Skip to content

Reuse explicit credentials when creating 'database.spanner_api'. - #3722

Merged
tseaver merged 3 commits into
masterfrom
3718-spanner-propagate-client-creds-to-db
Aug 7, 2017
Merged

Reuse explicit credentials when creating 'database.spanner_api'.#3722
tseaver merged 3 commits into
masterfrom
3718-spanner-propagate-client-creds-to-db

Conversation

@tseaver

@tseavertseaver commented Aug 3, 2017

Copy link
Copy Markdown
Contributor
  • Preserves "custom" credentials (existing code worked only with implicit credentials from the environment).
  • Add tests ensuring scopes are set for correctly for all GAX apis (client uses admin scope, which do not grant data access, while database uses data scope, which does not grant admin access).

Closes#3718.

@tseavertseaver added api: spanner Issues related to the Spanner API. auth labels Aug 3, 2017
@googlebotgooglebot added the cla: yes This human has signed the Contributor License Agreement. label Aug 3, 2017
theacodes
theacodes reviewed Aug 3, 2017
View reviewed changes
Comment threadspanner/google/cloud/spanner/database.py Outdated
"""Helper for session-related API calls."""
if self._spanner_api is None:
base_creds = self._instance._client.credentials
scoped = base_creds.with_scopes((SPANNER_DATA_SCOPE,))

This comment was marked as spam.

Sign in to view

This comment was marked as spam.

Sign in to view

This comment was marked as spam.

Sign in to view

@tseaver
Reuse explicit credentials when creating 'database.spanner_api'.
de8e18c
- Preserves "custom" credentials (existing code worked only with
implicit credentials from the environment).
- Add tests ensuring scopes are set for correctly for all GAX apis
(client uses admin scope, which do not grant data access, while
database uses data scope, which does not grant admin access).
Closes#3718.
@tseaver
tseaverforce-pushed the 3718-spanner-propagate-client-creds-to-db branch from 65013ad to de8e18cCompareAugust 3, 2017 17:24
@theacodes

theacodes commented Aug 4, 2017

Copy link
Copy Markdown
Contributor

Github buried my comment, re-posting:

checked, and not in this case. the base client would've already scoped the credentials and requires_scopes will return false

with_scopes_if_required won't work for this case.

@tseaver

tseaver commented Aug 7, 2017

Copy link
Copy Markdown
ContributorAuthor

@jonparrott Who actually implements with_scopes? I can't find a non-raising concrete implementation except in google.auth.app_engine.

@theacodes

theacodes commented Aug 7, 2017

Copy link
Copy Markdown
Contributor

@tseaverhttp://google-auth.readthedocs.io/en/latest/_modules/google/oauth2/service_account.html#Credentials.with_scopes

@tseaver
Handle scope replacement correctly.
cf5b2df
'google.auth.credentials.with_scopes_if_required' doesn't replace scopes,
but only adds them if missing.
Addresses:
#3722 (comment).
@tseaver

tseaver commented Aug 7, 2017

Copy link
Copy Markdown
ContributorAuthor

@jonparrott See cf5b2df

@tseaver
tseaver merged commit 45ee4bd into masterAug 7, 2017
@tseaver
tseaver deleted the 3718-spanner-propagate-client-creds-to-db branch August 7, 2017 22:00
landrito pushed a commit to landrito/google-cloud-python that referenced this pull request Aug 21, 2017
@tseaver@landrito
Reuse explicit credentials when creating 'database.spanner_api'. (goo…
f5b7c79
…gleapis#3722)
- Preserves "custom" credentials (existing code worked only with
implicit credentials from the environment).
- Add tests ensuring scopes are set for correctly for all GAX apis
(client uses admin scope, which do not grant data access, while
database uses data scope, which does not grant admin access).
landrito pushed a commit to landrito/google-cloud-python that referenced this pull request Aug 22, 2017
@tseaver@landrito
Reuse explicit credentials when creating 'database.spanner_api'. (goo…
098eb5f
…gleapis#3722)
- Preserves "custom" credentials (existing code worked only with
implicit credentials from the environment).
- Add tests ensuring scopes are set for correctly for all GAX apis
(client uses admin scope, which do not grant data access, while
database uses data scope, which does not grant admin access).
landrito pushed a commit to landrito/google-cloud-python that referenced this pull request Aug 22, 2017
@tseaver@landrito
Reuse explicit credentials when creating 'database.spanner_api'. (goo…
a0a8ec5
…gleapis#3722)
- Preserves "custom" credentials (existing code worked only with
implicit credentials from the environment).
- Add tests ensuring scopes are set for correctly for all GAX apis
(client uses admin scope, which do not grant data access, while
database uses data scope, which does not grant admin access).
@dhermesdhermes mentioned this pull request Aug 24, 2017
Merged
parthea pushed a commit that referenced this pull request Mar 9, 2026
@tseaver
Reuse explicit credentials when creating 'database.spanner_api'. (#3722)
01892d7
- Preserves "custom" credentials (existing code worked only with
implicit credentials from the environment).
- Add tests ensuring scopes are set for correctly for all GAX apis
(client uses admin scope, which do not grant data access, while
database uses data scope, which does not grant admin access).
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dhermesdhermesAwaiting requested review from dhermes
1 more reviewer
@theacodestheacodestheacodes approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

api: spannerIssues related to the Spanner API.authcla: yesThis human has signed the Contributor License Agreement.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@tseaver@theacodes@googlebot