Cloud storage signing urls

[jmgamboa]

Specs

1. Cloud storage
2. OS type and version
3. 3.4
4. google-cloud-python version 1.9

Hi. Great job so far. I using signed urls for google cloud storage. I saw this feature was recently added on Feb 6th. I noticed that the signed url function exists only on a Blob level whereas google also allows you to generate signed urls on the bucket level. Does this function support the bucket level signed urls as well?

https://google-cloud-python.readthedocs.io/en/latest/_modules/google/cloud/storage/blob.html#Blob

[theacodes]

@jmgamboa can you describe your use case a little bit more?

[theacodes]

Also - heads up - we're likely to drop 3.4 support soonish. I would highly recommend upgrading!

[jmgamboa]

Thanks for the heads up. To elaborate, I am trying to allow a user to upload or retrieve files to my bucket on cloud storage via signed url. Signed urls as you might know give temporary access to the bucket or or asset within the bucket. It is my understanding that a Blob is a particular item within a bucket and not the bucket itself. You have generated_signed_url available on the Blob class but not the Bucket class. This means that you can only generate_signed_urls for existing files in the bucket and not permissions to the bucket itself.

[theacodes]

Interesting. I actually wasn't aware that it works at the bucket level. You can try using the private google.cloud.storage._singing.generate_signed_url directly. If you can confirm that works for your use case, we can add a bucket-level generate signed url method. :)

[tseaver]

The Creating Signed URLs with a Program doc has a Python example which shows signing URLs using just ServiceAccountCredentials. That example should work with bucket URLs, too.

[jmgamboa]

@tseaver yep. I am aware of this. the example in the docs is for a bucket. Just curious if there is an implementation for it in this library.

@jonparrott yep i used the private module to generate a signed url. the resource i passed it was just /bucketname/ and it gave back a signed url so will test using it to upload a file and get back to this post in the next few days

[jmgamboa]

@jonparrott so i gave it a try

and the resource i passed the function was the bucket name. it sent back a signed url and assume it worked fine. the issue is, after reading the docs. I dont know what to do with it. Is it ok to assume that

(Not the actual return)

https://storage.googleapis.combucketname-filestorage?GoogleAccessId=bucketname%40tiny-tact-133716.iam.gserviceaccount.com&Expires=1526418577&Signature=LSDIJlskdjflJOSDJK%LSKJDFLJSDKFL%2B8SrBKkxeGnK7aIR2iF6jPA%LSJDFLKJDFLS%LSKDJFSLDKF%2FZX2hryACTI55LpeoDpLgjh%LKSDJFLKJSDFL%KLSDJFLKJDS%SLKDJFLKJSDFLKJSFD%SDSDLKFJKLSDFLFDS%2BcMGXD%2BnM%2ByrQ%3D%3D&response-content-type=&response-content-disposition=&generation="

what do i do with this to confirm it actually works?

[tseaver]

Per the objects.insert documentation, new blobs / objects are created in a bucket via a POST to the URL pattern https://www.googleapis.com/upload/storage/v1/b/<bucket-name>/o. It seems that you would need to sign that URL, including the POST method.

[jmgamboa]

@tseaver ah yeah. thanks. just passing the // to the generate_signed_url function did not suffice.

Just an update.
I believe I have a correct signed url given tseavers feedback. At least I am getting errors from the xml api about required fields. Once I finally get an upload successful, I will confirm here.
Also a side note, resumable uploading is only supported via xml api :(

[jmgamboa]

Update. I was not able to get the generate_signed_url function to work on bucket. instead i used the create_resumable_upload function available on an existing blob https://github.com/GoogleCloudPlatform/google-cloud-python/blob/master/storage/google/cloud/storage/blob.py#L1127

[tseaver]

@jmgamboa Buckets got a generate_signed_url method in #7460, including support for both V2 and V4 signing protocols. Please follow-up / reopen if that feature doesn't address your issue.