@@ -434,12 +434,19 @@ replacements:
434434 with mock.patch.dict\(
435435 os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "Unsupported"}
436436 \):
437- with pytest.raises\(ValueError\) as excinfo:
438- GrafeasClient._read_environment_variables\(\)
439- assert \(
440- str\(excinfo.value\)
441- == "Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`"
442- \)
437+ if not hasattr\(google.auth.transport.mtls, "should_use_client_cert"\):
438+ with pytest.raises\(ValueError\) as excinfo:
439+ GrafeasClient._read_environment_variables\(\)
440+ assert \(
441+ str\(excinfo.value\)
442+ == "Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`"
443+ \)
444+ else:
445+ assert GrafeasClient._read_environment_variables\(\) == \(
446+ False,
447+ "auto",
448+ None,
449+ \)
443450
444451 with mock.patch.dict\(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "never"}\):
445452 assert GrafeasClient._read_environment_variables\(\) == \(False, "never", None\)
@@ -462,6 +469,105 @@ replacements:
462469 assert GrafeasClient._read_environment_variables\(\) == \(False, "auto", "foo.com"\)
463470
464471
472+ def test_use_client_cert_effective\(\):
473+ # Test case 1: Test when `should_use_client_cert` returns True.
474+ # We mock the `should_use_client_cert` function to simulate a scenario where
475+ # the google-auth library supports automatic mTLS and determines that a
476+ # client certificate should be used.
477+ if hasattr\(google.auth.transport.mtls, "should_use_client_cert"\):
478+ with mock.patch\(
479+ "google.auth.transport.mtls.should_use_client_cert", return_value=True
480+ \):
481+ assert GrafeasClient._use_client_cert_effective\(\) is True
482+
483+ # Test case 2: Test when `should_use_client_cert` returns False.
484+ # We mock the `should_use_client_cert` function to simulate a scenario where
485+ # the google-auth library supports automatic mTLS and determines that a
486+ # client certificate should NOT be used.
487+ if hasattr\(google.auth.transport.mtls, "should_use_client_cert"\):
488+ with mock.patch\(
489+ "google.auth.transport.mtls.should_use_client_cert", return_value=False
490+ \):
491+ assert GrafeasClient._use_client_cert_effective\(\) is False
492+
493+ # Test case 3: Test when `should_use_client_cert` is unavailable and the
494+ # `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is set to "true".
495+ if not hasattr\(google.auth.transport.mtls, "should_use_client_cert"\):
496+ with mock.patch.dict\(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "true"}\):
497+ assert GrafeasClient._use_client_cert_effective\(\) is True
498+
499+ # Test case 4: Test when `should_use_client_cert` is unavailable and the
500+ # `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is set to "false".
501+ if not hasattr\(google.auth.transport.mtls, "should_use_client_cert"\):
502+ with mock.patch.dict\(
503+ os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "false"}
504+ \):
505+ assert GrafeasClient._use_client_cert_effective\(\) is False
506+
507+ # Test case 5: Test when `should_use_client_cert` is unavailable and the
508+ # `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is set to "True".
509+ if not hasattr\(google.auth.transport.mtls, "should_use_client_cert"\):
510+ with mock.patch.dict\(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "True"}\):
511+ assert GrafeasClient._use_client_cert_effective\(\) is True
512+
513+ # Test case 6: Test when `should_use_client_cert` is unavailable and the
514+ # `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is set to "False".
515+ if not hasattr\(google.auth.transport.mtls, "should_use_client_cert"\):
516+ with mock.patch.dict\(
517+ os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "False"}
518+ \):
519+ assert GrafeasClient._use_client_cert_effective\(\) is False
520+
521+ # Test case 7: Test when `should_use_client_cert` is unavailable and the
522+ # `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is set to "TRUE".
523+ if not hasattr\(google.auth.transport.mtls, "should_use_client_cert"\):
524+ with mock.patch.dict\(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "TRUE"}\):
525+ assert GrafeasClient._use_client_cert_effective\(\) is True
526+
527+ # Test case 8: Test when `should_use_client_cert` is unavailable and the
528+ # `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is set to "FALSE".
529+ if not hasattr\(google.auth.transport.mtls, "should_use_client_cert"\):
530+ with mock.patch.dict\(
531+ os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "FALSE"}
532+ \):
533+ assert GrafeasClient._use_client_cert_effective\(\) is False
534+
535+ # Test case 9: Test when `should_use_client_cert` is unavailable and the
536+ # `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is not set.
537+ # In this case, the method should return False, which is the default value.
538+ if not hasattr\(google.auth.transport.mtls, "should_use_client_cert"\):
539+ with mock.patch.dict\(os.environ, clear=True\):
540+ assert GrafeasClient._use_client_cert_effective\(\) is False
541+
542+ # Test case 10: Test when `should_use_client_cert` is unavailable and the
543+ # `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is set to an invalid value.
544+ # The method should raise a ValueError as the environment variable must be either
545+ # "true" or "false".
546+ if not hasattr\(google.auth.transport.mtls, "should_use_client_cert"\):
547+ with mock.patch.dict\(
548+ os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "unsupported"}
549+ \):
550+ with pytest.raises\(ValueError\):
551+ GrafeasClient._use_client_cert_effective\(\)
552+
553+ # Test case 11: Test when `should_use_client_cert` is available and the
554+ # `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is set to an invalid value.
555+ # The method should return False as the environment variable is set to an invalid value.
556+ if hasattr\(google.auth.transport.mtls, "should_use_client_cert"\):
557+ with mock.patch.dict\(
558+ os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "unsupported"}
559+ \):
560+ assert GrafeasClient._use_client_cert_effective\(\) is False
561+
562+ # Test case 12: Test when `should_use_client_cert` is available and the
563+ # `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is unset. Also,
564+ # the GOOGLE_API_CONFIG environment variable is unset.
565+ if hasattr\(google.auth.transport.mtls, "should_use_client_cert"\):
566+ with mock.patch.dict\(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": ""}\):
567+ with mock.patch.dict\(os.environ, {"GOOGLE_API_CERTIFICATE_CONFIG": ""}\):
568+ assert GrafeasClient._use_client_cert_effective\(\) is False
569+
570+
465571 def test__get_client_cert_source\(\):
466572 mock_provided_cert_source = mock.Mock\(\)
467573 mock_default_cert_source = mock.Mock\(\)
@@ -814,17 +920,6 @@ replacements:
814920 == "Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`"
815921 \)
816922
817- # Check the case GOOGLE_API_USE_CLIENT_CERTIFICATE has unsupported value.
818- with mock.patch.dict\(
819- os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "Unsupported"}
820- \):
821- with pytest.raises\(ValueError\) as excinfo:
822- client = client_class\(transport=transport_name\)
823- assert \(
824- str\(excinfo.value\)
825- == "Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`"
826- \)
827-
828923 # Check the case quota_project_id is provided
829924 options = client_options.ClientOptions\(quota_project_id="octopus"\)
830925 with mock.patch.object\(transport_class, "__init__"\) as patched:
@@ -1034,6 +1129,119 @@ replacements:
10341129 assert api_endpoint == mock_api_endpoint
10351130 assert cert_source is None
10361131
1132+ # Test the case GOOGLE_API_USE_CLIENT_CERTIFICATE is "Unsupported".
1133+ with mock.patch.dict\(
1134+ os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "Unsupported"}
1135+ \):
1136+ if hasattr\(google.auth.transport.mtls, "should_use_client_cert"\):
1137+ mock_client_cert_source = mock.Mock\(\)
1138+ mock_api_endpoint = "foo"
1139+ options = client_options.ClientOptions\(
1140+ client_cert_source=mock_client_cert_source,
1141+ api_endpoint=mock_api_endpoint,
1142+ \)
1143+ api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source\(
1144+ options
1145+ \)
1146+ assert api_endpoint == mock_api_endpoint
1147+ assert cert_source is None
1148+
1149+ # Test cases for mTLS enablement when GOOGLE_API_USE_CLIENT_CERTIFICATE is unset.
1150+ test_cases = \[
1151+ \(
1152+ # With workloads present in config, mTLS is enabled.
1153+ {
1154+ "version": 1,
1155+ "cert_configs": {
1156+ "workload": {
1157+ "cert_path": "path/to/cert/file",
1158+ "key_path": "path/to/key/file",
1159+ }
1160+ },
1161+ },
1162+ mock_client_cert_source,
1163+ \),
1164+ \(
1165+ # With workloads not present in config, mTLS is disabled.
1166+ {
1167+ "version": 1,
1168+ "cert_configs": {},
1169+ },
1170+ None,
1171+ \),
1172+ \]
1173+ if hasattr\(google.auth.transport.mtls, "should_use_client_cert"\):
1174+ for config_data, expected_cert_source in test_cases:
1175+ env = os.environ.copy\(\)
1176+ env.pop\("GOOGLE_API_USE_CLIENT_CERTIFICATE", None\)
1177+ with mock.patch.dict\(os.environ, env, clear=True\):
1178+ config_filename = "mock_certificate_config.json"
1179+ config_file_content = json.dumps\(config_data\)
1180+ m = mock.mock_open\(read_data=config_file_content\)
1181+ with mock.patch\("builtins.open", m\):
1182+ with mock.patch.dict\(
1183+ os.environ, {"GOOGLE_API_CERTIFICATE_CONFIG": config_filename}
1184+ \):
1185+ mock_api_endpoint = "foo"
1186+ options = client_options.ClientOptions\(
1187+ client_cert_source=mock_client_cert_source,
1188+ api_endpoint=mock_api_endpoint,
1189+ \)
1190+ \(
1191+ api_endpoint,
1192+ cert_source,
1193+ \) = client_class.get_mtls_endpoint_and_cert_source\(options\)
1194+ assert api_endpoint == mock_api_endpoint
1195+ assert cert_source is expected_cert_source
1196+
1197+ # Test cases for mTLS enablement when GOOGLE_API_USE_CLIENT_CERTIFICATE is unset\(empty\).
1198+ test_cases = \[
1199+ \(
1200+ # With workloads present in config, mTLS is enabled.
1201+ {
1202+ "version": 1,
1203+ "cert_configs": {
1204+ "workload": {
1205+ "cert_path": "path/to/cert/file",
1206+ "key_path": "path/to/key/file",
1207+ }
1208+ },
1209+ },
1210+ mock_client_cert_source,
1211+ \),
1212+ \(
1213+ # With workloads not present in config, mTLS is disabled.
1214+ {
1215+ "version": 1,
1216+ "cert_configs": {},
1217+ },
1218+ None,
1219+ \),
1220+ \]
1221+ if hasattr\(google.auth.transport.mtls, "should_use_client_cert"\):
1222+ for config_data, expected_cert_source in test_cases:
1223+ env = os.environ.copy\(\)
1224+ env.pop\("GOOGLE_API_USE_CLIENT_CERTIFICATE", ""\)
1225+ with mock.patch.dict\(os.environ, env, clear=True\):
1226+ config_filename = "mock_certificate_config.json"
1227+ config_file_content = json.dumps\(config_data\)
1228+ m = mock.mock_open\(read_data=config_file_content\)
1229+ with mock.patch\("builtins.open", m\):
1230+ with mock.patch.dict\(
1231+ os.environ, {"GOOGLE_API_CERTIFICATE_CONFIG": config_filename}
1232+ \):
1233+ mock_api_endpoint = "foo"
1234+ options = client_options.ClientOptions\(
1235+ client_cert_source=mock_client_cert_source,
1236+ api_endpoint=mock_api_endpoint,
1237+ \)
1238+ \(
1239+ api_endpoint,
1240+ cert_source,
1241+ \) = client_class.get_mtls_endpoint_and_cert_source\(options\)
1242+ assert api_endpoint == mock_api_endpoint
1243+ assert cert_source is expected_cert_source
1244+
10371245 # Test the case GOOGLE_API_USE_MTLS_ENDPOINT is "never".
10381246 with mock.patch.dict\(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "never"}\):
10391247 api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source\(\)
@@ -1084,18 +1292,6 @@ replacements:
10841292 == "Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`"
10851293 \)
10861294
1087- # Check the case GOOGLE_API_USE_CLIENT_CERTIFICATE has unsupported value.
1088- with mock.patch.dict\(
1089- os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "Unsupported"}
1090- \):
1091- with pytest.raises\(ValueError\) as excinfo:
1092- client_class.get_mtls_endpoint_and_cert_source\(\)
1093-
1094- assert \(
1095- str\(excinfo.value\)
1096- == "Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`"
1097- \)
1098-
10991295
11001296 @pytest.mark.parametrize\("client_class", \[GrafeasClient, GrafeasAsyncClient\]\)
11011297 @mock.patch.object\(
@@ -1390,20 +1586,16 @@ replacements:
13901586 \ \)
13911587 \ if client_options is None:
13921588 \ client_options = client_options_lib.ClientOptions\(\)
1393- \ use_client_cert = os.getenv\("GOOGLE_API_USE_CLIENT_CERTIFICATE", "false" \)
1589+ \ use_client_cert = GrafeasClient._use_client_cert_effective\( \)
13941590 \ use_mtls_endpoint = os.getenv\("GOOGLE_API_USE_MTLS_ENDPOINT", "auto"\)
1395- \ if use_client_cert not in \("true", "false"\):
1396- \ raise ValueError\(
1397- \ "Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`"
1398- \ \)
13991591 \ if use_mtls_endpoint not in \("auto", "never", "always"\):
14001592 \ raise MutualTLSChannelError\(
14011593 \ "Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`"
14021594 \ \)
14031595 \
14041596 \ # Figure out the client cert source to use.
14051597 \ client_cert_source = None
1406- \ if use_client_cert == "true" :
1598+ \ if use_client_cert:
14071599 \ if client_options.client_cert_source:
14081600 \ client_cert_source = client_options.client_cert_source
14091601 \ elif mtls.has_default_client_cert_source\(\):
@@ -1435,20 +1627,14 @@ replacements:
14351627 \ google.auth.exceptions.MutualTLSChannelError: If GOOGLE_API_USE_MTLS_ENDPOINT
14361628 \ is not any of \["auto", "never", "always"\].
14371629 \ """
1438- \ use_client_cert = os.getenv\(
1439- \ "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
1440- \ \).lower\(\)
1630+ \ use_client_cert = GrafeasClient._use_client_cert_effective\(\)
14411631 \ use_mtls_endpoint = os.getenv\("GOOGLE_API_USE_MTLS_ENDPOINT", "auto"\).lower\(\)
14421632 \ universe_domain_env = os.getenv\("GOOGLE_CLOUD_UNIVERSE_DOMAIN"\)
1443- \ if use_client_cert not in \("true", "false"\):
1444- \ raise ValueError\(
1445- \ "Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`"
1446- \ \)
14471633 \ if use_mtls_endpoint not in \("auto", "never", "always"\):
14481634 \ raise MutualTLSChannelError\(
14491635 \ "Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`"
14501636 \ \)
1451- \ return use_client_cert == "true" , use_mtls_endpoint, universe_domain_env
1637+ \ return use_client_cert, use_mtls_endpoint, universe_domain_env
14521638 \
14531639 \ @staticmethod
14541640 \ def _get_client_cert_source\(provided_cert_source, use_cert_flag\):
0 commit comments