@@ -262,6 +262,73 @@ def parse_common_location_path(path: str) -> Dict[str, str]:
262
262
m = re .match (r"^projects/(?P<project>.+?)/locations/(?P<location>.+?)$" , path )
263
263
return m .groupdict () if m else {}
264
264
265
+ @classmethod
266
+ def get_mtls_endpoint_and_cert_source (
267
+ cls , client_options : Optional [client_options_lib .ClientOptions ] = None
268
+ ):
269
+ """Return the API endpoint and client cert source for mutual TLS.
270
+
271
+ The client cert source is determined in the following order:
272
+ (1) if `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is not "true", the
273
+ client cert source is None.
274
+ (2) if `client_options.client_cert_source` is provided, use the provided one; if the
275
+ default client cert source exists, use the default one; otherwise the client cert
276
+ source is None.
277
+
278
+ The API endpoint is determined in the following order:
279
+ (1) if `client_options.api_endpoint` if provided, use the provided one.
280
+ (2) if `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is "always", use the
281
+ default mTLS endpoint; if the environment variabel is "never", use the default API
282
+ endpoint; otherwise if client cert source exists, use the default mTLS endpoint, otherwise
283
+ use the default API endpoint.
284
+
285
+ More details can be found at https://google.aip.dev/auth/4114.
286
+
287
+ Args:
288
+ client_options (google.api_core.client_options.ClientOptions): Custom options for the
289
+ client. Only the `api_endpoint` and `client_cert_source` properties may be used
290
+ in this method.
291
+
292
+ Returns:
293
+ Tuple[str, Callable[[], Tuple[bytes, bytes]]]: returns the API endpoint and the
294
+ client cert source to use.
295
+
296
+ Raises:
297
+ google.auth.exceptions.MutualTLSChannelError: If any errors happen.
298
+ """
299
+ if client_options is None :
300
+ client_options = client_options_lib .ClientOptions ()
301
+ use_client_cert = os .getenv ("GOOGLE_API_USE_CLIENT_CERTIFICATE" , "false" )
302
+ use_mtls_endpoint = os .getenv ("GOOGLE_API_USE_MTLS_ENDPOINT" , "auto" )
303
+ if use_client_cert not in ("true" , "false" ):
304
+ raise ValueError (
305
+ "Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`"
306
+ )
307
+ if use_mtls_endpoint not in ("auto" , "never" , "always" ):
308
+ raise MutualTLSChannelError (
309
+ "Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`"
310
+ )
311
+
312
+ # Figure out the client cert source to use.
313
+ client_cert_source = None
314
+ if use_client_cert == "true" :
315
+ if client_options .client_cert_source :
316
+ client_cert_source = client_options .client_cert_source
317
+ elif mtls .has_default_client_cert_source ():
318
+ client_cert_source = mtls .default_client_cert_source ()
319
+
320
+ # Figure out which api endpoint to use.
321
+ if client_options .api_endpoint is not None :
322
+ api_endpoint = client_options .api_endpoint
323
+ elif use_mtls_endpoint == "always" or (
324
+ use_mtls_endpoint == "auto" and client_cert_source
325
+ ):
326
+ api_endpoint = cls .DEFAULT_MTLS_ENDPOINT
327
+ else :
328
+ api_endpoint = cls .DEFAULT_ENDPOINT
329
+
330
+ return api_endpoint , client_cert_source
331
+
265
332
def __init__ (
266
333
self ,
267
334
* ,
@@ -312,57 +379,22 @@ def __init__(
312
379
if client_options is None :
313
380
client_options = client_options_lib .ClientOptions ()
314
381
315
- # Create SSL credentials for mutual TLS if needed.
316
- if os .getenv ("GOOGLE_API_USE_CLIENT_CERTIFICATE" , "false" ) not in (
317
- "true" ,
318
- "false" ,
319
- ):
320
- raise ValueError (
321
- "Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`"
322
- )
323
- use_client_cert = (
324
- os .getenv ("GOOGLE_API_USE_CLIENT_CERTIFICATE" , "false" ) == "true"
382
+ api_endpoint , client_cert_source_func = self .get_mtls_endpoint_and_cert_source (
383
+ client_options
325
384
)
326
385
327
- client_cert_source_func = None
328
- is_mtls = False
329
- if use_client_cert :
330
- if client_options .client_cert_source :
331
- is_mtls = True
332
- client_cert_source_func = client_options .client_cert_source
333
- else :
334
- is_mtls = mtls .has_default_client_cert_source ()
335
- if is_mtls :
336
- client_cert_source_func = mtls .default_client_cert_source ()
337
- else :
338
- client_cert_source_func = None
339
-
340
- # Figure out which api endpoint to use.
341
- if client_options .api_endpoint is not None :
342
- api_endpoint = client_options .api_endpoint
343
- else :
344
- use_mtls_env = os .getenv ("GOOGLE_API_USE_MTLS_ENDPOINT" , "auto" )
345
- if use_mtls_env == "never" :
346
- api_endpoint = self .DEFAULT_ENDPOINT
347
- elif use_mtls_env == "always" :
348
- api_endpoint = self .DEFAULT_MTLS_ENDPOINT
349
- elif use_mtls_env == "auto" :
350
- if is_mtls :
351
- api_endpoint = self .DEFAULT_MTLS_ENDPOINT
352
- else :
353
- api_endpoint = self .DEFAULT_ENDPOINT
354
- else :
355
- raise MutualTLSChannelError (
356
- "Unsupported GOOGLE_API_USE_MTLS_ENDPOINT value. Accepted "
357
- "values: never, auto, always"
358
- )
386
+ api_key_value = getattr (client_options , "api_key" , None )
387
+ if api_key_value and credentials :
388
+ raise ValueError (
389
+ "client_options.api_key and credentials are mutually exclusive"
390
+ )
359
391
360
392
# Save or instantiate the transport.
361
393
# Ordinarily, we provide the transport, but allowing a custom transport
362
394
# instance provides an extensibility point for unusual situations.
363
395
if isinstance (transport , TranscoderServiceTransport ):
364
396
# transport is a TranscoderServiceTransport instance.
365
- if credentials or client_options .credentials_file :
397
+ if credentials or client_options .credentials_file or api_key_value :
366
398
raise ValueError (
367
399
"When providing a transport instance, "
368
400
"provide its credentials directly."
@@ -374,6 +406,15 @@ def __init__(
374
406
)
375
407
self ._transport = transport
376
408
else :
409
+ import google .auth ._default # type: ignore
410
+
411
+ if api_key_value and hasattr (
412
+ google .auth ._default , "get_api_key_credentials"
413
+ ):
414
+ credentials = google .auth ._default .get_api_key_credentials (
415
+ api_key_value
416
+ )
417
+
377
418
Transport = type (self ).get_transport_class (transport )
378
419
self ._transport = Transport (
379
420
credentials = credentials ,
0 commit comments