cloud-sql-python-connector 1.17.0__py3-none-any.whl

google/cloud/sql/connector/refresh_utils.py

@@ -0,0 +1,154 @@
+"""
+Copyright 2021 Google LLC
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+  https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import copy
+import datetime
+import logging
+import random
+from typing import Any, Callable
+
+import aiohttp
+from google.auth.credentials import Credentials
+from google.auth.credentials import Scoped
+import google.auth.transport.requests
+
+logger = logging.getLogger(name=__name__)
+
+# _refresh_buffer is the amount of time before a refresh's result expires
+# that a new refresh operation begins.
+_refresh_buffer: int = 4 * 60  # 4 minutes
+
+
+def _seconds_until_refresh(
+    expiration: datetime.datetime,
+) -> int:
+    """
+    Calculates the duration to wait before starting the next refresh.
+
+    Usually the duration will be half of the time until certificate
+    expiration.
+
+    :rtype: int
+    :returns: Time in seconds to wait before performing next refresh.
+    """
+
+    duration = int(
+        (expiration - datetime.datetime.now(datetime.timezone.utc)).total_seconds()
+    )
+
+    # if certificate duration is less than 1 hour
+    if duration < 3600:
+        # something is wrong with certificate, refresh now
+        if duration < _refresh_buffer:
+            return 0
+        # otherwise wait until 4 minutes before expiration for next refresh
+        return duration - _refresh_buffer
+
+    return duration // 2
+
+
+async def _is_valid(task: asyncio.Task) -> bool:
+    try:
+        metadata = await task
+        # only valid if now is before the cert expires
+        if datetime.datetime.now(datetime.timezone.utc) < metadata.expiration:
+            return True
+    except Exception:
+        # supress any errors from task
+        logger.debug("Current instance metadata is invalid.")
+    return False
+
+
+def _downscope_credentials(
+    credentials: Credentials,
+    scopes: list[str] = ["https://www.googleapis.com/auth/sqlservice.login"],
+) -> Credentials:
+    """Generate a down-scoped credential.
+
+    :type credentials: google.auth.credentials.Credentials
+    :param credentials
+        Credentials object used to generate down-scoped credentials.
+
+    :type scopes: list[str]
+    :param scopes
+        List of Google scopes to include in down-scoped credentials object.
+
+    :rtype: google.auth.credentials.Credentials
+    :returns: Down-scoped credentials object.
+    """
+    # credentials sourced from a service account or metadata are children of
+    # Scoped class and are capable of being re-scoped
+    if isinstance(credentials, Scoped):
+        scoped_creds = credentials.with_scopes(scopes=scopes)
+    # authenticated user credentials can not be re-scoped
+    else:
+        # create shallow copy to not overwrite scopes on default credentials
+        scoped_creds = copy.copy(credentials)
+        # overwrite '_scopes' to down-scope user credentials
+        # Cloud SDK reference: https://github.com/google-cloud-sdk-unofficial/google-cloud-sdk/blob/93920ccb6d2cce0fe6d1ce841e9e33410551d66b/lib/googlecloudsdk/command_lib/sql/generate_login_token_util.py#L116
+        scoped_creds._scopes = scopes
+    # down-scoped credentials require refresh, are invalid after being re-scoped
+    request = google.auth.transport.requests.Request()
+    scoped_creds.refresh(request)
+    return scoped_creds
+
+
+def _exponential_backoff(attempt: int) -> float:
+    """Calculates a duration to backoff in milliseconds based on the attempt i.
+
+    The formula is:
+
+    base * multi^(attempt + 1 + random)
+
+    With base = 200ms and multi = 1.618, and random = [0.0, 1.0),
+    the backoff values would fall between the following low and high ends:
+
+    Attempt  Low (ms)  High (ms)
+
+    0         324	     524
+    1         524	     847
+    2         847	    1371
+    3        1371	    2218
+    4        2218	    3588
+
+    The theoretical worst case scenario would have a client wait 8.5s in total
+    for an API request to complete (with the first four attempts failing, and
+    the fifth succeeding).
+    """
+    base = 200
+    multi = 1.618
+    exp = attempt + 1 + random.random()
+    return base * pow(multi, exp)
+
+
+async def retry_50x(
+    request_coro: Callable, *args: Any, **kwargs: Any
+) -> aiohttp.ClientResponse:
+    """Retry any 50x HTTP response up to X number of times."""
+    max_retries = 5
+    for i in range(max_retries):
+        resp = await request_coro(*args, **kwargs)
+        # backoff for any 50X errors
+        if resp.status >= 500 and i < max_retries:
+            # calculate backoff time
+            backoff = _exponential_backoff(i)
+            await asyncio.sleep(backoff / 1000)
+        else:
+            break
+    return resp

google/cloud/sql/connector/resolver.py

@@ -0,0 +1,70 @@
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import dns.asyncresolver
+
+from google.cloud.sql.connector.connection_name import (
+    _parse_connection_name_with_domain_name,
+)
+from google.cloud.sql.connector.connection_name import _parse_connection_name
+from google.cloud.sql.connector.connection_name import ConnectionName
+from google.cloud.sql.connector.exceptions import DnsResolutionError
+
+
+class DefaultResolver:
+    """DefaultResolver simply validates and parses instance connection name."""
+
+    async def resolve(self, connection_name: str) -> ConnectionName:
+        return _parse_connection_name(connection_name)
+
+
+class DnsResolver(dns.asyncresolver.Resolver):
+    """
+    DnsResolver resolves domain names into instance connection names using
+    TXT records in DNS.
+    """
+
+    async def resolve(self, dns: str) -> ConnectionName:  # type: ignore
+        try:
+            conn_name = _parse_connection_name(dns)
+        except ValueError:
+            # The connection name was not project:region:instance format.
+            # Attempt to query a TXT record to get connection name.
+            conn_name = await self.query_dns(dns)
+        return conn_name
+
+    async def query_dns(self, dns: str) -> ConnectionName:
+        try:
+            # Attempt to query the TXT records.
+            records = await super().resolve(dns, "TXT", raise_on_no_answer=True)
+            # Sort the TXT record values alphabetically, strip quotes as record
+            # values can be returned as raw strings
+            rdata = [record.to_text().strip('"') for record in records]
+            rdata.sort()
+            # Attempt to parse records, returning the first valid record.
+            for record in rdata:
+                try:
+                    conn_name = _parse_connection_name_with_domain_name(record, dns)
+                    return conn_name
+                except Exception:
+                    continue
+            # If all records failed to parse, throw error
+            raise DnsResolutionError(
+                f"Unable to parse TXT record for `{dns}` -> `{rdata[0]}`"
+            )
+        # Don't override above DnsResolutionError
+        except DnsResolutionError:
+            raise
+        except Exception as e:
+            raise DnsResolutionError(f"Unable to resolve TXT record for `{dns}`") from e

google/cloud/sql/connector/utils.py

@@ -0,0 +1,103 @@
+"""
+Copyright 2019 Google LLC
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+"""
+
+import aiofiles
+from cryptography.hazmat.backends import default_backend
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
+
+
+async def generate_keys() -> tuple[bytes, str]:
+    """A helper function to generate the private and public keys.
+
+    backend - The value specified is default_backend(). This is because the
+    cryptography library used to support different backends, but now only uses
+    the default_backend().
+
+    public_exponent - The public exponent is one of the variables used in the
+    generation of the keys. 65537 is recommended due to being a good balance
+    between speed and security.
+
+    key_size - The cryptography documentation recommended a key_size
+    of at least 2048.
+
+    """
+    private_key_obj = rsa.generate_private_key(
+        backend=default_backend(), public_exponent=65537, key_size=2048
+    )
+
+    pub_key = (
+        private_key_obj.public_key()
+        .public_bytes(
+            encoding=serialization.Encoding.PEM,
+            format=serialization.PublicFormat.SubjectPublicKeyInfo,
+        )
+        .decode("UTF-8")
+    )
+
+    priv_key = private_key_obj.private_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PrivateFormat.TraditionalOpenSSL,
+        encryption_algorithm=serialization.NoEncryption(),
+    )
+
+    return priv_key, pub_key
+
+
+async def write_to_file(
+    dir_path: str, serverCaCert: str, ephemeralCert: str, priv_key: bytes
+) -> tuple[str, str, str]:
+    """
+    Helper function to write the serverCaCert, ephemeral certificate and
+    private key to .pem files in a given directory
+    """
+    ca_filename = f"{dir_path}/ca.pem"
+    cert_filename = f"{dir_path}/cert.pem"
+    key_filename = f"{dir_path}/priv.pem"
+
+    async with aiofiles.open(ca_filename, "w+") as ca_out:
+        await ca_out.write(serverCaCert)
+    async with aiofiles.open(cert_filename, "w+") as ephemeral_out:
+        await ephemeral_out.write(ephemeralCert)
+    async with aiofiles.open(key_filename, "wb") as priv_out:
+        await priv_out.write(priv_key)
+
+    return (ca_filename, cert_filename, key_filename)
+
+
+def format_database_user(database_version: str, user: str) -> str:
+    """
+    Format database `user` param for Cloud SQL automatic IAM authentication.
+
+    :type database_version: str
+    :param database_version
+        Cloud SQL database version. (i.e. POSTGRES_14, MYSQL8_0, etc.)
+
+    :type user: str
+    :param user
+        Database username to connect to Cloud SQL database with.
+    """
+    # remove suffix for Postgres service accounts
+    if database_version.startswith("POSTGRES"):
+        suffix = ".gserviceaccount.com"
+        user = user[: -len(suffix)] if user.endswith(suffix) else user
+        return user
+
+    # remove everything after and including the @ for MySQL
+    if database_version.startswith("MYSQL") and "@" in user:
+        return user.split("@")[0]
+
+    return user

google/cloud/sql/connector/version.py

@@ -0,0 +1,15 @@
+# Copyright 2021 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+__version__ = "1.17.0"