google-api-core 2.34.0__tar.gz → 2.35.0__tar.gz

{google_api_core-2.34.0/google_api_core.egg-info → google_api_core-2.35.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: google-api-core
-Version: 2.34.0
+Version: 2.35.0
 Summary: Google API client core library
 Author-email: Google LLC <googleapis-packages@google.com>
 License: Apache 2.0

{google_api_core-2.34.0 → google_api_core-2.35.0}/google/api_core/_python_package_support.py

@@ -30,14 +30,37 @@ ParsedVersion = Tuple[int, ...]
 # about deprecated and unsupported versions.
 DependencyConstraint = namedtuple(
     "DependencyConstraint",
-    ["package_name", "minimum_fully_supported_version", "recommended_version"],
+    [
+        "package_name",
+        "minimum_fully_supported_version",
+        "recommended_version",
+        "message_template",
+    ],
+    defaults=(None, None),
 )
+
+PQC_GRPC_WARNING_TEMPLATE = (
+    "Package {consumer_package} depends on {dependency_package}, currently installed at version {version_used_string}. "
+    "grpcio < 1.83.0 does not support Post-Quantum Cryptography (PQC). "
+    "Support for non-PQC environments is deprecated. In October 2026, "
+    "Google Cloud Python packages will raise their minimum requirements "
+    "(including google-api-core, grpcio, and grpcio-status) to enforce grpcio >= 1.83.0. "
+    "For more details on Google Cloud's post-quantum security migration, visit: "
+    "https://cloud.google.com/security/resources/post-quantum-cryptography"
+)
+
 _PACKAGE_DEPENDENCY_WARNINGS = [
     DependencyConstraint(
         "google.protobuf",
         minimum_fully_supported_version="6.33.5",
         recommended_version="6.x",
-    )
+    ),
+    DependencyConstraint(
+        "grpcio",
+        minimum_fully_supported_version="1.83.0",
+        recommended_version="1.83.x",
+        message_template=PQC_GRPC_WARNING_TEMPLATE,
+    ),
 ]
 
 
@@ -162,7 +185,7 @@ def warn_deprecation_for_versions_less_than(
         ) = _get_distribution_and_import_packages(consumer_import_package)
 
         recommendation = (
-            " (we recommend {recommended_version})" if recommended_version else ""
+            f" (we recommend {recommended_version})" if recommended_version else ""
         )
         message_template = message_template or _flatten_message(
             """
@@ -222,4 +245,5 @@ def check_dependency_versions(
             package_info.package_name,
             package_info.minimum_fully_supported_version,
             recommended_version=package_info.recommended_version,
+            message_template=package_info.message_template,
         )

{google_api_core-2.34.0 → google_api_core-2.35.0}/google/api_core/path_template.py

@@ -28,6 +28,7 @@ from __future__ import unicode_literals
 import copy
 import functools
 import re
+import urllib.parse
 from collections import deque
 
 # Regular expression for extracting variable parts from a path template.
@@ -62,6 +63,41 @@ _SINGLE_SEGMENT_PATTERN = r"([^/]+)"
 _MULTI_SEGMENT_PATTERN = r"(.+)"
 
 
+def _extract_and_validate_wildcards(
+    val: str, template_str: str | None, property_name: str = "property"
+) -> None:
+    """Extract and validate wildcard variables against path traversal.
+
+    Ensures that values matched against single-segment wildcards ('*') are
+    not '.' or '..', and values matched against multi-segment wildcards ('**')
+    do not contain '.' or '..' segments.
+
+    If the value does not match the sub-template structure, validation is
+    deferred to allow subsequent bindings to be evaluated.
+
+    Args:
+        val (str): The raw string value to validate.
+        template_str (str | None): The template string of the variable (e.g.
+            'projects/*/locations/*').
+        property_name (str): The name of the property being validated, for use
+            in error messages.
+
+    Raises:
+        ValueError: If a wildcard value contains invalid dot segments.
+    """
+    tmpl = template_str or "*"
+    m = re.fullmatch(_generate_pattern_for_template(tmpl), val)
+    if m is not None:
+        groups = m.groups()
+        for g in groups:
+            if "." in g and any(seg in (".", "..") for seg in g.split("/")):
+                if "**" in tmpl or "/" in tmpl:
+                    raise ValueError(
+                        f"Value for {property_name} must not contain segments that are exactly . or .. ."
+                    )
+                raise ValueError(f"Invalid value {g} for {property_name}.")
+
+
 def _expand_variable_match(positional_vars, named_vars, match):
     """Expand a matched variable with its value.
 
@@ -81,9 +117,13 @@ def _expand_variable_match(positional_vars, named_vars, match):
     """
     positional = match.group("positional")
     name = match.group("name")
+    template = match.group("template")
+
     if name is not None:
         try:
-            return str(named_vars[name])
+            val = str(named_vars[name])
+            _extract_and_validate_wildcards(val, template, name)
+            return urllib.parse.quote(val, safe="/")
         except KeyError:
             raise ValueError(
                 "Named variable '{}' not specified and needed by template "
@@ -91,7 +131,9 @@ def _expand_variable_match(positional_vars, named_vars, match):
             )
     elif positional is not None:
         try:
-            return str(positional_vars.pop(0))
+            val = str(positional_vars.pop(0))
+            _extract_and_validate_wildcards(val, positional, "positional variable")
+            return urllib.parse.quote(val, safe="/")
         except IndexError:
             raise ValueError(
                 "Positional variable not specified and needed by template "
@@ -159,6 +201,7 @@ def _replace_variable_with_pattern(match):
         raise ValueError("Unknown template expression {}".format(match.group(0)))
 
 
+@functools.lru_cache(maxsize=256)
 def _generate_pattern_for_template(tmpl):
     """Generate a pattern that can validate a path template.
 

{google_api_core-2.34.0 → google_api_core-2.35.0}/google/api_core/version.py

@@ -12,4 +12,4 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-__version__ = "2.34.0"
+__version__ = "2.35.0"

{google_api_core-2.34.0 → google_api_core-2.35.0/google_api_core.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: google-api-core
-Version: 2.34.0
+Version: 2.35.0
 Summary: Google API client core library
 Author-email: Google LLC <googleapis-packages@google.com>
 License: Apache 2.0

{google_api_core-2.34.0 → google_api_core-2.35.0}/pyproject.toml

@@ -85,6 +85,8 @@ filterwarnings = [
   "error",
   # Prevent Python version warnings from interfering with tests
   "ignore:.* Python version .*:FutureWarning",
+  # TODO: Remove once b/544782314 is resolved (when grpcio >= 1.83.0 is enforced)
+  "ignore:.*does not support Post-Quantum Cryptography.*:FutureWarning",
   # Remove once https://github.com/pytest-dev/pytest-cov/issues/621 is fixed
   "ignore:.*The --rsyncdir command line argument and rsyncdirs config variable are deprecated:DeprecationWarning",
   # Remove once https://github.com/protocolbuffers/protobuf/issues/12186 is fixed

{google_api_core-2.34.0 → google_api_core-2.35.0}/tests/asyncio/test_grpc_helpers_async.py

@@ -421,9 +421,15 @@ def test_create_channel_implicit_with_default_host(
     assert channel is grpc_secure_channel.return_value
 
     google_auth_default.assert_called_once_with(scopes=None, default_scopes=None)
-    auth_metadata_plugin.assert_called_once_with(
-        mock.sentinel.credentials, mock.sentinel.Request, default_host=default_host
-    )
+    assert auth_metadata_plugin.call_count == 1
+    assert auth_metadata_plugin.call_args.args == (
+        mock.sentinel.credentials,
+        mock.sentinel.Request,
+    )
+    assert auth_metadata_plugin.call_args.kwargs["default_host"] == default_host
+    # google-auth >= 2.56.3 supports suppress_metrics_header; older versions omit it during fallback
+    if "suppress_metrics_header" in auth_metadata_plugin.call_args.kwargs:
+        assert auth_metadata_plugin.call_args.kwargs["suppress_metrics_header"] is True
     grpc_secure_channel.assert_called_once_with(
         expected_target, composite_creds, compression=None
     )

{google_api_core-2.34.0 → google_api_core-2.35.0}/tests/unit/test_grpc_helpers.py

@@ -453,9 +453,15 @@ def test_create_channel_implicit_with_default_host(
     assert channel is grpc_secure_channel.return_value
 
     google_auth_default.assert_called_once_with(scopes=None, default_scopes=None)
-    auth_metadata_plugin.assert_called_once_with(
-        mock.sentinel.credentials, mock.sentinel.Request, default_host=default_host
+    assert auth_metadata_plugin.call_count == 1
+    assert auth_metadata_plugin.call_args.args == (
+        mock.sentinel.credentials,
+        mock.sentinel.Request,
     )
+    assert auth_metadata_plugin.call_args.kwargs["default_host"] == default_host
+    # google-auth >= 2.56.3 supports suppress_metrics_header; older versions omit it during fallback
+    if "suppress_metrics_header" in auth_metadata_plugin.call_args.kwargs:
+        assert auth_metadata_plugin.call_args.kwargs["suppress_metrics_header"] is True
 
     grpc_secure_channel.assert_called_once_with(
         expected_target, composite_creds, compression=None

{google_api_core-2.34.0 → google_api_core-2.35.0}/tests/unit/test_path_template.py

@@ -64,6 +64,29 @@ from google.api_core import path_template
             {"name": "parent/child/object"},
             "/v1/a/parent/child/object",
         ],
+        # Encoding / Metacharacters in positional and named params
+        ["/v1/*", ["..?$httpMethod=DELETE#"], {}, "/v1/..%3F%24httpMethod%3DDELETE%23"],
+        ["/v1/**", ["path/sub/with/?and#"], {}, "/v1/path/sub/with/%3Fand%23"],
+        [
+            "/v1/{name}",
+            [],
+            {"name": "..?$httpMethod=DELETE#"},
+            "/v1/..%3F%24httpMethod%3DDELETE%23",
+        ],
+        [
+            "/v1/{name=**}",
+            [],
+            {"name": "path/sub/with/?and#"},
+            "/v1/path/sub/with/%3Fand%23",
+        ],
+        [
+            "/v3/{session=projects/*/locations/*/agents/*/sessions/*}:detectIntent",
+            [],
+            {
+                "session": "projects/cx/locations/global/agents/a1/sessions/..?$httpMethod=DELETE#"
+            },
+            "/v3/projects/cx/locations/global/agents/a1/sessions/..%3F%24httpMethod%3DDELETE%23:detectIntent",
+        ],
     ],
 )
 def test_expand_success(tmpl, args, kwargs, expected_result):
@@ -651,3 +674,274 @@ def helper_test_transcode(http_options_list, expected_result_list):
     if expected_result_list[2]:
         expected_result["body"] = expected_result_list[2]
     return (http_options, expected_result)
+
+
+@pytest.mark.parametrize(
+    "tmpl, args, kwargs, expected_err_match",
+    [
+        # Positional * with . or ..
+        [
+            "/v1/*",
+            ["."],
+            {},
+            r"^Invalid value \. for positional variable\.$",
+        ],
+        [
+            "/v1/*",
+            [".."],
+            {},
+            r"^Invalid value \.\. for positional variable\.$",
+        ],
+        # Named matching * with . or ..
+        [
+            "/compute/v1/projects/{project}/regions/{region}/addresses",
+            [],
+            {"project": "my-project", "region": ".."},
+            r"^Invalid value \.\. for region\.$",
+        ],
+        [
+            "/compute/v1/projects/{project}/regions/{region}/addresses",
+            [],
+            {"project": "my-project", "region": "."},
+            r"^Invalid value \. for region\.$",
+        ],
+        # Sub-template named matching * with . or ..
+        [
+            "/v2/{parent=projects/*/locations/*}/content:inspect",
+            [],
+            {"parent": "projects/my-project/locations/.."},
+            r"^Value for parent must not contain segments that are exactly \. or \.\. \.$",
+        ],
+        [
+            "/v2/{parent=projects/*/locations/*}/content:inspect",
+            [],
+            {"parent": "projects/my-project/locations/."},
+            r"^Value for parent must not contain segments that are exactly \. or \.\. \.$",
+        ],
+        [
+            "/v2/{parent=projects/*/locations/*}/content:inspect",
+            [],
+            {"parent": "projects/../locations/us-central1"},
+            r"^Value for parent must not contain segments that are exactly \. or \.\. \.$",
+        ],
+        [
+            "/v2/{parent=projects/*/locations/*}/content:inspect",
+            [],
+            {"parent": "projects/./locations/us-central1"},
+            r"^Value for parent must not contain segments that are exactly \. or \.\. \.$",
+        ],
+    ],
+)
+def test_path_traversal_dots_validation_star(tmpl, args, kwargs, expected_err_match):
+    with pytest.raises(ValueError, match=expected_err_match):
+        path_template.expand(tmpl, *args, **kwargs)
+
+
+@pytest.mark.parametrize(
+    "name_val, expected_path",
+    [
+        (
+            "projects/my-project/monitoredResourceDescriptors/instance/my-instance",
+            "/v3/projects/my-project/monitoredResourceDescriptors/instance/my-instance",
+        ),
+        (
+            "projects/my-project/monitoredResourceDescriptors/a/b/c/d/e",
+            "/v3/projects/my-project/monitoredResourceDescriptors/a/b/c/d/e",
+        ),
+        (
+            "projects/my-project/monitoredResourceDescriptors/instance...foo/bar",
+            "/v3/projects/my-project/monitoredResourceDescriptors/instance...foo/bar",
+        ),
+        (
+            "projects/my-project/monitoredResourceDescriptors/...",
+            "/v3/projects/my-project/monitoredResourceDescriptors/...",
+        ),
+    ],
+)
+def test_path_traversal_dots_validation_double_star_valid(name_val, expected_path):
+    assert (
+        path_template.expand(
+            "/v3/{name=projects/*/monitoredResourceDescriptors/**}",
+            name=name_val,
+        )
+        == expected_path
+    )
+
+
+@pytest.mark.parametrize(
+    "name_val",
+    [
+        "projects/my-project/monitoredResourceDescriptors/instance/my-instance/..",
+        "projects/my-project/monitoredResourceDescriptors/instance/my-instance/.",
+        "projects/my-project/monitoredResourceDescriptors/instance/my-instance/../..",
+        "projects/my-project/monitoredResourceDescriptors/instance/../my-instance/..",
+        "projects/my-project/monitoredResourceDescriptors/instance/../..",
+        "projects/my-project/monitoredResourceDescriptors/a/b/../../../c/d/e/..",
+        "projects/my-project/monitoredResourceDescriptors/a/b/c/d/e/../../../..",
+        "projects/my-project/monitoredResourceDescriptors/instance//..",
+    ],
+)
+def test_path_traversal_dots_validation_double_star_invalid(name_val):
+    with pytest.raises(
+        ValueError,
+        match=r"^Value for name must not contain segments that are exactly \. or \.\. \.$",
+    ):
+        path_template.expand(
+            "/v3/{name=projects/*/monitoredResourceDescriptors/**}",
+            name=name_val,
+        )
+
+
+@pytest.mark.parametrize(
+    "tmpl, kwargs, expected_result",
+    [
+        ["/v1/{name}", {"name": "abc-._~"}, "/v1/abc-._~"],
+        ["/v1/{name=**}", {"name": "abc-._~/"}, "/v1/abc-._~/"],
+        ["/v1/{name}", {"name": "a/b"}, "/v1/a/b"],
+        ["/v1/{name}", {"name": "a$b?c=d#e f"}, "/v1/a%24b%3Fc%3Dd%23e%20f"],
+    ],
+)
+def test_percent_encoding_unreserved_characters(tmpl, kwargs, expected_result):
+    result = path_template.expand(tmpl, **kwargs)
+    assert result == expected_result
+    # For single-segment with '/', validate should fail because '/' is preserved
+    if "/" in kwargs.get("name", "") and tmpl == "/v1/{name}":
+        assert not path_template.validate(tmpl, result)
+
+
+@pytest.mark.parametrize(
+    "tmpl, args, kwargs, expected_err_match",
+    [
+        (
+            "/v1/**",
+            [".."],
+            {},
+            r"^Value for positional variable must not contain segments that are exactly \. or \.\. \.$",
+        ),
+        (
+            "/v1/**",
+            ["a/./b"],
+            {},
+            r"^Value for positional variable must not contain segments that are exactly \. or \.\. \.$",
+        ),
+        (
+            "/v1/{name=**}",
+            [],
+            {"name": ".."},
+            r"^Value for name must not contain segments that are exactly \. or \.\. \.$",
+        ),
+        (
+            "/v1/{name=**}",
+            [],
+            {"name": "a/../b"},
+            r"^Value for name must not contain segments that are exactly \. or \.\. \.$",
+        ),
+    ],
+)
+def test_path_traversal_dots_validation_bare_double_star(
+    tmpl, args, kwargs, expected_err_match
+):
+    with pytest.raises(ValueError, match=expected_err_match):
+        path_template.expand(tmpl, *args, **kwargs)
+
+
+@pytest.mark.parametrize(
+    "name_val, expected_err_match",
+    [
+        (
+            "projects/../locations/us-central1/buckets/my-bucket",
+            r"^Value for name must not contain segments that are exactly \. or \.\. \.$",
+        ),
+        (
+            "projects/my-project/locations/./buckets/my-bucket",
+            r"^Value for name must not contain segments that are exactly \. or \.\. \.$",
+        ),
+        (
+            "projects/my-project/locations/us-central1/buckets/foo/../bar",
+            r"^Value for name must not contain segments that are exactly \. or \.\. \.$",
+        ),
+        (
+            "projects/my-project/locations/us-central1/buckets/.",
+            r"^Value for name must not contain segments that are exactly \. or \.\. \.$",
+        ),
+        (
+            "projects/my-project/locations/us-central1/buckets/..",
+            r"^Value for name must not contain segments that are exactly \. or \.\. \.$",
+        ),
+    ],
+)
+def test_path_traversal_mixed_subtemplate(name_val, expected_err_match):
+    tmpl = "/v1/{name=projects/*/locations/*/buckets/**}"
+    with pytest.raises(ValueError, match=expected_err_match):
+        path_template.expand(tmpl, name=name_val)
+
+
+@pytest.mark.parametrize(
+    "tmpl, args, kwargs, expected_err_match",
+    [
+        (
+            "/v1/*/**",
+            [".", "a/b"],
+            {},
+            r"^Invalid value \. for positional variable\.$",
+        ),
+        (
+            "/v1/*/**",
+            ["..", "a/b"],
+            {},
+            r"^Invalid value \.\. for positional variable\.$",
+        ),
+        (
+            "/v1/*/**",
+            ["a", "b/../c"],
+            {},
+            r"^Value for positional variable must not contain segments that are exactly \. or \.\. \.$",
+        ),
+        (
+            "/v1/*/**",
+            ["a", "b/./c"],
+            {},
+            r"^Value for positional variable must not contain segments that are exactly \. or \.\. \.$",
+        ),
+    ],
+)
+def test_path_traversal_multiple_positional_wildcards(
+    tmpl, args, kwargs, expected_err_match
+):
+    with pytest.raises(ValueError, match=expected_err_match):
+        path_template.expand(tmpl, *args, **kwargs)
+
+
+@pytest.mark.parametrize(
+    "tmpl, kwargs, expected_result",
+    [
+        ("/v1/{name}", {"name": ".hidden"}, "/v1/.hidden"),
+        ("/v1/{name}", {"name": "..hidden"}, "/v1/..hidden"),
+        ("/v1/{name}", {"name": "file.txt"}, "/v1/file.txt"),
+        ("/v1/{name=**}", {"name": "a/.hidden/b"}, "/v1/a/.hidden/b"),
+        ("/v1/{name=**}", {"name": "a/..hidden/b"}, "/v1/a/..hidden/b"),
+        ("/v1/{name=**}", {"name": "a/file.tar.gz/b"}, "/v1/a/file.tar.gz/b"),
+    ],
+)
+def test_valid_dot_containing_names(tmpl, kwargs, expected_result):
+    assert path_template.expand(tmpl, **kwargs) == expected_result
+
+
+def test_transcode_routing_with_path_traversal_fallback():
+    http_options = [
+        {"method": "get", "uri": "/v1/{name=projects/*/locations/*}"},
+        {"method": "get", "uri": "/v1/{name=projects/*}"},
+    ]
+
+    # Non-matching subtemplate structure falls through to secondary binding
+    result = path_template.transcode(http_options, None, name="projects/my-project")
+    assert result["uri"] == "/v1/projects/my-project"
+
+    # Structurally matching subtemplate with invalid dot segment raises immediately
+    with pytest.raises(
+        ValueError,
+        match=r"^Value for name must not contain segments that are exactly \. or \.\. \.$",
+    ):
+        path_template.transcode(
+            http_options, None, name="projects/my-project/locations/."
+        )

{google_api_core-2.34.0 → google_api_core-2.35.0}/tests/unit/test_python_package_support.py

@@ -18,6 +18,7 @@ from unittest.mock import patch
 import pytest
 
 from google.api_core._python_package_support import (
+    PQC_GRPC_WARNING_TEMPLATE,
     DependencyConstraint,
     DependencyVersion,
     check_dependency_versions,
@@ -37,7 +38,6 @@ def test_get_dependency_version(mocker, version_string_to_test):
         parse_version_to_tuple(version_string_to_test), version_string_to_test
     )
     assert get_dependency_version("some-package") == expected
-
     mock_importlib.assert_called_once_with("some-package")
 
     # Test package not found
@@ -112,6 +112,22 @@ def test_warn_deprecation_for_versions_less_than(mock_get_version, mock_get_pack
         in str(record[0].message)
     )
 
+    # Case 6: Recommended version is properly formatted.
+    mock_get_packages.reset_mock()
+    mock_get_packages.side_effect = [
+        ("dep-package (dep.package)", "dep-package"),
+        ("my-package (my.package)", "my-package"),
+    ]
+    mock_get_version.return_value = DependencyVersion(
+        parse_version_to_tuple("1.0.0"), "1.0.0"
+    )
+    with pytest.warns(FutureWarning) as record:
+        warn_deprecation_for_versions_less_than(
+            "my.package", "dep.package", "2.0.0", recommended_version="3.0.0"
+        )
+    assert len(record) == 1
+    assert "version 2.0.0 or higher (we recommend 3.0.0)." in str(record[0].message)
+
 
 @patch(
     "google.api_core._python_package_support.warn_deprecation_for_versions_less_than"
@@ -125,8 +141,40 @@ def test_check_dependency_versions_with_custom_warnings(mock_warn):
 
     assert mock_warn.call_count == 2
     mock_warn.assert_any_call(
-        "my-consumer", "pkg1", "1.0.0", recommended_version="2.0.0"
+        "my-consumer",
+        "pkg1",
+        "1.0.0",
+        recommended_version="2.0.0",
+        message_template=None,
+    )
+    mock_warn.assert_any_call(
+        "my-consumer",
+        "pkg2",
+        "2.0.0",
+        recommended_version="3.0.0",
+        message_template=None,
+    )
+
+
+@patch(
+    "google.api_core._python_package_support.warn_deprecation_for_versions_less_than"
+)
+def test_check_dependency_versions_default(mock_warn):
+    """Test check_dependency_versions with default package dependency warnings."""
+    check_dependency_versions("my-consumer")
+
+    assert mock_warn.call_count == 2
+    mock_warn.assert_any_call(
+        "my-consumer",
+        "google.protobuf",
+        "6.33.5",
+        recommended_version="6.x",
+        message_template=None,
     )
     mock_warn.assert_any_call(
-        "my-consumer", "pkg2", "2.0.0", recommended_version="3.0.0"
+        "my-consumer",
+        "grpcio",
+        "1.83.0",
+        recommended_version="1.83.x",
+        message_template=PQC_GRPC_WARNING_TEMPLATE,
     )