google-cloud-policy_troubleshooter 1.3.0 → 1.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5710c0483917c149660a99042656f133a7a4c02762c3d5269d0bbbe271746850
-  data.tar.gz: fe380b36a753045404522fcdc43469c80abb919bdcde3a0f3d5ebf940e49e00c
+  metadata.gz: 48baf1b273689804d757541a11cd6a055304d27aeab11ca49bfd407489f3a25f
+  data.tar.gz: 3cd27c047d66617898f6503278898597f719fc21e66f7927a74241d71c3188d7
 SHA512:
-  metadata.gz: 2baa1a0429dfe7029b08fa718143de49388bc8000409d4537ed68d60f5d324e5e75c4bf24543cc2b3210c61389e53145f281b3ffb3249bdf65053c5a3da4e93e
-  data.tar.gz: b50dcc70773c3de39a7611dc056e3306f10499d95322b7d1e6f358bc6a6330b8c6bf018b8a1cc23b548cef5d3799cd0900109443c277506afe2b6986baa1716d
+  metadata.gz: 88f0caba0f9a6d686f14549d4a7a050cc150ffa31e1eda57329c846320a359d559684c598ba486bc8a0a8992136cdeb16aacc3d0544912a95a6ccd47defa3da7
+  data.tar.gz: 9433beea93e873a2e285c0d7f994c4d605805897b92874f95aaf7ecd4f0e0f25af3e0d6b838e7bfd78918ae81390642a3244620637a03b181941ee0543470dbc

data/AUTHENTICATION.md

@@ -1,151 +1,122 @@
 # Authentication
 
-In general, the google-cloud-policy_troubleshooter library uses
-[Service Account](https://cloud.google.com/iam/docs/creating-managing-service-accounts)
-credentials to connect to Google Cloud services. When running within
-[Google Cloud Platform environments](#google-cloud-platform-environments) the
-credentials will be discovered automatically. When running on other
-environments, the Service Account credentials can be specified by providing the
-path to the
-[JSON keyfile](https://cloud.google.com/iam/docs/managing-service-account-keys)
-for the account (or the JSON itself) in
-[environment variables](#environment-variables). Additionally, Cloud SDK
-credentials can also be discovered automatically, but this is only recommended
-during development.
+The recommended way to authenticate to the google-cloud-policy_troubleshooter library is to use
+[Application Default Credentials (ADC)](https://cloud.google.com/docs/authentication/application-default-credentials).
+To review all of your authentication options, see [Credentials lookup](#credential-lookup).
 
 ## Quickstart
 
-1. [Create a service account and credentials](#creating-a-service-account).
-2. Set the [environment variable](#environment-variables).
+The following example shows how to set up authentication for a local development
+environment with your user credentials. 
 
-```sh
-export POLICY_TROUBLESHOOTER_CREDENTIALS=path/to/keyfile.json
-```
-
-3. Initialize the client.
+**NOTE:** This method is _not_ recommended for running in production. User credentials
+should be used only during development.
 
-```ruby
-require "google/cloud/policy_troubleshooter"
+1. [Download and install the Google Cloud CLI](https://cloud.google.com/sdk).
+2. Set up a local ADC file with your user credentials:
 
-client = Google::Cloud::PolicyTroubleshooter.iam_checker
+```sh
+gcloud auth application-default login
 ```
 
-## Credential Lookup
-
-The google-cloud-policy_troubleshooter library aims to make authentication
-as simple as possible, and provides several mechanisms to configure your system
-without requiring **Service Account Credentials** directly in code.
-
-**Credentials** are discovered in the following order:
-
-1. Specify credentials in method arguments
-2. Specify credentials in configuration
-3. Discover credentials path in environment variables
-4. Discover credentials JSON in environment variables
-5. Discover credentials file in the Cloud SDK's path
-6. Discover GCP credentials
-
-### Google Cloud Platform environments
+3. Write code as if already authenticated.
 
-When running on Google Cloud Platform (GCP), including Google Compute Engine
-(GCE), Google Kubernetes Engine (GKE), Google App Engine (GAE), Google Cloud
-Functions (GCF) and Cloud Run, **Credentials** are discovered automatically.
-Code should be written as if already authenticated.
+For more information about setting up authentication for a local development environment, see
+[Set up Application Default Credentials](https://cloud.google.com/docs/authentication/provide-credentials-adc#local-dev).
 
-### Environment Variables
+## Credential Lookup
 
-The **Credentials JSON** can be placed in environment variables instead of
-declaring them directly in code. Each service has its own environment variable,
-allowing for different service accounts to be used for different services. (See
-the READMEs for the individual service gems for details.) The path to the
-**Credentials JSON** file can be stored in the environment variable, or the
-**Credentials JSON** itself can be stored for environments such as Docker
-containers where writing files is difficult or not encouraged.
+The google-cloud-policy_troubleshooter library provides several mechanisms to configure your system.
+Generally, using Application Default Credentials to facilitate automatic 
+credentials discovery is the easist method. But if you need to explicitly specify
+credentials, there are several methods available to you.
 
-The environment variables that google-cloud-policy_troubleshooter
-checks for credentials are configured on the service Credentials class (such as
-`::Google::Cloud::PolicyTroubleshooter::V1::IamChecker::Credentials`):
+Credentials are accepted in the following ways, in the following order or precedence:
 
-* `POLICY_TROUBLESHOOTER_CREDENTIALS` - Path to JSON file, or JSON contents
-* `POLICY_TROUBLESHOOTER_KEYFILE` - Path to JSON file, or JSON contents
-* `GOOGLE_CLOUD_CREDENTIALS` - Path to JSON file, or JSON contents
-* `GOOGLE_CLOUD_KEYFILE` - Path to JSON file, or JSON contents
-* `GOOGLE_APPLICATION_CREDENTIALS` - Path to JSON file
+1. Credentials specified in method arguments
+2. Credentials specified in configuration
+3. Credentials pointed to or included in environment variables
+4. Credentials found in local ADC file
+5. Credentials returned by the metadata server for the attached service account (GCP)
 
-```ruby
-require "google/cloud/policy_troubleshooter"
-
-ENV["POLICY_TROUBLESHOOTER_CREDENTIALS"] = "path/to/keyfile.json"
+### Configuration
 
-client = Google::Cloud::PolicyTroubleshooter.iam_checker
-```
+You can configure a path to a JSON credentials file, either for an individual client object or
+globally, for all client objects. The JSON file can contain credentials created for
+[workload identity federation](https://cloud.google.com/iam/docs/workload-identity-federation),
+[workforce identity federation](https://cloud.google.com/iam/docs/workforce-identity-federation), or a
+[service account key](https://cloud.google.com/docs/authentication/provide-credentials-adc#local-key).
 
-### Configuration
+Note: Service account keys are a security risk if not managed correctly. You should
+[choose a more secure alternative to service account keys](https://cloud.google.com/docs/authentication#auth-decision-tree)
+whenever possible.
 
-The path to the **Credentials JSON** file can be configured instead of storing
-it in an environment variable. Either on an individual client initialization:
+To configure a credentials file for an individual client initialization:
 
 ```ruby
 require "google/cloud/policy_troubleshooter"
 
 client = Google::Cloud::PolicyTroubleshooter.iam_checker do |config|
-  config.credentials = "path/to/keyfile.json"
+  config.credentials = "path/to/credentialfile.json"
 end
 ```
 
-Or globally for all clients:
+To configure a credentials file globally for all clients:
 
 ```ruby
 require "google/cloud/policy_troubleshooter"
 
 Google::Cloud::PolicyTroubleshooter.configure do |config|
-  config.credentials = "path/to/keyfile.json"
+  config.credentials = "path/to/credentialfile.json"
 end
 
 client = Google::Cloud::PolicyTroubleshooter.iam_checker
 ```
 
-### Cloud SDK
+### Environment Variables
 
-This option allows for an easy way to authenticate during development. If
-credentials are not provided in code or in environment variables, then Cloud SDK
-credentials are discovered.
+You can also use an environment variable to provide a JSON credentials file.
+The environment variable can contain a path to the credentials file or, for
+environments such as Docker containers where writing files is not encouraged,
+you can include the credentials file itself.
 
-To configure your system for this, simply:
+The JSON file can contain credentials created for
+[workload identity federation](https://cloud.google.com/iam/docs/workload-identity-federation),
+[workforce identity federation](https://cloud.google.com/iam/docs/workforce-identity-federation), or a
+[service account key](https://cloud.google.com/docs/authentication/provide-credentials-adc#local-key).
 
-1. [Download and install the Cloud SDK](https://cloud.google.com/sdk)
-2. Authenticate using OAuth 2.0 `$ gcloud auth application-default login`
-3. Write code as if already authenticated.
+Note: Service account keys are a security risk if not managed correctly. You should
+[choose a more secure alternative to service account keys](https://cloud.google.com/docs/authentication#auth-decision-tree)
+whenever possible.
+
+The environment variables that google-cloud-policy_troubleshooter
+checks for credentials are:
 
-**NOTE:** This is _not_ recommended for running in production. The Cloud SDK
-*should* only be used during development.
+* `GOOGLE_CLOUD_CREDENTIALS` - Path to JSON file, or JSON contents
+* `GOOGLE_APPLICATION_CREDENTIALS` - Path to JSON file
 
-## Creating a Service Account
+```ruby
+require "google/cloud/policy_troubleshooter"
 
-Google Cloud requires **Service Account Credentials** to
-connect to the APIs. You will use the **JSON key file** to
-connect to most services with google-cloud-policy_troubleshooter.
+ENV["GOOGLE_APPLICATION_CREDENTIALS"] = "path/to/credentialfile.json"
 
-If you are not running this client within
-[Google Cloud Platform environments](#google-cloud-platform-environments), you
-need a Google Developers service account.
+client = Google::Cloud::PolicyTroubleshooter.iam_checker
+```
 
-1. Visit the [Google Cloud Console](https://console.cloud.google.com/project).
-2. Create a new project or click on an existing project.
-3. Activate the menu in the upper left and select **APIs & Services**. From
-   here, you will enable the APIs that your application requires.
+### Local ADC file
 
-   *Note: You may need to enable billing in order to use these services.*
+You can set up a local ADC file with your user credentials for authentication during
+development. If credentials are not provided in code or in environment variables,
+then the local ADC credentials are discovered.
 
-4. Select **Credentials** from the side navigation.
+Follow the steps in [Quickstart](#quickstart) to set up a local ADC file.
 
-   Find the "Create credentials" drop down near the top of the page, and select
-   "Service account" to be guided through downloading a new JSON key file.
+### Google Cloud Platform environments
 
-   If you want to re-use an existing service account, you can easily generate a
-   new key file. Just select the account you wish to re-use, click the pencil
-   tool on the right side to edit the service account, select the **Keys** tab,
-   and then select **Add Key**.
+When running on Google Cloud Platform (GCP), including Google Compute Engine
+(GCE), Google Kubernetes Engine (GKE), Google App Engine (GAE), Google Cloud
+Functions (GCF) and Cloud Run, credentials are retrieved from the attached
+service account automatically. Code should be written as if already authenticated.
 
-   The key file you download will be used by this library to authenticate API
-   requests and should be stored in a secure location.
+For more information, see
+[Set up ADC for Google Cloud services](https://cloud.google.com/docs/authentication/provide-credentials-adc#attached-sa).

data/README.md

@@ -16,7 +16,8 @@ for this library, google-cloud-policy_troubleshooter, to see the convenience met
 constructing client objects. Reference documentation for the client objects
 themselves can be found in the client library documentation for the versioned
 client gems:
-[google-cloud-policy_troubleshooter-v1](https://googleapis.dev/ruby/google-cloud-policy_troubleshooter-v1/latest).
+[google-cloud-policy_troubleshooter-v1](https://cloud.google.com/ruby/docs/reference/google-cloud-policy_troubleshooter-v1/latest),
+[google-cloud-policy_troubleshooter-iam-v3](https://cloud.google.com/ruby/docs/reference/google-cloud-policy_troubleshooter-iam-v3/latest).
 
 See also the [Product Documentation](https://cloud.google.com/iam/docs/troubleshooting-access)
 for more usage information.

data/lib/google/cloud/policy_troubleshooter/iam/version.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Auto-generated by gapic-generator-ruby. DO NOT EDIT!
+
+
+module Google
+  module Cloud
+    module PolicyTroubleshooter
+      module Iam
+        # @private Unused
+        VERSION = ""
+      end
+    end
+  end
+end

data/lib/google/cloud/policy_troubleshooter/iam.rb

@@ -0,0 +1,124 @@
+# frozen_string_literal: true
+
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Auto-generated by gapic-generator-ruby. DO NOT EDIT!
+
+# Require this file early so that the version constant gets defined before
+# requiring "google/cloud". This is because google-cloud-core will load the
+# entrypoint (gem name) file, which in turn re-requires this file (hence
+# causing a require cycle) unless the version constant is already defined.
+require "google/cloud/policy_troubleshooter/iam/version"
+
+require "googleauth"
+gem "google-cloud-core"
+require "google/cloud" unless defined? ::Google::Cloud.new
+require "google/cloud/config"
+
+# Set the default configuration
+::Google::Cloud.configure.add_config! :policy_troubleshooter_iam do |config|
+  config.add_field! :endpoint,      nil, match: ::String
+  config.add_field! :credentials,   nil, match: [::String, ::Hash, ::Google::Auth::Credentials]
+  config.add_field! :scope,         nil, match: [::Array, ::String]
+  config.add_field! :lib_name,      nil, match: ::String
+  config.add_field! :lib_version,   nil, match: ::String
+  config.add_field! :interceptors,  nil, match: ::Array
+  config.add_field! :timeout,       nil, match: ::Numeric
+  config.add_field! :metadata,      nil, match: ::Hash
+  config.add_field! :retry_policy,  nil, match: [::Hash, ::Proc]
+  config.add_field! :quota_project, nil, match: ::String
+  config.add_field! :universe_domain, nil, match: ::String
+end
+
+module Google
+  module Cloud
+    module PolicyTroubleshooter
+      module Iam
+        ##
+        # Create a new client object for PolicyTroubleshooter.
+        #
+        # By default, this returns an instance of
+        # [Google::Cloud::PolicyTroubleshooter::Iam::V3::PolicyTroubleshooter::Client](https://cloud.google.com/ruby/docs/reference/google-cloud-policy_troubleshooter-iam-v3/latest/Google-Cloud-PolicyTroubleshooter-Iam-V3-PolicyTroubleshooter-Client)
+        # for a gRPC client for version V3 of the API.
+        # However, you can specify a different API version by passing it in the
+        # `version` parameter. If the PolicyTroubleshooter service is
+        # supported by that API version, and the corresponding gem is available, the
+        # appropriate versioned client will be returned.
+        # You can also specify a different transport by passing `:rest` or `:grpc` in
+        # the `transport` parameter.
+        #
+        # ## About PolicyTroubleshooter
+        #
+        # IAM Policy Troubleshooter service.
+        #
+        # This service helps you troubleshoot access issues for Google Cloud resources.
+        #
+        # @param version [::String, ::Symbol] The API version to connect to. Optional.
+        #   Defaults to `:v3`.
+        # @param transport [:grpc, :rest] The transport to use. Defaults to `:grpc`.
+        # @return [::Object] A client object for the specified version.
+        #
+        def self.policy_troubleshooter version: :v3, transport: :grpc, &block
+          require "google/cloud/policy_troubleshooter/iam/#{version.to_s.downcase}"
+
+          package_name = Google::Cloud::PolicyTroubleshooter::Iam
+                         .constants
+                         .select { |sym| sym.to_s.downcase == version.to_s.downcase.tr("_", "") }
+                         .first
+          service_module = Google::Cloud::PolicyTroubleshooter::Iam.const_get(package_name).const_get(:PolicyTroubleshooter)
+          service_module = service_module.const_get(:Rest) if transport == :rest
+          service_module.const_get(:Client).new(&block)
+        end
+
+        ##
+        # Configure the google-cloud-policy_troubleshooter-iam library.
+        #
+        # The following configuration parameters are supported:
+        #
+        # * `credentials` (*type:* `String, Hash, Google::Auth::Credentials`) -
+        #   The path to the keyfile as a String, the contents of the keyfile as a
+        #   Hash, or a Google::Auth::Credentials object.
+        # * `lib_name` (*type:* `String`) -
+        #   The library name as recorded in instrumentation and logging.
+        # * `lib_version` (*type:* `String`) -
+        #   The library version as recorded in instrumentation and logging.
+        # * `interceptors` (*type:* `Array<GRPC::ClientInterceptor>`) -
+        #   An array of interceptors that are run before calls are executed.
+        # * `timeout` (*type:* `Numeric`) -
+        #   Default timeout in seconds.
+        # * `metadata` (*type:* `Hash{Symbol=>String}`) -
+        #   Additional headers to be sent with the call.
+        # * `retry_policy` (*type:* `Hash`) -
+        #   The retry policy. The value is a hash with the following keys:
+        #     * `:initial_delay` (*type:* `Numeric`) - The initial delay in seconds.
+        #     * `:max_delay` (*type:* `Numeric`) - The max delay in seconds.
+        #     * `:multiplier` (*type:* `Numeric`) - The incremental backoff multiplier.
+        #     * `:retry_codes` (*type:* `Array<String>`) -
+        #       The error codes that should trigger a retry.
+        #
+        # @return [::Google::Cloud::Config] The default configuration used by this library
+        #
+        def self.configure
+          yield ::Google::Cloud.configure.policy_troubleshooter_iam if block_given?
+
+          ::Google::Cloud.configure.policy_troubleshooter_iam
+        end
+      end
+    end
+  end
+end
+
+helper_path = ::File.join __dir__, "iam", "helpers.rb"
+require "google/cloud/policy_troubleshooter/iam/helpers" if ::File.file? helper_path

data/lib/google/cloud/policy_troubleshooter/version.rb

@@ -20,7 +20,7 @@
 module Google
   module Cloud
     module PolicyTroubleshooter
-      VERSION = "1.3.0"
+      VERSION = "1.5.0"
     end
   end
 end

data/lib/google/cloud/policy_troubleshooter.rb

@@ -29,7 +29,7 @@ require "google/cloud/config"
 
 # Set the default configuration
 ::Google::Cloud.configure.add_config! :policy_troubleshooter do |config|
-  config.add_field! :endpoint,      "policytroubleshooter.googleapis.com", match: ::String
+  config.add_field! :endpoint,      nil, match: ::String
   config.add_field! :credentials,   nil, match: [::String, ::Hash, ::Google::Auth::Credentials]
   config.add_field! :scope,         nil, match: [::Array, ::String]
   config.add_field! :lib_name,      nil, match: ::String
@@ -39,6 +39,7 @@ require "google/cloud/config"
   config.add_field! :metadata,      nil, match: ::Hash
   config.add_field! :retry_policy,  nil, match: [::Hash, ::Proc]
   config.add_field! :quota_project, nil, match: ::String
+  config.add_field! :universe_domain, nil, match: ::String
 end
 
 module Google
@@ -48,7 +49,7 @@ module Google
       # Create a new client object for IamChecker.
       #
       # By default, this returns an instance of
-      # [Google::Cloud::PolicyTroubleshooter::V1::IamChecker::Client](https://googleapis.dev/ruby/google-cloud-policy_troubleshooter-v1/latest/Google/Cloud/PolicyTroubleshooter/V1/IamChecker/Client.html)
+      # [Google::Cloud::PolicyTroubleshooter::V1::IamChecker::Client](https://cloud.google.com/ruby/docs/reference/google-cloud-policy_troubleshooter-v1/latest/Google-Cloud-PolicyTroubleshooter-V1-IamChecker-Client)
       # for a gRPC client for version V1 of the API.
       # However, you can specify a different API version by passing it in the
       # `version` parameter. If the IamChecker service is

data/lib/google-cloud-policy_troubleshooter.rb

@@ -17,3 +17,4 @@
 # Auto-generated by gapic-generator-ruby. DO NOT EDIT!
 
 require "google/cloud/policy_troubleshooter" unless defined? Google::Cloud::PolicyTroubleshooter::VERSION
+require "google/cloud/policy_troubleshooter/iam" unless defined? Google::Cloud::PolicyTroubleshooter::Iam::VERSION

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: google-cloud-policy_troubleshooter
 version: !ruby/object:Gem::Version
-  version: 1.3.0
+  version: 1.5.0
 platform: ruby
 authors:
 - Google LLC
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-03-09 00:00:00.000000000 Z
+date: 2024-01-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: google-cloud-core
@@ -30,7 +30,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0.6'
+        version: '0.10'
     - - "<"
       - !ruby/object:Gem::Version
         version: 2.a
@@ -40,7 +40,27 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0.6'
+        version: '0.10'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: 2.a
+- !ruby/object:Gem::Dependency
+  name: google-cloud-policy_troubleshooter-iam-v3
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.3'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: 2.a
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.3'
     - - "<"
       - !ruby/object:Gem::Version
         version: 2.a
@@ -172,6 +192,8 @@ files:
 - README.md
 - lib/google-cloud-policy_troubleshooter.rb
 - lib/google/cloud/policy_troubleshooter.rb
+- lib/google/cloud/policy_troubleshooter/iam.rb
+- lib/google/cloud/policy_troubleshooter/iam/version.rb
 - lib/google/cloud/policy_troubleshooter/version.rb
 homepage: https://github.com/googleapis/google-cloud-ruby
 licenses:
@@ -192,7 +214,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.2
+rubygems_version: 3.5.3
 signing_key: 
 specification_version: 4
 summary: API Client library for the IAM Policy Troubleshooter API