Skip to content
This repository was archived by the owner on Mar 6, 2026. It is now read-only.

Commit 944bf4d

Browse files
committed
Merge branch 'main' into remove-rsa-dependency
2 parents 58a7df9 + 5c07e1c commit 944bf4d

84 files changed

Lines changed: 503 additions & 163 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

.librarian/state.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
1-
image: us-central1-docker.pkg.dev/cloud-sdk-librarian-prod/images-prod/python-librarian-generator@sha256:39628f6e89c9cad27973b9a39a50f7052bec0435ee58c7027b4fa6b655943e31
1+
image: us-central1-docker.pkg.dev/cloud-sdk-librarian-prod/images-prod/python-librarian-generator@sha256:b8058df4c45e9a6e07f6b4d65b458d0d059241dd34c814f151c8bf6b89211209
22
libraries:
33
- id: google-auth
4-
version: 2.45.0
4+
version: 2.46.0
55
last_generated_commit: 102d9f92ac6ed649a61efd9b208e4d1de278e9bb
66
apis: []
77
source_roots:

CHANGELOG.md

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,28 @@
44

55
[1]: https://pypi.org/project/google-auth/#history
66

7+
## [2.46.0](https://github.com/googleapis/google-auth-library-python/compare/v2.45.0...v2.46.0) (2026-01-05)
8+
9+
10+
### Documentation
11+
12+
* update urllib3 docstrings for v2 compatibility (#1903) ([3f1aeea2d1014ea1d244a4c3470e52d74d55404b](https://github.com/googleapis/google-auth-library-python/commit/3f1aeea2d1014ea1d244a4c3470e52d74d55404b))
13+
14+
15+
### Features
16+
17+
* Recognize workload certificate config in has_default_client_cert_source for mTLS for Agentic Identities (#1907) ([0b9107d573123e358c347ffa067637f992af61b4](https://github.com/googleapis/google-auth-library-python/commit/0b9107d573123e358c347ffa067637f992af61b4))
18+
19+
20+
### Bug Fixes
21+
22+
* add types to default and verify_token and Request __init__ based on comments in the source code. (#1588) ([59a5f588f7793b59d923a4185c8c07738da618f7](https://github.com/googleapis/google-auth-library-python/commit/59a5f588f7793b59d923a4185c8c07738da618f7))
23+
* fix the document of secure_authorized_session (#1536) ([5d0014707fc359782df5ccfcaa75fd372fe9dce3](https://github.com/googleapis/google-auth-library-python/commit/5d0014707fc359782df5ccfcaa75fd372fe9dce3))
24+
* remove setup.cfg configuration for creating universal wheels (#1693) ([c767531ce05a89002d109f595187aff1fcaacfb7](https://github.com/googleapis/google-auth-library-python/commit/c767531ce05a89002d109f595187aff1fcaacfb7))
25+
* use .read() instead of .content.read() in aiohttp transport (#1899) ([12f4470f808809e8abf1141f98d88ab720c3899b](https://github.com/googleapis/google-auth-library-python/commit/12f4470f808809e8abf1141f98d88ab720c3899b))
26+
* raise RefreshError for missing token in impersonated credentials (#1897) ([94d04e090fdfc61926dd32bc1d65f8820b9cede5](https://github.com/googleapis/google-auth-library-python/commit/94d04e090fdfc61926dd32bc1d65f8820b9cede5))
27+
* Fix test coverage for mtls_helper (#1886) ([02e71631fe275d93825c2e957e830773e75133f7](https://github.com/googleapis/google-auth-library-python/commit/02e71631fe275d93825c2e957e830773e75133f7))
28+
729
## [2.45.0](https://github.com/googleapis/google-auth-library-python/compare/v2.44.0...v2.45.0) (2025-12-15)
830

931

google/auth/_cache.py

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
# Copyright 2025 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# https://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
from collections import OrderedDict
16+
17+
18+
class LRUCache(dict):
19+
def __init__(self, maxsize):
20+
super().__init__()
21+
self._order = OrderedDict()
22+
self.maxsize = maxsize
23+
24+
def clear(self):
25+
super().clear()
26+
self._order.clear()
27+
28+
def get(self, key, default=None):
29+
try:
30+
value = super().__getitem__(key)
31+
self._update(key)
32+
return value
33+
except KeyError:
34+
return default
35+
36+
def __getitem__(self, key):
37+
value = super().__getitem__(key)
38+
self._update(key)
39+
return value
40+
41+
def __setitem__(self, key, value):
42+
maxsize = self.maxsize
43+
if maxsize <= 0:
44+
return
45+
if key not in self:
46+
while len(self) >= maxsize:
47+
self.popitem()
48+
super().__setitem__(key, value)
49+
self._update(key)
50+
51+
def __delitem__(self, key):
52+
super().__delitem__(key)
53+
del self._order[key]
54+
55+
def popitem(self):
56+
"""Remove and return the least recently used key-value pair."""
57+
key, _ = self._order.popitem(last=False)
58+
return key, super().pop(key)
59+
60+
def _update(self, key):
61+
try:
62+
self._order.move_to_end(key)
63+
except KeyError:
64+
self._order[key] = None

google/auth/_default.py

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,16 +17,22 @@
1717
Implements application default credentials and project ID detection.
1818
"""
1919

20+
from collections.abc import Sequence
2021
import io
2122
import json
2223
import logging
2324
import os
25+
from typing import Optional, TYPE_CHECKING
2426
import warnings
2527

2628
from google.auth import environment_vars
2729
from google.auth import exceptions
2830
import google.auth.transport._http_client
2931

32+
if TYPE_CHECKING: # pragma: NO COVER
33+
from google.auth.credentials import Credentials # noqa: F401
34+
from google.auth.transport import Request # noqa: F401
35+
3036
_LOGGER = logging.getLogger(__name__)
3137

3238
# Valid types accepted for file-based credentials.
@@ -588,7 +594,12 @@ def _apply_quota_project_id(credentials, quota_project_id):
588594
return credentials
589595

590596

591-
def default(scopes=None, request=None, quota_project_id=None, default_scopes=None):
597+
def default(
598+
scopes: Optional[Sequence[str]] = None,
599+
request: Optional["google.auth.transport.Request"] = None,
600+
quota_project_id: Optional[str] = None,
601+
default_scopes: Optional[Sequence[str]] = None,
602+
) -> tuple["google.auth.credentials.Credentials", Optional[str]]:
592603
"""Gets the default credentials for the current environment.
593604
594605
`Application Default Credentials`_ provides an easy way to obtain

google/auth/aio/transport/aiohttp.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,7 @@ class Request(transport.Request):
104104
# Custom aiohttp Session Example:
105105
session = session=aiohttp.ClientSession(auto_decompress=False)
106106
request = google.auth.aio.transport.aiohttp.Request(session=session)
107-
auth_sesion = google.auth.aio.transport.sessions.AsyncAuthorizedSession(auth_request=request)
107+
auth_session = google.auth.aio.transport.sessions.AsyncAuthorizedSession(auth_request=request)
108108
109109
Args:
110110
session (aiohttp.ClientSession): An instance :class:`aiohttp.ClientSession` used

google/auth/aio/transport/sessions.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -159,7 +159,7 @@ async def request(
159159
at ``max_allowed_time``. It might take longer, for example, if
160160
an underlying request takes a lot of time, but the request
161161
itself does not timeout, e.g. if a large file is being
162-
transmitted. The timout error will be raised after such
162+
transmitted. The timeout error will be raised after such
163163
request completes.
164164
165165
Returns:

google/auth/compute_engine/_metadata.py

Lines changed: 22 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -294,7 +294,7 @@ def get(
294294
url = _helpers.update_query(base_url, query_params)
295295

296296
backoff = ExponentialBackoff(total_attempts=retry_count)
297-
failure_reason = None
297+
last_exception = None
298298
for attempt in backoff:
299299
try:
300300
response = request(
@@ -308,13 +308,10 @@ def get(
308308
retry_count,
309309
response.status,
310310
)
311-
failure_reason = (
312-
response.data.decode("utf-8")
313-
if hasattr(response.data, "decode")
314-
else response.data
315-
)
311+
last_exception = None
316312
continue
317313
else:
314+
last_exception = None
318315
break
319316

320317
except exceptions.TransportError as e:
@@ -325,14 +322,27 @@ def get(
325322
retry_count,
326323
e,
327324
)
328-
failure_reason = e
325+
last_exception = e
329326
else:
330-
raise exceptions.TransportError(
331-
"Failed to retrieve {} from the Google Compute Engine "
332-
"metadata service. Compute Engine Metadata server unavailable due to {}".format(
333-
url, failure_reason
327+
if last_exception:
328+
raise exceptions.TransportError(
329+
"Failed to retrieve {} from the Google Compute Engine "
330+
"metadata service. Compute Engine Metadata server unavailable. "
331+
"Last exception: {}".format(url, last_exception)
332+
) from last_exception
333+
else:
334+
error_details = (
335+
response.data.decode("utf-8")
336+
if hasattr(response.data, "decode")
337+
else response.data
338+
)
339+
raise exceptions.TransportError(
340+
"Failed to retrieve {} from the Google Compute Engine "
341+
"metadata service. Compute Engine Metadata server unavailable. "
342+
"Response status: {}\nResponse details:\n{}".format(
343+
url, response.status, error_details
344+
)
334345
)
335-
)
336346

337347
content = _helpers.from_bytes(response.data)
338348

google/auth/compute_engine/credentials.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -123,7 +123,7 @@ def _retrieve_info(self, request):
123123
def _metric_header_for_usage(self):
124124
return metrics.CRED_TYPE_SA_MDS
125125

126-
def _refresh_token(self, request):
126+
def _perform_refresh_token(self, request):
127127
"""Refresh the access token and scopes.
128128
129129
Args:

google/auth/credentials.py

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -294,7 +294,7 @@ class CredentialsWithTrustBoundary(Credentials):
294294
"""Abstract base for credentials supporting ``with_trust_boundary`` factory"""
295295

296296
@abc.abstractmethod
297-
def _refresh_token(self, request):
297+
def _perform_refresh_token(self, request):
298298
"""Refreshes the access token.
299299
300300
Args:
@@ -305,7 +305,7 @@ def _refresh_token(self, request):
305305
google.auth.exceptions.RefreshError: If the credentials could
306306
not be refreshed.
307307
"""
308-
raise NotImplementedError("_refresh_token must be implemented")
308+
raise NotImplementedError("_perform_refresh_token must be implemented")
309309

310310
def with_trust_boundary(self, trust_boundary):
311311
"""Returns a copy of these credentials with a modified trust boundary.
@@ -364,7 +364,7 @@ def refresh(self, request):
364364
This method calls the subclass's token refresh logic and then
365365
refreshes the trust boundary if applicable.
366366
"""
367-
self._refresh_token(request)
367+
self._perform_refresh_token(request)
368368
self._refresh_trust_boundary(request)
369369

370370
def _refresh_trust_boundary(self, request):

google/auth/external_account.py

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -420,7 +420,7 @@ def refresh(self, request):
420420
source credentials and the impersonated credentials. For non-impersonated
421421
credentials, it will refresh the access token and the trust boundary.
422422
"""
423-
self._refresh_token(request)
423+
self._perform_refresh_token(request)
424424
self._handle_trust_boundary(request)
425425

426426
def _handle_trust_boundary(self, request):
@@ -432,7 +432,7 @@ def _handle_trust_boundary(self, request):
432432
# Otherwise, refresh the trust boundary for the external account.
433433
self._refresh_trust_boundary(request)
434434

435-
def _refresh_token(self, request, cert_fingerprint=None):
435+
def _perform_refresh_token(self, request, cert_fingerprint=None):
436436
scopes = self._scopes if self._scopes is not None else self._default_scopes
437437

438438
# Inject client certificate into request.

0 commit comments

Comments
 (0)