Merge branch 'master' into auth-add-provider

Author: astr0n0mer

.github/workflows/release.yml

@@ -108,6 +108,7 @@ jobs:
       uses: actions/[email protected]
       with:
         name: dist
+        path: dist
 
     - name: Publish preflight check
       id: preflight

firebase_admin/__about__.py

@@ -14,7 +14,7 @@
 
 """About information (version, etc) for Firebase Admin SDK."""
 
-__version__ = '6.5.0'
+__version__ = '6.6.0'
 __title__ = 'firebase_admin'
 __author__ = 'Firebase'
 __license__ = 'Apache License 2.0'

firebase_admin/__init__.py

@@ -18,6 +18,7 @@
 import os
 import threading
 
+from google.auth.credentials import Credentials as GoogleAuthCredentials
 from google.auth.exceptions import DefaultCredentialsError
 from firebase_admin import credentials
 from firebase_admin.__about__ import __version__
@@ -208,10 +209,13 @@ def __init__(self, name, credential, options):
                              'non-empty string.'.format(name))
         self._name = name
 
-        if not isinstance(credential, credentials.Base):
+        if isinstance(credential, GoogleAuthCredentials):
+            self._credential = credentials._ExternalCredentials(credential) # pylint: disable=protected-access
+        elif isinstance(credential, credentials.Base):
+            self._credential = credential
+        else:
             raise ValueError('Illegal Firebase credential provided. App must be initialized '
                              'with a valid credential instance.')
-        self._credential = credential
         self._options = _AppOptions(options)
         self._lock = threading.RLock()
         self._services = {}

firebase_admin/_http_client.py

@@ -21,6 +21,7 @@
 import requests
 from requests.packages.urllib3.util import retry # pylint: disable=import-error
 
+from firebase_admin import _utils
 
 if hasattr(retry.Retry.DEFAULT, 'allowed_methods'):
     _ANY_METHOD = {'allowed_methods': None}
@@ -36,6 +37,9 @@
 
 DEFAULT_TIMEOUT_SECONDS = 120
 
+METRICS_HEADERS = {
+    'X-GOOG-API-CLIENT': _utils.get_metrics_header(),
+}
 
 class HttpClient:
     """Base HTTP client used to make HTTP calls.
@@ -72,6 +76,7 @@ def __init__(
 
         if headers:
             self._session.headers.update(headers)
+        self._session.headers.update(METRICS_HEADERS)
         if retries:
             self._session.mount('http://', requests.adapters.HTTPAdapter(max_retries=retries))
             self._session.mount('https://', requests.adapters.HTTPAdapter(max_retries=retries))

firebase_admin/_utils.py

@@ -15,6 +15,7 @@
 """Internal utilities common to all modules."""
 
 import json
+from platform import python_version
 
 import google.auth
 import requests
@@ -75,6 +76,8 @@
     16: exceptions.UNAUTHENTICATED,
 }
 
+def get_metrics_header():
+    return f'gl-python/{python_version()} fire-admin/{firebase_admin.__version__}'
 
 def _get_initialized_app(app):
     """Returns a reference to an initialized App instance."""

firebase_admin/app_check.py

@@ -51,6 +51,10 @@ class _AppCheckService:
     _scoped_project_id = None
     _jwks_client = None
 
+    _APP_CHECK_HEADERS = {
+        'X-GOOG-API-CLIENT': _utils.get_metrics_header(),
+    }
+
     def __init__(self, app):
         # Validate and store the project_id to validate the JWT claims
         self._project_id = app.project_id
@@ -62,7 +66,8 @@ def __init__(self, app):
                 'GOOGLE_CLOUD_PROJECT environment variable.')
         self._scoped_project_id = 'projects/' + app.project_id
         # Default lifespan is 300 seconds (5 minutes) so we change it to 21600 seconds (6 hours).
-        self._jwks_client = PyJWKClient(self._JWKS_URL, lifespan=21600)
+        self._jwks_client = PyJWKClient(
+            self._JWKS_URL, lifespan=21600, headers=self._APP_CHECK_HEADERS)
 
 
     def verify_token(self, token: str) -> Dict[str, Any]:

firebase_admin/credentials.py

@@ -18,6 +18,7 @@
 import pathlib
 
 import google.auth
+from google.auth.credentials import Credentials as GoogleAuthCredentials
 from google.auth.transport import requests
 from google.oauth2 import credentials
 from google.oauth2 import service_account
@@ -58,6 +59,19 @@ def get_credential(self):
         """Returns the Google credential instance used for authentication."""
         raise NotImplementedError
 
+class _ExternalCredentials(Base):
+    """A wrapper for google.auth.credentials.Credentials typed credential instances"""
+
+    def __init__(self, credential: GoogleAuthCredentials):
+        super(_ExternalCredentials, self).__init__()
+        self._g_credential = credential
+
+    def get_credential(self):
+        """Returns the underlying Google Credential
+
+        Returns:
+          google.auth.credentials.Credentials: A Google Auth credential instance."""
+        return self._g_credential
 
 class Certificate(Base):
     """A credential initialized from a JSON certificate keyfile."""

firebase_admin/storage.py

@@ -55,8 +55,13 @@ def bucket(name=None, app=None) -> storage.Bucket:
 class _StorageClient:
     """Holds a Google Cloud Storage client instance."""
 
+    STORAGE_HEADERS = {
+        'X-GOOG-API-CLIENT': _utils.get_metrics_header(),
+    }
+
     def __init__(self, credentials, project, default_bucket):
-        self._client = storage.Client(credentials=credentials, project=project)
+        self._client = storage.Client(
+            credentials=credentials, project=project, extra_headers=self.STORAGE_HEADERS)
         self._default_bucket = default_bucket
 
     @classmethod

requirements.txt

@@ -9,6 +9,6 @@ pytest-mock >= 3.6.1
 cachecontrol >= 0.12.14
 google-api-core[grpc] >= 1.22.1, < 3.0.0dev; platform.python_implementation != 'PyPy'
 google-api-python-client >= 1.7.8
-google-cloud-firestore >= 2.9.1; platform.python_implementation != 'PyPy'
+google-cloud-firestore >= 2.19.0; platform.python_implementation != 'PyPy'
 google-cloud-storage >= 1.37.1
 pyjwt[crypto] >= 2.5.0

setup.py

@@ -40,7 +40,7 @@
     'cachecontrol>=0.12.14',
     'google-api-core[grpc] >= 1.22.1, < 3.0.0dev; platform.python_implementation != "PyPy"',
     'google-api-python-client >= 1.7.8',
-    'google-cloud-firestore>=2.9.1; platform.python_implementation != "PyPy"',
+    'google-cloud-firestore>=2.19.0; platform.python_implementation != "PyPy"',
     'google-cloud-storage>=1.37.1',
     'pyjwt[crypto] >= 2.5.0',
 ]

tests/test_app.py

@@ -246,6 +246,16 @@ def test_non_default_app_init(self, app_credential):
         with pytest.raises(ValueError):
             firebase_admin.initialize_app(app_credential, name='myApp')
 
+    def test_app_init_with_google_auth_cred(self):
+        cred = testutils.MockGoogleCredential()
+        assert isinstance(cred, credentials.GoogleAuthCredentials)
+        app = firebase_admin.initialize_app(cred)
+        assert cred is app.credential.get_credential()
+        assert isinstance(app.credential, credentials.Base)
+        assert isinstance(app.credential, credentials._ExternalCredentials)
+        with pytest.raises(ValueError):
+            firebase_admin.initialize_app(app_credential)
+
     @pytest.mark.parametrize('cred', invalid_credentials)
     def test_app_init_with_invalid_credential(self, cred):
         with pytest.raises(ValueError):