cloud-sql-python-connector 1.6.0__py2.py3-none-any.whl → 1.8.0__py2.py3-none-any.whl

{cloud_sql_python_connector-1.6.0.dist-info → cloud_sql_python_connector-1.8.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: cloud-sql-python-connector
-Version: 1.6.0
+Version: 1.8.0
 Summary: The Cloud SQL Python Connector is a library that can be used alongside a database driver to allow users with sufficient permissions to connect to a Cloud SQL database without having to manually allowlist IPs or manage SSL certificates.
 Home-page: https://github.com/GoogleCloudPlatform/cloud-sql-python-connector
 Author: Google LLC
@@ -15,21 +15,22 @@ Classifier: Programming Language :: Python :: 3.8
 Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
 Requires-Python: >=3.8
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: aiohttp
-Requires-Dist: cryptography (>=38.0.3)
+Requires-Dist: cryptography (>=42.0.0)
 Requires-Dist: Requests
 Requires-Dist: google-auth
 Provides-Extra: asyncpg
 Requires-Dist: asyncpg (>=0.29.0) ; extra == 'asyncpg'
 Provides-Extra: pg8000
-Requires-Dist: pg8000 (>=1.30.4) ; extra == 'pg8000'
+Requires-Dist: pg8000 (>=1.30.5) ; extra == 'pg8000'
 Provides-Extra: pymysql
 Requires-Dist: PyMySQL (>=1.1.0) ; extra == 'pymysql'
 Provides-Extra: pytds
-Requires-Dist: python-tds (>=1.13.0) ; extra == 'pytds'
+Requires-Dist: python-tds (>=1.15.0) ; extra == 'pytds'
 
 <p align="center">
     <a href="https://cloud.google.com/blog/topics/developers-practitioners/how-connect-cloud-sql-using-python-easy-way">
@@ -144,7 +145,7 @@ format "project:region:instance".
 ### How to use this Connector
 
 To connect to Cloud SQL using the connector, inititalize a `Connector`
-object and call it's `connect` method with the proper input parameters.
+object and call its `connect` method with the proper input parameters.
 
 The `Connector` itself creates connection objects by calling its `connect` method but does not manage database connection pooling. For this reason, it is recommended to use the connector alongside a library that can create connection pools, such as [SQLAlchemy](https://www.sqlalchemy.org/). This will allow for connections to remain open and be reused, reducing connection overhead and the number of connections needed.
 
@@ -200,7 +201,7 @@ with pool.connect() as db_conn:
         print(row)
 ```
 
-To close the `Connector` object's background resources, call it's `close()` method as follows:
+To close the `Connector` object's background resources, call its `close()` method as follows:
 
 ```python
 connector.close()
@@ -221,7 +222,7 @@ from google.cloud.sql.connector import Connector, IPTypes
 
 # Note: all parameters below are optional
 connector = Connector(
-    ip_type=IPTypes.PUBLIC,
+    ip_type="public",  # can also be "private" or "psc"
     enable_iam_auth=False,
     timeout=30,
     credentials=custom_creds # google.auth.credentials.Credentials
@@ -294,18 +295,16 @@ using both public and private IP addresses, as well as
 with, set the `ip_type` keyword argument when initializing a `Connector()` or when
 calling `connector.connect()`.
 
-Possible values for `ip_type` are `IPTypes.PUBLIC` (default value),
-`IPTypes.PRIVATE`, and `IPTypes.PSC`.
+Possible values for `ip_type` are `"public"` (default value),
+`"private"`, and `"psc"`.
 
 Example:
 
 ```python
-from google.cloud.sql.connector import IPTypes
-
 conn = connector.connect(
     "project:region:instance",
     "pymysql",
-    ip_type=IPTypes.PRIVATE # use private IP
+    ip_type="private"  # use private IP
 ... insert other kwargs ...
 )
 ```
@@ -366,7 +365,7 @@ conn = connector.connect(
     db="my-db-name",
     active_directory_auth=True,
     server_name="private.[instance].[location].[project].cloudsql.[domain]",
-    ip_type=IPTypes.PRIVATE
+    ip_type="private"
 )
 ```
 
@@ -391,7 +390,7 @@ your web application through the following:
 ```python
 from flask import Flask
 from flask_sqlalchemy import SQLAlchemy
-from google.cloud.sql.connector import Connector, IPTypes
+from google.cloud.sql.connector import Connector
 
 
 # initialize Python Connector object
@@ -405,7 +404,7 @@ def getconn():
         user="my-user",
         password="my-password",
         db="my-database",
-        ip_type= IPTypes.PUBLIC  # IPTypes.PRIVATE for private IP
+        ip_type="public"  # "private" for private IP
     )
     return conn
 
@@ -440,7 +439,7 @@ from sqlalchemy import create_engine
 from sqlalchemy.engine import Engine
 from sqlalchemy.ext.declarative import declarative_base
 from sqlalchemy.orm import sessionmaker
-from google.cloud.sql.connector import Connector, IPTypes
+from google.cloud.sql.connector import Connector
 
 # helper function to return SQLAlchemy connection pool
 def init_connection_pool(connector: Connector) -> Engine:
@@ -452,7 +451,7 @@ def init_connection_pool(connector: Connector) -> Engine:
             user="my-user",
             password="my-password",
             db="my-database",
-            ip_type= IPTypes.PUBLIC  # IPTypes.PRIVATE for private IP
+            ip_type="public"  # "private" for private IP
         )
         return conn
 

cloud_sql_python_connector-1.8.0.dist-info/RECORD

@@ -0,0 +1,19 @@
+google/cloud/sql/connector/__init__.py,sha256=Z3AkPOQwjNF1ogo2DR18GN-CnYvI4MTmhsCe8hURKUo,883
+google/cloud/sql/connector/asyncpg.py,sha256=c4lAlvEgGf_eBq0G8MVNPRAJQQvo6DcwybiXDW36qkU,1838
+google/cloud/sql/connector/client.py,sha256=n1v6xxtfuvNZYCUfNUWY6FdNw9uvgOnmFxpSE0NmN5M,8263
+google/cloud/sql/connector/connector.py,sha256=nx5SVEJUF6pJt3VAmjw3-XBpWKFdWHJDEABM_pPzsvc,16867
+google/cloud/sql/connector/exceptions.py,sha256=rTBtbCoiZ3U5IFVsyXPw5baHbCODixx2hPDQeXUzgzs,1524
+google/cloud/sql/connector/instance.py,sha256=G7-SCqsLjZiOYZ-Ds2RIErs6oaT0ewnAN683fs7EebI,14920
+google/cloud/sql/connector/pg8000.py,sha256=EZuO7XgCkG_Y79NQlh3Vv8Ff2w85BFJyFVO237hx1GM,1814
+google/cloud/sql/connector/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+google/cloud/sql/connector/pymysql.py,sha256=wldUgwDPlPa8Nj5F3JaipuP8hJyvzlgOAJbRnOoaB1U,2105
+google/cloud/sql/connector/pytds.py,sha256=vKJoE7E2P0GrhZojg8bGZkqCMLc8dgKAcXE4ee7vEVc,2452
+google/cloud/sql/connector/rate_limiter.py,sha256=bPTupfM4f5QRSCmCAWMqjQylEB7bUM-50plVBU3W2CA,2993
+google/cloud/sql/connector/refresh_utils.py,sha256=P2ye3qDymdK1iOlGCXby4VIaqwvHdc9GEmuUsMcufxY,3680
+google/cloud/sql/connector/utils.py,sha256=FQs7RgoViJLIFgJIynVT-_DwAVWnpyXIKu5WZ4m10Ts,3448
+google/cloud/sql/connector/version.py,sha256=uFu1vr_bHDmu9LzGZmYfAmD9Cb7yvaTRwh3jChsfq0g,597
+cloud_sql_python_connector-1.8.0.dist-info/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
+cloud_sql_python_connector-1.8.0.dist-info/METADATA,sha256=FUIl4XRA6VgxpVcTI0sNtdIxch7MtBumAsGZ1TwdvFA,24102
+cloud_sql_python_connector-1.8.0.dist-info/WHEEL,sha256=bb2Ot9scclHKMOLDEHY6B2sicWOgugjFKaJsT7vwMQo,110
+cloud_sql_python_connector-1.8.0.dist-info/top_level.txt,sha256=_1QvSJIhFAGfxb79D6DhB7SUw2X6T4rwnz_LLrbcD3c,7
+cloud_sql_python_connector-1.8.0.dist-info/RECORD,,

google/cloud/sql/connector/client.py

@@ -0,0 +1,221 @@
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from __future__ import annotations
+
+import datetime
+import logging
+from typing import Any, Dict, Optional, Tuple, TYPE_CHECKING
+
+import aiohttp
+from cryptography.hazmat.backends import default_backend
+from cryptography.x509 import load_pem_x509_certificate
+import google.auth.transport.requests
+
+from google.cloud.sql.connector.refresh_utils import _downscope_credentials
+from google.cloud.sql.connector.version import __version__ as version
+
+if TYPE_CHECKING:
+    from google.auth.credentials import Credentials
+
+USER_AGENT: str = f"cloud-sql-python-connector/{version}"
+API_VERSION: str = "v1beta4"
+
+logger = logging.getLogger(name=__name__)
+
+
+def _format_user_agent(driver: Optional[str], custom: Optional[str]) -> str:
+    agent = f"{USER_AGENT}+{driver}" if driver else USER_AGENT
+    if custom:
+        agent = f"{agent} {custom}"
+    return agent
+
+
+class CloudSQLClient:
+    def __init__(
+        self,
+        sqladmin_api_endpoint: str,
+        quota_project: Optional[str],
+        credentials: Credentials,
+        client: Optional[aiohttp.ClientSession] = None,
+        driver: Optional[str] = None,
+        user_agent: Optional[str] = None,
+    ) -> None:
+        """
+        Establish the client to be used for Cloud SQL Admin API requests.
+
+        Args:
+            sqladmin_api_endpoint (str): Base URL to use when calling
+                the Cloud SQL Admin API endpoints.
+            quota_project (str): The Project ID for an existing Google Cloud
+                project. The project specified is used for quota and
+                billing purposes.
+            credentials (google.auth.credentials.Credentials):
+                A credentials object created from the google-auth Python library.
+                Must have the Cloud SQL Admin scopes. For more info check out
+                https://google-auth.readthedocs.io/en/latest/.
+            client (aiohttp.ClientSession): Async client used to make requests to
+                Cloud SQL Admin APIs.
+                Optional, defaults to None and creates new client.
+            driver (str): Database driver to be used by the client.
+        """
+        user_agent = _format_user_agent(driver, user_agent)
+        headers = {
+            "x-goog-api-client": user_agent,
+            "User-Agent": user_agent,
+            "Content-Type": "application/json",
+        }
+        if quota_project:
+            headers["x-goog-user-project"] = quota_project
+
+        self._client = client if client else aiohttp.ClientSession(headers=headers)
+        self._credentials = credentials
+        self._sqladmin_api_endpoint = sqladmin_api_endpoint
+        self._user_agent = user_agent
+
+    async def _get_metadata(
+        self,
+        project: str,
+        region: str,
+        instance: str,
+    ) -> Dict[str, Any]:
+        """Requests metadata from the Cloud SQL Instance
+        and returns a dictionary containing the IP addresses and certificate
+        authority of the Cloud SQL Instance.
+
+        :type project: str
+        :param project:
+            A string representing the name of the project.
+
+        :type region: str
+        :param region : A string representing the name of the region.
+
+        :type instance: str
+        :param instance: A string representing the name of the instance.
+
+        :rtype: Dict[str: Union[Dict, str]]
+        :returns: Returns a dictionary containing a dictionary of all IP
+            addresses and their type and a string representing the
+            certificate authority.
+        """
+        if not self._credentials.valid:
+            request = google.auth.transport.requests.Request()
+            self._credentials.refresh(request)
+
+        headers = {
+            "Authorization": f"Bearer {self._credentials.token}",
+        }
+
+        url = f"{self._sqladmin_api_endpoint}/sql/{API_VERSION}/projects/{project}/instances/{instance}/connectSettings"
+
+        logger.debug(f"['{instance}']: Requesting metadata")
+
+        resp = await self._client.get(url, headers=headers, raise_for_status=True)
+        ret_dict = await resp.json()
+
+        if ret_dict["region"] != region:
+            raise ValueError(
+                f'[{project}:{region}:{instance}]: Provided region was mismatched - got region {region}, expected {ret_dict["region"]}.'
+            )
+
+        ip_addresses = (
+            {ip["type"]: ip["ipAddress"] for ip in ret_dict["ipAddresses"]}
+            if "ipAddresses" in ret_dict
+            else {}
+        )
+        if "dnsName" in ret_dict:
+            ip_addresses["PSC"] = ret_dict["dnsName"]
+
+        return {
+            "ip_addresses": ip_addresses,
+            "server_ca_cert": ret_dict["serverCaCert"]["cert"],
+            "database_version": ret_dict["databaseVersion"],
+        }
+
+    async def _get_ephemeral(
+        self,
+        project: str,
+        instance: str,
+        pub_key: str,
+        enable_iam_auth: bool = False,
+    ) -> Tuple[str, datetime.datetime]:
+        """Asynchronously requests an ephemeral certificate from the Cloud SQL Instance.
+
+        :type project: str
+        :param project : A string representing the name of the project.
+
+        :type instance: str
+        :param instance: A string representing the name of the instance.
+
+        :type pub_key:
+        :param str: A string representing PEM-encoded RSA public key.
+
+        :type enable_iam_auth: bool
+        :param enable_iam_auth
+            Enables automatic IAM database authentication for Postgres or MySQL
+            instances.
+
+        :rtype: str
+        :returns: An ephemeral certificate from the Cloud SQL instance that allows
+            authorized connections to the instance.
+        """
+
+        logger.debug(f"['{instance}']: Requesting ephemeral certificate")
+
+        if not self._credentials.valid:
+            request = google.auth.transport.requests.Request()
+            self._credentials.refresh(request)
+
+        headers = {
+            "Authorization": f"Bearer {self._credentials.token}",
+        }
+
+        url = f"{self._sqladmin_api_endpoint}/sql/{API_VERSION}/projects/{project}/instances/{instance}:generateEphemeralCert"
+
+        data = {"public_key": pub_key}
+
+        if enable_iam_auth:
+            # down-scope credentials with only IAM login scope (refreshes them too)
+            login_creds = _downscope_credentials(self._credentials)
+            data["access_token"] = login_creds.token
+
+        resp = await self._client.post(
+            url, headers=headers, json=data, raise_for_status=True
+        )
+
+        ret_dict = await resp.json()
+
+        ephemeral_cert: str = ret_dict["ephemeralCert"]["cert"]
+
+        # decode cert to read expiration
+        x509 = load_pem_x509_certificate(
+            ephemeral_cert.encode("UTF-8"), default_backend()
+        )
+        expiration = x509.not_valid_after_utc
+        # for IAM authentication OAuth2 token is embedded in cert so it
+        # must still be valid for successful connection
+        if enable_iam_auth:
+            token_expiration: datetime.datetime = login_creds.expiry
+            # google.auth library strips timezone info for backwards compatibality
+            # reasons with Python 2. Add it back to allow timezone aware datetimes.
+            # Ref: https://github.com/googleapis/google-auth-library-python/blob/49a5ff7411a2ae4d32a7d11700f9f961c55406a9/google/auth/_helpers.py#L93-L99
+            token_expiration = token_expiration.replace(tzinfo=datetime.timezone.utc)
+
+            if expiration > token_expiration:
+                expiration = token_expiration
+        return ephemeral_cert, expiration
+
+    async def close(self) -> None:
+        """Close CloudSQLClient gracefully."""
+        await self._client.close()

google/cloud/sql/connector/connector.py

@@ -13,6 +13,7 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 """
+
 from __future__ import annotations
 
 import asyncio
@@ -21,9 +22,14 @@ import logging
 import socket
 from threading import Thread
 from types import TracebackType
-from typing import Any, Dict, Optional, Type, TYPE_CHECKING
+from typing import Any, Dict, Optional, Type
+
+import google.auth
+from google.auth.credentials import Credentials
+from google.auth.credentials import with_scopes_if_required
 
 import google.cloud.sql.connector.asyncpg as asyncpg
+from google.cloud.sql.connector.client import CloudSQLClient
 from google.cloud.sql.connector.exceptions import ConnectorLoopError
 from google.cloud.sql.connector.exceptions import DnsNameResolutionError
 from google.cloud.sql.connector.instance import Instance
@@ -34,9 +40,6 @@ import google.cloud.sql.connector.pytds as pytds
 from google.cloud.sql.connector.utils import format_database_user
 from google.cloud.sql.connector.utils import generate_keys
 
-if TYPE_CHECKING:
-    from google.auth.credentials import Credentials
-
 logger = logging.getLogger(name=__name__)
 
 ASYNC_DRIVERS = ["asyncpg"]
@@ -45,10 +48,10 @@ ASYNC_DRIVERS = ["asyncpg"]
 class Connector:
     """A class to configure and create connections to Cloud SQL instances.
 
-    :type ip_type: IPTypes
+    :type ip_type: str | IPTypes
     :param ip_type
-        The IP type (public or private)  used to connect. IP types
-        can be either IPTypes.PUBLIC or IPTypes.PRIVATE.
+        The IP type used to connect. IP types can be either IPTypes.PUBLIC
+        ("PUBLIC"), IPTypes.PRIVATE ("PRIVATE"), or IPTypes.PSC ("PSC").
 
     :type enable_iam_auth: bool
     :param enable_iam_auth
@@ -84,13 +87,14 @@ class Connector:
 
     def __init__(
         self,
-        ip_type: IPTypes = IPTypes.PUBLIC,
+        ip_type: str | IPTypes = IPTypes.PUBLIC,
         enable_iam_auth: bool = False,
         timeout: int = 30,
         credentials: Optional[Credentials] = None,
-        loop: asyncio.AbstractEventLoop = None,
+        loop: Optional[asyncio.AbstractEventLoop] = None,
         quota_project: Optional[str] = None,
         sqladmin_api_endpoint: str = "https://sqladmin.googleapis.com",
+        user_agent: Optional[str] = None,
     ) -> None:
         # if event loop is given, use for background tasks
         if loop:
@@ -107,14 +111,32 @@ class Connector:
                 loop=self._loop,
             )
         self._instances: Dict[str, Instance] = {}
-
+        self._client: Optional[CloudSQLClient] = None
+
+        # initialize credentials
+        scopes = ["https://www.googleapis.com/auth/sqlservice.admin"]
+        if credentials:
+            # verify custom credentials are proper type
+            # and atleast base class of google.auth.credentials
+            if not isinstance(credentials, Credentials):
+                raise TypeError(
+                    "credentials must be of type google.auth.credentials.Credentials,"
+                    f" got {type(credentials)}"
+                )
+            self._credentials = with_scopes_if_required(credentials, scopes=scopes)
+        # otherwise use application default credentials
+        else:
+            self._credentials, _ = google.auth.default(scopes=scopes)
         # set default params for connections
         self._timeout = timeout
         self._enable_iam_auth = enable_iam_auth
-        self._ip_type = ip_type
         self._quota_project = quota_project
         self._sqladmin_api_endpoint = sqladmin_api_endpoint
-        self._credentials = credentials
+        self._user_agent = user_agent
+        # if ip_type is str, convert to IPTypes enum
+        if isinstance(ip_type, str):
+            ip_type = IPTypes._from_str(ip_type)
+        self._ip_type = ip_type
 
     def connect(
         self, instance_connection_string: str, driver: str, **kwargs: Any
@@ -191,26 +213,31 @@ class Connector:
         # Use the Instance to establish an SSL Connection.
         #
         # Return a DBAPI connection
+        if self._client is None:
+            # lazy init client as it has to be initialized in async context
+            self._client = CloudSQLClient(
+                self._sqladmin_api_endpoint,
+                self._quota_project,
+                self._credentials,
+                user_agent=self._user_agent,
+                driver=driver,
+            )
         enable_iam_auth = kwargs.pop("enable_iam_auth", self._enable_iam_auth)
         if instance_connection_string in self._instances:
             instance = self._instances[instance_connection_string]
             if enable_iam_auth != instance._enable_iam_auth:
                 raise ValueError(
-                    f"connect() called with `enable_iam_auth={enable_iam_auth}`, "
-                    f"but previously used enable_iam_auth={instance._enable_iam_auth}`. "
+                    f"connect() called with 'enable_iam_auth={enable_iam_auth}', "
+                    f"but previously used 'enable_iam_auth={instance._enable_iam_auth}'. "
                     "If you require both for your use case, please use a new "
                     "connector.Connector object."
                 )
         else:
             instance = Instance(
                 instance_connection_string,
-                driver,
+                self._client,
                 self._keys,
-                self._loop,
-                self._credentials,
                 enable_iam_auth,
-                self._quota_project,
-                self._sqladmin_api_endpoint,
             )
             self._instances[instance_connection_string] = instance
 
@@ -228,6 +255,9 @@ class Connector:
             raise KeyError(f"Driver '{driver}' is not supported.")
 
         ip_type = kwargs.pop("ip_type", self._ip_type)
+        # if ip_type is str, convert to IPTypes enum
+        if isinstance(ip_type, str):
+            ip_type = IPTypes._from_str(ip_type)
         kwargs["timeout"] = kwargs.get("timeout", self._timeout)
 
         # Host and ssl options come from the certificates and metadata, so we don't
@@ -308,15 +338,17 @@ class Connector:
 
     def close(self) -> None:
         """Close Connector by stopping tasks and releasing resources."""
-        close_future = asyncio.run_coroutine_threadsafe(
-            self.close_async(), loop=self._loop
-        )
-        # Will attempt to safely shut down tasks for 5s
-        close_future.result(timeout=5)
+        if self._loop.is_running():
+            close_future = asyncio.run_coroutine_threadsafe(
+                self.close_async(), loop=self._loop
+            )
+            # Will attempt to safely shut down tasks for 3s
+            close_future.result(timeout=3)
         # if background thread exists for Connector, clean it up
         if self._thread:
-            # stop event loop running in background thread
-            self._loop.call_soon_threadsafe(self._loop.stop)
+            if self._loop.is_running():
+                # stop event loop running in background thread
+                self._loop.call_soon_threadsafe(self._loop.stop)
             # wait for thread to finish closing (i.e. loop to stop)
             self._thread.join()
 
@@ -326,6 +358,8 @@ class Connector:
         await asyncio.gather(
             *[instance.close() for instance in self._instances.values()]
         )
+        if self._client:
+            await self._client.close()
 
 
 async def create_async_connector(
@@ -333,37 +367,61 @@ async def create_async_connector(
     enable_iam_auth: bool = False,
     timeout: int = 30,
     credentials: Optional[Credentials] = None,
-    loop: asyncio.AbstractEventLoop = None,
+    loop: Optional[asyncio.AbstractEventLoop] = None,
+    quota_project: Optional[str] = None,
+    sqladmin_api_endpoint: str = "https://sqladmin.googleapis.com",
+    user_agent: Optional[str] = None,
 ) -> Connector:
     """
-    Create Connector object for asyncio connections that can auto-detect
-    and use current thread's running event loop.
+     Create Connector object for asyncio connections that can auto-detect
+     and use current thread's running event loop.
 
     :type ip_type: IPTypes
-    :param ip_type
-        The IP type (public or private)  used to connect. IP types
-        can be either IPTypes.PUBLIC or IPTypes.PRIVATE.
-
-    :type enable_iam_auth: bool
-    :param enable_iam_auth
-        Enables automatic IAM database authentication for Postgres or MySQL
-        instances.
-
-    :type timeout: int
-    :param timeout
-        The time limit for a connection before raising a TimeoutError.
-
-    :type credentials: google.auth.credentials.Credentials
-    :param credentials
-        Credentials object used to authenticate connections to Cloud SQL server.
-        If not specified, Application Default Credentials are used.
-
-    :type loop: asyncio.AbstractEventLoop
-    :param loop
-        Event loop to run asyncio tasks, if not specified, defaults
-        to current thread's running event loop.
+     :param ip_type
+         The IP type (public or private)  used to connect. IP types
+         can be either IPTypes.PUBLIC or IPTypes.PRIVATE.
+
+     :type enable_iam_auth: bool
+     :param enable_iam_auth
+         Enables automatic IAM database authentication for Postgres or MySQL
+         instances.
+
+     :type timeout: int
+     :param timeout
+         The time limit for a connection before raising a TimeoutError.
+
+     :type credentials: google.auth.credentials.Credentials
+     :param credentials
+         Credentials object used to authenticate connections to Cloud SQL server.
+         If not specified, Application Default Credentials are used.
+
+     :type quota_project: str
+     :param quota_project
+         The Project ID for an existing Google Cloud project. The project specified
+         is used for quota and billing purposes. If not specified, defaults to
+         project sourced from environment.
+
+     :type loop: asyncio.AbstractEventLoop
+     :param loop
+         Event loop to run asyncio tasks, if not specified, defaults to
+         creating new event loop on background thread.
+
+     :type sqladmin_api_endpoint: str
+     :param sqladmin_api_endpoint:
+         Base URL to use when calling the Cloud SQL Admin API endpoint.
+         Defaults to "https://sqladmin.googleapis.com", this argument should
+         only be used in development.
     """
     # if no loop given, automatically detect running event loop
     if loop is None:
         loop = asyncio.get_running_loop()
-    return Connector(ip_type, enable_iam_auth, timeout, credentials, loop)
+    return Connector(
+        ip_type=ip_type,
+        enable_iam_auth=enable_iam_auth,
+        timeout=timeout,
+        credentials=credentials,
+        loop=loop,
+        quota_project=quota_project,
+        sqladmin_api_endpoint=sqladmin_api_endpoint,
+        user_agent=user_agent,
+    )

google/cloud/sql/connector/exceptions.py

@@ -48,14 +48,6 @@ class PlatformNotSupportedError(Exception):
     pass
 
 
-class CredentialsTypeError(Exception):
-    """
-    Raised when credentials parameter is not proper type.
-    """
-
-    pass
-
-
 class AutoIAMAuthNotSupported(Exception):
     """
     Exception to be raised when Automatic IAM Authentication is not

google/cloud/sql/connector/instance.py

@@ -13,6 +13,7 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 """
+
 from __future__ import annotations
 
 import asyncio
@@ -21,23 +22,18 @@ import logging
 import re
 import ssl
 from tempfile import TemporaryDirectory
-from typing import Any, Dict, Optional, Tuple, TYPE_CHECKING
+from typing import Any, Dict, Tuple, TYPE_CHECKING
 
 import aiohttp
-from google.auth.credentials import Credentials
 
+from google.cloud.sql.connector.client import CloudSQLClient
 from google.cloud.sql.connector.exceptions import AutoIAMAuthNotSupported
 from google.cloud.sql.connector.exceptions import CloudSQLIPTypeError
-from google.cloud.sql.connector.exceptions import CredentialsTypeError
 from google.cloud.sql.connector.exceptions import TLSVersionError
 from google.cloud.sql.connector.rate_limiter import AsyncRateLimiter
-from google.cloud.sql.connector.refresh_utils import _get_ephemeral
-from google.cloud.sql.connector.refresh_utils import _get_metadata
 from google.cloud.sql.connector.refresh_utils import _is_valid
 from google.cloud.sql.connector.refresh_utils import _seconds_until_refresh
-from google.cloud.sql.connector.utils import _auth_init
 from google.cloud.sql.connector.utils import write_to_file
-from google.cloud.sql.connector.version import __version__ as version
 
 if TYPE_CHECKING:
     import datetime
@@ -68,6 +64,20 @@ class IPTypes(Enum):
     PRIVATE: str = "PRIVATE"
     PSC: str = "PSC"
 
+    @classmethod
+    def _missing_(cls, value: object) -> None:
+        raise ValueError(
+            f"Incorrect value for ip_type, got '{value}'. Want one of: "
+            f"{', '.join([repr(m.value) for m in cls])}, 'PUBLIC'."
+        )
+
+    @classmethod
+    def _from_str(cls, ip_type_str: str) -> IPTypes:
+        """Convert IP type from a str into IPTypes."""
+        if ip_type_str.upper() == "PUBLIC":
+            ip_type_str = "PRIMARY"
+        return cls(ip_type_str.upper())
+
 
 class ConnectionInfo:
     ip_addrs: Dict[str, Any]
@@ -143,68 +153,15 @@ class Instance:
         string.
     :type instance_connection_string: str
 
-    :param user_agent_string:
-        The user agent string to append to SQLAdmin API requests
-    :type user_agent_string: str
-
-    :type credentials: google.auth.credentials.Credentials
-    :param credentials
-        Credentials object used to authenticate connections to Cloud SQL server.
-        If not specified, Application Default Credentials are used.
-
     :param enable_iam_auth
         Enables automatic IAM database authentication for Postgres or MySQL
         instances.
     :type enable_iam_auth: bool
-
-    :param loop:
-        A new event loop for the refresh function to run in.
-    :type loop: asyncio.AbstractEventLoop
-
-    :type quota_project: str
-    :param quota_project
-        The Project ID for an existing Google Cloud project. The project specified
-        is used for quota and billing purposes. If not specified, defaults to
-        project sourced from environment.
-
-    :type sqladmin_api_endpoint: str
-    :param sqladmin_api_endpoint:
-        Base URL to use when calling the Cloud SQL Admin API endpoint.
-        Defaults to "https://sqladmin.googleapis.com", this argument should
-        only be used in development.
     """
 
-    # asyncio.AbstractEventLoop is used because the default loop,
-    # SelectorEventLoop, is usable on both Unix and Windows but has limited
-    # functionality on Windows. It is recommended to use ProactorEventLoop
-    # while developing on Windows.
-    # Link to Github issue:
-    # https://github.com/GoogleCloudPlatform/cloud-sql-python-connector/issues/22
-    _loop: asyncio.AbstractEventLoop
-
     _enable_iam_auth: bool
-
-    __client_session: Optional[aiohttp.ClientSession] = None
-
-    @property
-    def _client_session(self) -> aiohttp.ClientSession:
-        if self.__client_session is None:
-            headers = {
-                "x-goog-api-client": self._user_agent_string,
-                "User-Agent": self._user_agent_string,
-                "Content-Type": "application/json",
-            }
-            if self._quota_project:
-                headers["x-goog-user-project"] = self._quota_project
-            self.__client_session = aiohttp.ClientSession(headers=headers)
-        return self.__client_session
-
-    _credentials: Optional[Credentials] = None
     _keys: asyncio.Future
-
     _instance_connection_string: str
-    _user_agent_string: str
-    _sqladmin_api_endpoint: str
     _instance: str
     _project: str
     _region: str
@@ -217,13 +174,9 @@ class Instance:
     def __init__(
         self,
         instance_connection_string: str,
-        driver_name: str,
+        client: CloudSQLClient,
         keys: asyncio.Future,
-        loop: asyncio.AbstractEventLoop,
-        credentials: Optional[Credentials] = None,
         enable_iam_auth: bool = False,
-        quota_project: str = None,
-        sqladmin_api_endpoint: str = "https://sqladmin.googleapis.com",
     ) -> None:
         # validate and parse instance connection name
         self._project, self._region, self._instance = _parse_instance_connection_name(
@@ -232,21 +185,11 @@ class Instance:
         self._instance_connection_string = instance_connection_string
 
         self._enable_iam_auth = enable_iam_auth
-
-        self._user_agent_string = f"{APPLICATION_NAME}/{version}+{driver_name}"
-        self._quota_project = quota_project
-        self._sqladmin_api_endpoint = sqladmin_api_endpoint
-        self._loop = loop
         self._keys = keys
-        # validate credentials type
-        if not isinstance(credentials, Credentials) and credentials is not None:
-            raise CredentialsTypeError(
-                "Arg credentials must be type 'google.auth.credentials.Credentials' "
-                "or None (to use Application Default Credentials)"
-            )
-        self._credentials = _auth_init(credentials)
+        self._client = client
         self._refresh_rate_limiter = AsyncRateLimiter(
-            max_capacity=2, rate=1 / 30, loop=self._loop
+            max_capacity=2,
+            rate=1 / 30,
         )
         self._refresh_in_progress = asyncio.locks.Event()
         self._current = self._schedule_refresh(0)
@@ -284,22 +227,16 @@ class Instance:
 
             logger.debug(f"['{self._instance_connection_string}']: Creating context")
 
-            metadata_task = self._loop.create_task(
-                _get_metadata(
-                    self._client_session,
-                    self._sqladmin_api_endpoint,
-                    self._credentials,
+            metadata_task = asyncio.create_task(
+                self._client._get_metadata(
                     self._project,
                     self._region,
                     self._instance,
                 )
             )
 
-            ephemeral_task = self._loop.create_task(
-                _get_ephemeral(
-                    self._client_session,
-                    self._sqladmin_api_endpoint,
-                    self._credentials,
+            ephemeral_task = asyncio.create_task(
+                self._client._get_ephemeral(
                     self._project,
                     self._instance,
                     pub_key,
@@ -371,7 +308,7 @@ class Instance:
                 logger.debug(f"['{self._instance_connection_string}']: Entering sleep")
                 if delay > 0:
                     await asyncio.sleep(delay)
-                refresh_task = self._loop.create_task(self._perform_refresh())
+                refresh_task = asyncio.create_task(self._perform_refresh())
                 refresh_data = await refresh_task
             except asyncio.CancelledError:
                 logger.debug(
@@ -402,7 +339,7 @@ class Instance:
             return refresh_data
 
         # schedule refresh task and return it
-        scheduled_task = self._loop.create_task(_refresh_task(self, delay))
+        scheduled_task = asyncio.create_task(_refresh_task(self, delay))
         return scheduled_task
 
     async def connect_info(
@@ -448,4 +385,6 @@ class Instance:
         logger.debug(
             f"['{self._instance_connection_string}']: Waiting for _client_session to close"
         )
-        await self._client_session.close()
+        # gracefully wait for tasks to cancel
+        tasks = asyncio.gather(self._current, self._next, return_exceptions=True)
+        await asyncio.wait_for(tasks, timeout=2.0)

google/cloud/sql/connector/rate_limiter.py

@@ -13,7 +13,9 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 """
+
 import asyncio
+from typing import Optional
 
 
 class AsyncRateLimiter(object):
@@ -41,7 +43,7 @@ class AsyncRateLimiter(object):
         self,
         max_capacity: int = 1,
         rate: float = 1 / 60,
-        loop: asyncio.AbstractEventLoop = None,
+        loop: Optional[asyncio.AbstractEventLoop] = None,
     ) -> None:
         self.rate = rate
         self.max_capacity = max_capacity

google/cloud/sql/connector/refresh_utils.py

@@ -13,214 +13,26 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 """
+
 from __future__ import annotations
 
 import asyncio
 import copy
 import datetime
 import logging
-from typing import Any, Dict, List, Tuple, TYPE_CHECKING
+from typing import List
 
-from cryptography.hazmat.backends import default_backend
-from cryptography.x509 import load_pem_x509_certificate
 from google.auth.credentials import Credentials
 from google.auth.credentials import Scoped
 import google.auth.transport.requests
 
-if TYPE_CHECKING:
-    import aiohttp
-
 logger = logging.getLogger(name=__name__)
 
-_sql_api_version: str = "v1beta4"
-
 # _refresh_buffer is the amount of time before a refresh's result expires
 # that a new refresh operation begins.
 _refresh_buffer: int = 4 * 60  # 4 minutes
 
 
-async def _get_metadata(
-    client_session: aiohttp.ClientSession,
-    sqladmin_api_endpoint: str,
-    credentials: Credentials,
-    project: str,
-    region: str,
-    instance: str,
-) -> Dict[str, Any]:
-    """Requests metadata from the Cloud SQL Instance
-    and returns a dictionary containing the IP addresses and certificate
-    authority of the Cloud SQL Instance.
-
-    :type sqladmin_api_endpoint: str
-    :param sqladmin_api_endpoint:
-        Base URL to use when calling the Cloud SQL Admin API endpoint.
-
-    :type credentials: google.auth.credentials.Credentials
-    :param credentials:
-        A credentials object created from the google-auth Python library.
-        Must have the SQL Admin API scopes. For more info check out
-        https://google-auth.readthedocs.io/en/latest/.
-
-    :type project: str
-    :param project:
-        A string representing the name of the project.
-
-    :type region: str
-    :param region : A string representing the name of the region.
-
-    :type instance: str
-    :param instance: A string representing the name of the instance.
-
-    :rtype: Dict[str: Union[Dict, str]]
-    :returns: Returns a dictionary containing a dictionary of all IP
-          addresses and their type and a string representing the
-          certificate authority.
-
-    :raises TypeError: If any of the arguments are not the specified type.
-    """
-
-    if not isinstance(credentials, Credentials):
-        raise TypeError(
-            "credentials must be of type google.auth.credentials.Credentials,"
-            f" got {type(credentials)}"
-        )
-    elif not isinstance(project, str):
-        raise TypeError(f"project must be of type str, got {type(project)}")
-    elif not isinstance(region, str):
-        raise TypeError(f"region must be of type str, got {type(region)}")
-    elif not isinstance(instance, str):
-        raise TypeError(f"instance must be of type str, got {type(instance)}")
-
-    if not credentials.valid:
-        request = google.auth.transport.requests.Request()
-        credentials.refresh(request)
-
-    headers = {
-        "Authorization": f"Bearer {credentials.token}",
-    }
-
-    url = f"{sqladmin_api_endpoint}/sql/{_sql_api_version}/projects/{project}/instances/{instance}/connectSettings"
-
-    logger.debug(f"['{instance}']: Requesting metadata")
-
-    resp = await client_session.get(url, headers=headers, raise_for_status=True)
-    ret_dict = await resp.json()
-
-    if ret_dict["region"] != region:
-        raise ValueError(
-            f'[{project}:{region}:{instance}]: Provided region was mismatched - got region {region}, expected {ret_dict["region"]}.'
-        )
-
-    ip_addresses = (
-        {ip["type"]: ip["ipAddress"] for ip in ret_dict["ipAddresses"]}
-        if "ipAddresses" in ret_dict
-        else {}
-    )
-    if "dnsName" in ret_dict:
-        ip_addresses["PSC"] = ret_dict["dnsName"]
-
-    metadata = {
-        "ip_addresses": ip_addresses,
-        "server_ca_cert": ret_dict["serverCaCert"]["cert"],
-        "database_version": ret_dict["databaseVersion"],
-    }
-
-    return metadata
-
-
-async def _get_ephemeral(
-    client_session: aiohttp.ClientSession,
-    sqladmin_api_endpoint: str,
-    credentials: Credentials,
-    project: str,
-    instance: str,
-    pub_key: str,
-    enable_iam_auth: bool = False,
-) -> Tuple[str, datetime.datetime]:
-    """Asynchronously requests an ephemeral certificate from the Cloud SQL Instance.
-
-    :type sqladmin_api_endpoint: str
-    :param sqladmin_api_endpoint:
-        Base URL to use when calling the Cloud SQL Admin API endpoint.
-
-    :type credentials: google.auth.credentials.Credentials
-    :param credentials: A credentials object
-        created from the google-auth library. Must be
-        using the SQL Admin API scopes. For more info, check out
-        https://google-auth.readthedocs.io/en/latest/.
-
-    :type project: str
-    :param project : A string representing the name of the project.
-
-    :type instance: str
-    :param instance: A string representing the name of the instance.
-
-    :type pub_key:
-    :param str: A string representing PEM-encoded RSA public key.
-
-    :type enable_iam_auth: bool
-    :param enable_iam_auth
-        Enables automatic IAM database authentication for Postgres or MySQL
-        instances.
-
-    :rtype: str
-    :returns: An ephemeral certificate from the Cloud SQL instance that allows
-          authorized connections to the instance.
-
-    :raises TypeError: If one of the arguments passed in is None.
-    """
-
-    logger.debug(f"['{instance}']: Requesting ephemeral certificate")
-
-    if not isinstance(credentials, Credentials):
-        raise TypeError(
-            "credentials must be of type google.auth.credentials.Credentials,"
-            f" got {type(credentials)}"
-        )
-    elif not isinstance(project, str):
-        raise TypeError(f"project must be of type str, got {type(project)}")
-    elif not isinstance(instance, str):
-        raise TypeError(f"instance must be of type str, got {type(instance)}")
-    elif not isinstance(pub_key, str):
-        raise TypeError(f"pub_key must be of type str, got {type(pub_key)}")
-
-    if not credentials.valid:
-        request = google.auth.transport.requests.Request()
-        credentials.refresh(request)
-
-    headers = {
-        "Authorization": f"Bearer {credentials.token}",
-    }
-
-    url = f"{sqladmin_api_endpoint}/sql/{_sql_api_version}/projects/{project}/instances/{instance}:generateEphemeralCert"
-
-    data = {"public_key": pub_key}
-
-    if enable_iam_auth:
-        # down-scope credentials with only IAM login scope (refreshes them too)
-        login_creds = _downscope_credentials(credentials)
-        data["access_token"] = login_creds.token
-
-    resp = await client_session.post(
-        url, headers=headers, json=data, raise_for_status=True
-    )
-
-    ret_dict = await resp.json()
-
-    ephemeral_cert: str = ret_dict["ephemeralCert"]["cert"]
-
-    # decode cert to read expiration
-    x509 = load_pem_x509_certificate(ephemeral_cert.encode("UTF-8"), default_backend())
-    expiration = x509.not_valid_after
-    # for IAM authentication OAuth2 token is embedded in cert so it
-    # must still be valid for successful connection
-    if enable_iam_auth:
-        token_expiration: datetime.datetime = login_creds.expiry
-        if expiration > token_expiration:
-            expiration = token_expiration
-    return ephemeral_cert, expiration
-
-
 def _seconds_until_refresh(
     expiration: datetime.datetime,
 ) -> int:
@@ -234,7 +46,9 @@ def _seconds_until_refresh(
     :returns: Time in seconds to wait before performing next refresh.
     """
 
-    duration = int((expiration - datetime.datetime.utcnow()).total_seconds())
+    duration = int(
+        (expiration - datetime.datetime.now(datetime.timezone.utc)).total_seconds()
+    )
 
     # if certificate duration is less than 1 hour
     if duration < 3600:
@@ -251,7 +65,7 @@ async def _is_valid(task: asyncio.Task) -> bool:
     try:
         metadata = await task
         # only valid if now is before the cert expires
-        if datetime.datetime.utcnow() < metadata.expiration:
+        if datetime.datetime.now(datetime.timezone.utc) < metadata.expiration:
             return True
     except Exception:
         # supress any errors from task

google/cloud/sql/connector/utils.py

@@ -13,14 +13,11 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 """
-from typing import Optional, Tuple
+from typing import Tuple
 
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives import serialization
 from cryptography.hazmat.primitives.asymmetric import rsa
-from google.auth import default
-from google.auth.credentials import Credentials
-from google.auth.credentials import with_scopes_if_required
 
 
 async def generate_keys() -> Tuple[bytes, str]:
@@ -104,23 +101,3 @@ def format_database_user(database_version: str, user: str) -> str:
         return user.split("@")[0]
 
     return user
-
-
-def _auth_init(credentials: Optional[Credentials]) -> Credentials:
-    """Creates google.auth credentials object with scopes required to make
-    calls to the Cloud SQL Admin APIs.
-
-    :type credentials: google.auth.credentials.Credentials
-    :param credentials
-        Credentials object used to authenticate connections to Cloud SQL server.
-        If not specified, Application Default Credentials are used.
-    """
-    scopes = ["https://www.googleapis.com/auth/sqlservice.admin"]
-    # if Credentials object is passed in, use for authentication
-    if isinstance(credentials, Credentials):
-        credentials = with_scopes_if_required(credentials, scopes=scopes)
-    # otherwise use application default credentials
-    else:
-        credentials, _ = default(scopes=scopes)
-
-    return credentials

google/cloud/sql/connector/version.py

@@ -12,4 +12,4 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-__version__ = "1.6.0"
+__version__ = "1.8.0"

cloud_sql_python_connector-1.6.0.dist-info/RECORD

@@ -1,18 +0,0 @@
-google/cloud/sql/connector/__init__.py,sha256=Z3AkPOQwjNF1ogo2DR18GN-CnYvI4MTmhsCe8hURKUo,883
-google/cloud/sql/connector/asyncpg.py,sha256=c4lAlvEgGf_eBq0G8MVNPRAJQQvo6DcwybiXDW36qkU,1838
-google/cloud/sql/connector/connector.py,sha256=KwrB9Jx_qNwbLoEO7Bf7eFp76cm3nL4ZCYNduH1AUbk,14315
-google/cloud/sql/connector/exceptions.py,sha256=99sY_6UVuSeSg1jFusXOpPWEsbzDwk-LLo4WZkcsL2A,1649
-google/cloud/sql/connector/instance.py,sha256=zFwdDSWjiKsY8szgY0fn9zLtiRWoAiWYpUW-CK4d-1Q,17728
-google/cloud/sql/connector/pg8000.py,sha256=EZuO7XgCkG_Y79NQlh3Vv8Ff2w85BFJyFVO237hx1GM,1814
-google/cloud/sql/connector/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-google/cloud/sql/connector/pymysql.py,sha256=wldUgwDPlPa8Nj5F3JaipuP8hJyvzlgOAJbRnOoaB1U,2105
-google/cloud/sql/connector/pytds.py,sha256=vKJoE7E2P0GrhZojg8bGZkqCMLc8dgKAcXE4ee7vEVc,2452
-google/cloud/sql/connector/rate_limiter.py,sha256=Ci3f-94090bj0cWJUu-vGZFc32IWRCyi8TIgChsQvxY,2954
-google/cloud/sql/connector/refresh_utils.py,sha256=04lDyHu8kG98y4J6OLCt_fePYnSXlCZNyN8q98wE68Q,10223
-google/cloud/sql/connector/utils.py,sha256=QOn2lKRB6lGd9CEbI8XCOYzXpxs7Oz4pknunSYdeHzk,4405
-google/cloud/sql/connector/version.py,sha256=aZ3zQ5-k8PViHHPlQGcYGqk9pS4YC_tfVYHDVYM9YuU,597
-cloud_sql_python_connector-1.6.0.dist-info/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
-cloud_sql_python_connector-1.6.0.dist-info/METADATA,sha256=4bQn_w88lf1oCknl3iH0Fuli4p-VgTzwGO0-doez9SM,24146
-cloud_sql_python_connector-1.6.0.dist-info/WHEEL,sha256=bb2Ot9scclHKMOLDEHY6B2sicWOgugjFKaJsT7vwMQo,110
-cloud_sql_python_connector-1.6.0.dist-info/top_level.txt,sha256=_1QvSJIhFAGfxb79D6DhB7SUw2X6T4rwnz_LLrbcD3c,7
-cloud_sql_python_connector-1.6.0.dist-info/RECORD,,