git.iko.soy/gogol
on develop help sign in
Tweaking naming
14897f8Brendan Hay
gogol/src/Network/Google.hs+1
compare with develop
unifiedsplit
@@ -105,6 +105,7 @@ import qualified Control.Monad.Writer.Lazy as LW
105import qualified Control.Monad.Writer.Strict as W
105import qualified Control.Monad.Writer.Strict as W
106import Network.Google.Auth
106import Network.Google.Auth
107import Network.Google.Env
107import Network.Google.Env
108+import Network.Google.Internal.Auth
108import Network.Google.Internal.Body
109import Network.Google.Internal.Body
109import Network.Google.Internal.HTTP
110import Network.Google.Internal.HTTP
110import Network.Google.Internal.Logger
111import Network.Google.Internal.Logger
gogol/src/Network/Google/Auth.hs+83−28
@@ -133,34 +133,10 @@ import Network.HTTP.Conduit hiding
133 (Request)
133 (Request)
134import qualified Network.HTTP.Conduit as Client
134import qualified Network.HTTP.Conduit as Client
135import Network.HTTP.Types
135import Network.HTTP.Types
136−
136+import System.Directory (doesFileExist, getHomeDirectory)
137−-- | Attempt credentials discovery via the following steps:
137+import System.Environment (lookupEnv)
138−--
138+import System.FilePath ((</>))
139−-- * Read the default credentials from a file specified by
139+import System.Info (os)
140−-- the environment variable @GOOGLE_APPLICATION_CREDENTIALS@ if it exists.
141−--
142−-- * Read the platform equivalent of @~\/.config\/gcloud\/application_default_credentials.json@ if it exists.
143−-- The @~/.config@ component of the path can be overriden by the environment
144−-- variable @CLOUDSDK_CONFIG@ if it exists.
145−--
146−-- * Retrieve the default service account application credentials if
147−-- running on GCE. The environment variable @NO_GCE_CHECK@ can be used to
148−-- skip this check if set to a truthy value such as @1@ or @true@.
149−--
150−-- The specified 'Scope's are used to authorize any @service_account@ that is
151−-- found with the appropriate scopes, otherwise they are not used. See the
152−-- top-level module of each individual @gogol-*@ library for a list of available
153−-- scopes, such as @Network.Google.Compute.computeScope@.
154−-- discover :: (MonadIO m, MonadCatch m)
155−-- => [OAuthScope]
156−-- -> Manager
157−-- -> m Credentials
158−-- discover ss m =
159−-- catching _MissingFileError (fromFile ss) $ \f -> do
160−-- p <- isGCE m
161−-- unless p $
162−-- throwingM _MissingFileError f
163−-- pure $! FromMetadata "default"
164
140
165-- | The supported credential mechanisms.
141-- | The supported credential mechanisms.
166data Credentials
142data Credentials
@@ -189,6 +165,85 @@ data Credentials
189 -- An 'AuthorizedUser' is typically created by the @gcloud init@ command
165 -- An 'AuthorizedUser' is typically created by the @gcloud init@ command
190 -- of the Google CloudSDK Tools.
166 -- of the Google CloudSDK Tools.
191
167
168+-- | Attempt credentials discovery via the following steps:
169+--
170+-- * Read the default credentials from a file specified by
171+-- the environment variable @GOOGLE_APPLICATION_CREDENTIALS@ if it exists.
172+--
173+-- * Read the platform equivalent of @~\/.config\/gcloud\/application_default_credentials.json@ if it exists.
174+-- The @~/.config@ component of the path can be overriden by the environment
175+-- variable @CLOUDSDK_CONFIG@ if it exists.
176+--
177+-- * Retrieve the default service account application credentials if
178+-- running on GCE. The environment variable @NO_GCE_CHECK@ can be used to
179+-- skip this check if set to a truthy value such as @1@ or @true@.
180+--
181+-- The specified 'Scope's are used to authorize any @service_account@ that is
182+-- found with the appropriate scopes, otherwise they are not used. See the
183+-- top-level module of each individual @gogol-*@ library for a list of available
184+-- scopes, such as @Network.Google.Compute.computeScope@.
185+discover :: (MonadIO m, MonadCatch m)
186+ => [OAuthScope]
187+ -> Manager
188+ -> m Credentials
189+discover ss m =
190+ catching _MissingFileError (fromFile ss) $ \f -> do
191+ p <- isGCE m
192+ unless p $
193+ throwingM _MissingFileError f
194+ pure $! FromMetadata "default"
195+
196+-- | Attempt to load either a @service_account@ or @authorized_user@ formatted
197+-- file to obtain the credentials neccessary to perform a token refresh.
198+--
199+-- The specified 'Scope's are used to authorize any @service_account@ that is
200+-- found with the appropriate scopes, otherwise they are not used. See the
201+-- top-level module of each individual @gogol-*@ library for a list of available
202+-- scopes, such as @Network.Google.Compute.computeScope@.
203+--
204+-- /See:/ 'cloudSDKConfigPath', 'defaultCredentialsPath'.
205+fromFile :: (MonadIO m, MonadCatch m) => [OAuthScope] -> m Credentials
206+fromFile ss = do
207+ f <- defaultCredentialsPath
208+ case f of
209+ Just x -> fromFilePath ss x
210+ Nothing -> do
211+ x <- cloudSDKConfigPath
212+ fromFilePath ss x
213+
214+-- | Attempt to load either a @service_account@ or @authorized_user@ formatted
215+-- file to obtain the credentials neccessary to perform a token refresh from
216+-- the specified file.
217+--
218+-- The specified 'Scope's are used to authorize any @service_account@ that is
219+-- found with the appropriate scopes, otherwise they are not used. See the
220+-- top-level module of each individual @gogol-*@ library for a list of available
221+-- scopes, such as @Network.Google.Compute.computeScope@.
222+fromFilePath :: (MonadIO m, MonadCatch m)
223+ => [OAuthScope]
224+ -> FilePath
225+ -> m Credentials
226+fromFilePath ss f = do
227+ p <- liftIO (doesFileExist f)
228+ unless p $
229+ throwM (MissingFileError f)
230+ bs <- liftIO (LBS.readFile f)
231+ either (throwM . InvalidFileError f . Text.pack) pure
232+ (fromJSONCredentials ss bs)
233+
234+fromJSONCredentials :: [OAuthScope]
235+ -> LBS.ByteString
236+ -> Either String Credentials
237+fromJSONCredentials ss bs = do
238+ v <- eitherDecode' bs
239+ let x = (`FromAccount` ss) <$> parseEither parseJSON v
240+ y = FromUser <$> parseEither parseJSON v
241+ case (x, y) of
242+ (Left xe, Left ye) -> Left $
243+ "Failed parsing service_account: " ++ xe ++
244+ ", Failed parsing authorized_user: " ++ ye
245+ _ -> x <|> y
246+
192exchange :: (MonadIO m, MonadCatch m)
247exchange :: (MonadIO m, MonadCatch m)
193 => Credentials
248 => Credentials
194 -> Logger
249 -> Logger
gogol/src/Network/Google/Auth/ApplicationDefaultCredentials.hs−51
@@ -109,57 +109,6 @@ authorizedUserToken u r = refreshRequest $
109 <> "&refresh_token=" <> toText (fromMaybe (_userRefresh u) r)
109 <> "&refresh_token=" <> toText (fromMaybe (_userRefresh u) r)
110 }
110 }
111
111
112−-- -- | Attempt to load either a @service_account@ or @authorized_user@ formatted
113−-- -- file to obtain the credentials neccessary to perform a token refresh.
114−-- --
115−-- -- The specified 'Scope's are used to authorize any @service_account@ that is
116−-- -- found with the appropriate scopes, otherwise they are not used. See the
117−-- -- top-level module of each individual @gogol-*@ library for a list of available
118−-- -- scopes, such as @Network.Google.Compute.computeScope@.
119−-- --
120−-- -- /See:/ 'cloudSDKConfigPath', 'defaultCredentialsPath'.
121−-- fromFile :: (MonadIO m, MonadCatch m) => [OAuthScope] -> m Credentials
122−-- fromFile ss = do
123−-- f <- defaultCredentialsPath
124−-- case f of
125−-- Just x -> fromFilePath ss x
126−-- Nothing -> do
127−-- x <- cloudSDKConfigPath
128−-- fromFilePath ss x
129−
130−-- -- | Attempt to load either a @service_account@ or @authorized_user@ formatted
131−-- -- file to obtain the credentials neccessary to perform a token refresh from
132−-- -- the specified file.
133−-- --
134−-- -- The specified 'Scope's are used to authorize any @service_account@ that is
135−-- -- found with the appropriate scopes, otherwise they are not used. See the
136−-- -- top-level module of each individual @gogol-*@ library for a list of available
137−-- -- scopes, such as @Network.Google.Compute.computeScope@.
138−-- fromFilePath :: (MonadIO m, MonadCatch m)
139−-- => [OAuthScope]
140−-- -> FilePath
141−-- -> m Credentials
142−-- fromFilePath ss f = do
143−-- p <- liftIO (doesFileExist f)
144−-- unless p $
145−-- throwM (MissingFileError f)
146−-- bs <- liftIO (LBS.readFile f)
147−-- either (throwM . InvalidFileError f . Text.pack) pure
148−-- (fromJSONCredentials ss bs)
149−
150−-- fromJSONCredentials :: [OAuthScope]
151−-- -> LBS.ByteString
152−-- -> Either String Credentials
153−-- fromJSONCredentials ss bs = do
154−-- v <- eitherDecode' bs
155−-- let x = (`FromAccount` ss) <$> parseEither parseJSON v
156−-- y = FromUser <$> parseEither parseJSON v
157−-- case (x, y) of
158−-- (Left xe, Left ye) -> Left $
159−-- "Failed parsing service_account: " ++ xe ++
160−-- ", Failed parsing authorized_user: " ++ ye
161−-- _ -> x <|> y
162−
163-- | Lookup the @GOOGLE_APPLICATION_CREDENTIALS@ environment variable for the
112-- | Lookup the @GOOGLE_APPLICATION_CREDENTIALS@ environment variable for the
164-- default application credentials filepath.
113-- default application credentials filepath.
165defaultCredentialsPath :: MonadIO m => m (Maybe FilePath)
114defaultCredentialsPath :: MonadIO m => m (Maybe FilePath)
gogol/src/Network/Google/Auth/ServiceAccount.hs+3−3
@@ -105,7 +105,7 @@ serviceAccountToken :: (MonadIO m, MonadCatch m)
105 -> Manager
105 -> Manager
106 -> m OAuthToken
106 -> m OAuthToken
107serviceAccountToken s ss l m = do
107serviceAccountToken s ss l m = do
108− b <- encodeJWTBearer s ss
108+ b <- encodeBearerJWT s ss
109 let rq = accountsRequest
109 let rq = accountsRequest
110 { Client.requestBody = RequestBodyBS $
110 { Client.requestBody = RequestBodyBS $
111 "grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer"
111 "grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer"
@@ -126,11 +126,11 @@ metadataToken s = refreshRequest $
126 <> "/token"
126 <> "/token"
127 }
127 }
128
128
129−encodeJWTBearer :: (MonadIO m, MonadThrow m)
129+encodeBearerJWT :: (MonadIO m, MonadThrow m)
130 => ServiceAccount
130 => ServiceAccount
131 -> [OAuthScope]
131 -> [OAuthScope]
132 -> m ByteString
132 -> m ByteString
133−encodeJWTBearer s ss = liftIO $ do
133+encodeBearerJWT s ss = liftIO $ do
134 i <- input . truncate <$> getPOSIXTime
134 i <- input . truncate <$> getPOSIXTime
135 r <- signSafer (Just SHA256) (_servicePrivateKey s) i
135 r <- signSafer (Just SHA256) (_servicePrivateKey s) i
136 either failure (pure . concat' i) r
136 either failure (pure . concat' i) r