleapis.com/auth/devstorage.full_control).freeze

data/lib/fog/storage/google_json/mock.rb

@@ -10,11 +10,17 @@ module Fog
         def initialize(options = {})
           shared_initialize(options[:google_project], GOOGLE_STORAGE_JSON_API_VERSION, GOOGLE_STORAGE_JSON_BASE_URL)
           @client = MockClient.new('test')
+          @storage_json = MockClient.new('test')
+          @iam_service = MockClient.new('test')
         end
 
         def signature(_params)
           "foo"
         end
+
+        def google_access_id
+          "my-account@project.iam.gserviceaccount"
+        end
       end
     end
   end

data/lib/fog/storage/google_json/real.rb

@@ -13,7 +13,14 @@ module Fog
           options[:google_api_scope_url] = GOOGLE_STORAGE_JSON_API_SCOPE_URLS.join(" ")
           @host = options[:host] || "storage.googleapis.com"
 
+          # TODO(temikus): Do we even need this client?
           @client = initialize_google_client(options)
+          # IAM client used for SignBlob API
+          @iam_service = ::Google::Apis::IamcredentialsV1::IAMCredentialsService.new
+          apply_client_options(@iam_service, {
+                                 google_api_scope_url: GOOGLE_STORAGE_JSON_IAM_API_SCOPE_URLS.join(" ")
+                               })
+
           @storage_json = ::Google::Apis::StorageV1::StorageService.new
           apply_client_options(@storage_json, options)
 
@@ -56,12 +63,108 @@ DATA
           canonical_resource.chop!
           string_to_sign << canonical_resource.to_s
 
-          key = OpenSSL::PKey::RSA.new(@client.signing_key)
-          digest = OpenSSL::Digest::SHA256.new
-          signed_string = key.sign(digest, string_to_sign)
+          # TODO(temikus): make signer configurable or add ability to supply your own via lambda
+          if !@storage_json.authorization.signing_key.nil?
+            signed_string = default_signer(string_to_sign)
+          else
+            # If client doesn't contain signing key attempt to auth via IAM SignBlob API
+            signed_string = iam_signer(string_to_sign)
+          end
 
           Base64.encode64(signed_string).chomp!
         end
+
+        private
+
+        def google_access_id
+          @google_access_id ||= get_google_access_id
+        end
+
+        ##
+        # Fetches the google service account name
+        #
+        # @return [String] Service account name, typically needed for GoogleAccessId, e.g.
+        #   my-account@project.iam.gserviceaccount
+        # @raises [Fog::Errors::Error] If authorisation is incorrect or inapplicable for current action
+        def get_google_access_id
+          if @storage_json.authorization.is_a?(::Google::Auth::UserRefreshCredentials)
+            raise Fog::Errors::Error.new("User / Application Default Credentials are not supported for storage"\
+                                         "url signing, please use a service account or metadata authentication.")
+          end
+
+          if !@storage_json.authorization.issuer.nil?
+            return @storage_json.authorization.issuer
+          else
+            get_access_id_from_metadata
+          end
+        end
+
+        ##
+        # Attempts to fetch the google service account name from metadata using Google::Cloud::Env
+        #
+        # @return [String] Service account name, typically needed for GoogleAccessId, e.g.
+        #   my-account@project.iam.gserviceaccount
+        # @raises [Fog::Errors::Error] If Metadata service is not available or returns an invalid response
+        def get_access_id_from_metadata
+          if @google_cloud_env.metadata?
+            access_id = @google_cloud_env.lookup_metadata("instance", "service-accounts/default/email")
+          else
+            raise Fog::Errors::Error.new("Metadata service not available, unable to retrieve service account info.")
+          end
+
+          if access_id.nil?
+            raise Fog::Errors::Error.new("Metadata service found but didn't return data." \
+               "Please file a bug: https://github.com/fog/fog-google")
+          end
+
+          return access_id
+        end
+
+        ##
+        # Default url signer using service account keys
+        #
+        # @param [String] string_to_sign Special collection of headers and options for V2 storage signing, e.g.:
+        #
+        #   StringToSign = HTTP_Verb + "\n" +
+        #                  Content_MD5 + "\n" +
+        #                  Content_Type + "\n" +
+        #                  Expires + "\n" +
+        #                  Canonicalized_Extension_Headers +
+        #                  Canonicalized_Resource
+        #
+        #   See https://cloud.google.com/storage/docs/access-control/signed-urls-v2
+        # @return [String] Signature binary blob
+        def default_signer(string_to_sign)
+          key = OpenSSL::PKey::RSA.new(@storage_json.authorization.signing_key)
+          digest = OpenSSL::Digest::SHA256.new
+          return key.sign(digest, string_to_sign)
+        end
+
+        ##
+        # Fallback URL signer using the IAM SignServiceAccountBlob API, see
+        #   Google::Apis::IamcredentialsV1::IAMCredentialsService#sign_service_account_blob
+        #
+        # @param [String] string_to_sign Special collection of headers and options for V2 storage signing, e.g.:
+        #
+        #   StringToSign = HTTP_Verb + "\n" +
+        #                  Content_MD5 + "\n" +
+        #                  Content_Type + "\n" +
+        #                  Expires + "\n" +
+        #                  Canonicalized_Extension_Headers +
+        #                  Canonicalized_Resource
+        #
+        #   See https://cloud.google.com/storage/docs/access-control/signed-urls-v2
+        # @return [String] Signature binary blob
+        def iam_signer(string_to_sign)
+          request = {
+            "payload": string_to_sign
+          }
+
+          resource = "projects/-/serviceAccounts/#{google_access_id}"
+          response = @iam_service.sign_service_account_blob resource, request, {}
+
+          return response.signed_blob
+        end
       end
     end
   end