Shortcuts on this page
r m x toggle line displays
j k next/prev highlighted chunk
0 (zero) top of page
1 (one) first highlighted chunk
1# -*- coding: utf-8 -*-
2# Copyright 2026 Google LLC
3#
4# Licensed under the Apache License, Version 2.0 (the "License");
5# you may not use this file except in compliance with the License.
6# You may obtain a copy of the License at
7#
8# http://www.apache.org/licenses/LICENSE-2.0
9#
10# Unless required by applicable law or agreed to in writing, software
11# distributed under the License is distributed on an "AS IS" BASIS,
12# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13# See the License for the specific language governing permissions and
14# limitations under the License.
15#
16import abc
17from typing import Awaitable, Callable, Dict, Optional, Sequence, Union
19import google.api_core
20import google.auth # type: ignore
21import google.protobuf
22from google.api_core import exceptions as core_exceptions
23from google.api_core import gapic_v1
24from google.api_core import retry as retries
25from google.auth import credentials as ga_credentials # type: ignore
26from google.oauth2 import service_account # type: ignore
28from google.cloud.iam_credentials_v1 import gapic_version as package_version
29from google.cloud.iam_credentials_v1.types import common
31DEFAULT_CLIENT_INFO = gapic_v1.client_info.ClientInfo(
32 gapic_version=package_version.__version__
33)
34DEFAULT_CLIENT_INFO.protobuf_runtime_version = google.protobuf.__version__
37class IAMCredentialsTransport(abc.ABC):
38 """Abstract transport class for IAMCredentials."""
40 AUTH_SCOPES = ("https://www.googleapis.com/auth/cloud-platform",)
42 DEFAULT_HOST: str = "iamcredentials.googleapis.com"
44 def __init__(
45 self,
46 *,
47 host: str = DEFAULT_HOST,
48 credentials: Optional[ga_credentials.Credentials] = None,
49 credentials_file: Optional[str] = None,
50 scopes: Optional[Sequence[str]] = None,
51 quota_project_id: Optional[str] = None,
52 client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO,
53 always_use_jwt_access: Optional[bool] = False,
54 api_audience: Optional[str] = None,
55 **kwargs,
56 ) -> None:
57 """Instantiate the transport.
59 Args:
60 host (Optional[str]):
61 The hostname to connect to (default: 'iamcredentials.googleapis.com').
62 credentials (Optional[google.auth.credentials.Credentials]): The
63 authorization credentials to attach to requests. These
64 credentials identify the application to the service; if none
65 are specified, the client will attempt to ascertain the
66 credentials from the environment.
67 credentials_file (Optional[str]): Deprecated. A file with credentials that can
68 be loaded with :func:`google.auth.load_credentials_from_file`.
69 This argument is mutually exclusive with credentials. This argument will be
70 removed in the next major version of this library.
71 scopes (Optional[Sequence[str]]): A list of scopes.
72 quota_project_id (Optional[str]): An optional project to use for billing
73 and quota.
74 client_info (google.api_core.gapic_v1.client_info.ClientInfo):
75 The client info used to send a user-agent string along with
76 API requests. If ``None``, then default info will be used.
77 Generally, you only need to set this if you're developing
78 your own client library.
79 always_use_jwt_access (Optional[bool]): Whether self signed JWT should
80 be used for service account credentials.
81 api_audience (Optional[str]): The intended audience for the API calls
82 to the service that will be set when using certain 3rd party
83 authentication flows. Audience is typically a resource identifier.
84 If not set, the host value will be used as a default.
85 """
87 # Save the scopes.
88 self._scopes = scopes
89 if not hasattr(self, "_ignore_credentials"):
90 self._ignore_credentials: bool = False
92 # If no credentials are provided, then determine the appropriate
93 # defaults.
94 if credentials and credentials_file:
95 raise core_exceptions.DuplicateCredentialArgs(
96 "'credentials_file' and 'credentials' are mutually exclusive"
97 )
99 if credentials_file is not None:
100 credentials, _ = google.auth.load_credentials_from_file(
101 credentials_file,
102 scopes=scopes,
103 quota_project_id=quota_project_id,
104 default_scopes=self.AUTH_SCOPES,
105 )
106 elif credentials is None and not self._ignore_credentials:
107 credentials, _ = google.auth.default(
108 scopes=scopes,
109 quota_project_id=quota_project_id,
110 default_scopes=self.AUTH_SCOPES,
111 )
112 # Don't apply audience if the credentials file passed from user.
113 if hasattr(credentials, "with_gdch_audience"):
114 credentials = credentials.with_gdch_audience(
115 api_audience if api_audience else host
116 )
118 # If the credentials are service account credentials, then always try to use self signed JWT.
119 if (
120 always_use_jwt_access
121 and isinstance(credentials, service_account.Credentials)
122 and hasattr(service_account.Credentials, "with_always_use_jwt_access")
123 ):
124 credentials = credentials.with_always_use_jwt_access(True)
126 # Save the credentials.
127 self._credentials = credentials
129 # Save the hostname. Default to port 443 (HTTPS) if none is specified.
130 if ":" not in host:
131 host += ":443"
132 self._host = host
134 self._wrapped_methods: Dict[Callable, Callable] = {}
136 @property
137 def host(self):
138 return self._host
140 def _prep_wrapped_messages(self, client_info):
141 # Precompute the wrapped methods.
142 self._wrapped_methods = {
143 self.generate_access_token: gapic_v1.method.wrap_method(
144 self.generate_access_token,
145 default_retry=retries.Retry(
146 initial=0.1,
147 maximum=60.0,
148 multiplier=1.3,
149 predicate=retries.if_exception_type(
150 core_exceptions.DeadlineExceeded,
151 core_exceptions.ServiceUnavailable,
152 ),
153 deadline=60.0,
154 ),
155 default_timeout=60.0,
156 client_info=client_info,
157 ),
158 self.generate_id_token: gapic_v1.method.wrap_method(
159 self.generate_id_token,
160 default_retry=retries.Retry(
161 initial=0.1,
162 maximum=60.0,
163 multiplier=1.3,
164 predicate=retries.if_exception_type(
165 core_exceptions.DeadlineExceeded,
166 core_exceptions.ServiceUnavailable,
167 ),
168 deadline=60.0,
169 ),
170 default_timeout=60.0,
171 client_info=client_info,
172 ),
173 self.sign_blob: gapic_v1.method.wrap_method(
174 self.sign_blob,
175 default_retry=retries.Retry(
176 initial=0.1,
177 maximum=60.0,
178 multiplier=1.3,
179 predicate=retries.if_exception_type(
180 core_exceptions.DeadlineExceeded,
181 core_exceptions.ServiceUnavailable,
182 ),
183 deadline=60.0,
184 ),
185 default_timeout=60.0,
186 client_info=client_info,
187 ),
188 self.sign_jwt: gapic_v1.method.wrap_method(
189 self.sign_jwt,
190 default_retry=retries.Retry(
191 initial=0.1,
192 maximum=60.0,
193 multiplier=1.3,
194 predicate=retries.if_exception_type(
195 core_exceptions.DeadlineExceeded,
196 core_exceptions.ServiceUnavailable,
197 ),
198 deadline=60.0,
199 ),
200 default_timeout=60.0,
201 client_info=client_info,
202 ),
203 }
205 def close(self):
206 """Closes resources associated with the transport.
208 .. warning::
209 Only call this method if the transport is NOT shared
210 with other clients - this may cause errors in other clients!
211 """
212 raise NotImplementedError()
214 @property
215 def generate_access_token(
216 self,
217 ) -> Callable[
218 [common.GenerateAccessTokenRequest],
219 Union[
220 common.GenerateAccessTokenResponse,
221 Awaitable[common.GenerateAccessTokenResponse],
222 ],
223 ]:
224 raise NotImplementedError()
226 @property
227 def generate_id_token(
228 self,
229 ) -> Callable[
230 [common.GenerateIdTokenRequest],
231 Union[
232 common.GenerateIdTokenResponse, Awaitable[common.GenerateIdTokenResponse]
233 ],
234 ]:
235 raise NotImplementedError()
237 @property
238 def sign_blob(
239 self,
240 ) -> Callable[
241 [common.SignBlobRequest],
242 Union[common.SignBlobResponse, Awaitable[common.SignBlobResponse]],
243 ]:
244 raise NotImplementedError()
246 @property
247 def sign_jwt(
248 self,
249 ) -> Callable[
250 [common.SignJwtRequest],
251 Union[common.SignJwtResponse, Awaitable[common.SignJwtResponse]],
252 ]:
253 raise NotImplementedError()
255 @property
256 def kind(self) -> str:
257 raise NotImplementedError()
260__all__ = ("IAMCredentialsTransport",)