Repository navigation
feat(client): support ADC and quota project via AuthorizedSession - #9
Merged
Merged
Conversation
Route requests through google-auth's AuthorizedSession so any Application Default Credentials work (service account, workload identity, or local user credentials from `gcloud auth application-default login`), not just service accounts. The session refreshes tokens and attaches the `x-goog-user-project` quota-project header automatically. The Remote Config REST API rejects user credentials with no quota project (403 SERVICE_DISABLED); user credentials now default their quota project to `project_id`. Add optional `quota_project_id` and `timeout` (default 30s) constructor params. Broaden the accepted credential type to the google-auth base `Credentials`. Public method signatures and return types are unchanged.
Add RemoteConfigClient tests: quota-project resolution for user, service account, explicit, and preset-quota credentials; GET success and version param; non-200 raising UnexpectedError; rollback body; and timeout forwarding. All mock AuthorizedSession with no network access.
Show initializing the client with google.auth.default() alongside the service-account example, explain the quota_project_id parameter and the 403 SERVICE_DISABLED case for user credentials, and broaden the credentials requirement note beyond service accounts.
list_versions returns a ListVersionsResponse, not a tuple.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Makes
RemoteConfigClientwork with any Application Default Credentials — a service account, workload identity, or local user credentials fromgcloud auth application-default login— instead of service accounts only.Requests now go through google-auth's
AuthorizedSession, which refreshes tokens and attaches thex-goog-user-projectquota-project header automatically. This removes the need for callers to hand-roll an authenticated session just to reach the Remote Config REST API under user credentials.Changes
Credentialstype; service-account, workload-identity, and user credentials all work.403 SERVICE_DISABLED. User credentials now default their quota project toproject_id; a new optionalquota_project_idparam overrides it. Service-account / workload-identity credentials get no quota project unless they already carry one.timeoutparam (default 30s) applied to every request; previously requests were unbounded. Passtimeout=Noneto restore the old behavior.make_remote_configtolerates a missingetagheader instead of raisingKeyError.get_oauth_tokenhelper and simplifiedmake_headers(auth is handled by the session).Public method signatures and return types are unchanged; the documented service-account usage is a drop-in.
Compatibility
RemoteConfigClient(credentials, project_id)calls are unchanged.timeout=None), andx-goog-user-projectis now sent when credentials carry a quota project (standard behavior). Private helpersget_oauth_token/ oldmake_headers(access_token, ...)are gone — not part of the exported API.0.1.23→0.2.0.Tests
Adds
tests/test_client.py(the client previously had none): quota-project resolution across credential types, GET success and version param, non-200 →UnexpectedError, rollback body, and timeout forwarding — all mockingAuthorizedSession, no network. Full suite: 24 passed, ruff clean.