fix: resolve circular imports (#1942) · googleapis/google-auth-library-python@25c1b06 · GitHub

This repository was archived by the owner on Mar 6, 2026. It is now read-only.

googleapis / google-auth-library-python Public archive

• Notifications You must be signed in to change notification settings
• Fork 351
• Star 882

• Code
• Issues
• Pull requests
• Actions
• Security and quality
• Insights

Additional navigation options

Commit 25c1b06

Browse filesBrowse the repository at this point in the historyBrowse files

daniel-sanche

authored

fix: resolve circular imports (#1942)

We have a couple circular imports in the library: - _mtls_helper and _agent_identity_utils both require each other - credentials and _default form a cycle This makes it difficult to import the library into google3 This PR resolved the import issues

1 parent e5a28b5 commit 25c1b06
Copy full SHA for 25c1b06

7 files changed

+45-42Lines changed: 45 additions & 42 deletions

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

• google/auth
  • _agent_identity_utils.py
  • credentials.py
  • transport
    • _mtls_helper.py
• tests
  • test_agent_identity_utils.py
  • transport
    • test__mtls_helper.py
    • test_requests.py
    • test_urllib3.py

Expand file treeCollapse file tree

Open diff view settings

Collapse file

‎google/auth/_agent_identity_utils.py‎

Copy file name to clipboardExpand all lines: google/auth/_agent_identity_utils.py

-9Lines changed: 0 additions & 9 deletions

Original file line number	Diff line number	Diff line change
@@ -24,7 +24,6 @@
24	24
25	25	from google.auth import environment_vars
26	26	from google.auth import exceptions
27		- from google.auth.transport import _mtls_helper
28	27
29	28
30	29	_LOGGER = logging.getLogger(__name__)
@@ -263,14 +262,6 @@ def should_request_bound_token(cert):
263	262	return is_agent_cert and is_opted_in
264	263
265	264
266		- def call_client_cert_callback():
267		- """Calls the client cert callback and returns the certificate and key."""
268		- _, cert_bytes, key_bytes, passphrase = _mtls_helper.get_client_ssl_credentials(
269		- generate_encrypted_key=True
270		- )
271		- return cert_bytes, key_bytes
272		-
273		-
274	265	def get_cached_cert_fingerprint(cached_cert):
275	266	"""Returns the fingerprint of the cached certificate."""
276	267	if cached_cert:

Collapse file

‎google/auth/credentials.py‎

Copy file name to clipboardExpand all lines: google/auth/credentials.py

+3-1Lines changed: 3 additions & 1 deletion

Original file line number	Diff line number	Diff line change
@@ -17,20 +17,22 @@
17	17
18	18	import abc
19	19	from enum import Enum
	20	+ import logging
20	21	import os
21	22	from typing import List
22	23
23	24	from google.auth import _helpers, environment_vars
24	25	from google.auth import exceptions
25	26	from google.auth import metrics
26	27	from google.auth._credentials_base import _BaseCredentials
27		- from google.auth._default import _LOGGER
28	28	from google.auth._refresh_worker import RefreshThreadManager
29	29
30	30	DEFAULT_UNIVERSE_DOMAIN = "googleapis.com"
31	31	NO_OP_TRUST_BOUNDARY_LOCATIONS: List[str] = []
32	32	NO_OP_TRUST_BOUNDARY_ENCODED_LOCATIONS = "0x0"
33	33
	34	+ _LOGGER = logging.getLogger("google.auth._default")
	35	+
34	36
35	37	class Credentials(_BaseCredentials):
36	38	"""Base class for all credentials.

Collapse file

‎google/auth/transport/_mtls_helper.py‎

Copy file name to clipboardExpand all lines: google/auth/transport/_mtls_helper.py

+9-1Lines changed: 9 additions & 1 deletion

Original file line number	Diff line number	Diff line change
@@ -489,7 +489,7 @@ def check_parameters_for_unauthorized_response(cached_cert):
489	489	str: The base64-encoded SHA256 cached fingerprint.
490	490	str: The base64-encoded SHA256 current cert fingerprint.
491	491	"""
492		- call_cert_bytes, call_key_bytes = _agent_identity_utils.call_client_cert_callback()
	492	+ call_cert_bytes, call_key_bytes = call_client_cert_callback()
493	493	cert_obj = _agent_identity_utils.parse_certificate(call_cert_bytes)
494	494	current_cert_fingerprint = _agent_identity_utils.calculate_certificate_fingerprint(
495	495	cert_obj
@@ -501,3 +501,11 @@ def check_parameters_for_unauthorized_response(cached_cert):
501	501	else:
502	502	cached_fingerprint = current_cert_fingerprint
503	503	return call_cert_bytes, call_key_bytes, cached_fingerprint, current_cert_fingerprint
	504	+
	505	+
	506	+ def call_client_cert_callback():
	507	+ """Calls the client cert callback and returns the certificate and key."""
	508	+ _, cert_bytes, key_bytes, passphrase = get_client_ssl_credentials(
	509	+ generate_encrypted_key=True
	510	+ )
	511	+ return cert_bytes, key_bytes

Collapse file

‎tests/test_agent_identity_utils.py‎

Copy file name to clipboardExpand all lines: tests/test_agent_identity_utils.py

-17Lines changed: 0 additions & 17 deletions

Original file line number	Diff line number	Diff line change
@@ -282,23 +282,6 @@ def test_get_agent_identity_certificate_path_fallback_to_well_known_path(
282	282	mock_sleep.assert_called_once()
283	283	assert mock_is_ready.call_count == 2
284	284
285		- @mock.patch("google.auth.transport._mtls_helper.get_client_ssl_credentials")
286		- def test_call_client_cert_callback(self, mock_get_client_ssl_credentials):
287		- mock_get_client_ssl_credentials.return_value = (
288		- True,
289		- b"cert_bytes",
290		- b"key_bytes",
291		- b"passphrase",
292		- )
293		-
294		- cert, key = _agent_identity_utils.call_client_cert_callback()
295		-
296		- assert cert == b"cert_bytes"
297		- assert key == b"key_bytes"
298		- mock_get_client_ssl_credentials.assert_called_once_with(
299		- generate_encrypted_key=True
300		- )
301		-
302	285	def test_get_cached_cert_fingerprint_no_cert(self):
303	286	with pytest.raises(ValueError, match="mTLS connection is not configured."):
304	287	_agent_identity_utils.get_cached_cert_fingerprint(None)

Collapse file

‎tests/transport/test__mtls_helper.py‎

Copy file name to clipboardExpand all lines: tests/transport/test__mtls_helper.py

+26-7Lines changed: 26 additions & 7 deletions

Original file line number	Diff line number	Diff line change
@@ -813,11 +813,12 @@ def test_no_env_vars_set(self):
813	813
814	814
815	815	class TestMtlsHelper:
	816	+ @mock.patch.object(_mtls_helper, "call_client_cert_callback")
816	817	@mock.patch("google.auth.transport._mtls_helper._agent_identity_utils")
817	818	def test_check_parameters_for_unauthorized_response_with_cached_cert(
818		- self, mock_agent_identity_utils
	819	+ self, mock_agent_identity_utils, mock_call_client_cert_callback
819	820	):
820		- mock_agent_identity_utils.call_client_cert_callback.return_value = (
	821	+ mock_call_client_cert_callback.return_value = (
821	822	CERT_MOCK_VAL,
822	823	KEY_MOCK_VAL,
823	824	)
@@ -841,16 +842,17 @@ def test_check_parameters_for_unauthorized_response_with_cached_cert(
841	842	assert key == KEY_MOCK_VAL
842	843	assert cached_fingerprint == "cached_fingerprint"
843	844	assert current_fingerprint == "current_fingerprint"
844		- mock_agent_identity_utils.call_client_cert_callback.assert_called_once()
	845	+ mock_call_client_cert_callback.assert_called_once()
845	846	mock_agent_identity_utils.get_cached_cert_fingerprint.assert_called_once_with(
846	847	b"cached_cert_bytes"
847	848	)
848	849
849		- @mock.patch("google.auth.transport._mtls_helper._agent_identity_utils")
	850	+ @mock.patch.object(_mtls_helper, "call_client_cert_callback")
	851	+ @mock.patch.object(_mtls_helper, "_agent_identity_utils")
850	852	def test_check_parameters_for_unauthorized_response_without_cached_cert(
851		- self, mock_agent_identity_utils
	853	+ self, mock_agent_identity_utils, mock_call_client_cert_callback
852	854	):
853		- mock_agent_identity_utils.call_client_cert_callback.return_value = (
	855	+ mock_call_client_cert_callback.return_value = (
854	856	CERT_MOCK_VAL,
855	857	KEY_MOCK_VAL,
856	858	)
@@ -869,5 +871,22 @@ def test_check_parameters_for_unauthorized_response_without_cached_cert(
869	871	assert key == KEY_MOCK_VAL
870	872	assert cached_fingerprint == "current_fingerprint"
871	873	assert current_fingerprint == "current_fingerprint"
872		- mock_agent_identity_utils.call_client_cert_callback.assert_called_once()
	874	+ mock_call_client_cert_callback.assert_called_once()
873	875	mock_agent_identity_utils.get_cached_cert_fingerprint.assert_not_called()
	876	+
	877	+ @mock.patch("google.auth.transport._mtls_helper.get_client_ssl_credentials")
	878	+ def test_call_client_cert_callback(self, mock_get_client_ssl_credentials):
	879	+ mock_get_client_ssl_credentials.return_value = (
	880	+ True,
	881	+ b"cert_bytes",
	882	+ b"key_bytes",
	883	+ b"passphrase",
	884	+ )
	885	+
	886	+ cert, key = _mtls_helper.call_client_cert_callback()
	887	+
	888	+ assert cert == b"cert_bytes"
	889	+ assert key == b"key_bytes"
	890	+ mock_get_client_ssl_credentials.assert_called_once_with(
	891	+ generate_encrypted_key=True
	892	+ )

Collapse file

‎tests/transport/test_requests.py‎

Copy file name to clipboardExpand all lines: tests/transport/test_requests.py

+4-4Lines changed: 4 additions & 4 deletions

Original file line number	Diff line number	Diff line change
@@ -566,7 +566,7 @@ def test_cert_rotation_when_cert_mismatch_and_mtls_enabled(self):
566	566
567	567	# Mock call_client_cert_callback to return the new certificate.
568	568	with mock.patch.object(
569		- google.auth.transport._mtls_helper._agent_identity_utils,
	569	+ google.auth.transport._mtls_helper,
570	570	"call_client_cert_callback",
571	571	return_value=(new_cert, new_key),
572	572	) as mock_callback:
@@ -605,7 +605,7 @@ def test_no_cert_rotation_when_cert_match_and_mTLS_enabled(self):
605	605
606	606	# Mock call_client_cert_callback to return the new certificate.
607	607	with mock.patch.object(
608		- google.auth.transport._mtls_helper._agent_identity_utils,
	608	+ google.auth.transport._mtls_helper,
609	609	"call_client_cert_callback",
610	610	return_value=(new_cert, new_key),
611	611	):
@@ -638,7 +638,7 @@ def test_no_cert_match_check_when_mtls_disabled(self):
638	638
639	639	# Mock call_client_cert_callback to return the new certificate.
640	640	with mock.patch.object(
641		- google.auth.transport._mtls_helper._agent_identity_utils,
	641	+ google.auth.transport._mtls_helper,
642	642	"call_client_cert_callback",
643	643	return_value=(new_cert, new_key),
644	644	) as mock_callback:
@@ -688,7 +688,7 @@ def test_cert_rotation_failure_raises_error(self):
688	688	authed_session._is_mtls = True
689	689
690	690	with mock.patch.object(
691		- google.auth.transport._mtls_helper._agent_identity_utils,
	691	+ google.auth.transport._mtls_helper,
692	692	"call_client_cert_callback",
693	693	return_value=(new_cert, new_key),
694	694	):

Collapse file

‎tests/transport/test_urllib3.py‎

Copy file name to clipboardExpand all lines: tests/transport/test_urllib3.py

+3-3Lines changed: 3 additions & 3 deletions

Original file line number	Diff line number	Diff line change
@@ -343,7 +343,7 @@ def test_cert_rotation_when_cert_mismatch_and_mtls_endpoint_used(self):
343	343	authed_http._is_mtls = True
344	344	# Mock call_client_cert_callback to return the new certificate.
345	345	with mock.patch.object(
346		- google.auth._agent_identity_utils,
	346	+ google.auth.transport._mtls_helper,
347	347	"call_client_cert_callback",
348	348	return_value=(new_cert, new_key),
349	349	) as mock_callback:
@@ -378,7 +378,7 @@ def test_no_cert_rotation_when_cert_match_and_mtls_endpoint_used(self):
378	378	authed_http._is_mtls = True
379	379	# Mock call_client_cert_callback to return the certificate.
380	380	with mock.patch.object(
381		- google.auth._agent_identity_utils,
	381	+ google.auth.transport._mtls_helper,
382	382	"call_client_cert_callback",
383	383	return_value=(new_cert, new_key),
384	384	):
@@ -408,7 +408,7 @@ def test_no_cert_match_check_when_mtls_endpoint_not_used(self):
408	408
409	409	# Mock call_client_cert_callback to return the certificate.
410	410	with mock.patch.object(
411		- google.auth._agent_identity_utils,
	411	+ google.auth.transport._mtls_helper,
412	412	"call_client_cert_callback",
413	413	return_value=(new_cert, new_key),
414	414	) as mock_callback:

0 commit comments

Comments

0 (0)