<commit_before>#!/usr/bin/env python
"""Common credentials classes and constructors."""
from __future__ import print_function

import datetime
import json
import os
import threading

import httplib2
import oauth2client
import oauth2client.client
import oauth2client.gce
import oauth2client.locked_file
import oauth2client.multistore_file
import oauth2client.service_account
from oauth2client import tools  # for gflags declarations
from six.moves import http_client
from six.moves import urllib

from apitools.base.py import exceptions
from apitools.base.py import util

try:
    import gflags
    FLAGS = gflags.FLAGS
except ImportError:
    FLAGS = None


__all__ = [
    'CredentialsFromFile',
    'GaeAssertionCredentials',
    'GceAssertionCredentials',
    'GetCredentials',
    'GetUserinfo',
    'ServiceAccountCredentials',
    'ServiceAccountCredentialsFromFile',
]


# Lock when accessing the cache file to avoid resource contention.
cache_file_lock = threading.Lock()


def SetCredentialsCacheFileLock(lock):
    global cache_file_lock  # pylint: disable=global-statement
    cache_file_lock = lock


# TODO(craigcitro): Expose the extra args here somewhere higher up,
# possibly as flags in the generated CLI.
def GetCredentials(package_name, scopes, client_id, client_secret, user_agent,
                   credentials_filename=None,
                   service_account_name=None, service_account_keyfile=None,
                   service_account_json_keyfile=None,
                   api_key=None,  # pylint: disable=unused-argument
                   client=None,  # pylint: disable=unused-argument
                   oauth2client_args=None):
    """Attempt to get credentials, using an oauth dance as the last resort."""
    scopes = util.NormalizeScopes(scopes)
    if ((service_account_name and not service_account_keyfile) or
            (service_account_keyfile and not service_account_name)):
        raise exceptions.CredentialsError(
            'Service account name or keyfile provided without the other')
    # TODO(craigcitro): Error checking.
    client_info = {
        'client_id': client_id,
        'client_secret': client_secret,
        'scope': ' '.join(sorted(util.NormalizeScopes(scopes))),
        'user_agent': user_agent or '%s-generated/0.1' % package_name,
    }
    service_account_kwargs = {
        'user_agent': client_info['user_agent'],
    }
    if service_account_json_keyfile:
        with open(service_account_json_keyfile) as keyfile:
            service_account_info = json.load(keyfile)
        account_type = service_account_info.get('type')
        if account_type != oauth2client.client.SERVICE_ACCOUNT:
            raise exceptions.CredentialsError(
                'Invalid service account credentials: %s' % (
                    service_account_json_keyfile,))
        # pylint: disable=protected-access
        credentials = oauth2client.service_account._ServiceAccountCredentials(
            service_account_id=service_account_info['client_id'],
            service_account_email=service_account_info['client_email'],
            private_key_id=service_account_info['private_key_id'],
            private_key_pkcs8_text=service_account_info['private_key'],
            scopes=scopes,
            **service_account_kwargs)
        # pylint: enable=protected-access
        return credentials
    if service_account_name is not None:
        credentials = ServiceAccountCredentialsFromFile(
            service_account_name, service_account_keyfile, scopes,
            service_account_kwargs=service_account_kwargs)
        if credentials is not None:
            return credentials
    credentials = GaeAssertionCredentials.Get(scopes)
    if credentials is not None:
        return credentials
    credentials = GceAssertionCredentials.Get(scopes)
    if credentials is not None:
        return credentials
    credentials_filename = credentials_filename or os.path.expanduser(
        '~/.apitools.token')
    credentials = CredentialsFromFile(credentials_filename, client_info,
                                      oauth2client_args=oauth2client_args)
    if credentials is not None:
        return credentials
    raise exceptions.CredentialsError('Could not create valid credentials')


def ServiceAccountCredentialsFromFile(
        service_account_name, private_key_filename, scopes,
        service_account_kwargs=None):
    with open(private_key_filename) as key_file:
        return ServiceAccountCredentials(
            service_account_name, key_file.read(), scopes,
            service_account_kwargs=service_account_kwargs)


def ServiceAccountCredentials(service_account_name, private_key, scopes,
                              service_account_kwargs=None):
    service_account_kwargs = service_account_kwargs or {}
    scopes = util.NormalizeScopes(scopes)
    return oauth2client.client.SignedJwtAssertionCredentials(
        service_account_name, private_key, scopes, **service_account_kwargs)
<commit_msg>Use the Application Default Credential if available.<commit_after>#!/usr/bin/env python
"""Common credentials classes and constructors."""
from __future__ import print_function

import datetime
import json
import os
import threading

import httplib2
import oauth2client
import oauth2client.client
import oauth2client.gce
import oauth2client.locked_file
import oauth2client.multistore_file
import oauth2client.service_account
from oauth2client import tools  # for gflags declarations
from six.moves import http_client
from six.moves import urllib

from apitools.base.py import exceptions
from apitools.base.py import util

try:
    import gflags
    FLAGS = gflags.FLAGS
except ImportError:
    FLAGS = None


__all__ = [
    'CredentialsFromFile',
    'GaeAssertionCredentials',
    'GceAssertionCredentials',
    'GetCredentials',
    'GetUserinfo',
    'ServiceAccountCredentials',
    'ServiceAccountCredentialsFromFile',
]


# Lock when accessing the cache file to avoid resource contention.
cache_file_lock = threading.Lock()


def SetCredentialsCacheFileLock(lock):
    global cache_file_lock  # pylint: disable=global-statement
    cache_file_lock = lock


# TODO(craigcitro): Expose the extra args here somewhere higher up,
# possibly as flags in the generated CLI.
def GetCredentials(package_name, scopes, client_id, client_secret, user_agent,
                   credentials_filename=None,
                   service_account_name=None, service_account_keyfile=None,
                   service_account_json_keyfile=None,
                   skip_application_default_credentials=False,
                   api_key=None,  # pylint: disable=unused-argument
                   client=None,  # pylint: disable=unused-argument
                   oauth2client_args=None):
    """Attempt to get credentials, using an oauth dance as the last resort."""
    scopes = util.NormalizeScopes(scopes)
    if ((service_account_name and not service_account_keyfile) or
            (service_account_keyfile and not service_account_name)):
        raise exceptions.CredentialsError(
            'Service account name or keyfile provided without the other')
    # TODO(craigcitro): Error checking.
    client_info = {
        'client_id': client_id,
        'client_secret': client_secret,
        'scope': ' '.join(sorted(util.NormalizeScopes(scopes))),
        'user_agent': user_agent or '%s-generated/0.1' % package_name,
    }
    service_account_kwargs = {
        'user_agent': client_info['user_agent'],
    }
    if service_account_json_keyfile:
        with open(service_account_json_keyfile) as keyfile:
            service_account_info = json.load(keyfile)
        account_type = service_account_info.get('type')
        if account_type != oauth2client.client.SERVICE_ACCOUNT:
            raise exceptions.CredentialsError(
                'Invalid service account credentials: %s' % (
                    service_account_json_keyfile,))
        # pylint: disable=protected-access
        credentials = oauth2client.service_account._ServiceAccountCredentials(
            service_account_id=service_account_info['client_id'],
            service_account_email=service_account_info['client_email'],
            private_key_id=service_account_info['private_key_id'],
            private_key_pkcs8_text=service_account_info['private_key'],
            scopes=scopes,
            **service_account_kwargs)
        # pylint: enable=protected-access
        return credentials
    if service_account_name is not None:
        credentials = ServiceAccountCredentialsFromFile(
            service_account_name, service_account_keyfile, scopes,
            service_account_kwargs=service_account_kwargs)
        if credentials is not None:
            return credentials
    credentials = GaeAssertionCredentials.Get(scopes)
    if credentials is not None:
        return credentials
    credentials = GceAssertionCredentials.Get(scopes)
    if credentials is not None:
        return credentials
    if not skip_application_default_credentials:
        credentials = _GetApplicationDefaultCredentials(scopes)
        if credentials is not None:
            return credentials
    credentials_filename = credentials_filename or os.path.expanduser(
        '~/.apitools.token')
    credentials = CredentialsFromFile(credentials_filename, client_info,
                                      oauth2client_args=oauth2client_args)
    if credentials is not None:
        return credentials
    raise exceptions.CredentialsError('Could not create valid credentials')


def ServiceAccountCredentialsFromFile(
        service_account_name, private_key_filename, scopes,
        service_account_kwargs=None):
    with open(private_key_filename) as key_file:
        return ServiceAccountCredentials(
            service_account_name, key_file.read(), scopes,
            service_account_kwargs=service_account_kwargs)


def ServiceAccountCredentials(service_account_name, private_key, scopes,
                              service_account_kwargs=None):
    service_account_kwargs = service_account_kwargs or {}
    scopes = util.NormalizeScopes(scopes)
    return oauth2client.client.SignedJwtAssertionCredentials(
        service_account_name, private_key, scopes, **service_account_kwargs)


def _GetApplicationDefaultCredentials(scopes):
    gc = oauth2client.client.GoogleCredentials
    with cache_file_lock:
        try:
            # pylint: disable=protected-access
            # We've already done our own check for GAE/GCE
            # credentials, we don't want to pay for checking again.
            credentials = gc._implicit_credentials_from_files()
        except oauth2client.client.ApplicationDefaultCredentialsError:
            return None
    # If we got back a non-service-account credential, we need to use
    # a heuristic to decide whether or not the application default
    # credential will work for us. We assume that if we're requesting
    # cloud-platform, our scopes are a subset of cloud scopes, and the
    # ADC will work.
    cp = 'https://www.googleapis.com/auth/cloud-platform'
    if not isinstance(credentials, gc) or cp in scopes:
        return credentials
    return None

{'fraction_non_alphanumeric': 0.06589771101573677, 'fraction_numerical': 0.003218884120171674, 'mean_word_length': 3.3185328185328187, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 1, 'lorem ipsum': 0, 'www.': 1, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3849823', 'n_tokens_mistral': 3022, 'n_tokens_neox': 3008, 'n_words': 719}