This repository was archived by the owner on Mar 6, 2026. It is now read-only.
Commit b0993c7
fix(auth): Delegate workload cert and key default lookup to helper function (#1877)
get_client_ssl_credentials had a bug that defaulted the cert path to
CERTIFICATE_CONFIGURATION_DEFAULT_PATH if not explicitly specified. The
correct behavior should be to delegate the lookup logic to
"_get_workload_cert_and_key" which also takes into account the cert
config path set by the env var GOOGLE_API_CERTIFICATE_CONFIG.
---------
Co-authored-by: Daniel Sanche <d.sanche14@gmail.com>1 parent 2c374d3 commit b0993c7
2 files changed
Lines changed: 17 additions & 9 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -279,7 +279,7 @@ def _run_cert_provider_command(command, expect_encrypted_key=False): | |||
| 279 | 279 | def get_client_ssl_credentials( | |
| 280 | 280 | generate_encrypted_key=False, | |
| 281 | 281 | context_aware_metadata_path=CONTEXT_AWARE_METADATA_PATH, | |
| 282 | - certificate_config_path=CERTIFICATE_CONFIGURATION_DEFAULT_PATH, | ||
| 282 | + certificate_config_path=None, | ||
| 283 | 283 | ): | |
| 284 | 284 | """Returns the client side certificate, private key and passphrase. | |
| 285 | 285 | ||
@@ -306,13 +306,10 @@ def get_client_ssl_credentials( | |||
| 306 | 306 | the cert, key and passphrase. | |
| 307 | 307 | """ | |
| 308 | 308 | ||
| 309 | - # 1. Check for certificate config json. | ||
| 310 | - cert_config_path = _check_config_path(certificate_config_path) | ||
| 311 | - if cert_config_path: | ||
| 312 | - # Attempt to retrieve X.509 Workload cert and key. | ||
| 313 | - cert, key = _get_workload_cert_and_key(cert_config_path) | ||
| 314 | - if cert and key: | ||
| 315 | - return True, cert, key, None | ||
| 309 | + # 1. Attempt to retrieve X.509 Workload cert and key. | ||
| 310 | + cert, key = _get_workload_cert_and_key(certificate_config_path) | ||
| 311 | + if cert and key: | ||
| 312 | + return True, cert, key, None | ||
| 316 | 313 | ||
| 317 | 314 | # 2. Check for context aware metadata json | |
| 318 | 315 | metadata_path = _check_config_path(context_aware_metadata_path) | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -334,9 +334,15 @@ def test_success_with_certificate_config( | |||
| 334 | 334 | assert key == pytest.private_key_bytes | |
| 335 | 335 | assert passphrase is None | |
| 336 | 336 | ||
| 337 | + @mock.patch( | ||
| 338 | + "google.auth.transport._mtls_helper._get_workload_cert_and_key", autospec=True | ||
| 339 | + ) | ||
| 337 | 340 | @mock.patch("google.auth.transport._mtls_helper._check_config_path", autospec=True) | |
| 338 | - def test_success_without_metadata(self, mock_check_config_path): | ||
| 341 | + def test_success_without_metadata( | ||
| 342 | + self, mock_check_config_path, mock_get_workload_cert_and_key | ||
| 343 | + ): | ||
| 339 | 344 | mock_check_config_path.return_value = False | |
| 345 | + mock_get_workload_cert_and_key.return_value = (None, None) | ||
| 340 | 346 | has_cert, cert, key, passphrase = _mtls_helper.get_client_ssl_credentials() | |
| 341 | 347 | assert not has_cert | |
| 342 | 348 | assert cert is None | |
@@ -395,12 +401,17 @@ def test_missing_cert_command( | |||
| 395 | 401 | ) | |
| 396 | 402 | @mock.patch("google.auth.transport._mtls_helper._load_json_file", autospec=True) | |
| 397 | 403 | @mock.patch("google.auth.transport._mtls_helper._check_config_path", autospec=True) | |
| 404 | + @mock.patch( | ||
| 405 | + "google.auth.transport._mtls_helper._get_workload_cert_and_key", autospec=True | ||
| 406 | + ) | ||
| 398 | 407 | def test_customize_context_aware_metadata_path( | |
| 399 | 408 | self, | |
| 409 | + mock_get_workload_cert_and_key, | ||
| 400 | 410 | mock_check_config_path, | |
| 401 | 411 | mock_load_json_file, | |
| 402 | 412 | mock_run_cert_provider_command, | |
| 403 | 413 | ): | |
| 414 | + mock_get_workload_cert_and_key.return_value = (None, None) | ||
| 404 | 415 | context_aware_metadata_path = "/path/to/metata/data" | |
| 405 | 416 | mock_check_config_path.return_value = context_aware_metadata_path | |
| 406 | 417 | mock_load_json_file.return_value = {"cert_provider_command": ["command"]} | |
0 commit comments