feat: opt-in logging support for request / response (#1686)

* feat: opt-in logging support for request/response

* add pragma no cover

* add test coverage for request/response

* add code coverage

Author: ohmayr

google/auth/_helpers.py

@@ -26,6 +26,14 @@
 
 from google.auth import exceptions
 
+try:
+    from google.api_core import client_logging
+    CLIENT_LOGGING_SUPPORTED = True  # pragma: NO COVER
+# TODO(https://github.com/googleapis/google-auth-library-python/issues/1690): Remove `pragma: NO COVER` once
+# logging is supported in minimum version of google-api-core.
+except ImportError:  # pragma: NO COVER
+    CLIENT_LOGGING_SUPPORTED = False
+
 # The smallest MDS cache used by this library stores tokens until 4 minutes from
 # expiry.
 REFRESH_THRESHOLD = datetime.timedelta(minutes=3, seconds=45)
@@ -316,15 +324,22 @@ def _hash_value(value, field_name: str) -> str:
     return f"hashed_{field_name}-{hex_digest}"
 
 
-def request_log(
-    logger: logging.Logger,
-    method: str,
-    url: str,
-    body: Optional[Any],
-    headers: Optional[Dict[str, str]],
-) -> None:
+def is_logging_enabled(logger: logging.Logger) -> bool:
+    """
+    Checks if debug logging is enabled for the given logger.
+
+    Args:
+        logger: The logging.Logger instance to check.
+
+    Returns:
+        True if debug logging is enabled, False otherwise.
+    """
+    return CLIENT_LOGGING_SUPPORTED and logger.isEnabledFor(logging.DEBUG)
+
+
+def request_log(logger: logging.Logger, method: str, url: str, body: Optional[Any], headers: Optional[Dict[str, str]]) -> None:
     """
-    Logs an HTTP request at the DEBUG level.
+    Logs an HTTP request at the DEBUG level if logging is enabled.
 
     Args:
         logger: The logging.Logger instance to use.
@@ -333,21 +348,21 @@ def request_log(
         body: The request body (can be None).
         headers: The request headers (can be None).
     """
-    # TODO(https://github.com/googleapis/google-auth-library-python/issues/1680): Log only if enabled.
     # TODO(https://github.com/googleapis/google-auth-library-python/issues/1682): Add httpRequest extra to log event.
     # TODO(https://github.com/googleapis/google-auth-library-python/issues/1681): Hash sensitive information.
-    logger.debug("Making request: %s %s", method, url)
+    if is_logging_enabled(logger):
+        logger.debug("Making request: %s %s", method, url)
 
 
 def response_log(logger: logging.Logger, response: Any) -> None:
     """
-    Logs an HTTP response at the DEBUG level.
+    Logs an HTTP response at the DEBUG level if logging is enabled.
 
     Args:
         logger: The logging.Logger instance to use.
         response: The HTTP response object to log.
     """
-    # TODO(https://github.com/googleapis/google-auth-library-python/issues/1680): Log only if enabled.
     # TODO(https://github.com/googleapis/google-auth-library-python/issues/1683): Add httpResponse extra to log event.
     # TODO(https://github.com/googleapis/google-auth-library-python/issues/1681): Hash sensitive information.
-    logger.debug("Response received...")
+    if is_logging_enabled(logger):
+        logger.debug("Response received...")

tests/test__helpers.py

@@ -14,12 +14,20 @@
 
 import datetime
 import urllib
+import logging
+from unittest import mock
 
 import pytest  # type: ignore
 
 from google.auth import _helpers
 
 
+@pytest.fixture
+def logger():
+    """Provides a basic logger instance for testing."""
+    return logging.getLogger(__name__)
+
+
 class SourceClass(object):
     def func(self):  # pragma: NO COVER
         """example docstring"""
@@ -263,3 +271,54 @@ def test_hash_value_different_hashing():
 
 def test_hash_value_none():
     assert _helpers._hash_value(None, "test") is None
+
+
+def test_is_logging_enabled_with_no_level_set(logger):
+    
+    with mock.patch("google.auth._helpers.CLIENT_LOGGING_SUPPORTED", True):
+        assert _helpers.is_logging_enabled(logger) is False
+
+
+def test_is_logging_enabled_with_client_logging_not_supported(caplog, logger):
+    
+    with mock.patch("google.auth._helpers.CLIENT_LOGGING_SUPPORTED", False):
+        caplog.set_level(logging.DEBUG, logger=__name__)
+        assert _helpers.is_logging_enabled(logger) is False
+
+
+def test_is_logging_enabled_with_debug_disabled(caplog, logger):
+    
+    with mock.patch("google.auth._helpers.CLIENT_LOGGING_SUPPORTED", True):
+        caplog.set_level(logging.INFO, logger=__name__)
+        assert _helpers.is_logging_enabled(logger) is False
+
+
+def test_is_logging_enabled_with_debug_enabled(caplog, logger):
+    with mock.patch("google.auth._helpers.CLIENT_LOGGING_SUPPORTED", True):
+        caplog.set_level(logging.DEBUG, logger=__name__)
+        assert _helpers.is_logging_enabled(logger)
+
+
+def test_request_log_debug_enabled(logger, caplog):
+    logger.setLevel(logging.DEBUG)
+    with mock.patch("google.auth._helpers.CLIENT_LOGGING_SUPPORTED", True):
+        _helpers.request_log(logger, "GET", "http://example.com", {"key": "value"}, {"Authorization": "Bearer token"})
+    assert "Making request: GET http://example.com" in caplog.text
+
+def test_request_log_debug_disabled(logger, caplog):
+    logger.setLevel(logging.INFO)
+    with mock.patch("google.auth._helpers.CLIENT_LOGGING_SUPPORTED", True):
+        _helpers.request_log(logger, "POST", "https://api.example.com", "data", {"Content-Type": "application/json"})
+    assert "Making request: POST https://api.example.com" not in caplog.text
+
+def test_response_log_debug_enabled(logger, caplog):
+    logger.setLevel(logging.DEBUG)
+    with mock.patch("google.auth._helpers.CLIENT_LOGGING_SUPPORTED", True):
+        _helpers.response_log(logger, "response_object")
+    assert "Response received..." in caplog.text
+
+def test_response_log_debug_disabled(logger, caplog):
+    logger.setLevel(logging.INFO)
+    with mock.patch("google.auth._helpers.CLIENT_LOGGING_SUPPORTED", True):
+        _helpers.response_log(logger, "another_response")
+    assert "Response received..." not in caplog.text