X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/286a7152f2984ca4704b4174a4c6cadca793c28e..ee6f8ae6f983f2beb1afa94f9332f9e244fbbb9d:/lib/google/api_client.rb diff --git a/lib/google/api_client.rb b/lib/google/api_client.rb index 07f3a13ab8..4c9ee03c7a 100644 --- a/lib/google/api_client.rb +++ b/lib/google/api_client.rb @@ -13,20 +13,32 @@ # limitations under the License. -require 'httpadapter' -require 'json' +require 'faraday' +require 'faraday/utils' +require 'multi_json' +require 'compat/multi_json' require 'stringio' +require 'google/api_client/version' +require 'google/api_client/logging' require 'google/api_client/errors' +require 'google/api_client/environment' require 'google/api_client/discovery' +require 'google/api_client/request' +require 'google/api_client/reference' +require 'google/api_client/result' +require 'google/api_client/media' +require 'google/api_client/service_account' +require 'google/api_client/batch' +require 'google/api_client/railtie' if defined?(Rails) module Google - # TODO(bobaman): Document all this stuff. - ## # This class manages APIs communication. class APIClient + include Google::APIClient::Logging + ## # Creates a new Google API client. # @@ -40,80 +52,65 @@ module Google #
  • :oauth_1
    • #
  • :oauth_2
    • # - # @option options [String] :host ("www.googleapis.com") - # The API hostname used by the client. This rarely needs to be changed. - # @option options [String] :user_agent ("google-api-ruby-client/{version}") + # @option options [Boolean] :auto_refresh_token (true) + # The setting that controls whether or not the api client attempts to + # refresh authorization when a 401 is hit in #execute. If the token does + # not support it, this option is ignored. + # @option options [String] :application_name + # The name of the application using the client. + # @option options [String] :application_version + # The version number of the application using the client. + # @option options [String] :user_agent + # ("{app_name} google-api-ruby-client/{version} {os_name}/{os_version}") # The user agent used by the client. Most developers will want to - # leave this value alone — the API key is the primary mechanism used to - # identify an application. + # leave this value alone and use the `:application_name` option instead. + # @option options [String] :host ("www.googleapis.com") + # The API hostname used by the client. This rarely needs to be changed. + # @option options [String] :port (443) + # The port number used by the client. This rarely needs to be changed. + # @option options [String] :discovery_path ("/discovery/v1") + # The discovery base path. This rarely needs to be changed. def initialize(options={}) + logger.debug { "#{self.class} - Initializing client with options #{options}" } + # Normalize key to String to allow indifferent access. options = options.inject({}) do |accu, (key, value)| - accu[key.to_s] = value + accu[key.to_sym] = value accu end # Almost all API usage will have a host of 'www.googleapis.com'. - self.host = options["host"] || 'www.googleapis.com' - # Most developers will want to leave this value alone. - self.user_agent = options["user_agent"] || ( - 'google-api-ruby-client/' + Google::APIClient::VERSION::STRING - ) - # This is mostly a default for the sake of convenience. - # Unlike most other options, this one may be nil, so we check for - # the presence of the key rather than checking the value. - if options.has_key?("parser") - self.parser = options["parser"] + self.host = options[:host] || 'www.googleapis.com' + self.port = options[:port] || 443 + self.discovery_path = options[:discovery_path] || '/discovery/v1' + + # Most developers will want to leave this value alone and use the + # application_name option. + if options[:application_name] + app_name = options[:application_name] + app_version = options[:application_version] + application_string = "#{app_name}/#{app_version || '0.0.0'}" else - require 'google/api_client/parsers/json_parser' - # NOTE: Do not rely on this default value, as it may change - self.parser = Google::APIClient::JSONParser + logger.warn { "#{self.class} - Please provide :application_name and :application_version when initializing the client" } end + self.user_agent = options[:user_agent] || ( + "#{application_string} " + + "google-api-ruby-client/#{Google::APIClient::VERSION::STRING} " + + ENV::OS_VERSION + ).strip # The writer method understands a few Symbols and will generate useful # default authentication mechanisms. - self.authorization = options["authorization"] || :oauth_2 - # The HTTP adapter controls all of the HTTP traffic the client generates. - # By default, Net::HTTP is used, but adding support for other clients - # is trivial. - if options["http_adapter"] - self.http_adapter = options["http_adapter"] - else - require 'httpadapter/adapters/net_http' - # NOTE: Do not rely on this default value, as it may change - self.http_adapter = HTTPAdapter::NetHTTPAdapter.new - end + self.authorization = + options.key?(:authorization) ? options[:authorization] : :oauth_2 + self.auto_refresh_token = options.fetch(:auto_refresh_token) { true } + self.key = options[:key] + self.user_ip = options[:user_ip] @discovery_uris = {} @discovery_documents = {} @discovered_apis = {} + return self end - - ## - # Returns the parser used by the client. - # - # @return [#serialize, #parse] - # The parser used by the client. Any object that implements both a - # #serialize and a #parse method may be used. - # If nil, no parsing will be done. - attr_reader :parser - - ## - # Sets the parser used by the client. - # - # @param [#serialize, #parse] new_parser - # The parser used by the client. Any object that implements both a - # #serialize and a #parse method may be used. - # If nil, no parsing will be done. - def parser=(new_parser) - if new_parser && - !new_parser.respond_to?(:serialize) && - !new_parser.respond_to?(:parse) - raise TypeError, - 'Expected parser object to respond to #serialize and #parse.' - end - @parser = new_parser - end - ## # Returns the authorization mechanism used by the client. # @@ -171,33 +168,23 @@ module Google end ## - # Returns the HTTP adapter used by the client. + # The setting that controls whether or not the api client attempts to + # refresh authorization when a 401 is hit in #execute. # - # @return [HTTPAdapter] - # The HTTP adapter object. The object must include the - # HTTPAdapter module and conform to its interface. - attr_reader :http_adapter + # @return [Boolean] + attr_accessor :auto_refresh_token ## - # Returns the HTTP adapter used by the client. - # - # @return [HTTPAdapter] - # The HTTP adapter object. The object must include the - # HTTPAdapter module and conform to its interface. - def http_adapter=(new_http_adapter) - if new_http_adapter.kind_of?(HTTPAdapter) - @http_adapter = new_http_adapter - else - raise TypeError, "Expected HTTPAdapter, got #{new_http_adapter.class}." - end - end + # The application's API key issued by the API console. + # + # @return [String] The API key. + attr_accessor :key ## - # The API hostname used by the client. + # The IP address of the user this request is being performed on behalf of. # - # @return [String] - # The API hostname. Should almost always be 'www.googleapis.com'. - attr_accessor :host + # @return [String] The user's IP address. + attr_accessor :user_ip ## # The user agent used by the client. @@ -206,25 +193,41 @@ module Google # The user agent string used in the User-Agent header. attr_accessor :user_agent + ## + # The API hostname used by the client. + # + # @return [String] + # The API hostname. Should almost always be 'www.googleapis.com'. + attr_accessor :host + + ## + # The port number used by the client. + # + # @return [String] + # The port number. Should almost always be 443. + attr_accessor :port + + ## + # The base path used by the client for discovery. + # + # @return [String] + # The base path. Should almost always be '/discovery/v1'. + attr_accessor :discovery_path + ## # Returns the URI for the directory document. # # @return [Addressable::URI] The URI of the directory document. def directory_uri - template = Addressable::Template.new( - "https://{host}/discovery/v0.3/directory" - ) - return template.expand({ - "host" => self.host - }) + return resolve_uri(self.discovery_path + '/apis') end ## # Manually registers a URI as a discovery document for a specific version # of an API. # - # @param [String, Symbol] api The service name. - # @param [String] version The desired version of the service. + # @param [String, Symbol] api The API name. + # @param [String] version The desired version of the API. # @param [Addressable::URI] uri The URI of the discovery document. def register_discovery_uri(api, version, uri) api = api.to_s @@ -235,31 +238,27 @@ module Google ## # Returns the URI for the discovery document. # - # @param [String, Symbol] api The service name. - # @param [String] version The desired version of the service. + # @param [String, Symbol] api The API name. + # @param [String] version The desired version of the API. # @return [Addressable::URI] The URI of the discovery document. def discovery_uri(api, version=nil) api = api.to_s version = version || 'v1' - return @discovery_uris["#{api}:#{version}"] ||= (begin - template = Addressable::Template.new( - "https://{host}/discovery/v0.3/describe/" + - "{api}/{version}" + return @discovery_uris["#{api}:#{version}"] ||= ( + resolve_uri( + self.discovery_path + '/apis/{api}/{version}/rest', + 'api' => api, + 'version' => version ) - template.expand({ - "host" => self.host, - "api" => api, - "version" => version - }) - end) + ) end ## # Manually registers a pre-loaded discovery document for a specific version # of an API. # - # @param [String, Symbol] api The service name. - # @param [String] version The desired version of the service. + # @param [String, Symbol] api The API name. + # @param [String] version The desired version of the API. # @param [String, StringIO] discovery_document # The contents of the discovery document. def register_discovery_document(api, version, discovery_document) @@ -275,7 +274,7 @@ module Google "Expected String or StringIO, got #{discovery_document.class}." end @discovery_documents["#{api}:#{version}"] = - JSON.parse(discovery_document) + MultiJson.load(discovery_document) end ## @@ -284,49 +283,31 @@ module Google # @return [Hash] The parsed JSON from the directory document. def directory_document return @directory_document ||= (begin - request_uri = self.directory_uri - request = ['GET', request_uri, [], []] - response = self.transmit_request(request) - status, headers, body = response - if status == 200 # TODO(bobaman) Better status code handling? - merged_body = StringIO.new - body.each do |chunk| - merged_body.write(chunk) - end - merged_body.rewind - JSON.parse(merged_body.string) - else - raise TransmissionError, - "Could not retrieve discovery document at: #{request_uri}" - end + response = self.execute!( + :http_method => :get, + :uri => self.directory_uri, + :authenticated => false + ) + response.data end) end ## # Returns the parsed discovery document. # - # @param [String, Symbol] api The service name. - # @param [String] version The desired version of the service. + # @param [String, Symbol] api The API name. + # @param [String] version The desired version of the API. # @return [Hash] The parsed JSON from the discovery document. def discovery_document(api, version=nil) api = api.to_s version = version || 'v1' return @discovery_documents["#{api}:#{version}"] ||= (begin - request_uri = self.discovery_uri(api, version) - request = ['GET', request_uri, [], []] - response = self.transmit_request(request) - status, headers, body = response - if status == 200 # TODO(bobaman) Better status code handling? - merged_body = StringIO.new - body.each do |chunk| - merged_body.write(chunk) - end - merged_body.rewind - JSON.parse(merged_body.string) - else - raise TransmissionError, - "Could not retrieve discovery document at: #{request_uri}" - end + response = self.execute!( + :http_method => :get, + :uri => self.discovery_uri(api, version), + :authenticated => false + ) + response.data end) end @@ -339,7 +320,7 @@ module Google document_base = self.directory_uri if self.directory_document && self.directory_document['items'] self.directory_document['items'].map do |discovery_document| - ::Google::APIClient::API.new( + Google::APIClient::API.new( document_base, discovery_document ) @@ -353,8 +334,8 @@ module Google ## # Returns the service object for a given service name and service version. # - # @param [String, Symbol] api The service name. - # @param [String] version The desired version of the service. + # @param [String, Symbol] api The API name. + # @param [String] version The desired version of the API. # # @return [Google::APIClient::API] The service object. def discovered_api(api, version=nil) @@ -368,7 +349,7 @@ module Google document_base = self.discovery_uri(api, version) discovery_document = self.discovery_document(api, version) if document_base && discovery_document - ::Google::APIClient::API.new( + Google::APIClient::API.new( document_base, discovery_document ) @@ -382,7 +363,8 @@ module Google # Returns the method object for a given RPC name and service version. # # @param [String, Symbol] rpc_name The RPC name of the desired method. - # @param [String] version The desired version of the service. + # @param [String, Symbol] api The API the method is within. + # @param [String] version The desired version of the API. # # @return [Google::APIClient::Method] The method object. def discovered_method(rpc_name, api, version=nil) @@ -417,169 +399,234 @@ module Google "Expected String or Symbol, got #{api.class}." end api = api.to_s - # TODO(bobaman): Update to use directory API. return self.discovered_apis.detect do |a| a.name == api && a.preferred == true end end + ## + # Verifies an ID token against a server certificate. Used to ensure that + # an ID token supplied by an untrusted client-side mechanism is valid. + # Raises an error if the token is invalid or missing. + def verify_id_token! + require 'jwt' + require 'openssl' + @certificates ||= {} + if !self.authorization.respond_to?(:id_token) + raise ArgumentError, ( + "Current authorization mechanism does not support ID tokens: " + + "#{self.authorization.class.to_s}" + ) + elsif !self.authorization.id_token + raise ArgumentError, ( + "Could not verify ID token, ID token missing. " + + "Scopes were: #{self.authorization.scope.inspect}" + ) + else + check_cached_certs = lambda do + valid = false + for key, cert in @certificates + begin + self.authorization.decoded_id_token(cert.public_key) + valid = true + rescue JWT::DecodeError, Signet::UnsafeOperationError + # Expected exception. Ignore, ID token has not been validated. + end + end + valid + end + if check_cached_certs.call() + return true + end + response = self.execute!( + :http_method => :get, + :uri => 'https://www.googleapis.com/oauth2/v1/certs', + :authenticated => false + ) + @certificates.merge!( + Hash[MultiJson.load(response.body).map do |key, cert| + [key, OpenSSL::X509::Certificate.new(cert)] + end] + ) + if check_cached_certs.call() + return true + else + raise InvalidIDTokenError, + "Could not verify ID token against any available certificate." + end + end + return nil + end + ## # Generates a request. # - # @param [Google::APIClient::Method, String] api_method + # @option options [Google::APIClient::Method] :api_method # The method object or the RPC name of the method being executed. - # @param [Hash, Array] parameters + # @option options [Hash, Array] :parameters # The parameters to send to the method. - # @param [String] body The body of the request. - # @param [Hash, Array] headers The HTTP headers for the request. - # @param [Hash] options - # The configuration parameters for the request. - # - :version — - # The service version. Only used if api_method is a - # String. Defaults to 'v1'. - # - :parser — - # The parser for the response. - # - :authorization — - # The authorization mechanism for the response. Used only if - # :authenticated is true. - # - :authenticated — - # true if the request must be signed or otherwise - # authenticated, false - # otherwise. Defaults to true if an authorization - # mechanism has been set, false otherwise. - # - # @return [Array] The generated request. + # @option options [Hash, Array] :headers The HTTP headers for the request. + # @option options [String] :body The body of the request. + # @option options [String] :version ("v1") + # The service version. Only used if `api_method` is a `String`. + # @option options [#generate_authenticated_request] :authorization + # The authorization mechanism for the response. Used only if + # `:authenticated` is `true`. + # @option options [TrueClass, FalseClass] :authenticated (true) + # `true` if the request must be signed or somehow + # authenticated, `false` otherwise. + # + # @return [Google::APIClient::Reference] The generated request. # # @example # request = client.generate_request( - # 'chili.activities.list', - # {'scope' => '@self', 'userId' => '@me', 'alt' => 'json'} + # :api_method => 'plus.activities.list', + # :parameters => + # {'collection' => 'public', 'userId' => 'me'} # ) - # method, uri, headers, body = request - def generate_request( - api_method, parameters={}, body='', headers=[], options={}) - options={ - :parser => self.parser, - :version => 'v1', - :authorization => self.authorization + def generate_request(options={}) + options = { + :api_client => self }.merge(options) - # The default value for the :authenticated option depends on whether an - # authorization mechanism has been set. - if options[:authorization] - options = {:authenticated => true}.merge(options) - else - options = {:authenticated => false}.merge(options) - end - if api_method.kind_of?(String) || api_method.kind_of?(Symbol) - api_method = api_method.to_s - # This method of guessing the API is unreliable. This will fail for - # APIs where the first segment of the RPC name does not match the - # service name. However, this is a fallback mechanism anyway. - # Developers should be passing in a reference to the method, rather - # than passing in a string or symbol. This should raise an error - # in the case of a mismatch. - api = api_method[/^([^.]+)\./, 1] - api_method = self.discovered_method( - api_method, api, options[:version] - ) - elsif !api_method.kind_of?(::Google::APIClient::Method) - raise TypeError, - "Expected String, Symbol, or Google::APIClient::Method, " + - "got #{api_method.class}." - end - unless api_method - raise ArgumentError, "API method could not be found." - end - request = api_method.generate_request(parameters, body, headers) - if options[:authenticated] - request = self.generate_authenticated_request(:request => request) - end - return request + return Google::APIClient::Request.new(options) end ## - # Generates a request and transmits it. + # Executes a request, wrapping it in a Result object. # - # @param [Google::APIClient::Method, String] api_method - # The method object or the RPC name of the method being executed. - # @param [Hash, Array] parameters - # The parameters to send to the method. - # @param [String] body The body of the request. - # @param [Hash, Array] headers The HTTP headers for the request. - # @param [Hash] options - # The configuration parameters for the request. - # - :version — - # The service version. Only used if api_method is a - # String. Defaults to 'v1'. - # - :adapter — - # The HTTP adapter. - # - :parser — - # The parser for the response. - # - :authorization — - # The authorization mechanism for the response. Used only if - # :authenticated is true. - # - :authenticated — - # true if the request must be signed or otherwise - # authenticated, false - # otherwise. Defaults to true. - # - # @return [Array] The response from the API. + # @param [Google::APIClient::Request, Hash, Array] params + # Either a Google::APIClient::Request, a Hash, or an Array. + # + # If a Google::APIClient::Request, no other parameters are expected. + # + # If a Hash, the below parameters are handled. If an Array, the + # parameters are assumed to be in the below order: + # + # - (Google::APIClient::Method) api_method: + # The method object or the RPC name of the method being executed. + # - (Hash, Array) parameters: + # The parameters to send to the method. + # - (String) body: The body of the request. + # - (Hash, Array) headers: The HTTP headers for the request. + # - (Hash) options: A set of options for the request, of which: + # - (#generate_authenticated_request) :authorization (default: true) - + # The authorization mechanism for the response. Used only if + # `:authenticated` is `true`. + # - (TrueClass, FalseClass) :authenticated (default: true) - + # `true` if the request must be signed or somehow + # authenticated, `false` otherwise. + # + # @return [Google::APIClient::Result] The result from the API, nil if batch. + # + # @example + # result = client.execute(batch_request) # # @example - # response = client.execute( - # 'chili.activities.list', - # {'scope' => '@self', 'userId' => '@me', 'alt' => 'json'} + # plus = client.discovered_api('plus') + # result = client.execute( + # :api_method => plus.activities.list, + # :parameters => {'collection' => 'public', 'userId' => 'me'} # ) - # status, headers, body = response - def execute(api_method, parameters={}, body='', headers=[], options={}) - request = self.generate_request( - api_method, parameters, body, headers, options - ) - return self.transmit_request( - request, - options[:adapter] || self.http_adapter - ) + # + # @see Google::APIClient#generate_request + def execute(*params) + if params.last.kind_of?(Google::APIClient::Request) && + params.size == 1 + request = params.pop + options = {} + else + # This block of code allows us to accept multiple parameter passing + # styles, and maintaining some backwards compatibility. + # + # Note: I'm extremely tempted to deprecate this style of execute call. + if params.last.respond_to?(:to_hash) && params.size == 1 + options = params.pop + else + options = {} + end + + options[:api_method] = params.shift if params.size > 0 + options[:parameters] = params.shift if params.size > 0 + options[:body] = params.shift if params.size > 0 + options[:headers] = params.shift if params.size > 0 + options.update(params.shift) if params.size > 0 + request = self.generate_request(options) + end + + request.headers['User-Agent'] ||= '' + self.user_agent unless self.user_agent.nil? + request.parameters['key'] ||= self.key unless self.key.nil? + request.parameters['userIp'] ||= self.user_ip unless self.user_ip.nil? + + connection = options[:connection] || Faraday.default_connection + request.authorization = options[:authorization] || self.authorization unless options[:authenticated] == false + + result = request.send(connection) + if result.status == 401 && authorization.respond_to?(:refresh_token) && auto_refresh_token + begin + logger.debug("Attempting refresh of access token & retry of request") + authorization.fetch_access_token! + result = request.send(connection) + rescue Signet::AuthorizationError + # Ignore since we want the original error + end + end + + return result end ## - # Transmits the request using the current HTTP adapter. - # - # @param [Array] request The request to transmit. - # @param [#transmit] adapter The HTTP adapter. - # - # @return [Array] The response from the server. - def transmit_request(request, adapter=self.http_adapter) - if self.user_agent != nil - # If there's no User-Agent header, set one. - method, uri, headers, body = request - unless headers.kind_of?(Enumerable) - # We need to use some Enumerable methods, relying on the presence of - # the #each method. - class < 'https', + :host => self.host, + :port => self.port + ).normalize + template = if template.kind_of?(Addressable::Template) + template.pattern + elsif template.respond_to?(:to_str) + template.to_str + else + raise TypeError, + "Expected String, Addressable::URI, or Addressable::Template, " + + "got #{template.class}." + end + return Addressable::Template.new(@base_uri + template).expand(mapping) end + end end