Skip to content

Commit 2503d4a

Browse files
BigTailWolfBigTailWolf
authored
fix: Trust boundary meta header renaming and using the schema from backend team. (#1384)
* fix: rename the trust boundary metaheader into * fix comments
1 parent bd25e6a commit 2503d4a

File tree

7 files changed

+54
-37
lines changed

7 files changed

+54
-37
lines changed

‎google/auth/credentials.py‎

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -52,8 +52,9 @@ def __init__(self):
5252
self._quota_project_id = None
5353
"""Optional[str]: Project to use for quota and billing purposes."""
5454
self._trust_boundary = None
55-
"""Optional[str]: Encoded string representation of credentials trust
56-
boundary."""
55+
"""Optional[dict]: Cache of a trust boundary response which has a list
56+
of allowed regions and an encoded string representation of credentials
57+
trust boundary."""
5758
self._universe_domain = "googleapis.com"
5859
"""Optional[str]: The universe domain value, default is googleapis.com
5960
"""
@@ -135,8 +136,21 @@ def apply(self, headers, token=None):
135136
headers["authorization"] = "Bearer {}".format(
136137
_helpers.from_bytes(token or self.token)
137138
)
139+
"""Trust boundary value will be a cached value from global lookup.
140+
141+
The response of trust boundary will be a list of regions and a hex
142+
encoded representation.
143+
144+
An example of global lookup response:
145+
{
146+
"locations": [
147+
"us-central1", "us-east1", "europe-west1", "asia-east1"
148+
]
149+
"encoded_locations": "0xA30"
150+
}
151+
"""
138152
if self._trust_boundary is not None:
139-
headers["x-identity-trust-boundary"] = self._trust_boundary
153+
headers["x-allowed-locations"] = self._trust_boundary["encoded_locations"]
140154
if self.quota_project_id:
141155
headers["x-goog-user-project"] = self.quota_project_id
142156

‎google/auth/external_account.py‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -132,7 +132,10 @@ def __init__(
132132
self._default_scopes = default_scopes
133133
self._workforce_pool_user_project = workforce_pool_user_project
134134
self._universe_domain = universe_domain or _DEFAULT_UNIVERSE_DOMAIN
135-
self._trust_boundary = "0" # expose a placeholder trust boundary value.
135+
self._trust_boundary = {
136+
"locations": [],
137+
"encoded_locations": "0x0",
138+
} # expose a placeholder trust boundary value.
136139

137140
if self._client_id:
138141
self._client_auth = utils.ClientAuthentication(

‎google/oauth2/service_account.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -196,7 +196,7 @@ def __init__(
196196
self._additional_claims = additional_claims
197197
else:
198198
self._additional_claims = {}
199-
self._trust_boundary = "0"
199+
self._trust_boundary = {"locations": [], "encoded_locations": "0x0"}
200200

201201
@classmethod
202202
def _from_signer_and_info(cls, signer, info, **kwargs):

‎tests/test_aws.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1969,7 +1969,7 @@ def test_refresh_success_with_impersonation_ignore_default_scopes(
19691969
"authorization": "Bearer {}".format(self.SUCCESS_RESPONSE["access_token"]),
19701970
"x-goog-user-project": QUOTA_PROJECT_ID,
19711971
"x-goog-api-client": IMPERSONATE_ACCESS_TOKEN_REQUEST_METRICS_HEADER_VALUE,
1972-
"x-identity-trust-boundary": "0",
1972+
"x-allowed-locations": "0x0",
19731973
}
19741974
impersonation_request_data = {
19751975
"delegates": None,
@@ -2066,7 +2066,7 @@ def test_refresh_success_with_impersonation_use_default_scopes(
20662066
"authorization": "Bearer {}".format(self.SUCCESS_RESPONSE["access_token"]),
20672067
"x-goog-user-project": QUOTA_PROJECT_ID,
20682068
"x-goog-api-client": IMPERSONATE_ACCESS_TOKEN_REQUEST_METRICS_HEADER_VALUE,
2069-
"x-identity-trust-boundary": "0",
2069+
"x-allowed-locations": "0x0",
20702070
}
20712071
impersonation_request_data = {
20722072
"delegates": None,

‎tests/test_credentials.py‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ def test_before_request():
8181
assert credentials.valid
8282
assert credentials.token == "token"
8383
assert headers["authorization"] == "Bearer token"
84-
assert "x-identity-trust-boundary" not in headers
84+
assert "x-allowed-locations" not in headers
8585

8686
request = "token2"
8787
headers = {}
@@ -91,13 +91,13 @@ def test_before_request():
9191
assert credentials.valid
9292
assert credentials.token == "token"
9393
assert headers["authorization"] == "Bearer token"
94-
assert "x-identity-trust-boundary" not in headers
94+
assert "x-allowed-locations" not in headers
9595

9696

9797
def test_before_request_with_trust_boundary():
98-
DUMMY_BOUNDARY = "00110101"
98+
DUMMY_BOUNDARY = "0xA30"
9999
credentials = CredentialsImpl()
100-
credentials._trust_boundary = DUMMY_BOUNDARY
100+
credentials._trust_boundary = {"locations": [], "encoded_locations": DUMMY_BOUNDARY}
101101
request = "token"
102102
headers = {}
103103

@@ -106,7 +106,7 @@ def test_before_request_with_trust_boundary():
106106
assert credentials.valid
107107
assert credentials.token == "token"
108108
assert headers["authorization"] == "Bearer token"
109-
assert headers["x-identity-trust-boundary"] == DUMMY_BOUNDARY
109+
assert headers["x-allowed-locations"] == DUMMY_BOUNDARY
110110

111111
request = "token2"
112112
headers = {}
@@ -116,7 +116,7 @@ def test_before_request_with_trust_boundary():
116116
assert credentials.valid
117117
assert credentials.token == "token"
118118
assert headers["authorization"] == "Bearer token"
119-
assert headers["x-identity-trust-boundary"] == DUMMY_BOUNDARY
119+
assert headers["x-allowed-locations"] == DUMMY_BOUNDARY
120120

121121

122122
def test_before_request_metrics():

‎tests/test_external_account.py‎

Lines changed: 23 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -833,7 +833,7 @@ def test_refresh_impersonation_without_client_auth_success(
833833
"Content-Type": "application/json",
834834
"authorization": "Bearer {}".format(token_response["access_token"]),
835835
"x-goog-api-client": IMPERSONATE_ACCESS_TOKEN_REQUEST_METRICS_HEADER_VALUE,
836-
"x-identity-trust-boundary": "0",
836+
"x-allowed-locations": "0x0",
837837
}
838838
impersonation_request_data = {
839839
"delegates": None,
@@ -915,7 +915,7 @@ def test_refresh_workforce_impersonation_without_client_auth_success(
915915
"Content-Type": "application/json",
916916
"authorization": "Bearer {}".format(token_response["access_token"]),
917917
"x-goog-api-client": IMPERSONATE_ACCESS_TOKEN_REQUEST_METRICS_HEADER_VALUE,
918-
"x-identity-trust-boundary": "0",
918+
"x-allowed-locations": "0x0",
919919
}
920920
impersonation_request_data = {
921921
"delegates": None,
@@ -1134,7 +1134,7 @@ def test_refresh_impersonation_with_client_auth_success_ignore_default_scopes(
11341134
"Content-Type": "application/json",
11351135
"authorization": "Bearer {}".format(token_response["access_token"]),
11361136
"x-goog-api-client": IMPERSONATE_ACCESS_TOKEN_REQUEST_METRICS_HEADER_VALUE,
1137-
"x-identity-trust-boundary": "0",
1137+
"x-allowed-locations": "0x0",
11381138
}
11391139
impersonation_request_data = {
11401140
"delegates": None,
@@ -1218,7 +1218,7 @@ def test_refresh_impersonation_with_client_auth_success_use_default_scopes(
12181218
"Content-Type": "application/json",
12191219
"authorization": "Bearer {}".format(token_response["access_token"]),
12201220
"x-goog-api-client": IMPERSONATE_ACCESS_TOKEN_REQUEST_METRICS_HEADER_VALUE,
1221-
"x-identity-trust-boundary": "0",
1221+
"x-allowed-locations": "0x0",
12221222
}
12231223
impersonation_request_data = {
12241224
"delegates": None,
@@ -1274,7 +1274,7 @@ def test_apply_without_quota_project_id(self):
12741274

12751275
assert headers == {
12761276
"authorization": "Bearer {}".format(self.SUCCESS_RESPONSE["access_token"]),
1277-
"x-identity-trust-boundary": "0",
1277+
"x-allowed-locations": "0x0",
12781278
}
12791279

12801280
def test_apply_workforce_without_quota_project_id(self):
@@ -1291,7 +1291,7 @@ def test_apply_workforce_without_quota_project_id(self):
12911291

12921292
assert headers == {
12931293
"authorization": "Bearer {}".format(self.SUCCESS_RESPONSE["access_token"]),
1294-
"x-identity-trust-boundary": "0",
1294+
"x-allowed-locations": "0x0",
12951295
}
12961296

12971297
def test_apply_impersonation_without_quota_project_id(self):
@@ -1323,7 +1323,7 @@ def test_apply_impersonation_without_quota_project_id(self):
13231323

13241324
assert headers == {
13251325
"authorization": "Bearer {}".format(impersonation_response["accessToken"]),
1326-
"x-identity-trust-boundary": "0",
1326+
"x-allowed-locations": "0x0",
13271327
}
13281328

13291329
def test_apply_with_quota_project_id(self):
@@ -1340,7 +1340,7 @@ def test_apply_with_quota_project_id(self):
13401340
"other": "header-value",
13411341
"authorization": "Bearer {}".format(self.SUCCESS_RESPONSE["access_token"]),
13421342
"x-goog-user-project": self.QUOTA_PROJECT_ID,
1343-
"x-identity-trust-boundary": "0",
1343+
"x-allowed-locations": "0x0",
13441344
}
13451345

13461346
def test_apply_impersonation_with_quota_project_id(self):
@@ -1375,7 +1375,7 @@ def test_apply_impersonation_with_quota_project_id(self):
13751375
"other": "header-value",
13761376
"authorization": "Bearer {}".format(impersonation_response["accessToken"]),
13771377
"x-goog-user-project": self.QUOTA_PROJECT_ID,
1378-
"x-identity-trust-boundary": "0",
1378+
"x-allowed-locations": "0x0",
13791379
}
13801380

13811381
def test_before_request(self):
@@ -1391,7 +1391,7 @@ def test_before_request(self):
13911391
assert headers == {
13921392
"other": "header-value",
13931393
"authorization": "Bearer {}".format(self.SUCCESS_RESPONSE["access_token"]),
1394-
"x-identity-trust-boundary": "0",
1394+
"x-allowed-locations": "0x0",
13951395
}
13961396

13971397
# Second call shouldn't call refresh.
@@ -1400,7 +1400,7 @@ def test_before_request(self):
14001400
assert headers == {
14011401
"other": "header-value",
14021402
"authorization": "Bearer {}".format(self.SUCCESS_RESPONSE["access_token"]),
1403-
"x-identity-trust-boundary": "0",
1403+
"x-allowed-locations": "0x0",
14041404
}
14051405

14061406
def test_before_request_workforce(self):
@@ -1418,7 +1418,7 @@ def test_before_request_workforce(self):
14181418
assert headers == {
14191419
"other": "header-value",
14201420
"authorization": "Bearer {}".format(self.SUCCESS_RESPONSE["access_token"]),
1421-
"x-identity-trust-boundary": "0",
1421+
"x-allowed-locations": "0x0",
14221422
}
14231423

14241424
# Second call shouldn't call refresh.
@@ -1427,7 +1427,7 @@ def test_before_request_workforce(self):
14271427
assert headers == {
14281428
"other": "header-value",
14291429
"authorization": "Bearer {}".format(self.SUCCESS_RESPONSE["access_token"]),
1430-
"x-identity-trust-boundary": "0",
1430+
"x-allowed-locations": "0x0",
14311431
}
14321432

14331433
def test_before_request_impersonation(self):
@@ -1458,7 +1458,7 @@ def test_before_request_impersonation(self):
14581458
assert headers == {
14591459
"other": "header-value",
14601460
"authorization": "Bearer {}".format(impersonation_response["accessToken"]),
1461-
"x-identity-trust-boundary": "0",
1461+
"x-allowed-locations": "0x0",
14621462
}
14631463

14641464
# Second call shouldn't call refresh.
@@ -1467,7 +1467,7 @@ def test_before_request_impersonation(self):
14671467
assert headers == {
14681468
"other": "header-value",
14691469
"authorization": "Bearer {}".format(impersonation_response["accessToken"]),
1470-
"x-identity-trust-boundary": "0",
1470+
"x-allowed-locations": "0x0",
14711471
}
14721472

14731473
@mock.patch("google.auth._helpers.utcnow")
@@ -1495,7 +1495,7 @@ def test_before_request_expired(self, utcnow):
14951495
# Cached token should be used.
14961496
assert headers == {
14971497
"authorization": "Bearer token",
1498-
"x-identity-trust-boundary": "0",
1498+
"x-allowed-locations": "0x0",
14991499
}
15001500

15011501
# Next call should simulate 1 second passed.
@@ -1509,7 +1509,7 @@ def test_before_request_expired(self, utcnow):
15091509
# New token should be retrieved.
15101510
assert headers == {
15111511
"authorization": "Bearer {}".format(self.SUCCESS_RESPONSE["access_token"]),
1512-
"x-identity-trust-boundary": "0",
1512+
"x-allowed-locations": "0x0",
15131513
}
15141514

15151515
@mock.patch("google.auth._helpers.utcnow")
@@ -1552,7 +1552,7 @@ def test_before_request_impersonation_expired(self, utcnow):
15521552
# Cached token should be used.
15531553
assert headers == {
15541554
"authorization": "Bearer token",
1555-
"x-identity-trust-boundary": "0",
1555+
"x-allowed-locations": "0x0",
15561556
}
15571557

15581558
# Next call should simulate 1 second passed. This will trigger the expiration
@@ -1567,7 +1567,7 @@ def test_before_request_impersonation_expired(self, utcnow):
15671567
# New token should be retrieved.
15681568
assert headers == {
15691569
"authorization": "Bearer {}".format(impersonation_response["accessToken"]),
1570-
"x-identity-trust-boundary": "0",
1570+
"x-allowed-locations": "0x0",
15711571
}
15721572

15731573
@pytest.mark.parametrize(
@@ -1666,7 +1666,7 @@ def test_get_project_id_cloud_resource_manager_success(
16661666
"x-goog-user-project": self.QUOTA_PROJECT_ID,
16671667
"authorization": "Bearer {}".format(token_response["access_token"]),
16681668
"x-goog-api-client": IMPERSONATE_ACCESS_TOKEN_REQUEST_METRICS_HEADER_VALUE,
1669-
"x-identity-trust-boundary": "0",
1669+
"x-allowed-locations": "0x0",
16701670
}
16711671
impersonation_request_data = {
16721672
"delegates": None,
@@ -1720,7 +1720,7 @@ def test_get_project_id_cloud_resource_manager_success(
17201720
"authorization": "Bearer {}".format(
17211721
impersonation_response["accessToken"]
17221722
),
1723-
"x-identity-trust-boundary": "0",
1723+
"x-allowed-locations": "0x0",
17241724
},
17251725
)
17261726

@@ -1792,7 +1792,7 @@ def test_workforce_pool_get_project_id_cloud_resource_manager_success(
17921792
"authorization": "Bearer {}".format(
17931793
self.SUCCESS_RESPONSE["access_token"]
17941794
),
1795-
"x-identity-trust-boundary": "0",
1795+
"x-allowed-locations": "0x0",
17961796
},
17971797
)
17981798

@@ -1842,7 +1842,7 @@ def test_refresh_impersonation_with_lifetime(
18421842
"Content-Type": "application/json",
18431843
"authorization": "Bearer {}".format(token_response["access_token"]),
18441844
"x-goog-api-client": IMPERSONATE_ACCESS_TOKEN_REQUEST_METRICS_HEADER_VALUE,
1845-
"x-identity-trust-boundary": "0",
1845+
"x-allowed-locations": "0x0",
18461846
}
18471847
impersonation_request_data = {
18481848
"delegates": None,

‎tests/test_identity_pool.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -319,7 +319,7 @@ def assert_underlying_credentials_refresh(
319319
"Content-Type": "application/json",
320320
"authorization": "Bearer {}".format(token_response["access_token"]),
321321
"x-goog-api-client": metrics_header_value,
322-
"x-identity-trust-boundary": "0",
322+
"x-allowed-locations": "0x0",
323323
}
324324
impersonation_request_data = {
325325
"delegates": None,

0 commit comments

Comments
 (0)