From 0fc7e8d9448271e29a7abf5c8afa0ba8008d05bd Mon Sep 17 00:00:00 2001 From: Owl Bot Date: Fri, 29 Aug 2025 21:05:36 +0000 Subject: [PATCH 1/4] feat: Add new `VerifyConfidentialSpace` and `VerifyConfidentialGke` rpcs and relevant fields fix!: Move `AwsPrincipalTagsOptions` out from `TokenOptions` message docs: Updated comment for method `VerifyAttestation`, `VerifyAttestationRequest` and `VerifyAttestationResponse` in service `ConfidentialComputing` is changed docs: A comment for field `aws_principal_tags_options` in message `.google.cloud.confidentialcomputing.v1.TokenOptions` is changed PiperOrigin-RevId: 800806196 Source-Link: https://github.com/googleapis/googleapis/commit/bf9ef0b974165254603138d47a1f09ea1aa9cd0a Source-Link: https://github.com/googleapis/googleapis-gen/commit/4744f98a9dbf9a8ebf07f4bed5f8072382593946 Copy-Tag: eyJwIjoicGFja2FnZXMvZ29vZ2xlLWNsb3VkLWNvbmZpZGVudGlhbGNvbXB1dGluZy8uT3dsQm90LnlhbWwiLCJoIjoiNDc0NGY5OGE5ZGJmOWE4ZWJmMDdmNGJlZDVmODA3MjM4MjU5Mzk0NiJ9 --- .../v1/.coveragerc | 13 + .../v1/.flake8 | 34 + .../v1/LICENSE | 202 + .../v1/MANIFEST.in | 20 + .../v1/README.rst | 143 + .../v1/docs/_static/custom.css | 20 + .../v1/docs/_templates/layout.html | 50 + .../v1/docs/conf.py | 385 ++ .../confidential_computing.rst | 6 + .../confidentialcomputing_v1/services_.rst | 6 + .../docs/confidentialcomputing_v1/types_.rst | 6 + .../v1/docs/index.rst | 10 + .../v1/docs/multiprocessing.rst | 7 + .../cloud/confidentialcomputing/__init__.py | 71 + .../confidentialcomputing/gapic_version.py | 16 + .../cloud/confidentialcomputing/py.typed | 2 + .../confidentialcomputing_v1/__init__.py | 72 + .../gapic_metadata.json | 88 + .../confidentialcomputing_v1/gapic_version.py | 16 + .../cloud/confidentialcomputing_v1/py.typed | 2 + .../services/__init__.py | 15 + .../confidential_computing/__init__.py | 22 + .../confidential_computing/async_client.py | 760 +++ .../services/confidential_computing/client.py | 1123 +++++ .../transports/README.rst | 9 + .../transports/__init__.py | 38 + .../confidential_computing/transports/base.py | 264 ++ .../confidential_computing/transports/grpc.py | 465 ++ .../transports/grpc_asyncio.py | 547 +++ .../confidential_computing/transports/rest.py | 1179 +++++ .../transports/rest_base.py | 330 ++ .../types/__init__.py | 64 + .../confidentialcomputing_v1/types/service.py | 915 ++++ .../v1/mypy.ini | 3 + .../v1/noxfile.py | 592 +++ ...ential_computing_create_challenge_async.py | 52 + ...dential_computing_create_challenge_sync.py | 52 + ...tial_computing_verify_attestation_async.py | 52 + ...ntial_computing_verify_attestation_sync.py | 52 + ...computing_verify_confidential_gke_async.py | 52 + ..._computing_verify_confidential_gke_sync.py | 52 + ...mputing_verify_confidential_space_async.py | 52 + ...omputing_verify_confidential_space_sync.py | 52 + ...google.cloud.confidentialcomputing.v1.json | 643 +++ ...fixup_confidentialcomputing_v1_keywords.py | 179 + .../v1/setup.py | 98 + .../v1/testing/constraints-3.10.txt | 6 + .../v1/testing/constraints-3.11.txt | 6 + .../v1/testing/constraints-3.12.txt | 6 + .../v1/testing/constraints-3.13.txt | 11 + .../v1/testing/constraints-3.7.txt | 10 + .../v1/testing/constraints-3.8.txt | 6 + .../v1/testing/constraints-3.9.txt | 6 + .../v1/tests/__init__.py | 16 + .../v1/tests/unit/__init__.py | 16 + .../v1/tests/unit/gapic/__init__.py | 16 + .../confidentialcomputing_v1/__init__.py | 16 + .../test_confidential_computing.py | 4165 +++++++++++++++++ 58 files changed, 13111 insertions(+) create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/.coveragerc create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/.flake8 create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/LICENSE create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/MANIFEST.in create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/README.rst create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/_static/custom.css create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/_templates/layout.html create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/conf.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/confidential_computing.rst create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/services_.rst create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/types_.rst create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/index.rst create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/multiprocessing.rst create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/__init__.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/gapic_version.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/py.typed create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/__init__.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/gapic_metadata.json create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/gapic_version.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/py.typed create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/__init__.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/__init__.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/async_client.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/client.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/README.rst create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/__init__.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/base.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc_asyncio.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest_base.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/types/__init__.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/types/service.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/mypy.ini create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/noxfile.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_create_challenge_async.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_create_challenge_sync.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_attestation_async.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_attestation_sync.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_async.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_sync.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_async.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_sync.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/snippet_metadata_google.cloud.confidentialcomputing.v1.json create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/scripts/fixup_confidentialcomputing_v1_keywords.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/setup.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.10.txt create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.11.txt create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.12.txt create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.13.txt create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.7.txt create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.8.txt create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.9.txt create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/__init__.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/__init__.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/__init__.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/confidentialcomputing_v1/__init__.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/confidentialcomputing_v1/test_confidential_computing.py diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/.coveragerc b/owl-bot-staging/google-cloud-confidentialcomputing/v1/.coveragerc new file mode 100644 index 000000000000..ecca1f30bedc --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/.coveragerc @@ -0,0 +1,13 @@ +[run] +branch = True + +[report] +show_missing = True +omit = + google/cloud/confidentialcomputing/__init__.py + google/cloud/confidentialcomputing/gapic_version.py +exclude_lines = + # Re-enable the standard pragma + pragma: NO COVER + # Ignore debug-only repr + def __repr__ diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/.flake8 b/owl-bot-staging/google-cloud-confidentialcomputing/v1/.flake8 new file mode 100644 index 000000000000..90316de21489 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/.flake8 @@ -0,0 +1,34 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +[flake8] +# TODO(https://github.com/googleapis/gapic-generator-python/issues/2333): +# Resolve flake8 lint issues +ignore = E203, E231, E266, E501, W503 +exclude = + # TODO(https://github.com/googleapis/gapic-generator-python/issues/2333): + # Ensure that generated code passes flake8 lint + **/gapic/** + **/services/** + **/types/** + # Exclude Protobuf gencode + *_pb2.py + + # Standard linting exemptions. + **/.nox/** + __pycache__, + .git, + *.pyc, + conf.py diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/LICENSE b/owl-bot-staging/google-cloud-confidentialcomputing/v1/LICENSE new file mode 100644 index 000000000000..d64569567334 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/LICENSE @@ -0,0 +1,202 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/MANIFEST.in b/owl-bot-staging/google-cloud-confidentialcomputing/v1/MANIFEST.in new file mode 100644 index 000000000000..dae249ec8976 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/MANIFEST.in @@ -0,0 +1,20 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +include README.rst LICENSE +recursive-include google *.py *.pyi *.json *.proto py.typed +recursive-include tests * +global-exclude *.py[co] +global-exclude __pycache__ diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/README.rst b/owl-bot-staging/google-cloud-confidentialcomputing/v1/README.rst new file mode 100644 index 000000000000..593004344023 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/README.rst @@ -0,0 +1,143 @@ +Python Client for Google Cloud Confidentialcomputing API +================================================= + +Quick Start +----------- + +In order to use this library, you first need to go through the following steps: + +1. `Select or create a Cloud Platform project.`_ +2. `Enable billing for your project.`_ +3. Enable the Google Cloud Confidentialcomputing API. +4. `Setup Authentication.`_ + +.. _Select or create a Cloud Platform project.: https://console.cloud.google.com/project +.. _Enable billing for your project.: https://cloud.google.com/billing/docs/how-to/modify-project#enable_billing_for_a_project +.. _Setup Authentication.: https://googleapis.dev/python/google-api-core/latest/auth.html + +Installation +~~~~~~~~~~~~ + +Install this library in a `virtualenv`_ using pip. `virtualenv`_ is a tool to +create isolated Python environments. The basic problem it addresses is one of +dependencies and versions, and indirectly permissions. + +With `virtualenv`_, it's possible to install this library without needing system +install permissions, and without clashing with the installed system +dependencies. + +.. _`virtualenv`: https://virtualenv.pypa.io/en/latest/ + + +Mac/Linux +^^^^^^^^^ + +.. code-block:: console + + python3 -m venv + source /bin/activate + /bin/pip install /path/to/library + + +Windows +^^^^^^^ + +.. code-block:: console + + python3 -m venv + \Scripts\activate + \Scripts\pip.exe install \path\to\library + + +Logging +------- + +This library uses the standard Python :code:`logging` functionality to log some RPC events that could be of interest for debugging and monitoring purposes. +Note the following: + +#. Logs may contain sensitive information. Take care to **restrict access to the logs** if they are saved, whether it be on local storage or on Google Cloud Logging. +#. Google may refine the occurrence, level, and content of various log messages in this library without flagging such changes as breaking. **Do not depend on immutability of the logging events**. +#. By default, the logging events from this library are not handled. You must **explicitly configure log handling** using one of the mechanisms below. + + +Simple, environment-based configuration +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +To enable logging for this library without any changes in your code, set the :code:`GOOGLE_SDK_PYTHON_LOGGING_SCOPE` environment variable to a valid Google +logging scope. This configures handling of logging events (at level :code:`logging.DEBUG` or higher) from this library in a default manner, emitting the logged +messages in a structured format. It does not currently allow customizing the logging levels captured nor the handlers, formatters, etc. used for any logging +event. + +A logging scope is a period-separated namespace that begins with :code:`google`, identifying the Python module or package to log. + +- Valid logging scopes: :code:`google`, :code:`google.cloud.asset.v1`, :code:`google.api`, :code:`google.auth`, etc. +- Invalid logging scopes: :code:`foo`, :code:`123`, etc. + +**NOTE**: If the logging scope is invalid, the library does not set up any logging handlers. + + +Examples +^^^^^^^^ + +- Enabling the default handler for all Google-based loggers + +.. code-block:: console + + export GOOGLE_SDK_PYTHON_LOGGING_SCOPE=google + +- Enabling the default handler for a specific Google module (for a client library called :code:`library_v1`): + +.. code-block:: console + + export GOOGLE_SDK_PYTHON_LOGGING_SCOPE=google.cloud.library_v1 + + +Advanced, code-based configuration +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +You can also configure a valid logging scope using Python's standard `logging` mechanism. + + +Examples +^^^^^^^^ + +- Configuring a handler for all Google-based loggers + +.. code-block:: python + + import logging + + from google.cloud.translate_v3 import translate + + base_logger = logging.getLogger("google") + base_logger.addHandler(logging.StreamHandler()) + base_logger.setLevel(logging.DEBUG) + +- Configuring a handler for a specific Google module (for a client library called :code:`library_v1`): + +.. code-block:: python + + import logging + + from google.cloud.translate_v3 import translate + + base_logger = logging.getLogger("google.cloud.library_v1") + base_logger.addHandler(logging.StreamHandler()) + base_logger.setLevel(logging.DEBUG) + + +Logging details +~~~~~~~~~~~~~~~ + +#. Regardless of which of the mechanisms above you use to configure logging for this library, by default logging events are not propagated up to the root + logger from the `google`-level logger. If you need the events to be propagated to the root logger, you must explicitly set + :code:`logging.getLogger("google").propagate = True` in your code. +#. You can mix the different logging configurations above for different Google modules. For example, you may want use a code-based logging configuration for + one library, but decide you need to also set up environment-based logging configuration for another library. + + #. If you attempt to use both code-based and environment-based configuration for the same module, the environment-based configuration will be ineffectual + if the code -based configuration gets applied first. + +#. The Google-specific logging configurations (default handlers for environment-based configuration; not propagating logging events to the root logger) get + executed the first time *any* client library is instantiated in your application, and only if the affected loggers have not been previously configured. + (This is the reason for 2.i. above.) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/_static/custom.css b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/_static/custom.css new file mode 100644 index 000000000000..b0a295464b23 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/_static/custom.css @@ -0,0 +1,20 @@ +div#python2-eol { + border-color: red; + border-width: medium; +} + +/* Ensure minimum width for 'Parameters' / 'Returns' column */ +dl.field-list > dt { + min-width: 100px +} + +/* Insert space between methods for readability */ +dl.method { + padding-top: 10px; + padding-bottom: 10px +} + +/* Insert empty space between classes */ +dl.class { + padding-bottom: 50px +} diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/_templates/layout.html b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/_templates/layout.html new file mode 100644 index 000000000000..95e9c77fcfe1 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/_templates/layout.html @@ -0,0 +1,50 @@ + +{% extends "!layout.html" %} +{%- block content %} +{%- if theme_fixed_sidebar|lower == 'true' %} +
+ {{ sidebar() }} + {%- block document %} +
+ {%- if render_sidebar %} +
+ {%- endif %} + + {%- block relbar_top %} + {%- if theme_show_relbar_top|tobool %} +
+   + {{- rellink_markup () }} +
+ {%- endif %} + {% endblock %} + +
+
+ As of January 1, 2020 this library no longer supports Python 2 on the latest released version. + Library versions released prior to that date will continue to be available. For more information please + visit Python 2 support on Google Cloud. +
+ {% block body %} {% endblock %} +
+ + {%- block relbar_bottom %} + {%- if theme_show_relbar_bottom|tobool %} +
+   + {{- rellink_markup () }} +
+ {%- endif %} + {% endblock %} + + {%- if render_sidebar %} +
+ {%- endif %} +
+ {%- endblock %} +
+
+{%- else %} +{{ super() }} +{%- endif %} +{%- endblock %} diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/conf.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/conf.py new file mode 100644 index 000000000000..e25ab393e702 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/conf.py @@ -0,0 +1,385 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# +# google-cloud-confidentialcomputing documentation build configuration file +# +# This file is execfile()d with the current directory set to its +# containing dir. +# +# Note that not all possible configuration values are present in this +# autogenerated file. +# +# All configuration values have a default; values that are commented out +# serve to show the default. + +import sys +import os +import shlex + +# If extensions (or modules to document with autodoc) are in another directory, +# add these directories to sys.path here. If the directory is relative to the +# documentation root, use os.path.abspath to make it absolute, like shown here. +sys.path.insert(0, os.path.abspath("..")) + +# For plugins that can not read conf.py. +# See also: https://github.com/docascode/sphinx-docfx-yaml/issues/85 +sys.path.insert(0, os.path.abspath(".")) + +__version__ = "" + +# -- General configuration ------------------------------------------------ + +# If your documentation needs a minimal Sphinx version, state it here. +needs_sphinx = "4.5.0" + +# Add any Sphinx extension module names here, as strings. They can be +# extensions coming with Sphinx (named 'sphinx.ext.*') or your custom +# ones. +extensions = [ + "sphinx.ext.autodoc", + "sphinx.ext.autosummary", + "sphinx.ext.intersphinx", + "sphinx.ext.coverage", + "sphinx.ext.doctest", + "sphinx.ext.napoleon", + "sphinx.ext.todo", + "sphinx.ext.viewcode", + "recommonmark", +] + +# autodoc/autosummary flags +autoclass_content = "both" +autodoc_default_options = {"members": True} +autosummary_generate = True + + +# Add any paths that contain templates here, relative to this directory. +templates_path = ["_templates"] + +# The suffix(es) of source filenames. +# You can specify multiple suffix as a list of string: +# source_suffix = ['.rst', '.md'] +source_suffix = [".rst", ".md"] + +# The encoding of source files. +# source_encoding = 'utf-8-sig' + +# The root toctree document. +root_doc = "index" + +# General information about the project. +project = u"google-cloud-confidentialcomputing" +copyright = u"2025, Google, LLC" +author = u"Google APIs" + +# The version info for the project you're documenting, acts as replacement for +# |version| and |release|, also used in various other places throughout the +# built documents. +# +# The full version, including alpha/beta/rc tags. +release = __version__ +# The short X.Y version. +version = ".".join(release.split(".")[0:2]) + +# The language for content autogenerated by Sphinx. Refer to documentation +# for a list of supported languages. +# +# This is also used if you do content translation via gettext catalogs. +# Usually you set "language" from the command line for these cases. +language = None + +# There are two options for replacing |today|: either, you set today to some +# non-false value, then it is used: +# today = '' +# Else, today_fmt is used as the format for a strftime call. +# today_fmt = '%B %d, %Y' + +# List of patterns, relative to source directory, that match files and +# directories to ignore when looking for source files. +exclude_patterns = [ + "_build", + "**/.nox/**/*", + "samples/AUTHORING_GUIDE.md", + "samples/CONTRIBUTING.md", + "samples/snippets/README.rst", +] + +# The reST default role (used for this markup: `text`) to use for all +# documents. +# default_role = None + +# If true, '()' will be appended to :func: etc. cross-reference text. +# add_function_parentheses = True + +# If true, the current module name will be prepended to all description +# unit titles (such as .. function::). +# add_module_names = True + +# If true, sectionauthor and moduleauthor directives will be shown in the +# output. They are ignored by default. +# show_authors = False + +# The name of the Pygments (syntax highlighting) style to use. +pygments_style = "sphinx" + +# A list of ignored prefixes for module index sorting. +# modindex_common_prefix = [] + +# If true, keep warnings as "system message" paragraphs in the built documents. +# keep_warnings = False + +# If true, `todo` and `todoList` produce output, else they produce nothing. +todo_include_todos = True + + +# -- Options for HTML output ---------------------------------------------- + +# The theme to use for HTML and HTML Help pages. See the documentation for +# a list of builtin themes. +html_theme = "alabaster" + +# Theme options are theme-specific and customize the look and feel of a theme +# further. For a list of options available for each theme, see the +# documentation. +html_theme_options = { + "description": "Google Cloud Client Libraries for google-cloud-confidentialcomputing", + "github_user": "googleapis", + "github_repo": "google-cloud-python", + "github_banner": True, + "font_family": "'Roboto', Georgia, sans", + "head_font_family": "'Roboto', Georgia, serif", + "code_font_family": "'Roboto Mono', 'Consolas', monospace", +} + +# Add any paths that contain custom themes here, relative to this directory. +# html_theme_path = [] + +# The name for this set of Sphinx documents. If None, it defaults to +# " v documentation". +# html_title = None + +# A shorter title for the navigation bar. Default is the same as html_title. +# html_short_title = None + +# The name of an image file (relative to this directory) to place at the top +# of the sidebar. +# html_logo = None + +# The name of an image file (within the static path) to use as favicon of the +# docs. This file should be a Windows icon file (.ico) being 16x16 or 32x32 +# pixels large. +# html_favicon = None + +# Add any paths that contain custom static files (such as style sheets) here, +# relative to this directory. They are copied after the builtin static files, +# so a file named "default.css" will overwrite the builtin "default.css". +html_static_path = ["_static"] + +# Add any extra paths that contain custom files (such as robots.txt or +# .htaccess) here, relative to this directory. These files are copied +# directly to the root of the documentation. +# html_extra_path = [] + +# If not '', a 'Last updated on:' timestamp is inserted at every page bottom, +# using the given strftime format. +# html_last_updated_fmt = '%b %d, %Y' + +# If true, SmartyPants will be used to convert quotes and dashes to +# typographically correct entities. +# html_use_smartypants = True + +# Custom sidebar templates, maps document names to template names. +# html_sidebars = {} + +# Additional templates that should be rendered to pages, maps page names to +# template names. +# html_additional_pages = {} + +# If false, no module index is generated. +# html_domain_indices = True + +# If false, no index is generated. +# html_use_index = True + +# If true, the index is split into individual pages for each letter. +# html_split_index = False + +# If true, links to the reST sources are added to the pages. +# html_show_sourcelink = True + +# If true, "Created using Sphinx" is shown in the HTML footer. Default is True. +# html_show_sphinx = True + +# If true, "(C) Copyright ..." is shown in the HTML footer. Default is True. +# html_show_copyright = True + +# If true, an OpenSearch description file will be output, and all pages will +# contain a tag referring to it. The value of this option must be the +# base URL from which the finished HTML is served. +# html_use_opensearch = '' + +# This is the file name suffix for HTML files (e.g. ".xhtml"). +# html_file_suffix = None + +# Language to be used for generating the HTML full-text search index. +# Sphinx supports the following languages: +# 'da', 'de', 'en', 'es', 'fi', 'fr', 'hu', 'it', 'ja' +# 'nl', 'no', 'pt', 'ro', 'ru', 'sv', 'tr' +# html_search_language = 'en' + +# A dictionary with options for the search language support, empty by default. +# Now only 'ja' uses this config value +# html_search_options = {'type': 'default'} + +# The name of a javascript file (relative to the configuration directory) that +# implements a search results scorer. If empty, the default will be used. +# html_search_scorer = 'scorer.js' + +# Output file base name for HTML help builder. +htmlhelp_basename = "google-cloud-confidentialcomputing-doc" + +# -- Options for warnings ------------------------------------------------------ + + +suppress_warnings = [ + # Temporarily suppress this to avoid "more than one target found for + # cross-reference" warning, which are intractable for us to avoid while in + # a mono-repo. + # See https://github.com/sphinx-doc/sphinx/blob + # /2a65ffeef5c107c19084fabdd706cdff3f52d93c/sphinx/domains/python.py#L843 + "ref.python" +] + +# -- Options for LaTeX output --------------------------------------------- + +latex_elements = { + # The paper size ('letterpaper' or 'a4paper'). + # 'papersize': 'letterpaper', + # The font size ('10pt', '11pt' or '12pt'). + # 'pointsize': '10pt', + # Additional stuff for the LaTeX preamble. + # 'preamble': '', + # Latex figure (float) alignment + # 'figure_align': 'htbp', +} + +# Grouping the document tree into LaTeX files. List of tuples +# (source start file, target name, title, +# author, documentclass [howto, manual, or own class]). +latex_documents = [ + ( + root_doc, + "google-cloud-confidentialcomputing.tex", + u"google-cloud-confidentialcomputing Documentation", + author, + "manual", + ) +] + +# The name of an image file (relative to this directory) to place at the top of +# the title page. +# latex_logo = None + +# For "manual" documents, if this is true, then toplevel headings are parts, +# not chapters. +# latex_use_parts = False + +# If true, show page references after internal links. +# latex_show_pagerefs = False + +# If true, show URL addresses after external links. +# latex_show_urls = False + +# Documents to append as an appendix to all manuals. +# latex_appendices = [] + +# If false, no module index is generated. +# latex_domain_indices = True + + +# -- Options for manual page output --------------------------------------- + +# One entry per manual page. List of tuples +# (source start file, name, description, authors, manual section). +man_pages = [ + ( + root_doc, + "google-cloud-confidentialcomputing", + "google-cloud-confidentialcomputing Documentation", + [author], + 1, + ) +] + +# If true, show URL addresses after external links. +# man_show_urls = False + + +# -- Options for Texinfo output ------------------------------------------- + +# Grouping the document tree into Texinfo files. List of tuples +# (source start file, target name, title, author, +# dir menu entry, description, category) +texinfo_documents = [ + ( + root_doc, + "google-cloud-confidentialcomputing", + "google-cloud-confidentialcomputing Documentation", + author, + "google-cloud-confidentialcomputing", + "google-cloud-confidentialcomputing Library", + "APIs", + ) +] + +# Documents to append as an appendix to all manuals. +# texinfo_appendices = [] + +# If false, no module index is generated. +# texinfo_domain_indices = True + +# How to display URL addresses: 'footnote', 'no', or 'inline'. +# texinfo_show_urls = 'footnote' + +# If true, do not generate a @detailmenu in the "Top" node's menu. +# texinfo_no_detailmenu = False + + +# Example configuration for intersphinx: refer to the Python standard library. +intersphinx_mapping = { + "python": ("https://python.readthedocs.org/en/latest/", None), + "google-auth": ("https://googleapis.dev/python/google-auth/latest/", None), + "google.api_core": ( + "https://googleapis.dev/python/google-api-core/latest/", + None, + ), + "grpc": ("https://grpc.github.io/grpc/python/", None), + "proto-plus": ("https://proto-plus-python.readthedocs.io/en/latest/", None), + "protobuf": ("https://googleapis.dev/python/protobuf/latest/", None), +} + + +# Napoleon settings +napoleon_google_docstring = True +napoleon_numpy_docstring = True +napoleon_include_private_with_doc = False +napoleon_include_special_with_doc = True +napoleon_use_admonition_for_examples = False +napoleon_use_admonition_for_notes = False +napoleon_use_admonition_for_references = False +napoleon_use_ivar = False +napoleon_use_param = True +napoleon_use_rtype = True diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/confidential_computing.rst b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/confidential_computing.rst new file mode 100644 index 000000000000..06d7e01926a9 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/confidential_computing.rst @@ -0,0 +1,6 @@ +ConfidentialComputing +--------------------------------------- + +.. automodule:: google.cloud.confidentialcomputing_v1.services.confidential_computing + :members: + :inherited-members: diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/services_.rst b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/services_.rst new file mode 100644 index 000000000000..0e44260b2eae --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/services_.rst @@ -0,0 +1,6 @@ +Services for Google Cloud Confidentialcomputing v1 API +====================================================== +.. toctree:: + :maxdepth: 2 + + confidential_computing diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/types_.rst b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/types_.rst new file mode 100644 index 000000000000..ae5970c73d34 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/types_.rst @@ -0,0 +1,6 @@ +Types for Google Cloud Confidentialcomputing v1 API +=================================================== + +.. automodule:: google.cloud.confidentialcomputing_v1.types + :members: + :show-inheritance: diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/index.rst b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/index.rst new file mode 100644 index 000000000000..0566de600bc8 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/index.rst @@ -0,0 +1,10 @@ +.. include:: multiprocessing.rst + + +API Reference +------------- +.. toctree:: + :maxdepth: 2 + + confidentialcomputing_v1/services_ + confidentialcomputing_v1/types_ diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/multiprocessing.rst b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/multiprocessing.rst new file mode 100644 index 000000000000..536d17b2ea65 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/multiprocessing.rst @@ -0,0 +1,7 @@ +.. note:: + + Because this client uses :mod:`grpc` library, it is safe to + share instances across threads. In multiprocessing scenarios, the best + practice is to create client instances *after* the invocation of + :func:`os.fork` by :class:`multiprocessing.pool.Pool` or + :class:`multiprocessing.Process`. diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/__init__.py new file mode 100644 index 000000000000..9dabe5d04bb0 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/__init__.py @@ -0,0 +1,71 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +from google.cloud.confidentialcomputing import gapic_version as package_version + +__version__ = package_version.__version__ + + +from google.cloud.confidentialcomputing_v1.services.confidential_computing.client import ConfidentialComputingClient +from google.cloud.confidentialcomputing_v1.services.confidential_computing.async_client import ConfidentialComputingAsyncClient + +from google.cloud.confidentialcomputing_v1.types.service import AwsPrincipalTagsOptions +from google.cloud.confidentialcomputing_v1.types.service import Challenge +from google.cloud.confidentialcomputing_v1.types.service import ConfidentialSpaceInfo +from google.cloud.confidentialcomputing_v1.types.service import ContainerImageSignature +from google.cloud.confidentialcomputing_v1.types.service import CreateChallengeRequest +from google.cloud.confidentialcomputing_v1.types.service import GceShieldedIdentity +from google.cloud.confidentialcomputing_v1.types.service import GcpCredentials +from google.cloud.confidentialcomputing_v1.types.service import SevSnpAttestation +from google.cloud.confidentialcomputing_v1.types.service import SignedEntity +from google.cloud.confidentialcomputing_v1.types.service import TdxCcelAttestation +from google.cloud.confidentialcomputing_v1.types.service import TokenOptions +from google.cloud.confidentialcomputing_v1.types.service import TpmAttestation +from google.cloud.confidentialcomputing_v1.types.service import VerifyAttestationRequest +from google.cloud.confidentialcomputing_v1.types.service import VerifyAttestationResponse +from google.cloud.confidentialcomputing_v1.types.service import VerifyConfidentialGkeRequest +from google.cloud.confidentialcomputing_v1.types.service import VerifyConfidentialGkeResponse +from google.cloud.confidentialcomputing_v1.types.service import VerifyConfidentialSpaceRequest +from google.cloud.confidentialcomputing_v1.types.service import VerifyConfidentialSpaceResponse +from google.cloud.confidentialcomputing_v1.types.service import SignatureType +from google.cloud.confidentialcomputing_v1.types.service import SigningAlgorithm +from google.cloud.confidentialcomputing_v1.types.service import TokenProfile +from google.cloud.confidentialcomputing_v1.types.service import TokenType + +__all__ = ('ConfidentialComputingClient', + 'ConfidentialComputingAsyncClient', + 'AwsPrincipalTagsOptions', + 'Challenge', + 'ConfidentialSpaceInfo', + 'ContainerImageSignature', + 'CreateChallengeRequest', + 'GceShieldedIdentity', + 'GcpCredentials', + 'SevSnpAttestation', + 'SignedEntity', + 'TdxCcelAttestation', + 'TokenOptions', + 'TpmAttestation', + 'VerifyAttestationRequest', + 'VerifyAttestationResponse', + 'VerifyConfidentialGkeRequest', + 'VerifyConfidentialGkeResponse', + 'VerifyConfidentialSpaceRequest', + 'VerifyConfidentialSpaceResponse', + 'SignatureType', + 'SigningAlgorithm', + 'TokenProfile', + 'TokenType', +) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/gapic_version.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/gapic_version.py new file mode 100644 index 000000000000..20a9cd975b02 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/gapic_version.py @@ -0,0 +1,16 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +__version__ = "0.0.0" # {x-release-please-version} diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/py.typed b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/py.typed new file mode 100644 index 000000000000..5e085fa19b06 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/py.typed @@ -0,0 +1,2 @@ +# Marker file for PEP 561. +# The google-cloud-confidentialcomputing package uses inline types. diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/__init__.py new file mode 100644 index 000000000000..2674431e4ee1 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/__init__.py @@ -0,0 +1,72 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +from google.cloud.confidentialcomputing_v1 import gapic_version as package_version + +__version__ = package_version.__version__ + + +from .services.confidential_computing import ConfidentialComputingClient +from .services.confidential_computing import ConfidentialComputingAsyncClient + +from .types.service import AwsPrincipalTagsOptions +from .types.service import Challenge +from .types.service import ConfidentialSpaceInfo +from .types.service import ContainerImageSignature +from .types.service import CreateChallengeRequest +from .types.service import GceShieldedIdentity +from .types.service import GcpCredentials +from .types.service import SevSnpAttestation +from .types.service import SignedEntity +from .types.service import TdxCcelAttestation +from .types.service import TokenOptions +from .types.service import TpmAttestation +from .types.service import VerifyAttestationRequest +from .types.service import VerifyAttestationResponse +from .types.service import VerifyConfidentialGkeRequest +from .types.service import VerifyConfidentialGkeResponse +from .types.service import VerifyConfidentialSpaceRequest +from .types.service import VerifyConfidentialSpaceResponse +from .types.service import SignatureType +from .types.service import SigningAlgorithm +from .types.service import TokenProfile +from .types.service import TokenType + +__all__ = ( + 'ConfidentialComputingAsyncClient', +'AwsPrincipalTagsOptions', +'Challenge', +'ConfidentialComputingClient', +'ConfidentialSpaceInfo', +'ContainerImageSignature', +'CreateChallengeRequest', +'GceShieldedIdentity', +'GcpCredentials', +'SevSnpAttestation', +'SignatureType', +'SignedEntity', +'SigningAlgorithm', +'TdxCcelAttestation', +'TokenOptions', +'TokenProfile', +'TokenType', +'TpmAttestation', +'VerifyAttestationRequest', +'VerifyAttestationResponse', +'VerifyConfidentialGkeRequest', +'VerifyConfidentialGkeResponse', +'VerifyConfidentialSpaceRequest', +'VerifyConfidentialSpaceResponse', +) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/gapic_metadata.json b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/gapic_metadata.json new file mode 100644 index 000000000000..5227e556513e --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/gapic_metadata.json @@ -0,0 +1,88 @@ + { + "comment": "This file maps proto services/RPCs to the corresponding library clients/methods", + "language": "python", + "libraryPackage": "google.cloud.confidentialcomputing_v1", + "protoPackage": "google.cloud.confidentialcomputing.v1", + "schema": "1.0", + "services": { + "ConfidentialComputing": { + "clients": { + "grpc": { + "libraryClient": "ConfidentialComputingClient", + "rpcs": { + "CreateChallenge": { + "methods": [ + "create_challenge" + ] + }, + "VerifyAttestation": { + "methods": [ + "verify_attestation" + ] + }, + "VerifyConfidentialGke": { + "methods": [ + "verify_confidential_gke" + ] + }, + "VerifyConfidentialSpace": { + "methods": [ + "verify_confidential_space" + ] + } + } + }, + "grpc-async": { + "libraryClient": "ConfidentialComputingAsyncClient", + "rpcs": { + "CreateChallenge": { + "methods": [ + "create_challenge" + ] + }, + "VerifyAttestation": { + "methods": [ + "verify_attestation" + ] + }, + "VerifyConfidentialGke": { + "methods": [ + "verify_confidential_gke" + ] + }, + "VerifyConfidentialSpace": { + "methods": [ + "verify_confidential_space" + ] + } + } + }, + "rest": { + "libraryClient": "ConfidentialComputingClient", + "rpcs": { + "CreateChallenge": { + "methods": [ + "create_challenge" + ] + }, + "VerifyAttestation": { + "methods": [ + "verify_attestation" + ] + }, + "VerifyConfidentialGke": { + "methods": [ + "verify_confidential_gke" + ] + }, + "VerifyConfidentialSpace": { + "methods": [ + "verify_confidential_space" + ] + } + } + } + } + } + } +} diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/gapic_version.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/gapic_version.py new file mode 100644 index 000000000000..20a9cd975b02 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/gapic_version.py @@ -0,0 +1,16 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +__version__ = "0.0.0" # {x-release-please-version} diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/py.typed b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/py.typed new file mode 100644 index 000000000000..5e085fa19b06 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/py.typed @@ -0,0 +1,2 @@ +# Marker file for PEP 561. +# The google-cloud-confidentialcomputing package uses inline types. diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/__init__.py new file mode 100644 index 000000000000..cbf94b283c70 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/__init__.py @@ -0,0 +1,15 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/__init__.py new file mode 100644 index 000000000000..000ad9033f05 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/__init__.py @@ -0,0 +1,22 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +from .client import ConfidentialComputingClient +from .async_client import ConfidentialComputingAsyncClient + +__all__ = ( + 'ConfidentialComputingClient', + 'ConfidentialComputingAsyncClient', +) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/async_client.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/async_client.py new file mode 100644 index 000000000000..97512c2a575f --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/async_client.py @@ -0,0 +1,760 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +import logging as std_logging +from collections import OrderedDict +import re +from typing import Dict, Callable, Mapping, MutableMapping, MutableSequence, Optional, Sequence, Tuple, Type, Union + +from google.cloud.confidentialcomputing_v1 import gapic_version as package_version + +from google.api_core.client_options import ClientOptions +from google.api_core import exceptions as core_exceptions +from google.api_core import gapic_v1 +from google.api_core import retry_async as retries +from google.auth import credentials as ga_credentials # type: ignore +from google.oauth2 import service_account # type: ignore +import google.protobuf + + +try: + OptionalRetry = Union[retries.AsyncRetry, gapic_v1.method._MethodDefault, None] +except AttributeError: # pragma: NO COVER + OptionalRetry = Union[retries.AsyncRetry, object, None] # type: ignore + +from google.cloud.confidentialcomputing_v1.types import service +from google.cloud.location import locations_pb2 # type: ignore +from google.protobuf import timestamp_pb2 # type: ignore +from google.rpc import status_pb2 # type: ignore +from .transports.base import ConfidentialComputingTransport, DEFAULT_CLIENT_INFO +from .transports.grpc_asyncio import ConfidentialComputingGrpcAsyncIOTransport +from .client import ConfidentialComputingClient + +try: + from google.api_core import client_logging # type: ignore + CLIENT_LOGGING_SUPPORTED = True # pragma: NO COVER +except ImportError: # pragma: NO COVER + CLIENT_LOGGING_SUPPORTED = False + +_LOGGER = std_logging.getLogger(__name__) + +class ConfidentialComputingAsyncClient: + """Service describing handlers for resources""" + + _client: ConfidentialComputingClient + + # Copy defaults from the synchronous client for use here. + # Note: DEFAULT_ENDPOINT is deprecated. Use _DEFAULT_ENDPOINT_TEMPLATE instead. + DEFAULT_ENDPOINT = ConfidentialComputingClient.DEFAULT_ENDPOINT + DEFAULT_MTLS_ENDPOINT = ConfidentialComputingClient.DEFAULT_MTLS_ENDPOINT + _DEFAULT_ENDPOINT_TEMPLATE = ConfidentialComputingClient._DEFAULT_ENDPOINT_TEMPLATE + _DEFAULT_UNIVERSE = ConfidentialComputingClient._DEFAULT_UNIVERSE + + challenge_path = staticmethod(ConfidentialComputingClient.challenge_path) + parse_challenge_path = staticmethod(ConfidentialComputingClient.parse_challenge_path) + common_billing_account_path = staticmethod(ConfidentialComputingClient.common_billing_account_path) + parse_common_billing_account_path = staticmethod(ConfidentialComputingClient.parse_common_billing_account_path) + common_folder_path = staticmethod(ConfidentialComputingClient.common_folder_path) + parse_common_folder_path = staticmethod(ConfidentialComputingClient.parse_common_folder_path) + common_organization_path = staticmethod(ConfidentialComputingClient.common_organization_path) + parse_common_organization_path = staticmethod(ConfidentialComputingClient.parse_common_organization_path) + common_project_path = staticmethod(ConfidentialComputingClient.common_project_path) + parse_common_project_path = staticmethod(ConfidentialComputingClient.parse_common_project_path) + common_location_path = staticmethod(ConfidentialComputingClient.common_location_path) + parse_common_location_path = staticmethod(ConfidentialComputingClient.parse_common_location_path) + + @classmethod + def from_service_account_info(cls, info: dict, *args, **kwargs): + """Creates an instance of this client using the provided credentials + info. + + Args: + info (dict): The service account private key info. + args: Additional arguments to pass to the constructor. + kwargs: Additional arguments to pass to the constructor. + + Returns: + ConfidentialComputingAsyncClient: The constructed client. + """ + return ConfidentialComputingClient.from_service_account_info.__func__(ConfidentialComputingAsyncClient, info, *args, **kwargs) # type: ignore + + @classmethod + def from_service_account_file(cls, filename: str, *args, **kwargs): + """Creates an instance of this client using the provided credentials + file. + + Args: + filename (str): The path to the service account private key json + file. + args: Additional arguments to pass to the constructor. + kwargs: Additional arguments to pass to the constructor. + + Returns: + ConfidentialComputingAsyncClient: The constructed client. + """ + return ConfidentialComputingClient.from_service_account_file.__func__(ConfidentialComputingAsyncClient, filename, *args, **kwargs) # type: ignore + + from_service_account_json = from_service_account_file + + @classmethod + def get_mtls_endpoint_and_cert_source(cls, client_options: Optional[ClientOptions] = None): + """Return the API endpoint and client cert source for mutual TLS. + + The client cert source is determined in the following order: + (1) if `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is not "true", the + client cert source is None. + (2) if `client_options.client_cert_source` is provided, use the provided one; if the + default client cert source exists, use the default one; otherwise the client cert + source is None. + + The API endpoint is determined in the following order: + (1) if `client_options.api_endpoint` if provided, use the provided one. + (2) if `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is "always", use the + default mTLS endpoint; if the environment variable is "never", use the default API + endpoint; otherwise if client cert source exists, use the default mTLS endpoint, otherwise + use the default API endpoint. + + More details can be found at https://google.aip.dev/auth/4114. + + Args: + client_options (google.api_core.client_options.ClientOptions): Custom options for the + client. Only the `api_endpoint` and `client_cert_source` properties may be used + in this method. + + Returns: + Tuple[str, Callable[[], Tuple[bytes, bytes]]]: returns the API endpoint and the + client cert source to use. + + Raises: + google.auth.exceptions.MutualTLSChannelError: If any errors happen. + """ + return ConfidentialComputingClient.get_mtls_endpoint_and_cert_source(client_options) # type: ignore + + @property + def transport(self) -> ConfidentialComputingTransport: + """Returns the transport used by the client instance. + + Returns: + ConfidentialComputingTransport: The transport used by the client instance. + """ + return self._client.transport + + @property + def api_endpoint(self): + """Return the API endpoint used by the client instance. + + Returns: + str: The API endpoint used by the client instance. + """ + return self._client._api_endpoint + + @property + def universe_domain(self) -> str: + """Return the universe domain used by the client instance. + + Returns: + str: The universe domain used + by the client instance. + """ + return self._client._universe_domain + + get_transport_class = ConfidentialComputingClient.get_transport_class + + def __init__(self, *, + credentials: Optional[ga_credentials.Credentials] = None, + transport: Optional[Union[str, ConfidentialComputingTransport, Callable[..., ConfidentialComputingTransport]]] = "grpc_asyncio", + client_options: Optional[ClientOptions] = None, + client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO, + ) -> None: + """Instantiates the confidential computing async client. + + Args: + credentials (Optional[google.auth.credentials.Credentials]): The + authorization credentials to attach to requests. These + credentials identify the application to the service; if none + are specified, the client will attempt to ascertain the + credentials from the environment. + transport (Optional[Union[str,ConfidentialComputingTransport,Callable[..., ConfidentialComputingTransport]]]): + The transport to use, or a Callable that constructs and returns a new transport to use. + If a Callable is given, it will be called with the same set of initialization + arguments as used in the ConfidentialComputingTransport constructor. + If set to None, a transport is chosen automatically. + client_options (Optional[Union[google.api_core.client_options.ClientOptions, dict]]): + Custom options for the client. + + 1. The ``api_endpoint`` property can be used to override the + default endpoint provided by the client when ``transport`` is + not explicitly provided. Only if this property is not set and + ``transport`` was not explicitly provided, the endpoint is + determined by the GOOGLE_API_USE_MTLS_ENDPOINT environment + variable, which have one of the following values: + "always" (always use the default mTLS endpoint), "never" (always + use the default regular endpoint) and "auto" (auto-switch to the + default mTLS endpoint if client certificate is present; this is + the default value). + + 2. If the GOOGLE_API_USE_CLIENT_CERTIFICATE environment variable + is "true", then the ``client_cert_source`` property can be used + to provide a client certificate for mTLS transport. If + not provided, the default SSL client certificate will be used if + present. If GOOGLE_API_USE_CLIENT_CERTIFICATE is "false" or not + set, no client certificate will be used. + + 3. The ``universe_domain`` property can be used to override the + default "googleapis.com" universe. Note that ``api_endpoint`` + property still takes precedence; and ``universe_domain`` is + currently not supported for mTLS. + + client_info (google.api_core.gapic_v1.client_info.ClientInfo): + The client info used to send a user-agent string along with + API requests. If ``None``, then default info will be used. + Generally, you only need to set this if you're developing + your own client library. + + Raises: + google.auth.exceptions.MutualTlsChannelError: If mutual TLS transport + creation failed for any reason. + """ + self._client = ConfidentialComputingClient( + credentials=credentials, + transport=transport, + client_options=client_options, + client_info=client_info, + + ) + + if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(std_logging.DEBUG): # pragma: NO COVER + _LOGGER.debug( + "Created client `google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient`.", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "universeDomain": getattr(self._client._transport._credentials, "universe_domain", ""), + "credentialsType": f"{type(self._client._transport._credentials).__module__}.{type(self._client._transport._credentials).__qualname__}", + "credentialsInfo": getattr(self.transport._credentials, "get_cred_info", lambda: None)(), + } if hasattr(self._client._transport, "_credentials") else { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "credentialsType": None, + } + ) + + async def create_challenge(self, + request: Optional[Union[service.CreateChallengeRequest, dict]] = None, + *, + parent: Optional[str] = None, + challenge: Optional[service.Challenge] = None, + retry: OptionalRetry = gapic_v1.method.DEFAULT, + timeout: Union[float, object] = gapic_v1.method.DEFAULT, + metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), + ) -> service.Challenge: + r"""Creates a new Challenge in a given project and + location. + + .. code-block:: python + + # This snippet has been automatically generated and should be regarded as a + # code template only. + # It will require modifications to work: + # - It may require correct/in-range values for request initialization. + # - It may require specifying regional endpoints when creating the service + # client as shown in: + # https://googleapis.dev/python/google-api-core/latest/client_options.html + from google.cloud import confidentialcomputing_v1 + + async def sample_create_challenge(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingAsyncClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.CreateChallengeRequest( + parent="parent_value", + ) + + # Make the request + response = await client.create_challenge(request=request) + + # Handle the response + print(response) + + Args: + request (Optional[Union[google.cloud.confidentialcomputing_v1.types.CreateChallengeRequest, dict]]): + The request object. Message for creating a Challenge + parent (:class:`str`): + Required. The resource name of the location where the + Challenge will be used, in the format + ``projects/*/locations/*``. + + This corresponds to the ``parent`` field + on the ``request`` instance; if ``request`` is provided, this + should not be set. + challenge (:class:`google.cloud.confidentialcomputing_v1.types.Challenge`): + Required. The Challenge to be + created. Currently this field can be + empty as all the Challenge fields are + set by the server. + + This corresponds to the ``challenge`` field + on the ``request`` instance; if ``request`` is provided, this + should not be set. + retry (google.api_core.retry_async.AsyncRetry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + google.cloud.confidentialcomputing_v1.types.Challenge: + A Challenge from the server used to + guarantee freshness of attestations + + """ + # Create or coerce a protobuf request object. + # - Quick check: If we got a request object, we should *not* have + # gotten any keyword arguments that map to the request. + flattened_params = [parent, challenge] + has_flattened_params = len([param for param in flattened_params if param is not None]) > 0 + if request is not None and has_flattened_params: + raise ValueError("If the `request` argument is set, then none of " + "the individual field arguments should be set.") + + # - Use the request object if provided (there's no risk of modifying the input as + # there are no flattened fields), or create one. + if not isinstance(request, service.CreateChallengeRequest): + request = service.CreateChallengeRequest(request) + + # If we have keyword arguments corresponding to fields on the + # request, apply these. + if parent is not None: + request.parent = parent + if challenge is not None: + request.challenge = challenge + + # Wrap the RPC method; this adds retry and timeout information, + # and friendly error handling. + rpc = self._client._transport._wrapped_methods[self._client._transport.create_challenge] + + # Certain fields should be provided within the metadata header; + # add these here. + metadata = tuple(metadata) + ( + gapic_v1.routing_header.to_grpc_metadata(( + ("parent", request.parent), + )), + ) + + # Validate the universe domain. + self._client._validate_universe_domain() + + # Send the request. + response = await rpc( + request, + retry=retry, + timeout=timeout, + metadata=metadata, + ) + + # Done; return the response. + return response + + async def verify_attestation(self, + request: Optional[Union[service.VerifyAttestationRequest, dict]] = None, + *, + retry: OptionalRetry = gapic_v1.method.DEFAULT, + timeout: Union[float, object] = gapic_v1.method.DEFAULT, + metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), + ) -> service.VerifyAttestationResponse: + r"""Verifies the provided attestation info, returning a + signed attestation token. + + .. code-block:: python + + # This snippet has been automatically generated and should be regarded as a + # code template only. + # It will require modifications to work: + # - It may require correct/in-range values for request initialization. + # - It may require specifying regional endpoints when creating the service + # client as shown in: + # https://googleapis.dev/python/google-api-core/latest/client_options.html + from google.cloud import confidentialcomputing_v1 + + async def sample_verify_attestation(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingAsyncClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.VerifyAttestationRequest( + challenge="challenge_value", + ) + + # Make the request + response = await client.verify_attestation(request=request) + + # Handle the response + print(response) + + Args: + request (Optional[Union[google.cloud.confidentialcomputing_v1.types.VerifyAttestationRequest, dict]]): + The request object. A request for an attestation token, + providing all the necessary information + needed for this service to verify the + platform state of the requestor. + retry (google.api_core.retry_async.AsyncRetry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + google.cloud.confidentialcomputing_v1.types.VerifyAttestationResponse: + A response once an attestation has + been successfully verified, containing a + signed attestation token. + + """ + # Create or coerce a protobuf request object. + # - Use the request object if provided (there's no risk of modifying the input as + # there are no flattened fields), or create one. + if not isinstance(request, service.VerifyAttestationRequest): + request = service.VerifyAttestationRequest(request) + + # Wrap the RPC method; this adds retry and timeout information, + # and friendly error handling. + rpc = self._client._transport._wrapped_methods[self._client._transport.verify_attestation] + + # Certain fields should be provided within the metadata header; + # add these here. + metadata = tuple(metadata) + ( + gapic_v1.routing_header.to_grpc_metadata(( + ("challenge", request.challenge), + )), + ) + + # Validate the universe domain. + self._client._validate_universe_domain() + + # Send the request. + response = await rpc( + request, + retry=retry, + timeout=timeout, + metadata=metadata, + ) + + # Done; return the response. + return response + + async def verify_confidential_space(self, + request: Optional[Union[service.VerifyConfidentialSpaceRequest, dict]] = None, + *, + retry: OptionalRetry = gapic_v1.method.DEFAULT, + timeout: Union[float, object] = gapic_v1.method.DEFAULT, + metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), + ) -> service.VerifyConfidentialSpaceResponse: + r"""Verifies whether the provided attestation info is + valid, returning a signed attestation token if so. + + .. code-block:: python + + # This snippet has been automatically generated and should be regarded as a + # code template only. + # It will require modifications to work: + # - It may require correct/in-range values for request initialization. + # - It may require specifying regional endpoints when creating the service + # client as shown in: + # https://googleapis.dev/python/google-api-core/latest/client_options.html + from google.cloud import confidentialcomputing_v1 + + async def sample_verify_confidential_space(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingAsyncClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.VerifyConfidentialSpaceRequest( + challenge="challenge_value", + ) + + # Make the request + response = await client.verify_confidential_space(request=request) + + # Handle the response + print(response) + + Args: + request (Optional[Union[google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceRequest, dict]]): + The request object. A request for an attestation token, + providing all the necessary information + needed for this service to verify the + platform state of the requestor. + retry (google.api_core.retry_async.AsyncRetry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceResponse: + VerifyConfidentialSpaceResponse is + returned once a Confidential Space + attestation has been successfully + verified, containing a signed token. + + """ + # Create or coerce a protobuf request object. + # - Use the request object if provided (there's no risk of modifying the input as + # there are no flattened fields), or create one. + if not isinstance(request, service.VerifyConfidentialSpaceRequest): + request = service.VerifyConfidentialSpaceRequest(request) + + # Wrap the RPC method; this adds retry and timeout information, + # and friendly error handling. + rpc = self._client._transport._wrapped_methods[self._client._transport.verify_confidential_space] + + # Certain fields should be provided within the metadata header; + # add these here. + metadata = tuple(metadata) + ( + gapic_v1.routing_header.to_grpc_metadata(( + ("challenge", request.challenge), + )), + ) + + # Validate the universe domain. + self._client._validate_universe_domain() + + # Send the request. + response = await rpc( + request, + retry=retry, + timeout=timeout, + metadata=metadata, + ) + + # Done; return the response. + return response + + async def verify_confidential_gke(self, + request: Optional[Union[service.VerifyConfidentialGkeRequest, dict]] = None, + *, + retry: OptionalRetry = gapic_v1.method.DEFAULT, + timeout: Union[float, object] = gapic_v1.method.DEFAULT, + metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), + ) -> service.VerifyConfidentialGkeResponse: + r"""Verifies the provided Confidential GKE attestation + info, returning a signed OIDC token. + + .. code-block:: python + + # This snippet has been automatically generated and should be regarded as a + # code template only. + # It will require modifications to work: + # - It may require correct/in-range values for request initialization. + # - It may require specifying regional endpoints when creating the service + # client as shown in: + # https://googleapis.dev/python/google-api-core/latest/client_options.html + from google.cloud import confidentialcomputing_v1 + + async def sample_verify_confidential_gke(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingAsyncClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.VerifyConfidentialGkeRequest( + challenge="challenge_value", + ) + + # Make the request + response = await client.verify_confidential_gke(request=request) + + # Handle the response + print(response) + + Args: + request (Optional[Union[google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeRequest, dict]]): + The request object. A request for an attestation token, + providing all the necessary information + needed for this service to verify + Confidential GKE platform state of the + requestor. + retry (google.api_core.retry_async.AsyncRetry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeResponse: + VerifyConfidentialGkeResponse + response is returened once a + Confidential GKE attestation has been + successfully verified, containing a + signed OIDC token. + + """ + # Create or coerce a protobuf request object. + # - Use the request object if provided (there's no risk of modifying the input as + # there are no flattened fields), or create one. + if not isinstance(request, service.VerifyConfidentialGkeRequest): + request = service.VerifyConfidentialGkeRequest(request) + + # Wrap the RPC method; this adds retry and timeout information, + # and friendly error handling. + rpc = self._client._transport._wrapped_methods[self._client._transport.verify_confidential_gke] + + # Certain fields should be provided within the metadata header; + # add these here. + metadata = tuple(metadata) + ( + gapic_v1.routing_header.to_grpc_metadata(( + ("challenge", request.challenge), + )), + ) + + # Validate the universe domain. + self._client._validate_universe_domain() + + # Send the request. + response = await rpc( + request, + retry=retry, + timeout=timeout, + metadata=metadata, + ) + + # Done; return the response. + return response + + async def get_location( + self, + request: Optional[locations_pb2.GetLocationRequest] = None, + *, + retry: OptionalRetry = gapic_v1.method.DEFAULT, + timeout: Union[float, object] = gapic_v1.method.DEFAULT, + metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), + ) -> locations_pb2.Location: + r"""Gets information about a location. + + Args: + request (:class:`~.location_pb2.GetLocationRequest`): + The request object. Request message for + `GetLocation` method. + retry (google.api_core.retry_async.AsyncRetry): Designation of what errors, + if any, should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + Returns: + ~.location_pb2.Location: + Location object. + """ + # Create or coerce a protobuf request object. + # The request isn't a proto-plus wrapped type, + # so it must be constructed via keyword expansion. + if isinstance(request, dict): + request = locations_pb2.GetLocationRequest(**request) + + # Wrap the RPC method; this adds retry and timeout information, + # and friendly error handling. + rpc = self.transport._wrapped_methods[self._client._transport.get_location] + + # Certain fields should be provided within the metadata header; + # add these here. + metadata = tuple(metadata) + ( + gapic_v1.routing_header.to_grpc_metadata( + (("name", request.name),)), + ) + + # Validate the universe domain. + self._client._validate_universe_domain() + + # Send the request. + response = await rpc( + request, retry=retry, timeout=timeout, metadata=metadata,) + + # Done; return the response. + return response + + async def list_locations( + self, + request: Optional[locations_pb2.ListLocationsRequest] = None, + *, + retry: OptionalRetry = gapic_v1.method.DEFAULT, + timeout: Union[float, object] = gapic_v1.method.DEFAULT, + metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), + ) -> locations_pb2.ListLocationsResponse: + r"""Lists information about the supported locations for this service. + + Args: + request (:class:`~.location_pb2.ListLocationsRequest`): + The request object. Request message for + `ListLocations` method. + retry (google.api_core.retry_async.AsyncRetry): Designation of what errors, + if any, should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + Returns: + ~.location_pb2.ListLocationsResponse: + Response message for ``ListLocations`` method. + """ + # Create or coerce a protobuf request object. + # The request isn't a proto-plus wrapped type, + # so it must be constructed via keyword expansion. + if isinstance(request, dict): + request = locations_pb2.ListLocationsRequest(**request) + + # Wrap the RPC method; this adds retry and timeout information, + # and friendly error handling. + rpc = self.transport._wrapped_methods[self._client._transport.list_locations] + + # Certain fields should be provided within the metadata header; + # add these here. + metadata = tuple(metadata) + ( + gapic_v1.routing_header.to_grpc_metadata( + (("name", request.name),)), + ) + + # Validate the universe domain. + self._client._validate_universe_domain() + + # Send the request. + response = await rpc( + request, retry=retry, timeout=timeout, metadata=metadata,) + + # Done; return the response. + return response + + async def __aenter__(self) -> "ConfidentialComputingAsyncClient": + return self + + async def __aexit__(self, exc_type, exc, tb): + await self.transport.close() + +DEFAULT_CLIENT_INFO = gapic_v1.client_info.ClientInfo(gapic_version=package_version.__version__) + +if hasattr(DEFAULT_CLIENT_INFO, "protobuf_runtime_version"): # pragma: NO COVER + DEFAULT_CLIENT_INFO.protobuf_runtime_version = google.protobuf.__version__ + + +__all__ = ( + "ConfidentialComputingAsyncClient", +) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/client.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/client.py new file mode 100644 index 000000000000..b269902f541e --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/client.py @@ -0,0 +1,1123 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +from collections import OrderedDict +from http import HTTPStatus +import json +import logging as std_logging +import os +import re +from typing import Dict, Callable, Mapping, MutableMapping, MutableSequence, Optional, Sequence, Tuple, Type, Union, cast +import warnings + +from google.cloud.confidentialcomputing_v1 import gapic_version as package_version + +from google.api_core import client_options as client_options_lib +from google.api_core import exceptions as core_exceptions +from google.api_core import gapic_v1 +from google.api_core import retry as retries +from google.auth import credentials as ga_credentials # type: ignore +from google.auth.transport import mtls # type: ignore +from google.auth.transport.grpc import SslCredentials # type: ignore +from google.auth.exceptions import MutualTLSChannelError # type: ignore +from google.oauth2 import service_account # type: ignore +import google.protobuf + +try: + OptionalRetry = Union[retries.Retry, gapic_v1.method._MethodDefault, None] +except AttributeError: # pragma: NO COVER + OptionalRetry = Union[retries.Retry, object, None] # type: ignore + +try: + from google.api_core import client_logging # type: ignore + CLIENT_LOGGING_SUPPORTED = True # pragma: NO COVER +except ImportError: # pragma: NO COVER + CLIENT_LOGGING_SUPPORTED = False + +_LOGGER = std_logging.getLogger(__name__) + +from google.cloud.confidentialcomputing_v1.types import service +from google.cloud.location import locations_pb2 # type: ignore +from google.protobuf import timestamp_pb2 # type: ignore +from google.rpc import status_pb2 # type: ignore +from .transports.base import ConfidentialComputingTransport, DEFAULT_CLIENT_INFO +from .transports.grpc import ConfidentialComputingGrpcTransport +from .transports.grpc_asyncio import ConfidentialComputingGrpcAsyncIOTransport +from .transports.rest import ConfidentialComputingRestTransport + + +class ConfidentialComputingClientMeta(type): + """Metaclass for the ConfidentialComputing client. + + This provides class-level methods for building and retrieving + support objects (e.g. transport) without polluting the client instance + objects. + """ + _transport_registry = OrderedDict() # type: Dict[str, Type[ConfidentialComputingTransport]] + _transport_registry["grpc"] = ConfidentialComputingGrpcTransport + _transport_registry["grpc_asyncio"] = ConfidentialComputingGrpcAsyncIOTransport + _transport_registry["rest"] = ConfidentialComputingRestTransport + + def get_transport_class(cls, + label: Optional[str] = None, + ) -> Type[ConfidentialComputingTransport]: + """Returns an appropriate transport class. + + Args: + label: The name of the desired transport. If none is + provided, then the first transport in the registry is used. + + Returns: + The transport class to use. + """ + # If a specific transport is requested, return that one. + if label: + return cls._transport_registry[label] + + # No transport is requested; return the default (that is, the first one + # in the dictionary). + return next(iter(cls._transport_registry.values())) + + +class ConfidentialComputingClient(metaclass=ConfidentialComputingClientMeta): + """Service describing handlers for resources""" + + @staticmethod + def _get_default_mtls_endpoint(api_endpoint): + """Converts api endpoint to mTLS endpoint. + + Convert "*.sandbox.googleapis.com" and "*.googleapis.com" to + "*.mtls.sandbox.googleapis.com" and "*.mtls.googleapis.com" respectively. + Args: + api_endpoint (Optional[str]): the api endpoint to convert. + Returns: + str: converted mTLS api endpoint. + """ + if not api_endpoint: + return api_endpoint + + mtls_endpoint_re = re.compile( + r"(?P[^.]+)(?P\.mtls)?(?P\.sandbox)?(?P\.googleapis\.com)?" + ) + + m = mtls_endpoint_re.match(api_endpoint) + name, mtls, sandbox, googledomain = m.groups() + if mtls or not googledomain: + return api_endpoint + + if sandbox: + return api_endpoint.replace( + "sandbox.googleapis.com", "mtls.sandbox.googleapis.com" + ) + + return api_endpoint.replace(".googleapis.com", ".mtls.googleapis.com") + + # Note: DEFAULT_ENDPOINT is deprecated. Use _DEFAULT_ENDPOINT_TEMPLATE instead. + DEFAULT_ENDPOINT = "confidentialcomputing.googleapis.com" + DEFAULT_MTLS_ENDPOINT = _get_default_mtls_endpoint.__func__( # type: ignore + DEFAULT_ENDPOINT + ) + + _DEFAULT_ENDPOINT_TEMPLATE = "confidentialcomputing.{UNIVERSE_DOMAIN}" + _DEFAULT_UNIVERSE = "googleapis.com" + + @classmethod + def from_service_account_info(cls, info: dict, *args, **kwargs): + """Creates an instance of this client using the provided credentials + info. + + Args: + info (dict): The service account private key info. + args: Additional arguments to pass to the constructor. + kwargs: Additional arguments to pass to the constructor. + + Returns: + ConfidentialComputingClient: The constructed client. + """ + credentials = service_account.Credentials.from_service_account_info(info) + kwargs["credentials"] = credentials + return cls(*args, **kwargs) + + @classmethod + def from_service_account_file(cls, filename: str, *args, **kwargs): + """Creates an instance of this client using the provided credentials + file. + + Args: + filename (str): The path to the service account private key json + file. + args: Additional arguments to pass to the constructor. + kwargs: Additional arguments to pass to the constructor. + + Returns: + ConfidentialComputingClient: The constructed client. + """ + credentials = service_account.Credentials.from_service_account_file( + filename) + kwargs["credentials"] = credentials + return cls(*args, **kwargs) + + from_service_account_json = from_service_account_file + + @property + def transport(self) -> ConfidentialComputingTransport: + """Returns the transport used by the client instance. + + Returns: + ConfidentialComputingTransport: The transport used by the client + instance. + """ + return self._transport + + @staticmethod + def challenge_path(project: str,location: str,uuid: str,) -> str: + """Returns a fully-qualified challenge string.""" + return "projects/{project}/locations/{location}/challenges/{uuid}".format(project=project, location=location, uuid=uuid, ) + + @staticmethod + def parse_challenge_path(path: str) -> Dict[str,str]: + """Parses a challenge path into its component segments.""" + m = re.match(r"^projects/(?P.+?)/locations/(?P.+?)/challenges/(?P.+?)$", path) + return m.groupdict() if m else {} + + @staticmethod + def common_billing_account_path(billing_account: str, ) -> str: + """Returns a fully-qualified billing_account string.""" + return "billingAccounts/{billing_account}".format(billing_account=billing_account, ) + + @staticmethod + def parse_common_billing_account_path(path: str) -> Dict[str,str]: + """Parse a billing_account path into its component segments.""" + m = re.match(r"^billingAccounts/(?P.+?)$", path) + return m.groupdict() if m else {} + + @staticmethod + def common_folder_path(folder: str, ) -> str: + """Returns a fully-qualified folder string.""" + return "folders/{folder}".format(folder=folder, ) + + @staticmethod + def parse_common_folder_path(path: str) -> Dict[str,str]: + """Parse a folder path into its component segments.""" + m = re.match(r"^folders/(?P.+?)$", path) + return m.groupdict() if m else {} + + @staticmethod + def common_organization_path(organization: str, ) -> str: + """Returns a fully-qualified organization string.""" + return "organizations/{organization}".format(organization=organization, ) + + @staticmethod + def parse_common_organization_path(path: str) -> Dict[str,str]: + """Parse a organization path into its component segments.""" + m = re.match(r"^organizations/(?P.+?)$", path) + return m.groupdict() if m else {} + + @staticmethod + def common_project_path(project: str, ) -> str: + """Returns a fully-qualified project string.""" + return "projects/{project}".format(project=project, ) + + @staticmethod + def parse_common_project_path(path: str) -> Dict[str,str]: + """Parse a project path into its component segments.""" + m = re.match(r"^projects/(?P.+?)$", path) + return m.groupdict() if m else {} + + @staticmethod + def common_location_path(project: str, location: str, ) -> str: + """Returns a fully-qualified location string.""" + return "projects/{project}/locations/{location}".format(project=project, location=location, ) + + @staticmethod + def parse_common_location_path(path: str) -> Dict[str,str]: + """Parse a location path into its component segments.""" + m = re.match(r"^projects/(?P.+?)/locations/(?P.+?)$", path) + return m.groupdict() if m else {} + + @classmethod + def get_mtls_endpoint_and_cert_source(cls, client_options: Optional[client_options_lib.ClientOptions] = None): + """Deprecated. Return the API endpoint and client cert source for mutual TLS. + + The client cert source is determined in the following order: + (1) if `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is not "true", the + client cert source is None. + (2) if `client_options.client_cert_source` is provided, use the provided one; if the + default client cert source exists, use the default one; otherwise the client cert + source is None. + + The API endpoint is determined in the following order: + (1) if `client_options.api_endpoint` if provided, use the provided one. + (2) if `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is "always", use the + default mTLS endpoint; if the environment variable is "never", use the default API + endpoint; otherwise if client cert source exists, use the default mTLS endpoint, otherwise + use the default API endpoint. + + More details can be found at https://google.aip.dev/auth/4114. + + Args: + client_options (google.api_core.client_options.ClientOptions): Custom options for the + client. Only the `api_endpoint` and `client_cert_source` properties may be used + in this method. + + Returns: + Tuple[str, Callable[[], Tuple[bytes, bytes]]]: returns the API endpoint and the + client cert source to use. + + Raises: + google.auth.exceptions.MutualTLSChannelError: If any errors happen. + """ + + warnings.warn("get_mtls_endpoint_and_cert_source is deprecated. Use the api_endpoint property instead.", + DeprecationWarning) + if client_options is None: + client_options = client_options_lib.ClientOptions() + use_client_cert = os.getenv("GOOGLE_API_USE_CLIENT_CERTIFICATE", "false") + use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto") + if use_client_cert not in ("true", "false"): + raise ValueError("Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`") + if use_mtls_endpoint not in ("auto", "never", "always"): + raise MutualTLSChannelError("Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`") + + # Figure out the client cert source to use. + client_cert_source = None + if use_client_cert == "true": + if client_options.client_cert_source: + client_cert_source = client_options.client_cert_source + elif mtls.has_default_client_cert_source(): + client_cert_source = mtls.default_client_cert_source() + + # Figure out which api endpoint to use. + if client_options.api_endpoint is not None: + api_endpoint = client_options.api_endpoint + elif use_mtls_endpoint == "always" or (use_mtls_endpoint == "auto" and client_cert_source): + api_endpoint = cls.DEFAULT_MTLS_ENDPOINT + else: + api_endpoint = cls.DEFAULT_ENDPOINT + + return api_endpoint, client_cert_source + + @staticmethod + def _read_environment_variables(): + """Returns the environment variables used by the client. + + Returns: + Tuple[bool, str, str]: returns the GOOGLE_API_USE_CLIENT_CERTIFICATE, + GOOGLE_API_USE_MTLS_ENDPOINT, and GOOGLE_CLOUD_UNIVERSE_DOMAIN environment variables. + + Raises: + ValueError: If GOOGLE_API_USE_CLIENT_CERTIFICATE is not + any of ["true", "false"]. + google.auth.exceptions.MutualTLSChannelError: If GOOGLE_API_USE_MTLS_ENDPOINT + is not any of ["auto", "never", "always"]. + """ + use_client_cert = os.getenv("GOOGLE_API_USE_CLIENT_CERTIFICATE", "false").lower() + use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower() + universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN") + if use_client_cert not in ("true", "false"): + raise ValueError("Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`") + if use_mtls_endpoint not in ("auto", "never", "always"): + raise MutualTLSChannelError("Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`") + return use_client_cert == "true", use_mtls_endpoint, universe_domain_env + + @staticmethod + def _get_client_cert_source(provided_cert_source, use_cert_flag): + """Return the client cert source to be used by the client. + + Args: + provided_cert_source (bytes): The client certificate source provided. + use_cert_flag (bool): A flag indicating whether to use the client certificate. + + Returns: + bytes or None: The client cert source to be used by the client. + """ + client_cert_source = None + if use_cert_flag: + if provided_cert_source: + client_cert_source = provided_cert_source + elif mtls.has_default_client_cert_source(): + client_cert_source = mtls.default_client_cert_source() + return client_cert_source + + @staticmethod + def _get_api_endpoint(api_override, client_cert_source, universe_domain, use_mtls_endpoint): + """Return the API endpoint used by the client. + + Args: + api_override (str): The API endpoint override. If specified, this is always + the return value of this function and the other arguments are not used. + client_cert_source (bytes): The client certificate source used by the client. + universe_domain (str): The universe domain used by the client. + use_mtls_endpoint (str): How to use the mTLS endpoint, which depends also on the other parameters. + Possible values are "always", "auto", or "never". + + Returns: + str: The API endpoint to be used by the client. + """ + if api_override is not None: + api_endpoint = api_override + elif use_mtls_endpoint == "always" or (use_mtls_endpoint == "auto" and client_cert_source): + _default_universe = ConfidentialComputingClient._DEFAULT_UNIVERSE + if universe_domain != _default_universe: + raise MutualTLSChannelError(f"mTLS is not supported in any universe other than {_default_universe}.") + api_endpoint = ConfidentialComputingClient.DEFAULT_MTLS_ENDPOINT + else: + api_endpoint = ConfidentialComputingClient._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=universe_domain) + return api_endpoint + + @staticmethod + def _get_universe_domain(client_universe_domain: Optional[str], universe_domain_env: Optional[str]) -> str: + """Return the universe domain used by the client. + + Args: + client_universe_domain (Optional[str]): The universe domain configured via the client options. + universe_domain_env (Optional[str]): The universe domain configured via the "GOOGLE_CLOUD_UNIVERSE_DOMAIN" environment variable. + + Returns: + str: The universe domain to be used by the client. + + Raises: + ValueError: If the universe domain is an empty string. + """ + universe_domain = ConfidentialComputingClient._DEFAULT_UNIVERSE + if client_universe_domain is not None: + universe_domain = client_universe_domain + elif universe_domain_env is not None: + universe_domain = universe_domain_env + if len(universe_domain.strip()) == 0: + raise ValueError("Universe Domain cannot be an empty string.") + return universe_domain + + def _validate_universe_domain(self): + """Validates client's and credentials' universe domains are consistent. + + Returns: + bool: True iff the configured universe domain is valid. + + Raises: + ValueError: If the configured universe domain is not valid. + """ + + # NOTE (b/349488459): universe validation is disabled until further notice. + return True + + def _add_cred_info_for_auth_errors( + self, + error: core_exceptions.GoogleAPICallError + ) -> None: + """Adds credential info string to error details for 401/403/404 errors. + + Args: + error (google.api_core.exceptions.GoogleAPICallError): The error to add the cred info. + """ + if error.code not in [HTTPStatus.UNAUTHORIZED, HTTPStatus.FORBIDDEN, HTTPStatus.NOT_FOUND]: + return + + cred = self._transport._credentials + + # get_cred_info is only available in google-auth>=2.35.0 + if not hasattr(cred, "get_cred_info"): + return + + # ignore the type check since pypy test fails when get_cred_info + # is not available + cred_info = cred.get_cred_info() # type: ignore + if cred_info and hasattr(error._details, "append"): + error._details.append(json.dumps(cred_info)) + + @property + def api_endpoint(self): + """Return the API endpoint used by the client instance. + + Returns: + str: The API endpoint used by the client instance. + """ + return self._api_endpoint + + @property + def universe_domain(self) -> str: + """Return the universe domain used by the client instance. + + Returns: + str: The universe domain used by the client instance. + """ + return self._universe_domain + + def __init__(self, *, + credentials: Optional[ga_credentials.Credentials] = None, + transport: Optional[Union[str, ConfidentialComputingTransport, Callable[..., ConfidentialComputingTransport]]] = None, + client_options: Optional[Union[client_options_lib.ClientOptions, dict]] = None, + client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO, + ) -> None: + """Instantiates the confidential computing client. + + Args: + credentials (Optional[google.auth.credentials.Credentials]): The + authorization credentials to attach to requests. These + credentials identify the application to the service; if none + are specified, the client will attempt to ascertain the + credentials from the environment. + transport (Optional[Union[str,ConfidentialComputingTransport,Callable[..., ConfidentialComputingTransport]]]): + The transport to use, or a Callable that constructs and returns a new transport. + If a Callable is given, it will be called with the same set of initialization + arguments as used in the ConfidentialComputingTransport constructor. + If set to None, a transport is chosen automatically. + client_options (Optional[Union[google.api_core.client_options.ClientOptions, dict]]): + Custom options for the client. + + 1. The ``api_endpoint`` property can be used to override the + default endpoint provided by the client when ``transport`` is + not explicitly provided. Only if this property is not set and + ``transport`` was not explicitly provided, the endpoint is + determined by the GOOGLE_API_USE_MTLS_ENDPOINT environment + variable, which have one of the following values: + "always" (always use the default mTLS endpoint), "never" (always + use the default regular endpoint) and "auto" (auto-switch to the + default mTLS endpoint if client certificate is present; this is + the default value). + + 2. If the GOOGLE_API_USE_CLIENT_CERTIFICATE environment variable + is "true", then the ``client_cert_source`` property can be used + to provide a client certificate for mTLS transport. If + not provided, the default SSL client certificate will be used if + present. If GOOGLE_API_USE_CLIENT_CERTIFICATE is "false" or not + set, no client certificate will be used. + + 3. The ``universe_domain`` property can be used to override the + default "googleapis.com" universe. Note that the ``api_endpoint`` + property still takes precedence; and ``universe_domain`` is + currently not supported for mTLS. + + client_info (google.api_core.gapic_v1.client_info.ClientInfo): + The client info used to send a user-agent string along with + API requests. If ``None``, then default info will be used. + Generally, you only need to set this if you're developing + your own client library. + + Raises: + google.auth.exceptions.MutualTLSChannelError: If mutual TLS transport + creation failed for any reason. + """ + self._client_options = client_options + if isinstance(self._client_options, dict): + self._client_options = client_options_lib.from_dict(self._client_options) + if self._client_options is None: + self._client_options = client_options_lib.ClientOptions() + self._client_options = cast(client_options_lib.ClientOptions, self._client_options) + + universe_domain_opt = getattr(self._client_options, 'universe_domain', None) + + self._use_client_cert, self._use_mtls_endpoint, self._universe_domain_env = ConfidentialComputingClient._read_environment_variables() + self._client_cert_source = ConfidentialComputingClient._get_client_cert_source(self._client_options.client_cert_source, self._use_client_cert) + self._universe_domain = ConfidentialComputingClient._get_universe_domain(universe_domain_opt, self._universe_domain_env) + self._api_endpoint = None # updated below, depending on `transport` + + # Initialize the universe domain validation. + self._is_universe_domain_valid = False + + if CLIENT_LOGGING_SUPPORTED: # pragma: NO COVER + # Setup logging. + client_logging.initialize_logging() + + api_key_value = getattr(self._client_options, "api_key", None) + if api_key_value and credentials: + raise ValueError("client_options.api_key and credentials are mutually exclusive") + + # Save or instantiate the transport. + # Ordinarily, we provide the transport, but allowing a custom transport + # instance provides an extensibility point for unusual situations. + transport_provided = isinstance(transport, ConfidentialComputingTransport) + if transport_provided: + # transport is a ConfidentialComputingTransport instance. + if credentials or self._client_options.credentials_file or api_key_value: + raise ValueError("When providing a transport instance, " + "provide its credentials directly.") + if self._client_options.scopes: + raise ValueError( + "When providing a transport instance, provide its scopes " + "directly." + ) + self._transport = cast(ConfidentialComputingTransport, transport) + self._api_endpoint = self._transport.host + + self._api_endpoint = (self._api_endpoint or + ConfidentialComputingClient._get_api_endpoint( + self._client_options.api_endpoint, + self._client_cert_source, + self._universe_domain, + self._use_mtls_endpoint)) + + if not transport_provided: + import google.auth._default # type: ignore + + if api_key_value and hasattr(google.auth._default, "get_api_key_credentials"): + credentials = google.auth._default.get_api_key_credentials(api_key_value) + + transport_init: Union[Type[ConfidentialComputingTransport], Callable[..., ConfidentialComputingTransport]] = ( + ConfidentialComputingClient.get_transport_class(transport) + if isinstance(transport, str) or transport is None + else cast(Callable[..., ConfidentialComputingTransport], transport) + ) + # initialize with the provided callable or the passed in class + self._transport = transport_init( + credentials=credentials, + credentials_file=self._client_options.credentials_file, + host=self._api_endpoint, + scopes=self._client_options.scopes, + client_cert_source_for_mtls=self._client_cert_source, + quota_project_id=self._client_options.quota_project_id, + client_info=client_info, + always_use_jwt_access=True, + api_audience=self._client_options.api_audience, + ) + + if "async" not in str(self._transport): + if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(std_logging.DEBUG): # pragma: NO COVER + _LOGGER.debug( + "Created client `google.cloud.confidentialcomputing_v1.ConfidentialComputingClient`.", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "universeDomain": getattr(self._transport._credentials, "universe_domain", ""), + "credentialsType": f"{type(self._transport._credentials).__module__}.{type(self._transport._credentials).__qualname__}", + "credentialsInfo": getattr(self.transport._credentials, "get_cred_info", lambda: None)(), + } if hasattr(self._transport, "_credentials") else { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "credentialsType": None, + } + ) + + def create_challenge(self, + request: Optional[Union[service.CreateChallengeRequest, dict]] = None, + *, + parent: Optional[str] = None, + challenge: Optional[service.Challenge] = None, + retry: OptionalRetry = gapic_v1.method.DEFAULT, + timeout: Union[float, object] = gapic_v1.method.DEFAULT, + metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), + ) -> service.Challenge: + r"""Creates a new Challenge in a given project and + location. + + .. code-block:: python + + # This snippet has been automatically generated and should be regarded as a + # code template only. + # It will require modifications to work: + # - It may require correct/in-range values for request initialization. + # - It may require specifying regional endpoints when creating the service + # client as shown in: + # https://googleapis.dev/python/google-api-core/latest/client_options.html + from google.cloud import confidentialcomputing_v1 + + def sample_create_challenge(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.CreateChallengeRequest( + parent="parent_value", + ) + + # Make the request + response = client.create_challenge(request=request) + + # Handle the response + print(response) + + Args: + request (Union[google.cloud.confidentialcomputing_v1.types.CreateChallengeRequest, dict]): + The request object. Message for creating a Challenge + parent (str): + Required. The resource name of the location where the + Challenge will be used, in the format + ``projects/*/locations/*``. + + This corresponds to the ``parent`` field + on the ``request`` instance; if ``request`` is provided, this + should not be set. + challenge (google.cloud.confidentialcomputing_v1.types.Challenge): + Required. The Challenge to be + created. Currently this field can be + empty as all the Challenge fields are + set by the server. + + This corresponds to the ``challenge`` field + on the ``request`` instance; if ``request`` is provided, this + should not be set. + retry (google.api_core.retry.Retry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + google.cloud.confidentialcomputing_v1.types.Challenge: + A Challenge from the server used to + guarantee freshness of attestations + + """ + # Create or coerce a protobuf request object. + # - Quick check: If we got a request object, we should *not* have + # gotten any keyword arguments that map to the request. + flattened_params = [parent, challenge] + has_flattened_params = len([param for param in flattened_params if param is not None]) > 0 + if request is not None and has_flattened_params: + raise ValueError('If the `request` argument is set, then none of ' + 'the individual field arguments should be set.') + + # - Use the request object if provided (there's no risk of modifying the input as + # there are no flattened fields), or create one. + if not isinstance(request, service.CreateChallengeRequest): + request = service.CreateChallengeRequest(request) + # If we have keyword arguments corresponding to fields on the + # request, apply these. + if parent is not None: + request.parent = parent + if challenge is not None: + request.challenge = challenge + + # Wrap the RPC method; this adds retry and timeout information, + # and friendly error handling. + rpc = self._transport._wrapped_methods[self._transport.create_challenge] + + # Certain fields should be provided within the metadata header; + # add these here. + metadata = tuple(metadata) + ( + gapic_v1.routing_header.to_grpc_metadata(( + ("parent", request.parent), + )), + ) + + # Validate the universe domain. + self._validate_universe_domain() + + # Send the request. + response = rpc( + request, + retry=retry, + timeout=timeout, + metadata=metadata, + ) + + # Done; return the response. + return response + + def verify_attestation(self, + request: Optional[Union[service.VerifyAttestationRequest, dict]] = None, + *, + retry: OptionalRetry = gapic_v1.method.DEFAULT, + timeout: Union[float, object] = gapic_v1.method.DEFAULT, + metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), + ) -> service.VerifyAttestationResponse: + r"""Verifies the provided attestation info, returning a + signed attestation token. + + .. code-block:: python + + # This snippet has been automatically generated and should be regarded as a + # code template only. + # It will require modifications to work: + # - It may require correct/in-range values for request initialization. + # - It may require specifying regional endpoints when creating the service + # client as shown in: + # https://googleapis.dev/python/google-api-core/latest/client_options.html + from google.cloud import confidentialcomputing_v1 + + def sample_verify_attestation(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.VerifyAttestationRequest( + challenge="challenge_value", + ) + + # Make the request + response = client.verify_attestation(request=request) + + # Handle the response + print(response) + + Args: + request (Union[google.cloud.confidentialcomputing_v1.types.VerifyAttestationRequest, dict]): + The request object. A request for an attestation token, + providing all the necessary information + needed for this service to verify the + platform state of the requestor. + retry (google.api_core.retry.Retry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + google.cloud.confidentialcomputing_v1.types.VerifyAttestationResponse: + A response once an attestation has + been successfully verified, containing a + signed attestation token. + + """ + # Create or coerce a protobuf request object. + # - Use the request object if provided (there's no risk of modifying the input as + # there are no flattened fields), or create one. + if not isinstance(request, service.VerifyAttestationRequest): + request = service.VerifyAttestationRequest(request) + + # Wrap the RPC method; this adds retry and timeout information, + # and friendly error handling. + rpc = self._transport._wrapped_methods[self._transport.verify_attestation] + + # Certain fields should be provided within the metadata header; + # add these here. + metadata = tuple(metadata) + ( + gapic_v1.routing_header.to_grpc_metadata(( + ("challenge", request.challenge), + )), + ) + + # Validate the universe domain. + self._validate_universe_domain() + + # Send the request. + response = rpc( + request, + retry=retry, + timeout=timeout, + metadata=metadata, + ) + + # Done; return the response. + return response + + def verify_confidential_space(self, + request: Optional[Union[service.VerifyConfidentialSpaceRequest, dict]] = None, + *, + retry: OptionalRetry = gapic_v1.method.DEFAULT, + timeout: Union[float, object] = gapic_v1.method.DEFAULT, + metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), + ) -> service.VerifyConfidentialSpaceResponse: + r"""Verifies whether the provided attestation info is + valid, returning a signed attestation token if so. + + .. code-block:: python + + # This snippet has been automatically generated and should be regarded as a + # code template only. + # It will require modifications to work: + # - It may require correct/in-range values for request initialization. + # - It may require specifying regional endpoints when creating the service + # client as shown in: + # https://googleapis.dev/python/google-api-core/latest/client_options.html + from google.cloud import confidentialcomputing_v1 + + def sample_verify_confidential_space(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.VerifyConfidentialSpaceRequest( + challenge="challenge_value", + ) + + # Make the request + response = client.verify_confidential_space(request=request) + + # Handle the response + print(response) + + Args: + request (Union[google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceRequest, dict]): + The request object. A request for an attestation token, + providing all the necessary information + needed for this service to verify the + platform state of the requestor. + retry (google.api_core.retry.Retry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceResponse: + VerifyConfidentialSpaceResponse is + returned once a Confidential Space + attestation has been successfully + verified, containing a signed token. + + """ + # Create or coerce a protobuf request object. + # - Use the request object if provided (there's no risk of modifying the input as + # there are no flattened fields), or create one. + if not isinstance(request, service.VerifyConfidentialSpaceRequest): + request = service.VerifyConfidentialSpaceRequest(request) + + # Wrap the RPC method; this adds retry and timeout information, + # and friendly error handling. + rpc = self._transport._wrapped_methods[self._transport.verify_confidential_space] + + # Certain fields should be provided within the metadata header; + # add these here. + metadata = tuple(metadata) + ( + gapic_v1.routing_header.to_grpc_metadata(( + ("challenge", request.challenge), + )), + ) + + # Validate the universe domain. + self._validate_universe_domain() + + # Send the request. + response = rpc( + request, + retry=retry, + timeout=timeout, + metadata=metadata, + ) + + # Done; return the response. + return response + + def verify_confidential_gke(self, + request: Optional[Union[service.VerifyConfidentialGkeRequest, dict]] = None, + *, + retry: OptionalRetry = gapic_v1.method.DEFAULT, + timeout: Union[float, object] = gapic_v1.method.DEFAULT, + metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), + ) -> service.VerifyConfidentialGkeResponse: + r"""Verifies the provided Confidential GKE attestation + info, returning a signed OIDC token. + + .. code-block:: python + + # This snippet has been automatically generated and should be regarded as a + # code template only. + # It will require modifications to work: + # - It may require correct/in-range values for request initialization. + # - It may require specifying regional endpoints when creating the service + # client as shown in: + # https://googleapis.dev/python/google-api-core/latest/client_options.html + from google.cloud import confidentialcomputing_v1 + + def sample_verify_confidential_gke(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.VerifyConfidentialGkeRequest( + challenge="challenge_value", + ) + + # Make the request + response = client.verify_confidential_gke(request=request) + + # Handle the response + print(response) + + Args: + request (Union[google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeRequest, dict]): + The request object. A request for an attestation token, + providing all the necessary information + needed for this service to verify + Confidential GKE platform state of the + requestor. + retry (google.api_core.retry.Retry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeResponse: + VerifyConfidentialGkeResponse + response is returened once a + Confidential GKE attestation has been + successfully verified, containing a + signed OIDC token. + + """ + # Create or coerce a protobuf request object. + # - Use the request object if provided (there's no risk of modifying the input as + # there are no flattened fields), or create one. + if not isinstance(request, service.VerifyConfidentialGkeRequest): + request = service.VerifyConfidentialGkeRequest(request) + + # Wrap the RPC method; this adds retry and timeout information, + # and friendly error handling. + rpc = self._transport._wrapped_methods[self._transport.verify_confidential_gke] + + # Certain fields should be provided within the metadata header; + # add these here. + metadata = tuple(metadata) + ( + gapic_v1.routing_header.to_grpc_metadata(( + ("challenge", request.challenge), + )), + ) + + # Validate the universe domain. + self._validate_universe_domain() + + # Send the request. + response = rpc( + request, + retry=retry, + timeout=timeout, + metadata=metadata, + ) + + # Done; return the response. + return response + + def __enter__(self) -> "ConfidentialComputingClient": + return self + + def __exit__(self, type, value, traceback): + """Releases underlying transport's resources. + + .. warning:: + ONLY use as a context manager if the transport is NOT shared + with other clients! Exiting the with block will CLOSE the transport + and may cause errors in other clients! + """ + self.transport.close() + + def get_location( + self, + request: Optional[locations_pb2.GetLocationRequest] = None, + *, + retry: OptionalRetry = gapic_v1.method.DEFAULT, + timeout: Union[float, object] = gapic_v1.method.DEFAULT, + metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), + ) -> locations_pb2.Location: + r"""Gets information about a location. + + Args: + request (:class:`~.location_pb2.GetLocationRequest`): + The request object. Request message for + `GetLocation` method. + retry (google.api_core.retry.Retry): Designation of what errors, + if any, should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + Returns: + ~.location_pb2.Location: + Location object. + """ + # Create or coerce a protobuf request object. + # The request isn't a proto-plus wrapped type, + # so it must be constructed via keyword expansion. + if isinstance(request, dict): + request = locations_pb2.GetLocationRequest(**request) + + # Wrap the RPC method; this adds retry and timeout information, + # and friendly error handling. + rpc = self._transport._wrapped_methods[self._transport.get_location] + + # Certain fields should be provided within the metadata header; + # add these here. + metadata = tuple(metadata) + ( + gapic_v1.routing_header.to_grpc_metadata( + (("name", request.name),)), + ) + + # Validate the universe domain. + self._validate_universe_domain() + + try: + # Send the request. + response = rpc( + request, retry=retry, timeout=timeout, metadata=metadata,) + + # Done; return the response. + return response + except core_exceptions.GoogleAPICallError as e: + self._add_cred_info_for_auth_errors(e) + raise e + + def list_locations( + self, + request: Optional[locations_pb2.ListLocationsRequest] = None, + *, + retry: OptionalRetry = gapic_v1.method.DEFAULT, + timeout: Union[float, object] = gapic_v1.method.DEFAULT, + metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), + ) -> locations_pb2.ListLocationsResponse: + r"""Lists information about the supported locations for this service. + + Args: + request (:class:`~.location_pb2.ListLocationsRequest`): + The request object. Request message for + `ListLocations` method. + retry (google.api_core.retry.Retry): Designation of what errors, + if any, should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + Returns: + ~.location_pb2.ListLocationsResponse: + Response message for ``ListLocations`` method. + """ + # Create or coerce a protobuf request object. + # The request isn't a proto-plus wrapped type, + # so it must be constructed via keyword expansion. + if isinstance(request, dict): + request = locations_pb2.ListLocationsRequest(**request) + + # Wrap the RPC method; this adds retry and timeout information, + # and friendly error handling. + rpc = self._transport._wrapped_methods[self._transport.list_locations] + + # Certain fields should be provided within the metadata header; + # add these here. + metadata = tuple(metadata) + ( + gapic_v1.routing_header.to_grpc_metadata( + (("name", request.name),)), + ) + + # Validate the universe domain. + self._validate_universe_domain() + + try: + # Send the request. + response = rpc( + request, retry=retry, timeout=timeout, metadata=metadata,) + + # Done; return the response. + return response + except core_exceptions.GoogleAPICallError as e: + self._add_cred_info_for_auth_errors(e) + raise e + + +DEFAULT_CLIENT_INFO = gapic_v1.client_info.ClientInfo(gapic_version=package_version.__version__) + +if hasattr(DEFAULT_CLIENT_INFO, "protobuf_runtime_version"): # pragma: NO COVER + DEFAULT_CLIENT_INFO.protobuf_runtime_version = google.protobuf.__version__ + +__all__ = ( + "ConfidentialComputingClient", +) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/README.rst b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/README.rst new file mode 100644 index 000000000000..2bf126ac1dec --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/README.rst @@ -0,0 +1,9 @@ + +transport inheritance structure +_______________________________ + +`ConfidentialComputingTransport` is the ABC for all transports. +- public child `ConfidentialComputingGrpcTransport` for sync gRPC transport (defined in `grpc.py`). +- public child `ConfidentialComputingGrpcAsyncIOTransport` for async gRPC transport (defined in `grpc_asyncio.py`). +- private child `_BaseConfidentialComputingRestTransport` for base REST transport with inner classes `_BaseMETHOD` (defined in `rest_base.py`). +- public child `ConfidentialComputingRestTransport` for sync REST transport with inner classes `METHOD` derived from the parent's corresponding `_BaseMETHOD` classes (defined in `rest.py`). diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/__init__.py new file mode 100644 index 000000000000..c7d682081e49 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/__init__.py @@ -0,0 +1,38 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +from collections import OrderedDict +from typing import Dict, Type + +from .base import ConfidentialComputingTransport +from .grpc import ConfidentialComputingGrpcTransport +from .grpc_asyncio import ConfidentialComputingGrpcAsyncIOTransport +from .rest import ConfidentialComputingRestTransport +from .rest import ConfidentialComputingRestInterceptor + + +# Compile a registry of transports. +_transport_registry = OrderedDict() # type: Dict[str, Type[ConfidentialComputingTransport]] +_transport_registry['grpc'] = ConfidentialComputingGrpcTransport +_transport_registry['grpc_asyncio'] = ConfidentialComputingGrpcAsyncIOTransport +_transport_registry['rest'] = ConfidentialComputingRestTransport + +__all__ = ( + 'ConfidentialComputingTransport', + 'ConfidentialComputingGrpcTransport', + 'ConfidentialComputingGrpcAsyncIOTransport', + 'ConfidentialComputingRestTransport', + 'ConfidentialComputingRestInterceptor', +) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/base.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/base.py new file mode 100644 index 000000000000..40ff08bd7b14 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/base.py @@ -0,0 +1,264 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +import abc +from typing import Awaitable, Callable, Dict, Optional, Sequence, Union + +from google.cloud.confidentialcomputing_v1 import gapic_version as package_version + +import google.auth # type: ignore +import google.api_core +from google.api_core import exceptions as core_exceptions +from google.api_core import gapic_v1 +from google.api_core import retry as retries +from google.auth import credentials as ga_credentials # type: ignore +from google.oauth2 import service_account # type: ignore +import google.protobuf + +from google.cloud.confidentialcomputing_v1.types import service +from google.cloud.location import locations_pb2 # type: ignore + +DEFAULT_CLIENT_INFO = gapic_v1.client_info.ClientInfo(gapic_version=package_version.__version__) + +if hasattr(DEFAULT_CLIENT_INFO, "protobuf_runtime_version"): # pragma: NO COVER + DEFAULT_CLIENT_INFO.protobuf_runtime_version = google.protobuf.__version__ + + +class ConfidentialComputingTransport(abc.ABC): + """Abstract transport class for ConfidentialComputing.""" + + AUTH_SCOPES = ( + 'https://www.googleapis.com/auth/cloud-platform', + ) + + DEFAULT_HOST: str = 'confidentialcomputing.googleapis.com' + + def __init__( + self, *, + host: str = DEFAULT_HOST, + credentials: Optional[ga_credentials.Credentials] = None, + credentials_file: Optional[str] = None, + scopes: Optional[Sequence[str]] = None, + quota_project_id: Optional[str] = None, + client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO, + always_use_jwt_access: Optional[bool] = False, + api_audience: Optional[str] = None, + **kwargs, + ) -> None: + """Instantiate the transport. + + Args: + host (Optional[str]): + The hostname to connect to (default: 'confidentialcomputing.googleapis.com'). + credentials (Optional[google.auth.credentials.Credentials]): The + authorization credentials to attach to requests. These + credentials identify the application to the service; if none + are specified, the client will attempt to ascertain the + credentials from the environment. + credentials_file (Optional[str]): A file with credentials that can + be loaded with :func:`google.auth.load_credentials_from_file`. + This argument is mutually exclusive with credentials. + scopes (Optional[Sequence[str]]): A list of scopes. + quota_project_id (Optional[str]): An optional project to use for billing + and quota. + client_info (google.api_core.gapic_v1.client_info.ClientInfo): + The client info used to send a user-agent string along with + API requests. If ``None``, then default info will be used. + Generally, you only need to set this if you're developing + your own client library. + always_use_jwt_access (Optional[bool]): Whether self signed JWT should + be used for service account credentials. + """ + + scopes_kwargs = {"scopes": scopes, "default_scopes": self.AUTH_SCOPES} + + # Save the scopes. + self._scopes = scopes + if not hasattr(self, "_ignore_credentials"): + self._ignore_credentials: bool = False + + # If no credentials are provided, then determine the appropriate + # defaults. + if credentials and credentials_file: + raise core_exceptions.DuplicateCredentialArgs("'credentials_file' and 'credentials' are mutually exclusive") + + if credentials_file is not None: + credentials, _ = google.auth.load_credentials_from_file( + credentials_file, + **scopes_kwargs, + quota_project_id=quota_project_id + ) + elif credentials is None and not self._ignore_credentials: + credentials, _ = google.auth.default(**scopes_kwargs, quota_project_id=quota_project_id) + # Don't apply audience if the credentials file passed from user. + if hasattr(credentials, "with_gdch_audience"): + credentials = credentials.with_gdch_audience(api_audience if api_audience else host) + + # If the credentials are service account credentials, then always try to use self signed JWT. + if always_use_jwt_access and isinstance(credentials, service_account.Credentials) and hasattr(service_account.Credentials, "with_always_use_jwt_access"): + credentials = credentials.with_always_use_jwt_access(True) + + # Save the credentials. + self._credentials = credentials + + # Save the hostname. Default to port 443 (HTTPS) if none is specified. + if ':' not in host: + host += ':443' + self._host = host + + @property + def host(self): + return self._host + + def _prep_wrapped_messages(self, client_info): + # Precompute the wrapped methods. + self._wrapped_methods = { + self.create_challenge: gapic_v1.method.wrap_method( + self.create_challenge, + default_retry=retries.Retry( + initial=1.0, + maximum=60.0, + multiplier=1.3, + predicate=retries.if_exception_type( + core_exceptions.ServiceUnavailable, + ), + deadline=60.0, + ), + default_timeout=60.0, + client_info=client_info, + ), + self.verify_attestation: gapic_v1.method.wrap_method( + self.verify_attestation, + default_retry=retries.Retry( + initial=1.0, + maximum=60.0, + multiplier=1.3, + predicate=retries.if_exception_type( + core_exceptions.ServiceUnavailable, + ), + deadline=60.0, + ), + default_timeout=60.0, + client_info=client_info, + ), + self.verify_confidential_space: gapic_v1.method.wrap_method( + self.verify_confidential_space, + default_retry=retries.Retry( + initial=1.0, + maximum=60.0, + multiplier=1.3, + predicate=retries.if_exception_type( + core_exceptions.ServiceUnavailable, + ), + deadline=60.0, + ), + default_timeout=60.0, + client_info=client_info, + ), + self.verify_confidential_gke: gapic_v1.method.wrap_method( + self.verify_confidential_gke, + default_retry=retries.Retry( + initial=1.0, + maximum=60.0, + multiplier=1.3, + predicate=retries.if_exception_type( + core_exceptions.ServiceUnavailable, + ), + deadline=60.0, + ), + default_timeout=60.0, + client_info=client_info, + ), + self.get_location: gapic_v1.method.wrap_method( + self.get_location, + default_timeout=None, + client_info=client_info, + ), + self.list_locations: gapic_v1.method.wrap_method( + self.list_locations, + default_timeout=None, + client_info=client_info, + ), + } + + def close(self): + """Closes resources associated with the transport. + + .. warning:: + Only call this method if the transport is NOT shared + with other clients - this may cause errors in other clients! + """ + raise NotImplementedError() + + @property + def create_challenge(self) -> Callable[ + [service.CreateChallengeRequest], + Union[ + service.Challenge, + Awaitable[service.Challenge] + ]]: + raise NotImplementedError() + + @property + def verify_attestation(self) -> Callable[ + [service.VerifyAttestationRequest], + Union[ + service.VerifyAttestationResponse, + Awaitable[service.VerifyAttestationResponse] + ]]: + raise NotImplementedError() + + @property + def verify_confidential_space(self) -> Callable[ + [service.VerifyConfidentialSpaceRequest], + Union[ + service.VerifyConfidentialSpaceResponse, + Awaitable[service.VerifyConfidentialSpaceResponse] + ]]: + raise NotImplementedError() + + @property + def verify_confidential_gke(self) -> Callable[ + [service.VerifyConfidentialGkeRequest], + Union[ + service.VerifyConfidentialGkeResponse, + Awaitable[service.VerifyConfidentialGkeResponse] + ]]: + raise NotImplementedError() + + @property + def get_location(self, + ) -> Callable[ + [locations_pb2.GetLocationRequest], + Union[locations_pb2.Location, Awaitable[locations_pb2.Location]], + ]: + raise NotImplementedError() + + @property + def list_locations(self, + ) -> Callable[ + [locations_pb2.ListLocationsRequest], + Union[locations_pb2.ListLocationsResponse, Awaitable[locations_pb2.ListLocationsResponse]], + ]: + raise NotImplementedError() + + @property + def kind(self) -> str: + raise NotImplementedError() + + +__all__ = ( + 'ConfidentialComputingTransport', +) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc.py new file mode 100644 index 000000000000..7aa894736780 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc.py @@ -0,0 +1,465 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +import json +import logging as std_logging +import pickle +import warnings +from typing import Callable, Dict, Optional, Sequence, Tuple, Union + +from google.api_core import grpc_helpers +from google.api_core import gapic_v1 +import google.auth # type: ignore +from google.auth import credentials as ga_credentials # type: ignore +from google.auth.transport.grpc import SslCredentials # type: ignore +from google.protobuf.json_format import MessageToJson +import google.protobuf.message + +import grpc # type: ignore +import proto # type: ignore + +from google.cloud.confidentialcomputing_v1.types import service +from google.cloud.location import locations_pb2 # type: ignore +from .base import ConfidentialComputingTransport, DEFAULT_CLIENT_INFO + +try: + from google.api_core import client_logging # type: ignore + CLIENT_LOGGING_SUPPORTED = True # pragma: NO COVER +except ImportError: # pragma: NO COVER + CLIENT_LOGGING_SUPPORTED = False + +_LOGGER = std_logging.getLogger(__name__) + + +class _LoggingClientInterceptor(grpc.UnaryUnaryClientInterceptor): # pragma: NO COVER + def intercept_unary_unary(self, continuation, client_call_details, request): + logging_enabled = CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(std_logging.DEBUG) + if logging_enabled: # pragma: NO COVER + request_metadata = client_call_details.metadata + if isinstance(request, proto.Message): + request_payload = type(request).to_json(request) + elif isinstance(request, google.protobuf.message.Message): + request_payload = MessageToJson(request) + else: + request_payload = f"{type(request).__name__}: {pickle.dumps(request)}" + + request_metadata = { + key: value.decode("utf-8") if isinstance(value, bytes) else value + for key, value in request_metadata + } + grpc_request = { + "payload": request_payload, + "requestMethod": "grpc", + "metadata": dict(request_metadata), + } + _LOGGER.debug( + f"Sending request for {client_call_details.method}", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": str(client_call_details.method), + "request": grpc_request, + "metadata": grpc_request["metadata"], + }, + ) + response = continuation(client_call_details, request) + if logging_enabled: # pragma: NO COVER + response_metadata = response.trailing_metadata() + # Convert gRPC metadata `` to list of tuples + metadata = dict([(k, str(v)) for k, v in response_metadata]) if response_metadata else None + result = response.result() + if isinstance(result, proto.Message): + response_payload = type(result).to_json(result) + elif isinstance(result, google.protobuf.message.Message): + response_payload = MessageToJson(result) + else: + response_payload = f"{type(result).__name__}: {pickle.dumps(result)}" + grpc_response = { + "payload": response_payload, + "metadata": metadata, + "status": "OK", + } + _LOGGER.debug( + f"Received response for {client_call_details.method}.", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": client_call_details.method, + "response": grpc_response, + "metadata": grpc_response["metadata"], + }, + ) + return response + + +class ConfidentialComputingGrpcTransport(ConfidentialComputingTransport): + """gRPC backend transport for ConfidentialComputing. + + Service describing handlers for resources + + This class defines the same methods as the primary client, so the + primary client can load the underlying transport implementation + and call it. + + It sends protocol buffers over the wire using gRPC (which is built on + top of HTTP/2); the ``grpcio`` package must be installed. + """ + _stubs: Dict[str, Callable] + + def __init__(self, *, + host: str = 'confidentialcomputing.googleapis.com', + credentials: Optional[ga_credentials.Credentials] = None, + credentials_file: Optional[str] = None, + scopes: Optional[Sequence[str]] = None, + channel: Optional[Union[grpc.Channel, Callable[..., grpc.Channel]]] = None, + api_mtls_endpoint: Optional[str] = None, + client_cert_source: Optional[Callable[[], Tuple[bytes, bytes]]] = None, + ssl_channel_credentials: Optional[grpc.ChannelCredentials] = None, + client_cert_source_for_mtls: Optional[Callable[[], Tuple[bytes, bytes]]] = None, + quota_project_id: Optional[str] = None, + client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO, + always_use_jwt_access: Optional[bool] = False, + api_audience: Optional[str] = None, + ) -> None: + """Instantiate the transport. + + Args: + host (Optional[str]): + The hostname to connect to (default: 'confidentialcomputing.googleapis.com'). + credentials (Optional[google.auth.credentials.Credentials]): The + authorization credentials to attach to requests. These + credentials identify the application to the service; if none + are specified, the client will attempt to ascertain the + credentials from the environment. + This argument is ignored if a ``channel`` instance is provided. + credentials_file (Optional[str]): A file with credentials that can + be loaded with :func:`google.auth.load_credentials_from_file`. + This argument is ignored if a ``channel`` instance is provided. + scopes (Optional(Sequence[str])): A list of scopes. This argument is + ignored if a ``channel`` instance is provided. + channel (Optional[Union[grpc.Channel, Callable[..., grpc.Channel]]]): + A ``Channel`` instance through which to make calls, or a Callable + that constructs and returns one. If set to None, ``self.create_channel`` + is used to create the channel. If a Callable is given, it will be called + with the same arguments as used in ``self.create_channel``. + api_mtls_endpoint (Optional[str]): Deprecated. The mutual TLS endpoint. + If provided, it overrides the ``host`` argument and tries to create + a mutual TLS channel with client SSL credentials from + ``client_cert_source`` or application default SSL credentials. + client_cert_source (Optional[Callable[[], Tuple[bytes, bytes]]]): + Deprecated. A callback to provide client SSL certificate bytes and + private key bytes, both in PEM format. It is ignored if + ``api_mtls_endpoint`` is None. + ssl_channel_credentials (grpc.ChannelCredentials): SSL credentials + for the grpc channel. It is ignored if a ``channel`` instance is provided. + client_cert_source_for_mtls (Optional[Callable[[], Tuple[bytes, bytes]]]): + A callback to provide client certificate bytes and private key bytes, + both in PEM format. It is used to configure a mutual TLS channel. It is + ignored if a ``channel`` instance or ``ssl_channel_credentials`` is provided. + quota_project_id (Optional[str]): An optional project to use for billing + and quota. + client_info (google.api_core.gapic_v1.client_info.ClientInfo): + The client info used to send a user-agent string along with + API requests. If ``None``, then default info will be used. + Generally, you only need to set this if you're developing + your own client library. + always_use_jwt_access (Optional[bool]): Whether self signed JWT should + be used for service account credentials. + + Raises: + google.auth.exceptions.MutualTLSChannelError: If mutual TLS transport + creation failed for any reason. + google.api_core.exceptions.DuplicateCredentialArgs: If both ``credentials`` + and ``credentials_file`` are passed. + """ + self._grpc_channel = None + self._ssl_channel_credentials = ssl_channel_credentials + self._stubs: Dict[str, Callable] = {} + + if api_mtls_endpoint: + warnings.warn("api_mtls_endpoint is deprecated", DeprecationWarning) + if client_cert_source: + warnings.warn("client_cert_source is deprecated", DeprecationWarning) + + if isinstance(channel, grpc.Channel): + # Ignore credentials if a channel was passed. + credentials = None + self._ignore_credentials = True + # If a channel was explicitly provided, set it. + self._grpc_channel = channel + self._ssl_channel_credentials = None + + else: + if api_mtls_endpoint: + host = api_mtls_endpoint + + # Create SSL credentials with client_cert_source or application + # default SSL credentials. + if client_cert_source: + cert, key = client_cert_source() + self._ssl_channel_credentials = grpc.ssl_channel_credentials( + certificate_chain=cert, private_key=key + ) + else: + self._ssl_channel_credentials = SslCredentials().ssl_credentials + + else: + if client_cert_source_for_mtls and not ssl_channel_credentials: + cert, key = client_cert_source_for_mtls() + self._ssl_channel_credentials = grpc.ssl_channel_credentials( + certificate_chain=cert, private_key=key + ) + + # The base transport sets the host, credentials and scopes + super().__init__( + host=host, + credentials=credentials, + credentials_file=credentials_file, + scopes=scopes, + quota_project_id=quota_project_id, + client_info=client_info, + always_use_jwt_access=always_use_jwt_access, + api_audience=api_audience, + ) + + if not self._grpc_channel: + # initialize with the provided callable or the default channel + channel_init = channel or type(self).create_channel + self._grpc_channel = channel_init( + self._host, + # use the credentials which are saved + credentials=self._credentials, + # Set ``credentials_file`` to ``None`` here as + # the credentials that we saved earlier should be used. + credentials_file=None, + scopes=self._scopes, + ssl_credentials=self._ssl_channel_credentials, + quota_project_id=quota_project_id, + options=[ + ("grpc.max_send_message_length", -1), + ("grpc.max_receive_message_length", -1), + ], + ) + + self._interceptor = _LoggingClientInterceptor() + self._logged_channel = grpc.intercept_channel(self._grpc_channel, self._interceptor) + + # Wrap messages. This must be done after self._logged_channel exists + self._prep_wrapped_messages(client_info) + + @classmethod + def create_channel(cls, + host: str = 'confidentialcomputing.googleapis.com', + credentials: Optional[ga_credentials.Credentials] = None, + credentials_file: Optional[str] = None, + scopes: Optional[Sequence[str]] = None, + quota_project_id: Optional[str] = None, + **kwargs) -> grpc.Channel: + """Create and return a gRPC channel object. + Args: + host (Optional[str]): The host for the channel to use. + credentials (Optional[~.Credentials]): The + authorization credentials to attach to requests. These + credentials identify this application to the service. If + none are specified, the client will attempt to ascertain + the credentials from the environment. + credentials_file (Optional[str]): A file with credentials that can + be loaded with :func:`google.auth.load_credentials_from_file`. + This argument is mutually exclusive with credentials. + scopes (Optional[Sequence[str]]): A optional list of scopes needed for this + service. These are only used when credentials are not specified and + are passed to :func:`google.auth.default`. + quota_project_id (Optional[str]): An optional project to use for billing + and quota. + kwargs (Optional[dict]): Keyword arguments, which are passed to the + channel creation. + Returns: + grpc.Channel: A gRPC channel object. + + Raises: + google.api_core.exceptions.DuplicateCredentialArgs: If both ``credentials`` + and ``credentials_file`` are passed. + """ + + return grpc_helpers.create_channel( + host, + credentials=credentials, + credentials_file=credentials_file, + quota_project_id=quota_project_id, + default_scopes=cls.AUTH_SCOPES, + scopes=scopes, + default_host=cls.DEFAULT_HOST, + **kwargs + ) + + @property + def grpc_channel(self) -> grpc.Channel: + """Return the channel designed to connect to this service. + """ + return self._grpc_channel + + @property + def create_challenge(self) -> Callable[ + [service.CreateChallengeRequest], + service.Challenge]: + r"""Return a callable for the create challenge method over gRPC. + + Creates a new Challenge in a given project and + location. + + Returns: + Callable[[~.CreateChallengeRequest], + ~.Challenge]: + A function that, when called, will call the underlying RPC + on the server. + """ + # Generate a "stub function" on-the-fly which will actually make + # the request. + # gRPC handles serialization and deserialization, so we just need + # to pass in the functions for each. + if 'create_challenge' not in self._stubs: + self._stubs['create_challenge'] = self._logged_channel.unary_unary( + '/google.cloud.confidentialcomputing.v1.ConfidentialComputing/CreateChallenge', + request_serializer=service.CreateChallengeRequest.serialize, + response_deserializer=service.Challenge.deserialize, + ) + return self._stubs['create_challenge'] + + @property + def verify_attestation(self) -> Callable[ + [service.VerifyAttestationRequest], + service.VerifyAttestationResponse]: + r"""Return a callable for the verify attestation method over gRPC. + + Verifies the provided attestation info, returning a + signed attestation token. + + Returns: + Callable[[~.VerifyAttestationRequest], + ~.VerifyAttestationResponse]: + A function that, when called, will call the underlying RPC + on the server. + """ + # Generate a "stub function" on-the-fly which will actually make + # the request. + # gRPC handles serialization and deserialization, so we just need + # to pass in the functions for each. + if 'verify_attestation' not in self._stubs: + self._stubs['verify_attestation'] = self._logged_channel.unary_unary( + '/google.cloud.confidentialcomputing.v1.ConfidentialComputing/VerifyAttestation', + request_serializer=service.VerifyAttestationRequest.serialize, + response_deserializer=service.VerifyAttestationResponse.deserialize, + ) + return self._stubs['verify_attestation'] + + @property + def verify_confidential_space(self) -> Callable[ + [service.VerifyConfidentialSpaceRequest], + service.VerifyConfidentialSpaceResponse]: + r"""Return a callable for the verify confidential space method over gRPC. + + Verifies whether the provided attestation info is + valid, returning a signed attestation token if so. + + Returns: + Callable[[~.VerifyConfidentialSpaceRequest], + ~.VerifyConfidentialSpaceResponse]: + A function that, when called, will call the underlying RPC + on the server. + """ + # Generate a "stub function" on-the-fly which will actually make + # the request. + # gRPC handles serialization and deserialization, so we just need + # to pass in the functions for each. + if 'verify_confidential_space' not in self._stubs: + self._stubs['verify_confidential_space'] = self._logged_channel.unary_unary( + '/google.cloud.confidentialcomputing.v1.ConfidentialComputing/VerifyConfidentialSpace', + request_serializer=service.VerifyConfidentialSpaceRequest.serialize, + response_deserializer=service.VerifyConfidentialSpaceResponse.deserialize, + ) + return self._stubs['verify_confidential_space'] + + @property + def verify_confidential_gke(self) -> Callable[ + [service.VerifyConfidentialGkeRequest], + service.VerifyConfidentialGkeResponse]: + r"""Return a callable for the verify confidential gke method over gRPC. + + Verifies the provided Confidential GKE attestation + info, returning a signed OIDC token. + + Returns: + Callable[[~.VerifyConfidentialGkeRequest], + ~.VerifyConfidentialGkeResponse]: + A function that, when called, will call the underlying RPC + on the server. + """ + # Generate a "stub function" on-the-fly which will actually make + # the request. + # gRPC handles serialization and deserialization, so we just need + # to pass in the functions for each. + if 'verify_confidential_gke' not in self._stubs: + self._stubs['verify_confidential_gke'] = self._logged_channel.unary_unary( + '/google.cloud.confidentialcomputing.v1.ConfidentialComputing/VerifyConfidentialGke', + request_serializer=service.VerifyConfidentialGkeRequest.serialize, + response_deserializer=service.VerifyConfidentialGkeResponse.deserialize, + ) + return self._stubs['verify_confidential_gke'] + + def close(self): + self._logged_channel.close() + + @property + def list_locations( + self, + ) -> Callable[[locations_pb2.ListLocationsRequest], locations_pb2.ListLocationsResponse]: + r"""Return a callable for the list locations method over gRPC. + """ + # Generate a "stub function" on-the-fly which will actually make + # the request. + # gRPC handles serialization and deserialization, so we just need + # to pass in the functions for each. + if "list_locations" not in self._stubs: + self._stubs["list_locations"] = self._logged_channel.unary_unary( + "/google.cloud.location.Locations/ListLocations", + request_serializer=locations_pb2.ListLocationsRequest.SerializeToString, + response_deserializer=locations_pb2.ListLocationsResponse.FromString, + ) + return self._stubs["list_locations"] + + @property + def get_location( + self, + ) -> Callable[[locations_pb2.GetLocationRequest], locations_pb2.Location]: + r"""Return a callable for the list locations method over gRPC. + """ + # Generate a "stub function" on-the-fly which will actually make + # the request. + # gRPC handles serialization and deserialization, so we just need + # to pass in the functions for each. + if "get_location" not in self._stubs: + self._stubs["get_location"] = self._logged_channel.unary_unary( + "/google.cloud.location.Locations/GetLocation", + request_serializer=locations_pb2.GetLocationRequest.SerializeToString, + response_deserializer=locations_pb2.Location.FromString, + ) + return self._stubs["get_location"] + + @property + def kind(self) -> str: + return "grpc" + + +__all__ = ( + 'ConfidentialComputingGrpcTransport', +) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc_asyncio.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc_asyncio.py new file mode 100644 index 000000000000..4e254a73b6a2 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc_asyncio.py @@ -0,0 +1,547 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +import inspect +import json +import pickle +import logging as std_logging +import warnings +from typing import Awaitable, Callable, Dict, Optional, Sequence, Tuple, Union + +from google.api_core import gapic_v1 +from google.api_core import grpc_helpers_async +from google.api_core import exceptions as core_exceptions +from google.api_core import retry_async as retries +from google.auth import credentials as ga_credentials # type: ignore +from google.auth.transport.grpc import SslCredentials # type: ignore +from google.protobuf.json_format import MessageToJson +import google.protobuf.message + +import grpc # type: ignore +import proto # type: ignore +from grpc.experimental import aio # type: ignore + +from google.cloud.confidentialcomputing_v1.types import service +from google.cloud.location import locations_pb2 # type: ignore +from .base import ConfidentialComputingTransport, DEFAULT_CLIENT_INFO +from .grpc import ConfidentialComputingGrpcTransport + +try: + from google.api_core import client_logging # type: ignore + CLIENT_LOGGING_SUPPORTED = True # pragma: NO COVER +except ImportError: # pragma: NO COVER + CLIENT_LOGGING_SUPPORTED = False + +_LOGGER = std_logging.getLogger(__name__) + + +class _LoggingClientAIOInterceptor(grpc.aio.UnaryUnaryClientInterceptor): # pragma: NO COVER + async def intercept_unary_unary(self, continuation, client_call_details, request): + logging_enabled = CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(std_logging.DEBUG) + if logging_enabled: # pragma: NO COVER + request_metadata = client_call_details.metadata + if isinstance(request, proto.Message): + request_payload = type(request).to_json(request) + elif isinstance(request, google.protobuf.message.Message): + request_payload = MessageToJson(request) + else: + request_payload = f"{type(request).__name__}: {pickle.dumps(request)}" + + request_metadata = { + key: value.decode("utf-8") if isinstance(value, bytes) else value + for key, value in request_metadata + } + grpc_request = { + "payload": request_payload, + "requestMethod": "grpc", + "metadata": dict(request_metadata), + } + _LOGGER.debug( + f"Sending request for {client_call_details.method}", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": str(client_call_details.method), + "request": grpc_request, + "metadata": grpc_request["metadata"], + }, + ) + response = await continuation(client_call_details, request) + if logging_enabled: # pragma: NO COVER + response_metadata = await response.trailing_metadata() + # Convert gRPC metadata `` to list of tuples + metadata = dict([(k, str(v)) for k, v in response_metadata]) if response_metadata else None + result = await response + if isinstance(result, proto.Message): + response_payload = type(result).to_json(result) + elif isinstance(result, google.protobuf.message.Message): + response_payload = MessageToJson(result) + else: + response_payload = f"{type(result).__name__}: {pickle.dumps(result)}" + grpc_response = { + "payload": response_payload, + "metadata": metadata, + "status": "OK", + } + _LOGGER.debug( + f"Received response to rpc {client_call_details.method}.", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": str(client_call_details.method), + "response": grpc_response, + "metadata": grpc_response["metadata"], + }, + ) + return response + + +class ConfidentialComputingGrpcAsyncIOTransport(ConfidentialComputingTransport): + """gRPC AsyncIO backend transport for ConfidentialComputing. + + Service describing handlers for resources + + This class defines the same methods as the primary client, so the + primary client can load the underlying transport implementation + and call it. + + It sends protocol buffers over the wire using gRPC (which is built on + top of HTTP/2); the ``grpcio`` package must be installed. + """ + + _grpc_channel: aio.Channel + _stubs: Dict[str, Callable] = {} + + @classmethod + def create_channel(cls, + host: str = 'confidentialcomputing.googleapis.com', + credentials: Optional[ga_credentials.Credentials] = None, + credentials_file: Optional[str] = None, + scopes: Optional[Sequence[str]] = None, + quota_project_id: Optional[str] = None, + **kwargs) -> aio.Channel: + """Create and return a gRPC AsyncIO channel object. + Args: + host (Optional[str]): The host for the channel to use. + credentials (Optional[~.Credentials]): The + authorization credentials to attach to requests. These + credentials identify this application to the service. If + none are specified, the client will attempt to ascertain + the credentials from the environment. + credentials_file (Optional[str]): A file with credentials that can + be loaded with :func:`google.auth.load_credentials_from_file`. + scopes (Optional[Sequence[str]]): A optional list of scopes needed for this + service. These are only used when credentials are not specified and + are passed to :func:`google.auth.default`. + quota_project_id (Optional[str]): An optional project to use for billing + and quota. + kwargs (Optional[dict]): Keyword arguments, which are passed to the + channel creation. + Returns: + aio.Channel: A gRPC AsyncIO channel object. + """ + + return grpc_helpers_async.create_channel( + host, + credentials=credentials, + credentials_file=credentials_file, + quota_project_id=quota_project_id, + default_scopes=cls.AUTH_SCOPES, + scopes=scopes, + default_host=cls.DEFAULT_HOST, + **kwargs + ) + + def __init__(self, *, + host: str = 'confidentialcomputing.googleapis.com', + credentials: Optional[ga_credentials.Credentials] = None, + credentials_file: Optional[str] = None, + scopes: Optional[Sequence[str]] = None, + channel: Optional[Union[aio.Channel, Callable[..., aio.Channel]]] = None, + api_mtls_endpoint: Optional[str] = None, + client_cert_source: Optional[Callable[[], Tuple[bytes, bytes]]] = None, + ssl_channel_credentials: Optional[grpc.ChannelCredentials] = None, + client_cert_source_for_mtls: Optional[Callable[[], Tuple[bytes, bytes]]] = None, + quota_project_id: Optional[str] = None, + client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO, + always_use_jwt_access: Optional[bool] = False, + api_audience: Optional[str] = None, + ) -> None: + """Instantiate the transport. + + Args: + host (Optional[str]): + The hostname to connect to (default: 'confidentialcomputing.googleapis.com'). + credentials (Optional[google.auth.credentials.Credentials]): The + authorization credentials to attach to requests. These + credentials identify the application to the service; if none + are specified, the client will attempt to ascertain the + credentials from the environment. + This argument is ignored if a ``channel`` instance is provided. + credentials_file (Optional[str]): A file with credentials that can + be loaded with :func:`google.auth.load_credentials_from_file`. + This argument is ignored if a ``channel`` instance is provided. + scopes (Optional[Sequence[str]]): A optional list of scopes needed for this + service. These are only used when credentials are not specified and + are passed to :func:`google.auth.default`. + channel (Optional[Union[aio.Channel, Callable[..., aio.Channel]]]): + A ``Channel`` instance through which to make calls, or a Callable + that constructs and returns one. If set to None, ``self.create_channel`` + is used to create the channel. If a Callable is given, it will be called + with the same arguments as used in ``self.create_channel``. + api_mtls_endpoint (Optional[str]): Deprecated. The mutual TLS endpoint. + If provided, it overrides the ``host`` argument and tries to create + a mutual TLS channel with client SSL credentials from + ``client_cert_source`` or application default SSL credentials. + client_cert_source (Optional[Callable[[], Tuple[bytes, bytes]]]): + Deprecated. A callback to provide client SSL certificate bytes and + private key bytes, both in PEM format. It is ignored if + ``api_mtls_endpoint`` is None. + ssl_channel_credentials (grpc.ChannelCredentials): SSL credentials + for the grpc channel. It is ignored if a ``channel`` instance is provided. + client_cert_source_for_mtls (Optional[Callable[[], Tuple[bytes, bytes]]]): + A callback to provide client certificate bytes and private key bytes, + both in PEM format. It is used to configure a mutual TLS channel. It is + ignored if a ``channel`` instance or ``ssl_channel_credentials`` is provided. + quota_project_id (Optional[str]): An optional project to use for billing + and quota. + client_info (google.api_core.gapic_v1.client_info.ClientInfo): + The client info used to send a user-agent string along with + API requests. If ``None``, then default info will be used. + Generally, you only need to set this if you're developing + your own client library. + always_use_jwt_access (Optional[bool]): Whether self signed JWT should + be used for service account credentials. + + Raises: + google.auth.exceptions.MutualTlsChannelError: If mutual TLS transport + creation failed for any reason. + google.api_core.exceptions.DuplicateCredentialArgs: If both ``credentials`` + and ``credentials_file`` are passed. + """ + self._grpc_channel = None + self._ssl_channel_credentials = ssl_channel_credentials + self._stubs: Dict[str, Callable] = {} + + if api_mtls_endpoint: + warnings.warn("api_mtls_endpoint is deprecated", DeprecationWarning) + if client_cert_source: + warnings.warn("client_cert_source is deprecated", DeprecationWarning) + + if isinstance(channel, aio.Channel): + # Ignore credentials if a channel was passed. + credentials = None + self._ignore_credentials = True + # If a channel was explicitly provided, set it. + self._grpc_channel = channel + self._ssl_channel_credentials = None + else: + if api_mtls_endpoint: + host = api_mtls_endpoint + + # Create SSL credentials with client_cert_source or application + # default SSL credentials. + if client_cert_source: + cert, key = client_cert_source() + self._ssl_channel_credentials = grpc.ssl_channel_credentials( + certificate_chain=cert, private_key=key + ) + else: + self._ssl_channel_credentials = SslCredentials().ssl_credentials + + else: + if client_cert_source_for_mtls and not ssl_channel_credentials: + cert, key = client_cert_source_for_mtls() + self._ssl_channel_credentials = grpc.ssl_channel_credentials( + certificate_chain=cert, private_key=key + ) + + # The base transport sets the host, credentials and scopes + super().__init__( + host=host, + credentials=credentials, + credentials_file=credentials_file, + scopes=scopes, + quota_project_id=quota_project_id, + client_info=client_info, + always_use_jwt_access=always_use_jwt_access, + api_audience=api_audience, + ) + + if not self._grpc_channel: + # initialize with the provided callable or the default channel + channel_init = channel or type(self).create_channel + self._grpc_channel = channel_init( + self._host, + # use the credentials which are saved + credentials=self._credentials, + # Set ``credentials_file`` to ``None`` here as + # the credentials that we saved earlier should be used. + credentials_file=None, + scopes=self._scopes, + ssl_credentials=self._ssl_channel_credentials, + quota_project_id=quota_project_id, + options=[ + ("grpc.max_send_message_length", -1), + ("grpc.max_receive_message_length", -1), + ], + ) + + self._interceptor = _LoggingClientAIOInterceptor() + self._grpc_channel._unary_unary_interceptors.append(self._interceptor) + self._logged_channel = self._grpc_channel + self._wrap_with_kind = "kind" in inspect.signature(gapic_v1.method_async.wrap_method).parameters + # Wrap messages. This must be done after self._logged_channel exists + self._prep_wrapped_messages(client_info) + + @property + def grpc_channel(self) -> aio.Channel: + """Create the channel designed to connect to this service. + + This property caches on the instance; repeated calls return + the same channel. + """ + # Return the channel from cache. + return self._grpc_channel + + @property + def create_challenge(self) -> Callable[ + [service.CreateChallengeRequest], + Awaitable[service.Challenge]]: + r"""Return a callable for the create challenge method over gRPC. + + Creates a new Challenge in a given project and + location. + + Returns: + Callable[[~.CreateChallengeRequest], + Awaitable[~.Challenge]]: + A function that, when called, will call the underlying RPC + on the server. + """ + # Generate a "stub function" on-the-fly which will actually make + # the request. + # gRPC handles serialization and deserialization, so we just need + # to pass in the functions for each. + if 'create_challenge' not in self._stubs: + self._stubs['create_challenge'] = self._logged_channel.unary_unary( + '/google.cloud.confidentialcomputing.v1.ConfidentialComputing/CreateChallenge', + request_serializer=service.CreateChallengeRequest.serialize, + response_deserializer=service.Challenge.deserialize, + ) + return self._stubs['create_challenge'] + + @property + def verify_attestation(self) -> Callable[ + [service.VerifyAttestationRequest], + Awaitable[service.VerifyAttestationResponse]]: + r"""Return a callable for the verify attestation method over gRPC. + + Verifies the provided attestation info, returning a + signed attestation token. + + Returns: + Callable[[~.VerifyAttestationRequest], + Awaitable[~.VerifyAttestationResponse]]: + A function that, when called, will call the underlying RPC + on the server. + """ + # Generate a "stub function" on-the-fly which will actually make + # the request. + # gRPC handles serialization and deserialization, so we just need + # to pass in the functions for each. + if 'verify_attestation' not in self._stubs: + self._stubs['verify_attestation'] = self._logged_channel.unary_unary( + '/google.cloud.confidentialcomputing.v1.ConfidentialComputing/VerifyAttestation', + request_serializer=service.VerifyAttestationRequest.serialize, + response_deserializer=service.VerifyAttestationResponse.deserialize, + ) + return self._stubs['verify_attestation'] + + @property + def verify_confidential_space(self) -> Callable[ + [service.VerifyConfidentialSpaceRequest], + Awaitable[service.VerifyConfidentialSpaceResponse]]: + r"""Return a callable for the verify confidential space method over gRPC. + + Verifies whether the provided attestation info is + valid, returning a signed attestation token if so. + + Returns: + Callable[[~.VerifyConfidentialSpaceRequest], + Awaitable[~.VerifyConfidentialSpaceResponse]]: + A function that, when called, will call the underlying RPC + on the server. + """ + # Generate a "stub function" on-the-fly which will actually make + # the request. + # gRPC handles serialization and deserialization, so we just need + # to pass in the functions for each. + if 'verify_confidential_space' not in self._stubs: + self._stubs['verify_confidential_space'] = self._logged_channel.unary_unary( + '/google.cloud.confidentialcomputing.v1.ConfidentialComputing/VerifyConfidentialSpace', + request_serializer=service.VerifyConfidentialSpaceRequest.serialize, + response_deserializer=service.VerifyConfidentialSpaceResponse.deserialize, + ) + return self._stubs['verify_confidential_space'] + + @property + def verify_confidential_gke(self) -> Callable[ + [service.VerifyConfidentialGkeRequest], + Awaitable[service.VerifyConfidentialGkeResponse]]: + r"""Return a callable for the verify confidential gke method over gRPC. + + Verifies the provided Confidential GKE attestation + info, returning a signed OIDC token. + + Returns: + Callable[[~.VerifyConfidentialGkeRequest], + Awaitable[~.VerifyConfidentialGkeResponse]]: + A function that, when called, will call the underlying RPC + on the server. + """ + # Generate a "stub function" on-the-fly which will actually make + # the request. + # gRPC handles serialization and deserialization, so we just need + # to pass in the functions for each. + if 'verify_confidential_gke' not in self._stubs: + self._stubs['verify_confidential_gke'] = self._logged_channel.unary_unary( + '/google.cloud.confidentialcomputing.v1.ConfidentialComputing/VerifyConfidentialGke', + request_serializer=service.VerifyConfidentialGkeRequest.serialize, + response_deserializer=service.VerifyConfidentialGkeResponse.deserialize, + ) + return self._stubs['verify_confidential_gke'] + + def _prep_wrapped_messages(self, client_info): + """ Precompute the wrapped methods, overriding the base class method to use async wrappers.""" + self._wrapped_methods = { + self.create_challenge: self._wrap_method( + self.create_challenge, + default_retry=retries.AsyncRetry( + initial=1.0, + maximum=60.0, + multiplier=1.3, + predicate=retries.if_exception_type( + core_exceptions.ServiceUnavailable, + ), + deadline=60.0, + ), + default_timeout=60.0, + client_info=client_info, + ), + self.verify_attestation: self._wrap_method( + self.verify_attestation, + default_retry=retries.AsyncRetry( + initial=1.0, + maximum=60.0, + multiplier=1.3, + predicate=retries.if_exception_type( + core_exceptions.ServiceUnavailable, + ), + deadline=60.0, + ), + default_timeout=60.0, + client_info=client_info, + ), + self.verify_confidential_space: self._wrap_method( + self.verify_confidential_space, + default_retry=retries.AsyncRetry( + initial=1.0, + maximum=60.0, + multiplier=1.3, + predicate=retries.if_exception_type( + core_exceptions.ServiceUnavailable, + ), + deadline=60.0, + ), + default_timeout=60.0, + client_info=client_info, + ), + self.verify_confidential_gke: self._wrap_method( + self.verify_confidential_gke, + default_retry=retries.AsyncRetry( + initial=1.0, + maximum=60.0, + multiplier=1.3, + predicate=retries.if_exception_type( + core_exceptions.ServiceUnavailable, + ), + deadline=60.0, + ), + default_timeout=60.0, + client_info=client_info, + ), + self.get_location: self._wrap_method( + self.get_location, + default_timeout=None, + client_info=client_info, + ), + self.list_locations: self._wrap_method( + self.list_locations, + default_timeout=None, + client_info=client_info, + ), + } + + def _wrap_method(self, func, *args, **kwargs): + if self._wrap_with_kind: # pragma: NO COVER + kwargs["kind"] = self.kind + return gapic_v1.method_async.wrap_method(func, *args, **kwargs) + + def close(self): + return self._logged_channel.close() + + @property + def kind(self) -> str: + return "grpc_asyncio" + + @property + def list_locations( + self, + ) -> Callable[[locations_pb2.ListLocationsRequest], locations_pb2.ListLocationsResponse]: + r"""Return a callable for the list locations method over gRPC. + """ + # Generate a "stub function" on-the-fly which will actually make + # the request. + # gRPC handles serialization and deserialization, so we just need + # to pass in the functions for each. + if "list_locations" not in self._stubs: + self._stubs["list_locations"] = self._logged_channel.unary_unary( + "/google.cloud.location.Locations/ListLocations", + request_serializer=locations_pb2.ListLocationsRequest.SerializeToString, + response_deserializer=locations_pb2.ListLocationsResponse.FromString, + ) + return self._stubs["list_locations"] + + @property + def get_location( + self, + ) -> Callable[[locations_pb2.GetLocationRequest], locations_pb2.Location]: + r"""Return a callable for the list locations method over gRPC. + """ + # Generate a "stub function" on-the-fly which will actually make + # the request. + # gRPC handles serialization and deserialization, so we just need + # to pass in the functions for each. + if "get_location" not in self._stubs: + self._stubs["get_location"] = self._logged_channel.unary_unary( + "/google.cloud.location.Locations/GetLocation", + request_serializer=locations_pb2.GetLocationRequest.SerializeToString, + response_deserializer=locations_pb2.Location.FromString, + ) + return self._stubs["get_location"] + + +__all__ = ( + 'ConfidentialComputingGrpcAsyncIOTransport', +) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest.py new file mode 100644 index 000000000000..440084e79181 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest.py @@ -0,0 +1,1179 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +import logging +import json # type: ignore + +from google.auth.transport.requests import AuthorizedSession # type: ignore +from google.auth import credentials as ga_credentials # type: ignore +from google.api_core import exceptions as core_exceptions +from google.api_core import retry as retries +from google.api_core import rest_helpers +from google.api_core import rest_streaming +from google.api_core import gapic_v1 +import google.protobuf + +from google.protobuf import json_format +from google.cloud.location import locations_pb2 # type: ignore + +from requests import __version__ as requests_version +import dataclasses +from typing import Any, Callable, Dict, List, Optional, Sequence, Tuple, Union +import warnings + + +from google.cloud.confidentialcomputing_v1.types import service + + +from .rest_base import _BaseConfidentialComputingRestTransport +from .base import DEFAULT_CLIENT_INFO as BASE_DEFAULT_CLIENT_INFO + +try: + OptionalRetry = Union[retries.Retry, gapic_v1.method._MethodDefault, None] +except AttributeError: # pragma: NO COVER + OptionalRetry = Union[retries.Retry, object, None] # type: ignore + +try: + from google.api_core import client_logging # type: ignore + CLIENT_LOGGING_SUPPORTED = True # pragma: NO COVER +except ImportError: # pragma: NO COVER + CLIENT_LOGGING_SUPPORTED = False + +_LOGGER = logging.getLogger(__name__) + +DEFAULT_CLIENT_INFO = gapic_v1.client_info.ClientInfo( + gapic_version=BASE_DEFAULT_CLIENT_INFO.gapic_version, + grpc_version=None, + rest_version=f"requests@{requests_version}", +) + +if hasattr(DEFAULT_CLIENT_INFO, "protobuf_runtime_version"): # pragma: NO COVER + DEFAULT_CLIENT_INFO.protobuf_runtime_version = google.protobuf.__version__ + + +class ConfidentialComputingRestInterceptor: + """Interceptor for ConfidentialComputing. + + Interceptors are used to manipulate requests, request metadata, and responses + in arbitrary ways. + Example use cases include: + * Logging + * Verifying requests according to service or custom semantics + * Stripping extraneous information from responses + + These use cases and more can be enabled by injecting an + instance of a custom subclass when constructing the ConfidentialComputingRestTransport. + + .. code-block:: python + class MyCustomConfidentialComputingInterceptor(ConfidentialComputingRestInterceptor): + def pre_create_challenge(self, request, metadata): + logging.log(f"Received request: {request}") + return request, metadata + + def post_create_challenge(self, response): + logging.log(f"Received response: {response}") + return response + + def pre_verify_attestation(self, request, metadata): + logging.log(f"Received request: {request}") + return request, metadata + + def post_verify_attestation(self, response): + logging.log(f"Received response: {response}") + return response + + def pre_verify_confidential_gke(self, request, metadata): + logging.log(f"Received request: {request}") + return request, metadata + + def post_verify_confidential_gke(self, response): + logging.log(f"Received response: {response}") + return response + + def pre_verify_confidential_space(self, request, metadata): + logging.log(f"Received request: {request}") + return request, metadata + + def post_verify_confidential_space(self, response): + logging.log(f"Received response: {response}") + return response + + transport = ConfidentialComputingRestTransport(interceptor=MyCustomConfidentialComputingInterceptor()) + client = ConfidentialComputingClient(transport=transport) + + + """ + def pre_create_challenge(self, request: service.CreateChallengeRequest, metadata: Sequence[Tuple[str, Union[str, bytes]]]) -> Tuple[service.CreateChallengeRequest, Sequence[Tuple[str, Union[str, bytes]]]]: + """Pre-rpc interceptor for create_challenge + + Override in a subclass to manipulate the request or metadata + before they are sent to the ConfidentialComputing server. + """ + return request, metadata + + def post_create_challenge(self, response: service.Challenge) -> service.Challenge: + """Post-rpc interceptor for create_challenge + + DEPRECATED. Please use the `post_create_challenge_with_metadata` + interceptor instead. + + Override in a subclass to read or manipulate the response + after it is returned by the ConfidentialComputing server but before + it is returned to user code. This `post_create_challenge` interceptor runs + before the `post_create_challenge_with_metadata` interceptor. + """ + return response + + def post_create_challenge_with_metadata(self, response: service.Challenge, metadata: Sequence[Tuple[str, Union[str, bytes]]]) -> Tuple[service.Challenge, Sequence[Tuple[str, Union[str, bytes]]]]: + """Post-rpc interceptor for create_challenge + + Override in a subclass to read or manipulate the response or metadata after it + is returned by the ConfidentialComputing server but before it is returned to user code. + + We recommend only using this `post_create_challenge_with_metadata` + interceptor in new development instead of the `post_create_challenge` interceptor. + When both interceptors are used, this `post_create_challenge_with_metadata` interceptor runs after the + `post_create_challenge` interceptor. The (possibly modified) response returned by + `post_create_challenge` will be passed to + `post_create_challenge_with_metadata`. + """ + return response, metadata + + def pre_verify_attestation(self, request: service.VerifyAttestationRequest, metadata: Sequence[Tuple[str, Union[str, bytes]]]) -> Tuple[service.VerifyAttestationRequest, Sequence[Tuple[str, Union[str, bytes]]]]: + """Pre-rpc interceptor for verify_attestation + + Override in a subclass to manipulate the request or metadata + before they are sent to the ConfidentialComputing server. + """ + return request, metadata + + def post_verify_attestation(self, response: service.VerifyAttestationResponse) -> service.VerifyAttestationResponse: + """Post-rpc interceptor for verify_attestation + + DEPRECATED. Please use the `post_verify_attestation_with_metadata` + interceptor instead. + + Override in a subclass to read or manipulate the response + after it is returned by the ConfidentialComputing server but before + it is returned to user code. This `post_verify_attestation` interceptor runs + before the `post_verify_attestation_with_metadata` interceptor. + """ + return response + + def post_verify_attestation_with_metadata(self, response: service.VerifyAttestationResponse, metadata: Sequence[Tuple[str, Union[str, bytes]]]) -> Tuple[service.VerifyAttestationResponse, Sequence[Tuple[str, Union[str, bytes]]]]: + """Post-rpc interceptor for verify_attestation + + Override in a subclass to read or manipulate the response or metadata after it + is returned by the ConfidentialComputing server but before it is returned to user code. + + We recommend only using this `post_verify_attestation_with_metadata` + interceptor in new development instead of the `post_verify_attestation` interceptor. + When both interceptors are used, this `post_verify_attestation_with_metadata` interceptor runs after the + `post_verify_attestation` interceptor. The (possibly modified) response returned by + `post_verify_attestation` will be passed to + `post_verify_attestation_with_metadata`. + """ + return response, metadata + + def pre_verify_confidential_gke(self, request: service.VerifyConfidentialGkeRequest, metadata: Sequence[Tuple[str, Union[str, bytes]]]) -> Tuple[service.VerifyConfidentialGkeRequest, Sequence[Tuple[str, Union[str, bytes]]]]: + """Pre-rpc interceptor for verify_confidential_gke + + Override in a subclass to manipulate the request or metadata + before they are sent to the ConfidentialComputing server. + """ + return request, metadata + + def post_verify_confidential_gke(self, response: service.VerifyConfidentialGkeResponse) -> service.VerifyConfidentialGkeResponse: + """Post-rpc interceptor for verify_confidential_gke + + DEPRECATED. Please use the `post_verify_confidential_gke_with_metadata` + interceptor instead. + + Override in a subclass to read or manipulate the response + after it is returned by the ConfidentialComputing server but before + it is returned to user code. This `post_verify_confidential_gke` interceptor runs + before the `post_verify_confidential_gke_with_metadata` interceptor. + """ + return response + + def post_verify_confidential_gke_with_metadata(self, response: service.VerifyConfidentialGkeResponse, metadata: Sequence[Tuple[str, Union[str, bytes]]]) -> Tuple[service.VerifyConfidentialGkeResponse, Sequence[Tuple[str, Union[str, bytes]]]]: + """Post-rpc interceptor for verify_confidential_gke + + Override in a subclass to read or manipulate the response or metadata after it + is returned by the ConfidentialComputing server but before it is returned to user code. + + We recommend only using this `post_verify_confidential_gke_with_metadata` + interceptor in new development instead of the `post_verify_confidential_gke` interceptor. + When both interceptors are used, this `post_verify_confidential_gke_with_metadata` interceptor runs after the + `post_verify_confidential_gke` interceptor. The (possibly modified) response returned by + `post_verify_confidential_gke` will be passed to + `post_verify_confidential_gke_with_metadata`. + """ + return response, metadata + + def pre_verify_confidential_space(self, request: service.VerifyConfidentialSpaceRequest, metadata: Sequence[Tuple[str, Union[str, bytes]]]) -> Tuple[service.VerifyConfidentialSpaceRequest, Sequence[Tuple[str, Union[str, bytes]]]]: + """Pre-rpc interceptor for verify_confidential_space + + Override in a subclass to manipulate the request or metadata + before they are sent to the ConfidentialComputing server. + """ + return request, metadata + + def post_verify_confidential_space(self, response: service.VerifyConfidentialSpaceResponse) -> service.VerifyConfidentialSpaceResponse: + """Post-rpc interceptor for verify_confidential_space + + DEPRECATED. Please use the `post_verify_confidential_space_with_metadata` + interceptor instead. + + Override in a subclass to read or manipulate the response + after it is returned by the ConfidentialComputing server but before + it is returned to user code. This `post_verify_confidential_space` interceptor runs + before the `post_verify_confidential_space_with_metadata` interceptor. + """ + return response + + def post_verify_confidential_space_with_metadata(self, response: service.VerifyConfidentialSpaceResponse, metadata: Sequence[Tuple[str, Union[str, bytes]]]) -> Tuple[service.VerifyConfidentialSpaceResponse, Sequence[Tuple[str, Union[str, bytes]]]]: + """Post-rpc interceptor for verify_confidential_space + + Override in a subclass to read or manipulate the response or metadata after it + is returned by the ConfidentialComputing server but before it is returned to user code. + + We recommend only using this `post_verify_confidential_space_with_metadata` + interceptor in new development instead of the `post_verify_confidential_space` interceptor. + When both interceptors are used, this `post_verify_confidential_space_with_metadata` interceptor runs after the + `post_verify_confidential_space` interceptor. The (possibly modified) response returned by + `post_verify_confidential_space` will be passed to + `post_verify_confidential_space_with_metadata`. + """ + return response, metadata + + def pre_get_location( + self, request: locations_pb2.GetLocationRequest, metadata: Sequence[Tuple[str, Union[str, bytes]]] + ) -> Tuple[locations_pb2.GetLocationRequest, Sequence[Tuple[str, Union[str, bytes]]]]: + """Pre-rpc interceptor for get_location + + Override in a subclass to manipulate the request or metadata + before they are sent to the ConfidentialComputing server. + """ + return request, metadata + + def post_get_location( + self, response: locations_pb2.Location + ) -> locations_pb2.Location: + """Post-rpc interceptor for get_location + + Override in a subclass to manipulate the response + after it is returned by the ConfidentialComputing server but before + it is returned to user code. + """ + return response + + def pre_list_locations( + self, request: locations_pb2.ListLocationsRequest, metadata: Sequence[Tuple[str, Union[str, bytes]]] + ) -> Tuple[locations_pb2.ListLocationsRequest, Sequence[Tuple[str, Union[str, bytes]]]]: + """Pre-rpc interceptor for list_locations + + Override in a subclass to manipulate the request or metadata + before they are sent to the ConfidentialComputing server. + """ + return request, metadata + + def post_list_locations( + self, response: locations_pb2.ListLocationsResponse + ) -> locations_pb2.ListLocationsResponse: + """Post-rpc interceptor for list_locations + + Override in a subclass to manipulate the response + after it is returned by the ConfidentialComputing server but before + it is returned to user code. + """ + return response + + +@dataclasses.dataclass +class ConfidentialComputingRestStub: + _session: AuthorizedSession + _host: str + _interceptor: ConfidentialComputingRestInterceptor + + +class ConfidentialComputingRestTransport(_BaseConfidentialComputingRestTransport): + """REST backend synchronous transport for ConfidentialComputing. + + Service describing handlers for resources + + This class defines the same methods as the primary client, so the + primary client can load the underlying transport implementation + and call it. + + It sends JSON representations of protocol buffers over HTTP/1.1 + """ + + def __init__(self, *, + host: str = 'confidentialcomputing.googleapis.com', + credentials: Optional[ga_credentials.Credentials] = None, + credentials_file: Optional[str] = None, + scopes: Optional[Sequence[str]] = None, + client_cert_source_for_mtls: Optional[Callable[[ + ], Tuple[bytes, bytes]]] = None, + quota_project_id: Optional[str] = None, + client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO, + always_use_jwt_access: Optional[bool] = False, + url_scheme: str = 'https', + interceptor: Optional[ConfidentialComputingRestInterceptor] = None, + api_audience: Optional[str] = None, + ) -> None: + """Instantiate the transport. + + Args: + host (Optional[str]): + The hostname to connect to (default: 'confidentialcomputing.googleapis.com'). + credentials (Optional[google.auth.credentials.Credentials]): The + authorization credentials to attach to requests. These + credentials identify the application to the service; if none + are specified, the client will attempt to ascertain the + credentials from the environment. + + credentials_file (Optional[str]): A file with credentials that can + be loaded with :func:`google.auth.load_credentials_from_file`. + This argument is ignored if ``channel`` is provided. + scopes (Optional(Sequence[str])): A list of scopes. This argument is + ignored if ``channel`` is provided. + client_cert_source_for_mtls (Callable[[], Tuple[bytes, bytes]]): Client + certificate to configure mutual TLS HTTP channel. It is ignored + if ``channel`` is provided. + quota_project_id (Optional[str]): An optional project to use for billing + and quota. + client_info (google.api_core.gapic_v1.client_info.ClientInfo): + The client info used to send a user-agent string along with + API requests. If ``None``, then default info will be used. + Generally, you only need to set this if you are developing + your own client library. + always_use_jwt_access (Optional[bool]): Whether self signed JWT should + be used for service account credentials. + url_scheme: the protocol scheme for the API endpoint. Normally + "https", but for testing or local servers, + "http" can be specified. + """ + # Run the base constructor + # TODO(yon-mg): resolve other ctor params i.e. scopes, quota, etc. + # TODO: When custom host (api_endpoint) is set, `scopes` must *also* be set on the + # credentials object + super().__init__( + host=host, + credentials=credentials, + client_info=client_info, + always_use_jwt_access=always_use_jwt_access, + url_scheme=url_scheme, + api_audience=api_audience + ) + self._session = AuthorizedSession( + self._credentials, default_host=self.DEFAULT_HOST) + if client_cert_source_for_mtls: + self._session.configure_mtls_channel(client_cert_source_for_mtls) + self._interceptor = interceptor or ConfidentialComputingRestInterceptor() + self._prep_wrapped_messages(client_info) + + class _CreateChallenge(_BaseConfidentialComputingRestTransport._BaseCreateChallenge, ConfidentialComputingRestStub): + def __hash__(self): + return hash("ConfidentialComputingRestTransport.CreateChallenge") + + @staticmethod + def _get_response( + host, + metadata, + query_params, + session, + timeout, + transcoded_request, + body=None): + + uri = transcoded_request['uri'] + method = transcoded_request['method'] + headers = dict(metadata) + headers['Content-Type'] = 'application/json' + response = getattr(session, method)( + "{host}{uri}".format(host=host, uri=uri), + timeout=timeout, + headers=headers, + params=rest_helpers.flatten_query_params(query_params, strict=True), + data=body, + ) + return response + + def __call__(self, + request: service.CreateChallengeRequest, *, + retry: OptionalRetry=gapic_v1.method.DEFAULT, + timeout: Optional[float]=None, + metadata: Sequence[Tuple[str, Union[str, bytes]]]=(), + ) -> service.Challenge: + r"""Call the create challenge method over HTTP. + + Args: + request (~.service.CreateChallengeRequest): + The request object. Message for creating a Challenge + retry (google.api_core.retry.Retry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + ~.service.Challenge: + A Challenge from the server used to + guarantee freshness of attestations + + """ + + http_options = _BaseConfidentialComputingRestTransport._BaseCreateChallenge._get_http_options() + + request, metadata = self._interceptor.pre_create_challenge(request, metadata) + transcoded_request = _BaseConfidentialComputingRestTransport._BaseCreateChallenge._get_transcoded_request(http_options, request) + + body = _BaseConfidentialComputingRestTransport._BaseCreateChallenge._get_request_body_json(transcoded_request) + + # Jsonify the query params + query_params = _BaseConfidentialComputingRestTransport._BaseCreateChallenge._get_query_params_json(transcoded_request) + + if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER + request_url = "{host}{uri}".format(host=self._host, uri=transcoded_request['uri']) + method = transcoded_request['method'] + try: + request_payload = type(request).to_json(request) + except: + request_payload = None + http_request = { + "payload": request_payload, + "requestMethod": method, + "requestUrl": request_url, + "headers": dict(metadata), + } + _LOGGER.debug( + f"Sending request for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.CreateChallenge", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": "CreateChallenge", + "httpRequest": http_request, + "metadata": http_request["headers"], + }, + ) + + # Send the request + response = ConfidentialComputingRestTransport._CreateChallenge._get_response(self._host, metadata, query_params, self._session, timeout, transcoded_request, body) + + # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception + # subclass. + if response.status_code >= 400: + raise core_exceptions.from_http_response(response) + + # Return the response + resp = service.Challenge() + pb_resp = service.Challenge.pb(resp) + + json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True) + + resp = self._interceptor.post_create_challenge(resp) + response_metadata = [(k, str(v)) for k, v in response.headers.items()] + resp, _ = self._interceptor.post_create_challenge_with_metadata(resp, response_metadata) + if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER + try: + response_payload = service.Challenge.to_json(response) + except: + response_payload = None + http_response = { + "payload": response_payload, + "headers": dict(response.headers), + "status": response.status_code, + } + _LOGGER.debug( + "Received response for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.create_challenge", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": "CreateChallenge", + "metadata": http_response["headers"], + "httpResponse": http_response, + }, + ) + return resp + + class _VerifyAttestation(_BaseConfidentialComputingRestTransport._BaseVerifyAttestation, ConfidentialComputingRestStub): + def __hash__(self): + return hash("ConfidentialComputingRestTransport.VerifyAttestation") + + @staticmethod + def _get_response( + host, + metadata, + query_params, + session, + timeout, + transcoded_request, + body=None): + + uri = transcoded_request['uri'] + method = transcoded_request['method'] + headers = dict(metadata) + headers['Content-Type'] = 'application/json' + response = getattr(session, method)( + "{host}{uri}".format(host=host, uri=uri), + timeout=timeout, + headers=headers, + params=rest_helpers.flatten_query_params(query_params, strict=True), + data=body, + ) + return response + + def __call__(self, + request: service.VerifyAttestationRequest, *, + retry: OptionalRetry=gapic_v1.method.DEFAULT, + timeout: Optional[float]=None, + metadata: Sequence[Tuple[str, Union[str, bytes]]]=(), + ) -> service.VerifyAttestationResponse: + r"""Call the verify attestation method over HTTP. + + Args: + request (~.service.VerifyAttestationRequest): + The request object. A request for an attestation token, + providing all the necessary information + needed for this service to verify the + platform state of the requestor. + retry (google.api_core.retry.Retry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + ~.service.VerifyAttestationResponse: + A response once an attestation has + been successfully verified, containing a + signed attestation token. + + """ + + http_options = _BaseConfidentialComputingRestTransport._BaseVerifyAttestation._get_http_options() + + request, metadata = self._interceptor.pre_verify_attestation(request, metadata) + transcoded_request = _BaseConfidentialComputingRestTransport._BaseVerifyAttestation._get_transcoded_request(http_options, request) + + body = _BaseConfidentialComputingRestTransport._BaseVerifyAttestation._get_request_body_json(transcoded_request) + + # Jsonify the query params + query_params = _BaseConfidentialComputingRestTransport._BaseVerifyAttestation._get_query_params_json(transcoded_request) + + if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER + request_url = "{host}{uri}".format(host=self._host, uri=transcoded_request['uri']) + method = transcoded_request['method'] + try: + request_payload = type(request).to_json(request) + except: + request_payload = None + http_request = { + "payload": request_payload, + "requestMethod": method, + "requestUrl": request_url, + "headers": dict(metadata), + } + _LOGGER.debug( + f"Sending request for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.VerifyAttestation", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": "VerifyAttestation", + "httpRequest": http_request, + "metadata": http_request["headers"], + }, + ) + + # Send the request + response = ConfidentialComputingRestTransport._VerifyAttestation._get_response(self._host, metadata, query_params, self._session, timeout, transcoded_request, body) + + # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception + # subclass. + if response.status_code >= 400: + raise core_exceptions.from_http_response(response) + + # Return the response + resp = service.VerifyAttestationResponse() + pb_resp = service.VerifyAttestationResponse.pb(resp) + + json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True) + + resp = self._interceptor.post_verify_attestation(resp) + response_metadata = [(k, str(v)) for k, v in response.headers.items()] + resp, _ = self._interceptor.post_verify_attestation_with_metadata(resp, response_metadata) + if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER + try: + response_payload = service.VerifyAttestationResponse.to_json(response) + except: + response_payload = None + http_response = { + "payload": response_payload, + "headers": dict(response.headers), + "status": response.status_code, + } + _LOGGER.debug( + "Received response for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.verify_attestation", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": "VerifyAttestation", + "metadata": http_response["headers"], + "httpResponse": http_response, + }, + ) + return resp + + class _VerifyConfidentialGke(_BaseConfidentialComputingRestTransport._BaseVerifyConfidentialGke, ConfidentialComputingRestStub): + def __hash__(self): + return hash("ConfidentialComputingRestTransport.VerifyConfidentialGke") + + @staticmethod + def _get_response( + host, + metadata, + query_params, + session, + timeout, + transcoded_request, + body=None): + + uri = transcoded_request['uri'] + method = transcoded_request['method'] + headers = dict(metadata) + headers['Content-Type'] = 'application/json' + response = getattr(session, method)( + "{host}{uri}".format(host=host, uri=uri), + timeout=timeout, + headers=headers, + params=rest_helpers.flatten_query_params(query_params, strict=True), + data=body, + ) + return response + + def __call__(self, + request: service.VerifyConfidentialGkeRequest, *, + retry: OptionalRetry=gapic_v1.method.DEFAULT, + timeout: Optional[float]=None, + metadata: Sequence[Tuple[str, Union[str, bytes]]]=(), + ) -> service.VerifyConfidentialGkeResponse: + r"""Call the verify confidential gke method over HTTP. + + Args: + request (~.service.VerifyConfidentialGkeRequest): + The request object. A request for an attestation token, + providing all the necessary information + needed for this service to verify + Confidential GKE platform state of the + requestor. + retry (google.api_core.retry.Retry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + ~.service.VerifyConfidentialGkeResponse: + VerifyConfidentialGkeResponse + response is returened once a + Confidential GKE attestation has been + successfully verified, containing a + signed OIDC token. + + """ + + http_options = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialGke._get_http_options() + + request, metadata = self._interceptor.pre_verify_confidential_gke(request, metadata) + transcoded_request = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialGke._get_transcoded_request(http_options, request) + + body = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialGke._get_request_body_json(transcoded_request) + + # Jsonify the query params + query_params = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialGke._get_query_params_json(transcoded_request) + + if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER + request_url = "{host}{uri}".format(host=self._host, uri=transcoded_request['uri']) + method = transcoded_request['method'] + try: + request_payload = type(request).to_json(request) + except: + request_payload = None + http_request = { + "payload": request_payload, + "requestMethod": method, + "requestUrl": request_url, + "headers": dict(metadata), + } + _LOGGER.debug( + f"Sending request for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.VerifyConfidentialGke", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": "VerifyConfidentialGke", + "httpRequest": http_request, + "metadata": http_request["headers"], + }, + ) + + # Send the request + response = ConfidentialComputingRestTransport._VerifyConfidentialGke._get_response(self._host, metadata, query_params, self._session, timeout, transcoded_request, body) + + # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception + # subclass. + if response.status_code >= 400: + raise core_exceptions.from_http_response(response) + + # Return the response + resp = service.VerifyConfidentialGkeResponse() + pb_resp = service.VerifyConfidentialGkeResponse.pb(resp) + + json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True) + + resp = self._interceptor.post_verify_confidential_gke(resp) + response_metadata = [(k, str(v)) for k, v in response.headers.items()] + resp, _ = self._interceptor.post_verify_confidential_gke_with_metadata(resp, response_metadata) + if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER + try: + response_payload = service.VerifyConfidentialGkeResponse.to_json(response) + except: + response_payload = None + http_response = { + "payload": response_payload, + "headers": dict(response.headers), + "status": response.status_code, + } + _LOGGER.debug( + "Received response for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.verify_confidential_gke", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": "VerifyConfidentialGke", + "metadata": http_response["headers"], + "httpResponse": http_response, + }, + ) + return resp + + class _VerifyConfidentialSpace(_BaseConfidentialComputingRestTransport._BaseVerifyConfidentialSpace, ConfidentialComputingRestStub): + def __hash__(self): + return hash("ConfidentialComputingRestTransport.VerifyConfidentialSpace") + + @staticmethod + def _get_response( + host, + metadata, + query_params, + session, + timeout, + transcoded_request, + body=None): + + uri = transcoded_request['uri'] + method = transcoded_request['method'] + headers = dict(metadata) + headers['Content-Type'] = 'application/json' + response = getattr(session, method)( + "{host}{uri}".format(host=host, uri=uri), + timeout=timeout, + headers=headers, + params=rest_helpers.flatten_query_params(query_params, strict=True), + data=body, + ) + return response + + def __call__(self, + request: service.VerifyConfidentialSpaceRequest, *, + retry: OptionalRetry=gapic_v1.method.DEFAULT, + timeout: Optional[float]=None, + metadata: Sequence[Tuple[str, Union[str, bytes]]]=(), + ) -> service.VerifyConfidentialSpaceResponse: + r"""Call the verify confidential space method over HTTP. + + Args: + request (~.service.VerifyConfidentialSpaceRequest): + The request object. A request for an attestation token, + providing all the necessary information + needed for this service to verify the + platform state of the requestor. + retry (google.api_core.retry.Retry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + ~.service.VerifyConfidentialSpaceResponse: + VerifyConfidentialSpaceResponse is + returned once a Confidential Space + attestation has been successfully + verified, containing a signed token. + + """ + + http_options = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialSpace._get_http_options() + + request, metadata = self._interceptor.pre_verify_confidential_space(request, metadata) + transcoded_request = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialSpace._get_transcoded_request(http_options, request) + + body = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialSpace._get_request_body_json(transcoded_request) + + # Jsonify the query params + query_params = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialSpace._get_query_params_json(transcoded_request) + + if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER + request_url = "{host}{uri}".format(host=self._host, uri=transcoded_request['uri']) + method = transcoded_request['method'] + try: + request_payload = type(request).to_json(request) + except: + request_payload = None + http_request = { + "payload": request_payload, + "requestMethod": method, + "requestUrl": request_url, + "headers": dict(metadata), + } + _LOGGER.debug( + f"Sending request for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.VerifyConfidentialSpace", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": "VerifyConfidentialSpace", + "httpRequest": http_request, + "metadata": http_request["headers"], + }, + ) + + # Send the request + response = ConfidentialComputingRestTransport._VerifyConfidentialSpace._get_response(self._host, metadata, query_params, self._session, timeout, transcoded_request, body) + + # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception + # subclass. + if response.status_code >= 400: + raise core_exceptions.from_http_response(response) + + # Return the response + resp = service.VerifyConfidentialSpaceResponse() + pb_resp = service.VerifyConfidentialSpaceResponse.pb(resp) + + json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True) + + resp = self._interceptor.post_verify_confidential_space(resp) + response_metadata = [(k, str(v)) for k, v in response.headers.items()] + resp, _ = self._interceptor.post_verify_confidential_space_with_metadata(resp, response_metadata) + if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER + try: + response_payload = service.VerifyConfidentialSpaceResponse.to_json(response) + except: + response_payload = None + http_response = { + "payload": response_payload, + "headers": dict(response.headers), + "status": response.status_code, + } + _LOGGER.debug( + "Received response for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.verify_confidential_space", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": "VerifyConfidentialSpace", + "metadata": http_response["headers"], + "httpResponse": http_response, + }, + ) + return resp + + @property + def create_challenge(self) -> Callable[ + [service.CreateChallengeRequest], + service.Challenge]: + # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here. + # In C++ this would require a dynamic_cast + return self._CreateChallenge(self._session, self._host, self._interceptor) # type: ignore + + @property + def verify_attestation(self) -> Callable[ + [service.VerifyAttestationRequest], + service.VerifyAttestationResponse]: + # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here. + # In C++ this would require a dynamic_cast + return self._VerifyAttestation(self._session, self._host, self._interceptor) # type: ignore + + @property + def verify_confidential_gke(self) -> Callable[ + [service.VerifyConfidentialGkeRequest], + service.VerifyConfidentialGkeResponse]: + # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here. + # In C++ this would require a dynamic_cast + return self._VerifyConfidentialGke(self._session, self._host, self._interceptor) # type: ignore + + @property + def verify_confidential_space(self) -> Callable[ + [service.VerifyConfidentialSpaceRequest], + service.VerifyConfidentialSpaceResponse]: + # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here. + # In C++ this would require a dynamic_cast + return self._VerifyConfidentialSpace(self._session, self._host, self._interceptor) # type: ignore + + @property + def get_location(self): + return self._GetLocation(self._session, self._host, self._interceptor) # type: ignore + + class _GetLocation(_BaseConfidentialComputingRestTransport._BaseGetLocation, ConfidentialComputingRestStub): + def __hash__(self): + return hash("ConfidentialComputingRestTransport.GetLocation") + + @staticmethod + def _get_response( + host, + metadata, + query_params, + session, + timeout, + transcoded_request, + body=None): + + uri = transcoded_request['uri'] + method = transcoded_request['method'] + headers = dict(metadata) + headers['Content-Type'] = 'application/json' + response = getattr(session, method)( + "{host}{uri}".format(host=host, uri=uri), + timeout=timeout, + headers=headers, + params=rest_helpers.flatten_query_params(query_params, strict=True), + ) + return response + + def __call__(self, + request: locations_pb2.GetLocationRequest, *, + retry: OptionalRetry=gapic_v1.method.DEFAULT, + timeout: Optional[float]=None, + metadata: Sequence[Tuple[str, Union[str, bytes]]]=(), + ) -> locations_pb2.Location: + + r"""Call the get location method over HTTP. + + Args: + request (locations_pb2.GetLocationRequest): + The request object for GetLocation method. + retry (google.api_core.retry.Retry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + locations_pb2.Location: Response from GetLocation method. + """ + + http_options = _BaseConfidentialComputingRestTransport._BaseGetLocation._get_http_options() + + request, metadata = self._interceptor.pre_get_location(request, metadata) + transcoded_request = _BaseConfidentialComputingRestTransport._BaseGetLocation._get_transcoded_request(http_options, request) + + # Jsonify the query params + query_params = _BaseConfidentialComputingRestTransport._BaseGetLocation._get_query_params_json(transcoded_request) + + if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER + request_url = "{host}{uri}".format(host=self._host, uri=transcoded_request['uri']) + method = transcoded_request['method'] + try: + request_payload = json_format.MessageToJson(request) + except: + request_payload = None + http_request = { + "payload": request_payload, + "requestMethod": method, + "requestUrl": request_url, + "headers": dict(metadata), + } + _LOGGER.debug( + f"Sending request for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.GetLocation", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": "GetLocation", + "httpRequest": http_request, + "metadata": http_request["headers"], + }, + ) + + # Send the request + response = ConfidentialComputingRestTransport._GetLocation._get_response(self._host, metadata, query_params, self._session, timeout, transcoded_request) + + # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception + # subclass. + if response.status_code >= 400: + raise core_exceptions.from_http_response(response) + + content = response.content.decode("utf-8") + resp = locations_pb2.Location() + resp = json_format.Parse(content, resp) + resp = self._interceptor.post_get_location(resp) + if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER + try: + response_payload = json_format.MessageToJson(resp) + except: + response_payload = None + http_response = { + "payload": response_payload, + "headers": dict(response.headers), + "status": response.status_code, + } + _LOGGER.debug( + "Received response for google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient.GetLocation", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": "GetLocation", + "httpResponse": http_response, + "metadata": http_response["headers"], + }, + ) + return resp + + @property + def list_locations(self): + return self._ListLocations(self._session, self._host, self._interceptor) # type: ignore + + class _ListLocations(_BaseConfidentialComputingRestTransport._BaseListLocations, ConfidentialComputingRestStub): + def __hash__(self): + return hash("ConfidentialComputingRestTransport.ListLocations") + + @staticmethod + def _get_response( + host, + metadata, + query_params, + session, + timeout, + transcoded_request, + body=None): + + uri = transcoded_request['uri'] + method = transcoded_request['method'] + headers = dict(metadata) + headers['Content-Type'] = 'application/json' + response = getattr(session, method)( + "{host}{uri}".format(host=host, uri=uri), + timeout=timeout, + headers=headers, + params=rest_helpers.flatten_query_params(query_params, strict=True), + ) + return response + + def __call__(self, + request: locations_pb2.ListLocationsRequest, *, + retry: OptionalRetry=gapic_v1.method.DEFAULT, + timeout: Optional[float]=None, + metadata: Sequence[Tuple[str, Union[str, bytes]]]=(), + ) -> locations_pb2.ListLocationsResponse: + + r"""Call the list locations method over HTTP. + + Args: + request (locations_pb2.ListLocationsRequest): + The request object for ListLocations method. + retry (google.api_core.retry.Retry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + locations_pb2.ListLocationsResponse: Response from ListLocations method. + """ + + http_options = _BaseConfidentialComputingRestTransport._BaseListLocations._get_http_options() + + request, metadata = self._interceptor.pre_list_locations(request, metadata) + transcoded_request = _BaseConfidentialComputingRestTransport._BaseListLocations._get_transcoded_request(http_options, request) + + # Jsonify the query params + query_params = _BaseConfidentialComputingRestTransport._BaseListLocations._get_query_params_json(transcoded_request) + + if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER + request_url = "{host}{uri}".format(host=self._host, uri=transcoded_request['uri']) + method = transcoded_request['method'] + try: + request_payload = json_format.MessageToJson(request) + except: + request_payload = None + http_request = { + "payload": request_payload, + "requestMethod": method, + "requestUrl": request_url, + "headers": dict(metadata), + } + _LOGGER.debug( + f"Sending request for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.ListLocations", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": "ListLocations", + "httpRequest": http_request, + "metadata": http_request["headers"], + }, + ) + + # Send the request + response = ConfidentialComputingRestTransport._ListLocations._get_response(self._host, metadata, query_params, self._session, timeout, transcoded_request) + + # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception + # subclass. + if response.status_code >= 400: + raise core_exceptions.from_http_response(response) + + content = response.content.decode("utf-8") + resp = locations_pb2.ListLocationsResponse() + resp = json_format.Parse(content, resp) + resp = self._interceptor.post_list_locations(resp) + if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER + try: + response_payload = json_format.MessageToJson(resp) + except: + response_payload = None + http_response = { + "payload": response_payload, + "headers": dict(response.headers), + "status": response.status_code, + } + _LOGGER.debug( + "Received response for google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient.ListLocations", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": "ListLocations", + "httpResponse": http_response, + "metadata": http_response["headers"], + }, + ) + return resp + + @property + def kind(self) -> str: + return "rest" + + def close(self): + self._session.close() + + +__all__=( + 'ConfidentialComputingRestTransport', +) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest_base.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest_base.py new file mode 100644 index 000000000000..b75b206a52f7 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest_base.py @@ -0,0 +1,330 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +import json # type: ignore +from google.api_core import path_template +from google.api_core import gapic_v1 + +from google.protobuf import json_format +from google.cloud.location import locations_pb2 # type: ignore +from .base import ConfidentialComputingTransport, DEFAULT_CLIENT_INFO + +import re +from typing import Any, Callable, Dict, List, Optional, Sequence, Tuple, Union + + +from google.cloud.confidentialcomputing_v1.types import service + + +class _BaseConfidentialComputingRestTransport(ConfidentialComputingTransport): + """Base REST backend transport for ConfidentialComputing. + + Note: This class is not meant to be used directly. Use its sync and + async sub-classes instead. + + This class defines the same methods as the primary client, so the + primary client can load the underlying transport implementation + and call it. + + It sends JSON representations of protocol buffers over HTTP/1.1 + """ + + def __init__(self, *, + host: str = 'confidentialcomputing.googleapis.com', + credentials: Optional[Any] = None, + client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO, + always_use_jwt_access: Optional[bool] = False, + url_scheme: str = 'https', + api_audience: Optional[str] = None, + ) -> None: + """Instantiate the transport. + Args: + host (Optional[str]): + The hostname to connect to (default: 'confidentialcomputing.googleapis.com'). + credentials (Optional[Any]): The + authorization credentials to attach to requests. These + credentials identify the application to the service; if none + are specified, the client will attempt to ascertain the + credentials from the environment. + client_info (google.api_core.gapic_v1.client_info.ClientInfo): + The client info used to send a user-agent string along with + API requests. If ``None``, then default info will be used. + Generally, you only need to set this if you are developing + your own client library. + always_use_jwt_access (Optional[bool]): Whether self signed JWT should + be used for service account credentials. + url_scheme: the protocol scheme for the API endpoint. Normally + "https", but for testing or local servers, + "http" can be specified. + """ + # Run the base constructor + maybe_url_match = re.match("^(?Phttp(?:s)?://)?(?P.*)$", host) + if maybe_url_match is None: + raise ValueError(f"Unexpected hostname structure: {host}") # pragma: NO COVER + + url_match_items = maybe_url_match.groupdict() + + host = f"{url_scheme}://{host}" if not url_match_items["scheme"] else host + + super().__init__( + host=host, + credentials=credentials, + client_info=client_info, + always_use_jwt_access=always_use_jwt_access, + api_audience=api_audience + ) + + class _BaseCreateChallenge: + def __hash__(self): # pragma: NO COVER + return NotImplementedError("__hash__ must be implemented.") + + __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = { + } + + @classmethod + def _get_unset_required_fields(cls, message_dict): + return {k: v for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items() if k not in message_dict} + + @staticmethod + def _get_http_options(): + http_options: List[Dict[str, str]] = [{ + 'method': 'post', + 'uri': '/v1/{parent=projects/*/locations/*}/challenges', + 'body': 'challenge', + }, + ] + return http_options + + @staticmethod + def _get_transcoded_request(http_options, request): + pb_request = service.CreateChallengeRequest.pb(request) + transcoded_request = path_template.transcode(http_options, pb_request) + return transcoded_request + + @staticmethod + def _get_request_body_json(transcoded_request): + # Jsonify the request body + + body = json_format.MessageToJson( + transcoded_request['body'], + use_integers_for_enums=True + ) + return body + @staticmethod + def _get_query_params_json(transcoded_request): + query_params = json.loads(json_format.MessageToJson( + transcoded_request['query_params'], + use_integers_for_enums=True, + )) + query_params.update(_BaseConfidentialComputingRestTransport._BaseCreateChallenge._get_unset_required_fields(query_params)) + + query_params["$alt"] = "json;enum-encoding=int" + return query_params + + class _BaseVerifyAttestation: + def __hash__(self): # pragma: NO COVER + return NotImplementedError("__hash__ must be implemented.") + + __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = { + } + + @classmethod + def _get_unset_required_fields(cls, message_dict): + return {k: v for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items() if k not in message_dict} + + @staticmethod + def _get_http_options(): + http_options: List[Dict[str, str]] = [{ + 'method': 'post', + 'uri': '/v1/{challenge=projects/*/locations/*/challenges/*}:verifyAttestation', + 'body': '*', + }, + ] + return http_options + + @staticmethod + def _get_transcoded_request(http_options, request): + pb_request = service.VerifyAttestationRequest.pb(request) + transcoded_request = path_template.transcode(http_options, pb_request) + return transcoded_request + + @staticmethod + def _get_request_body_json(transcoded_request): + # Jsonify the request body + + body = json_format.MessageToJson( + transcoded_request['body'], + use_integers_for_enums=True + ) + return body + @staticmethod + def _get_query_params_json(transcoded_request): + query_params = json.loads(json_format.MessageToJson( + transcoded_request['query_params'], + use_integers_for_enums=True, + )) + query_params.update(_BaseConfidentialComputingRestTransport._BaseVerifyAttestation._get_unset_required_fields(query_params)) + + query_params["$alt"] = "json;enum-encoding=int" + return query_params + + class _BaseVerifyConfidentialGke: + def __hash__(self): # pragma: NO COVER + return NotImplementedError("__hash__ must be implemented.") + + __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = { + } + + @classmethod + def _get_unset_required_fields(cls, message_dict): + return {k: v for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items() if k not in message_dict} + + @staticmethod + def _get_http_options(): + http_options: List[Dict[str, str]] = [{ + 'method': 'post', + 'uri': '/v1/{challenge=projects/*/locations/*/challenges/*}:verifyConfidentialGke', + 'body': '*', + }, + ] + return http_options + + @staticmethod + def _get_transcoded_request(http_options, request): + pb_request = service.VerifyConfidentialGkeRequest.pb(request) + transcoded_request = path_template.transcode(http_options, pb_request) + return transcoded_request + + @staticmethod + def _get_request_body_json(transcoded_request): + # Jsonify the request body + + body = json_format.MessageToJson( + transcoded_request['body'], + use_integers_for_enums=True + ) + return body + @staticmethod + def _get_query_params_json(transcoded_request): + query_params = json.loads(json_format.MessageToJson( + transcoded_request['query_params'], + use_integers_for_enums=True, + )) + query_params.update(_BaseConfidentialComputingRestTransport._BaseVerifyConfidentialGke._get_unset_required_fields(query_params)) + + query_params["$alt"] = "json;enum-encoding=int" + return query_params + + class _BaseVerifyConfidentialSpace: + def __hash__(self): # pragma: NO COVER + return NotImplementedError("__hash__ must be implemented.") + + __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = { + } + + @classmethod + def _get_unset_required_fields(cls, message_dict): + return {k: v for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items() if k not in message_dict} + + @staticmethod + def _get_http_options(): + http_options: List[Dict[str, str]] = [{ + 'method': 'post', + 'uri': '/v1/{challenge=projects/*/locations/*/challenges/*}:verifyConfidentialSpace', + 'body': '*', + }, + ] + return http_options + + @staticmethod + def _get_transcoded_request(http_options, request): + pb_request = service.VerifyConfidentialSpaceRequest.pb(request) + transcoded_request = path_template.transcode(http_options, pb_request) + return transcoded_request + + @staticmethod + def _get_request_body_json(transcoded_request): + # Jsonify the request body + + body = json_format.MessageToJson( + transcoded_request['body'], + use_integers_for_enums=True + ) + return body + @staticmethod + def _get_query_params_json(transcoded_request): + query_params = json.loads(json_format.MessageToJson( + transcoded_request['query_params'], + use_integers_for_enums=True, + )) + query_params.update(_BaseConfidentialComputingRestTransport._BaseVerifyConfidentialSpace._get_unset_required_fields(query_params)) + + query_params["$alt"] = "json;enum-encoding=int" + return query_params + + class _BaseGetLocation: + def __hash__(self): # pragma: NO COVER + return NotImplementedError("__hash__ must be implemented.") + + @staticmethod + def _get_http_options(): + http_options: List[Dict[str, str]] = [{ + 'method': 'get', + 'uri': '/v1/{name=projects/*/locations/*}', + }, + ] + return http_options + + @staticmethod + def _get_transcoded_request(http_options, request): + request_kwargs = json_format.MessageToDict(request) + transcoded_request = path_template.transcode( + http_options, **request_kwargs) + return transcoded_request + + @staticmethod + def _get_query_params_json(transcoded_request): + query_params = json.loads(json.dumps(transcoded_request['query_params'])) + return query_params + + class _BaseListLocations: + def __hash__(self): # pragma: NO COVER + return NotImplementedError("__hash__ must be implemented.") + + @staticmethod + def _get_http_options(): + http_options: List[Dict[str, str]] = [{ + 'method': 'get', + 'uri': '/v1/{name=projects/*}/locations', + }, + ] + return http_options + + @staticmethod + def _get_transcoded_request(http_options, request): + request_kwargs = json_format.MessageToDict(request) + transcoded_request = path_template.transcode( + http_options, **request_kwargs) + return transcoded_request + + @staticmethod + def _get_query_params_json(transcoded_request): + query_params = json.loads(json.dumps(transcoded_request['query_params'])) + return query_params + + +__all__=( + '_BaseConfidentialComputingRestTransport', +) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/types/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/types/__init__.py new file mode 100644 index 000000000000..7725a0653773 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/types/__init__.py @@ -0,0 +1,64 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +from .service import ( + AwsPrincipalTagsOptions, + Challenge, + ConfidentialSpaceInfo, + ContainerImageSignature, + CreateChallengeRequest, + GceShieldedIdentity, + GcpCredentials, + SevSnpAttestation, + SignedEntity, + TdxCcelAttestation, + TokenOptions, + TpmAttestation, + VerifyAttestationRequest, + VerifyAttestationResponse, + VerifyConfidentialGkeRequest, + VerifyConfidentialGkeResponse, + VerifyConfidentialSpaceRequest, + VerifyConfidentialSpaceResponse, + SignatureType, + SigningAlgorithm, + TokenProfile, + TokenType, +) + +__all__ = ( + 'AwsPrincipalTagsOptions', + 'Challenge', + 'ConfidentialSpaceInfo', + 'ContainerImageSignature', + 'CreateChallengeRequest', + 'GceShieldedIdentity', + 'GcpCredentials', + 'SevSnpAttestation', + 'SignedEntity', + 'TdxCcelAttestation', + 'TokenOptions', + 'TpmAttestation', + 'VerifyAttestationRequest', + 'VerifyAttestationResponse', + 'VerifyConfidentialGkeRequest', + 'VerifyConfidentialGkeResponse', + 'VerifyConfidentialSpaceRequest', + 'VerifyConfidentialSpaceResponse', + 'SignatureType', + 'SigningAlgorithm', + 'TokenProfile', + 'TokenType', +) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/types/service.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/types/service.py new file mode 100644 index 000000000000..9ac177e7a94a --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/types/service.py @@ -0,0 +1,915 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +from __future__ import annotations + +from typing import MutableMapping, MutableSequence + +import proto # type: ignore + +from google.protobuf import timestamp_pb2 # type: ignore +from google.rpc import status_pb2 # type: ignore + + +__protobuf__ = proto.module( + package='google.cloud.confidentialcomputing.v1', + manifest={ + 'SigningAlgorithm', + 'TokenType', + 'SignatureType', + 'TokenProfile', + 'Challenge', + 'CreateChallengeRequest', + 'VerifyAttestationRequest', + 'TdxCcelAttestation', + 'SevSnpAttestation', + 'VerifyAttestationResponse', + 'GcpCredentials', + 'TokenOptions', + 'AwsPrincipalTagsOptions', + 'TpmAttestation', + 'ConfidentialSpaceInfo', + 'SignedEntity', + 'ContainerImageSignature', + 'VerifyConfidentialSpaceRequest', + 'GceShieldedIdentity', + 'VerifyConfidentialSpaceResponse', + 'VerifyConfidentialGkeRequest', + 'VerifyConfidentialGkeResponse', + }, +) + + +class SigningAlgorithm(proto.Enum): + r"""SigningAlgorithm enumerates all the supported signing + algorithms. + + Values: + SIGNING_ALGORITHM_UNSPECIFIED (0): + Unspecified signing algorithm. + RSASSA_PSS_SHA256 (1): + RSASSA-PSS with a SHA256 digest. + RSASSA_PKCS1V15_SHA256 (2): + RSASSA-PKCS1 v1.5 with a SHA256 digest. + ECDSA_P256_SHA256 (3): + ECDSA on the P-256 Curve with a SHA256 + digest. + """ + SIGNING_ALGORITHM_UNSPECIFIED = 0 + RSASSA_PSS_SHA256 = 1 + RSASSA_PKCS1V15_SHA256 = 2 + ECDSA_P256_SHA256 = 3 + + +class TokenType(proto.Enum): + r"""Token type enum contains the different types of token + responses Confidential Space supports + + Values: + TOKEN_TYPE_UNSPECIFIED (0): + Unspecified token type + TOKEN_TYPE_OIDC (1): + OpenID Connect (OIDC) token type + TOKEN_TYPE_PKI (2): + Public Key Infrastructure (PKI) token type + TOKEN_TYPE_LIMITED_AWS (3): + Limited claim token type for AWS integration + TOKEN_TYPE_AWS_PRINCIPALTAGS (4): + Principal-tag-based token for AWS integration + """ + TOKEN_TYPE_UNSPECIFIED = 0 + TOKEN_TYPE_OIDC = 1 + TOKEN_TYPE_PKI = 2 + TOKEN_TYPE_LIMITED_AWS = 3 + TOKEN_TYPE_AWS_PRINCIPALTAGS = 4 + + +class SignatureType(proto.Enum): + r"""SignatureType enumerates supported signature types for + attestation tokens. + + Values: + SIGNATURE_TYPE_UNSPECIFIED (0): + Unspecified signature type. + SIGNATURE_TYPE_OIDC (1): + Google OIDC signature. + SIGNATURE_TYPE_PKI (2): + Public Key Infrastructure (PKI) signature. + """ + SIGNATURE_TYPE_UNSPECIFIED = 0 + SIGNATURE_TYPE_OIDC = 1 + SIGNATURE_TYPE_PKI = 2 + + +class TokenProfile(proto.Enum): + r"""TokenProfile enumerates the supported token claims profiles. + + Values: + TOKEN_PROFILE_UNSPECIFIED (0): + Unspecified token profile. + TOKEN_PROFILE_DEFAULT_EAT (1): + EAT claims. + TOKEN_PROFILE_AWS (2): + AWS Principal Tags claims. + """ + TOKEN_PROFILE_UNSPECIFIED = 0 + TOKEN_PROFILE_DEFAULT_EAT = 1 + TOKEN_PROFILE_AWS = 2 + + +class Challenge(proto.Message): + r"""A Challenge from the server used to guarantee freshness of + attestations + + Attributes: + name (str): + Output only. The resource name for this Challenge in the + format ``projects/*/locations/*/challenges/*`` + create_time (google.protobuf.timestamp_pb2.Timestamp): + Output only. The time at which this Challenge + was created + expire_time (google.protobuf.timestamp_pb2.Timestamp): + Output only. The time at which this Challenge + will no longer be usable. It is also the + expiration time for any tokens generated from + this Challenge. + used (bool): + Output only. Indicates if this challenge has + been used to generate a token. + tpm_nonce (str): + Output only. Identical to nonce, but as a + string. + """ + + name: str = proto.Field( + proto.STRING, + number=1, + ) + create_time: timestamp_pb2.Timestamp = proto.Field( + proto.MESSAGE, + number=2, + message=timestamp_pb2.Timestamp, + ) + expire_time: timestamp_pb2.Timestamp = proto.Field( + proto.MESSAGE, + number=3, + message=timestamp_pb2.Timestamp, + ) + used: bool = proto.Field( + proto.BOOL, + number=4, + ) + tpm_nonce: str = proto.Field( + proto.STRING, + number=6, + ) + + +class CreateChallengeRequest(proto.Message): + r"""Message for creating a Challenge + + Attributes: + parent (str): + Required. The resource name of the location where the + Challenge will be used, in the format + ``projects/*/locations/*``. + challenge (google.cloud.confidentialcomputing_v1.types.Challenge): + Required. The Challenge to be created. + Currently this field can be empty as all the + Challenge fields are set by the server. + """ + + parent: str = proto.Field( + proto.STRING, + number=1, + ) + challenge: 'Challenge' = proto.Field( + proto.MESSAGE, + number=2, + message='Challenge', + ) + + +class VerifyAttestationRequest(proto.Message): + r"""A request for an attestation token, providing all the + necessary information needed for this service to verify the + platform state of the requestor. + + This message has `oneof`_ fields (mutually exclusive fields). + For each oneof, at most one member field can be set at the same time. + Setting any member of the oneof automatically clears all other + members. + + .. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields + + Attributes: + td_ccel (google.cloud.confidentialcomputing_v1.types.TdxCcelAttestation): + Optional. A TDX with CCEL and RTMR + Attestation Quote. + + This field is a member of `oneof`_ ``tee_attestation``. + sev_snp_attestation (google.cloud.confidentialcomputing_v1.types.SevSnpAttestation): + Optional. An SEV-SNP Attestation Report. + + This field is a member of `oneof`_ ``tee_attestation``. + challenge (str): + Required. The name of the Challenge whose nonce was used to + generate the attestation, in the format + ``projects/*/locations/*/challenges/*``. The provided + Challenge will be consumed, and cannot be used again. + gcp_credentials (google.cloud.confidentialcomputing_v1.types.GcpCredentials): + Optional. Credentials used to populate the "emails" claim in + the claims_token. + tpm_attestation (google.cloud.confidentialcomputing_v1.types.TpmAttestation): + Required. The TPM-specific data provided by + the attesting platform, used to populate any of + the claims regarding platform state. + confidential_space_info (google.cloud.confidentialcomputing_v1.types.ConfidentialSpaceInfo): + Optional. Optional information related to the + Confidential Space TEE. + token_options (google.cloud.confidentialcomputing_v1.types.TokenOptions): + Optional. A collection of optional, + workload-specified claims that modify the token + output. + attester (str): + Optional. An optional indicator of the + attester, only applies to certain products. + """ + + td_ccel: 'TdxCcelAttestation' = proto.Field( + proto.MESSAGE, + number=6, + oneof='tee_attestation', + message='TdxCcelAttestation', + ) + sev_snp_attestation: 'SevSnpAttestation' = proto.Field( + proto.MESSAGE, + number=7, + oneof='tee_attestation', + message='SevSnpAttestation', + ) + challenge: str = proto.Field( + proto.STRING, + number=1, + ) + gcp_credentials: 'GcpCredentials' = proto.Field( + proto.MESSAGE, + number=2, + message='GcpCredentials', + ) + tpm_attestation: 'TpmAttestation' = proto.Field( + proto.MESSAGE, + number=3, + message='TpmAttestation', + ) + confidential_space_info: 'ConfidentialSpaceInfo' = proto.Field( + proto.MESSAGE, + number=4, + message='ConfidentialSpaceInfo', + ) + token_options: 'TokenOptions' = proto.Field( + proto.MESSAGE, + number=5, + message='TokenOptions', + ) + attester: str = proto.Field( + proto.STRING, + number=8, + ) + + +class TdxCcelAttestation(proto.Message): + r"""A TDX Attestation quote. + + Attributes: + ccel_acpi_table (bytes): + Optional. The Confidential Computing Event + Log (CCEL) ACPI table. Formatted as described in + the ACPI Specification 6.5. + ccel_data (bytes): + Optional. The CCEL event log. Formatted as + described in the UEFI 2.10. + canonical_event_log (bytes): + Optional. An Event Log containing additional + events measured into the RTMR that are not + already present in the CCEL. + td_quote (bytes): + Optional. The TDX attestation quote from the + guest. It contains the RTMR values. + """ + + ccel_acpi_table: bytes = proto.Field( + proto.BYTES, + number=1, + ) + ccel_data: bytes = proto.Field( + proto.BYTES, + number=2, + ) + canonical_event_log: bytes = proto.Field( + proto.BYTES, + number=3, + ) + td_quote: bytes = proto.Field( + proto.BYTES, + number=4, + ) + + +class SevSnpAttestation(proto.Message): + r"""An SEV-SNP Attestation Report. + Contains the attestation report and the certificate bundle that + the client collects. + + Attributes: + report (bytes): + Optional. The SEV-SNP Attestation Report Format is in + revision 1.55, §7.3 Attestation, Table 22. + ATTESTATION_REPORT Structure in this document: + https://www.amd.com/content/dam/amd/en/documents/epyc-technical-docs/specifications/56860.pdf + aux_blob (bytes): + Optional. Certificate bundle defined in the GHCB protocol + definition Format is documented in GHCB revision 2.03, + section 4.1.8.1 struct cert_table in this document: + https://www.amd.com/content/dam/amd/en/documents/epyc-technical-docs/specifications/56421.pdf + """ + + report: bytes = proto.Field( + proto.BYTES, + number=1, + ) + aux_blob: bytes = proto.Field( + proto.BYTES, + number=2, + ) + + +class VerifyAttestationResponse(proto.Message): + r"""A response once an attestation has been successfully + verified, containing a signed attestation token. + + Attributes: + oidc_claims_token (str): + Output only. Same as claims_token, but as a string. + partial_errors (MutableSequence[google.rpc.status_pb2.Status]): + Output only. A list of messages that carry + the partial error details related to + VerifyAttestation. + """ + + oidc_claims_token: str = proto.Field( + proto.STRING, + number=2, + ) + partial_errors: MutableSequence[status_pb2.Status] = proto.RepeatedField( + proto.MESSAGE, + number=3, + message=status_pb2.Status, + ) + + +class GcpCredentials(proto.Message): + r"""Credentials issued by GCP which are linked to the platform + attestation. These will be verified server-side as part of + attestaion verification. + + Attributes: + service_account_id_tokens (MutableSequence[str]): + Same as id_tokens, but as a string. + """ + + service_account_id_tokens: MutableSequence[str] = proto.RepeatedField( + proto.STRING, + number=2, + ) + + +class TokenOptions(proto.Message): + r"""Options to modify claims in the token to generate + custom-purpose tokens. + + + .. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields + + Attributes: + aws_principal_tags_options (google.cloud.confidentialcomputing_v1.types.AwsPrincipalTagsOptions): + Optional. Options for AWS token type. + + This field is a member of `oneof`_ ``token_type_options``. + audience (str): + Optional. Optional string to issue the token + with a custom audience claim. Required if one or + more nonces are specified. + nonce (MutableSequence[str]): + Optional. Optional parameter to place one or more nonces in + the eat_nonce claim in the output token. The minimum size + for JSON-encoded EATs is 10 bytes and the maximum size is 74 + bytes. + token_type (google.cloud.confidentialcomputing_v1.types.TokenType): + Optional. Optional token type to select what + type of token to return. + """ + + aws_principal_tags_options: 'AwsPrincipalTagsOptions' = proto.Field( + proto.MESSAGE, + number=4, + oneof='token_type_options', + message='AwsPrincipalTagsOptions', + ) + audience: str = proto.Field( + proto.STRING, + number=1, + ) + nonce: MutableSequence[str] = proto.RepeatedField( + proto.STRING, + number=2, + ) + token_type: 'TokenType' = proto.Field( + proto.ENUM, + number=3, + enum='TokenType', + ) + + +class AwsPrincipalTagsOptions(proto.Message): + r"""Token options that only apply to the AWS Principal Tags token + type. + + Attributes: + allowed_principal_tags (google.cloud.confidentialcomputing_v1.types.AwsPrincipalTagsOptions.AllowedPrincipalTags): + Optional. Principal tags to allow in the + token. + """ + + class AllowedPrincipalTags(proto.Message): + r"""Allowed principal tags is used to define what principal tags + will be placed in the token. + + Attributes: + container_image_signatures (google.cloud.confidentialcomputing_v1.types.AwsPrincipalTagsOptions.AllowedPrincipalTags.ContainerImageSignatures): + Optional. Container image signatures allowed + in the token. + """ + + class ContainerImageSignatures(proto.Message): + r"""Allowed Container Image Signatures. Key IDs are required to + allow this claim to fit within the narrow AWS IAM restrictions. + + Attributes: + key_ids (MutableSequence[str]): + Optional. List of key ids to filter into the + Principal tags. Only keys that have been + validated and added to the token will be + filtered into principal tags. Unrecognized key + ids will be ignored. + """ + + key_ids: MutableSequence[str] = proto.RepeatedField( + proto.STRING, + number=1, + ) + + container_image_signatures: 'AwsPrincipalTagsOptions.AllowedPrincipalTags.ContainerImageSignatures' = proto.Field( + proto.MESSAGE, + number=1, + message='AwsPrincipalTagsOptions.AllowedPrincipalTags.ContainerImageSignatures', + ) + + allowed_principal_tags: AllowedPrincipalTags = proto.Field( + proto.MESSAGE, + number=1, + message=AllowedPrincipalTags, + ) + + +class TpmAttestation(proto.Message): + r"""TPM2 data containing everything necessary to validate any + platform state measured into the TPM. + + Attributes: + quotes (MutableSequence[google.cloud.confidentialcomputing_v1.types.TpmAttestation.Quote]): + TPM2 PCR Quotes generated by calling TPM2_Quote on each PCR + bank. + tcg_event_log (bytes): + The binary TCG Event Log containing events + measured into the TPM by the platform firmware + and operating system. Formatted as described in + the "TCG PC Client Platform Firmware Profile + Specification". + canonical_event_log (bytes): + An Event Log containing additional events measured into the + TPM that are not already present in the tcg_event_log. + Formatted as described in the "Canonical Event Log Format" + TCG Specification. + ak_cert (bytes): + DER-encoded X.509 certificate of the + Attestation Key (otherwise known as an AK or a + TPM restricted signing key) used to generate the + quotes. + cert_chain (MutableSequence[bytes]): + List of DER-encoded X.509 certificates which, together with + the ak_cert, chain back to a trusted Root Certificate. + """ + + class Quote(proto.Message): + r"""Information about Platform Control Registers (PCRs) including + a signature over their values, which can be used for remote + validation. + + Attributes: + hash_algo (int): + The hash algorithm of the PCR bank being quoted, encoded as + a TPM_ALG_ID + pcr_values (MutableMapping[int, bytes]): + Raw binary values of each PCRs being quoted. + raw_quote (bytes): + TPM2 quote, encoded as a TPMS_ATTEST + raw_signature (bytes): + TPM2 signature, encoded as a TPMT_SIGNATURE + """ + + hash_algo: int = proto.Field( + proto.INT32, + number=1, + ) + pcr_values: MutableMapping[int, bytes] = proto.MapField( + proto.INT32, + proto.BYTES, + number=2, + ) + raw_quote: bytes = proto.Field( + proto.BYTES, + number=3, + ) + raw_signature: bytes = proto.Field( + proto.BYTES, + number=4, + ) + + quotes: MutableSequence[Quote] = proto.RepeatedField( + proto.MESSAGE, + number=1, + message=Quote, + ) + tcg_event_log: bytes = proto.Field( + proto.BYTES, + number=2, + ) + canonical_event_log: bytes = proto.Field( + proto.BYTES, + number=3, + ) + ak_cert: bytes = proto.Field( + proto.BYTES, + number=4, + ) + cert_chain: MutableSequence[bytes] = proto.RepeatedField( + proto.BYTES, + number=5, + ) + + +class ConfidentialSpaceInfo(proto.Message): + r"""ConfidentialSpaceInfo contains information related to the + Confidential Space TEE. + + Attributes: + signed_entities (MutableSequence[google.cloud.confidentialcomputing_v1.types.SignedEntity]): + Optional. A list of signed entities + containing container image signatures that can + be used for server-side signature verification. + """ + + signed_entities: MutableSequence['SignedEntity'] = proto.RepeatedField( + proto.MESSAGE, + number=1, + message='SignedEntity', + ) + + +class SignedEntity(proto.Message): + r"""SignedEntity represents an OCI image object containing + everything necessary to verify container image signatures. + + Attributes: + container_image_signatures (MutableSequence[google.cloud.confidentialcomputing_v1.types.ContainerImageSignature]): + Optional. A list of container image + signatures attached to an OCI image object. + """ + + container_image_signatures: MutableSequence['ContainerImageSignature'] = proto.RepeatedField( + proto.MESSAGE, + number=1, + message='ContainerImageSignature', + ) + + +class ContainerImageSignature(proto.Message): + r"""ContainerImageSignature holds necessary metadata to verify a + container image signature. + + Attributes: + payload (bytes): + Optional. The binary signature payload following the + SimpleSigning format + https://github.com/sigstore/cosign/blob/main/specs/SIGNATURE_SPEC.md#simple-signing. + This payload includes the container image digest. + signature (bytes): + Optional. A signature over the payload. The container image + digest is incorporated into the signature as follows: + + 1. Generate a SimpleSigning format payload that includes the + container image digest. + 2. Generate a signature over SHA256 digest of the payload. + The signature generation process can be represented as + follows: + ``Sign(sha256(SimpleSigningPayload(sha256(Image Manifest))))`` + public_key (bytes): + Optional. Reserved for future use. + sig_alg (google.cloud.confidentialcomputing_v1.types.SigningAlgorithm): + Optional. Reserved for future use. + """ + + payload: bytes = proto.Field( + proto.BYTES, + number=1, + ) + signature: bytes = proto.Field( + proto.BYTES, + number=2, + ) + public_key: bytes = proto.Field( + proto.BYTES, + number=3, + ) + sig_alg: 'SigningAlgorithm' = proto.Field( + proto.ENUM, + number=4, + enum='SigningAlgorithm', + ) + + +class VerifyConfidentialSpaceRequest(proto.Message): + r"""A request for an attestation token, providing all the + necessary information needed for this service to verify the + platform state of the requestor. + + This message has `oneof`_ fields (mutually exclusive fields). + For each oneof, at most one member field can be set at the same time. + Setting any member of the oneof automatically clears all other + members. + + .. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields + + Attributes: + td_ccel (google.cloud.confidentialcomputing_v1.types.TdxCcelAttestation): + Input only. A TDX with CCEL and RTMR + Attestation Quote. + + This field is a member of `oneof`_ ``tee_attestation``. + tpm_attestation (google.cloud.confidentialcomputing_v1.types.TpmAttestation): + Input only. The TPM-specific data provided by + the attesting platform, used to populate any of + the claims regarding platform state. + + This field is a member of `oneof`_ ``tee_attestation``. + challenge (str): + Required. The name of the Challenge whose nonce was used to + generate the attestation, in the format + ``projects/*/locations/*/challenges/*``. The provided + Challenge will be consumed, and cannot be used again. + gcp_credentials (google.cloud.confidentialcomputing_v1.types.GcpCredentials): + Optional. Credentials used to populate the "emails" claim in + the claims_token. If not present, token will not contain the + "emails" claim. + signed_entities (MutableSequence[google.cloud.confidentialcomputing_v1.types.SignedEntity]): + Optional. A list of signed entities + containing container image signatures that can + be used for server-side signature verification. + gce_shielded_identity (google.cloud.confidentialcomputing_v1.types.GceShieldedIdentity): + Optional. Information about the associated Compute Engine + instance. Required for td_ccel requests only - + tpm_attestation requests will provide this information in + the attestation. + options (google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceRequest.ConfidentialSpaceOptions): + Optional. A collection of fields that modify + the token output. + """ + + class ConfidentialSpaceOptions(proto.Message): + r"""Token options for Confidential Space attestation. + + .. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields + + Attributes: + aws_principal_tags_options (google.cloud.confidentialcomputing_v1.types.AwsPrincipalTagsOptions): + Optional. Options for the AWS token type. + + This field is a member of `oneof`_ ``token_profile_options``. + audience (str): + Optional. Optional string to issue the token + with a custom audience claim. Required if custom + nonces are specified. + token_profile (google.cloud.confidentialcomputing_v1.types.TokenProfile): + Optional. Optional specification for token + claims profile. + nonce (MutableSequence[str]): + Optional. Optional parameter to place one or more nonces in + the eat_nonce claim in the output token. The minimum size + for JSON-encoded EATs is 10 bytes and the maximum size is 74 + bytes. + signature_type (google.cloud.confidentialcomputing_v1.types.SignatureType): + Optional. Optional specification for how to sign the + attestation token. Defaults to SIGNATURE_TYPE_OIDC if + unspecified. + """ + + aws_principal_tags_options: 'AwsPrincipalTagsOptions' = proto.Field( + proto.MESSAGE, + number=5, + oneof='token_profile_options', + message='AwsPrincipalTagsOptions', + ) + audience: str = proto.Field( + proto.STRING, + number=1, + ) + token_profile: 'TokenProfile' = proto.Field( + proto.ENUM, + number=2, + enum='TokenProfile', + ) + nonce: MutableSequence[str] = proto.RepeatedField( + proto.STRING, + number=3, + ) + signature_type: 'SignatureType' = proto.Field( + proto.ENUM, + number=4, + enum='SignatureType', + ) + + td_ccel: 'TdxCcelAttestation' = proto.Field( + proto.MESSAGE, + number=3, + oneof='tee_attestation', + message='TdxCcelAttestation', + ) + tpm_attestation: 'TpmAttestation' = proto.Field( + proto.MESSAGE, + number=4, + oneof='tee_attestation', + message='TpmAttestation', + ) + challenge: str = proto.Field( + proto.STRING, + number=1, + ) + gcp_credentials: 'GcpCredentials' = proto.Field( + proto.MESSAGE, + number=2, + message='GcpCredentials', + ) + signed_entities: MutableSequence['SignedEntity'] = proto.RepeatedField( + proto.MESSAGE, + number=5, + message='SignedEntity', + ) + gce_shielded_identity: 'GceShieldedIdentity' = proto.Field( + proto.MESSAGE, + number=6, + message='GceShieldedIdentity', + ) + options: ConfidentialSpaceOptions = proto.Field( + proto.MESSAGE, + number=7, + message=ConfidentialSpaceOptions, + ) + + +class GceShieldedIdentity(proto.Message): + r"""GceShieldedIdentity contains information about a Compute + Engine instance. + + Attributes: + ak_cert (bytes): + Optional. DER-encoded X.509 certificate of + the Attestation Key (otherwise known as an AK or + a TPM restricted signing key) used to generate + the quotes. + ak_cert_chain (MutableSequence[bytes]): + Optional. List of DER-encoded X.509 certificates which, + together with the ak_cert, chain back to a trusted Root + Certificate. + """ + + ak_cert: bytes = proto.Field( + proto.BYTES, + number=1, + ) + ak_cert_chain: MutableSequence[bytes] = proto.RepeatedField( + proto.BYTES, + number=2, + ) + + +class VerifyConfidentialSpaceResponse(proto.Message): + r"""VerifyConfidentialSpaceResponse is returned once a + Confidential Space attestation has been successfully verified, + containing a signed token. + + Attributes: + attestation_token (str): + Output only. The attestation token issued by + this service. It contains specific platform + claims based on the contents of the provided + attestation. + partial_errors (MutableSequence[google.rpc.status_pb2.Status]): + Output only. A list of messages that carry + the partial error details related to + VerifyConfidentialSpace. This field is populated + by errors during container image signature + verification, which may reflect problems in the + provided image signatures. This does not block + the issuing of an attestation token, but the + token will not contain claims for the failed + image signatures. + """ + + attestation_token: str = proto.Field( + proto.STRING, + number=1, + ) + partial_errors: MutableSequence[status_pb2.Status] = proto.RepeatedField( + proto.MESSAGE, + number=2, + message=status_pb2.Status, + ) + + +class VerifyConfidentialGkeRequest(proto.Message): + r"""A request for an attestation token, providing all the + necessary information needed for this service to verify + Confidential GKE platform state of the requestor. + + + .. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields + + Attributes: + tpm_attestation (google.cloud.confidentialcomputing_v1.types.TpmAttestation): + The TPM-specific data provided by the + attesting platform, used to populate any of the + claims regarding platform state. + + This field is a member of `oneof`_ ``tee_attestation``. + challenge (str): + Required. The name of the Challenge whose nonce was used to + generate the attestation, in the format + projects/\ */locations/*/challenges/*. The provided + Challenge will be consumed, and cannot be used again. + """ + + tpm_attestation: 'TpmAttestation' = proto.Field( + proto.MESSAGE, + number=2, + oneof='tee_attestation', + message='TpmAttestation', + ) + challenge: str = proto.Field( + proto.STRING, + number=1, + ) + + +class VerifyConfidentialGkeResponse(proto.Message): + r"""VerifyConfidentialGkeResponse response is returened once a + Confidential GKE attestation has been successfully verified, + containing a signed OIDC token. + + Attributes: + attestation_token (str): + Output only. The attestation token issued by + this service for Confidential GKE. It contains + specific platform claims based on the contents + of the provided attestation. + """ + + attestation_token: str = proto.Field( + proto.STRING, + number=1, + ) + + +__all__ = tuple(sorted(__protobuf__.manifest)) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/mypy.ini b/owl-bot-staging/google-cloud-confidentialcomputing/v1/mypy.ini new file mode 100644 index 000000000000..574c5aed394b --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/mypy.ini @@ -0,0 +1,3 @@ +[mypy] +python_version = 3.7 +namespace_packages = True diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/noxfile.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/noxfile.py new file mode 100644 index 000000000000..09565c9afa4f --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/noxfile.py @@ -0,0 +1,592 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +import os +import pathlib +import re +import shutil + +from typing import Dict, List +import warnings + +import nox + +BLACK_VERSION = "black[jupyter]==23.7.0" +ISORT_VERSION = "isort==5.11.0" + +LINT_PATHS = ["docs", "google", "tests", "noxfile.py", "setup.py"] + +ALL_PYTHON = [ + "3.7", + "3.8", + "3.9", + "3.10", + "3.11", + "3.12", + "3.13", +] + +DEFAULT_PYTHON_VERSION = ALL_PYTHON[-1] + +CURRENT_DIRECTORY = pathlib.Path(__file__).parent.absolute() + +LOWER_BOUND_CONSTRAINTS_FILE = CURRENT_DIRECTORY / "constraints.txt" +PACKAGE_NAME = "google-cloud-confidentialcomputing" + +UNIT_TEST_STANDARD_DEPENDENCIES = [ + "mock", + "asyncmock", + "pytest", + "pytest-cov", + "pytest-asyncio", +] +UNIT_TEST_EXTERNAL_DEPENDENCIES: List[str] = [] +UNIT_TEST_LOCAL_DEPENDENCIES: List[str] = [] +UNIT_TEST_DEPENDENCIES: List[str] = [] +UNIT_TEST_EXTRAS: List[str] = [] +UNIT_TEST_EXTRAS_BY_PYTHON: Dict[str, List[str]] = {} + +SYSTEM_TEST_PYTHON_VERSIONS: List[str] = ["3.8", "3.9", "3.10", "3.11", "3.12", "3.13"] +SYSTEM_TEST_STANDARD_DEPENDENCIES = [ + "mock", + "pytest", + "google-cloud-testutils", +] +SYSTEM_TEST_EXTERNAL_DEPENDENCIES: List[str] = [] +SYSTEM_TEST_LOCAL_DEPENDENCIES: List[str] = [] +SYSTEM_TEST_DEPENDENCIES: List[str] = [] +SYSTEM_TEST_EXTRAS: List[str] = [] +SYSTEM_TEST_EXTRAS_BY_PYTHON: Dict[str, List[str]] = {} + +nox.options.sessions = [ + "unit", + "system", + "cover", + "lint", + "lint_setup_py", + "blacken", + "docs", +] + +# Error if a python version is missing +nox.options.error_on_missing_interpreters = True + + +@nox.session(python=ALL_PYTHON) +def mypy(session): + """Run the type checker.""" + session.install( + # TODO(https://github.com/googleapis/gapic-generator-python/issues/2410): Use the latest version of mypy + "mypy<1.16.0", + "types-requests", + "types-protobuf", + ) + session.install(".") + session.run( + "mypy", + "-p", + "google", + ) + + +@nox.session +def update_lower_bounds(session): + """Update lower bounds in constraints.txt to match setup.py""" + session.install("google-cloud-testutils") + session.install(".") + + session.run( + "lower-bound-checker", + "update", + "--package-name", + PACKAGE_NAME, + "--constraints-file", + str(LOWER_BOUND_CONSTRAINTS_FILE), + ) + + +@nox.session +def check_lower_bounds(session): + """Check lower bounds in setup.py are reflected in constraints file""" + session.install("google-cloud-testutils") + session.install(".") + + session.run( + "lower-bound-checker", + "check", + "--package-name", + PACKAGE_NAME, + "--constraints-file", + str(LOWER_BOUND_CONSTRAINTS_FILE), + ) + + +@nox.session(python=DEFAULT_PYTHON_VERSION) +def lint(session): + """Run linters. + + Returns a failure if the linters find linting errors or sufficiently + serious code quality issues. + """ + session.install("flake8", BLACK_VERSION) + session.run( + "black", + "--check", + *LINT_PATHS, + ) + + session.run("flake8", "google", "tests") + + +@nox.session(python=DEFAULT_PYTHON_VERSION) +def blacken(session): + """Run black. Format code to uniform standard.""" + session.install(BLACK_VERSION) + session.run( + "black", + *LINT_PATHS, + ) + + +@nox.session(python=DEFAULT_PYTHON_VERSION) +def format(session): + """ + Run isort to sort imports. Then run black + to format code to uniform standard. + """ + session.install(BLACK_VERSION, ISORT_VERSION) + # Use the --fss option to sort imports using strict alphabetical order. + # See https://pycqa.github.io/isort/docs/configuration/options.html#force-sort-within-sections + session.run( + "isort", + "--fss", + *LINT_PATHS, + ) + session.run( + "black", + *LINT_PATHS, + ) + + +@nox.session(python=DEFAULT_PYTHON_VERSION) +def lint_setup_py(session): + """Verify that setup.py is valid (including RST check).""" + session.install("setuptools", "docutils", "pygments") + session.run("python", "setup.py", "check", "--restructuredtext", "--strict") + + +def install_unittest_dependencies(session, *constraints): + standard_deps = UNIT_TEST_STANDARD_DEPENDENCIES + UNIT_TEST_DEPENDENCIES + session.install(*standard_deps, *constraints) + + if UNIT_TEST_EXTERNAL_DEPENDENCIES: + warnings.warn( + "'unit_test_external_dependencies' is deprecated. Instead, please " + "use 'unit_test_dependencies' or 'unit_test_local_dependencies'.", + DeprecationWarning, + ) + session.install(*UNIT_TEST_EXTERNAL_DEPENDENCIES, *constraints) + + if UNIT_TEST_LOCAL_DEPENDENCIES: + session.install(*UNIT_TEST_LOCAL_DEPENDENCIES, *constraints) + + if UNIT_TEST_EXTRAS_BY_PYTHON: + extras = UNIT_TEST_EXTRAS_BY_PYTHON.get(session.python, []) + elif UNIT_TEST_EXTRAS: + extras = UNIT_TEST_EXTRAS + else: + extras = [] + + if extras: + session.install("-e", f".[{','.join(extras)}]", *constraints) + else: + session.install("-e", ".", *constraints) + + +@nox.session(python=ALL_PYTHON) +@nox.parametrize( + "protobuf_implementation", + ["python", "upb", "cpp"], +) +def unit(session, protobuf_implementation): + # Install all test dependencies, then install this package in-place. + + if protobuf_implementation == "cpp" and session.python in ("3.11", "3.12", "3.13"): + session.skip("cpp implementation is not supported in python 3.11+") + + constraints_path = str( + CURRENT_DIRECTORY / "testing" / f"constraints-{session.python}.txt" + ) + install_unittest_dependencies(session, "-c", constraints_path) + + # TODO(https://github.com/googleapis/synthtool/issues/1976): + # Remove the 'cpp' implementation once support for Protobuf 3.x is dropped. + # The 'cpp' implementation requires Protobuf<4. + if protobuf_implementation == "cpp": + session.install("protobuf<4") + + # Run py.test against the unit tests. + session.run( + "py.test", + "--quiet", + f"--junitxml=unit_{session.python}_sponge_log.xml", + "--cov=google", + "--cov=tests/unit", + "--cov-append", + "--cov-config=.coveragerc", + "--cov-report=", + "--cov-fail-under=0", + os.path.join("tests", "unit"), + *session.posargs, + env={ + "PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION": protobuf_implementation, + }, + ) + + +def install_systemtest_dependencies(session, *constraints): + session.install("--pre", "grpcio") + + session.install(*SYSTEM_TEST_STANDARD_DEPENDENCIES, *constraints) + + if SYSTEM_TEST_EXTERNAL_DEPENDENCIES: + session.install(*SYSTEM_TEST_EXTERNAL_DEPENDENCIES, *constraints) + + if SYSTEM_TEST_LOCAL_DEPENDENCIES: + session.install("-e", *SYSTEM_TEST_LOCAL_DEPENDENCIES, *constraints) + + if SYSTEM_TEST_DEPENDENCIES: + session.install("-e", *SYSTEM_TEST_DEPENDENCIES, *constraints) + + if SYSTEM_TEST_EXTRAS_BY_PYTHON: + extras = SYSTEM_TEST_EXTRAS_BY_PYTHON.get(session.python, []) + elif SYSTEM_TEST_EXTRAS: + extras = SYSTEM_TEST_EXTRAS + else: + extras = [] + + if extras: + session.install("-e", f".[{','.join(extras)}]", *constraints) + else: + session.install("-e", ".", *constraints) + + +@nox.session(python=SYSTEM_TEST_PYTHON_VERSIONS) +def system(session): + """Run the system test suite.""" + constraints_path = str( + CURRENT_DIRECTORY / "testing" / f"constraints-{session.python}.txt" + ) + system_test_path = os.path.join("tests", "system.py") + system_test_folder_path = os.path.join("tests", "system") + + # Check the value of `RUN_SYSTEM_TESTS` env var. It defaults to true. + if os.environ.get("RUN_SYSTEM_TESTS", "true") == "false": + session.skip("RUN_SYSTEM_TESTS is set to false, skipping") + # Install pyopenssl for mTLS testing. + if os.environ.get("GOOGLE_API_USE_CLIENT_CERTIFICATE", "false") == "true": + session.install("pyopenssl") + + system_test_exists = os.path.exists(system_test_path) + system_test_folder_exists = os.path.exists(system_test_folder_path) + # Sanity check: only run tests if found. + if not system_test_exists and not system_test_folder_exists: + session.skip("System tests were not found") + + install_systemtest_dependencies(session, "-c", constraints_path) + + # Run py.test against the system tests. + if system_test_exists: + session.run( + "py.test", + "--quiet", + f"--junitxml=system_{session.python}_sponge_log.xml", + system_test_path, + *session.posargs, + ) + if system_test_folder_exists: + session.run( + "py.test", + "--quiet", + f"--junitxml=system_{session.python}_sponge_log.xml", + system_test_folder_path, + *session.posargs, + ) + + +@nox.session(python=DEFAULT_PYTHON_VERSION) +def cover(session): + """Run the final coverage report. + + This outputs the coverage report aggregating coverage from the unit + test runs (not system test runs), and then erases coverage data. + """ + session.install("coverage", "pytest-cov") + session.run("coverage", "report", "--show-missing", "--fail-under=100") + + session.run("coverage", "erase") + + +@nox.session(python="3.10") +def docs(session): + """Build the docs for this library.""" + + session.install("-e", ".") + session.install( + # We need to pin to specific versions of the `sphinxcontrib-*` packages + # which still support sphinx 4.x. + # See https://github.com/googleapis/sphinx-docfx-yaml/issues/344 + # and https://github.com/googleapis/sphinx-docfx-yaml/issues/345. + "sphinxcontrib-applehelp==1.0.4", + "sphinxcontrib-devhelp==1.0.2", + "sphinxcontrib-htmlhelp==2.0.1", + "sphinxcontrib-qthelp==1.0.3", + "sphinxcontrib-serializinghtml==1.1.5", + "sphinx==4.5.0", + "alabaster", + "recommonmark", + ) + + shutil.rmtree(os.path.join("docs", "_build"), ignore_errors=True) + session.run( + "sphinx-build", + "-W", # warnings as errors + "-T", # show full traceback on exception + "-N", # no colors + "-b", + "html", + "-d", + os.path.join("docs", "_build", "doctrees", ""), + os.path.join("docs", ""), + os.path.join("docs", "_build", "html", ""), + ) + + +@nox.session(python="3.10") +def docfx(session): + """Build the docfx yaml files for this library.""" + + session.install("-e", ".") + session.install( + # We need to pin to specific versions of the `sphinxcontrib-*` packages + # which still support sphinx 4.x. + # See https://github.com/googleapis/sphinx-docfx-yaml/issues/344 + # and https://github.com/googleapis/sphinx-docfx-yaml/issues/345. + "sphinxcontrib-applehelp==1.0.4", + "sphinxcontrib-devhelp==1.0.2", + "sphinxcontrib-htmlhelp==2.0.1", + "sphinxcontrib-qthelp==1.0.3", + "sphinxcontrib-serializinghtml==1.1.5", + "gcp-sphinx-docfx-yaml", + "alabaster", + "recommonmark", + ) + + shutil.rmtree(os.path.join("docs", "_build"), ignore_errors=True) + session.run( + "sphinx-build", + "-T", # show full traceback on exception + "-N", # no colors + "-D", + ( + "extensions=sphinx.ext.autodoc," + "sphinx.ext.autosummary," + "docfx_yaml.extension," + "sphinx.ext.intersphinx," + "sphinx.ext.coverage," + "sphinx.ext.napoleon," + "sphinx.ext.todo," + "sphinx.ext.viewcode," + "recommonmark" + ), + "-b", + "html", + "-d", + os.path.join("docs", "_build", "doctrees", ""), + os.path.join("docs", ""), + os.path.join("docs", "_build", "html", ""), + ) + + +@nox.session(python=DEFAULT_PYTHON_VERSION) +@nox.parametrize( + "protobuf_implementation", + ["python", "upb", "cpp"], +) +def prerelease_deps(session, protobuf_implementation): + """ + Run all tests with pre-release versions of dependencies installed + rather than the standard non pre-release versions. + Pre-release versions can be installed using + `pip install --pre `. + """ + + if protobuf_implementation == "cpp" and session.python in ("3.11", "3.12", "3.13"): + session.skip("cpp implementation is not supported in python 3.11+") + + # Install all dependencies + session.install("-e", ".") + + # Install dependencies for the unit test environment + unit_deps_all = UNIT_TEST_STANDARD_DEPENDENCIES + UNIT_TEST_EXTERNAL_DEPENDENCIES + session.install(*unit_deps_all) + + # Install dependencies for the system test environment + system_deps_all = ( + SYSTEM_TEST_STANDARD_DEPENDENCIES + + SYSTEM_TEST_EXTERNAL_DEPENDENCIES + + SYSTEM_TEST_EXTRAS + ) + session.install(*system_deps_all) + + # Because we test minimum dependency versions on the minimum Python + # version, the first version we test with in the unit tests sessions has a + # constraints file containing all dependencies and extras. + with open( + CURRENT_DIRECTORY / "testing" / f"constraints-{ALL_PYTHON[0]}.txt", + encoding="utf-8", + ) as constraints_file: + constraints_text = constraints_file.read() + + # Ignore leading whitespace and comment lines. + constraints_deps = [ + match.group(1) + for match in re.finditer( + r"^\s*(\S+)(?===\S+)", constraints_text, flags=re.MULTILINE + ) + ] + + # Install dependencies specified in `testing/constraints-X.txt`. + session.install(*constraints_deps) + + # Note: If a dependency is added to the `prerel_deps` list, + # the `core_dependencies_from_source` list in the `core_deps_from_source` + # nox session should also be updated. + prerel_deps = [ + "googleapis-common-protos", + "google-api-core", + "google-auth", + "grpc-google-iam-v1", + "grpcio", + "grpcio-status", + "protobuf", + "proto-plus", + ] + + for dep in prerel_deps: + session.install("--pre", "--no-deps", "--ignore-installed", dep) + # TODO(https://github.com/grpc/grpc/issues/38965): Add `grpcio-status`` + # to the dictionary below once this bug is fixed. + # TODO(https://github.com/googleapis/google-cloud-python/issues/13643): Add + # `googleapis-common-protos` and `grpc-google-iam-v1` to the dictionary below + # once this bug is fixed. + package_namespaces = { + "google-api-core": "google.api_core", + "google-auth": "google.auth", + "grpcio": "grpc", + "protobuf": "google.protobuf", + "proto-plus": "proto", + } + + version_namespace = package_namespaces.get(dep) + + print(f"Installed {dep}") + if version_namespace: + session.run( + "python", + "-c", + f"import {version_namespace}; print({version_namespace}.__version__)", + ) + + session.run( + "py.test", + "tests/unit", + env={ + "PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION": protobuf_implementation, + }, + ) + + +@nox.session(python=DEFAULT_PYTHON_VERSION) +@nox.parametrize( + "protobuf_implementation", + ["python", "upb"], +) +def core_deps_from_source(session, protobuf_implementation): + """Run all tests with core dependencies installed from source + rather than pulling the dependencies from PyPI. + """ + + # Install all dependencies + session.install("-e", ".") + + # Install dependencies for the unit test environment + unit_deps_all = UNIT_TEST_STANDARD_DEPENDENCIES + UNIT_TEST_EXTERNAL_DEPENDENCIES + session.install(*unit_deps_all) + + # Install dependencies for the system test environment + system_deps_all = ( + SYSTEM_TEST_STANDARD_DEPENDENCIES + + SYSTEM_TEST_EXTERNAL_DEPENDENCIES + + SYSTEM_TEST_EXTRAS + ) + session.install(*system_deps_all) + + # Because we test minimum dependency versions on the minimum Python + # version, the first version we test with in the unit tests sessions has a + # constraints file containing all dependencies and extras. + with open( + CURRENT_DIRECTORY / "testing" / f"constraints-{ALL_PYTHON[0]}.txt", + encoding="utf-8", + ) as constraints_file: + constraints_text = constraints_file.read() + + # Ignore leading whitespace and comment lines. + constraints_deps = [ + match.group(1) + for match in re.finditer( + r"^\s*(\S+)(?===\S+)", constraints_text, flags=re.MULTILINE + ) + ] + + # Install dependencies specified in `testing/constraints-X.txt`. + session.install(*constraints_deps) + + # TODO(https://github.com/googleapis/gapic-generator-python/issues/2358): `grpcio` and + # `grpcio-status` should be added to the list below so that they are installed from source, + # rather than PyPI. + # TODO(https://github.com/googleapis/gapic-generator-python/issues/2357): `protobuf` should be + # added to the list below so that it is installed from source, rather than PyPI + # Note: If a dependency is added to the `core_dependencies_from_source` list, + # the `prerel_deps` list in the `prerelease_deps` nox session should also be updated. + core_dependencies_from_source = [ + "googleapis-common-protos @ git+https://github.com/googleapis/google-cloud-python#egg=googleapis-common-protos&subdirectory=packages/googleapis-common-protos", + "google-api-core @ git+https://github.com/googleapis/python-api-core.git", + "google-auth @ git+https://github.com/googleapis/google-auth-library-python.git", + "grpc-google-iam-v1 @ git+https://github.com/googleapis/google-cloud-python#egg=grpc-google-iam-v1&subdirectory=packages/grpc-google-iam-v1", + "proto-plus @ git+https://github.com/googleapis/proto-plus-python.git", + ] + + for dep in core_dependencies_from_source: + session.install(dep, "--no-deps", "--ignore-installed") + print(f"Installed {dep}") + + session.run( + "py.test", + "tests/unit", + env={ + "PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION": protobuf_implementation, + }, + ) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_create_challenge_async.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_create_challenge_async.py new file mode 100644 index 000000000000..528b0847412b --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_create_challenge_async.py @@ -0,0 +1,52 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# Generated code. DO NOT EDIT! +# +# Snippet for CreateChallenge +# NOTE: This snippet has been automatically generated for illustrative purposes only. +# It may require modifications to work in your environment. + +# To install the latest published package dependency, execute the following: +# python3 -m pip install google-cloud-confidentialcomputing + + +# [START confidentialcomputing_v1_generated_ConfidentialComputing_CreateChallenge_async] +# This snippet has been automatically generated and should be regarded as a +# code template only. +# It will require modifications to work: +# - It may require correct/in-range values for request initialization. +# - It may require specifying regional endpoints when creating the service +# client as shown in: +# https://googleapis.dev/python/google-api-core/latest/client_options.html +from google.cloud import confidentialcomputing_v1 + + +async def sample_create_challenge(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingAsyncClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.CreateChallengeRequest( + parent="parent_value", + ) + + # Make the request + response = await client.create_challenge(request=request) + + # Handle the response + print(response) + +# [END confidentialcomputing_v1_generated_ConfidentialComputing_CreateChallenge_async] diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_create_challenge_sync.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_create_challenge_sync.py new file mode 100644 index 000000000000..77033a817788 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_create_challenge_sync.py @@ -0,0 +1,52 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# Generated code. DO NOT EDIT! +# +# Snippet for CreateChallenge +# NOTE: This snippet has been automatically generated for illustrative purposes only. +# It may require modifications to work in your environment. + +# To install the latest published package dependency, execute the following: +# python3 -m pip install google-cloud-confidentialcomputing + + +# [START confidentialcomputing_v1_generated_ConfidentialComputing_CreateChallenge_sync] +# This snippet has been automatically generated and should be regarded as a +# code template only. +# It will require modifications to work: +# - It may require correct/in-range values for request initialization. +# - It may require specifying regional endpoints when creating the service +# client as shown in: +# https://googleapis.dev/python/google-api-core/latest/client_options.html +from google.cloud import confidentialcomputing_v1 + + +def sample_create_challenge(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.CreateChallengeRequest( + parent="parent_value", + ) + + # Make the request + response = client.create_challenge(request=request) + + # Handle the response + print(response) + +# [END confidentialcomputing_v1_generated_ConfidentialComputing_CreateChallenge_sync] diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_attestation_async.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_attestation_async.py new file mode 100644 index 000000000000..815f2f866b48 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_attestation_async.py @@ -0,0 +1,52 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# Generated code. DO NOT EDIT! +# +# Snippet for VerifyAttestation +# NOTE: This snippet has been automatically generated for illustrative purposes only. +# It may require modifications to work in your environment. + +# To install the latest published package dependency, execute the following: +# python3 -m pip install google-cloud-confidentialcomputing + + +# [START confidentialcomputing_v1_generated_ConfidentialComputing_VerifyAttestation_async] +# This snippet has been automatically generated and should be regarded as a +# code template only. +# It will require modifications to work: +# - It may require correct/in-range values for request initialization. +# - It may require specifying regional endpoints when creating the service +# client as shown in: +# https://googleapis.dev/python/google-api-core/latest/client_options.html +from google.cloud import confidentialcomputing_v1 + + +async def sample_verify_attestation(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingAsyncClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.VerifyAttestationRequest( + challenge="challenge_value", + ) + + # Make the request + response = await client.verify_attestation(request=request) + + # Handle the response + print(response) + +# [END confidentialcomputing_v1_generated_ConfidentialComputing_VerifyAttestation_async] diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_attestation_sync.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_attestation_sync.py new file mode 100644 index 000000000000..724ad44eec2a --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_attestation_sync.py @@ -0,0 +1,52 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# Generated code. DO NOT EDIT! +# +# Snippet for VerifyAttestation +# NOTE: This snippet has been automatically generated for illustrative purposes only. +# It may require modifications to work in your environment. + +# To install the latest published package dependency, execute the following: +# python3 -m pip install google-cloud-confidentialcomputing + + +# [START confidentialcomputing_v1_generated_ConfidentialComputing_VerifyAttestation_sync] +# This snippet has been automatically generated and should be regarded as a +# code template only. +# It will require modifications to work: +# - It may require correct/in-range values for request initialization. +# - It may require specifying regional endpoints when creating the service +# client as shown in: +# https://googleapis.dev/python/google-api-core/latest/client_options.html +from google.cloud import confidentialcomputing_v1 + + +def sample_verify_attestation(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.VerifyAttestationRequest( + challenge="challenge_value", + ) + + # Make the request + response = client.verify_attestation(request=request) + + # Handle the response + print(response) + +# [END confidentialcomputing_v1_generated_ConfidentialComputing_VerifyAttestation_sync] diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_async.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_async.py new file mode 100644 index 000000000000..f31b51fb713f --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_async.py @@ -0,0 +1,52 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# Generated code. DO NOT EDIT! +# +# Snippet for VerifyConfidentialGke +# NOTE: This snippet has been automatically generated for illustrative purposes only. +# It may require modifications to work in your environment. + +# To install the latest published package dependency, execute the following: +# python3 -m pip install google-cloud-confidentialcomputing + + +# [START confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialGke_async] +# This snippet has been automatically generated and should be regarded as a +# code template only. +# It will require modifications to work: +# - It may require correct/in-range values for request initialization. +# - It may require specifying regional endpoints when creating the service +# client as shown in: +# https://googleapis.dev/python/google-api-core/latest/client_options.html +from google.cloud import confidentialcomputing_v1 + + +async def sample_verify_confidential_gke(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingAsyncClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.VerifyConfidentialGkeRequest( + challenge="challenge_value", + ) + + # Make the request + response = await client.verify_confidential_gke(request=request) + + # Handle the response + print(response) + +# [END confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialGke_async] diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_sync.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_sync.py new file mode 100644 index 000000000000..f48c41b7d257 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_sync.py @@ -0,0 +1,52 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# Generated code. DO NOT EDIT! +# +# Snippet for VerifyConfidentialGke +# NOTE: This snippet has been automatically generated for illustrative purposes only. +# It may require modifications to work in your environment. + +# To install the latest published package dependency, execute the following: +# python3 -m pip install google-cloud-confidentialcomputing + + +# [START confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialGke_sync] +# This snippet has been automatically generated and should be regarded as a +# code template only. +# It will require modifications to work: +# - It may require correct/in-range values for request initialization. +# - It may require specifying regional endpoints when creating the service +# client as shown in: +# https://googleapis.dev/python/google-api-core/latest/client_options.html +from google.cloud import confidentialcomputing_v1 + + +def sample_verify_confidential_gke(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.VerifyConfidentialGkeRequest( + challenge="challenge_value", + ) + + # Make the request + response = client.verify_confidential_gke(request=request) + + # Handle the response + print(response) + +# [END confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialGke_sync] diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_async.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_async.py new file mode 100644 index 000000000000..2a518ead0d28 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_async.py @@ -0,0 +1,52 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# Generated code. DO NOT EDIT! +# +# Snippet for VerifyConfidentialSpace +# NOTE: This snippet has been automatically generated for illustrative purposes only. +# It may require modifications to work in your environment. + +# To install the latest published package dependency, execute the following: +# python3 -m pip install google-cloud-confidentialcomputing + + +# [START confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialSpace_async] +# This snippet has been automatically generated and should be regarded as a +# code template only. +# It will require modifications to work: +# - It may require correct/in-range values for request initialization. +# - It may require specifying regional endpoints when creating the service +# client as shown in: +# https://googleapis.dev/python/google-api-core/latest/client_options.html +from google.cloud import confidentialcomputing_v1 + + +async def sample_verify_confidential_space(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingAsyncClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.VerifyConfidentialSpaceRequest( + challenge="challenge_value", + ) + + # Make the request + response = await client.verify_confidential_space(request=request) + + # Handle the response + print(response) + +# [END confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialSpace_async] diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_sync.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_sync.py new file mode 100644 index 000000000000..c7a2756f49bc --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_sync.py @@ -0,0 +1,52 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# Generated code. DO NOT EDIT! +# +# Snippet for VerifyConfidentialSpace +# NOTE: This snippet has been automatically generated for illustrative purposes only. +# It may require modifications to work in your environment. + +# To install the latest published package dependency, execute the following: +# python3 -m pip install google-cloud-confidentialcomputing + + +# [START confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialSpace_sync] +# This snippet has been automatically generated and should be regarded as a +# code template only. +# It will require modifications to work: +# - It may require correct/in-range values for request initialization. +# - It may require specifying regional endpoints when creating the service +# client as shown in: +# https://googleapis.dev/python/google-api-core/latest/client_options.html +from google.cloud import confidentialcomputing_v1 + + +def sample_verify_confidential_space(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.VerifyConfidentialSpaceRequest( + challenge="challenge_value", + ) + + # Make the request + response = client.verify_confidential_space(request=request) + + # Handle the response + print(response) + +# [END confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialSpace_sync] diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/snippet_metadata_google.cloud.confidentialcomputing.v1.json b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/snippet_metadata_google.cloud.confidentialcomputing.v1.json new file mode 100644 index 000000000000..1994174817f3 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/snippet_metadata_google.cloud.confidentialcomputing.v1.json @@ -0,0 +1,643 @@ +{ + "clientLibrary": { + "apis": [ + { + "id": "google.cloud.confidentialcomputing.v1", + "version": "v1" + } + ], + "language": "PYTHON", + "name": "google-cloud-confidentialcomputing", + "version": "0.1.0" + }, + "snippets": [ + { + "canonical": true, + "clientMethod": { + "async": true, + "client": { + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient", + "shortName": "ConfidentialComputingAsyncClient" + }, + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient.create_challenge", + "method": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.CreateChallenge", + "service": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "shortName": "ConfidentialComputing" + }, + "shortName": "CreateChallenge" + }, + "parameters": [ + { + "name": "request", + "type": "google.cloud.confidentialcomputing_v1.types.CreateChallengeRequest" + }, + { + "name": "parent", + "type": "str" + }, + { + "name": "challenge", + "type": "google.cloud.confidentialcomputing_v1.types.Challenge" + }, + { + "name": "retry", + "type": "google.api_core.retry.Retry" + }, + { + "name": "timeout", + "type": "float" + }, + { + "name": "metadata", + "type": "Sequence[Tuple[str, Union[str, bytes]]]" + } + ], + "resultType": "google.cloud.confidentialcomputing_v1.types.Challenge", + "shortName": "create_challenge" + }, + "description": "Sample for CreateChallenge", + "file": "confidentialcomputing_v1_generated_confidential_computing_create_challenge_async.py", + "language": "PYTHON", + "origin": "API_DEFINITION", + "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_CreateChallenge_async", + "segments": [ + { + "end": 51, + "start": 27, + "type": "FULL" + }, + { + "end": 51, + "start": 27, + "type": "SHORT" + }, + { + "end": 40, + "start": 38, + "type": "CLIENT_INITIALIZATION" + }, + { + "end": 45, + "start": 41, + "type": "REQUEST_INITIALIZATION" + }, + { + "end": 48, + "start": 46, + "type": "REQUEST_EXECUTION" + }, + { + "end": 52, + "start": 49, + "type": "RESPONSE_HANDLING" + } + ], + "title": "confidentialcomputing_v1_generated_confidential_computing_create_challenge_async.py" + }, + { + "canonical": true, + "clientMethod": { + "client": { + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient", + "shortName": "ConfidentialComputingClient" + }, + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.create_challenge", + "method": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.CreateChallenge", + "service": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "shortName": "ConfidentialComputing" + }, + "shortName": "CreateChallenge" + }, + "parameters": [ + { + "name": "request", + "type": "google.cloud.confidentialcomputing_v1.types.CreateChallengeRequest" + }, + { + "name": "parent", + "type": "str" + }, + { + "name": "challenge", + "type": "google.cloud.confidentialcomputing_v1.types.Challenge" + }, + { + "name": "retry", + "type": "google.api_core.retry.Retry" + }, + { + "name": "timeout", + "type": "float" + }, + { + "name": "metadata", + "type": "Sequence[Tuple[str, Union[str, bytes]]]" + } + ], + "resultType": "google.cloud.confidentialcomputing_v1.types.Challenge", + "shortName": "create_challenge" + }, + "description": "Sample for CreateChallenge", + "file": "confidentialcomputing_v1_generated_confidential_computing_create_challenge_sync.py", + "language": "PYTHON", + "origin": "API_DEFINITION", + "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_CreateChallenge_sync", + "segments": [ + { + "end": 51, + "start": 27, + "type": "FULL" + }, + { + "end": 51, + "start": 27, + "type": "SHORT" + }, + { + "end": 40, + "start": 38, + "type": "CLIENT_INITIALIZATION" + }, + { + "end": 45, + "start": 41, + "type": "REQUEST_INITIALIZATION" + }, + { + "end": 48, + "start": 46, + "type": "REQUEST_EXECUTION" + }, + { + "end": 52, + "start": 49, + "type": "RESPONSE_HANDLING" + } + ], + "title": "confidentialcomputing_v1_generated_confidential_computing_create_challenge_sync.py" + }, + { + "canonical": true, + "clientMethod": { + "async": true, + "client": { + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient", + "shortName": "ConfidentialComputingAsyncClient" + }, + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient.verify_attestation", + "method": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.VerifyAttestation", + "service": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "shortName": "ConfidentialComputing" + }, + "shortName": "VerifyAttestation" + }, + "parameters": [ + { + "name": "request", + "type": "google.cloud.confidentialcomputing_v1.types.VerifyAttestationRequest" + }, + { + "name": "retry", + "type": "google.api_core.retry.Retry" + }, + { + "name": "timeout", + "type": "float" + }, + { + "name": "metadata", + "type": "Sequence[Tuple[str, Union[str, bytes]]]" + } + ], + "resultType": "google.cloud.confidentialcomputing_v1.types.VerifyAttestationResponse", + "shortName": "verify_attestation" + }, + "description": "Sample for VerifyAttestation", + "file": "confidentialcomputing_v1_generated_confidential_computing_verify_attestation_async.py", + "language": "PYTHON", + "origin": "API_DEFINITION", + "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_VerifyAttestation_async", + "segments": [ + { + "end": 51, + "start": 27, + "type": "FULL" + }, + { + "end": 51, + "start": 27, + "type": "SHORT" + }, + { + "end": 40, + "start": 38, + "type": "CLIENT_INITIALIZATION" + }, + { + "end": 45, + "start": 41, + "type": "REQUEST_INITIALIZATION" + }, + { + "end": 48, + "start": 46, + "type": "REQUEST_EXECUTION" + }, + { + "end": 52, + "start": 49, + "type": "RESPONSE_HANDLING" + } + ], + "title": "confidentialcomputing_v1_generated_confidential_computing_verify_attestation_async.py" + }, + { + "canonical": true, + "clientMethod": { + "client": { + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient", + "shortName": "ConfidentialComputingClient" + }, + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.verify_attestation", + "method": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.VerifyAttestation", + "service": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "shortName": "ConfidentialComputing" + }, + "shortName": "VerifyAttestation" + }, + "parameters": [ + { + "name": "request", + "type": "google.cloud.confidentialcomputing_v1.types.VerifyAttestationRequest" + }, + { + "name": "retry", + "type": "google.api_core.retry.Retry" + }, + { + "name": "timeout", + "type": "float" + }, + { + "name": "metadata", + "type": "Sequence[Tuple[str, Union[str, bytes]]]" + } + ], + "resultType": "google.cloud.confidentialcomputing_v1.types.VerifyAttestationResponse", + "shortName": "verify_attestation" + }, + "description": "Sample for VerifyAttestation", + "file": "confidentialcomputing_v1_generated_confidential_computing_verify_attestation_sync.py", + "language": "PYTHON", + "origin": "API_DEFINITION", + "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_VerifyAttestation_sync", + "segments": [ + { + "end": 51, + "start": 27, + "type": "FULL" + }, + { + "end": 51, + "start": 27, + "type": "SHORT" + }, + { + "end": 40, + "start": 38, + "type": "CLIENT_INITIALIZATION" + }, + { + "end": 45, + "start": 41, + "type": "REQUEST_INITIALIZATION" + }, + { + "end": 48, + "start": 46, + "type": "REQUEST_EXECUTION" + }, + { + "end": 52, + "start": 49, + "type": "RESPONSE_HANDLING" + } + ], + "title": "confidentialcomputing_v1_generated_confidential_computing_verify_attestation_sync.py" + }, + { + "canonical": true, + "clientMethod": { + "async": true, + "client": { + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient", + "shortName": "ConfidentialComputingAsyncClient" + }, + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient.verify_confidential_gke", + "method": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.VerifyConfidentialGke", + "service": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "shortName": "ConfidentialComputing" + }, + "shortName": "VerifyConfidentialGke" + }, + "parameters": [ + { + "name": "request", + "type": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeRequest" + }, + { + "name": "retry", + "type": "google.api_core.retry.Retry" + }, + { + "name": "timeout", + "type": "float" + }, + { + "name": "metadata", + "type": "Sequence[Tuple[str, Union[str, bytes]]]" + } + ], + "resultType": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeResponse", + "shortName": "verify_confidential_gke" + }, + "description": "Sample for VerifyConfidentialGke", + "file": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_async.py", + "language": "PYTHON", + "origin": "API_DEFINITION", + "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialGke_async", + "segments": [ + { + "end": 51, + "start": 27, + "type": "FULL" + }, + { + "end": 51, + "start": 27, + "type": "SHORT" + }, + { + "end": 40, + "start": 38, + "type": "CLIENT_INITIALIZATION" + }, + { + "end": 45, + "start": 41, + "type": "REQUEST_INITIALIZATION" + }, + { + "end": 48, + "start": 46, + "type": "REQUEST_EXECUTION" + }, + { + "end": 52, + "start": 49, + "type": "RESPONSE_HANDLING" + } + ], + "title": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_async.py" + }, + { + "canonical": true, + "clientMethod": { + "client": { + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient", + "shortName": "ConfidentialComputingClient" + }, + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.verify_confidential_gke", + "method": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.VerifyConfidentialGke", + "service": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "shortName": "ConfidentialComputing" + }, + "shortName": "VerifyConfidentialGke" + }, + "parameters": [ + { + "name": "request", + "type": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeRequest" + }, + { + "name": "retry", + "type": "google.api_core.retry.Retry" + }, + { + "name": "timeout", + "type": "float" + }, + { + "name": "metadata", + "type": "Sequence[Tuple[str, Union[str, bytes]]]" + } + ], + "resultType": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeResponse", + "shortName": "verify_confidential_gke" + }, + "description": "Sample for VerifyConfidentialGke", + "file": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_sync.py", + "language": "PYTHON", + "origin": "API_DEFINITION", + "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialGke_sync", + "segments": [ + { + "end": 51, + "start": 27, + "type": "FULL" + }, + { + "end": 51, + "start": 27, + "type": "SHORT" + }, + { + "end": 40, + "start": 38, + "type": "CLIENT_INITIALIZATION" + }, + { + "end": 45, + "start": 41, + "type": "REQUEST_INITIALIZATION" + }, + { + "end": 48, + "start": 46, + "type": "REQUEST_EXECUTION" + }, + { + "end": 52, + "start": 49, + "type": "RESPONSE_HANDLING" + } + ], + "title": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_sync.py" + }, + { + "canonical": true, + "clientMethod": { + "async": true, + "client": { + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient", + "shortName": "ConfidentialComputingAsyncClient" + }, + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient.verify_confidential_space", + "method": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.VerifyConfidentialSpace", + "service": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "shortName": "ConfidentialComputing" + }, + "shortName": "VerifyConfidentialSpace" + }, + "parameters": [ + { + "name": "request", + "type": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceRequest" + }, + { + "name": "retry", + "type": "google.api_core.retry.Retry" + }, + { + "name": "timeout", + "type": "float" + }, + { + "name": "metadata", + "type": "Sequence[Tuple[str, Union[str, bytes]]]" + } + ], + "resultType": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceResponse", + "shortName": "verify_confidential_space" + }, + "description": "Sample for VerifyConfidentialSpace", + "file": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_async.py", + "language": "PYTHON", + "origin": "API_DEFINITION", + "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialSpace_async", + "segments": [ + { + "end": 51, + "start": 27, + "type": "FULL" + }, + { + "end": 51, + "start": 27, + "type": "SHORT" + }, + { + "end": 40, + "start": 38, + "type": "CLIENT_INITIALIZATION" + }, + { + "end": 45, + "start": 41, + "type": "REQUEST_INITIALIZATION" + }, + { + "end": 48, + "start": 46, + "type": "REQUEST_EXECUTION" + }, + { + "end": 52, + "start": 49, + "type": "RESPONSE_HANDLING" + } + ], + "title": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_async.py" + }, + { + "canonical": true, + "clientMethod": { + "client": { + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient", + "shortName": "ConfidentialComputingClient" + }, + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.verify_confidential_space", + "method": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.VerifyConfidentialSpace", + "service": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "shortName": "ConfidentialComputing" + }, + "shortName": "VerifyConfidentialSpace" + }, + "parameters": [ + { + "name": "request", + "type": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceRequest" + }, + { + "name": "retry", + "type": "google.api_core.retry.Retry" + }, + { + "name": "timeout", + "type": "float" + }, + { + "name": "metadata", + "type": "Sequence[Tuple[str, Union[str, bytes]]]" + } + ], + "resultType": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceResponse", + "shortName": "verify_confidential_space" + }, + "description": "Sample for VerifyConfidentialSpace", + "file": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_sync.py", + "language": "PYTHON", + "origin": "API_DEFINITION", + "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialSpace_sync", + "segments": [ + { + "end": 51, + "start": 27, + "type": "FULL" + }, + { + "end": 51, + "start": 27, + "type": "SHORT" + }, + { + "end": 40, + "start": 38, + "type": "CLIENT_INITIALIZATION" + }, + { + "end": 45, + "start": 41, + "type": "REQUEST_INITIALIZATION" + }, + { + "end": 48, + "start": 46, + "type": "REQUEST_EXECUTION" + }, + { + "end": 52, + "start": 49, + "type": "RESPONSE_HANDLING" + } + ], + "title": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_sync.py" + } + ] +} diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/scripts/fixup_confidentialcomputing_v1_keywords.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/scripts/fixup_confidentialcomputing_v1_keywords.py new file mode 100644 index 000000000000..6a8e4fb95705 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/scripts/fixup_confidentialcomputing_v1_keywords.py @@ -0,0 +1,179 @@ +#! /usr/bin/env python3 +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +import argparse +import os +import libcst as cst +import pathlib +import sys +from typing import (Any, Callable, Dict, List, Sequence, Tuple) + + +def partition( + predicate: Callable[[Any], bool], + iterator: Sequence[Any] +) -> Tuple[List[Any], List[Any]]: + """A stable, out-of-place partition.""" + results = ([], []) + + for i in iterator: + results[int(predicate(i))].append(i) + + # Returns trueList, falseList + return results[1], results[0] + + +class confidentialcomputingCallTransformer(cst.CSTTransformer): + CTRL_PARAMS: Tuple[str] = ('retry', 'timeout', 'metadata') + METHOD_TO_PARAMS: Dict[str, Tuple[str]] = { + 'create_challenge': ('parent', 'challenge', ), + 'verify_attestation': ('challenge', 'tpm_attestation', 'td_ccel', 'sev_snp_attestation', 'gcp_credentials', 'confidential_space_info', 'token_options', 'attester', ), + 'verify_confidential_gke': ('challenge', 'tpm_attestation', ), + 'verify_confidential_space': ('challenge', 'td_ccel', 'tpm_attestation', 'gcp_credentials', 'signed_entities', 'gce_shielded_identity', 'options', ), + } + + def leave_Call(self, original: cst.Call, updated: cst.Call) -> cst.CSTNode: + try: + key = original.func.attr.value + kword_params = self.METHOD_TO_PARAMS[key] + except (AttributeError, KeyError): + # Either not a method from the API or too convoluted to be sure. + return updated + + # If the existing code is valid, keyword args come after positional args. + # Therefore, all positional args must map to the first parameters. + args, kwargs = partition(lambda a: not bool(a.keyword), updated.args) + if any(k.keyword.value == "request" for k in kwargs): + # We've already fixed this file, don't fix it again. + return updated + + kwargs, ctrl_kwargs = partition( + lambda a: a.keyword.value not in self.CTRL_PARAMS, + kwargs + ) + + args, ctrl_args = args[:len(kword_params)], args[len(kword_params):] + ctrl_kwargs.extend(cst.Arg(value=a.value, keyword=cst.Name(value=ctrl)) + for a, ctrl in zip(ctrl_args, self.CTRL_PARAMS)) + + request_arg = cst.Arg( + value=cst.Dict([ + cst.DictElement( + cst.SimpleString("'{}'".format(name)), +cst.Element(value=arg.value) + ) + # Note: the args + kwargs looks silly, but keep in mind that + # the control parameters had to be stripped out, and that + # those could have been passed positionally or by keyword. + for name, arg in zip(kword_params, args + kwargs)]), + keyword=cst.Name("request") + ) + + return updated.with_changes( + args=[request_arg] + ctrl_kwargs + ) + + +def fix_files( + in_dir: pathlib.Path, + out_dir: pathlib.Path, + *, + transformer=confidentialcomputingCallTransformer(), +): + """Duplicate the input dir to the output dir, fixing file method calls. + + Preconditions: + * in_dir is a real directory + * out_dir is a real, empty directory + """ + pyfile_gen = ( + pathlib.Path(os.path.join(root, f)) + for root, _, files in os.walk(in_dir) + for f in files if os.path.splitext(f)[1] == ".py" + ) + + for fpath in pyfile_gen: + with open(fpath, 'r') as f: + src = f.read() + + # Parse the code and insert method call fixes. + tree = cst.parse_module(src) + updated = tree.visit(transformer) + + # Create the path and directory structure for the new file. + updated_path = out_dir.joinpath(fpath.relative_to(in_dir)) + updated_path.parent.mkdir(parents=True, exist_ok=True) + + # Generate the updated source file at the corresponding path. + with open(updated_path, 'w') as f: + f.write(updated.code) + + +if __name__ == '__main__': + parser = argparse.ArgumentParser( + description="""Fix up source that uses the confidentialcomputing client library. + +The existing sources are NOT overwritten but are copied to output_dir with changes made. + +Note: This tool operates at a best-effort level at converting positional + parameters in client method calls to keyword based parameters. + Cases where it WILL FAIL include + A) * or ** expansion in a method call. + B) Calls via function or method alias (includes free function calls) + C) Indirect or dispatched calls (e.g. the method is looked up dynamically) + + These all constitute false negatives. The tool will also detect false + positives when an API method shares a name with another method. +""") + parser.add_argument( + '-d', + '--input-directory', + required=True, + dest='input_dir', + help='the input directory to walk for python files to fix up', + ) + parser.add_argument( + '-o', + '--output-directory', + required=True, + dest='output_dir', + help='the directory to output files fixed via un-flattening', + ) + args = parser.parse_args() + input_dir = pathlib.Path(args.input_dir) + output_dir = pathlib.Path(args.output_dir) + if not input_dir.is_dir(): + print( + f"input directory '{input_dir}' does not exist or is not a directory", + file=sys.stderr, + ) + sys.exit(-1) + + if not output_dir.is_dir(): + print( + f"output directory '{output_dir}' does not exist or is not a directory", + file=sys.stderr, + ) + sys.exit(-1) + + if os.listdir(output_dir): + print( + f"output directory '{output_dir}' is not empty", + file=sys.stderr, + ) + sys.exit(-1) + + fix_files(input_dir, output_dir) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/setup.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/setup.py new file mode 100644 index 000000000000..1fed1a0eec9f --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/setup.py @@ -0,0 +1,98 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +import io +import os +import re + +import setuptools # type: ignore + +package_root = os.path.abspath(os.path.dirname(__file__)) + +name = 'google-cloud-confidentialcomputing' + + +description = "Google Cloud Confidentialcomputing API client library" + +version = None + +with open(os.path.join(package_root, 'google/cloud/confidentialcomputing/gapic_version.py')) as fp: + version_candidates = re.findall(r"(?<=\")\d+.\d+.\d+(?=\")", fp.read()) + assert (len(version_candidates) == 1) + version = version_candidates[0] + +if version[0] == "0": + release_status = "Development Status :: 4 - Beta" +else: + release_status = "Development Status :: 5 - Production/Stable" + +dependencies = [ + "google-api-core[grpc] >= 1.34.1, <3.0.0,!=2.0.*,!=2.1.*,!=2.2.*,!=2.3.*,!=2.4.*,!=2.5.*,!=2.6.*,!=2.7.*,!=2.8.*,!=2.9.*,!=2.10.*", + # Exclude incompatible versions of `google-auth` + # See https://github.com/googleapis/google-cloud-python/issues/12364 + "google-auth >= 2.14.1, <3.0.0,!=2.24.0,!=2.25.0", + "proto-plus >= 1.22.3, <2.0.0", + "proto-plus >= 1.25.0, <2.0.0; python_version >= '3.13'", + "protobuf>=3.20.2,<7.0.0,!=4.21.0,!=4.21.1,!=4.21.2,!=4.21.3,!=4.21.4,!=4.21.5", +] +extras = { +} +url = "https://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-confidentialcomputing" + +package_root = os.path.abspath(os.path.dirname(__file__)) + +readme_filename = os.path.join(package_root, "README.rst") +with io.open(readme_filename, encoding="utf-8") as readme_file: + readme = readme_file.read() + +packages = [ + package + for package in setuptools.find_namespace_packages() + if package.startswith("google") +] + +setuptools.setup( + name=name, + version=version, + description=description, + long_description=readme, + author="Google LLC", + author_email="googleapis-packages@google.com", + license="Apache 2.0", + url=url, + classifiers=[ + release_status, + "Intended Audience :: Developers", + "License :: OSI Approved :: Apache Software License", + "Programming Language :: Python", + "Programming Language :: Python :: 3", + "Programming Language :: Python :: 3.7", + "Programming Language :: Python :: 3.8", + "Programming Language :: Python :: 3.9", + "Programming Language :: Python :: 3.10", + "Programming Language :: Python :: 3.11", + "Programming Language :: Python :: 3.12", + "Programming Language :: Python :: 3.13", + "Operating System :: OS Independent", + "Topic :: Internet", + ], + platforms="Posix; MacOS X; Windows", + packages=packages, + python_requires=">=3.7", + install_requires=dependencies, + extras_require=extras, + include_package_data=True, + zip_safe=False, +) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.10.txt b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.10.txt new file mode 100644 index 000000000000..ed7f9aed2559 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.10.txt @@ -0,0 +1,6 @@ +# -*- coding: utf-8 -*- +# This constraints file is required for unit tests. +# List all library dependencies and extras in this file. +google-api-core +proto-plus +protobuf diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.11.txt b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.11.txt new file mode 100644 index 000000000000..ed7f9aed2559 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.11.txt @@ -0,0 +1,6 @@ +# -*- coding: utf-8 -*- +# This constraints file is required for unit tests. +# List all library dependencies and extras in this file. +google-api-core +proto-plus +protobuf diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.12.txt b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.12.txt new file mode 100644 index 000000000000..ed7f9aed2559 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.12.txt @@ -0,0 +1,6 @@ +# -*- coding: utf-8 -*- +# This constraints file is required for unit tests. +# List all library dependencies and extras in this file. +google-api-core +proto-plus +protobuf diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.13.txt b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.13.txt new file mode 100644 index 000000000000..c20a77817caa --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.13.txt @@ -0,0 +1,11 @@ +# We use the constraints file for the latest Python version +# (currently this file) to check that the latest +# major versions of dependencies are supported in setup.py. +# List all library dependencies and extras in this file. +# Require the latest major version be installed for each dependency. +# e.g., if setup.py has "google-cloud-foo >= 1.14.0, < 2.0.0", +# Then this file should have google-cloud-foo>=1 +google-api-core>=2 +google-auth>=2 +proto-plus>=1 +protobuf>=6 diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.7.txt b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.7.txt new file mode 100644 index 000000000000..a77f12bc13e4 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.7.txt @@ -0,0 +1,10 @@ +# This constraints file is used to check that lower bounds +# are correct in setup.py +# List all library dependencies and extras in this file. +# Pin the version to the lower bound. +# e.g., if setup.py has "google-cloud-foo >= 1.14.0, < 2.0.0", +# Then this file should have google-cloud-foo==1.14.0 +google-api-core==1.34.1 +google-auth==2.14.1 +proto-plus==1.22.3 +protobuf==3.20.2 diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.8.txt b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.8.txt new file mode 100644 index 000000000000..ed7f9aed2559 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.8.txt @@ -0,0 +1,6 @@ +# -*- coding: utf-8 -*- +# This constraints file is required for unit tests. +# List all library dependencies and extras in this file. +google-api-core +proto-plus +protobuf diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.9.txt b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.9.txt new file mode 100644 index 000000000000..ed7f9aed2559 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.9.txt @@ -0,0 +1,6 @@ +# -*- coding: utf-8 -*- +# This constraints file is required for unit tests. +# List all library dependencies and extras in this file. +google-api-core +proto-plus +protobuf diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/__init__.py new file mode 100644 index 000000000000..191773d5572d --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/__init__.py @@ -0,0 +1,16 @@ + +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/__init__.py new file mode 100644 index 000000000000..191773d5572d --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/__init__.py @@ -0,0 +1,16 @@ + +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/__init__.py new file mode 100644 index 000000000000..191773d5572d --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/__init__.py @@ -0,0 +1,16 @@ + +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/confidentialcomputing_v1/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/confidentialcomputing_v1/__init__.py new file mode 100644 index 000000000000..191773d5572d --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/confidentialcomputing_v1/__init__.py @@ -0,0 +1,16 @@ + +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/confidentialcomputing_v1/test_confidential_computing.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/confidentialcomputing_v1/test_confidential_computing.py new file mode 100644 index 000000000000..261b185b4d1b --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/confidentialcomputing_v1/test_confidential_computing.py @@ -0,0 +1,4165 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +import os +# try/except added for compatibility with python < 3.8 +try: + from unittest import mock + from unittest.mock import AsyncMock # pragma: NO COVER +except ImportError: # pragma: NO COVER + import mock + +import grpc +from grpc.experimental import aio +from collections.abc import Iterable, AsyncIterable +from google.protobuf import json_format +import json +import math +import pytest +from google.api_core import api_core_version +from proto.marshal.rules.dates import DurationRule, TimestampRule +from proto.marshal.rules import wrappers +from requests import Response +from requests import Request, PreparedRequest +from requests.sessions import Session +from google.protobuf import json_format + +try: + from google.auth.aio import credentials as ga_credentials_async + HAS_GOOGLE_AUTH_AIO = True +except ImportError: # pragma: NO COVER + HAS_GOOGLE_AUTH_AIO = False + +from google.api_core import client_options +from google.api_core import exceptions as core_exceptions +from google.api_core import gapic_v1 +from google.api_core import grpc_helpers +from google.api_core import grpc_helpers_async +from google.api_core import path_template +from google.api_core import retry as retries +from google.auth import credentials as ga_credentials +from google.auth.exceptions import MutualTLSChannelError +from google.cloud.confidentialcomputing_v1.services.confidential_computing import ConfidentialComputingAsyncClient +from google.cloud.confidentialcomputing_v1.services.confidential_computing import ConfidentialComputingClient +from google.cloud.confidentialcomputing_v1.services.confidential_computing import transports +from google.cloud.confidentialcomputing_v1.types import service +from google.cloud.location import locations_pb2 +from google.oauth2 import service_account +from google.protobuf import timestamp_pb2 # type: ignore +from google.rpc import status_pb2 # type: ignore +import google.auth + + + +CRED_INFO_JSON = { + "credential_source": "/path/to/file", + "credential_type": "service account credentials", + "principal": "service-account@example.com", +} +CRED_INFO_STRING = json.dumps(CRED_INFO_JSON) + + +async def mock_async_gen(data, chunk_size=1): + for i in range(0, len(data)): # pragma: NO COVER + chunk = data[i : i + chunk_size] + yield chunk.encode("utf-8") + +def client_cert_source_callback(): + return b"cert bytes", b"key bytes" + +# TODO: use async auth anon credentials by default once the minimum version of google-auth is upgraded. +# See related issue: https://github.com/googleapis/gapic-generator-python/issues/2107. +def async_anonymous_credentials(): + if HAS_GOOGLE_AUTH_AIO: + return ga_credentials_async.AnonymousCredentials() + return ga_credentials.AnonymousCredentials() + +# If default endpoint is localhost, then default mtls endpoint will be the same. +# This method modifies the default endpoint so the client can produce a different +# mtls endpoint for endpoint testing purposes. +def modify_default_endpoint(client): + return "foo.googleapis.com" if ("localhost" in client.DEFAULT_ENDPOINT) else client.DEFAULT_ENDPOINT + +# If default endpoint template is localhost, then default mtls endpoint will be the same. +# This method modifies the default endpoint template so the client can produce a different +# mtls endpoint for endpoint testing purposes. +def modify_default_endpoint_template(client): + return "test.{UNIVERSE_DOMAIN}" if ("localhost" in client._DEFAULT_ENDPOINT_TEMPLATE) else client._DEFAULT_ENDPOINT_TEMPLATE + + +def test__get_default_mtls_endpoint(): + api_endpoint = "example.googleapis.com" + api_mtls_endpoint = "example.mtls.googleapis.com" + sandbox_endpoint = "example.sandbox.googleapis.com" + sandbox_mtls_endpoint = "example.mtls.sandbox.googleapis.com" + non_googleapi = "api.example.com" + + assert ConfidentialComputingClient._get_default_mtls_endpoint(None) is None + assert ConfidentialComputingClient._get_default_mtls_endpoint(api_endpoint) == api_mtls_endpoint + assert ConfidentialComputingClient._get_default_mtls_endpoint(api_mtls_endpoint) == api_mtls_endpoint + assert ConfidentialComputingClient._get_default_mtls_endpoint(sandbox_endpoint) == sandbox_mtls_endpoint + assert ConfidentialComputingClient._get_default_mtls_endpoint(sandbox_mtls_endpoint) == sandbox_mtls_endpoint + assert ConfidentialComputingClient._get_default_mtls_endpoint(non_googleapi) == non_googleapi + +def test__read_environment_variables(): + assert ConfidentialComputingClient._read_environment_variables() == (False, "auto", None) + + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "true"}): + assert ConfidentialComputingClient._read_environment_variables() == (True, "auto", None) + + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "false"}): + assert ConfidentialComputingClient._read_environment_variables() == (False, "auto", None) + + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "Unsupported"}): + with pytest.raises(ValueError) as excinfo: + ConfidentialComputingClient._read_environment_variables() + assert str(excinfo.value) == "Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`" + + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "never"}): + assert ConfidentialComputingClient._read_environment_variables() == (False, "never", None) + + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "always"}): + assert ConfidentialComputingClient._read_environment_variables() == (False, "always", None) + + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "auto"}): + assert ConfidentialComputingClient._read_environment_variables() == (False, "auto", None) + + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "Unsupported"}): + with pytest.raises(MutualTLSChannelError) as excinfo: + ConfidentialComputingClient._read_environment_variables() + assert str(excinfo.value) == "Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`" + + with mock.patch.dict(os.environ, {"GOOGLE_CLOUD_UNIVERSE_DOMAIN": "foo.com"}): + assert ConfidentialComputingClient._read_environment_variables() == (False, "auto", "foo.com") + +def test__get_client_cert_source(): + mock_provided_cert_source = mock.Mock() + mock_default_cert_source = mock.Mock() + + assert ConfidentialComputingClient._get_client_cert_source(None, False) is None + assert ConfidentialComputingClient._get_client_cert_source(mock_provided_cert_source, False) is None + assert ConfidentialComputingClient._get_client_cert_source(mock_provided_cert_source, True) == mock_provided_cert_source + + with mock.patch('google.auth.transport.mtls.has_default_client_cert_source', return_value=True): + with mock.patch('google.auth.transport.mtls.default_client_cert_source', return_value=mock_default_cert_source): + assert ConfidentialComputingClient._get_client_cert_source(None, True) is mock_default_cert_source + assert ConfidentialComputingClient._get_client_cert_source(mock_provided_cert_source, "true") is mock_provided_cert_source + +@mock.patch.object(ConfidentialComputingClient, "_DEFAULT_ENDPOINT_TEMPLATE", modify_default_endpoint_template(ConfidentialComputingClient)) +@mock.patch.object(ConfidentialComputingAsyncClient, "_DEFAULT_ENDPOINT_TEMPLATE", modify_default_endpoint_template(ConfidentialComputingAsyncClient)) +def test__get_api_endpoint(): + api_override = "foo.com" + mock_client_cert_source = mock.Mock() + default_universe = ConfidentialComputingClient._DEFAULT_UNIVERSE + default_endpoint = ConfidentialComputingClient._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=default_universe) + mock_universe = "bar.com" + mock_endpoint = ConfidentialComputingClient._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=mock_universe) + + assert ConfidentialComputingClient._get_api_endpoint(api_override, mock_client_cert_source, default_universe, "always") == api_override + assert ConfidentialComputingClient._get_api_endpoint(None, mock_client_cert_source, default_universe, "auto") == ConfidentialComputingClient.DEFAULT_MTLS_ENDPOINT + assert ConfidentialComputingClient._get_api_endpoint(None, None, default_universe, "auto") == default_endpoint + assert ConfidentialComputingClient._get_api_endpoint(None, None, default_universe, "always") == ConfidentialComputingClient.DEFAULT_MTLS_ENDPOINT + assert ConfidentialComputingClient._get_api_endpoint(None, mock_client_cert_source, default_universe, "always") == ConfidentialComputingClient.DEFAULT_MTLS_ENDPOINT + assert ConfidentialComputingClient._get_api_endpoint(None, None, mock_universe, "never") == mock_endpoint + assert ConfidentialComputingClient._get_api_endpoint(None, None, default_universe, "never") == default_endpoint + + with pytest.raises(MutualTLSChannelError) as excinfo: + ConfidentialComputingClient._get_api_endpoint(None, mock_client_cert_source, mock_universe, "auto") + assert str(excinfo.value) == "mTLS is not supported in any universe other than googleapis.com." + + +def test__get_universe_domain(): + client_universe_domain = "foo.com" + universe_domain_env = "bar.com" + + assert ConfidentialComputingClient._get_universe_domain(client_universe_domain, universe_domain_env) == client_universe_domain + assert ConfidentialComputingClient._get_universe_domain(None, universe_domain_env) == universe_domain_env + assert ConfidentialComputingClient._get_universe_domain(None, None) == ConfidentialComputingClient._DEFAULT_UNIVERSE + + with pytest.raises(ValueError) as excinfo: + ConfidentialComputingClient._get_universe_domain("", None) + assert str(excinfo.value) == "Universe Domain cannot be an empty string." + +@pytest.mark.parametrize("error_code,cred_info_json,show_cred_info", [ + (401, CRED_INFO_JSON, True), + (403, CRED_INFO_JSON, True), + (404, CRED_INFO_JSON, True), + (500, CRED_INFO_JSON, False), + (401, None, False), + (403, None, False), + (404, None, False), + (500, None, False) +]) +def test__add_cred_info_for_auth_errors(error_code, cred_info_json, show_cred_info): + cred = mock.Mock(["get_cred_info"]) + cred.get_cred_info = mock.Mock(return_value=cred_info_json) + client = ConfidentialComputingClient(credentials=cred) + client._transport._credentials = cred + + error = core_exceptions.GoogleAPICallError("message", details=["foo"]) + error.code = error_code + + client._add_cred_info_for_auth_errors(error) + if show_cred_info: + assert error.details == ["foo", CRED_INFO_STRING] + else: + assert error.details == ["foo"] + +@pytest.mark.parametrize("error_code", [401,403,404,500]) +def test__add_cred_info_for_auth_errors_no_get_cred_info(error_code): + cred = mock.Mock([]) + assert not hasattr(cred, "get_cred_info") + client = ConfidentialComputingClient(credentials=cred) + client._transport._credentials = cred + + error = core_exceptions.GoogleAPICallError("message", details=[]) + error.code = error_code + + client._add_cred_info_for_auth_errors(error) + assert error.details == [] + +@pytest.mark.parametrize("client_class,transport_name", [ + (ConfidentialComputingClient, "grpc"), + (ConfidentialComputingAsyncClient, "grpc_asyncio"), + (ConfidentialComputingClient, "rest"), +]) +def test_confidential_computing_client_from_service_account_info(client_class, transport_name): + creds = ga_credentials.AnonymousCredentials() + with mock.patch.object(service_account.Credentials, 'from_service_account_info') as factory: + factory.return_value = creds + info = {"valid": True} + client = client_class.from_service_account_info(info, transport=transport_name) + assert client.transport._credentials == creds + assert isinstance(client, client_class) + + assert client.transport._host == ( + 'confidentialcomputing.googleapis.com:443' + if transport_name in ['grpc', 'grpc_asyncio'] + else + 'https://confidentialcomputing.googleapis.com' + ) + + +@pytest.mark.parametrize("transport_class,transport_name", [ + (transports.ConfidentialComputingGrpcTransport, "grpc"), + (transports.ConfidentialComputingGrpcAsyncIOTransport, "grpc_asyncio"), + (transports.ConfidentialComputingRestTransport, "rest"), +]) +def test_confidential_computing_client_service_account_always_use_jwt(transport_class, transport_name): + with mock.patch.object(service_account.Credentials, 'with_always_use_jwt_access', create=True) as use_jwt: + creds = service_account.Credentials(None, None, None) + transport = transport_class(credentials=creds, always_use_jwt_access=True) + use_jwt.assert_called_once_with(True) + + with mock.patch.object(service_account.Credentials, 'with_always_use_jwt_access', create=True) as use_jwt: + creds = service_account.Credentials(None, None, None) + transport = transport_class(credentials=creds, always_use_jwt_access=False) + use_jwt.assert_not_called() + + +@pytest.mark.parametrize("client_class,transport_name", [ + (ConfidentialComputingClient, "grpc"), + (ConfidentialComputingAsyncClient, "grpc_asyncio"), + (ConfidentialComputingClient, "rest"), +]) +def test_confidential_computing_client_from_service_account_file(client_class, transport_name): + creds = ga_credentials.AnonymousCredentials() + with mock.patch.object(service_account.Credentials, 'from_service_account_file') as factory: + factory.return_value = creds + client = client_class.from_service_account_file("dummy/file/path.json", transport=transport_name) + assert client.transport._credentials == creds + assert isinstance(client, client_class) + + client = client_class.from_service_account_json("dummy/file/path.json", transport=transport_name) + assert client.transport._credentials == creds + assert isinstance(client, client_class) + + assert client.transport._host == ( + 'confidentialcomputing.googleapis.com:443' + if transport_name in ['grpc', 'grpc_asyncio'] + else + 'https://confidentialcomputing.googleapis.com' + ) + + +def test_confidential_computing_client_get_transport_class(): + transport = ConfidentialComputingClient.get_transport_class() + available_transports = [ + transports.ConfidentialComputingGrpcTransport, + transports.ConfidentialComputingRestTransport, + ] + assert transport in available_transports + + transport = ConfidentialComputingClient.get_transport_class("grpc") + assert transport == transports.ConfidentialComputingGrpcTransport + + +@pytest.mark.parametrize("client_class,transport_class,transport_name", [ + (ConfidentialComputingClient, transports.ConfidentialComputingGrpcTransport, "grpc"), + (ConfidentialComputingAsyncClient, transports.ConfidentialComputingGrpcAsyncIOTransport, "grpc_asyncio"), + (ConfidentialComputingClient, transports.ConfidentialComputingRestTransport, "rest"), +]) +@mock.patch.object(ConfidentialComputingClient, "_DEFAULT_ENDPOINT_TEMPLATE", modify_default_endpoint_template(ConfidentialComputingClient)) +@mock.patch.object(ConfidentialComputingAsyncClient, "_DEFAULT_ENDPOINT_TEMPLATE", modify_default_endpoint_template(ConfidentialComputingAsyncClient)) +def test_confidential_computing_client_client_options(client_class, transport_class, transport_name): + # Check that if channel is provided we won't create a new one. + with mock.patch.object(ConfidentialComputingClient, 'get_transport_class') as gtc: + transport = transport_class( + credentials=ga_credentials.AnonymousCredentials() + ) + client = client_class(transport=transport) + gtc.assert_not_called() + + # Check that if channel is provided via str we will create a new one. + with mock.patch.object(ConfidentialComputingClient, 'get_transport_class') as gtc: + client = client_class(transport=transport_name) + gtc.assert_called() + + # Check the case api_endpoint is provided. + options = client_options.ClientOptions(api_endpoint="squid.clam.whelk") + with mock.patch.object(transport_class, '__init__') as patched: + patched.return_value = None + client = client_class(transport=transport_name, client_options=options) + patched.assert_called_once_with( + credentials=None, + credentials_file=None, + host="squid.clam.whelk", + scopes=None, + client_cert_source_for_mtls=None, + quota_project_id=None, + client_info=transports.base.DEFAULT_CLIENT_INFO, + always_use_jwt_access=True, + api_audience=None, + ) + + # Check the case api_endpoint is not provided and GOOGLE_API_USE_MTLS_ENDPOINT is + # "never". + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "never"}): + with mock.patch.object(transport_class, '__init__') as patched: + patched.return_value = None + client = client_class(transport=transport_name) + patched.assert_called_once_with( + credentials=None, + credentials_file=None, + host=client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE), + scopes=None, + client_cert_source_for_mtls=None, + quota_project_id=None, + client_info=transports.base.DEFAULT_CLIENT_INFO, + always_use_jwt_access=True, + api_audience=None, + ) + + # Check the case api_endpoint is not provided and GOOGLE_API_USE_MTLS_ENDPOINT is + # "always". + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "always"}): + with mock.patch.object(transport_class, '__init__') as patched: + patched.return_value = None + client = client_class(transport=transport_name) + patched.assert_called_once_with( + credentials=None, + credentials_file=None, + host=client.DEFAULT_MTLS_ENDPOINT, + scopes=None, + client_cert_source_for_mtls=None, + quota_project_id=None, + client_info=transports.base.DEFAULT_CLIENT_INFO, + always_use_jwt_access=True, + api_audience=None, + ) + + # Check the case api_endpoint is not provided and GOOGLE_API_USE_MTLS_ENDPOINT has + # unsupported value. + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "Unsupported"}): + with pytest.raises(MutualTLSChannelError) as excinfo: + client = client_class(transport=transport_name) + assert str(excinfo.value) == "Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`" + + # Check the case GOOGLE_API_USE_CLIENT_CERTIFICATE has unsupported value. + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "Unsupported"}): + with pytest.raises(ValueError) as excinfo: + client = client_class(transport=transport_name) + assert str(excinfo.value) == "Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`" + + # Check the case quota_project_id is provided + options = client_options.ClientOptions(quota_project_id="octopus") + with mock.patch.object(transport_class, '__init__') as patched: + patched.return_value = None + client = client_class(client_options=options, transport=transport_name) + patched.assert_called_once_with( + credentials=None, + credentials_file=None, + host=client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE), + scopes=None, + client_cert_source_for_mtls=None, + quota_project_id="octopus", + client_info=transports.base.DEFAULT_CLIENT_INFO, + always_use_jwt_access=True, + api_audience=None, + ) + # Check the case api_endpoint is provided + options = client_options.ClientOptions(api_audience="https://language.googleapis.com") + with mock.patch.object(transport_class, '__init__') as patched: + patched.return_value = None + client = client_class(client_options=options, transport=transport_name) + patched.assert_called_once_with( + credentials=None, + credentials_file=None, + host=client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE), + scopes=None, + client_cert_source_for_mtls=None, + quota_project_id=None, + client_info=transports.base.DEFAULT_CLIENT_INFO, + always_use_jwt_access=True, + api_audience="https://language.googleapis.com" + ) + +@pytest.mark.parametrize("client_class,transport_class,transport_name,use_client_cert_env", [ + (ConfidentialComputingClient, transports.ConfidentialComputingGrpcTransport, "grpc", "true"), + (ConfidentialComputingAsyncClient, transports.ConfidentialComputingGrpcAsyncIOTransport, "grpc_asyncio", "true"), + (ConfidentialComputingClient, transports.ConfidentialComputingGrpcTransport, "grpc", "false"), + (ConfidentialComputingAsyncClient, transports.ConfidentialComputingGrpcAsyncIOTransport, "grpc_asyncio", "false"), + (ConfidentialComputingClient, transports.ConfidentialComputingRestTransport, "rest", "true"), + (ConfidentialComputingClient, transports.ConfidentialComputingRestTransport, "rest", "false"), +]) +@mock.patch.object(ConfidentialComputingClient, "_DEFAULT_ENDPOINT_TEMPLATE", modify_default_endpoint_template(ConfidentialComputingClient)) +@mock.patch.object(ConfidentialComputingAsyncClient, "_DEFAULT_ENDPOINT_TEMPLATE", modify_default_endpoint_template(ConfidentialComputingAsyncClient)) +@mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "auto"}) +def test_confidential_computing_client_mtls_env_auto(client_class, transport_class, transport_name, use_client_cert_env): + # This tests the endpoint autoswitch behavior. Endpoint is autoswitched to the default + # mtls endpoint, if GOOGLE_API_USE_CLIENT_CERTIFICATE is "true" and client cert exists. + + # Check the case client_cert_source is provided. Whether client cert is used depends on + # GOOGLE_API_USE_CLIENT_CERTIFICATE value. + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": use_client_cert_env}): + options = client_options.ClientOptions(client_cert_source=client_cert_source_callback) + with mock.patch.object(transport_class, '__init__') as patched: + patched.return_value = None + client = client_class(client_options=options, transport=transport_name) + + if use_client_cert_env == "false": + expected_client_cert_source = None + expected_host = client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE) + else: + expected_client_cert_source = client_cert_source_callback + expected_host = client.DEFAULT_MTLS_ENDPOINT + + patched.assert_called_once_with( + credentials=None, + credentials_file=None, + host=expected_host, + scopes=None, + client_cert_source_for_mtls=expected_client_cert_source, + quota_project_id=None, + client_info=transports.base.DEFAULT_CLIENT_INFO, + always_use_jwt_access=True, + api_audience=None, + ) + + # Check the case ADC client cert is provided. Whether client cert is used depends on + # GOOGLE_API_USE_CLIENT_CERTIFICATE value. + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": use_client_cert_env}): + with mock.patch.object(transport_class, '__init__') as patched: + with mock.patch('google.auth.transport.mtls.has_default_client_cert_source', return_value=True): + with mock.patch('google.auth.transport.mtls.default_client_cert_source', return_value=client_cert_source_callback): + if use_client_cert_env == "false": + expected_host = client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE) + expected_client_cert_source = None + else: + expected_host = client.DEFAULT_MTLS_ENDPOINT + expected_client_cert_source = client_cert_source_callback + + patched.return_value = None + client = client_class(transport=transport_name) + patched.assert_called_once_with( + credentials=None, + credentials_file=None, + host=expected_host, + scopes=None, + client_cert_source_for_mtls=expected_client_cert_source, + quota_project_id=None, + client_info=transports.base.DEFAULT_CLIENT_INFO, + always_use_jwt_access=True, + api_audience=None, + ) + + # Check the case client_cert_source and ADC client cert are not provided. + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": use_client_cert_env}): + with mock.patch.object(transport_class, '__init__') as patched: + with mock.patch("google.auth.transport.mtls.has_default_client_cert_source", return_value=False): + patched.return_value = None + client = client_class(transport=transport_name) + patched.assert_called_once_with( + credentials=None, + credentials_file=None, + host=client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE), + scopes=None, + client_cert_source_for_mtls=None, + quota_project_id=None, + client_info=transports.base.DEFAULT_CLIENT_INFO, + always_use_jwt_access=True, + api_audience=None, + ) + + +@pytest.mark.parametrize("client_class", [ + ConfidentialComputingClient, ConfidentialComputingAsyncClient +]) +@mock.patch.object(ConfidentialComputingClient, "DEFAULT_ENDPOINT", modify_default_endpoint(ConfidentialComputingClient)) +@mock.patch.object(ConfidentialComputingAsyncClient, "DEFAULT_ENDPOINT", modify_default_endpoint(ConfidentialComputingAsyncClient)) +def test_confidential_computing_client_get_mtls_endpoint_and_cert_source(client_class): + mock_client_cert_source = mock.Mock() + + # Test the case GOOGLE_API_USE_CLIENT_CERTIFICATE is "true". + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "true"}): + mock_api_endpoint = "foo" + options = client_options.ClientOptions(client_cert_source=mock_client_cert_source, api_endpoint=mock_api_endpoint) + api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source(options) + assert api_endpoint == mock_api_endpoint + assert cert_source == mock_client_cert_source + + # Test the case GOOGLE_API_USE_CLIENT_CERTIFICATE is "false". + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "false"}): + mock_client_cert_source = mock.Mock() + mock_api_endpoint = "foo" + options = client_options.ClientOptions(client_cert_source=mock_client_cert_source, api_endpoint=mock_api_endpoint) + api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source(options) + assert api_endpoint == mock_api_endpoint + assert cert_source is None + + # Test the case GOOGLE_API_USE_MTLS_ENDPOINT is "never". + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "never"}): + api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source() + assert api_endpoint == client_class.DEFAULT_ENDPOINT + assert cert_source is None + + # Test the case GOOGLE_API_USE_MTLS_ENDPOINT is "always". + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "always"}): + api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source() + assert api_endpoint == client_class.DEFAULT_MTLS_ENDPOINT + assert cert_source is None + + # Test the case GOOGLE_API_USE_MTLS_ENDPOINT is "auto" and default cert doesn't exist. + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "true"}): + with mock.patch('google.auth.transport.mtls.has_default_client_cert_source', return_value=False): + api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source() + assert api_endpoint == client_class.DEFAULT_ENDPOINT + assert cert_source is None + + # Test the case GOOGLE_API_USE_MTLS_ENDPOINT is "auto" and default cert exists. + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "true"}): + with mock.patch('google.auth.transport.mtls.has_default_client_cert_source', return_value=True): + with mock.patch('google.auth.transport.mtls.default_client_cert_source', return_value=mock_client_cert_source): + api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source() + assert api_endpoint == client_class.DEFAULT_MTLS_ENDPOINT + assert cert_source == mock_client_cert_source + + # Check the case api_endpoint is not provided and GOOGLE_API_USE_MTLS_ENDPOINT has + # unsupported value. + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "Unsupported"}): + with pytest.raises(MutualTLSChannelError) as excinfo: + client_class.get_mtls_endpoint_and_cert_source() + + assert str(excinfo.value) == "Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`" + + # Check the case GOOGLE_API_USE_CLIENT_CERTIFICATE has unsupported value. + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "Unsupported"}): + with pytest.raises(ValueError) as excinfo: + client_class.get_mtls_endpoint_and_cert_source() + + assert str(excinfo.value) == "Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`" + +@pytest.mark.parametrize("client_class", [ + ConfidentialComputingClient, ConfidentialComputingAsyncClient +]) +@mock.patch.object(ConfidentialComputingClient, "_DEFAULT_ENDPOINT_TEMPLATE", modify_default_endpoint_template(ConfidentialComputingClient)) +@mock.patch.object(ConfidentialComputingAsyncClient, "_DEFAULT_ENDPOINT_TEMPLATE", modify_default_endpoint_template(ConfidentialComputingAsyncClient)) +def test_confidential_computing_client_client_api_endpoint(client_class): + mock_client_cert_source = client_cert_source_callback + api_override = "foo.com" + default_universe = ConfidentialComputingClient._DEFAULT_UNIVERSE + default_endpoint = ConfidentialComputingClient._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=default_universe) + mock_universe = "bar.com" + mock_endpoint = ConfidentialComputingClient._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=mock_universe) + + # If ClientOptions.api_endpoint is set and GOOGLE_API_USE_CLIENT_CERTIFICATE="true", + # use ClientOptions.api_endpoint as the api endpoint regardless. + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "true"}): + with mock.patch("google.auth.transport.requests.AuthorizedSession.configure_mtls_channel"): + options = client_options.ClientOptions(client_cert_source=mock_client_cert_source, api_endpoint=api_override) + client = client_class(client_options=options, credentials=ga_credentials.AnonymousCredentials()) + assert client.api_endpoint == api_override + + # If ClientOptions.api_endpoint is not set and GOOGLE_API_USE_MTLS_ENDPOINT="never", + # use the _DEFAULT_ENDPOINT_TEMPLATE populated with GDU as the api endpoint. + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "never"}): + client = client_class(credentials=ga_credentials.AnonymousCredentials()) + assert client.api_endpoint == default_endpoint + + # If ClientOptions.api_endpoint is not set and GOOGLE_API_USE_MTLS_ENDPOINT="always", + # use the DEFAULT_MTLS_ENDPOINT as the api endpoint. + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "always"}): + client = client_class(credentials=ga_credentials.AnonymousCredentials()) + assert client.api_endpoint == client_class.DEFAULT_MTLS_ENDPOINT + + # If ClientOptions.api_endpoint is not set, GOOGLE_API_USE_MTLS_ENDPOINT="auto" (default), + # GOOGLE_API_USE_CLIENT_CERTIFICATE="false" (default), default cert source doesn't exist, + # and ClientOptions.universe_domain="bar.com", + # use the _DEFAULT_ENDPOINT_TEMPLATE populated with universe domain as the api endpoint. + options = client_options.ClientOptions() + universe_exists = hasattr(options, "universe_domain") + if universe_exists: + options = client_options.ClientOptions(universe_domain=mock_universe) + client = client_class(client_options=options, credentials=ga_credentials.AnonymousCredentials()) + else: + client = client_class(client_options=options, credentials=ga_credentials.AnonymousCredentials()) + assert client.api_endpoint == (mock_endpoint if universe_exists else default_endpoint) + assert client.universe_domain == (mock_universe if universe_exists else default_universe) + + # If ClientOptions does not have a universe domain attribute and GOOGLE_API_USE_MTLS_ENDPOINT="never", + # use the _DEFAULT_ENDPOINT_TEMPLATE populated with GDU as the api endpoint. + options = client_options.ClientOptions() + if hasattr(options, "universe_domain"): + delattr(options, "universe_domain") + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "never"}): + client = client_class(client_options=options, credentials=ga_credentials.AnonymousCredentials()) + assert client.api_endpoint == default_endpoint + + +@pytest.mark.parametrize("client_class,transport_class,transport_name", [ + (ConfidentialComputingClient, transports.ConfidentialComputingGrpcTransport, "grpc"), + (ConfidentialComputingAsyncClient, transports.ConfidentialComputingGrpcAsyncIOTransport, "grpc_asyncio"), + (ConfidentialComputingClient, transports.ConfidentialComputingRestTransport, "rest"), +]) +def test_confidential_computing_client_client_options_scopes(client_class, transport_class, transport_name): + # Check the case scopes are provided. + options = client_options.ClientOptions( + scopes=["1", "2"], + ) + with mock.patch.object(transport_class, '__init__') as patched: + patched.return_value = None + client = client_class(client_options=options, transport=transport_name) + patched.assert_called_once_with( + credentials=None, + credentials_file=None, + host=client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE), + scopes=["1", "2"], + client_cert_source_for_mtls=None, + quota_project_id=None, + client_info=transports.base.DEFAULT_CLIENT_INFO, + always_use_jwt_access=True, + api_audience=None, + ) + +@pytest.mark.parametrize("client_class,transport_class,transport_name,grpc_helpers", [ + (ConfidentialComputingClient, transports.ConfidentialComputingGrpcTransport, "grpc", grpc_helpers), + (ConfidentialComputingAsyncClient, transports.ConfidentialComputingGrpcAsyncIOTransport, "grpc_asyncio", grpc_helpers_async), + (ConfidentialComputingClient, transports.ConfidentialComputingRestTransport, "rest", None), +]) +def test_confidential_computing_client_client_options_credentials_file(client_class, transport_class, transport_name, grpc_helpers): + # Check the case credentials file is provided. + options = client_options.ClientOptions( + credentials_file="credentials.json" + ) + + with mock.patch.object(transport_class, '__init__') as patched: + patched.return_value = None + client = client_class(client_options=options, transport=transport_name) + patched.assert_called_once_with( + credentials=None, + credentials_file="credentials.json", + host=client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE), + scopes=None, + client_cert_source_for_mtls=None, + quota_project_id=None, + client_info=transports.base.DEFAULT_CLIENT_INFO, + always_use_jwt_access=True, + api_audience=None, + ) + +def test_confidential_computing_client_client_options_from_dict(): + with mock.patch('google.cloud.confidentialcomputing_v1.services.confidential_computing.transports.ConfidentialComputingGrpcTransport.__init__') as grpc_transport: + grpc_transport.return_value = None + client = ConfidentialComputingClient( + client_options={'api_endpoint': 'squid.clam.whelk'} + ) + grpc_transport.assert_called_once_with( + credentials=None, + credentials_file=None, + host="squid.clam.whelk", + scopes=None, + client_cert_source_for_mtls=None, + quota_project_id=None, + client_info=transports.base.DEFAULT_CLIENT_INFO, + always_use_jwt_access=True, + api_audience=None, + ) + + +@pytest.mark.parametrize("client_class,transport_class,transport_name,grpc_helpers", [ + (ConfidentialComputingClient, transports.ConfidentialComputingGrpcTransport, "grpc", grpc_helpers), + (ConfidentialComputingAsyncClient, transports.ConfidentialComputingGrpcAsyncIOTransport, "grpc_asyncio", grpc_helpers_async), +]) +def test_confidential_computing_client_create_channel_credentials_file(client_class, transport_class, transport_name, grpc_helpers): + # Check the case credentials file is provided. + options = client_options.ClientOptions( + credentials_file="credentials.json" + ) + + with mock.patch.object(transport_class, '__init__') as patched: + patched.return_value = None + client = client_class(client_options=options, transport=transport_name) + patched.assert_called_once_with( + credentials=None, + credentials_file="credentials.json", + host=client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE), + scopes=None, + client_cert_source_for_mtls=None, + quota_project_id=None, + client_info=transports.base.DEFAULT_CLIENT_INFO, + always_use_jwt_access=True, + api_audience=None, + ) + + # test that the credentials from file are saved and used as the credentials. + with mock.patch.object( + google.auth, "load_credentials_from_file", autospec=True + ) as load_creds, mock.patch.object( + google.auth, "default", autospec=True + ) as adc, mock.patch.object( + grpc_helpers, "create_channel" + ) as create_channel: + creds = ga_credentials.AnonymousCredentials() + file_creds = ga_credentials.AnonymousCredentials() + load_creds.return_value = (file_creds, None) + adc.return_value = (creds, None) + client = client_class(client_options=options, transport=transport_name) + create_channel.assert_called_with( + "confidentialcomputing.googleapis.com:443", + credentials=file_creds, + credentials_file=None, + quota_project_id=None, + default_scopes=( + 'https://www.googleapis.com/auth/cloud-platform', +), + scopes=None, + default_host="confidentialcomputing.googleapis.com", + ssl_credentials=None, + options=[ + ("grpc.max_send_message_length", -1), + ("grpc.max_receive_message_length", -1), + ], + ) + + +@pytest.mark.parametrize("request_type", [ + service.CreateChallengeRequest, + dict, +]) +def test_create_challenge(request_type, transport: str = 'grpc'): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport=transport, + ) + + # Everything is optional in proto3 as far as the runtime is concerned, + # and we are mocking out the actual API, so just send an empty request. + request = request_type() + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.create_challenge), + '__call__') as call: + # Designate an appropriate return value for the call. + call.return_value = service.Challenge( + name='name_value', + used=True, + tpm_nonce='tpm_nonce_value', + ) + response = client.create_challenge(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + request = service.CreateChallengeRequest() + assert args[0] == request + + # Establish that the response is the type that we expect. + assert isinstance(response, service.Challenge) + assert response.name == 'name_value' + assert response.used is True + assert response.tpm_nonce == 'tpm_nonce_value' + + +def test_create_challenge_non_empty_request_with_auto_populated_field(): + # This test is a coverage failsafe to make sure that UUID4 fields are + # automatically populated, according to AIP-4235, with non-empty requests. + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport='grpc', + ) + + # Populate all string fields in the request which are not UUID4 + # since we want to check that UUID4 are populated automatically + # if they meet the requirements of AIP 4235. + request = service.CreateChallengeRequest( + parent='parent_value', + ) + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.create_challenge), + '__call__') as call: + call.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. + client.create_challenge(request=request) + call.assert_called() + _, args, _ = call.mock_calls[0] + assert args[0] == service.CreateChallengeRequest( + parent='parent_value', + ) + +def test_create_challenge_use_cached_wrapped_rpc(): + # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, + # instead of constructing them on each call + with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="grpc", + ) + + # Should wrap all calls on client creation + assert wrapper_fn.call_count > 0 + wrapper_fn.reset_mock() + + # Ensure method has been cached + assert client._transport.create_challenge in client._transport._wrapped_methods + + # Replace cached wrapped function with mock + mock_rpc = mock.Mock() + mock_rpc.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. + client._transport._wrapped_methods[client._transport.create_challenge] = mock_rpc + request = {} + client.create_challenge(request) + + # Establish that the underlying gRPC stub method was called. + assert mock_rpc.call_count == 1 + + client.create_challenge(request) + + # Establish that a new wrapper was not created for this call + assert wrapper_fn.call_count == 0 + assert mock_rpc.call_count == 2 + +@pytest.mark.asyncio +async def test_create_challenge_async_use_cached_wrapped_rpc(transport: str = "grpc_asyncio"): + # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, + # instead of constructing them on each call + with mock.patch("google.api_core.gapic_v1.method_async.wrap_method") as wrapper_fn: + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport=transport, + ) + + # Should wrap all calls on client creation + assert wrapper_fn.call_count > 0 + wrapper_fn.reset_mock() + + # Ensure method has been cached + assert client._client._transport.create_challenge in client._client._transport._wrapped_methods + + # Replace cached wrapped function with mock + mock_rpc = mock.AsyncMock() + mock_rpc.return_value = mock.Mock() + client._client._transport._wrapped_methods[client._client._transport.create_challenge] = mock_rpc + + request = {} + await client.create_challenge(request) + + # Establish that the underlying gRPC stub method was called. + assert mock_rpc.call_count == 1 + + await client.create_challenge(request) + + # Establish that a new wrapper was not created for this call + assert wrapper_fn.call_count == 0 + assert mock_rpc.call_count == 2 + +@pytest.mark.asyncio +async def test_create_challenge_async(transport: str = 'grpc_asyncio', request_type=service.CreateChallengeRequest): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport=transport, + ) + + # Everything is optional in proto3 as far as the runtime is concerned, + # and we are mocking out the actual API, so just send an empty request. + request = request_type() + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.create_challenge), + '__call__') as call: + # Designate an appropriate return value for the call. + call.return_value =grpc_helpers_async.FakeUnaryUnaryCall(service.Challenge( + name='name_value', + used=True, + tpm_nonce='tpm_nonce_value', + )) + response = await client.create_challenge(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) + _, args, _ = call.mock_calls[0] + request = service.CreateChallengeRequest() + assert args[0] == request + + # Establish that the response is the type that we expect. + assert isinstance(response, service.Challenge) + assert response.name == 'name_value' + assert response.used is True + assert response.tpm_nonce == 'tpm_nonce_value' + + +@pytest.mark.asyncio +async def test_create_challenge_async_from_dict(): + await test_create_challenge_async(request_type=dict) + +def test_create_challenge_field_headers(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + ) + + # Any value that is part of the HTTP/1.1 URI should be sent as + # a field header. Set these to a non-empty value. + request = service.CreateChallengeRequest() + + request.parent = 'parent_value' + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.create_challenge), + '__call__') as call: + call.return_value = service.Challenge() + client.create_challenge(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the field header was sent. + _, _, kw = call.mock_calls[0] + assert ( + 'x-goog-request-params', + 'parent=parent_value', + ) in kw['metadata'] + + +@pytest.mark.asyncio +async def test_create_challenge_field_headers_async(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + ) + + # Any value that is part of the HTTP/1.1 URI should be sent as + # a field header. Set these to a non-empty value. + request = service.CreateChallengeRequest() + + request.parent = 'parent_value' + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.create_challenge), + '__call__') as call: + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.Challenge()) + await client.create_challenge(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the field header was sent. + _, _, kw = call.mock_calls[0] + assert ( + 'x-goog-request-params', + 'parent=parent_value', + ) in kw['metadata'] + + +def test_create_challenge_flattened(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + ) + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.create_challenge), + '__call__') as call: + # Designate an appropriate return value for the call. + call.return_value = service.Challenge() + # Call the method with a truthy value for each flattened field, + # using the keyword arguments to the method. + client.create_challenge( + parent='parent_value', + challenge=service.Challenge(name='name_value'), + ) + + # Establish that the underlying call was made with the expected + # request object values. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + arg = args[0].parent + mock_val = 'parent_value' + assert arg == mock_val + arg = args[0].challenge + mock_val = service.Challenge(name='name_value') + assert arg == mock_val + + +def test_create_challenge_flattened_error(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + ) + + # Attempting to call a method with both a request object and flattened + # fields is an error. + with pytest.raises(ValueError): + client.create_challenge( + service.CreateChallengeRequest(), + parent='parent_value', + challenge=service.Challenge(name='name_value'), + ) + +@pytest.mark.asyncio +async def test_create_challenge_flattened_async(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + ) + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.create_challenge), + '__call__') as call: + # Designate an appropriate return value for the call. + call.return_value = service.Challenge() + + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.Challenge()) + # Call the method with a truthy value for each flattened field, + # using the keyword arguments to the method. + response = await client.create_challenge( + parent='parent_value', + challenge=service.Challenge(name='name_value'), + ) + + # Establish that the underlying call was made with the expected + # request object values. + assert len(call.mock_calls) + _, args, _ = call.mock_calls[0] + arg = args[0].parent + mock_val = 'parent_value' + assert arg == mock_val + arg = args[0].challenge + mock_val = service.Challenge(name='name_value') + assert arg == mock_val + +@pytest.mark.asyncio +async def test_create_challenge_flattened_error_async(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + ) + + # Attempting to call a method with both a request object and flattened + # fields is an error. + with pytest.raises(ValueError): + await client.create_challenge( + service.CreateChallengeRequest(), + parent='parent_value', + challenge=service.Challenge(name='name_value'), + ) + + +@pytest.mark.parametrize("request_type", [ + service.VerifyAttestationRequest, + dict, +]) +def test_verify_attestation(request_type, transport: str = 'grpc'): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport=transport, + ) + + # Everything is optional in proto3 as far as the runtime is concerned, + # and we are mocking out the actual API, so just send an empty request. + request = request_type() + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_attestation), + '__call__') as call: + # Designate an appropriate return value for the call. + call.return_value = service.VerifyAttestationResponse( + oidc_claims_token='oidc_claims_token_value', + ) + response = client.verify_attestation(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + request = service.VerifyAttestationRequest() + assert args[0] == request + + # Establish that the response is the type that we expect. + assert isinstance(response, service.VerifyAttestationResponse) + assert response.oidc_claims_token == 'oidc_claims_token_value' + + +def test_verify_attestation_non_empty_request_with_auto_populated_field(): + # This test is a coverage failsafe to make sure that UUID4 fields are + # automatically populated, according to AIP-4235, with non-empty requests. + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport='grpc', + ) + + # Populate all string fields in the request which are not UUID4 + # since we want to check that UUID4 are populated automatically + # if they meet the requirements of AIP 4235. + request = service.VerifyAttestationRequest( + challenge='challenge_value', + attester='attester_value', + ) + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_attestation), + '__call__') as call: + call.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. + client.verify_attestation(request=request) + call.assert_called() + _, args, _ = call.mock_calls[0] + assert args[0] == service.VerifyAttestationRequest( + challenge='challenge_value', + attester='attester_value', + ) + +def test_verify_attestation_use_cached_wrapped_rpc(): + # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, + # instead of constructing them on each call + with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="grpc", + ) + + # Should wrap all calls on client creation + assert wrapper_fn.call_count > 0 + wrapper_fn.reset_mock() + + # Ensure method has been cached + assert client._transport.verify_attestation in client._transport._wrapped_methods + + # Replace cached wrapped function with mock + mock_rpc = mock.Mock() + mock_rpc.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. + client._transport._wrapped_methods[client._transport.verify_attestation] = mock_rpc + request = {} + client.verify_attestation(request) + + # Establish that the underlying gRPC stub method was called. + assert mock_rpc.call_count == 1 + + client.verify_attestation(request) + + # Establish that a new wrapper was not created for this call + assert wrapper_fn.call_count == 0 + assert mock_rpc.call_count == 2 + +@pytest.mark.asyncio +async def test_verify_attestation_async_use_cached_wrapped_rpc(transport: str = "grpc_asyncio"): + # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, + # instead of constructing them on each call + with mock.patch("google.api_core.gapic_v1.method_async.wrap_method") as wrapper_fn: + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport=transport, + ) + + # Should wrap all calls on client creation + assert wrapper_fn.call_count > 0 + wrapper_fn.reset_mock() + + # Ensure method has been cached + assert client._client._transport.verify_attestation in client._client._transport._wrapped_methods + + # Replace cached wrapped function with mock + mock_rpc = mock.AsyncMock() + mock_rpc.return_value = mock.Mock() + client._client._transport._wrapped_methods[client._client._transport.verify_attestation] = mock_rpc + + request = {} + await client.verify_attestation(request) + + # Establish that the underlying gRPC stub method was called. + assert mock_rpc.call_count == 1 + + await client.verify_attestation(request) + + # Establish that a new wrapper was not created for this call + assert wrapper_fn.call_count == 0 + assert mock_rpc.call_count == 2 + +@pytest.mark.asyncio +async def test_verify_attestation_async(transport: str = 'grpc_asyncio', request_type=service.VerifyAttestationRequest): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport=transport, + ) + + # Everything is optional in proto3 as far as the runtime is concerned, + # and we are mocking out the actual API, so just send an empty request. + request = request_type() + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_attestation), + '__call__') as call: + # Designate an appropriate return value for the call. + call.return_value =grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyAttestationResponse( + oidc_claims_token='oidc_claims_token_value', + )) + response = await client.verify_attestation(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) + _, args, _ = call.mock_calls[0] + request = service.VerifyAttestationRequest() + assert args[0] == request + + # Establish that the response is the type that we expect. + assert isinstance(response, service.VerifyAttestationResponse) + assert response.oidc_claims_token == 'oidc_claims_token_value' + + +@pytest.mark.asyncio +async def test_verify_attestation_async_from_dict(): + await test_verify_attestation_async(request_type=dict) + +def test_verify_attestation_field_headers(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + ) + + # Any value that is part of the HTTP/1.1 URI should be sent as + # a field header. Set these to a non-empty value. + request = service.VerifyAttestationRequest() + + request.challenge = 'challenge_value' + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_attestation), + '__call__') as call: + call.return_value = service.VerifyAttestationResponse() + client.verify_attestation(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the field header was sent. + _, _, kw = call.mock_calls[0] + assert ( + 'x-goog-request-params', + 'challenge=challenge_value', + ) in kw['metadata'] + + +@pytest.mark.asyncio +async def test_verify_attestation_field_headers_async(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + ) + + # Any value that is part of the HTTP/1.1 URI should be sent as + # a field header. Set these to a non-empty value. + request = service.VerifyAttestationRequest() + + request.challenge = 'challenge_value' + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_attestation), + '__call__') as call: + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyAttestationResponse()) + await client.verify_attestation(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the field header was sent. + _, _, kw = call.mock_calls[0] + assert ( + 'x-goog-request-params', + 'challenge=challenge_value', + ) in kw['metadata'] + + +@pytest.mark.parametrize("request_type", [ + service.VerifyConfidentialSpaceRequest, + dict, +]) +def test_verify_confidential_space(request_type, transport: str = 'grpc'): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport=transport, + ) + + # Everything is optional in proto3 as far as the runtime is concerned, + # and we are mocking out the actual API, so just send an empty request. + request = request_type() + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_space), + '__call__') as call: + # Designate an appropriate return value for the call. + call.return_value = service.VerifyConfidentialSpaceResponse( + attestation_token='attestation_token_value', + ) + response = client.verify_confidential_space(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + request = service.VerifyConfidentialSpaceRequest() + assert args[0] == request + + # Establish that the response is the type that we expect. + assert isinstance(response, service.VerifyConfidentialSpaceResponse) + assert response.attestation_token == 'attestation_token_value' + + +def test_verify_confidential_space_non_empty_request_with_auto_populated_field(): + # This test is a coverage failsafe to make sure that UUID4 fields are + # automatically populated, according to AIP-4235, with non-empty requests. + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport='grpc', + ) + + # Populate all string fields in the request which are not UUID4 + # since we want to check that UUID4 are populated automatically + # if they meet the requirements of AIP 4235. + request = service.VerifyConfidentialSpaceRequest( + challenge='challenge_value', + ) + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_space), + '__call__') as call: + call.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. + client.verify_confidential_space(request=request) + call.assert_called() + _, args, _ = call.mock_calls[0] + assert args[0] == service.VerifyConfidentialSpaceRequest( + challenge='challenge_value', + ) + +def test_verify_confidential_space_use_cached_wrapped_rpc(): + # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, + # instead of constructing them on each call + with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="grpc", + ) + + # Should wrap all calls on client creation + assert wrapper_fn.call_count > 0 + wrapper_fn.reset_mock() + + # Ensure method has been cached + assert client._transport.verify_confidential_space in client._transport._wrapped_methods + + # Replace cached wrapped function with mock + mock_rpc = mock.Mock() + mock_rpc.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. + client._transport._wrapped_methods[client._transport.verify_confidential_space] = mock_rpc + request = {} + client.verify_confidential_space(request) + + # Establish that the underlying gRPC stub method was called. + assert mock_rpc.call_count == 1 + + client.verify_confidential_space(request) + + # Establish that a new wrapper was not created for this call + assert wrapper_fn.call_count == 0 + assert mock_rpc.call_count == 2 + +@pytest.mark.asyncio +async def test_verify_confidential_space_async_use_cached_wrapped_rpc(transport: str = "grpc_asyncio"): + # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, + # instead of constructing them on each call + with mock.patch("google.api_core.gapic_v1.method_async.wrap_method") as wrapper_fn: + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport=transport, + ) + + # Should wrap all calls on client creation + assert wrapper_fn.call_count > 0 + wrapper_fn.reset_mock() + + # Ensure method has been cached + assert client._client._transport.verify_confidential_space in client._client._transport._wrapped_methods + + # Replace cached wrapped function with mock + mock_rpc = mock.AsyncMock() + mock_rpc.return_value = mock.Mock() + client._client._transport._wrapped_methods[client._client._transport.verify_confidential_space] = mock_rpc + + request = {} + await client.verify_confidential_space(request) + + # Establish that the underlying gRPC stub method was called. + assert mock_rpc.call_count == 1 + + await client.verify_confidential_space(request) + + # Establish that a new wrapper was not created for this call + assert wrapper_fn.call_count == 0 + assert mock_rpc.call_count == 2 + +@pytest.mark.asyncio +async def test_verify_confidential_space_async(transport: str = 'grpc_asyncio', request_type=service.VerifyConfidentialSpaceRequest): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport=transport, + ) + + # Everything is optional in proto3 as far as the runtime is concerned, + # and we are mocking out the actual API, so just send an empty request. + request = request_type() + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_space), + '__call__') as call: + # Designate an appropriate return value for the call. + call.return_value =grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyConfidentialSpaceResponse( + attestation_token='attestation_token_value', + )) + response = await client.verify_confidential_space(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) + _, args, _ = call.mock_calls[0] + request = service.VerifyConfidentialSpaceRequest() + assert args[0] == request + + # Establish that the response is the type that we expect. + assert isinstance(response, service.VerifyConfidentialSpaceResponse) + assert response.attestation_token == 'attestation_token_value' + + +@pytest.mark.asyncio +async def test_verify_confidential_space_async_from_dict(): + await test_verify_confidential_space_async(request_type=dict) + +def test_verify_confidential_space_field_headers(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + ) + + # Any value that is part of the HTTP/1.1 URI should be sent as + # a field header. Set these to a non-empty value. + request = service.VerifyConfidentialSpaceRequest() + + request.challenge = 'challenge_value' + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_space), + '__call__') as call: + call.return_value = service.VerifyConfidentialSpaceResponse() + client.verify_confidential_space(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the field header was sent. + _, _, kw = call.mock_calls[0] + assert ( + 'x-goog-request-params', + 'challenge=challenge_value', + ) in kw['metadata'] + + +@pytest.mark.asyncio +async def test_verify_confidential_space_field_headers_async(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + ) + + # Any value that is part of the HTTP/1.1 URI should be sent as + # a field header. Set these to a non-empty value. + request = service.VerifyConfidentialSpaceRequest() + + request.challenge = 'challenge_value' + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_space), + '__call__') as call: + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyConfidentialSpaceResponse()) + await client.verify_confidential_space(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the field header was sent. + _, _, kw = call.mock_calls[0] + assert ( + 'x-goog-request-params', + 'challenge=challenge_value', + ) in kw['metadata'] + + +@pytest.mark.parametrize("request_type", [ + service.VerifyConfidentialGkeRequest, + dict, +]) +def test_verify_confidential_gke(request_type, transport: str = 'grpc'): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport=transport, + ) + + # Everything is optional in proto3 as far as the runtime is concerned, + # and we are mocking out the actual API, so just send an empty request. + request = request_type() + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_gke), + '__call__') as call: + # Designate an appropriate return value for the call. + call.return_value = service.VerifyConfidentialGkeResponse( + attestation_token='attestation_token_value', + ) + response = client.verify_confidential_gke(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + request = service.VerifyConfidentialGkeRequest() + assert args[0] == request + + # Establish that the response is the type that we expect. + assert isinstance(response, service.VerifyConfidentialGkeResponse) + assert response.attestation_token == 'attestation_token_value' + + +def test_verify_confidential_gke_non_empty_request_with_auto_populated_field(): + # This test is a coverage failsafe to make sure that UUID4 fields are + # automatically populated, according to AIP-4235, with non-empty requests. + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport='grpc', + ) + + # Populate all string fields in the request which are not UUID4 + # since we want to check that UUID4 are populated automatically + # if they meet the requirements of AIP 4235. + request = service.VerifyConfidentialGkeRequest( + challenge='challenge_value', + ) + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_gke), + '__call__') as call: + call.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. + client.verify_confidential_gke(request=request) + call.assert_called() + _, args, _ = call.mock_calls[0] + assert args[0] == service.VerifyConfidentialGkeRequest( + challenge='challenge_value', + ) + +def test_verify_confidential_gke_use_cached_wrapped_rpc(): + # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, + # instead of constructing them on each call + with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="grpc", + ) + + # Should wrap all calls on client creation + assert wrapper_fn.call_count > 0 + wrapper_fn.reset_mock() + + # Ensure method has been cached + assert client._transport.verify_confidential_gke in client._transport._wrapped_methods + + # Replace cached wrapped function with mock + mock_rpc = mock.Mock() + mock_rpc.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. + client._transport._wrapped_methods[client._transport.verify_confidential_gke] = mock_rpc + request = {} + client.verify_confidential_gke(request) + + # Establish that the underlying gRPC stub method was called. + assert mock_rpc.call_count == 1 + + client.verify_confidential_gke(request) + + # Establish that a new wrapper was not created for this call + assert wrapper_fn.call_count == 0 + assert mock_rpc.call_count == 2 + +@pytest.mark.asyncio +async def test_verify_confidential_gke_async_use_cached_wrapped_rpc(transport: str = "grpc_asyncio"): + # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, + # instead of constructing them on each call + with mock.patch("google.api_core.gapic_v1.method_async.wrap_method") as wrapper_fn: + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport=transport, + ) + + # Should wrap all calls on client creation + assert wrapper_fn.call_count > 0 + wrapper_fn.reset_mock() + + # Ensure method has been cached + assert client._client._transport.verify_confidential_gke in client._client._transport._wrapped_methods + + # Replace cached wrapped function with mock + mock_rpc = mock.AsyncMock() + mock_rpc.return_value = mock.Mock() + client._client._transport._wrapped_methods[client._client._transport.verify_confidential_gke] = mock_rpc + + request = {} + await client.verify_confidential_gke(request) + + # Establish that the underlying gRPC stub method was called. + assert mock_rpc.call_count == 1 + + await client.verify_confidential_gke(request) + + # Establish that a new wrapper was not created for this call + assert wrapper_fn.call_count == 0 + assert mock_rpc.call_count == 2 + +@pytest.mark.asyncio +async def test_verify_confidential_gke_async(transport: str = 'grpc_asyncio', request_type=service.VerifyConfidentialGkeRequest): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport=transport, + ) + + # Everything is optional in proto3 as far as the runtime is concerned, + # and we are mocking out the actual API, so just send an empty request. + request = request_type() + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_gke), + '__call__') as call: + # Designate an appropriate return value for the call. + call.return_value =grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyConfidentialGkeResponse( + attestation_token='attestation_token_value', + )) + response = await client.verify_confidential_gke(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) + _, args, _ = call.mock_calls[0] + request = service.VerifyConfidentialGkeRequest() + assert args[0] == request + + # Establish that the response is the type that we expect. + assert isinstance(response, service.VerifyConfidentialGkeResponse) + assert response.attestation_token == 'attestation_token_value' + + +@pytest.mark.asyncio +async def test_verify_confidential_gke_async_from_dict(): + await test_verify_confidential_gke_async(request_type=dict) + +def test_verify_confidential_gke_field_headers(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + ) + + # Any value that is part of the HTTP/1.1 URI should be sent as + # a field header. Set these to a non-empty value. + request = service.VerifyConfidentialGkeRequest() + + request.challenge = 'challenge_value' + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_gke), + '__call__') as call: + call.return_value = service.VerifyConfidentialGkeResponse() + client.verify_confidential_gke(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the field header was sent. + _, _, kw = call.mock_calls[0] + assert ( + 'x-goog-request-params', + 'challenge=challenge_value', + ) in kw['metadata'] + + +@pytest.mark.asyncio +async def test_verify_confidential_gke_field_headers_async(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + ) + + # Any value that is part of the HTTP/1.1 URI should be sent as + # a field header. Set these to a non-empty value. + request = service.VerifyConfidentialGkeRequest() + + request.challenge = 'challenge_value' + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_gke), + '__call__') as call: + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyConfidentialGkeResponse()) + await client.verify_confidential_gke(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the field header was sent. + _, _, kw = call.mock_calls[0] + assert ( + 'x-goog-request-params', + 'challenge=challenge_value', + ) in kw['metadata'] + + +def test_create_challenge_rest_use_cached_wrapped_rpc(): + # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, + # instead of constructing them on each call + with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", + ) + + # Should wrap all calls on client creation + assert wrapper_fn.call_count > 0 + wrapper_fn.reset_mock() + + # Ensure method has been cached + assert client._transport.create_challenge in client._transport._wrapped_methods + + # Replace cached wrapped function with mock + mock_rpc = mock.Mock() + mock_rpc.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. + client._transport._wrapped_methods[client._transport.create_challenge] = mock_rpc + + request = {} + client.create_challenge(request) + + # Establish that the underlying gRPC stub method was called. + assert mock_rpc.call_count == 1 + + client.create_challenge(request) + + # Establish that a new wrapper was not created for this call + assert wrapper_fn.call_count == 0 + assert mock_rpc.call_count == 2 + + +def test_create_challenge_rest_required_fields(request_type=service.CreateChallengeRequest): + transport_class = transports.ConfidentialComputingRestTransport + + request_init = {} + request_init["parent"] = "" + request = request_type(**request_init) + pb_request = request_type.pb(request) + jsonified_request = json.loads(json_format.MessageToJson( + pb_request, + use_integers_for_enums=False + )) + + # verify fields with default values are dropped + + unset_fields = transport_class(credentials=ga_credentials.AnonymousCredentials()).create_challenge._get_unset_required_fields(jsonified_request) + jsonified_request.update(unset_fields) + + # verify required fields with default values are now present + + jsonified_request["parent"] = 'parent_value' + + unset_fields = transport_class(credentials=ga_credentials.AnonymousCredentials()).create_challenge._get_unset_required_fields(jsonified_request) + jsonified_request.update(unset_fields) + + # verify required fields with non-default values are left alone + assert "parent" in jsonified_request + assert jsonified_request["parent"] == 'parent_value' + + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport='rest', + ) + request = request_type(**request_init) + + # Designate an appropriate value for the returned response. + return_value = service.Challenge() + # Mock the http request call within the method and fake a response. + with mock.patch.object(Session, 'request') as req: + # We need to mock transcode() because providing default values + # for required fields will fail the real version if the http_options + # expect actual values for those fields. + with mock.patch.object(path_template, 'transcode') as transcode: + # A uri without fields and an empty body will force all the + # request fields to show up in the query_params. + pb_request = request_type.pb(request) + transcode_result = { + 'uri': 'v1/sample_method', + 'method': "post", + 'query_params': pb_request, + } + transcode_result['body'] = pb_request + transcode.return_value = transcode_result + + response_value = Response() + response_value.status_code = 200 + + # Convert return value to protobuf type + return_value = service.Challenge.pb(return_value) + json_return_value = json_format.MessageToJson(return_value) + + response_value._content = json_return_value.encode('UTF-8') + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + + response = client.create_challenge(request) + + expected_params = [ + ('$alt', 'json;enum-encoding=int') + ] + actual_params = req.call_args.kwargs['params'] + assert expected_params == actual_params + + +def test_create_challenge_rest_unset_required_fields(): + transport = transports.ConfidentialComputingRestTransport(credentials=ga_credentials.AnonymousCredentials) + + unset_fields = transport.create_challenge._get_unset_required_fields({}) + assert set(unset_fields) == (set(()) & set(("parent", "challenge", ))) + + +def test_create_challenge_rest_flattened(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", + ) + + # Mock the http request call within the method and fake a response. + with mock.patch.object(type(client.transport._session), 'request') as req: + # Designate an appropriate value for the returned response. + return_value = service.Challenge() + + # get arguments that satisfy an http rule for this method + sample_request = {'parent': 'projects/sample1/locations/sample2'} + + # get truthy value for each flattened field + mock_args = dict( + parent='parent_value', + challenge=service.Challenge(name='name_value'), + ) + mock_args.update(sample_request) + + # Wrap the value into a proper Response obj + response_value = Response() + response_value.status_code = 200 + # Convert return value to protobuf type + return_value = service.Challenge.pb(return_value) + json_return_value = json_format.MessageToJson(return_value) + response_value._content = json_return_value.encode('UTF-8') + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + + client.create_challenge(**mock_args) + + # Establish that the underlying call was made with the expected + # request object values. + assert len(req.mock_calls) == 1 + _, args, _ = req.mock_calls[0] + assert path_template.validate("%s/v1/{parent=projects/*/locations/*}/challenges" % client.transport._host, args[1]) + + +def test_create_challenge_rest_flattened_error(transport: str = 'rest'): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport=transport, + ) + + # Attempting to call a method with both a request object and flattened + # fields is an error. + with pytest.raises(ValueError): + client.create_challenge( + service.CreateChallengeRequest(), + parent='parent_value', + challenge=service.Challenge(name='name_value'), + ) + + +def test_verify_attestation_rest_use_cached_wrapped_rpc(): + # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, + # instead of constructing them on each call + with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", + ) + + # Should wrap all calls on client creation + assert wrapper_fn.call_count > 0 + wrapper_fn.reset_mock() + + # Ensure method has been cached + assert client._transport.verify_attestation in client._transport._wrapped_methods + + # Replace cached wrapped function with mock + mock_rpc = mock.Mock() + mock_rpc.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. + client._transport._wrapped_methods[client._transport.verify_attestation] = mock_rpc + + request = {} + client.verify_attestation(request) + + # Establish that the underlying gRPC stub method was called. + assert mock_rpc.call_count == 1 + + client.verify_attestation(request) + + # Establish that a new wrapper was not created for this call + assert wrapper_fn.call_count == 0 + assert mock_rpc.call_count == 2 + + +def test_verify_attestation_rest_required_fields(request_type=service.VerifyAttestationRequest): + transport_class = transports.ConfidentialComputingRestTransport + + request_init = {} + request_init["challenge"] = "" + request = request_type(**request_init) + pb_request = request_type.pb(request) + jsonified_request = json.loads(json_format.MessageToJson( + pb_request, + use_integers_for_enums=False + )) + + # verify fields with default values are dropped + + unset_fields = transport_class(credentials=ga_credentials.AnonymousCredentials()).verify_attestation._get_unset_required_fields(jsonified_request) + jsonified_request.update(unset_fields) + + # verify required fields with default values are now present + + jsonified_request["challenge"] = 'challenge_value' + + unset_fields = transport_class(credentials=ga_credentials.AnonymousCredentials()).verify_attestation._get_unset_required_fields(jsonified_request) + jsonified_request.update(unset_fields) + + # verify required fields with non-default values are left alone + assert "challenge" in jsonified_request + assert jsonified_request["challenge"] == 'challenge_value' + + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport='rest', + ) + request = request_type(**request_init) + + # Designate an appropriate value for the returned response. + return_value = service.VerifyAttestationResponse() + # Mock the http request call within the method and fake a response. + with mock.patch.object(Session, 'request') as req: + # We need to mock transcode() because providing default values + # for required fields will fail the real version if the http_options + # expect actual values for those fields. + with mock.patch.object(path_template, 'transcode') as transcode: + # A uri without fields and an empty body will force all the + # request fields to show up in the query_params. + pb_request = request_type.pb(request) + transcode_result = { + 'uri': 'v1/sample_method', + 'method': "post", + 'query_params': pb_request, + } + transcode_result['body'] = pb_request + transcode.return_value = transcode_result + + response_value = Response() + response_value.status_code = 200 + + # Convert return value to protobuf type + return_value = service.VerifyAttestationResponse.pb(return_value) + json_return_value = json_format.MessageToJson(return_value) + + response_value._content = json_return_value.encode('UTF-8') + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + + response = client.verify_attestation(request) + + expected_params = [ + ('$alt', 'json;enum-encoding=int') + ] + actual_params = req.call_args.kwargs['params'] + assert expected_params == actual_params + + +def test_verify_attestation_rest_unset_required_fields(): + transport = transports.ConfidentialComputingRestTransport(credentials=ga_credentials.AnonymousCredentials) + + unset_fields = transport.verify_attestation._get_unset_required_fields({}) + assert set(unset_fields) == (set(()) & set(("challenge", "tpmAttestation", ))) + + +def test_verify_confidential_space_rest_use_cached_wrapped_rpc(): + # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, + # instead of constructing them on each call + with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", + ) + + # Should wrap all calls on client creation + assert wrapper_fn.call_count > 0 + wrapper_fn.reset_mock() + + # Ensure method has been cached + assert client._transport.verify_confidential_space in client._transport._wrapped_methods + + # Replace cached wrapped function with mock + mock_rpc = mock.Mock() + mock_rpc.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. + client._transport._wrapped_methods[client._transport.verify_confidential_space] = mock_rpc + + request = {} + client.verify_confidential_space(request) + + # Establish that the underlying gRPC stub method was called. + assert mock_rpc.call_count == 1 + + client.verify_confidential_space(request) + + # Establish that a new wrapper was not created for this call + assert wrapper_fn.call_count == 0 + assert mock_rpc.call_count == 2 + + +def test_verify_confidential_space_rest_required_fields(request_type=service.VerifyConfidentialSpaceRequest): + transport_class = transports.ConfidentialComputingRestTransport + + request_init = {} + request_init["challenge"] = "" + request = request_type(**request_init) + pb_request = request_type.pb(request) + jsonified_request = json.loads(json_format.MessageToJson( + pb_request, + use_integers_for_enums=False + )) + + # verify fields with default values are dropped + + unset_fields = transport_class(credentials=ga_credentials.AnonymousCredentials()).verify_confidential_space._get_unset_required_fields(jsonified_request) + jsonified_request.update(unset_fields) + + # verify required fields with default values are now present + + jsonified_request["challenge"] = 'challenge_value' + + unset_fields = transport_class(credentials=ga_credentials.AnonymousCredentials()).verify_confidential_space._get_unset_required_fields(jsonified_request) + jsonified_request.update(unset_fields) + + # verify required fields with non-default values are left alone + assert "challenge" in jsonified_request + assert jsonified_request["challenge"] == 'challenge_value' + + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport='rest', + ) + request = request_type(**request_init) + + # Designate an appropriate value for the returned response. + return_value = service.VerifyConfidentialSpaceResponse() + # Mock the http request call within the method and fake a response. + with mock.patch.object(Session, 'request') as req: + # We need to mock transcode() because providing default values + # for required fields will fail the real version if the http_options + # expect actual values for those fields. + with mock.patch.object(path_template, 'transcode') as transcode: + # A uri without fields and an empty body will force all the + # request fields to show up in the query_params. + pb_request = request_type.pb(request) + transcode_result = { + 'uri': 'v1/sample_method', + 'method': "post", + 'query_params': pb_request, + } + transcode_result['body'] = pb_request + transcode.return_value = transcode_result + + response_value = Response() + response_value.status_code = 200 + + # Convert return value to protobuf type + return_value = service.VerifyConfidentialSpaceResponse.pb(return_value) + json_return_value = json_format.MessageToJson(return_value) + + response_value._content = json_return_value.encode('UTF-8') + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + + response = client.verify_confidential_space(request) + + expected_params = [ + ('$alt', 'json;enum-encoding=int') + ] + actual_params = req.call_args.kwargs['params'] + assert expected_params == actual_params + + +def test_verify_confidential_space_rest_unset_required_fields(): + transport = transports.ConfidentialComputingRestTransport(credentials=ga_credentials.AnonymousCredentials) + + unset_fields = transport.verify_confidential_space._get_unset_required_fields({}) + assert set(unset_fields) == (set(()) & set(("challenge", ))) + + +def test_verify_confidential_gke_rest_use_cached_wrapped_rpc(): + # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, + # instead of constructing them on each call + with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", + ) + + # Should wrap all calls on client creation + assert wrapper_fn.call_count > 0 + wrapper_fn.reset_mock() + + # Ensure method has been cached + assert client._transport.verify_confidential_gke in client._transport._wrapped_methods + + # Replace cached wrapped function with mock + mock_rpc = mock.Mock() + mock_rpc.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. + client._transport._wrapped_methods[client._transport.verify_confidential_gke] = mock_rpc + + request = {} + client.verify_confidential_gke(request) + + # Establish that the underlying gRPC stub method was called. + assert mock_rpc.call_count == 1 + + client.verify_confidential_gke(request) + + # Establish that a new wrapper was not created for this call + assert wrapper_fn.call_count == 0 + assert mock_rpc.call_count == 2 + + +def test_verify_confidential_gke_rest_required_fields(request_type=service.VerifyConfidentialGkeRequest): + transport_class = transports.ConfidentialComputingRestTransport + + request_init = {} + request_init["challenge"] = "" + request = request_type(**request_init) + pb_request = request_type.pb(request) + jsonified_request = json.loads(json_format.MessageToJson( + pb_request, + use_integers_for_enums=False + )) + + # verify fields with default values are dropped + + unset_fields = transport_class(credentials=ga_credentials.AnonymousCredentials()).verify_confidential_gke._get_unset_required_fields(jsonified_request) + jsonified_request.update(unset_fields) + + # verify required fields with default values are now present + + jsonified_request["challenge"] = 'challenge_value' + + unset_fields = transport_class(credentials=ga_credentials.AnonymousCredentials()).verify_confidential_gke._get_unset_required_fields(jsonified_request) + jsonified_request.update(unset_fields) + + # verify required fields with non-default values are left alone + assert "challenge" in jsonified_request + assert jsonified_request["challenge"] == 'challenge_value' + + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport='rest', + ) + request = request_type(**request_init) + + # Designate an appropriate value for the returned response. + return_value = service.VerifyConfidentialGkeResponse() + # Mock the http request call within the method and fake a response. + with mock.patch.object(Session, 'request') as req: + # We need to mock transcode() because providing default values + # for required fields will fail the real version if the http_options + # expect actual values for those fields. + with mock.patch.object(path_template, 'transcode') as transcode: + # A uri without fields and an empty body will force all the + # request fields to show up in the query_params. + pb_request = request_type.pb(request) + transcode_result = { + 'uri': 'v1/sample_method', + 'method': "post", + 'query_params': pb_request, + } + transcode_result['body'] = pb_request + transcode.return_value = transcode_result + + response_value = Response() + response_value.status_code = 200 + + # Convert return value to protobuf type + return_value = service.VerifyConfidentialGkeResponse.pb(return_value) + json_return_value = json_format.MessageToJson(return_value) + + response_value._content = json_return_value.encode('UTF-8') + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + + response = client.verify_confidential_gke(request) + + expected_params = [ + ('$alt', 'json;enum-encoding=int') + ] + actual_params = req.call_args.kwargs['params'] + assert expected_params == actual_params + + +def test_verify_confidential_gke_rest_unset_required_fields(): + transport = transports.ConfidentialComputingRestTransport(credentials=ga_credentials.AnonymousCredentials) + + unset_fields = transport.verify_confidential_gke._get_unset_required_fields({}) + assert set(unset_fields) == (set(()) & set(("challenge", ))) + + +def test_credentials_transport_error(): + # It is an error to provide credentials and a transport instance. + transport = transports.ConfidentialComputingGrpcTransport( + credentials=ga_credentials.AnonymousCredentials(), + ) + with pytest.raises(ValueError): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport=transport, + ) + + # It is an error to provide a credentials file and a transport instance. + transport = transports.ConfidentialComputingGrpcTransport( + credentials=ga_credentials.AnonymousCredentials(), + ) + with pytest.raises(ValueError): + client = ConfidentialComputingClient( + client_options={"credentials_file": "credentials.json"}, + transport=transport, + ) + + # It is an error to provide an api_key and a transport instance. + transport = transports.ConfidentialComputingGrpcTransport( + credentials=ga_credentials.AnonymousCredentials(), + ) + options = client_options.ClientOptions() + options.api_key = "api_key" + with pytest.raises(ValueError): + client = ConfidentialComputingClient( + client_options=options, + transport=transport, + ) + + # It is an error to provide an api_key and a credential. + options = client_options.ClientOptions() + options.api_key = "api_key" + with pytest.raises(ValueError): + client = ConfidentialComputingClient( + client_options=options, + credentials=ga_credentials.AnonymousCredentials() + ) + + # It is an error to provide scopes and a transport instance. + transport = transports.ConfidentialComputingGrpcTransport( + credentials=ga_credentials.AnonymousCredentials(), + ) + with pytest.raises(ValueError): + client = ConfidentialComputingClient( + client_options={"scopes": ["1", "2"]}, + transport=transport, + ) + + +def test_transport_instance(): + # A client may be instantiated with a custom transport instance. + transport = transports.ConfidentialComputingGrpcTransport( + credentials=ga_credentials.AnonymousCredentials(), + ) + client = ConfidentialComputingClient(transport=transport) + assert client.transport is transport + +def test_transport_get_channel(): + # A client may be instantiated with a custom transport instance. + transport = transports.ConfidentialComputingGrpcTransport( + credentials=ga_credentials.AnonymousCredentials(), + ) + channel = transport.grpc_channel + assert channel + + transport = transports.ConfidentialComputingGrpcAsyncIOTransport( + credentials=ga_credentials.AnonymousCredentials(), + ) + channel = transport.grpc_channel + assert channel + +@pytest.mark.parametrize("transport_class", [ + transports.ConfidentialComputingGrpcTransport, + transports.ConfidentialComputingGrpcAsyncIOTransport, + transports.ConfidentialComputingRestTransport, +]) +def test_transport_adc(transport_class): + # Test default credentials are used if not provided. + with mock.patch.object(google.auth, 'default') as adc: + adc.return_value = (ga_credentials.AnonymousCredentials(), None) + transport_class() + adc.assert_called_once() + +def test_transport_kind_grpc(): + transport = ConfidentialComputingClient.get_transport_class("grpc")( + credentials=ga_credentials.AnonymousCredentials() + ) + assert transport.kind == "grpc" + + +def test_initialize_client_w_grpc(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="grpc" + ) + assert client is not None + + +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +def test_create_challenge_empty_call_grpc(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="grpc", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object( + type(client.transport.create_challenge), + '__call__') as call: + call.return_value = service.Challenge() + client.create_challenge(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.CreateChallengeRequest() + + assert args[0] == request_msg + + +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +def test_verify_attestation_empty_call_grpc(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="grpc", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object( + type(client.transport.verify_attestation), + '__call__') as call: + call.return_value = service.VerifyAttestationResponse() + client.verify_attestation(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.VerifyAttestationRequest() + + assert args[0] == request_msg + + +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +def test_verify_confidential_space_empty_call_grpc(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="grpc", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_space), + '__call__') as call: + call.return_value = service.VerifyConfidentialSpaceResponse() + client.verify_confidential_space(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.VerifyConfidentialSpaceRequest() + + assert args[0] == request_msg + + +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +def test_verify_confidential_gke_empty_call_grpc(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="grpc", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_gke), + '__call__') as call: + call.return_value = service.VerifyConfidentialGkeResponse() + client.verify_confidential_gke(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.VerifyConfidentialGkeRequest() + + assert args[0] == request_msg + + +def test_transport_kind_grpc_asyncio(): + transport = ConfidentialComputingAsyncClient.get_transport_class("grpc_asyncio")( + credentials=async_anonymous_credentials() + ) + assert transport.kind == "grpc_asyncio" + + +def test_initialize_client_w_grpc_asyncio(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport="grpc_asyncio" + ) + assert client is not None + + +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +@pytest.mark.asyncio +async def test_create_challenge_empty_call_grpc_asyncio(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport="grpc_asyncio", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object( + type(client.transport.create_challenge), + '__call__') as call: + # Designate an appropriate return value for the call. + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.Challenge( + name='name_value', + used=True, + tpm_nonce='tpm_nonce_value', + )) + await client.create_challenge(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.CreateChallengeRequest() + + assert args[0] == request_msg + + +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +@pytest.mark.asyncio +async def test_verify_attestation_empty_call_grpc_asyncio(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport="grpc_asyncio", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object( + type(client.transport.verify_attestation), + '__call__') as call: + # Designate an appropriate return value for the call. + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyAttestationResponse( + oidc_claims_token='oidc_claims_token_value', + )) + await client.verify_attestation(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.VerifyAttestationRequest() + + assert args[0] == request_msg + + +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +@pytest.mark.asyncio +async def test_verify_confidential_space_empty_call_grpc_asyncio(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport="grpc_asyncio", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_space), + '__call__') as call: + # Designate an appropriate return value for the call. + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyConfidentialSpaceResponse( + attestation_token='attestation_token_value', + )) + await client.verify_confidential_space(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.VerifyConfidentialSpaceRequest() + + assert args[0] == request_msg + + +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +@pytest.mark.asyncio +async def test_verify_confidential_gke_empty_call_grpc_asyncio(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport="grpc_asyncio", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_gke), + '__call__') as call: + # Designate an appropriate return value for the call. + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyConfidentialGkeResponse( + attestation_token='attestation_token_value', + )) + await client.verify_confidential_gke(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.VerifyConfidentialGkeRequest() + + assert args[0] == request_msg + + +def test_transport_kind_rest(): + transport = ConfidentialComputingClient.get_transport_class("rest")( + credentials=ga_credentials.AnonymousCredentials() + ) + assert transport.kind == "rest" + + +def test_create_challenge_rest_bad_request(request_type=service.CreateChallengeRequest): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest" + ) + # send a request that will satisfy transcoding + request_init = {'parent': 'projects/sample1/locations/sample2'} + request = request_type(**request_init) + + # Mock the http request call within the method and fake a BadRequest error. + with mock.patch.object(Session, 'request') as req, pytest.raises(core_exceptions.BadRequest): + # Wrap the value into a proper Response obj + response_value = mock.Mock() + json_return_value = '' + response_value.json = mock.Mock(return_value={}) + response_value.status_code = 400 + response_value.request = mock.Mock() + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + client.create_challenge(request) + + +@pytest.mark.parametrize("request_type", [ + service.CreateChallengeRequest, + dict, +]) +def test_create_challenge_rest_call_success(request_type): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest" + ) + + # send a request that will satisfy transcoding + request_init = {'parent': 'projects/sample1/locations/sample2'} + request_init["challenge"] = {'name': 'name_value', 'create_time': {'seconds': 751, 'nanos': 543}, 'expire_time': {}, 'used': True, 'tpm_nonce': 'tpm_nonce_value'} + # The version of a generated dependency at test runtime may differ from the version used during generation. + # Delete any fields which are not present in the current runtime dependency + # See https://github.com/googleapis/gapic-generator-python/issues/1748 + + # Determine if the message type is proto-plus or protobuf + test_field = service.CreateChallengeRequest.meta.fields["challenge"] + + def get_message_fields(field): + # Given a field which is a message (composite type), return a list with + # all the fields of the message. + # If the field is not a composite type, return an empty list. + message_fields = [] + + if hasattr(field, "message") and field.message: + is_field_type_proto_plus_type = not hasattr(field.message, "DESCRIPTOR") + + if is_field_type_proto_plus_type: + message_fields = field.message.meta.fields.values() + # Add `# pragma: NO COVER` because there may not be any `*_pb2` field types + else: # pragma: NO COVER + message_fields = field.message.DESCRIPTOR.fields + return message_fields + + runtime_nested_fields = [ + (field.name, nested_field.name) + for field in get_message_fields(test_field) + for nested_field in get_message_fields(field) + ] + + subfields_not_in_runtime = [] + + # For each item in the sample request, create a list of sub fields which are not present at runtime + # Add `# pragma: NO COVER` because this test code will not run if all subfields are present at runtime + for field, value in request_init["challenge"].items(): # pragma: NO COVER + result = None + is_repeated = False + # For repeated fields + if isinstance(value, list) and len(value): + is_repeated = True + result = value[0] + # For fields where the type is another message + if isinstance(value, dict): + result = value + + if result and hasattr(result, "keys"): + for subfield in result.keys(): + if (field, subfield) not in runtime_nested_fields: + subfields_not_in_runtime.append( + {"field": field, "subfield": subfield, "is_repeated": is_repeated} + ) + + # Remove fields from the sample request which are not present in the runtime version of the dependency + # Add `# pragma: NO COVER` because this test code will not run if all subfields are present at runtime + for subfield_to_delete in subfields_not_in_runtime: # pragma: NO COVER + field = subfield_to_delete.get("field") + field_repeated = subfield_to_delete.get("is_repeated") + subfield = subfield_to_delete.get("subfield") + if subfield: + if field_repeated: + for i in range(0, len(request_init["challenge"][field])): + del request_init["challenge"][field][i][subfield] + else: + del request_init["challenge"][field][subfield] + request = request_type(**request_init) + + # Mock the http request call within the method and fake a response. + with mock.patch.object(type(client.transport._session), 'request') as req: + # Designate an appropriate value for the returned response. + return_value = service.Challenge( + name='name_value', + used=True, + tpm_nonce='tpm_nonce_value', + ) + + # Wrap the value into a proper Response obj + response_value = mock.Mock() + response_value.status_code = 200 + + # Convert return value to protobuf type + return_value = service.Challenge.pb(return_value) + json_return_value = json_format.MessageToJson(return_value) + response_value.content = json_return_value.encode('UTF-8') + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + response = client.create_challenge(request) + + # Establish that the response is the type that we expect. + assert isinstance(response, service.Challenge) + assert response.name == 'name_value' + assert response.used is True + assert response.tpm_nonce == 'tpm_nonce_value' + + +@pytest.mark.parametrize("null_interceptor", [True, False]) +def test_create_challenge_rest_interceptors(null_interceptor): + transport = transports.ConfidentialComputingRestTransport( + credentials=ga_credentials.AnonymousCredentials(), + interceptor=None if null_interceptor else transports.ConfidentialComputingRestInterceptor(), + ) + client = ConfidentialComputingClient(transport=transport) + + with mock.patch.object(type(client.transport._session), "request") as req, \ + mock.patch.object(path_template, "transcode") as transcode, \ + mock.patch.object(transports.ConfidentialComputingRestInterceptor, "post_create_challenge") as post, \ + mock.patch.object(transports.ConfidentialComputingRestInterceptor, "post_create_challenge_with_metadata") as post_with_metadata, \ + mock.patch.object(transports.ConfidentialComputingRestInterceptor, "pre_create_challenge") as pre: + pre.assert_not_called() + post.assert_not_called() + post_with_metadata.assert_not_called() + pb_message = service.CreateChallengeRequest.pb(service.CreateChallengeRequest()) + transcode.return_value = { + "method": "post", + "uri": "my_uri", + "body": pb_message, + "query_params": pb_message, + } + + req.return_value = mock.Mock() + req.return_value.status_code = 200 + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + return_value = service.Challenge.to_json(service.Challenge()) + req.return_value.content = return_value + + request = service.CreateChallengeRequest() + metadata =[ + ("key", "val"), + ("cephalopod", "squid"), + ] + pre.return_value = request, metadata + post.return_value = service.Challenge() + post_with_metadata.return_value = service.Challenge(), metadata + + client.create_challenge(request, metadata=[("key", "val"), ("cephalopod", "squid"),]) + + pre.assert_called_once() + post.assert_called_once() + post_with_metadata.assert_called_once() + + +def test_verify_attestation_rest_bad_request(request_type=service.VerifyAttestationRequest): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest" + ) + # send a request that will satisfy transcoding + request_init = {'challenge': 'projects/sample1/locations/sample2/challenges/sample3'} + request = request_type(**request_init) + + # Mock the http request call within the method and fake a BadRequest error. + with mock.patch.object(Session, 'request') as req, pytest.raises(core_exceptions.BadRequest): + # Wrap the value into a proper Response obj + response_value = mock.Mock() + json_return_value = '' + response_value.json = mock.Mock(return_value={}) + response_value.status_code = 400 + response_value.request = mock.Mock() + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + client.verify_attestation(request) + + +@pytest.mark.parametrize("request_type", [ + service.VerifyAttestationRequest, + dict, +]) +def test_verify_attestation_rest_call_success(request_type): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest" + ) + + # send a request that will satisfy transcoding + request_init = {'challenge': 'projects/sample1/locations/sample2/challenges/sample3'} + request = request_type(**request_init) + + # Mock the http request call within the method and fake a response. + with mock.patch.object(type(client.transport._session), 'request') as req: + # Designate an appropriate value for the returned response. + return_value = service.VerifyAttestationResponse( + oidc_claims_token='oidc_claims_token_value', + ) + + # Wrap the value into a proper Response obj + response_value = mock.Mock() + response_value.status_code = 200 + + # Convert return value to protobuf type + return_value = service.VerifyAttestationResponse.pb(return_value) + json_return_value = json_format.MessageToJson(return_value) + response_value.content = json_return_value.encode('UTF-8') + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + response = client.verify_attestation(request) + + # Establish that the response is the type that we expect. + assert isinstance(response, service.VerifyAttestationResponse) + assert response.oidc_claims_token == 'oidc_claims_token_value' + + +@pytest.mark.parametrize("null_interceptor", [True, False]) +def test_verify_attestation_rest_interceptors(null_interceptor): + transport = transports.ConfidentialComputingRestTransport( + credentials=ga_credentials.AnonymousCredentials(), + interceptor=None if null_interceptor else transports.ConfidentialComputingRestInterceptor(), + ) + client = ConfidentialComputingClient(transport=transport) + + with mock.patch.object(type(client.transport._session), "request") as req, \ + mock.patch.object(path_template, "transcode") as transcode, \ + mock.patch.object(transports.ConfidentialComputingRestInterceptor, "post_verify_attestation") as post, \ + mock.patch.object(transports.ConfidentialComputingRestInterceptor, "post_verify_attestation_with_metadata") as post_with_metadata, \ + mock.patch.object(transports.ConfidentialComputingRestInterceptor, "pre_verify_attestation") as pre: + pre.assert_not_called() + post.assert_not_called() + post_with_metadata.assert_not_called() + pb_message = service.VerifyAttestationRequest.pb(service.VerifyAttestationRequest()) + transcode.return_value = { + "method": "post", + "uri": "my_uri", + "body": pb_message, + "query_params": pb_message, + } + + req.return_value = mock.Mock() + req.return_value.status_code = 200 + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + return_value = service.VerifyAttestationResponse.to_json(service.VerifyAttestationResponse()) + req.return_value.content = return_value + + request = service.VerifyAttestationRequest() + metadata =[ + ("key", "val"), + ("cephalopod", "squid"), + ] + pre.return_value = request, metadata + post.return_value = service.VerifyAttestationResponse() + post_with_metadata.return_value = service.VerifyAttestationResponse(), metadata + + client.verify_attestation(request, metadata=[("key", "val"), ("cephalopod", "squid"),]) + + pre.assert_called_once() + post.assert_called_once() + post_with_metadata.assert_called_once() + + +def test_verify_confidential_space_rest_bad_request(request_type=service.VerifyConfidentialSpaceRequest): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest" + ) + # send a request that will satisfy transcoding + request_init = {'challenge': 'projects/sample1/locations/sample2/challenges/sample3'} + request = request_type(**request_init) + + # Mock the http request call within the method and fake a BadRequest error. + with mock.patch.object(Session, 'request') as req, pytest.raises(core_exceptions.BadRequest): + # Wrap the value into a proper Response obj + response_value = mock.Mock() + json_return_value = '' + response_value.json = mock.Mock(return_value={}) + response_value.status_code = 400 + response_value.request = mock.Mock() + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + client.verify_confidential_space(request) + + +@pytest.mark.parametrize("request_type", [ + service.VerifyConfidentialSpaceRequest, + dict, +]) +def test_verify_confidential_space_rest_call_success(request_type): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest" + ) + + # send a request that will satisfy transcoding + request_init = {'challenge': 'projects/sample1/locations/sample2/challenges/sample3'} + request = request_type(**request_init) + + # Mock the http request call within the method and fake a response. + with mock.patch.object(type(client.transport._session), 'request') as req: + # Designate an appropriate value for the returned response. + return_value = service.VerifyConfidentialSpaceResponse( + attestation_token='attestation_token_value', + ) + + # Wrap the value into a proper Response obj + response_value = mock.Mock() + response_value.status_code = 200 + + # Convert return value to protobuf type + return_value = service.VerifyConfidentialSpaceResponse.pb(return_value) + json_return_value = json_format.MessageToJson(return_value) + response_value.content = json_return_value.encode('UTF-8') + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + response = client.verify_confidential_space(request) + + # Establish that the response is the type that we expect. + assert isinstance(response, service.VerifyConfidentialSpaceResponse) + assert response.attestation_token == 'attestation_token_value' + + +@pytest.mark.parametrize("null_interceptor", [True, False]) +def test_verify_confidential_space_rest_interceptors(null_interceptor): + transport = transports.ConfidentialComputingRestTransport( + credentials=ga_credentials.AnonymousCredentials(), + interceptor=None if null_interceptor else transports.ConfidentialComputingRestInterceptor(), + ) + client = ConfidentialComputingClient(transport=transport) + + with mock.patch.object(type(client.transport._session), "request") as req, \ + mock.patch.object(path_template, "transcode") as transcode, \ + mock.patch.object(transports.ConfidentialComputingRestInterceptor, "post_verify_confidential_space") as post, \ + mock.patch.object(transports.ConfidentialComputingRestInterceptor, "post_verify_confidential_space_with_metadata") as post_with_metadata, \ + mock.patch.object(transports.ConfidentialComputingRestInterceptor, "pre_verify_confidential_space") as pre: + pre.assert_not_called() + post.assert_not_called() + post_with_metadata.assert_not_called() + pb_message = service.VerifyConfidentialSpaceRequest.pb(service.VerifyConfidentialSpaceRequest()) + transcode.return_value = { + "method": "post", + "uri": "my_uri", + "body": pb_message, + "query_params": pb_message, + } + + req.return_value = mock.Mock() + req.return_value.status_code = 200 + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + return_value = service.VerifyConfidentialSpaceResponse.to_json(service.VerifyConfidentialSpaceResponse()) + req.return_value.content = return_value + + request = service.VerifyConfidentialSpaceRequest() + metadata =[ + ("key", "val"), + ("cephalopod", "squid"), + ] + pre.return_value = request, metadata + post.return_value = service.VerifyConfidentialSpaceResponse() + post_with_metadata.return_value = service.VerifyConfidentialSpaceResponse(), metadata + + client.verify_confidential_space(request, metadata=[("key", "val"), ("cephalopod", "squid"),]) + + pre.assert_called_once() + post.assert_called_once() + post_with_metadata.assert_called_once() + + +def test_verify_confidential_gke_rest_bad_request(request_type=service.VerifyConfidentialGkeRequest): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest" + ) + # send a request that will satisfy transcoding + request_init = {'challenge': 'projects/sample1/locations/sample2/challenges/sample3'} + request = request_type(**request_init) + + # Mock the http request call within the method and fake a BadRequest error. + with mock.patch.object(Session, 'request') as req, pytest.raises(core_exceptions.BadRequest): + # Wrap the value into a proper Response obj + response_value = mock.Mock() + json_return_value = '' + response_value.json = mock.Mock(return_value={}) + response_value.status_code = 400 + response_value.request = mock.Mock() + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + client.verify_confidential_gke(request) + + +@pytest.mark.parametrize("request_type", [ + service.VerifyConfidentialGkeRequest, + dict, +]) +def test_verify_confidential_gke_rest_call_success(request_type): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest" + ) + + # send a request that will satisfy transcoding + request_init = {'challenge': 'projects/sample1/locations/sample2/challenges/sample3'} + request = request_type(**request_init) + + # Mock the http request call within the method and fake a response. + with mock.patch.object(type(client.transport._session), 'request') as req: + # Designate an appropriate value for the returned response. + return_value = service.VerifyConfidentialGkeResponse( + attestation_token='attestation_token_value', + ) + + # Wrap the value into a proper Response obj + response_value = mock.Mock() + response_value.status_code = 200 + + # Convert return value to protobuf type + return_value = service.VerifyConfidentialGkeResponse.pb(return_value) + json_return_value = json_format.MessageToJson(return_value) + response_value.content = json_return_value.encode('UTF-8') + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + response = client.verify_confidential_gke(request) + + # Establish that the response is the type that we expect. + assert isinstance(response, service.VerifyConfidentialGkeResponse) + assert response.attestation_token == 'attestation_token_value' + + +@pytest.mark.parametrize("null_interceptor", [True, False]) +def test_verify_confidential_gke_rest_interceptors(null_interceptor): + transport = transports.ConfidentialComputingRestTransport( + credentials=ga_credentials.AnonymousCredentials(), + interceptor=None if null_interceptor else transports.ConfidentialComputingRestInterceptor(), + ) + client = ConfidentialComputingClient(transport=transport) + + with mock.patch.object(type(client.transport._session), "request") as req, \ + mock.patch.object(path_template, "transcode") as transcode, \ + mock.patch.object(transports.ConfidentialComputingRestInterceptor, "post_verify_confidential_gke") as post, \ + mock.patch.object(transports.ConfidentialComputingRestInterceptor, "post_verify_confidential_gke_with_metadata") as post_with_metadata, \ + mock.patch.object(transports.ConfidentialComputingRestInterceptor, "pre_verify_confidential_gke") as pre: + pre.assert_not_called() + post.assert_not_called() + post_with_metadata.assert_not_called() + pb_message = service.VerifyConfidentialGkeRequest.pb(service.VerifyConfidentialGkeRequest()) + transcode.return_value = { + "method": "post", + "uri": "my_uri", + "body": pb_message, + "query_params": pb_message, + } + + req.return_value = mock.Mock() + req.return_value.status_code = 200 + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + return_value = service.VerifyConfidentialGkeResponse.to_json(service.VerifyConfidentialGkeResponse()) + req.return_value.content = return_value + + request = service.VerifyConfidentialGkeRequest() + metadata =[ + ("key", "val"), + ("cephalopod", "squid"), + ] + pre.return_value = request, metadata + post.return_value = service.VerifyConfidentialGkeResponse() + post_with_metadata.return_value = service.VerifyConfidentialGkeResponse(), metadata + + client.verify_confidential_gke(request, metadata=[("key", "val"), ("cephalopod", "squid"),]) + + pre.assert_called_once() + post.assert_called_once() + post_with_metadata.assert_called_once() + + +def test_get_location_rest_bad_request(request_type=locations_pb2.GetLocationRequest): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", + ) + request = request_type() + request = json_format.ParseDict({'name': 'projects/sample1/locations/sample2'}, request) + + # Mock the http request call within the method and fake a BadRequest error. + with mock.patch.object(Session, 'request') as req, pytest.raises(core_exceptions.BadRequest): + # Wrap the value into a proper Response obj + response_value = Response() + json_return_value = '' + response_value.json = mock.Mock(return_value={}) + response_value.status_code = 400 + response_value.request = Request() + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + client.get_location(request) + + +@pytest.mark.parametrize("request_type", [ + locations_pb2.GetLocationRequest, + dict, +]) +def test_get_location_rest(request_type): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", + ) + + request_init = {'name': 'projects/sample1/locations/sample2'} + request = request_type(**request_init) + # Mock the http request call within the method and fake a response. + with mock.patch.object(Session, 'request') as req: + # Designate an appropriate value for the returned response. + return_value = locations_pb2.Location() + + # Wrap the value into a proper Response obj + response_value = mock.Mock() + response_value.status_code = 200 + json_return_value = json_format.MessageToJson(return_value) + response_value.content = json_return_value.encode('UTF-8') + + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + + response = client.get_location(request) + + # Establish that the response is the type that we expect. + assert isinstance(response, locations_pb2.Location) + + +def test_list_locations_rest_bad_request(request_type=locations_pb2.ListLocationsRequest): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", + ) + request = request_type() + request = json_format.ParseDict({'name': 'projects/sample1'}, request) + + # Mock the http request call within the method and fake a BadRequest error. + with mock.patch.object(Session, 'request') as req, pytest.raises(core_exceptions.BadRequest): + # Wrap the value into a proper Response obj + response_value = Response() + json_return_value = '' + response_value.json = mock.Mock(return_value={}) + response_value.status_code = 400 + response_value.request = Request() + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + client.list_locations(request) + + +@pytest.mark.parametrize("request_type", [ + locations_pb2.ListLocationsRequest, + dict, +]) +def test_list_locations_rest(request_type): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", + ) + + request_init = {'name': 'projects/sample1'} + request = request_type(**request_init) + # Mock the http request call within the method and fake a response. + with mock.patch.object(Session, 'request') as req: + # Designate an appropriate value for the returned response. + return_value = locations_pb2.ListLocationsResponse() + + # Wrap the value into a proper Response obj + response_value = mock.Mock() + response_value.status_code = 200 + json_return_value = json_format.MessageToJson(return_value) + response_value.content = json_return_value.encode('UTF-8') + + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + + response = client.list_locations(request) + + # Establish that the response is the type that we expect. + assert isinstance(response, locations_pb2.ListLocationsResponse) + +def test_initialize_client_w_rest(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest" + ) + assert client is not None + + +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +def test_create_challenge_empty_call_rest(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object( + type(client.transport.create_challenge), + '__call__') as call: + client.create_challenge(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.CreateChallengeRequest() + + assert args[0] == request_msg + + +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +def test_verify_attestation_empty_call_rest(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object( + type(client.transport.verify_attestation), + '__call__') as call: + client.verify_attestation(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.VerifyAttestationRequest() + + assert args[0] == request_msg + + +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +def test_verify_confidential_space_empty_call_rest(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_space), + '__call__') as call: + client.verify_confidential_space(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.VerifyConfidentialSpaceRequest() + + assert args[0] == request_msg + + +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +def test_verify_confidential_gke_empty_call_rest(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_gke), + '__call__') as call: + client.verify_confidential_gke(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.VerifyConfidentialGkeRequest() + + assert args[0] == request_msg + + +def test_transport_grpc_default(): + # A client should use the gRPC transport by default. + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + ) + assert isinstance( + client.transport, + transports.ConfidentialComputingGrpcTransport, + ) + +def test_confidential_computing_base_transport_error(): + # Passing both a credentials object and credentials_file should raise an error + with pytest.raises(core_exceptions.DuplicateCredentialArgs): + transport = transports.ConfidentialComputingTransport( + credentials=ga_credentials.AnonymousCredentials(), + credentials_file="credentials.json" + ) + + +def test_confidential_computing_base_transport(): + # Instantiate the base transport. + with mock.patch('google.cloud.confidentialcomputing_v1.services.confidential_computing.transports.ConfidentialComputingTransport.__init__') as Transport: + Transport.return_value = None + transport = transports.ConfidentialComputingTransport( + credentials=ga_credentials.AnonymousCredentials(), + ) + + # Every method on the transport should just blindly + # raise NotImplementedError. + methods = ( + 'create_challenge', + 'verify_attestation', + 'verify_confidential_space', + 'verify_confidential_gke', + 'get_location', + 'list_locations', + ) + for method in methods: + with pytest.raises(NotImplementedError): + getattr(transport, method)(request=object()) + + with pytest.raises(NotImplementedError): + transport.close() + + # Catch all for all remaining methods and properties + remainder = [ + 'kind', + ] + for r in remainder: + with pytest.raises(NotImplementedError): + getattr(transport, r)() + + +def test_confidential_computing_base_transport_with_credentials_file(): + # Instantiate the base transport with a credentials file + with mock.patch.object(google.auth, 'load_credentials_from_file', autospec=True) as load_creds, mock.patch('google.cloud.confidentialcomputing_v1.services.confidential_computing.transports.ConfidentialComputingTransport._prep_wrapped_messages') as Transport: + Transport.return_value = None + load_creds.return_value = (ga_credentials.AnonymousCredentials(), None) + transport = transports.ConfidentialComputingTransport( + credentials_file="credentials.json", + quota_project_id="octopus", + ) + load_creds.assert_called_once_with("credentials.json", + scopes=None, + default_scopes=( + 'https://www.googleapis.com/auth/cloud-platform', +), + quota_project_id="octopus", + ) + + +def test_confidential_computing_base_transport_with_adc(): + # Test the default credentials are used if credentials and credentials_file are None. + with mock.patch.object(google.auth, 'default', autospec=True) as adc, mock.patch('google.cloud.confidentialcomputing_v1.services.confidential_computing.transports.ConfidentialComputingTransport._prep_wrapped_messages') as Transport: + Transport.return_value = None + adc.return_value = (ga_credentials.AnonymousCredentials(), None) + transport = transports.ConfidentialComputingTransport() + adc.assert_called_once() + + +def test_confidential_computing_auth_adc(): + # If no credentials are provided, we should use ADC credentials. + with mock.patch.object(google.auth, 'default', autospec=True) as adc: + adc.return_value = (ga_credentials.AnonymousCredentials(), None) + ConfidentialComputingClient() + adc.assert_called_once_with( + scopes=None, + default_scopes=( + 'https://www.googleapis.com/auth/cloud-platform', +), + quota_project_id=None, + ) + + +@pytest.mark.parametrize( + "transport_class", + [ + transports.ConfidentialComputingGrpcTransport, + transports.ConfidentialComputingGrpcAsyncIOTransport, + ], +) +def test_confidential_computing_transport_auth_adc(transport_class): + # If credentials and host are not provided, the transport class should use + # ADC credentials. + with mock.patch.object(google.auth, 'default', autospec=True) as adc: + adc.return_value = (ga_credentials.AnonymousCredentials(), None) + transport_class(quota_project_id="octopus", scopes=["1", "2"]) + adc.assert_called_once_with( + scopes=["1", "2"], + default_scopes=( 'https://www.googleapis.com/auth/cloud-platform',), + quota_project_id="octopus", + ) + + +@pytest.mark.parametrize( + "transport_class", + [ + transports.ConfidentialComputingGrpcTransport, + transports.ConfidentialComputingGrpcAsyncIOTransport, + transports.ConfidentialComputingRestTransport, + ], +) +def test_confidential_computing_transport_auth_gdch_credentials(transport_class): + host = 'https://language.com' + api_audience_tests = [None, 'https://language2.com'] + api_audience_expect = [host, 'https://language2.com'] + for t, e in zip(api_audience_tests, api_audience_expect): + with mock.patch.object(google.auth, 'default', autospec=True) as adc: + gdch_mock = mock.MagicMock() + type(gdch_mock).with_gdch_audience = mock.PropertyMock(return_value=gdch_mock) + adc.return_value = (gdch_mock, None) + transport_class(host=host, api_audience=t) + gdch_mock.with_gdch_audience.assert_called_once_with( + e + ) + + +@pytest.mark.parametrize( + "transport_class,grpc_helpers", + [ + (transports.ConfidentialComputingGrpcTransport, grpc_helpers), + (transports.ConfidentialComputingGrpcAsyncIOTransport, grpc_helpers_async) + ], +) +def test_confidential_computing_transport_create_channel(transport_class, grpc_helpers): + # If credentials and host are not provided, the transport class should use + # ADC credentials. + with mock.patch.object(google.auth, "default", autospec=True) as adc, mock.patch.object( + grpc_helpers, "create_channel", autospec=True + ) as create_channel: + creds = ga_credentials.AnonymousCredentials() + adc.return_value = (creds, None) + transport_class( + quota_project_id="octopus", + scopes=["1", "2"] + ) + + create_channel.assert_called_with( + "confidentialcomputing.googleapis.com:443", + credentials=creds, + credentials_file=None, + quota_project_id="octopus", + default_scopes=( + 'https://www.googleapis.com/auth/cloud-platform', +), + scopes=["1", "2"], + default_host="confidentialcomputing.googleapis.com", + ssl_credentials=None, + options=[ + ("grpc.max_send_message_length", -1), + ("grpc.max_receive_message_length", -1), + ], + ) + + +@pytest.mark.parametrize("transport_class", [transports.ConfidentialComputingGrpcTransport, transports.ConfidentialComputingGrpcAsyncIOTransport]) +def test_confidential_computing_grpc_transport_client_cert_source_for_mtls( + transport_class +): + cred = ga_credentials.AnonymousCredentials() + + # Check ssl_channel_credentials is used if provided. + with mock.patch.object(transport_class, "create_channel") as mock_create_channel: + mock_ssl_channel_creds = mock.Mock() + transport_class( + host="squid.clam.whelk", + credentials=cred, + ssl_channel_credentials=mock_ssl_channel_creds + ) + mock_create_channel.assert_called_once_with( + "squid.clam.whelk:443", + credentials=cred, + credentials_file=None, + scopes=None, + ssl_credentials=mock_ssl_channel_creds, + quota_project_id=None, + options=[ + ("grpc.max_send_message_length", -1), + ("grpc.max_receive_message_length", -1), + ], + ) + + # Check if ssl_channel_credentials is not provided, then client_cert_source_for_mtls + # is used. + with mock.patch.object(transport_class, "create_channel", return_value=mock.Mock()): + with mock.patch("grpc.ssl_channel_credentials") as mock_ssl_cred: + transport_class( + credentials=cred, + client_cert_source_for_mtls=client_cert_source_callback + ) + expected_cert, expected_key = client_cert_source_callback() + mock_ssl_cred.assert_called_once_with( + certificate_chain=expected_cert, + private_key=expected_key + ) + +def test_confidential_computing_http_transport_client_cert_source_for_mtls(): + cred = ga_credentials.AnonymousCredentials() + with mock.patch("google.auth.transport.requests.AuthorizedSession.configure_mtls_channel") as mock_configure_mtls_channel: + transports.ConfidentialComputingRestTransport ( + credentials=cred, + client_cert_source_for_mtls=client_cert_source_callback + ) + mock_configure_mtls_channel.assert_called_once_with(client_cert_source_callback) + + +@pytest.mark.parametrize("transport_name", [ + "grpc", + "grpc_asyncio", + "rest", +]) +def test_confidential_computing_host_no_port(transport_name): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + client_options=client_options.ClientOptions(api_endpoint='confidentialcomputing.googleapis.com'), + transport=transport_name, + ) + assert client.transport._host == ( + 'confidentialcomputing.googleapis.com:443' + if transport_name in ['grpc', 'grpc_asyncio'] + else 'https://confidentialcomputing.googleapis.com' + ) + +@pytest.mark.parametrize("transport_name", [ + "grpc", + "grpc_asyncio", + "rest", +]) +def test_confidential_computing_host_with_port(transport_name): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + client_options=client_options.ClientOptions(api_endpoint='confidentialcomputing.googleapis.com:8000'), + transport=transport_name, + ) + assert client.transport._host == ( + 'confidentialcomputing.googleapis.com:8000' + if transport_name in ['grpc', 'grpc_asyncio'] + else 'https://confidentialcomputing.googleapis.com:8000' + ) + +@pytest.mark.parametrize("transport_name", [ + "rest", +]) +def test_confidential_computing_client_transport_session_collision(transport_name): + creds1 = ga_credentials.AnonymousCredentials() + creds2 = ga_credentials.AnonymousCredentials() + client1 = ConfidentialComputingClient( + credentials=creds1, + transport=transport_name, + ) + client2 = ConfidentialComputingClient( + credentials=creds2, + transport=transport_name, + ) + session1 = client1.transport.create_challenge._session + session2 = client2.transport.create_challenge._session + assert session1 != session2 + session1 = client1.transport.verify_attestation._session + session2 = client2.transport.verify_attestation._session + assert session1 != session2 + session1 = client1.transport.verify_confidential_space._session + session2 = client2.transport.verify_confidential_space._session + assert session1 != session2 + session1 = client1.transport.verify_confidential_gke._session + session2 = client2.transport.verify_confidential_gke._session + assert session1 != session2 +def test_confidential_computing_grpc_transport_channel(): + channel = grpc.secure_channel('http://localhost/', grpc.local_channel_credentials()) + + # Check that channel is used if provided. + transport = transports.ConfidentialComputingGrpcTransport( + host="squid.clam.whelk", + channel=channel, + ) + assert transport.grpc_channel == channel + assert transport._host == "squid.clam.whelk:443" + assert transport._ssl_channel_credentials == None + + +def test_confidential_computing_grpc_asyncio_transport_channel(): + channel = aio.secure_channel('http://localhost/', grpc.local_channel_credentials()) + + # Check that channel is used if provided. + transport = transports.ConfidentialComputingGrpcAsyncIOTransport( + host="squid.clam.whelk", + channel=channel, + ) + assert transport.grpc_channel == channel + assert transport._host == "squid.clam.whelk:443" + assert transport._ssl_channel_credentials == None + + +# Remove this test when deprecated arguments (api_mtls_endpoint, client_cert_source) are +# removed from grpc/grpc_asyncio transport constructor. +@pytest.mark.parametrize("transport_class", [transports.ConfidentialComputingGrpcTransport, transports.ConfidentialComputingGrpcAsyncIOTransport]) +def test_confidential_computing_transport_channel_mtls_with_client_cert_source( + transport_class +): + with mock.patch("grpc.ssl_channel_credentials", autospec=True) as grpc_ssl_channel_cred: + with mock.patch.object(transport_class, "create_channel") as grpc_create_channel: + mock_ssl_cred = mock.Mock() + grpc_ssl_channel_cred.return_value = mock_ssl_cred + + mock_grpc_channel = mock.Mock() + grpc_create_channel.return_value = mock_grpc_channel + + cred = ga_credentials.AnonymousCredentials() + with pytest.warns(DeprecationWarning): + with mock.patch.object(google.auth, 'default') as adc: + adc.return_value = (cred, None) + transport = transport_class( + host="squid.clam.whelk", + api_mtls_endpoint="mtls.squid.clam.whelk", + client_cert_source=client_cert_source_callback, + ) + adc.assert_called_once() + + grpc_ssl_channel_cred.assert_called_once_with( + certificate_chain=b"cert bytes", private_key=b"key bytes" + ) + grpc_create_channel.assert_called_once_with( + "mtls.squid.clam.whelk:443", + credentials=cred, + credentials_file=None, + scopes=None, + ssl_credentials=mock_ssl_cred, + quota_project_id=None, + options=[ + ("grpc.max_send_message_length", -1), + ("grpc.max_receive_message_length", -1), + ], + ) + assert transport.grpc_channel == mock_grpc_channel + assert transport._ssl_channel_credentials == mock_ssl_cred + + +# Remove this test when deprecated arguments (api_mtls_endpoint, client_cert_source) are +# removed from grpc/grpc_asyncio transport constructor. +@pytest.mark.parametrize("transport_class", [transports.ConfidentialComputingGrpcTransport, transports.ConfidentialComputingGrpcAsyncIOTransport]) +def test_confidential_computing_transport_channel_mtls_with_adc( + transport_class +): + mock_ssl_cred = mock.Mock() + with mock.patch.multiple( + "google.auth.transport.grpc.SslCredentials", + __init__=mock.Mock(return_value=None), + ssl_credentials=mock.PropertyMock(return_value=mock_ssl_cred), + ): + with mock.patch.object(transport_class, "create_channel") as grpc_create_channel: + mock_grpc_channel = mock.Mock() + grpc_create_channel.return_value = mock_grpc_channel + mock_cred = mock.Mock() + + with pytest.warns(DeprecationWarning): + transport = transport_class( + host="squid.clam.whelk", + credentials=mock_cred, + api_mtls_endpoint="mtls.squid.clam.whelk", + client_cert_source=None, + ) + + grpc_create_channel.assert_called_once_with( + "mtls.squid.clam.whelk:443", + credentials=mock_cred, + credentials_file=None, + scopes=None, + ssl_credentials=mock_ssl_cred, + quota_project_id=None, + options=[ + ("grpc.max_send_message_length", -1), + ("grpc.max_receive_message_length", -1), + ], + ) + assert transport.grpc_channel == mock_grpc_channel + + +def test_challenge_path(): + project = "squid" + location = "clam" + uuid = "whelk" + expected = "projects/{project}/locations/{location}/challenges/{uuid}".format(project=project, location=location, uuid=uuid, ) + actual = ConfidentialComputingClient.challenge_path(project, location, uuid) + assert expected == actual + + +def test_parse_challenge_path(): + expected = { + "project": "octopus", + "location": "oyster", + "uuid": "nudibranch", + } + path = ConfidentialComputingClient.challenge_path(**expected) + + # Check that the path construction is reversible. + actual = ConfidentialComputingClient.parse_challenge_path(path) + assert expected == actual + +def test_common_billing_account_path(): + billing_account = "cuttlefish" + expected = "billingAccounts/{billing_account}".format(billing_account=billing_account, ) + actual = ConfidentialComputingClient.common_billing_account_path(billing_account) + assert expected == actual + + +def test_parse_common_billing_account_path(): + expected = { + "billing_account": "mussel", + } + path = ConfidentialComputingClient.common_billing_account_path(**expected) + + # Check that the path construction is reversible. + actual = ConfidentialComputingClient.parse_common_billing_account_path(path) + assert expected == actual + +def test_common_folder_path(): + folder = "winkle" + expected = "folders/{folder}".format(folder=folder, ) + actual = ConfidentialComputingClient.common_folder_path(folder) + assert expected == actual + + +def test_parse_common_folder_path(): + expected = { + "folder": "nautilus", + } + path = ConfidentialComputingClient.common_folder_path(**expected) + + # Check that the path construction is reversible. + actual = ConfidentialComputingClient.parse_common_folder_path(path) + assert expected == actual + +def test_common_organization_path(): + organization = "scallop" + expected = "organizations/{organization}".format(organization=organization, ) + actual = ConfidentialComputingClient.common_organization_path(organization) + assert expected == actual + + +def test_parse_common_organization_path(): + expected = { + "organization": "abalone", + } + path = ConfidentialComputingClient.common_organization_path(**expected) + + # Check that the path construction is reversible. + actual = ConfidentialComputingClient.parse_common_organization_path(path) + assert expected == actual + +def test_common_project_path(): + project = "squid" + expected = "projects/{project}".format(project=project, ) + actual = ConfidentialComputingClient.common_project_path(project) + assert expected == actual + + +def test_parse_common_project_path(): + expected = { + "project": "clam", + } + path = ConfidentialComputingClient.common_project_path(**expected) + + # Check that the path construction is reversible. + actual = ConfidentialComputingClient.parse_common_project_path(path) + assert expected == actual + +def test_common_location_path(): + project = "whelk" + location = "octopus" + expected = "projects/{project}/locations/{location}".format(project=project, location=location, ) + actual = ConfidentialComputingClient.common_location_path(project, location) + assert expected == actual + + +def test_parse_common_location_path(): + expected = { + "project": "oyster", + "location": "nudibranch", + } + path = ConfidentialComputingClient.common_location_path(**expected) + + # Check that the path construction is reversible. + actual = ConfidentialComputingClient.parse_common_location_path(path) + assert expected == actual + + +def test_client_with_default_client_info(): + client_info = gapic_v1.client_info.ClientInfo() + + with mock.patch.object(transports.ConfidentialComputingTransport, '_prep_wrapped_messages') as prep: + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + client_info=client_info, + ) + prep.assert_called_once_with(client_info) + + with mock.patch.object(transports.ConfidentialComputingTransport, '_prep_wrapped_messages') as prep: + transport_class = ConfidentialComputingClient.get_transport_class() + transport = transport_class( + credentials=ga_credentials.AnonymousCredentials(), + client_info=client_info, + ) + prep.assert_called_once_with(client_info) + + +def test_list_locations(transport: str = "grpc"): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), transport=transport, + ) + + # Everything is optional in proto3 as far as the runtime is concerned, + # and we are mocking out the actual API, so just send an empty request. + request = locations_pb2.ListLocationsRequest() + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object(type(client.transport.list_locations), "__call__") as call: + # Designate an appropriate return value for the call. + call.return_value = locations_pb2.ListLocationsResponse() + response = client.list_locations(request) + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the response is the type that we expect. + assert isinstance(response, locations_pb2.ListLocationsResponse) +@pytest.mark.asyncio +async def test_list_locations_async(transport: str = "grpc_asyncio"): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), transport=transport, + ) + + # Everything is optional in proto3 as far as the runtime is concerned, + # and we are mocking out the actual API, so just send an empty request. + request = locations_pb2.ListLocationsRequest() + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object(type(client.transport.list_locations), "__call__") as call: + # Designate an appropriate return value for the call. + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( + locations_pb2.ListLocationsResponse() + ) + response = await client.list_locations(request) + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the response is the type that we expect. + assert isinstance(response, locations_pb2.ListLocationsResponse) + +def test_list_locations_field_headers(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + ) + + # Any value that is part of the HTTP/1.1 URI should be sent as + # a field header. Set these to a non-empty value. + request = locations_pb2.ListLocationsRequest() + request.name = "locations" + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object(type(client.transport.list_locations), "__call__") as call: + call.return_value = locations_pb2.ListLocationsResponse() + + client.list_locations(request) + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the field header was sent. + _, _, kw = call.mock_calls[0] + assert ("x-goog-request-params", "name=locations",) in kw["metadata"] +@pytest.mark.asyncio +async def test_list_locations_field_headers_async(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + ) + + # Any value that is part of the HTTP/1.1 URI should be sent as + # a field header. Set these to a non-empty value. + request = locations_pb2.ListLocationsRequest() + request.name = "locations" + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object(type(client.transport.list_locations), "__call__") as call: + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( + locations_pb2.ListLocationsResponse() + ) + await client.list_locations(request) + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the field header was sent. + _, _, kw = call.mock_calls[0] + assert ("x-goog-request-params", "name=locations",) in kw["metadata"] + +def test_list_locations_from_dict(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + ) + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object(type(client.transport.list_locations), "__call__") as call: + # Designate an appropriate return value for the call. + call.return_value = locations_pb2.ListLocationsResponse() + + response = client.list_locations( + request={ + "name": "locations", + } + ) + call.assert_called() +@pytest.mark.asyncio +async def test_list_locations_from_dict_async(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + ) + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object(type(client.transport.list_locations), "__call__") as call: + # Designate an appropriate return value for the call. + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( + locations_pb2.ListLocationsResponse() + ) + response = await client.list_locations( + request={ + "name": "locations", + } + ) + call.assert_called() + + +def test_get_location(transport: str = "grpc"): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), transport=transport, + ) + + # Everything is optional in proto3 as far as the runtime is concerned, + # and we are mocking out the actual API, so just send an empty request. + request = locations_pb2.GetLocationRequest() + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object(type(client.transport.get_location), "__call__") as call: + # Designate an appropriate return value for the call. + call.return_value = locations_pb2.Location() + response = client.get_location(request) + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the response is the type that we expect. + assert isinstance(response, locations_pb2.Location) +@pytest.mark.asyncio +async def test_get_location_async(transport: str = "grpc_asyncio"): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), transport=transport, + ) + + # Everything is optional in proto3 as far as the runtime is concerned, + # and we are mocking out the actual API, so just send an empty request. + request = locations_pb2.GetLocationRequest() + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object(type(client.transport.get_location), "__call__") as call: + # Designate an appropriate return value for the call. + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( + locations_pb2.Location() + ) + response = await client.get_location(request) + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the response is the type that we expect. + assert isinstance(response, locations_pb2.Location) + +def test_get_location_field_headers(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials()) + + # Any value that is part of the HTTP/1.1 URI should be sent as + # a field header. Set these to a non-empty value. + request = locations_pb2.GetLocationRequest() + request.name = "locations/abc" + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object(type(client.transport.get_location), "__call__") as call: + call.return_value = locations_pb2.Location() + + client.get_location(request) + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the field header was sent. + _, _, kw = call.mock_calls[0] + assert ("x-goog-request-params", "name=locations/abc",) in kw["metadata"] +@pytest.mark.asyncio +async def test_get_location_field_headers_async(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials() + ) + + # Any value that is part of the HTTP/1.1 URI should be sent as + # a field header. Set these to a non-empty value. + request = locations_pb2.GetLocationRequest() + request.name = "locations/abc" + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object(type(client.transport.get_location), "__call__") as call: + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( + locations_pb2.Location() + ) + await client.get_location(request) + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the field header was sent. + _, _, kw = call.mock_calls[0] + assert ("x-goog-request-params", "name=locations/abc",) in kw["metadata"] + +def test_get_location_from_dict(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + ) + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object(type(client.transport.list_locations), "__call__") as call: + # Designate an appropriate return value for the call. + call.return_value = locations_pb2.Location() + + response = client.get_location( + request={ + "name": "locations/abc", + } + ) + call.assert_called() +@pytest.mark.asyncio +async def test_get_location_from_dict_async(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + ) + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object(type(client.transport.list_locations), "__call__") as call: + # Designate an appropriate return value for the call. + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( + locations_pb2.Location() + ) + response = await client.get_location( + request={ + "name": "locations", + } + ) + call.assert_called() + + +def test_transport_close_grpc(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="grpc" + ) + with mock.patch.object(type(getattr(client.transport, "_grpc_channel")), "close") as close: + with client: + close.assert_not_called() + close.assert_called_once() + + +@pytest.mark.asyncio +async def test_transport_close_grpc_asyncio(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport="grpc_asyncio" + ) + with mock.patch.object(type(getattr(client.transport, "_grpc_channel")), "close") as close: + async with client: + close.assert_not_called() + close.assert_called_once() + + +def test_transport_close_rest(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest" + ) + with mock.patch.object(type(getattr(client.transport, "_session")), "close") as close: + with client: + close.assert_not_called() + close.assert_called_once() + + +def test_client_ctx(): + transports = [ + 'rest', + 'grpc', + ] + for transport in transports: + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport=transport + ) + # Test client calls underlying transport. + with mock.patch.object(type(client.transport), "close") as close: + close.assert_not_called() + with client: + pass + close.assert_called() + +@pytest.mark.parametrize("client_class,transport_class", [ + (ConfidentialComputingClient, transports.ConfidentialComputingGrpcTransport), + (ConfidentialComputingAsyncClient, transports.ConfidentialComputingGrpcAsyncIOTransport), +]) +def test_api_key_credentials(client_class, transport_class): + with mock.patch.object( + google.auth._default, "get_api_key_credentials", create=True + ) as get_api_key_credentials: + mock_cred = mock.Mock() + get_api_key_credentials.return_value = mock_cred + options = client_options.ClientOptions() + options.api_key = "api_key" + with mock.patch.object(transport_class, "__init__") as patched: + patched.return_value = None + client = client_class(client_options=options) + patched.assert_called_once_with( + credentials=mock_cred, + credentials_file=None, + host=client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE), + scopes=None, + client_cert_source_for_mtls=None, + quota_project_id=None, + client_info=transports.base.DEFAULT_CLIENT_INFO, + always_use_jwt_access=True, + api_audience=None, + ) From bd4881deb24c72df6cc6b83d89ca703206571006 Mon Sep 17 00:00:00 2001 From: Owl Bot Date: Fri, 29 Aug 2025 21:09:44 +0000 Subject: [PATCH 2/4] =?UTF-8?q?=F0=9F=A6=89=20Updates=20from=20OwlBot=20po?= =?UTF-8?q?st-processor?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md --- .../v1/.coveragerc | 13 - .../v1/.flake8 | 34 - .../v1/LICENSE | 202 - .../v1/MANIFEST.in | 20 - .../v1/README.rst | 143 - .../v1/docs/_static/custom.css | 20 - .../v1/docs/_templates/layout.html | 50 - .../v1/docs/conf.py | 385 -- .../confidential_computing.rst | 6 - .../confidentialcomputing_v1/services_.rst | 6 - .../docs/confidentialcomputing_v1/types_.rst | 6 - .../v1/docs/index.rst | 10 - .../v1/docs/multiprocessing.rst | 7 - .../cloud/confidentialcomputing/__init__.py | 71 - .../confidentialcomputing/gapic_version.py | 16 - .../cloud/confidentialcomputing/py.typed | 2 - .../confidentialcomputing_v1/__init__.py | 72 - .../gapic_metadata.json | 88 - .../confidentialcomputing_v1/gapic_version.py | 16 - .../cloud/confidentialcomputing_v1/py.typed | 2 - .../services/__init__.py | 15 - .../confidential_computing/__init__.py | 22 - .../confidential_computing/async_client.py | 760 --- .../services/confidential_computing/client.py | 1123 ----- .../transports/README.rst | 9 - .../transports/__init__.py | 38 - .../confidential_computing/transports/base.py | 264 -- .../confidential_computing/transports/grpc.py | 465 -- .../transports/grpc_asyncio.py | 547 --- .../confidential_computing/transports/rest.py | 1179 ----- .../transports/rest_base.py | 330 -- .../types/__init__.py | 64 - .../confidentialcomputing_v1/types/service.py | 915 ---- .../v1/mypy.ini | 3 - .../v1/noxfile.py | 592 --- ...ential_computing_create_challenge_async.py | 52 - ...dential_computing_create_challenge_sync.py | 52 - ...tial_computing_verify_attestation_async.py | 52 - ...ntial_computing_verify_attestation_sync.py | 52 - ...google.cloud.confidentialcomputing.v1.json | 643 --- ...fixup_confidentialcomputing_v1_keywords.py | 179 - .../v1/setup.py | 98 - .../v1/testing/constraints-3.10.txt | 6 - .../v1/testing/constraints-3.11.txt | 6 - .../v1/testing/constraints-3.12.txt | 6 - .../v1/testing/constraints-3.13.txt | 11 - .../v1/testing/constraints-3.7.txt | 10 - .../v1/testing/constraints-3.8.txt | 6 - .../v1/testing/constraints-3.9.txt | 6 - .../v1/tests/__init__.py | 16 - .../v1/tests/unit/__init__.py | 16 - .../v1/tests/unit/gapic/__init__.py | 16 - .../confidentialcomputing_v1/__init__.py | 16 - .../test_confidential_computing.py | 4165 ----------------- .../cloud/confidentialcomputing/__init__.py | 16 + .../confidentialcomputing_v1/__init__.py | 16 + .../gapic_metadata.json | 30 + .../confidential_computing/async_client.py | 194 +- .../services/confidential_computing/client.py | 192 +- .../confidential_computing/transports/base.py | 52 + .../confidential_computing/transports/grpc.py | 61 +- .../transports/grpc_asyncio.py | 90 +- .../confidential_computing/transports/rest.py | 469 +- .../transports/rest_base.py | 114 + .../types/__init__.py | 16 + .../confidentialcomputing_v1/types/service.py | 408 +- ...computing_verify_confidential_gke_async.py | 0 ..._computing_verify_confidential_gke_sync.py | 0 ...mputing_verify_confidential_space_async.py | 0 ...omputing_verify_confidential_space_sync.py | 0 ...google.cloud.confidentialcomputing.v1.json | 306 ++ ...fixup_confidentialcomputing_v1_keywords.py | 2 + .../test_confidential_computing.py | 2065 ++++++-- 73 files changed, 3528 insertions(+), 13406 deletions(-) delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/.coveragerc delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/.flake8 delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/LICENSE delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/MANIFEST.in delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/README.rst delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/_static/custom.css delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/_templates/layout.html delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/conf.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/confidential_computing.rst delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/services_.rst delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/types_.rst delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/index.rst delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/multiprocessing.rst delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/__init__.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/gapic_version.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/py.typed delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/__init__.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/gapic_metadata.json delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/gapic_version.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/py.typed delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/__init__.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/__init__.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/async_client.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/client.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/README.rst delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/__init__.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/base.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc_asyncio.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest_base.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/types/__init__.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/types/service.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/mypy.ini delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/noxfile.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_create_challenge_async.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_create_challenge_sync.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_attestation_async.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_attestation_sync.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/snippet_metadata_google.cloud.confidentialcomputing.v1.json delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/scripts/fixup_confidentialcomputing_v1_keywords.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/setup.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.10.txt delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.11.txt delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.12.txt delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.13.txt delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.7.txt delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.8.txt delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.9.txt delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/__init__.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/__init__.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/__init__.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/confidentialcomputing_v1/__init__.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/confidentialcomputing_v1/test_confidential_computing.py rename {owl-bot-staging/google-cloud-confidentialcomputing/v1 => packages/google-cloud-confidentialcomputing}/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_async.py (100%) rename {owl-bot-staging/google-cloud-confidentialcomputing/v1 => packages/google-cloud-confidentialcomputing}/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_sync.py (100%) rename {owl-bot-staging/google-cloud-confidentialcomputing/v1 => packages/google-cloud-confidentialcomputing}/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_async.py (100%) rename {owl-bot-staging/google-cloud-confidentialcomputing/v1 => packages/google-cloud-confidentialcomputing}/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_sync.py (100%) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/.coveragerc b/owl-bot-staging/google-cloud-confidentialcomputing/v1/.coveragerc deleted file mode 100644 index ecca1f30bedc..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/.coveragerc +++ /dev/null @@ -1,13 +0,0 @@ -[run] -branch = True - -[report] -show_missing = True -omit = - google/cloud/confidentialcomputing/__init__.py - google/cloud/confidentialcomputing/gapic_version.py -exclude_lines = - # Re-enable the standard pragma - pragma: NO COVER - # Ignore debug-only repr - def __repr__ diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/.flake8 b/owl-bot-staging/google-cloud-confidentialcomputing/v1/.flake8 deleted file mode 100644 index 90316de21489..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/.flake8 +++ /dev/null @@ -1,34 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -[flake8] -# TODO(https://github.com/googleapis/gapic-generator-python/issues/2333): -# Resolve flake8 lint issues -ignore = E203, E231, E266, E501, W503 -exclude = - # TODO(https://github.com/googleapis/gapic-generator-python/issues/2333): - # Ensure that generated code passes flake8 lint - **/gapic/** - **/services/** - **/types/** - # Exclude Protobuf gencode - *_pb2.py - - # Standard linting exemptions. - **/.nox/** - __pycache__, - .git, - *.pyc, - conf.py diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/LICENSE b/owl-bot-staging/google-cloud-confidentialcomputing/v1/LICENSE deleted file mode 100644 index d64569567334..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/LICENSE +++ /dev/null @@ -1,202 +0,0 @@ - - Apache License - Version 2.0, January 2004 - http://www.apache.org/licenses/ - - TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION - - 1. Definitions. - - "License" shall mean the terms and conditions for use, reproduction, - and distribution as defined by Sections 1 through 9 of this document. - - "Licensor" shall mean the copyright owner or entity authorized by - the copyright owner that is granting the License. - - "Legal Entity" shall mean the union of the acting entity and all - other entities that control, are controlled by, or are under common - control with that entity. For the purposes of this definition, - "control" means (i) the power, direct or indirect, to cause the - direction or management of such entity, whether by contract or - otherwise, or (ii) ownership of fifty percent (50%) or more of the - outstanding shares, or (iii) beneficial ownership of such entity. - - "You" (or "Your") shall mean an individual or Legal Entity - exercising permissions granted by this License. - - "Source" form shall mean the preferred form for making modifications, - including but not limited to software source code, documentation - source, and configuration files. - - "Object" form shall mean any form resulting from mechanical - transformation or translation of a Source form, including but - not limited to compiled object code, generated documentation, - and conversions to other media types. - - "Work" shall mean the work of authorship, whether in Source or - Object form, made available under the License, as indicated by a - copyright notice that is included in or attached to the work - (an example is provided in the Appendix below). - - "Derivative Works" shall mean any work, whether in Source or Object - form, that is based on (or derived from) the Work and for which the - editorial revisions, annotations, elaborations, or other modifications - represent, as a whole, an original work of authorship. For the purposes - of this License, Derivative Works shall not include works that remain - separable from, or merely link (or bind by name) to the interfaces of, - the Work and Derivative Works thereof. - - "Contribution" shall mean any work of authorship, including - the original version of the Work and any modifications or additions - to that Work or Derivative Works thereof, that is intentionally - submitted to Licensor for inclusion in the Work by the copyright owner - or by an individual or Legal Entity authorized to submit on behalf of - the copyright owner. For the purposes of this definition, "submitted" - means any form of electronic, verbal, or written communication sent - to the Licensor or its representatives, including but not limited to - communication on electronic mailing lists, source code control systems, - and issue tracking systems that are managed by, or on behalf of, the - Licensor for the purpose of discussing and improving the Work, but - excluding communication that is conspicuously marked or otherwise - designated in writing by the copyright owner as "Not a Contribution." - - "Contributor" shall mean Licensor and any individual or Legal Entity - on behalf of whom a Contribution has been received by Licensor and - subsequently incorporated within the Work. - - 2. Grant of Copyright License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - copyright license to reproduce, prepare Derivative Works of, - publicly display, publicly perform, sublicense, and distribute the - Work and such Derivative Works in Source or Object form. - - 3. Grant of Patent License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - (except as stated in this section) patent license to make, have made, - use, offer to sell, sell, import, and otherwise transfer the Work, - where such license applies only to those patent claims licensable - by such Contributor that are necessarily infringed by their - Contribution(s) alone or by combination of their Contribution(s) - with the Work to which such Contribution(s) was submitted. If You - institute patent litigation against any entity (including a - cross-claim or counterclaim in a lawsuit) alleging that the Work - or a Contribution incorporated within the Work constitutes direct - or contributory patent infringement, then any patent licenses - granted to You under this License for that Work shall terminate - as of the date such litigation is filed. - - 4. Redistribution. You may reproduce and distribute copies of the - Work or Derivative Works thereof in any medium, with or without - modifications, and in Source or Object form, provided that You - meet the following conditions: - - (a) You must give any other recipients of the Work or - Derivative Works a copy of this License; and - - (b) You must cause any modified files to carry prominent notices - stating that You changed the files; and - - (c) You must retain, in the Source form of any Derivative Works - that You distribute, all copyright, patent, trademark, and - attribution notices from the Source form of the Work, - excluding those notices that do not pertain to any part of - the Derivative Works; and - - (d) If the Work includes a "NOTICE" text file as part of its - distribution, then any Derivative Works that You distribute must - include a readable copy of the attribution notices contained - within such NOTICE file, excluding those notices that do not - pertain to any part of the Derivative Works, in at least one - of the following places: within a NOTICE text file distributed - as part of the Derivative Works; within the Source form or - documentation, if provided along with the Derivative Works; or, - within a display generated by the Derivative Works, if and - wherever such third-party notices normally appear. The contents - of the NOTICE file are for informational purposes only and - do not modify the License. You may add Your own attribution - notices within Derivative Works that You distribute, alongside - or as an addendum to the NOTICE text from the Work, provided - that such additional attribution notices cannot be construed - as modifying the License. - - You may add Your own copyright statement to Your modifications and - may provide additional or different license terms and conditions - for use, reproduction, or distribution of Your modifications, or - for any such Derivative Works as a whole, provided Your use, - reproduction, and distribution of the Work otherwise complies with - the conditions stated in this License. - - 5. Submission of Contributions. Unless You explicitly state otherwise, - any Contribution intentionally submitted for inclusion in the Work - by You to the Licensor shall be under the terms and conditions of - this License, without any additional terms or conditions. - Notwithstanding the above, nothing herein shall supersede or modify - the terms of any separate license agreement you may have executed - with Licensor regarding such Contributions. - - 6. Trademarks. This License does not grant permission to use the trade - names, trademarks, service marks, or product names of the Licensor, - except as required for reasonable and customary use in describing the - origin of the Work and reproducing the content of the NOTICE file. - - 7. Disclaimer of Warranty. Unless required by applicable law or - agreed to in writing, Licensor provides the Work (and each - Contributor provides its Contributions) on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - implied, including, without limitation, any warranties or conditions - of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A - PARTICULAR PURPOSE. You are solely responsible for determining the - appropriateness of using or redistributing the Work and assume any - risks associated with Your exercise of permissions under this License. - - 8. Limitation of Liability. In no event and under no legal theory, - whether in tort (including negligence), contract, or otherwise, - unless required by applicable law (such as deliberate and grossly - negligent acts) or agreed to in writing, shall any Contributor be - liable to You for damages, including any direct, indirect, special, - incidental, or consequential damages of any character arising as a - result of this License or out of the use or inability to use the - Work (including but not limited to damages for loss of goodwill, - work stoppage, computer failure or malfunction, or any and all - other commercial damages or losses), even if such Contributor - has been advised of the possibility of such damages. - - 9. Accepting Warranty or Additional Liability. While redistributing - the Work or Derivative Works thereof, You may choose to offer, - and charge a fee for, acceptance of support, warranty, indemnity, - or other liability obligations and/or rights consistent with this - License. However, in accepting such obligations, You may act only - on Your own behalf and on Your sole responsibility, not on behalf - of any other Contributor, and only if You agree to indemnify, - defend, and hold each Contributor harmless for any liability - incurred by, or claims asserted against, such Contributor by reason - of your accepting any such warranty or additional liability. - - END OF TERMS AND CONDITIONS - - APPENDIX: How to apply the Apache License to your work. - - To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "[]" - replaced with your own identifying information. (Don't include - the brackets!) The text should be enclosed in the appropriate - comment syntax for the file format. We also recommend that a - file or class name and description of purpose be included on the - same "printed page" as the copyright notice for easier - identification within third-party archives. - - Copyright [yyyy] [name of copyright owner] - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/MANIFEST.in b/owl-bot-staging/google-cloud-confidentialcomputing/v1/MANIFEST.in deleted file mode 100644 index dae249ec8976..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/MANIFEST.in +++ /dev/null @@ -1,20 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -include README.rst LICENSE -recursive-include google *.py *.pyi *.json *.proto py.typed -recursive-include tests * -global-exclude *.py[co] -global-exclude __pycache__ diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/README.rst b/owl-bot-staging/google-cloud-confidentialcomputing/v1/README.rst deleted file mode 100644 index 593004344023..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/README.rst +++ /dev/null @@ -1,143 +0,0 @@ -Python Client for Google Cloud Confidentialcomputing API -================================================= - -Quick Start ------------ - -In order to use this library, you first need to go through the following steps: - -1. `Select or create a Cloud Platform project.`_ -2. `Enable billing for your project.`_ -3. Enable the Google Cloud Confidentialcomputing API. -4. `Setup Authentication.`_ - -.. _Select or create a Cloud Platform project.: https://console.cloud.google.com/project -.. _Enable billing for your project.: https://cloud.google.com/billing/docs/how-to/modify-project#enable_billing_for_a_project -.. _Setup Authentication.: https://googleapis.dev/python/google-api-core/latest/auth.html - -Installation -~~~~~~~~~~~~ - -Install this library in a `virtualenv`_ using pip. `virtualenv`_ is a tool to -create isolated Python environments. The basic problem it addresses is one of -dependencies and versions, and indirectly permissions. - -With `virtualenv`_, it's possible to install this library without needing system -install permissions, and without clashing with the installed system -dependencies. - -.. _`virtualenv`: https://virtualenv.pypa.io/en/latest/ - - -Mac/Linux -^^^^^^^^^ - -.. code-block:: console - - python3 -m venv - source /bin/activate - /bin/pip install /path/to/library - - -Windows -^^^^^^^ - -.. code-block:: console - - python3 -m venv - \Scripts\activate - \Scripts\pip.exe install \path\to\library - - -Logging -------- - -This library uses the standard Python :code:`logging` functionality to log some RPC events that could be of interest for debugging and monitoring purposes. -Note the following: - -#. Logs may contain sensitive information. Take care to **restrict access to the logs** if they are saved, whether it be on local storage or on Google Cloud Logging. -#. Google may refine the occurrence, level, and content of various log messages in this library without flagging such changes as breaking. **Do not depend on immutability of the logging events**. -#. By default, the logging events from this library are not handled. You must **explicitly configure log handling** using one of the mechanisms below. - - -Simple, environment-based configuration -~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -To enable logging for this library without any changes in your code, set the :code:`GOOGLE_SDK_PYTHON_LOGGING_SCOPE` environment variable to a valid Google -logging scope. This configures handling of logging events (at level :code:`logging.DEBUG` or higher) from this library in a default manner, emitting the logged -messages in a structured format. It does not currently allow customizing the logging levels captured nor the handlers, formatters, etc. used for any logging -event. - -A logging scope is a period-separated namespace that begins with :code:`google`, identifying the Python module or package to log. - -- Valid logging scopes: :code:`google`, :code:`google.cloud.asset.v1`, :code:`google.api`, :code:`google.auth`, etc. -- Invalid logging scopes: :code:`foo`, :code:`123`, etc. - -**NOTE**: If the logging scope is invalid, the library does not set up any logging handlers. - - -Examples -^^^^^^^^ - -- Enabling the default handler for all Google-based loggers - -.. code-block:: console - - export GOOGLE_SDK_PYTHON_LOGGING_SCOPE=google - -- Enabling the default handler for a specific Google module (for a client library called :code:`library_v1`): - -.. code-block:: console - - export GOOGLE_SDK_PYTHON_LOGGING_SCOPE=google.cloud.library_v1 - - -Advanced, code-based configuration -~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -You can also configure a valid logging scope using Python's standard `logging` mechanism. - - -Examples -^^^^^^^^ - -- Configuring a handler for all Google-based loggers - -.. code-block:: python - - import logging - - from google.cloud.translate_v3 import translate - - base_logger = logging.getLogger("google") - base_logger.addHandler(logging.StreamHandler()) - base_logger.setLevel(logging.DEBUG) - -- Configuring a handler for a specific Google module (for a client library called :code:`library_v1`): - -.. code-block:: python - - import logging - - from google.cloud.translate_v3 import translate - - base_logger = logging.getLogger("google.cloud.library_v1") - base_logger.addHandler(logging.StreamHandler()) - base_logger.setLevel(logging.DEBUG) - - -Logging details -~~~~~~~~~~~~~~~ - -#. Regardless of which of the mechanisms above you use to configure logging for this library, by default logging events are not propagated up to the root - logger from the `google`-level logger. If you need the events to be propagated to the root logger, you must explicitly set - :code:`logging.getLogger("google").propagate = True` in your code. -#. You can mix the different logging configurations above for different Google modules. For example, you may want use a code-based logging configuration for - one library, but decide you need to also set up environment-based logging configuration for another library. - - #. If you attempt to use both code-based and environment-based configuration for the same module, the environment-based configuration will be ineffectual - if the code -based configuration gets applied first. - -#. The Google-specific logging configurations (default handlers for environment-based configuration; not propagating logging events to the root logger) get - executed the first time *any* client library is instantiated in your application, and only if the affected loggers have not been previously configured. - (This is the reason for 2.i. above.) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/_static/custom.css b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/_static/custom.css deleted file mode 100644 index b0a295464b23..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/_static/custom.css +++ /dev/null @@ -1,20 +0,0 @@ -div#python2-eol { - border-color: red; - border-width: medium; -} - -/* Ensure minimum width for 'Parameters' / 'Returns' column */ -dl.field-list > dt { - min-width: 100px -} - -/* Insert space between methods for readability */ -dl.method { - padding-top: 10px; - padding-bottom: 10px -} - -/* Insert empty space between classes */ -dl.class { - padding-bottom: 50px -} diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/_templates/layout.html b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/_templates/layout.html deleted file mode 100644 index 95e9c77fcfe1..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/_templates/layout.html +++ /dev/null @@ -1,50 +0,0 @@ - -{% extends "!layout.html" %} -{%- block content %} -{%- if theme_fixed_sidebar|lower == 'true' %} -
- {{ sidebar() }} - {%- block document %} -
- {%- if render_sidebar %} -
- {%- endif %} - - {%- block relbar_top %} - {%- if theme_show_relbar_top|tobool %} -
-   - {{- rellink_markup () }} -
- {%- endif %} - {% endblock %} - -
-
- As of January 1, 2020 this library no longer supports Python 2 on the latest released version. - Library versions released prior to that date will continue to be available. For more information please - visit Python 2 support on Google Cloud. -
- {% block body %} {% endblock %} -
- - {%- block relbar_bottom %} - {%- if theme_show_relbar_bottom|tobool %} -
-   - {{- rellink_markup () }} -
- {%- endif %} - {% endblock %} - - {%- if render_sidebar %} -
- {%- endif %} -
- {%- endblock %} -
-
-{%- else %} -{{ super() }} -{%- endif %} -{%- endblock %} diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/conf.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/conf.py deleted file mode 100644 index e25ab393e702..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/conf.py +++ /dev/null @@ -1,385 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -# -# google-cloud-confidentialcomputing documentation build configuration file -# -# This file is execfile()d with the current directory set to its -# containing dir. -# -# Note that not all possible configuration values are present in this -# autogenerated file. -# -# All configuration values have a default; values that are commented out -# serve to show the default. - -import sys -import os -import shlex - -# If extensions (or modules to document with autodoc) are in another directory, -# add these directories to sys.path here. If the directory is relative to the -# documentation root, use os.path.abspath to make it absolute, like shown here. -sys.path.insert(0, os.path.abspath("..")) - -# For plugins that can not read conf.py. -# See also: https://github.com/docascode/sphinx-docfx-yaml/issues/85 -sys.path.insert(0, os.path.abspath(".")) - -__version__ = "" - -# -- General configuration ------------------------------------------------ - -# If your documentation needs a minimal Sphinx version, state it here. -needs_sphinx = "4.5.0" - -# Add any Sphinx extension module names here, as strings. They can be -# extensions coming with Sphinx (named 'sphinx.ext.*') or your custom -# ones. -extensions = [ - "sphinx.ext.autodoc", - "sphinx.ext.autosummary", - "sphinx.ext.intersphinx", - "sphinx.ext.coverage", - "sphinx.ext.doctest", - "sphinx.ext.napoleon", - "sphinx.ext.todo", - "sphinx.ext.viewcode", - "recommonmark", -] - -# autodoc/autosummary flags -autoclass_content = "both" -autodoc_default_options = {"members": True} -autosummary_generate = True - - -# Add any paths that contain templates here, relative to this directory. -templates_path = ["_templates"] - -# The suffix(es) of source filenames. -# You can specify multiple suffix as a list of string: -# source_suffix = ['.rst', '.md'] -source_suffix = [".rst", ".md"] - -# The encoding of source files. -# source_encoding = 'utf-8-sig' - -# The root toctree document. -root_doc = "index" - -# General information about the project. -project = u"google-cloud-confidentialcomputing" -copyright = u"2025, Google, LLC" -author = u"Google APIs" - -# The version info for the project you're documenting, acts as replacement for -# |version| and |release|, also used in various other places throughout the -# built documents. -# -# The full version, including alpha/beta/rc tags. -release = __version__ -# The short X.Y version. -version = ".".join(release.split(".")[0:2]) - -# The language for content autogenerated by Sphinx. Refer to documentation -# for a list of supported languages. -# -# This is also used if you do content translation via gettext catalogs. -# Usually you set "language" from the command line for these cases. -language = None - -# There are two options for replacing |today|: either, you set today to some -# non-false value, then it is used: -# today = '' -# Else, today_fmt is used as the format for a strftime call. -# today_fmt = '%B %d, %Y' - -# List of patterns, relative to source directory, that match files and -# directories to ignore when looking for source files. -exclude_patterns = [ - "_build", - "**/.nox/**/*", - "samples/AUTHORING_GUIDE.md", - "samples/CONTRIBUTING.md", - "samples/snippets/README.rst", -] - -# The reST default role (used for this markup: `text`) to use for all -# documents. -# default_role = None - -# If true, '()' will be appended to :func: etc. cross-reference text. -# add_function_parentheses = True - -# If true, the current module name will be prepended to all description -# unit titles (such as .. function::). -# add_module_names = True - -# If true, sectionauthor and moduleauthor directives will be shown in the -# output. They are ignored by default. -# show_authors = False - -# The name of the Pygments (syntax highlighting) style to use. -pygments_style = "sphinx" - -# A list of ignored prefixes for module index sorting. -# modindex_common_prefix = [] - -# If true, keep warnings as "system message" paragraphs in the built documents. -# keep_warnings = False - -# If true, `todo` and `todoList` produce output, else they produce nothing. -todo_include_todos = True - - -# -- Options for HTML output ---------------------------------------------- - -# The theme to use for HTML and HTML Help pages. See the documentation for -# a list of builtin themes. -html_theme = "alabaster" - -# Theme options are theme-specific and customize the look and feel of a theme -# further. For a list of options available for each theme, see the -# documentation. -html_theme_options = { - "description": "Google Cloud Client Libraries for google-cloud-confidentialcomputing", - "github_user": "googleapis", - "github_repo": "google-cloud-python", - "github_banner": True, - "font_family": "'Roboto', Georgia, sans", - "head_font_family": "'Roboto', Georgia, serif", - "code_font_family": "'Roboto Mono', 'Consolas', monospace", -} - -# Add any paths that contain custom themes here, relative to this directory. -# html_theme_path = [] - -# The name for this set of Sphinx documents. If None, it defaults to -# " v documentation". -# html_title = None - -# A shorter title for the navigation bar. Default is the same as html_title. -# html_short_title = None - -# The name of an image file (relative to this directory) to place at the top -# of the sidebar. -# html_logo = None - -# The name of an image file (within the static path) to use as favicon of the -# docs. This file should be a Windows icon file (.ico) being 16x16 or 32x32 -# pixels large. -# html_favicon = None - -# Add any paths that contain custom static files (such as style sheets) here, -# relative to this directory. They are copied after the builtin static files, -# so a file named "default.css" will overwrite the builtin "default.css". -html_static_path = ["_static"] - -# Add any extra paths that contain custom files (such as robots.txt or -# .htaccess) here, relative to this directory. These files are copied -# directly to the root of the documentation. -# html_extra_path = [] - -# If not '', a 'Last updated on:' timestamp is inserted at every page bottom, -# using the given strftime format. -# html_last_updated_fmt = '%b %d, %Y' - -# If true, SmartyPants will be used to convert quotes and dashes to -# typographically correct entities. -# html_use_smartypants = True - -# Custom sidebar templates, maps document names to template names. -# html_sidebars = {} - -# Additional templates that should be rendered to pages, maps page names to -# template names. -# html_additional_pages = {} - -# If false, no module index is generated. -# html_domain_indices = True - -# If false, no index is generated. -# html_use_index = True - -# If true, the index is split into individual pages for each letter. -# html_split_index = False - -# If true, links to the reST sources are added to the pages. -# html_show_sourcelink = True - -# If true, "Created using Sphinx" is shown in the HTML footer. Default is True. -# html_show_sphinx = True - -# If true, "(C) Copyright ..." is shown in the HTML footer. Default is True. -# html_show_copyright = True - -# If true, an OpenSearch description file will be output, and all pages will -# contain a tag referring to it. The value of this option must be the -# base URL from which the finished HTML is served. -# html_use_opensearch = '' - -# This is the file name suffix for HTML files (e.g. ".xhtml"). -# html_file_suffix = None - -# Language to be used for generating the HTML full-text search index. -# Sphinx supports the following languages: -# 'da', 'de', 'en', 'es', 'fi', 'fr', 'hu', 'it', 'ja' -# 'nl', 'no', 'pt', 'ro', 'ru', 'sv', 'tr' -# html_search_language = 'en' - -# A dictionary with options for the search language support, empty by default. -# Now only 'ja' uses this config value -# html_search_options = {'type': 'default'} - -# The name of a javascript file (relative to the configuration directory) that -# implements a search results scorer. If empty, the default will be used. -# html_search_scorer = 'scorer.js' - -# Output file base name for HTML help builder. -htmlhelp_basename = "google-cloud-confidentialcomputing-doc" - -# -- Options for warnings ------------------------------------------------------ - - -suppress_warnings = [ - # Temporarily suppress this to avoid "more than one target found for - # cross-reference" warning, which are intractable for us to avoid while in - # a mono-repo. - # See https://github.com/sphinx-doc/sphinx/blob - # /2a65ffeef5c107c19084fabdd706cdff3f52d93c/sphinx/domains/python.py#L843 - "ref.python" -] - -# -- Options for LaTeX output --------------------------------------------- - -latex_elements = { - # The paper size ('letterpaper' or 'a4paper'). - # 'papersize': 'letterpaper', - # The font size ('10pt', '11pt' or '12pt'). - # 'pointsize': '10pt', - # Additional stuff for the LaTeX preamble. - # 'preamble': '', - # Latex figure (float) alignment - # 'figure_align': 'htbp', -} - -# Grouping the document tree into LaTeX files. List of tuples -# (source start file, target name, title, -# author, documentclass [howto, manual, or own class]). -latex_documents = [ - ( - root_doc, - "google-cloud-confidentialcomputing.tex", - u"google-cloud-confidentialcomputing Documentation", - author, - "manual", - ) -] - -# The name of an image file (relative to this directory) to place at the top of -# the title page. -# latex_logo = None - -# For "manual" documents, if this is true, then toplevel headings are parts, -# not chapters. -# latex_use_parts = False - -# If true, show page references after internal links. -# latex_show_pagerefs = False - -# If true, show URL addresses after external links. -# latex_show_urls = False - -# Documents to append as an appendix to all manuals. -# latex_appendices = [] - -# If false, no module index is generated. -# latex_domain_indices = True - - -# -- Options for manual page output --------------------------------------- - -# One entry per manual page. List of tuples -# (source start file, name, description, authors, manual section). -man_pages = [ - ( - root_doc, - "google-cloud-confidentialcomputing", - "google-cloud-confidentialcomputing Documentation", - [author], - 1, - ) -] - -# If true, show URL addresses after external links. -# man_show_urls = False - - -# -- Options for Texinfo output ------------------------------------------- - -# Grouping the document tree into Texinfo files. List of tuples -# (source start file, target name, title, author, -# dir menu entry, description, category) -texinfo_documents = [ - ( - root_doc, - "google-cloud-confidentialcomputing", - "google-cloud-confidentialcomputing Documentation", - author, - "google-cloud-confidentialcomputing", - "google-cloud-confidentialcomputing Library", - "APIs", - ) -] - -# Documents to append as an appendix to all manuals. -# texinfo_appendices = [] - -# If false, no module index is generated. -# texinfo_domain_indices = True - -# How to display URL addresses: 'footnote', 'no', or 'inline'. -# texinfo_show_urls = 'footnote' - -# If true, do not generate a @detailmenu in the "Top" node's menu. -# texinfo_no_detailmenu = False - - -# Example configuration for intersphinx: refer to the Python standard library. -intersphinx_mapping = { - "python": ("https://python.readthedocs.org/en/latest/", None), - "google-auth": ("https://googleapis.dev/python/google-auth/latest/", None), - "google.api_core": ( - "https://googleapis.dev/python/google-api-core/latest/", - None, - ), - "grpc": ("https://grpc.github.io/grpc/python/", None), - "proto-plus": ("https://proto-plus-python.readthedocs.io/en/latest/", None), - "protobuf": ("https://googleapis.dev/python/protobuf/latest/", None), -} - - -# Napoleon settings -napoleon_google_docstring = True -napoleon_numpy_docstring = True -napoleon_include_private_with_doc = False -napoleon_include_special_with_doc = True -napoleon_use_admonition_for_examples = False -napoleon_use_admonition_for_notes = False -napoleon_use_admonition_for_references = False -napoleon_use_ivar = False -napoleon_use_param = True -napoleon_use_rtype = True diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/confidential_computing.rst b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/confidential_computing.rst deleted file mode 100644 index 06d7e01926a9..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/confidential_computing.rst +++ /dev/null @@ -1,6 +0,0 @@ -ConfidentialComputing ---------------------------------------- - -.. automodule:: google.cloud.confidentialcomputing_v1.services.confidential_computing - :members: - :inherited-members: diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/services_.rst b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/services_.rst deleted file mode 100644 index 0e44260b2eae..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/services_.rst +++ /dev/null @@ -1,6 +0,0 @@ -Services for Google Cloud Confidentialcomputing v1 API -====================================================== -.. toctree:: - :maxdepth: 2 - - confidential_computing diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/types_.rst b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/types_.rst deleted file mode 100644 index ae5970c73d34..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/types_.rst +++ /dev/null @@ -1,6 +0,0 @@ -Types for Google Cloud Confidentialcomputing v1 API -=================================================== - -.. automodule:: google.cloud.confidentialcomputing_v1.types - :members: - :show-inheritance: diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/index.rst b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/index.rst deleted file mode 100644 index 0566de600bc8..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/index.rst +++ /dev/null @@ -1,10 +0,0 @@ -.. include:: multiprocessing.rst - - -API Reference -------------- -.. toctree:: - :maxdepth: 2 - - confidentialcomputing_v1/services_ - confidentialcomputing_v1/types_ diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/multiprocessing.rst b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/multiprocessing.rst deleted file mode 100644 index 536d17b2ea65..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/multiprocessing.rst +++ /dev/null @@ -1,7 +0,0 @@ -.. note:: - - Because this client uses :mod:`grpc` library, it is safe to - share instances across threads. In multiprocessing scenarios, the best - practice is to create client instances *after* the invocation of - :func:`os.fork` by :class:`multiprocessing.pool.Pool` or - :class:`multiprocessing.Process`. diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/__init__.py deleted file mode 100644 index 9dabe5d04bb0..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/__init__.py +++ /dev/null @@ -1,71 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -from google.cloud.confidentialcomputing import gapic_version as package_version - -__version__ = package_version.__version__ - - -from google.cloud.confidentialcomputing_v1.services.confidential_computing.client import ConfidentialComputingClient -from google.cloud.confidentialcomputing_v1.services.confidential_computing.async_client import ConfidentialComputingAsyncClient - -from google.cloud.confidentialcomputing_v1.types.service import AwsPrincipalTagsOptions -from google.cloud.confidentialcomputing_v1.types.service import Challenge -from google.cloud.confidentialcomputing_v1.types.service import ConfidentialSpaceInfo -from google.cloud.confidentialcomputing_v1.types.service import ContainerImageSignature -from google.cloud.confidentialcomputing_v1.types.service import CreateChallengeRequest -from google.cloud.confidentialcomputing_v1.types.service import GceShieldedIdentity -from google.cloud.confidentialcomputing_v1.types.service import GcpCredentials -from google.cloud.confidentialcomputing_v1.types.service import SevSnpAttestation -from google.cloud.confidentialcomputing_v1.types.service import SignedEntity -from google.cloud.confidentialcomputing_v1.types.service import TdxCcelAttestation -from google.cloud.confidentialcomputing_v1.types.service import TokenOptions -from google.cloud.confidentialcomputing_v1.types.service import TpmAttestation -from google.cloud.confidentialcomputing_v1.types.service import VerifyAttestationRequest -from google.cloud.confidentialcomputing_v1.types.service import VerifyAttestationResponse -from google.cloud.confidentialcomputing_v1.types.service import VerifyConfidentialGkeRequest -from google.cloud.confidentialcomputing_v1.types.service import VerifyConfidentialGkeResponse -from google.cloud.confidentialcomputing_v1.types.service import VerifyConfidentialSpaceRequest -from google.cloud.confidentialcomputing_v1.types.service import VerifyConfidentialSpaceResponse -from google.cloud.confidentialcomputing_v1.types.service import SignatureType -from google.cloud.confidentialcomputing_v1.types.service import SigningAlgorithm -from google.cloud.confidentialcomputing_v1.types.service import TokenProfile -from google.cloud.confidentialcomputing_v1.types.service import TokenType - -__all__ = ('ConfidentialComputingClient', - 'ConfidentialComputingAsyncClient', - 'AwsPrincipalTagsOptions', - 'Challenge', - 'ConfidentialSpaceInfo', - 'ContainerImageSignature', - 'CreateChallengeRequest', - 'GceShieldedIdentity', - 'GcpCredentials', - 'SevSnpAttestation', - 'SignedEntity', - 'TdxCcelAttestation', - 'TokenOptions', - 'TpmAttestation', - 'VerifyAttestationRequest', - 'VerifyAttestationResponse', - 'VerifyConfidentialGkeRequest', - 'VerifyConfidentialGkeResponse', - 'VerifyConfidentialSpaceRequest', - 'VerifyConfidentialSpaceResponse', - 'SignatureType', - 'SigningAlgorithm', - 'TokenProfile', - 'TokenType', -) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/gapic_version.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/gapic_version.py deleted file mode 100644 index 20a9cd975b02..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/gapic_version.py +++ /dev/null @@ -1,16 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -__version__ = "0.0.0" # {x-release-please-version} diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/py.typed b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/py.typed deleted file mode 100644 index 5e085fa19b06..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/py.typed +++ /dev/null @@ -1,2 +0,0 @@ -# Marker file for PEP 561. -# The google-cloud-confidentialcomputing package uses inline types. diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/__init__.py deleted file mode 100644 index 2674431e4ee1..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/__init__.py +++ /dev/null @@ -1,72 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -from google.cloud.confidentialcomputing_v1 import gapic_version as package_version - -__version__ = package_version.__version__ - - -from .services.confidential_computing import ConfidentialComputingClient -from .services.confidential_computing import ConfidentialComputingAsyncClient - -from .types.service import AwsPrincipalTagsOptions -from .types.service import Challenge -from .types.service import ConfidentialSpaceInfo -from .types.service import ContainerImageSignature -from .types.service import CreateChallengeRequest -from .types.service import GceShieldedIdentity -from .types.service import GcpCredentials -from .types.service import SevSnpAttestation -from .types.service import SignedEntity -from .types.service import TdxCcelAttestation -from .types.service import TokenOptions -from .types.service import TpmAttestation -from .types.service import VerifyAttestationRequest -from .types.service import VerifyAttestationResponse -from .types.service import VerifyConfidentialGkeRequest -from .types.service import VerifyConfidentialGkeResponse -from .types.service import VerifyConfidentialSpaceRequest -from .types.service import VerifyConfidentialSpaceResponse -from .types.service import SignatureType -from .types.service import SigningAlgorithm -from .types.service import TokenProfile -from .types.service import TokenType - -__all__ = ( - 'ConfidentialComputingAsyncClient', -'AwsPrincipalTagsOptions', -'Challenge', -'ConfidentialComputingClient', -'ConfidentialSpaceInfo', -'ContainerImageSignature', -'CreateChallengeRequest', -'GceShieldedIdentity', -'GcpCredentials', -'SevSnpAttestation', -'SignatureType', -'SignedEntity', -'SigningAlgorithm', -'TdxCcelAttestation', -'TokenOptions', -'TokenProfile', -'TokenType', -'TpmAttestation', -'VerifyAttestationRequest', -'VerifyAttestationResponse', -'VerifyConfidentialGkeRequest', -'VerifyConfidentialGkeResponse', -'VerifyConfidentialSpaceRequest', -'VerifyConfidentialSpaceResponse', -) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/gapic_metadata.json b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/gapic_metadata.json deleted file mode 100644 index 5227e556513e..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/gapic_metadata.json +++ /dev/null @@ -1,88 +0,0 @@ - { - "comment": "This file maps proto services/RPCs to the corresponding library clients/methods", - "language": "python", - "libraryPackage": "google.cloud.confidentialcomputing_v1", - "protoPackage": "google.cloud.confidentialcomputing.v1", - "schema": "1.0", - "services": { - "ConfidentialComputing": { - "clients": { - "grpc": { - "libraryClient": "ConfidentialComputingClient", - "rpcs": { - "CreateChallenge": { - "methods": [ - "create_challenge" - ] - }, - "VerifyAttestation": { - "methods": [ - "verify_attestation" - ] - }, - "VerifyConfidentialGke": { - "methods": [ - "verify_confidential_gke" - ] - }, - "VerifyConfidentialSpace": { - "methods": [ - "verify_confidential_space" - ] - } - } - }, - "grpc-async": { - "libraryClient": "ConfidentialComputingAsyncClient", - "rpcs": { - "CreateChallenge": { - "methods": [ - "create_challenge" - ] - }, - "VerifyAttestation": { - "methods": [ - "verify_attestation" - ] - }, - "VerifyConfidentialGke": { - "methods": [ - "verify_confidential_gke" - ] - }, - "VerifyConfidentialSpace": { - "methods": [ - "verify_confidential_space" - ] - } - } - }, - "rest": { - "libraryClient": "ConfidentialComputingClient", - "rpcs": { - "CreateChallenge": { - "methods": [ - "create_challenge" - ] - }, - "VerifyAttestation": { - "methods": [ - "verify_attestation" - ] - }, - "VerifyConfidentialGke": { - "methods": [ - "verify_confidential_gke" - ] - }, - "VerifyConfidentialSpace": { - "methods": [ - "verify_confidential_space" - ] - } - } - } - } - } - } -} diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/gapic_version.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/gapic_version.py deleted file mode 100644 index 20a9cd975b02..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/gapic_version.py +++ /dev/null @@ -1,16 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -__version__ = "0.0.0" # {x-release-please-version} diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/py.typed b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/py.typed deleted file mode 100644 index 5e085fa19b06..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/py.typed +++ /dev/null @@ -1,2 +0,0 @@ -# Marker file for PEP 561. -# The google-cloud-confidentialcomputing package uses inline types. diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/__init__.py deleted file mode 100644 index cbf94b283c70..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/__init__.py +++ /dev/null @@ -1,15 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/__init__.py deleted file mode 100644 index 000ad9033f05..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/__init__.py +++ /dev/null @@ -1,22 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -from .client import ConfidentialComputingClient -from .async_client import ConfidentialComputingAsyncClient - -__all__ = ( - 'ConfidentialComputingClient', - 'ConfidentialComputingAsyncClient', -) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/async_client.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/async_client.py deleted file mode 100644 index 97512c2a575f..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/async_client.py +++ /dev/null @@ -1,760 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -import logging as std_logging -from collections import OrderedDict -import re -from typing import Dict, Callable, Mapping, MutableMapping, MutableSequence, Optional, Sequence, Tuple, Type, Union - -from google.cloud.confidentialcomputing_v1 import gapic_version as package_version - -from google.api_core.client_options import ClientOptions -from google.api_core import exceptions as core_exceptions -from google.api_core import gapic_v1 -from google.api_core import retry_async as retries -from google.auth import credentials as ga_credentials # type: ignore -from google.oauth2 import service_account # type: ignore -import google.protobuf - - -try: - OptionalRetry = Union[retries.AsyncRetry, gapic_v1.method._MethodDefault, None] -except AttributeError: # pragma: NO COVER - OptionalRetry = Union[retries.AsyncRetry, object, None] # type: ignore - -from google.cloud.confidentialcomputing_v1.types import service -from google.cloud.location import locations_pb2 # type: ignore -from google.protobuf import timestamp_pb2 # type: ignore -from google.rpc import status_pb2 # type: ignore -from .transports.base import ConfidentialComputingTransport, DEFAULT_CLIENT_INFO -from .transports.grpc_asyncio import ConfidentialComputingGrpcAsyncIOTransport -from .client import ConfidentialComputingClient - -try: - from google.api_core import client_logging # type: ignore - CLIENT_LOGGING_SUPPORTED = True # pragma: NO COVER -except ImportError: # pragma: NO COVER - CLIENT_LOGGING_SUPPORTED = False - -_LOGGER = std_logging.getLogger(__name__) - -class ConfidentialComputingAsyncClient: - """Service describing handlers for resources""" - - _client: ConfidentialComputingClient - - # Copy defaults from the synchronous client for use here. - # Note: DEFAULT_ENDPOINT is deprecated. Use _DEFAULT_ENDPOINT_TEMPLATE instead. - DEFAULT_ENDPOINT = ConfidentialComputingClient.DEFAULT_ENDPOINT - DEFAULT_MTLS_ENDPOINT = ConfidentialComputingClient.DEFAULT_MTLS_ENDPOINT - _DEFAULT_ENDPOINT_TEMPLATE = ConfidentialComputingClient._DEFAULT_ENDPOINT_TEMPLATE - _DEFAULT_UNIVERSE = ConfidentialComputingClient._DEFAULT_UNIVERSE - - challenge_path = staticmethod(ConfidentialComputingClient.challenge_path) - parse_challenge_path = staticmethod(ConfidentialComputingClient.parse_challenge_path) - common_billing_account_path = staticmethod(ConfidentialComputingClient.common_billing_account_path) - parse_common_billing_account_path = staticmethod(ConfidentialComputingClient.parse_common_billing_account_path) - common_folder_path = staticmethod(ConfidentialComputingClient.common_folder_path) - parse_common_folder_path = staticmethod(ConfidentialComputingClient.parse_common_folder_path) - common_organization_path = staticmethod(ConfidentialComputingClient.common_organization_path) - parse_common_organization_path = staticmethod(ConfidentialComputingClient.parse_common_organization_path) - common_project_path = staticmethod(ConfidentialComputingClient.common_project_path) - parse_common_project_path = staticmethod(ConfidentialComputingClient.parse_common_project_path) - common_location_path = staticmethod(ConfidentialComputingClient.common_location_path) - parse_common_location_path = staticmethod(ConfidentialComputingClient.parse_common_location_path) - - @classmethod - def from_service_account_info(cls, info: dict, *args, **kwargs): - """Creates an instance of this client using the provided credentials - info. - - Args: - info (dict): The service account private key info. - args: Additional arguments to pass to the constructor. - kwargs: Additional arguments to pass to the constructor. - - Returns: - ConfidentialComputingAsyncClient: The constructed client. - """ - return ConfidentialComputingClient.from_service_account_info.__func__(ConfidentialComputingAsyncClient, info, *args, **kwargs) # type: ignore - - @classmethod - def from_service_account_file(cls, filename: str, *args, **kwargs): - """Creates an instance of this client using the provided credentials - file. - - Args: - filename (str): The path to the service account private key json - file. - args: Additional arguments to pass to the constructor. - kwargs: Additional arguments to pass to the constructor. - - Returns: - ConfidentialComputingAsyncClient: The constructed client. - """ - return ConfidentialComputingClient.from_service_account_file.__func__(ConfidentialComputingAsyncClient, filename, *args, **kwargs) # type: ignore - - from_service_account_json = from_service_account_file - - @classmethod - def get_mtls_endpoint_and_cert_source(cls, client_options: Optional[ClientOptions] = None): - """Return the API endpoint and client cert source for mutual TLS. - - The client cert source is determined in the following order: - (1) if `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is not "true", the - client cert source is None. - (2) if `client_options.client_cert_source` is provided, use the provided one; if the - default client cert source exists, use the default one; otherwise the client cert - source is None. - - The API endpoint is determined in the following order: - (1) if `client_options.api_endpoint` if provided, use the provided one. - (2) if `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is "always", use the - default mTLS endpoint; if the environment variable is "never", use the default API - endpoint; otherwise if client cert source exists, use the default mTLS endpoint, otherwise - use the default API endpoint. - - More details can be found at https://google.aip.dev/auth/4114. - - Args: - client_options (google.api_core.client_options.ClientOptions): Custom options for the - client. Only the `api_endpoint` and `client_cert_source` properties may be used - in this method. - - Returns: - Tuple[str, Callable[[], Tuple[bytes, bytes]]]: returns the API endpoint and the - client cert source to use. - - Raises: - google.auth.exceptions.MutualTLSChannelError: If any errors happen. - """ - return ConfidentialComputingClient.get_mtls_endpoint_and_cert_source(client_options) # type: ignore - - @property - def transport(self) -> ConfidentialComputingTransport: - """Returns the transport used by the client instance. - - Returns: - ConfidentialComputingTransport: The transport used by the client instance. - """ - return self._client.transport - - @property - def api_endpoint(self): - """Return the API endpoint used by the client instance. - - Returns: - str: The API endpoint used by the client instance. - """ - return self._client._api_endpoint - - @property - def universe_domain(self) -> str: - """Return the universe domain used by the client instance. - - Returns: - str: The universe domain used - by the client instance. - """ - return self._client._universe_domain - - get_transport_class = ConfidentialComputingClient.get_transport_class - - def __init__(self, *, - credentials: Optional[ga_credentials.Credentials] = None, - transport: Optional[Union[str, ConfidentialComputingTransport, Callable[..., ConfidentialComputingTransport]]] = "grpc_asyncio", - client_options: Optional[ClientOptions] = None, - client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO, - ) -> None: - """Instantiates the confidential computing async client. - - Args: - credentials (Optional[google.auth.credentials.Credentials]): The - authorization credentials to attach to requests. These - credentials identify the application to the service; if none - are specified, the client will attempt to ascertain the - credentials from the environment. - transport (Optional[Union[str,ConfidentialComputingTransport,Callable[..., ConfidentialComputingTransport]]]): - The transport to use, or a Callable that constructs and returns a new transport to use. - If a Callable is given, it will be called with the same set of initialization - arguments as used in the ConfidentialComputingTransport constructor. - If set to None, a transport is chosen automatically. - client_options (Optional[Union[google.api_core.client_options.ClientOptions, dict]]): - Custom options for the client. - - 1. The ``api_endpoint`` property can be used to override the - default endpoint provided by the client when ``transport`` is - not explicitly provided. Only if this property is not set and - ``transport`` was not explicitly provided, the endpoint is - determined by the GOOGLE_API_USE_MTLS_ENDPOINT environment - variable, which have one of the following values: - "always" (always use the default mTLS endpoint), "never" (always - use the default regular endpoint) and "auto" (auto-switch to the - default mTLS endpoint if client certificate is present; this is - the default value). - - 2. If the GOOGLE_API_USE_CLIENT_CERTIFICATE environment variable - is "true", then the ``client_cert_source`` property can be used - to provide a client certificate for mTLS transport. If - not provided, the default SSL client certificate will be used if - present. If GOOGLE_API_USE_CLIENT_CERTIFICATE is "false" or not - set, no client certificate will be used. - - 3. The ``universe_domain`` property can be used to override the - default "googleapis.com" universe. Note that ``api_endpoint`` - property still takes precedence; and ``universe_domain`` is - currently not supported for mTLS. - - client_info (google.api_core.gapic_v1.client_info.ClientInfo): - The client info used to send a user-agent string along with - API requests. If ``None``, then default info will be used. - Generally, you only need to set this if you're developing - your own client library. - - Raises: - google.auth.exceptions.MutualTlsChannelError: If mutual TLS transport - creation failed for any reason. - """ - self._client = ConfidentialComputingClient( - credentials=credentials, - transport=transport, - client_options=client_options, - client_info=client_info, - - ) - - if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(std_logging.DEBUG): # pragma: NO COVER - _LOGGER.debug( - "Created client `google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient`.", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "universeDomain": getattr(self._client._transport._credentials, "universe_domain", ""), - "credentialsType": f"{type(self._client._transport._credentials).__module__}.{type(self._client._transport._credentials).__qualname__}", - "credentialsInfo": getattr(self.transport._credentials, "get_cred_info", lambda: None)(), - } if hasattr(self._client._transport, "_credentials") else { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "credentialsType": None, - } - ) - - async def create_challenge(self, - request: Optional[Union[service.CreateChallengeRequest, dict]] = None, - *, - parent: Optional[str] = None, - challenge: Optional[service.Challenge] = None, - retry: OptionalRetry = gapic_v1.method.DEFAULT, - timeout: Union[float, object] = gapic_v1.method.DEFAULT, - metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), - ) -> service.Challenge: - r"""Creates a new Challenge in a given project and - location. - - .. code-block:: python - - # This snippet has been automatically generated and should be regarded as a - # code template only. - # It will require modifications to work: - # - It may require correct/in-range values for request initialization. - # - It may require specifying regional endpoints when creating the service - # client as shown in: - # https://googleapis.dev/python/google-api-core/latest/client_options.html - from google.cloud import confidentialcomputing_v1 - - async def sample_create_challenge(): - # Create a client - client = confidentialcomputing_v1.ConfidentialComputingAsyncClient() - - # Initialize request argument(s) - request = confidentialcomputing_v1.CreateChallengeRequest( - parent="parent_value", - ) - - # Make the request - response = await client.create_challenge(request=request) - - # Handle the response - print(response) - - Args: - request (Optional[Union[google.cloud.confidentialcomputing_v1.types.CreateChallengeRequest, dict]]): - The request object. Message for creating a Challenge - parent (:class:`str`): - Required. The resource name of the location where the - Challenge will be used, in the format - ``projects/*/locations/*``. - - This corresponds to the ``parent`` field - on the ``request`` instance; if ``request`` is provided, this - should not be set. - challenge (:class:`google.cloud.confidentialcomputing_v1.types.Challenge`): - Required. The Challenge to be - created. Currently this field can be - empty as all the Challenge fields are - set by the server. - - This corresponds to the ``challenge`` field - on the ``request`` instance; if ``request`` is provided, this - should not be set. - retry (google.api_core.retry_async.AsyncRetry): Designation of what errors, if any, - should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - - Returns: - google.cloud.confidentialcomputing_v1.types.Challenge: - A Challenge from the server used to - guarantee freshness of attestations - - """ - # Create or coerce a protobuf request object. - # - Quick check: If we got a request object, we should *not* have - # gotten any keyword arguments that map to the request. - flattened_params = [parent, challenge] - has_flattened_params = len([param for param in flattened_params if param is not None]) > 0 - if request is not None and has_flattened_params: - raise ValueError("If the `request` argument is set, then none of " - "the individual field arguments should be set.") - - # - Use the request object if provided (there's no risk of modifying the input as - # there are no flattened fields), or create one. - if not isinstance(request, service.CreateChallengeRequest): - request = service.CreateChallengeRequest(request) - - # If we have keyword arguments corresponding to fields on the - # request, apply these. - if parent is not None: - request.parent = parent - if challenge is not None: - request.challenge = challenge - - # Wrap the RPC method; this adds retry and timeout information, - # and friendly error handling. - rpc = self._client._transport._wrapped_methods[self._client._transport.create_challenge] - - # Certain fields should be provided within the metadata header; - # add these here. - metadata = tuple(metadata) + ( - gapic_v1.routing_header.to_grpc_metadata(( - ("parent", request.parent), - )), - ) - - # Validate the universe domain. - self._client._validate_universe_domain() - - # Send the request. - response = await rpc( - request, - retry=retry, - timeout=timeout, - metadata=metadata, - ) - - # Done; return the response. - return response - - async def verify_attestation(self, - request: Optional[Union[service.VerifyAttestationRequest, dict]] = None, - *, - retry: OptionalRetry = gapic_v1.method.DEFAULT, - timeout: Union[float, object] = gapic_v1.method.DEFAULT, - metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), - ) -> service.VerifyAttestationResponse: - r"""Verifies the provided attestation info, returning a - signed attestation token. - - .. code-block:: python - - # This snippet has been automatically generated and should be regarded as a - # code template only. - # It will require modifications to work: - # - It may require correct/in-range values for request initialization. - # - It may require specifying regional endpoints when creating the service - # client as shown in: - # https://googleapis.dev/python/google-api-core/latest/client_options.html - from google.cloud import confidentialcomputing_v1 - - async def sample_verify_attestation(): - # Create a client - client = confidentialcomputing_v1.ConfidentialComputingAsyncClient() - - # Initialize request argument(s) - request = confidentialcomputing_v1.VerifyAttestationRequest( - challenge="challenge_value", - ) - - # Make the request - response = await client.verify_attestation(request=request) - - # Handle the response - print(response) - - Args: - request (Optional[Union[google.cloud.confidentialcomputing_v1.types.VerifyAttestationRequest, dict]]): - The request object. A request for an attestation token, - providing all the necessary information - needed for this service to verify the - platform state of the requestor. - retry (google.api_core.retry_async.AsyncRetry): Designation of what errors, if any, - should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - - Returns: - google.cloud.confidentialcomputing_v1.types.VerifyAttestationResponse: - A response once an attestation has - been successfully verified, containing a - signed attestation token. - - """ - # Create or coerce a protobuf request object. - # - Use the request object if provided (there's no risk of modifying the input as - # there are no flattened fields), or create one. - if not isinstance(request, service.VerifyAttestationRequest): - request = service.VerifyAttestationRequest(request) - - # Wrap the RPC method; this adds retry and timeout information, - # and friendly error handling. - rpc = self._client._transport._wrapped_methods[self._client._transport.verify_attestation] - - # Certain fields should be provided within the metadata header; - # add these here. - metadata = tuple(metadata) + ( - gapic_v1.routing_header.to_grpc_metadata(( - ("challenge", request.challenge), - )), - ) - - # Validate the universe domain. - self._client._validate_universe_domain() - - # Send the request. - response = await rpc( - request, - retry=retry, - timeout=timeout, - metadata=metadata, - ) - - # Done; return the response. - return response - - async def verify_confidential_space(self, - request: Optional[Union[service.VerifyConfidentialSpaceRequest, dict]] = None, - *, - retry: OptionalRetry = gapic_v1.method.DEFAULT, - timeout: Union[float, object] = gapic_v1.method.DEFAULT, - metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), - ) -> service.VerifyConfidentialSpaceResponse: - r"""Verifies whether the provided attestation info is - valid, returning a signed attestation token if so. - - .. code-block:: python - - # This snippet has been automatically generated and should be regarded as a - # code template only. - # It will require modifications to work: - # - It may require correct/in-range values for request initialization. - # - It may require specifying regional endpoints when creating the service - # client as shown in: - # https://googleapis.dev/python/google-api-core/latest/client_options.html - from google.cloud import confidentialcomputing_v1 - - async def sample_verify_confidential_space(): - # Create a client - client = confidentialcomputing_v1.ConfidentialComputingAsyncClient() - - # Initialize request argument(s) - request = confidentialcomputing_v1.VerifyConfidentialSpaceRequest( - challenge="challenge_value", - ) - - # Make the request - response = await client.verify_confidential_space(request=request) - - # Handle the response - print(response) - - Args: - request (Optional[Union[google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceRequest, dict]]): - The request object. A request for an attestation token, - providing all the necessary information - needed for this service to verify the - platform state of the requestor. - retry (google.api_core.retry_async.AsyncRetry): Designation of what errors, if any, - should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - - Returns: - google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceResponse: - VerifyConfidentialSpaceResponse is - returned once a Confidential Space - attestation has been successfully - verified, containing a signed token. - - """ - # Create or coerce a protobuf request object. - # - Use the request object if provided (there's no risk of modifying the input as - # there are no flattened fields), or create one. - if not isinstance(request, service.VerifyConfidentialSpaceRequest): - request = service.VerifyConfidentialSpaceRequest(request) - - # Wrap the RPC method; this adds retry and timeout information, - # and friendly error handling. - rpc = self._client._transport._wrapped_methods[self._client._transport.verify_confidential_space] - - # Certain fields should be provided within the metadata header; - # add these here. - metadata = tuple(metadata) + ( - gapic_v1.routing_header.to_grpc_metadata(( - ("challenge", request.challenge), - )), - ) - - # Validate the universe domain. - self._client._validate_universe_domain() - - # Send the request. - response = await rpc( - request, - retry=retry, - timeout=timeout, - metadata=metadata, - ) - - # Done; return the response. - return response - - async def verify_confidential_gke(self, - request: Optional[Union[service.VerifyConfidentialGkeRequest, dict]] = None, - *, - retry: OptionalRetry = gapic_v1.method.DEFAULT, - timeout: Union[float, object] = gapic_v1.method.DEFAULT, - metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), - ) -> service.VerifyConfidentialGkeResponse: - r"""Verifies the provided Confidential GKE attestation - info, returning a signed OIDC token. - - .. code-block:: python - - # This snippet has been automatically generated and should be regarded as a - # code template only. - # It will require modifications to work: - # - It may require correct/in-range values for request initialization. - # - It may require specifying regional endpoints when creating the service - # client as shown in: - # https://googleapis.dev/python/google-api-core/latest/client_options.html - from google.cloud import confidentialcomputing_v1 - - async def sample_verify_confidential_gke(): - # Create a client - client = confidentialcomputing_v1.ConfidentialComputingAsyncClient() - - # Initialize request argument(s) - request = confidentialcomputing_v1.VerifyConfidentialGkeRequest( - challenge="challenge_value", - ) - - # Make the request - response = await client.verify_confidential_gke(request=request) - - # Handle the response - print(response) - - Args: - request (Optional[Union[google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeRequest, dict]]): - The request object. A request for an attestation token, - providing all the necessary information - needed for this service to verify - Confidential GKE platform state of the - requestor. - retry (google.api_core.retry_async.AsyncRetry): Designation of what errors, if any, - should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - - Returns: - google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeResponse: - VerifyConfidentialGkeResponse - response is returened once a - Confidential GKE attestation has been - successfully verified, containing a - signed OIDC token. - - """ - # Create or coerce a protobuf request object. - # - Use the request object if provided (there's no risk of modifying the input as - # there are no flattened fields), or create one. - if not isinstance(request, service.VerifyConfidentialGkeRequest): - request = service.VerifyConfidentialGkeRequest(request) - - # Wrap the RPC method; this adds retry and timeout information, - # and friendly error handling. - rpc = self._client._transport._wrapped_methods[self._client._transport.verify_confidential_gke] - - # Certain fields should be provided within the metadata header; - # add these here. - metadata = tuple(metadata) + ( - gapic_v1.routing_header.to_grpc_metadata(( - ("challenge", request.challenge), - )), - ) - - # Validate the universe domain. - self._client._validate_universe_domain() - - # Send the request. - response = await rpc( - request, - retry=retry, - timeout=timeout, - metadata=metadata, - ) - - # Done; return the response. - return response - - async def get_location( - self, - request: Optional[locations_pb2.GetLocationRequest] = None, - *, - retry: OptionalRetry = gapic_v1.method.DEFAULT, - timeout: Union[float, object] = gapic_v1.method.DEFAULT, - metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), - ) -> locations_pb2.Location: - r"""Gets information about a location. - - Args: - request (:class:`~.location_pb2.GetLocationRequest`): - The request object. Request message for - `GetLocation` method. - retry (google.api_core.retry_async.AsyncRetry): Designation of what errors, - if any, should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - Returns: - ~.location_pb2.Location: - Location object. - """ - # Create or coerce a protobuf request object. - # The request isn't a proto-plus wrapped type, - # so it must be constructed via keyword expansion. - if isinstance(request, dict): - request = locations_pb2.GetLocationRequest(**request) - - # Wrap the RPC method; this adds retry and timeout information, - # and friendly error handling. - rpc = self.transport._wrapped_methods[self._client._transport.get_location] - - # Certain fields should be provided within the metadata header; - # add these here. - metadata = tuple(metadata) + ( - gapic_v1.routing_header.to_grpc_metadata( - (("name", request.name),)), - ) - - # Validate the universe domain. - self._client._validate_universe_domain() - - # Send the request. - response = await rpc( - request, retry=retry, timeout=timeout, metadata=metadata,) - - # Done; return the response. - return response - - async def list_locations( - self, - request: Optional[locations_pb2.ListLocationsRequest] = None, - *, - retry: OptionalRetry = gapic_v1.method.DEFAULT, - timeout: Union[float, object] = gapic_v1.method.DEFAULT, - metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), - ) -> locations_pb2.ListLocationsResponse: - r"""Lists information about the supported locations for this service. - - Args: - request (:class:`~.location_pb2.ListLocationsRequest`): - The request object. Request message for - `ListLocations` method. - retry (google.api_core.retry_async.AsyncRetry): Designation of what errors, - if any, should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - Returns: - ~.location_pb2.ListLocationsResponse: - Response message for ``ListLocations`` method. - """ - # Create or coerce a protobuf request object. - # The request isn't a proto-plus wrapped type, - # so it must be constructed via keyword expansion. - if isinstance(request, dict): - request = locations_pb2.ListLocationsRequest(**request) - - # Wrap the RPC method; this adds retry and timeout information, - # and friendly error handling. - rpc = self.transport._wrapped_methods[self._client._transport.list_locations] - - # Certain fields should be provided within the metadata header; - # add these here. - metadata = tuple(metadata) + ( - gapic_v1.routing_header.to_grpc_metadata( - (("name", request.name),)), - ) - - # Validate the universe domain. - self._client._validate_universe_domain() - - # Send the request. - response = await rpc( - request, retry=retry, timeout=timeout, metadata=metadata,) - - # Done; return the response. - return response - - async def __aenter__(self) -> "ConfidentialComputingAsyncClient": - return self - - async def __aexit__(self, exc_type, exc, tb): - await self.transport.close() - -DEFAULT_CLIENT_INFO = gapic_v1.client_info.ClientInfo(gapic_version=package_version.__version__) - -if hasattr(DEFAULT_CLIENT_INFO, "protobuf_runtime_version"): # pragma: NO COVER - DEFAULT_CLIENT_INFO.protobuf_runtime_version = google.protobuf.__version__ - - -__all__ = ( - "ConfidentialComputingAsyncClient", -) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/client.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/client.py deleted file mode 100644 index b269902f541e..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/client.py +++ /dev/null @@ -1,1123 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -from collections import OrderedDict -from http import HTTPStatus -import json -import logging as std_logging -import os -import re -from typing import Dict, Callable, Mapping, MutableMapping, MutableSequence, Optional, Sequence, Tuple, Type, Union, cast -import warnings - -from google.cloud.confidentialcomputing_v1 import gapic_version as package_version - -from google.api_core import client_options as client_options_lib -from google.api_core import exceptions as core_exceptions -from google.api_core import gapic_v1 -from google.api_core import retry as retries -from google.auth import credentials as ga_credentials # type: ignore -from google.auth.transport import mtls # type: ignore -from google.auth.transport.grpc import SslCredentials # type: ignore -from google.auth.exceptions import MutualTLSChannelError # type: ignore -from google.oauth2 import service_account # type: ignore -import google.protobuf - -try: - OptionalRetry = Union[retries.Retry, gapic_v1.method._MethodDefault, None] -except AttributeError: # pragma: NO COVER - OptionalRetry = Union[retries.Retry, object, None] # type: ignore - -try: - from google.api_core import client_logging # type: ignore - CLIENT_LOGGING_SUPPORTED = True # pragma: NO COVER -except ImportError: # pragma: NO COVER - CLIENT_LOGGING_SUPPORTED = False - -_LOGGER = std_logging.getLogger(__name__) - -from google.cloud.confidentialcomputing_v1.types import service -from google.cloud.location import locations_pb2 # type: ignore -from google.protobuf import timestamp_pb2 # type: ignore -from google.rpc import status_pb2 # type: ignore -from .transports.base import ConfidentialComputingTransport, DEFAULT_CLIENT_INFO -from .transports.grpc import ConfidentialComputingGrpcTransport -from .transports.grpc_asyncio import ConfidentialComputingGrpcAsyncIOTransport -from .transports.rest import ConfidentialComputingRestTransport - - -class ConfidentialComputingClientMeta(type): - """Metaclass for the ConfidentialComputing client. - - This provides class-level methods for building and retrieving - support objects (e.g. transport) without polluting the client instance - objects. - """ - _transport_registry = OrderedDict() # type: Dict[str, Type[ConfidentialComputingTransport]] - _transport_registry["grpc"] = ConfidentialComputingGrpcTransport - _transport_registry["grpc_asyncio"] = ConfidentialComputingGrpcAsyncIOTransport - _transport_registry["rest"] = ConfidentialComputingRestTransport - - def get_transport_class(cls, - label: Optional[str] = None, - ) -> Type[ConfidentialComputingTransport]: - """Returns an appropriate transport class. - - Args: - label: The name of the desired transport. If none is - provided, then the first transport in the registry is used. - - Returns: - The transport class to use. - """ - # If a specific transport is requested, return that one. - if label: - return cls._transport_registry[label] - - # No transport is requested; return the default (that is, the first one - # in the dictionary). - return next(iter(cls._transport_registry.values())) - - -class ConfidentialComputingClient(metaclass=ConfidentialComputingClientMeta): - """Service describing handlers for resources""" - - @staticmethod - def _get_default_mtls_endpoint(api_endpoint): - """Converts api endpoint to mTLS endpoint. - - Convert "*.sandbox.googleapis.com" and "*.googleapis.com" to - "*.mtls.sandbox.googleapis.com" and "*.mtls.googleapis.com" respectively. - Args: - api_endpoint (Optional[str]): the api endpoint to convert. - Returns: - str: converted mTLS api endpoint. - """ - if not api_endpoint: - return api_endpoint - - mtls_endpoint_re = re.compile( - r"(?P[^.]+)(?P\.mtls)?(?P\.sandbox)?(?P\.googleapis\.com)?" - ) - - m = mtls_endpoint_re.match(api_endpoint) - name, mtls, sandbox, googledomain = m.groups() - if mtls or not googledomain: - return api_endpoint - - if sandbox: - return api_endpoint.replace( - "sandbox.googleapis.com", "mtls.sandbox.googleapis.com" - ) - - return api_endpoint.replace(".googleapis.com", ".mtls.googleapis.com") - - # Note: DEFAULT_ENDPOINT is deprecated. Use _DEFAULT_ENDPOINT_TEMPLATE instead. - DEFAULT_ENDPOINT = "confidentialcomputing.googleapis.com" - DEFAULT_MTLS_ENDPOINT = _get_default_mtls_endpoint.__func__( # type: ignore - DEFAULT_ENDPOINT - ) - - _DEFAULT_ENDPOINT_TEMPLATE = "confidentialcomputing.{UNIVERSE_DOMAIN}" - _DEFAULT_UNIVERSE = "googleapis.com" - - @classmethod - def from_service_account_info(cls, info: dict, *args, **kwargs): - """Creates an instance of this client using the provided credentials - info. - - Args: - info (dict): The service account private key info. - args: Additional arguments to pass to the constructor. - kwargs: Additional arguments to pass to the constructor. - - Returns: - ConfidentialComputingClient: The constructed client. - """ - credentials = service_account.Credentials.from_service_account_info(info) - kwargs["credentials"] = credentials - return cls(*args, **kwargs) - - @classmethod - def from_service_account_file(cls, filename: str, *args, **kwargs): - """Creates an instance of this client using the provided credentials - file. - - Args: - filename (str): The path to the service account private key json - file. - args: Additional arguments to pass to the constructor. - kwargs: Additional arguments to pass to the constructor. - - Returns: - ConfidentialComputingClient: The constructed client. - """ - credentials = service_account.Credentials.from_service_account_file( - filename) - kwargs["credentials"] = credentials - return cls(*args, **kwargs) - - from_service_account_json = from_service_account_file - - @property - def transport(self) -> ConfidentialComputingTransport: - """Returns the transport used by the client instance. - - Returns: - ConfidentialComputingTransport: The transport used by the client - instance. - """ - return self._transport - - @staticmethod - def challenge_path(project: str,location: str,uuid: str,) -> str: - """Returns a fully-qualified challenge string.""" - return "projects/{project}/locations/{location}/challenges/{uuid}".format(project=project, location=location, uuid=uuid, ) - - @staticmethod - def parse_challenge_path(path: str) -> Dict[str,str]: - """Parses a challenge path into its component segments.""" - m = re.match(r"^projects/(?P.+?)/locations/(?P.+?)/challenges/(?P.+?)$", path) - return m.groupdict() if m else {} - - @staticmethod - def common_billing_account_path(billing_account: str, ) -> str: - """Returns a fully-qualified billing_account string.""" - return "billingAccounts/{billing_account}".format(billing_account=billing_account, ) - - @staticmethod - def parse_common_billing_account_path(path: str) -> Dict[str,str]: - """Parse a billing_account path into its component segments.""" - m = re.match(r"^billingAccounts/(?P.+?)$", path) - return m.groupdict() if m else {} - - @staticmethod - def common_folder_path(folder: str, ) -> str: - """Returns a fully-qualified folder string.""" - return "folders/{folder}".format(folder=folder, ) - - @staticmethod - def parse_common_folder_path(path: str) -> Dict[str,str]: - """Parse a folder path into its component segments.""" - m = re.match(r"^folders/(?P.+?)$", path) - return m.groupdict() if m else {} - - @staticmethod - def common_organization_path(organization: str, ) -> str: - """Returns a fully-qualified organization string.""" - return "organizations/{organization}".format(organization=organization, ) - - @staticmethod - def parse_common_organization_path(path: str) -> Dict[str,str]: - """Parse a organization path into its component segments.""" - m = re.match(r"^organizations/(?P.+?)$", path) - return m.groupdict() if m else {} - - @staticmethod - def common_project_path(project: str, ) -> str: - """Returns a fully-qualified project string.""" - return "projects/{project}".format(project=project, ) - - @staticmethod - def parse_common_project_path(path: str) -> Dict[str,str]: - """Parse a project path into its component segments.""" - m = re.match(r"^projects/(?P.+?)$", path) - return m.groupdict() if m else {} - - @staticmethod - def common_location_path(project: str, location: str, ) -> str: - """Returns a fully-qualified location string.""" - return "projects/{project}/locations/{location}".format(project=project, location=location, ) - - @staticmethod - def parse_common_location_path(path: str) -> Dict[str,str]: - """Parse a location path into its component segments.""" - m = re.match(r"^projects/(?P.+?)/locations/(?P.+?)$", path) - return m.groupdict() if m else {} - - @classmethod - def get_mtls_endpoint_and_cert_source(cls, client_options: Optional[client_options_lib.ClientOptions] = None): - """Deprecated. Return the API endpoint and client cert source for mutual TLS. - - The client cert source is determined in the following order: - (1) if `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is not "true", the - client cert source is None. - (2) if `client_options.client_cert_source` is provided, use the provided one; if the - default client cert source exists, use the default one; otherwise the client cert - source is None. - - The API endpoint is determined in the following order: - (1) if `client_options.api_endpoint` if provided, use the provided one. - (2) if `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is "always", use the - default mTLS endpoint; if the environment variable is "never", use the default API - endpoint; otherwise if client cert source exists, use the default mTLS endpoint, otherwise - use the default API endpoint. - - More details can be found at https://google.aip.dev/auth/4114. - - Args: - client_options (google.api_core.client_options.ClientOptions): Custom options for the - client. Only the `api_endpoint` and `client_cert_source` properties may be used - in this method. - - Returns: - Tuple[str, Callable[[], Tuple[bytes, bytes]]]: returns the API endpoint and the - client cert source to use. - - Raises: - google.auth.exceptions.MutualTLSChannelError: If any errors happen. - """ - - warnings.warn("get_mtls_endpoint_and_cert_source is deprecated. Use the api_endpoint property instead.", - DeprecationWarning) - if client_options is None: - client_options = client_options_lib.ClientOptions() - use_client_cert = os.getenv("GOOGLE_API_USE_CLIENT_CERTIFICATE", "false") - use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto") - if use_client_cert not in ("true", "false"): - raise ValueError("Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`") - if use_mtls_endpoint not in ("auto", "never", "always"): - raise MutualTLSChannelError("Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`") - - # Figure out the client cert source to use. - client_cert_source = None - if use_client_cert == "true": - if client_options.client_cert_source: - client_cert_source = client_options.client_cert_source - elif mtls.has_default_client_cert_source(): - client_cert_source = mtls.default_client_cert_source() - - # Figure out which api endpoint to use. - if client_options.api_endpoint is not None: - api_endpoint = client_options.api_endpoint - elif use_mtls_endpoint == "always" or (use_mtls_endpoint == "auto" and client_cert_source): - api_endpoint = cls.DEFAULT_MTLS_ENDPOINT - else: - api_endpoint = cls.DEFAULT_ENDPOINT - - return api_endpoint, client_cert_source - - @staticmethod - def _read_environment_variables(): - """Returns the environment variables used by the client. - - Returns: - Tuple[bool, str, str]: returns the GOOGLE_API_USE_CLIENT_CERTIFICATE, - GOOGLE_API_USE_MTLS_ENDPOINT, and GOOGLE_CLOUD_UNIVERSE_DOMAIN environment variables. - - Raises: - ValueError: If GOOGLE_API_USE_CLIENT_CERTIFICATE is not - any of ["true", "false"]. - google.auth.exceptions.MutualTLSChannelError: If GOOGLE_API_USE_MTLS_ENDPOINT - is not any of ["auto", "never", "always"]. - """ - use_client_cert = os.getenv("GOOGLE_API_USE_CLIENT_CERTIFICATE", "false").lower() - use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower() - universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN") - if use_client_cert not in ("true", "false"): - raise ValueError("Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`") - if use_mtls_endpoint not in ("auto", "never", "always"): - raise MutualTLSChannelError("Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`") - return use_client_cert == "true", use_mtls_endpoint, universe_domain_env - - @staticmethod - def _get_client_cert_source(provided_cert_source, use_cert_flag): - """Return the client cert source to be used by the client. - - Args: - provided_cert_source (bytes): The client certificate source provided. - use_cert_flag (bool): A flag indicating whether to use the client certificate. - - Returns: - bytes or None: The client cert source to be used by the client. - """ - client_cert_source = None - if use_cert_flag: - if provided_cert_source: - client_cert_source = provided_cert_source - elif mtls.has_default_client_cert_source(): - client_cert_source = mtls.default_client_cert_source() - return client_cert_source - - @staticmethod - def _get_api_endpoint(api_override, client_cert_source, universe_domain, use_mtls_endpoint): - """Return the API endpoint used by the client. - - Args: - api_override (str): The API endpoint override. If specified, this is always - the return value of this function and the other arguments are not used. - client_cert_source (bytes): The client certificate source used by the client. - universe_domain (str): The universe domain used by the client. - use_mtls_endpoint (str): How to use the mTLS endpoint, which depends also on the other parameters. - Possible values are "always", "auto", or "never". - - Returns: - str: The API endpoint to be used by the client. - """ - if api_override is not None: - api_endpoint = api_override - elif use_mtls_endpoint == "always" or (use_mtls_endpoint == "auto" and client_cert_source): - _default_universe = ConfidentialComputingClient._DEFAULT_UNIVERSE - if universe_domain != _default_universe: - raise MutualTLSChannelError(f"mTLS is not supported in any universe other than {_default_universe}.") - api_endpoint = ConfidentialComputingClient.DEFAULT_MTLS_ENDPOINT - else: - api_endpoint = ConfidentialComputingClient._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=universe_domain) - return api_endpoint - - @staticmethod - def _get_universe_domain(client_universe_domain: Optional[str], universe_domain_env: Optional[str]) -> str: - """Return the universe domain used by the client. - - Args: - client_universe_domain (Optional[str]): The universe domain configured via the client options. - universe_domain_env (Optional[str]): The universe domain configured via the "GOOGLE_CLOUD_UNIVERSE_DOMAIN" environment variable. - - Returns: - str: The universe domain to be used by the client. - - Raises: - ValueError: If the universe domain is an empty string. - """ - universe_domain = ConfidentialComputingClient._DEFAULT_UNIVERSE - if client_universe_domain is not None: - universe_domain = client_universe_domain - elif universe_domain_env is not None: - universe_domain = universe_domain_env - if len(universe_domain.strip()) == 0: - raise ValueError("Universe Domain cannot be an empty string.") - return universe_domain - - def _validate_universe_domain(self): - """Validates client's and credentials' universe domains are consistent. - - Returns: - bool: True iff the configured universe domain is valid. - - Raises: - ValueError: If the configured universe domain is not valid. - """ - - # NOTE (b/349488459): universe validation is disabled until further notice. - return True - - def _add_cred_info_for_auth_errors( - self, - error: core_exceptions.GoogleAPICallError - ) -> None: - """Adds credential info string to error details for 401/403/404 errors. - - Args: - error (google.api_core.exceptions.GoogleAPICallError): The error to add the cred info. - """ - if error.code not in [HTTPStatus.UNAUTHORIZED, HTTPStatus.FORBIDDEN, HTTPStatus.NOT_FOUND]: - return - - cred = self._transport._credentials - - # get_cred_info is only available in google-auth>=2.35.0 - if not hasattr(cred, "get_cred_info"): - return - - # ignore the type check since pypy test fails when get_cred_info - # is not available - cred_info = cred.get_cred_info() # type: ignore - if cred_info and hasattr(error._details, "append"): - error._details.append(json.dumps(cred_info)) - - @property - def api_endpoint(self): - """Return the API endpoint used by the client instance. - - Returns: - str: The API endpoint used by the client instance. - """ - return self._api_endpoint - - @property - def universe_domain(self) -> str: - """Return the universe domain used by the client instance. - - Returns: - str: The universe domain used by the client instance. - """ - return self._universe_domain - - def __init__(self, *, - credentials: Optional[ga_credentials.Credentials] = None, - transport: Optional[Union[str, ConfidentialComputingTransport, Callable[..., ConfidentialComputingTransport]]] = None, - client_options: Optional[Union[client_options_lib.ClientOptions, dict]] = None, - client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO, - ) -> None: - """Instantiates the confidential computing client. - - Args: - credentials (Optional[google.auth.credentials.Credentials]): The - authorization credentials to attach to requests. These - credentials identify the application to the service; if none - are specified, the client will attempt to ascertain the - credentials from the environment. - transport (Optional[Union[str,ConfidentialComputingTransport,Callable[..., ConfidentialComputingTransport]]]): - The transport to use, or a Callable that constructs and returns a new transport. - If a Callable is given, it will be called with the same set of initialization - arguments as used in the ConfidentialComputingTransport constructor. - If set to None, a transport is chosen automatically. - client_options (Optional[Union[google.api_core.client_options.ClientOptions, dict]]): - Custom options for the client. - - 1. The ``api_endpoint`` property can be used to override the - default endpoint provided by the client when ``transport`` is - not explicitly provided. Only if this property is not set and - ``transport`` was not explicitly provided, the endpoint is - determined by the GOOGLE_API_USE_MTLS_ENDPOINT environment - variable, which have one of the following values: - "always" (always use the default mTLS endpoint), "never" (always - use the default regular endpoint) and "auto" (auto-switch to the - default mTLS endpoint if client certificate is present; this is - the default value). - - 2. If the GOOGLE_API_USE_CLIENT_CERTIFICATE environment variable - is "true", then the ``client_cert_source`` property can be used - to provide a client certificate for mTLS transport. If - not provided, the default SSL client certificate will be used if - present. If GOOGLE_API_USE_CLIENT_CERTIFICATE is "false" or not - set, no client certificate will be used. - - 3. The ``universe_domain`` property can be used to override the - default "googleapis.com" universe. Note that the ``api_endpoint`` - property still takes precedence; and ``universe_domain`` is - currently not supported for mTLS. - - client_info (google.api_core.gapic_v1.client_info.ClientInfo): - The client info used to send a user-agent string along with - API requests. If ``None``, then default info will be used. - Generally, you only need to set this if you're developing - your own client library. - - Raises: - google.auth.exceptions.MutualTLSChannelError: If mutual TLS transport - creation failed for any reason. - """ - self._client_options = client_options - if isinstance(self._client_options, dict): - self._client_options = client_options_lib.from_dict(self._client_options) - if self._client_options is None: - self._client_options = client_options_lib.ClientOptions() - self._client_options = cast(client_options_lib.ClientOptions, self._client_options) - - universe_domain_opt = getattr(self._client_options, 'universe_domain', None) - - self._use_client_cert, self._use_mtls_endpoint, self._universe_domain_env = ConfidentialComputingClient._read_environment_variables() - self._client_cert_source = ConfidentialComputingClient._get_client_cert_source(self._client_options.client_cert_source, self._use_client_cert) - self._universe_domain = ConfidentialComputingClient._get_universe_domain(universe_domain_opt, self._universe_domain_env) - self._api_endpoint = None # updated below, depending on `transport` - - # Initialize the universe domain validation. - self._is_universe_domain_valid = False - - if CLIENT_LOGGING_SUPPORTED: # pragma: NO COVER - # Setup logging. - client_logging.initialize_logging() - - api_key_value = getattr(self._client_options, "api_key", None) - if api_key_value and credentials: - raise ValueError("client_options.api_key and credentials are mutually exclusive") - - # Save or instantiate the transport. - # Ordinarily, we provide the transport, but allowing a custom transport - # instance provides an extensibility point for unusual situations. - transport_provided = isinstance(transport, ConfidentialComputingTransport) - if transport_provided: - # transport is a ConfidentialComputingTransport instance. - if credentials or self._client_options.credentials_file or api_key_value: - raise ValueError("When providing a transport instance, " - "provide its credentials directly.") - if self._client_options.scopes: - raise ValueError( - "When providing a transport instance, provide its scopes " - "directly." - ) - self._transport = cast(ConfidentialComputingTransport, transport) - self._api_endpoint = self._transport.host - - self._api_endpoint = (self._api_endpoint or - ConfidentialComputingClient._get_api_endpoint( - self._client_options.api_endpoint, - self._client_cert_source, - self._universe_domain, - self._use_mtls_endpoint)) - - if not transport_provided: - import google.auth._default # type: ignore - - if api_key_value and hasattr(google.auth._default, "get_api_key_credentials"): - credentials = google.auth._default.get_api_key_credentials(api_key_value) - - transport_init: Union[Type[ConfidentialComputingTransport], Callable[..., ConfidentialComputingTransport]] = ( - ConfidentialComputingClient.get_transport_class(transport) - if isinstance(transport, str) or transport is None - else cast(Callable[..., ConfidentialComputingTransport], transport) - ) - # initialize with the provided callable or the passed in class - self._transport = transport_init( - credentials=credentials, - credentials_file=self._client_options.credentials_file, - host=self._api_endpoint, - scopes=self._client_options.scopes, - client_cert_source_for_mtls=self._client_cert_source, - quota_project_id=self._client_options.quota_project_id, - client_info=client_info, - always_use_jwt_access=True, - api_audience=self._client_options.api_audience, - ) - - if "async" not in str(self._transport): - if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(std_logging.DEBUG): # pragma: NO COVER - _LOGGER.debug( - "Created client `google.cloud.confidentialcomputing_v1.ConfidentialComputingClient`.", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "universeDomain": getattr(self._transport._credentials, "universe_domain", ""), - "credentialsType": f"{type(self._transport._credentials).__module__}.{type(self._transport._credentials).__qualname__}", - "credentialsInfo": getattr(self.transport._credentials, "get_cred_info", lambda: None)(), - } if hasattr(self._transport, "_credentials") else { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "credentialsType": None, - } - ) - - def create_challenge(self, - request: Optional[Union[service.CreateChallengeRequest, dict]] = None, - *, - parent: Optional[str] = None, - challenge: Optional[service.Challenge] = None, - retry: OptionalRetry = gapic_v1.method.DEFAULT, - timeout: Union[float, object] = gapic_v1.method.DEFAULT, - metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), - ) -> service.Challenge: - r"""Creates a new Challenge in a given project and - location. - - .. code-block:: python - - # This snippet has been automatically generated and should be regarded as a - # code template only. - # It will require modifications to work: - # - It may require correct/in-range values for request initialization. - # - It may require specifying regional endpoints when creating the service - # client as shown in: - # https://googleapis.dev/python/google-api-core/latest/client_options.html - from google.cloud import confidentialcomputing_v1 - - def sample_create_challenge(): - # Create a client - client = confidentialcomputing_v1.ConfidentialComputingClient() - - # Initialize request argument(s) - request = confidentialcomputing_v1.CreateChallengeRequest( - parent="parent_value", - ) - - # Make the request - response = client.create_challenge(request=request) - - # Handle the response - print(response) - - Args: - request (Union[google.cloud.confidentialcomputing_v1.types.CreateChallengeRequest, dict]): - The request object. Message for creating a Challenge - parent (str): - Required. The resource name of the location where the - Challenge will be used, in the format - ``projects/*/locations/*``. - - This corresponds to the ``parent`` field - on the ``request`` instance; if ``request`` is provided, this - should not be set. - challenge (google.cloud.confidentialcomputing_v1.types.Challenge): - Required. The Challenge to be - created. Currently this field can be - empty as all the Challenge fields are - set by the server. - - This corresponds to the ``challenge`` field - on the ``request`` instance; if ``request`` is provided, this - should not be set. - retry (google.api_core.retry.Retry): Designation of what errors, if any, - should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - - Returns: - google.cloud.confidentialcomputing_v1.types.Challenge: - A Challenge from the server used to - guarantee freshness of attestations - - """ - # Create or coerce a protobuf request object. - # - Quick check: If we got a request object, we should *not* have - # gotten any keyword arguments that map to the request. - flattened_params = [parent, challenge] - has_flattened_params = len([param for param in flattened_params if param is not None]) > 0 - if request is not None and has_flattened_params: - raise ValueError('If the `request` argument is set, then none of ' - 'the individual field arguments should be set.') - - # - Use the request object if provided (there's no risk of modifying the input as - # there are no flattened fields), or create one. - if not isinstance(request, service.CreateChallengeRequest): - request = service.CreateChallengeRequest(request) - # If we have keyword arguments corresponding to fields on the - # request, apply these. - if parent is not None: - request.parent = parent - if challenge is not None: - request.challenge = challenge - - # Wrap the RPC method; this adds retry and timeout information, - # and friendly error handling. - rpc = self._transport._wrapped_methods[self._transport.create_challenge] - - # Certain fields should be provided within the metadata header; - # add these here. - metadata = tuple(metadata) + ( - gapic_v1.routing_header.to_grpc_metadata(( - ("parent", request.parent), - )), - ) - - # Validate the universe domain. - self._validate_universe_domain() - - # Send the request. - response = rpc( - request, - retry=retry, - timeout=timeout, - metadata=metadata, - ) - - # Done; return the response. - return response - - def verify_attestation(self, - request: Optional[Union[service.VerifyAttestationRequest, dict]] = None, - *, - retry: OptionalRetry = gapic_v1.method.DEFAULT, - timeout: Union[float, object] = gapic_v1.method.DEFAULT, - metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), - ) -> service.VerifyAttestationResponse: - r"""Verifies the provided attestation info, returning a - signed attestation token. - - .. code-block:: python - - # This snippet has been automatically generated and should be regarded as a - # code template only. - # It will require modifications to work: - # - It may require correct/in-range values for request initialization. - # - It may require specifying regional endpoints when creating the service - # client as shown in: - # https://googleapis.dev/python/google-api-core/latest/client_options.html - from google.cloud import confidentialcomputing_v1 - - def sample_verify_attestation(): - # Create a client - client = confidentialcomputing_v1.ConfidentialComputingClient() - - # Initialize request argument(s) - request = confidentialcomputing_v1.VerifyAttestationRequest( - challenge="challenge_value", - ) - - # Make the request - response = client.verify_attestation(request=request) - - # Handle the response - print(response) - - Args: - request (Union[google.cloud.confidentialcomputing_v1.types.VerifyAttestationRequest, dict]): - The request object. A request for an attestation token, - providing all the necessary information - needed for this service to verify the - platform state of the requestor. - retry (google.api_core.retry.Retry): Designation of what errors, if any, - should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - - Returns: - google.cloud.confidentialcomputing_v1.types.VerifyAttestationResponse: - A response once an attestation has - been successfully verified, containing a - signed attestation token. - - """ - # Create or coerce a protobuf request object. - # - Use the request object if provided (there's no risk of modifying the input as - # there are no flattened fields), or create one. - if not isinstance(request, service.VerifyAttestationRequest): - request = service.VerifyAttestationRequest(request) - - # Wrap the RPC method; this adds retry and timeout information, - # and friendly error handling. - rpc = self._transport._wrapped_methods[self._transport.verify_attestation] - - # Certain fields should be provided within the metadata header; - # add these here. - metadata = tuple(metadata) + ( - gapic_v1.routing_header.to_grpc_metadata(( - ("challenge", request.challenge), - )), - ) - - # Validate the universe domain. - self._validate_universe_domain() - - # Send the request. - response = rpc( - request, - retry=retry, - timeout=timeout, - metadata=metadata, - ) - - # Done; return the response. - return response - - def verify_confidential_space(self, - request: Optional[Union[service.VerifyConfidentialSpaceRequest, dict]] = None, - *, - retry: OptionalRetry = gapic_v1.method.DEFAULT, - timeout: Union[float, object] = gapic_v1.method.DEFAULT, - metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), - ) -> service.VerifyConfidentialSpaceResponse: - r"""Verifies whether the provided attestation info is - valid, returning a signed attestation token if so. - - .. code-block:: python - - # This snippet has been automatically generated and should be regarded as a - # code template only. - # It will require modifications to work: - # - It may require correct/in-range values for request initialization. - # - It may require specifying regional endpoints when creating the service - # client as shown in: - # https://googleapis.dev/python/google-api-core/latest/client_options.html - from google.cloud import confidentialcomputing_v1 - - def sample_verify_confidential_space(): - # Create a client - client = confidentialcomputing_v1.ConfidentialComputingClient() - - # Initialize request argument(s) - request = confidentialcomputing_v1.VerifyConfidentialSpaceRequest( - challenge="challenge_value", - ) - - # Make the request - response = client.verify_confidential_space(request=request) - - # Handle the response - print(response) - - Args: - request (Union[google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceRequest, dict]): - The request object. A request for an attestation token, - providing all the necessary information - needed for this service to verify the - platform state of the requestor. - retry (google.api_core.retry.Retry): Designation of what errors, if any, - should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - - Returns: - google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceResponse: - VerifyConfidentialSpaceResponse is - returned once a Confidential Space - attestation has been successfully - verified, containing a signed token. - - """ - # Create or coerce a protobuf request object. - # - Use the request object if provided (there's no risk of modifying the input as - # there are no flattened fields), or create one. - if not isinstance(request, service.VerifyConfidentialSpaceRequest): - request = service.VerifyConfidentialSpaceRequest(request) - - # Wrap the RPC method; this adds retry and timeout information, - # and friendly error handling. - rpc = self._transport._wrapped_methods[self._transport.verify_confidential_space] - - # Certain fields should be provided within the metadata header; - # add these here. - metadata = tuple(metadata) + ( - gapic_v1.routing_header.to_grpc_metadata(( - ("challenge", request.challenge), - )), - ) - - # Validate the universe domain. - self._validate_universe_domain() - - # Send the request. - response = rpc( - request, - retry=retry, - timeout=timeout, - metadata=metadata, - ) - - # Done; return the response. - return response - - def verify_confidential_gke(self, - request: Optional[Union[service.VerifyConfidentialGkeRequest, dict]] = None, - *, - retry: OptionalRetry = gapic_v1.method.DEFAULT, - timeout: Union[float, object] = gapic_v1.method.DEFAULT, - metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), - ) -> service.VerifyConfidentialGkeResponse: - r"""Verifies the provided Confidential GKE attestation - info, returning a signed OIDC token. - - .. code-block:: python - - # This snippet has been automatically generated and should be regarded as a - # code template only. - # It will require modifications to work: - # - It may require correct/in-range values for request initialization. - # - It may require specifying regional endpoints when creating the service - # client as shown in: - # https://googleapis.dev/python/google-api-core/latest/client_options.html - from google.cloud import confidentialcomputing_v1 - - def sample_verify_confidential_gke(): - # Create a client - client = confidentialcomputing_v1.ConfidentialComputingClient() - - # Initialize request argument(s) - request = confidentialcomputing_v1.VerifyConfidentialGkeRequest( - challenge="challenge_value", - ) - - # Make the request - response = client.verify_confidential_gke(request=request) - - # Handle the response - print(response) - - Args: - request (Union[google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeRequest, dict]): - The request object. A request for an attestation token, - providing all the necessary information - needed for this service to verify - Confidential GKE platform state of the - requestor. - retry (google.api_core.retry.Retry): Designation of what errors, if any, - should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - - Returns: - google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeResponse: - VerifyConfidentialGkeResponse - response is returened once a - Confidential GKE attestation has been - successfully verified, containing a - signed OIDC token. - - """ - # Create or coerce a protobuf request object. - # - Use the request object if provided (there's no risk of modifying the input as - # there are no flattened fields), or create one. - if not isinstance(request, service.VerifyConfidentialGkeRequest): - request = service.VerifyConfidentialGkeRequest(request) - - # Wrap the RPC method; this adds retry and timeout information, - # and friendly error handling. - rpc = self._transport._wrapped_methods[self._transport.verify_confidential_gke] - - # Certain fields should be provided within the metadata header; - # add these here. - metadata = tuple(metadata) + ( - gapic_v1.routing_header.to_grpc_metadata(( - ("challenge", request.challenge), - )), - ) - - # Validate the universe domain. - self._validate_universe_domain() - - # Send the request. - response = rpc( - request, - retry=retry, - timeout=timeout, - metadata=metadata, - ) - - # Done; return the response. - return response - - def __enter__(self) -> "ConfidentialComputingClient": - return self - - def __exit__(self, type, value, traceback): - """Releases underlying transport's resources. - - .. warning:: - ONLY use as a context manager if the transport is NOT shared - with other clients! Exiting the with block will CLOSE the transport - and may cause errors in other clients! - """ - self.transport.close() - - def get_location( - self, - request: Optional[locations_pb2.GetLocationRequest] = None, - *, - retry: OptionalRetry = gapic_v1.method.DEFAULT, - timeout: Union[float, object] = gapic_v1.method.DEFAULT, - metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), - ) -> locations_pb2.Location: - r"""Gets information about a location. - - Args: - request (:class:`~.location_pb2.GetLocationRequest`): - The request object. Request message for - `GetLocation` method. - retry (google.api_core.retry.Retry): Designation of what errors, - if any, should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - Returns: - ~.location_pb2.Location: - Location object. - """ - # Create or coerce a protobuf request object. - # The request isn't a proto-plus wrapped type, - # so it must be constructed via keyword expansion. - if isinstance(request, dict): - request = locations_pb2.GetLocationRequest(**request) - - # Wrap the RPC method; this adds retry and timeout information, - # and friendly error handling. - rpc = self._transport._wrapped_methods[self._transport.get_location] - - # Certain fields should be provided within the metadata header; - # add these here. - metadata = tuple(metadata) + ( - gapic_v1.routing_header.to_grpc_metadata( - (("name", request.name),)), - ) - - # Validate the universe domain. - self._validate_universe_domain() - - try: - # Send the request. - response = rpc( - request, retry=retry, timeout=timeout, metadata=metadata,) - - # Done; return the response. - return response - except core_exceptions.GoogleAPICallError as e: - self._add_cred_info_for_auth_errors(e) - raise e - - def list_locations( - self, - request: Optional[locations_pb2.ListLocationsRequest] = None, - *, - retry: OptionalRetry = gapic_v1.method.DEFAULT, - timeout: Union[float, object] = gapic_v1.method.DEFAULT, - metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), - ) -> locations_pb2.ListLocationsResponse: - r"""Lists information about the supported locations for this service. - - Args: - request (:class:`~.location_pb2.ListLocationsRequest`): - The request object. Request message for - `ListLocations` method. - retry (google.api_core.retry.Retry): Designation of what errors, - if any, should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - Returns: - ~.location_pb2.ListLocationsResponse: - Response message for ``ListLocations`` method. - """ - # Create or coerce a protobuf request object. - # The request isn't a proto-plus wrapped type, - # so it must be constructed via keyword expansion. - if isinstance(request, dict): - request = locations_pb2.ListLocationsRequest(**request) - - # Wrap the RPC method; this adds retry and timeout information, - # and friendly error handling. - rpc = self._transport._wrapped_methods[self._transport.list_locations] - - # Certain fields should be provided within the metadata header; - # add these here. - metadata = tuple(metadata) + ( - gapic_v1.routing_header.to_grpc_metadata( - (("name", request.name),)), - ) - - # Validate the universe domain. - self._validate_universe_domain() - - try: - # Send the request. - response = rpc( - request, retry=retry, timeout=timeout, metadata=metadata,) - - # Done; return the response. - return response - except core_exceptions.GoogleAPICallError as e: - self._add_cred_info_for_auth_errors(e) - raise e - - -DEFAULT_CLIENT_INFO = gapic_v1.client_info.ClientInfo(gapic_version=package_version.__version__) - -if hasattr(DEFAULT_CLIENT_INFO, "protobuf_runtime_version"): # pragma: NO COVER - DEFAULT_CLIENT_INFO.protobuf_runtime_version = google.protobuf.__version__ - -__all__ = ( - "ConfidentialComputingClient", -) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/README.rst b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/README.rst deleted file mode 100644 index 2bf126ac1dec..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/README.rst +++ /dev/null @@ -1,9 +0,0 @@ - -transport inheritance structure -_______________________________ - -`ConfidentialComputingTransport` is the ABC for all transports. -- public child `ConfidentialComputingGrpcTransport` for sync gRPC transport (defined in `grpc.py`). -- public child `ConfidentialComputingGrpcAsyncIOTransport` for async gRPC transport (defined in `grpc_asyncio.py`). -- private child `_BaseConfidentialComputingRestTransport` for base REST transport with inner classes `_BaseMETHOD` (defined in `rest_base.py`). -- public child `ConfidentialComputingRestTransport` for sync REST transport with inner classes `METHOD` derived from the parent's corresponding `_BaseMETHOD` classes (defined in `rest.py`). diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/__init__.py deleted file mode 100644 index c7d682081e49..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/__init__.py +++ /dev/null @@ -1,38 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -from collections import OrderedDict -from typing import Dict, Type - -from .base import ConfidentialComputingTransport -from .grpc import ConfidentialComputingGrpcTransport -from .grpc_asyncio import ConfidentialComputingGrpcAsyncIOTransport -from .rest import ConfidentialComputingRestTransport -from .rest import ConfidentialComputingRestInterceptor - - -# Compile a registry of transports. -_transport_registry = OrderedDict() # type: Dict[str, Type[ConfidentialComputingTransport]] -_transport_registry['grpc'] = ConfidentialComputingGrpcTransport -_transport_registry['grpc_asyncio'] = ConfidentialComputingGrpcAsyncIOTransport -_transport_registry['rest'] = ConfidentialComputingRestTransport - -__all__ = ( - 'ConfidentialComputingTransport', - 'ConfidentialComputingGrpcTransport', - 'ConfidentialComputingGrpcAsyncIOTransport', - 'ConfidentialComputingRestTransport', - 'ConfidentialComputingRestInterceptor', -) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/base.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/base.py deleted file mode 100644 index 40ff08bd7b14..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/base.py +++ /dev/null @@ -1,264 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -import abc -from typing import Awaitable, Callable, Dict, Optional, Sequence, Union - -from google.cloud.confidentialcomputing_v1 import gapic_version as package_version - -import google.auth # type: ignore -import google.api_core -from google.api_core import exceptions as core_exceptions -from google.api_core import gapic_v1 -from google.api_core import retry as retries -from google.auth import credentials as ga_credentials # type: ignore -from google.oauth2 import service_account # type: ignore -import google.protobuf - -from google.cloud.confidentialcomputing_v1.types import service -from google.cloud.location import locations_pb2 # type: ignore - -DEFAULT_CLIENT_INFO = gapic_v1.client_info.ClientInfo(gapic_version=package_version.__version__) - -if hasattr(DEFAULT_CLIENT_INFO, "protobuf_runtime_version"): # pragma: NO COVER - DEFAULT_CLIENT_INFO.protobuf_runtime_version = google.protobuf.__version__ - - -class ConfidentialComputingTransport(abc.ABC): - """Abstract transport class for ConfidentialComputing.""" - - AUTH_SCOPES = ( - 'https://www.googleapis.com/auth/cloud-platform', - ) - - DEFAULT_HOST: str = 'confidentialcomputing.googleapis.com' - - def __init__( - self, *, - host: str = DEFAULT_HOST, - credentials: Optional[ga_credentials.Credentials] = None, - credentials_file: Optional[str] = None, - scopes: Optional[Sequence[str]] = None, - quota_project_id: Optional[str] = None, - client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO, - always_use_jwt_access: Optional[bool] = False, - api_audience: Optional[str] = None, - **kwargs, - ) -> None: - """Instantiate the transport. - - Args: - host (Optional[str]): - The hostname to connect to (default: 'confidentialcomputing.googleapis.com'). - credentials (Optional[google.auth.credentials.Credentials]): The - authorization credentials to attach to requests. These - credentials identify the application to the service; if none - are specified, the client will attempt to ascertain the - credentials from the environment. - credentials_file (Optional[str]): A file with credentials that can - be loaded with :func:`google.auth.load_credentials_from_file`. - This argument is mutually exclusive with credentials. - scopes (Optional[Sequence[str]]): A list of scopes. - quota_project_id (Optional[str]): An optional project to use for billing - and quota. - client_info (google.api_core.gapic_v1.client_info.ClientInfo): - The client info used to send a user-agent string along with - API requests. If ``None``, then default info will be used. - Generally, you only need to set this if you're developing - your own client library. - always_use_jwt_access (Optional[bool]): Whether self signed JWT should - be used for service account credentials. - """ - - scopes_kwargs = {"scopes": scopes, "default_scopes": self.AUTH_SCOPES} - - # Save the scopes. - self._scopes = scopes - if not hasattr(self, "_ignore_credentials"): - self._ignore_credentials: bool = False - - # If no credentials are provided, then determine the appropriate - # defaults. - if credentials and credentials_file: - raise core_exceptions.DuplicateCredentialArgs("'credentials_file' and 'credentials' are mutually exclusive") - - if credentials_file is not None: - credentials, _ = google.auth.load_credentials_from_file( - credentials_file, - **scopes_kwargs, - quota_project_id=quota_project_id - ) - elif credentials is None and not self._ignore_credentials: - credentials, _ = google.auth.default(**scopes_kwargs, quota_project_id=quota_project_id) - # Don't apply audience if the credentials file passed from user. - if hasattr(credentials, "with_gdch_audience"): - credentials = credentials.with_gdch_audience(api_audience if api_audience else host) - - # If the credentials are service account credentials, then always try to use self signed JWT. - if always_use_jwt_access and isinstance(credentials, service_account.Credentials) and hasattr(service_account.Credentials, "with_always_use_jwt_access"): - credentials = credentials.with_always_use_jwt_access(True) - - # Save the credentials. - self._credentials = credentials - - # Save the hostname. Default to port 443 (HTTPS) if none is specified. - if ':' not in host: - host += ':443' - self._host = host - - @property - def host(self): - return self._host - - def _prep_wrapped_messages(self, client_info): - # Precompute the wrapped methods. - self._wrapped_methods = { - self.create_challenge: gapic_v1.method.wrap_method( - self.create_challenge, - default_retry=retries.Retry( - initial=1.0, - maximum=60.0, - multiplier=1.3, - predicate=retries.if_exception_type( - core_exceptions.ServiceUnavailable, - ), - deadline=60.0, - ), - default_timeout=60.0, - client_info=client_info, - ), - self.verify_attestation: gapic_v1.method.wrap_method( - self.verify_attestation, - default_retry=retries.Retry( - initial=1.0, - maximum=60.0, - multiplier=1.3, - predicate=retries.if_exception_type( - core_exceptions.ServiceUnavailable, - ), - deadline=60.0, - ), - default_timeout=60.0, - client_info=client_info, - ), - self.verify_confidential_space: gapic_v1.method.wrap_method( - self.verify_confidential_space, - default_retry=retries.Retry( - initial=1.0, - maximum=60.0, - multiplier=1.3, - predicate=retries.if_exception_type( - core_exceptions.ServiceUnavailable, - ), - deadline=60.0, - ), - default_timeout=60.0, - client_info=client_info, - ), - self.verify_confidential_gke: gapic_v1.method.wrap_method( - self.verify_confidential_gke, - default_retry=retries.Retry( - initial=1.0, - maximum=60.0, - multiplier=1.3, - predicate=retries.if_exception_type( - core_exceptions.ServiceUnavailable, - ), - deadline=60.0, - ), - default_timeout=60.0, - client_info=client_info, - ), - self.get_location: gapic_v1.method.wrap_method( - self.get_location, - default_timeout=None, - client_info=client_info, - ), - self.list_locations: gapic_v1.method.wrap_method( - self.list_locations, - default_timeout=None, - client_info=client_info, - ), - } - - def close(self): - """Closes resources associated with the transport. - - .. warning:: - Only call this method if the transport is NOT shared - with other clients - this may cause errors in other clients! - """ - raise NotImplementedError() - - @property - def create_challenge(self) -> Callable[ - [service.CreateChallengeRequest], - Union[ - service.Challenge, - Awaitable[service.Challenge] - ]]: - raise NotImplementedError() - - @property - def verify_attestation(self) -> Callable[ - [service.VerifyAttestationRequest], - Union[ - service.VerifyAttestationResponse, - Awaitable[service.VerifyAttestationResponse] - ]]: - raise NotImplementedError() - - @property - def verify_confidential_space(self) -> Callable[ - [service.VerifyConfidentialSpaceRequest], - Union[ - service.VerifyConfidentialSpaceResponse, - Awaitable[service.VerifyConfidentialSpaceResponse] - ]]: - raise NotImplementedError() - - @property - def verify_confidential_gke(self) -> Callable[ - [service.VerifyConfidentialGkeRequest], - Union[ - service.VerifyConfidentialGkeResponse, - Awaitable[service.VerifyConfidentialGkeResponse] - ]]: - raise NotImplementedError() - - @property - def get_location(self, - ) -> Callable[ - [locations_pb2.GetLocationRequest], - Union[locations_pb2.Location, Awaitable[locations_pb2.Location]], - ]: - raise NotImplementedError() - - @property - def list_locations(self, - ) -> Callable[ - [locations_pb2.ListLocationsRequest], - Union[locations_pb2.ListLocationsResponse, Awaitable[locations_pb2.ListLocationsResponse]], - ]: - raise NotImplementedError() - - @property - def kind(self) -> str: - raise NotImplementedError() - - -__all__ = ( - 'ConfidentialComputingTransport', -) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc.py deleted file mode 100644 index 7aa894736780..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc.py +++ /dev/null @@ -1,465 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -import json -import logging as std_logging -import pickle -import warnings -from typing import Callable, Dict, Optional, Sequence, Tuple, Union - -from google.api_core import grpc_helpers -from google.api_core import gapic_v1 -import google.auth # type: ignore -from google.auth import credentials as ga_credentials # type: ignore -from google.auth.transport.grpc import SslCredentials # type: ignore -from google.protobuf.json_format import MessageToJson -import google.protobuf.message - -import grpc # type: ignore -import proto # type: ignore - -from google.cloud.confidentialcomputing_v1.types import service -from google.cloud.location import locations_pb2 # type: ignore -from .base import ConfidentialComputingTransport, DEFAULT_CLIENT_INFO - -try: - from google.api_core import client_logging # type: ignore - CLIENT_LOGGING_SUPPORTED = True # pragma: NO COVER -except ImportError: # pragma: NO COVER - CLIENT_LOGGING_SUPPORTED = False - -_LOGGER = std_logging.getLogger(__name__) - - -class _LoggingClientInterceptor(grpc.UnaryUnaryClientInterceptor): # pragma: NO COVER - def intercept_unary_unary(self, continuation, client_call_details, request): - logging_enabled = CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(std_logging.DEBUG) - if logging_enabled: # pragma: NO COVER - request_metadata = client_call_details.metadata - if isinstance(request, proto.Message): - request_payload = type(request).to_json(request) - elif isinstance(request, google.protobuf.message.Message): - request_payload = MessageToJson(request) - else: - request_payload = f"{type(request).__name__}: {pickle.dumps(request)}" - - request_metadata = { - key: value.decode("utf-8") if isinstance(value, bytes) else value - for key, value in request_metadata - } - grpc_request = { - "payload": request_payload, - "requestMethod": "grpc", - "metadata": dict(request_metadata), - } - _LOGGER.debug( - f"Sending request for {client_call_details.method}", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "rpcName": str(client_call_details.method), - "request": grpc_request, - "metadata": grpc_request["metadata"], - }, - ) - response = continuation(client_call_details, request) - if logging_enabled: # pragma: NO COVER - response_metadata = response.trailing_metadata() - # Convert gRPC metadata `` to list of tuples - metadata = dict([(k, str(v)) for k, v in response_metadata]) if response_metadata else None - result = response.result() - if isinstance(result, proto.Message): - response_payload = type(result).to_json(result) - elif isinstance(result, google.protobuf.message.Message): - response_payload = MessageToJson(result) - else: - response_payload = f"{type(result).__name__}: {pickle.dumps(result)}" - grpc_response = { - "payload": response_payload, - "metadata": metadata, - "status": "OK", - } - _LOGGER.debug( - f"Received response for {client_call_details.method}.", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "rpcName": client_call_details.method, - "response": grpc_response, - "metadata": grpc_response["metadata"], - }, - ) - return response - - -class ConfidentialComputingGrpcTransport(ConfidentialComputingTransport): - """gRPC backend transport for ConfidentialComputing. - - Service describing handlers for resources - - This class defines the same methods as the primary client, so the - primary client can load the underlying transport implementation - and call it. - - It sends protocol buffers over the wire using gRPC (which is built on - top of HTTP/2); the ``grpcio`` package must be installed. - """ - _stubs: Dict[str, Callable] - - def __init__(self, *, - host: str = 'confidentialcomputing.googleapis.com', - credentials: Optional[ga_credentials.Credentials] = None, - credentials_file: Optional[str] = None, - scopes: Optional[Sequence[str]] = None, - channel: Optional[Union[grpc.Channel, Callable[..., grpc.Channel]]] = None, - api_mtls_endpoint: Optional[str] = None, - client_cert_source: Optional[Callable[[], Tuple[bytes, bytes]]] = None, - ssl_channel_credentials: Optional[grpc.ChannelCredentials] = None, - client_cert_source_for_mtls: Optional[Callable[[], Tuple[bytes, bytes]]] = None, - quota_project_id: Optional[str] = None, - client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO, - always_use_jwt_access: Optional[bool] = False, - api_audience: Optional[str] = None, - ) -> None: - """Instantiate the transport. - - Args: - host (Optional[str]): - The hostname to connect to (default: 'confidentialcomputing.googleapis.com'). - credentials (Optional[google.auth.credentials.Credentials]): The - authorization credentials to attach to requests. These - credentials identify the application to the service; if none - are specified, the client will attempt to ascertain the - credentials from the environment. - This argument is ignored if a ``channel`` instance is provided. - credentials_file (Optional[str]): A file with credentials that can - be loaded with :func:`google.auth.load_credentials_from_file`. - This argument is ignored if a ``channel`` instance is provided. - scopes (Optional(Sequence[str])): A list of scopes. This argument is - ignored if a ``channel`` instance is provided. - channel (Optional[Union[grpc.Channel, Callable[..., grpc.Channel]]]): - A ``Channel`` instance through which to make calls, or a Callable - that constructs and returns one. If set to None, ``self.create_channel`` - is used to create the channel. If a Callable is given, it will be called - with the same arguments as used in ``self.create_channel``. - api_mtls_endpoint (Optional[str]): Deprecated. The mutual TLS endpoint. - If provided, it overrides the ``host`` argument and tries to create - a mutual TLS channel with client SSL credentials from - ``client_cert_source`` or application default SSL credentials. - client_cert_source (Optional[Callable[[], Tuple[bytes, bytes]]]): - Deprecated. A callback to provide client SSL certificate bytes and - private key bytes, both in PEM format. It is ignored if - ``api_mtls_endpoint`` is None. - ssl_channel_credentials (grpc.ChannelCredentials): SSL credentials - for the grpc channel. It is ignored if a ``channel`` instance is provided. - client_cert_source_for_mtls (Optional[Callable[[], Tuple[bytes, bytes]]]): - A callback to provide client certificate bytes and private key bytes, - both in PEM format. It is used to configure a mutual TLS channel. It is - ignored if a ``channel`` instance or ``ssl_channel_credentials`` is provided. - quota_project_id (Optional[str]): An optional project to use for billing - and quota. - client_info (google.api_core.gapic_v1.client_info.ClientInfo): - The client info used to send a user-agent string along with - API requests. If ``None``, then default info will be used. - Generally, you only need to set this if you're developing - your own client library. - always_use_jwt_access (Optional[bool]): Whether self signed JWT should - be used for service account credentials. - - Raises: - google.auth.exceptions.MutualTLSChannelError: If mutual TLS transport - creation failed for any reason. - google.api_core.exceptions.DuplicateCredentialArgs: If both ``credentials`` - and ``credentials_file`` are passed. - """ - self._grpc_channel = None - self._ssl_channel_credentials = ssl_channel_credentials - self._stubs: Dict[str, Callable] = {} - - if api_mtls_endpoint: - warnings.warn("api_mtls_endpoint is deprecated", DeprecationWarning) - if client_cert_source: - warnings.warn("client_cert_source is deprecated", DeprecationWarning) - - if isinstance(channel, grpc.Channel): - # Ignore credentials if a channel was passed. - credentials = None - self._ignore_credentials = True - # If a channel was explicitly provided, set it. - self._grpc_channel = channel - self._ssl_channel_credentials = None - - else: - if api_mtls_endpoint: - host = api_mtls_endpoint - - # Create SSL credentials with client_cert_source or application - # default SSL credentials. - if client_cert_source: - cert, key = client_cert_source() - self._ssl_channel_credentials = grpc.ssl_channel_credentials( - certificate_chain=cert, private_key=key - ) - else: - self._ssl_channel_credentials = SslCredentials().ssl_credentials - - else: - if client_cert_source_for_mtls and not ssl_channel_credentials: - cert, key = client_cert_source_for_mtls() - self._ssl_channel_credentials = grpc.ssl_channel_credentials( - certificate_chain=cert, private_key=key - ) - - # The base transport sets the host, credentials and scopes - super().__init__( - host=host, - credentials=credentials, - credentials_file=credentials_file, - scopes=scopes, - quota_project_id=quota_project_id, - client_info=client_info, - always_use_jwt_access=always_use_jwt_access, - api_audience=api_audience, - ) - - if not self._grpc_channel: - # initialize with the provided callable or the default channel - channel_init = channel or type(self).create_channel - self._grpc_channel = channel_init( - self._host, - # use the credentials which are saved - credentials=self._credentials, - # Set ``credentials_file`` to ``None`` here as - # the credentials that we saved earlier should be used. - credentials_file=None, - scopes=self._scopes, - ssl_credentials=self._ssl_channel_credentials, - quota_project_id=quota_project_id, - options=[ - ("grpc.max_send_message_length", -1), - ("grpc.max_receive_message_length", -1), - ], - ) - - self._interceptor = _LoggingClientInterceptor() - self._logged_channel = grpc.intercept_channel(self._grpc_channel, self._interceptor) - - # Wrap messages. This must be done after self._logged_channel exists - self._prep_wrapped_messages(client_info) - - @classmethod - def create_channel(cls, - host: str = 'confidentialcomputing.googleapis.com', - credentials: Optional[ga_credentials.Credentials] = None, - credentials_file: Optional[str] = None, - scopes: Optional[Sequence[str]] = None, - quota_project_id: Optional[str] = None, - **kwargs) -> grpc.Channel: - """Create and return a gRPC channel object. - Args: - host (Optional[str]): The host for the channel to use. - credentials (Optional[~.Credentials]): The - authorization credentials to attach to requests. These - credentials identify this application to the service. If - none are specified, the client will attempt to ascertain - the credentials from the environment. - credentials_file (Optional[str]): A file with credentials that can - be loaded with :func:`google.auth.load_credentials_from_file`. - This argument is mutually exclusive with credentials. - scopes (Optional[Sequence[str]]): A optional list of scopes needed for this - service. These are only used when credentials are not specified and - are passed to :func:`google.auth.default`. - quota_project_id (Optional[str]): An optional project to use for billing - and quota. - kwargs (Optional[dict]): Keyword arguments, which are passed to the - channel creation. - Returns: - grpc.Channel: A gRPC channel object. - - Raises: - google.api_core.exceptions.DuplicateCredentialArgs: If both ``credentials`` - and ``credentials_file`` are passed. - """ - - return grpc_helpers.create_channel( - host, - credentials=credentials, - credentials_file=credentials_file, - quota_project_id=quota_project_id, - default_scopes=cls.AUTH_SCOPES, - scopes=scopes, - default_host=cls.DEFAULT_HOST, - **kwargs - ) - - @property - def grpc_channel(self) -> grpc.Channel: - """Return the channel designed to connect to this service. - """ - return self._grpc_channel - - @property - def create_challenge(self) -> Callable[ - [service.CreateChallengeRequest], - service.Challenge]: - r"""Return a callable for the create challenge method over gRPC. - - Creates a new Challenge in a given project and - location. - - Returns: - Callable[[~.CreateChallengeRequest], - ~.Challenge]: - A function that, when called, will call the underlying RPC - on the server. - """ - # Generate a "stub function" on-the-fly which will actually make - # the request. - # gRPC handles serialization and deserialization, so we just need - # to pass in the functions for each. - if 'create_challenge' not in self._stubs: - self._stubs['create_challenge'] = self._logged_channel.unary_unary( - '/google.cloud.confidentialcomputing.v1.ConfidentialComputing/CreateChallenge', - request_serializer=service.CreateChallengeRequest.serialize, - response_deserializer=service.Challenge.deserialize, - ) - return self._stubs['create_challenge'] - - @property - def verify_attestation(self) -> Callable[ - [service.VerifyAttestationRequest], - service.VerifyAttestationResponse]: - r"""Return a callable for the verify attestation method over gRPC. - - Verifies the provided attestation info, returning a - signed attestation token. - - Returns: - Callable[[~.VerifyAttestationRequest], - ~.VerifyAttestationResponse]: - A function that, when called, will call the underlying RPC - on the server. - """ - # Generate a "stub function" on-the-fly which will actually make - # the request. - # gRPC handles serialization and deserialization, so we just need - # to pass in the functions for each. - if 'verify_attestation' not in self._stubs: - self._stubs['verify_attestation'] = self._logged_channel.unary_unary( - '/google.cloud.confidentialcomputing.v1.ConfidentialComputing/VerifyAttestation', - request_serializer=service.VerifyAttestationRequest.serialize, - response_deserializer=service.VerifyAttestationResponse.deserialize, - ) - return self._stubs['verify_attestation'] - - @property - def verify_confidential_space(self) -> Callable[ - [service.VerifyConfidentialSpaceRequest], - service.VerifyConfidentialSpaceResponse]: - r"""Return a callable for the verify confidential space method over gRPC. - - Verifies whether the provided attestation info is - valid, returning a signed attestation token if so. - - Returns: - Callable[[~.VerifyConfidentialSpaceRequest], - ~.VerifyConfidentialSpaceResponse]: - A function that, when called, will call the underlying RPC - on the server. - """ - # Generate a "stub function" on-the-fly which will actually make - # the request. - # gRPC handles serialization and deserialization, so we just need - # to pass in the functions for each. - if 'verify_confidential_space' not in self._stubs: - self._stubs['verify_confidential_space'] = self._logged_channel.unary_unary( - '/google.cloud.confidentialcomputing.v1.ConfidentialComputing/VerifyConfidentialSpace', - request_serializer=service.VerifyConfidentialSpaceRequest.serialize, - response_deserializer=service.VerifyConfidentialSpaceResponse.deserialize, - ) - return self._stubs['verify_confidential_space'] - - @property - def verify_confidential_gke(self) -> Callable[ - [service.VerifyConfidentialGkeRequest], - service.VerifyConfidentialGkeResponse]: - r"""Return a callable for the verify confidential gke method over gRPC. - - Verifies the provided Confidential GKE attestation - info, returning a signed OIDC token. - - Returns: - Callable[[~.VerifyConfidentialGkeRequest], - ~.VerifyConfidentialGkeResponse]: - A function that, when called, will call the underlying RPC - on the server. - """ - # Generate a "stub function" on-the-fly which will actually make - # the request. - # gRPC handles serialization and deserialization, so we just need - # to pass in the functions for each. - if 'verify_confidential_gke' not in self._stubs: - self._stubs['verify_confidential_gke'] = self._logged_channel.unary_unary( - '/google.cloud.confidentialcomputing.v1.ConfidentialComputing/VerifyConfidentialGke', - request_serializer=service.VerifyConfidentialGkeRequest.serialize, - response_deserializer=service.VerifyConfidentialGkeResponse.deserialize, - ) - return self._stubs['verify_confidential_gke'] - - def close(self): - self._logged_channel.close() - - @property - def list_locations( - self, - ) -> Callable[[locations_pb2.ListLocationsRequest], locations_pb2.ListLocationsResponse]: - r"""Return a callable for the list locations method over gRPC. - """ - # Generate a "stub function" on-the-fly which will actually make - # the request. - # gRPC handles serialization and deserialization, so we just need - # to pass in the functions for each. - if "list_locations" not in self._stubs: - self._stubs["list_locations"] = self._logged_channel.unary_unary( - "/google.cloud.location.Locations/ListLocations", - request_serializer=locations_pb2.ListLocationsRequest.SerializeToString, - response_deserializer=locations_pb2.ListLocationsResponse.FromString, - ) - return self._stubs["list_locations"] - - @property - def get_location( - self, - ) -> Callable[[locations_pb2.GetLocationRequest], locations_pb2.Location]: - r"""Return a callable for the list locations method over gRPC. - """ - # Generate a "stub function" on-the-fly which will actually make - # the request. - # gRPC handles serialization and deserialization, so we just need - # to pass in the functions for each. - if "get_location" not in self._stubs: - self._stubs["get_location"] = self._logged_channel.unary_unary( - "/google.cloud.location.Locations/GetLocation", - request_serializer=locations_pb2.GetLocationRequest.SerializeToString, - response_deserializer=locations_pb2.Location.FromString, - ) - return self._stubs["get_location"] - - @property - def kind(self) -> str: - return "grpc" - - -__all__ = ( - 'ConfidentialComputingGrpcTransport', -) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc_asyncio.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc_asyncio.py deleted file mode 100644 index 4e254a73b6a2..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc_asyncio.py +++ /dev/null @@ -1,547 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -import inspect -import json -import pickle -import logging as std_logging -import warnings -from typing import Awaitable, Callable, Dict, Optional, Sequence, Tuple, Union - -from google.api_core import gapic_v1 -from google.api_core import grpc_helpers_async -from google.api_core import exceptions as core_exceptions -from google.api_core import retry_async as retries -from google.auth import credentials as ga_credentials # type: ignore -from google.auth.transport.grpc import SslCredentials # type: ignore -from google.protobuf.json_format import MessageToJson -import google.protobuf.message - -import grpc # type: ignore -import proto # type: ignore -from grpc.experimental import aio # type: ignore - -from google.cloud.confidentialcomputing_v1.types import service -from google.cloud.location import locations_pb2 # type: ignore -from .base import ConfidentialComputingTransport, DEFAULT_CLIENT_INFO -from .grpc import ConfidentialComputingGrpcTransport - -try: - from google.api_core import client_logging # type: ignore - CLIENT_LOGGING_SUPPORTED = True # pragma: NO COVER -except ImportError: # pragma: NO COVER - CLIENT_LOGGING_SUPPORTED = False - -_LOGGER = std_logging.getLogger(__name__) - - -class _LoggingClientAIOInterceptor(grpc.aio.UnaryUnaryClientInterceptor): # pragma: NO COVER - async def intercept_unary_unary(self, continuation, client_call_details, request): - logging_enabled = CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(std_logging.DEBUG) - if logging_enabled: # pragma: NO COVER - request_metadata = client_call_details.metadata - if isinstance(request, proto.Message): - request_payload = type(request).to_json(request) - elif isinstance(request, google.protobuf.message.Message): - request_payload = MessageToJson(request) - else: - request_payload = f"{type(request).__name__}: {pickle.dumps(request)}" - - request_metadata = { - key: value.decode("utf-8") if isinstance(value, bytes) else value - for key, value in request_metadata - } - grpc_request = { - "payload": request_payload, - "requestMethod": "grpc", - "metadata": dict(request_metadata), - } - _LOGGER.debug( - f"Sending request for {client_call_details.method}", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "rpcName": str(client_call_details.method), - "request": grpc_request, - "metadata": grpc_request["metadata"], - }, - ) - response = await continuation(client_call_details, request) - if logging_enabled: # pragma: NO COVER - response_metadata = await response.trailing_metadata() - # Convert gRPC metadata `` to list of tuples - metadata = dict([(k, str(v)) for k, v in response_metadata]) if response_metadata else None - result = await response - if isinstance(result, proto.Message): - response_payload = type(result).to_json(result) - elif isinstance(result, google.protobuf.message.Message): - response_payload = MessageToJson(result) - else: - response_payload = f"{type(result).__name__}: {pickle.dumps(result)}" - grpc_response = { - "payload": response_payload, - "metadata": metadata, - "status": "OK", - } - _LOGGER.debug( - f"Received response to rpc {client_call_details.method}.", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "rpcName": str(client_call_details.method), - "response": grpc_response, - "metadata": grpc_response["metadata"], - }, - ) - return response - - -class ConfidentialComputingGrpcAsyncIOTransport(ConfidentialComputingTransport): - """gRPC AsyncIO backend transport for ConfidentialComputing. - - Service describing handlers for resources - - This class defines the same methods as the primary client, so the - primary client can load the underlying transport implementation - and call it. - - It sends protocol buffers over the wire using gRPC (which is built on - top of HTTP/2); the ``grpcio`` package must be installed. - """ - - _grpc_channel: aio.Channel - _stubs: Dict[str, Callable] = {} - - @classmethod - def create_channel(cls, - host: str = 'confidentialcomputing.googleapis.com', - credentials: Optional[ga_credentials.Credentials] = None, - credentials_file: Optional[str] = None, - scopes: Optional[Sequence[str]] = None, - quota_project_id: Optional[str] = None, - **kwargs) -> aio.Channel: - """Create and return a gRPC AsyncIO channel object. - Args: - host (Optional[str]): The host for the channel to use. - credentials (Optional[~.Credentials]): The - authorization credentials to attach to requests. These - credentials identify this application to the service. If - none are specified, the client will attempt to ascertain - the credentials from the environment. - credentials_file (Optional[str]): A file with credentials that can - be loaded with :func:`google.auth.load_credentials_from_file`. - scopes (Optional[Sequence[str]]): A optional list of scopes needed for this - service. These are only used when credentials are not specified and - are passed to :func:`google.auth.default`. - quota_project_id (Optional[str]): An optional project to use for billing - and quota. - kwargs (Optional[dict]): Keyword arguments, which are passed to the - channel creation. - Returns: - aio.Channel: A gRPC AsyncIO channel object. - """ - - return grpc_helpers_async.create_channel( - host, - credentials=credentials, - credentials_file=credentials_file, - quota_project_id=quota_project_id, - default_scopes=cls.AUTH_SCOPES, - scopes=scopes, - default_host=cls.DEFAULT_HOST, - **kwargs - ) - - def __init__(self, *, - host: str = 'confidentialcomputing.googleapis.com', - credentials: Optional[ga_credentials.Credentials] = None, - credentials_file: Optional[str] = None, - scopes: Optional[Sequence[str]] = None, - channel: Optional[Union[aio.Channel, Callable[..., aio.Channel]]] = None, - api_mtls_endpoint: Optional[str] = None, - client_cert_source: Optional[Callable[[], Tuple[bytes, bytes]]] = None, - ssl_channel_credentials: Optional[grpc.ChannelCredentials] = None, - client_cert_source_for_mtls: Optional[Callable[[], Tuple[bytes, bytes]]] = None, - quota_project_id: Optional[str] = None, - client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO, - always_use_jwt_access: Optional[bool] = False, - api_audience: Optional[str] = None, - ) -> None: - """Instantiate the transport. - - Args: - host (Optional[str]): - The hostname to connect to (default: 'confidentialcomputing.googleapis.com'). - credentials (Optional[google.auth.credentials.Credentials]): The - authorization credentials to attach to requests. These - credentials identify the application to the service; if none - are specified, the client will attempt to ascertain the - credentials from the environment. - This argument is ignored if a ``channel`` instance is provided. - credentials_file (Optional[str]): A file with credentials that can - be loaded with :func:`google.auth.load_credentials_from_file`. - This argument is ignored if a ``channel`` instance is provided. - scopes (Optional[Sequence[str]]): A optional list of scopes needed for this - service. These are only used when credentials are not specified and - are passed to :func:`google.auth.default`. - channel (Optional[Union[aio.Channel, Callable[..., aio.Channel]]]): - A ``Channel`` instance through which to make calls, or a Callable - that constructs and returns one. If set to None, ``self.create_channel`` - is used to create the channel. If a Callable is given, it will be called - with the same arguments as used in ``self.create_channel``. - api_mtls_endpoint (Optional[str]): Deprecated. The mutual TLS endpoint. - If provided, it overrides the ``host`` argument and tries to create - a mutual TLS channel with client SSL credentials from - ``client_cert_source`` or application default SSL credentials. - client_cert_source (Optional[Callable[[], Tuple[bytes, bytes]]]): - Deprecated. A callback to provide client SSL certificate bytes and - private key bytes, both in PEM format. It is ignored if - ``api_mtls_endpoint`` is None. - ssl_channel_credentials (grpc.ChannelCredentials): SSL credentials - for the grpc channel. It is ignored if a ``channel`` instance is provided. - client_cert_source_for_mtls (Optional[Callable[[], Tuple[bytes, bytes]]]): - A callback to provide client certificate bytes and private key bytes, - both in PEM format. It is used to configure a mutual TLS channel. It is - ignored if a ``channel`` instance or ``ssl_channel_credentials`` is provided. - quota_project_id (Optional[str]): An optional project to use for billing - and quota. - client_info (google.api_core.gapic_v1.client_info.ClientInfo): - The client info used to send a user-agent string along with - API requests. If ``None``, then default info will be used. - Generally, you only need to set this if you're developing - your own client library. - always_use_jwt_access (Optional[bool]): Whether self signed JWT should - be used for service account credentials. - - Raises: - google.auth.exceptions.MutualTlsChannelError: If mutual TLS transport - creation failed for any reason. - google.api_core.exceptions.DuplicateCredentialArgs: If both ``credentials`` - and ``credentials_file`` are passed. - """ - self._grpc_channel = None - self._ssl_channel_credentials = ssl_channel_credentials - self._stubs: Dict[str, Callable] = {} - - if api_mtls_endpoint: - warnings.warn("api_mtls_endpoint is deprecated", DeprecationWarning) - if client_cert_source: - warnings.warn("client_cert_source is deprecated", DeprecationWarning) - - if isinstance(channel, aio.Channel): - # Ignore credentials if a channel was passed. - credentials = None - self._ignore_credentials = True - # If a channel was explicitly provided, set it. - self._grpc_channel = channel - self._ssl_channel_credentials = None - else: - if api_mtls_endpoint: - host = api_mtls_endpoint - - # Create SSL credentials with client_cert_source or application - # default SSL credentials. - if client_cert_source: - cert, key = client_cert_source() - self._ssl_channel_credentials = grpc.ssl_channel_credentials( - certificate_chain=cert, private_key=key - ) - else: - self._ssl_channel_credentials = SslCredentials().ssl_credentials - - else: - if client_cert_source_for_mtls and not ssl_channel_credentials: - cert, key = client_cert_source_for_mtls() - self._ssl_channel_credentials = grpc.ssl_channel_credentials( - certificate_chain=cert, private_key=key - ) - - # The base transport sets the host, credentials and scopes - super().__init__( - host=host, - credentials=credentials, - credentials_file=credentials_file, - scopes=scopes, - quota_project_id=quota_project_id, - client_info=client_info, - always_use_jwt_access=always_use_jwt_access, - api_audience=api_audience, - ) - - if not self._grpc_channel: - # initialize with the provided callable or the default channel - channel_init = channel or type(self).create_channel - self._grpc_channel = channel_init( - self._host, - # use the credentials which are saved - credentials=self._credentials, - # Set ``credentials_file`` to ``None`` here as - # the credentials that we saved earlier should be used. - credentials_file=None, - scopes=self._scopes, - ssl_credentials=self._ssl_channel_credentials, - quota_project_id=quota_project_id, - options=[ - ("grpc.max_send_message_length", -1), - ("grpc.max_receive_message_length", -1), - ], - ) - - self._interceptor = _LoggingClientAIOInterceptor() - self._grpc_channel._unary_unary_interceptors.append(self._interceptor) - self._logged_channel = self._grpc_channel - self._wrap_with_kind = "kind" in inspect.signature(gapic_v1.method_async.wrap_method).parameters - # Wrap messages. This must be done after self._logged_channel exists - self._prep_wrapped_messages(client_info) - - @property - def grpc_channel(self) -> aio.Channel: - """Create the channel designed to connect to this service. - - This property caches on the instance; repeated calls return - the same channel. - """ - # Return the channel from cache. - return self._grpc_channel - - @property - def create_challenge(self) -> Callable[ - [service.CreateChallengeRequest], - Awaitable[service.Challenge]]: - r"""Return a callable for the create challenge method over gRPC. - - Creates a new Challenge in a given project and - location. - - Returns: - Callable[[~.CreateChallengeRequest], - Awaitable[~.Challenge]]: - A function that, when called, will call the underlying RPC - on the server. - """ - # Generate a "stub function" on-the-fly which will actually make - # the request. - # gRPC handles serialization and deserialization, so we just need - # to pass in the functions for each. - if 'create_challenge' not in self._stubs: - self._stubs['create_challenge'] = self._logged_channel.unary_unary( - '/google.cloud.confidentialcomputing.v1.ConfidentialComputing/CreateChallenge', - request_serializer=service.CreateChallengeRequest.serialize, - response_deserializer=service.Challenge.deserialize, - ) - return self._stubs['create_challenge'] - - @property - def verify_attestation(self) -> Callable[ - [service.VerifyAttestationRequest], - Awaitable[service.VerifyAttestationResponse]]: - r"""Return a callable for the verify attestation method over gRPC. - - Verifies the provided attestation info, returning a - signed attestation token. - - Returns: - Callable[[~.VerifyAttestationRequest], - Awaitable[~.VerifyAttestationResponse]]: - A function that, when called, will call the underlying RPC - on the server. - """ - # Generate a "stub function" on-the-fly which will actually make - # the request. - # gRPC handles serialization and deserialization, so we just need - # to pass in the functions for each. - if 'verify_attestation' not in self._stubs: - self._stubs['verify_attestation'] = self._logged_channel.unary_unary( - '/google.cloud.confidentialcomputing.v1.ConfidentialComputing/VerifyAttestation', - request_serializer=service.VerifyAttestationRequest.serialize, - response_deserializer=service.VerifyAttestationResponse.deserialize, - ) - return self._stubs['verify_attestation'] - - @property - def verify_confidential_space(self) -> Callable[ - [service.VerifyConfidentialSpaceRequest], - Awaitable[service.VerifyConfidentialSpaceResponse]]: - r"""Return a callable for the verify confidential space method over gRPC. - - Verifies whether the provided attestation info is - valid, returning a signed attestation token if so. - - Returns: - Callable[[~.VerifyConfidentialSpaceRequest], - Awaitable[~.VerifyConfidentialSpaceResponse]]: - A function that, when called, will call the underlying RPC - on the server. - """ - # Generate a "stub function" on-the-fly which will actually make - # the request. - # gRPC handles serialization and deserialization, so we just need - # to pass in the functions for each. - if 'verify_confidential_space' not in self._stubs: - self._stubs['verify_confidential_space'] = self._logged_channel.unary_unary( - '/google.cloud.confidentialcomputing.v1.ConfidentialComputing/VerifyConfidentialSpace', - request_serializer=service.VerifyConfidentialSpaceRequest.serialize, - response_deserializer=service.VerifyConfidentialSpaceResponse.deserialize, - ) - return self._stubs['verify_confidential_space'] - - @property - def verify_confidential_gke(self) -> Callable[ - [service.VerifyConfidentialGkeRequest], - Awaitable[service.VerifyConfidentialGkeResponse]]: - r"""Return a callable for the verify confidential gke method over gRPC. - - Verifies the provided Confidential GKE attestation - info, returning a signed OIDC token. - - Returns: - Callable[[~.VerifyConfidentialGkeRequest], - Awaitable[~.VerifyConfidentialGkeResponse]]: - A function that, when called, will call the underlying RPC - on the server. - """ - # Generate a "stub function" on-the-fly which will actually make - # the request. - # gRPC handles serialization and deserialization, so we just need - # to pass in the functions for each. - if 'verify_confidential_gke' not in self._stubs: - self._stubs['verify_confidential_gke'] = self._logged_channel.unary_unary( - '/google.cloud.confidentialcomputing.v1.ConfidentialComputing/VerifyConfidentialGke', - request_serializer=service.VerifyConfidentialGkeRequest.serialize, - response_deserializer=service.VerifyConfidentialGkeResponse.deserialize, - ) - return self._stubs['verify_confidential_gke'] - - def _prep_wrapped_messages(self, client_info): - """ Precompute the wrapped methods, overriding the base class method to use async wrappers.""" - self._wrapped_methods = { - self.create_challenge: self._wrap_method( - self.create_challenge, - default_retry=retries.AsyncRetry( - initial=1.0, - maximum=60.0, - multiplier=1.3, - predicate=retries.if_exception_type( - core_exceptions.ServiceUnavailable, - ), - deadline=60.0, - ), - default_timeout=60.0, - client_info=client_info, - ), - self.verify_attestation: self._wrap_method( - self.verify_attestation, - default_retry=retries.AsyncRetry( - initial=1.0, - maximum=60.0, - multiplier=1.3, - predicate=retries.if_exception_type( - core_exceptions.ServiceUnavailable, - ), - deadline=60.0, - ), - default_timeout=60.0, - client_info=client_info, - ), - self.verify_confidential_space: self._wrap_method( - self.verify_confidential_space, - default_retry=retries.AsyncRetry( - initial=1.0, - maximum=60.0, - multiplier=1.3, - predicate=retries.if_exception_type( - core_exceptions.ServiceUnavailable, - ), - deadline=60.0, - ), - default_timeout=60.0, - client_info=client_info, - ), - self.verify_confidential_gke: self._wrap_method( - self.verify_confidential_gke, - default_retry=retries.AsyncRetry( - initial=1.0, - maximum=60.0, - multiplier=1.3, - predicate=retries.if_exception_type( - core_exceptions.ServiceUnavailable, - ), - deadline=60.0, - ), - default_timeout=60.0, - client_info=client_info, - ), - self.get_location: self._wrap_method( - self.get_location, - default_timeout=None, - client_info=client_info, - ), - self.list_locations: self._wrap_method( - self.list_locations, - default_timeout=None, - client_info=client_info, - ), - } - - def _wrap_method(self, func, *args, **kwargs): - if self._wrap_with_kind: # pragma: NO COVER - kwargs["kind"] = self.kind - return gapic_v1.method_async.wrap_method(func, *args, **kwargs) - - def close(self): - return self._logged_channel.close() - - @property - def kind(self) -> str: - return "grpc_asyncio" - - @property - def list_locations( - self, - ) -> Callable[[locations_pb2.ListLocationsRequest], locations_pb2.ListLocationsResponse]: - r"""Return a callable for the list locations method over gRPC. - """ - # Generate a "stub function" on-the-fly which will actually make - # the request. - # gRPC handles serialization and deserialization, so we just need - # to pass in the functions for each. - if "list_locations" not in self._stubs: - self._stubs["list_locations"] = self._logged_channel.unary_unary( - "/google.cloud.location.Locations/ListLocations", - request_serializer=locations_pb2.ListLocationsRequest.SerializeToString, - response_deserializer=locations_pb2.ListLocationsResponse.FromString, - ) - return self._stubs["list_locations"] - - @property - def get_location( - self, - ) -> Callable[[locations_pb2.GetLocationRequest], locations_pb2.Location]: - r"""Return a callable for the list locations method over gRPC. - """ - # Generate a "stub function" on-the-fly which will actually make - # the request. - # gRPC handles serialization and deserialization, so we just need - # to pass in the functions for each. - if "get_location" not in self._stubs: - self._stubs["get_location"] = self._logged_channel.unary_unary( - "/google.cloud.location.Locations/GetLocation", - request_serializer=locations_pb2.GetLocationRequest.SerializeToString, - response_deserializer=locations_pb2.Location.FromString, - ) - return self._stubs["get_location"] - - -__all__ = ( - 'ConfidentialComputingGrpcAsyncIOTransport', -) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest.py deleted file mode 100644 index 440084e79181..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest.py +++ /dev/null @@ -1,1179 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -import logging -import json # type: ignore - -from google.auth.transport.requests import AuthorizedSession # type: ignore -from google.auth import credentials as ga_credentials # type: ignore -from google.api_core import exceptions as core_exceptions -from google.api_core import retry as retries -from google.api_core import rest_helpers -from google.api_core import rest_streaming -from google.api_core import gapic_v1 -import google.protobuf - -from google.protobuf import json_format -from google.cloud.location import locations_pb2 # type: ignore - -from requests import __version__ as requests_version -import dataclasses -from typing import Any, Callable, Dict, List, Optional, Sequence, Tuple, Union -import warnings - - -from google.cloud.confidentialcomputing_v1.types import service - - -from .rest_base import _BaseConfidentialComputingRestTransport -from .base import DEFAULT_CLIENT_INFO as BASE_DEFAULT_CLIENT_INFO - -try: - OptionalRetry = Union[retries.Retry, gapic_v1.method._MethodDefault, None] -except AttributeError: # pragma: NO COVER - OptionalRetry = Union[retries.Retry, object, None] # type: ignore - -try: - from google.api_core import client_logging # type: ignore - CLIENT_LOGGING_SUPPORTED = True # pragma: NO COVER -except ImportError: # pragma: NO COVER - CLIENT_LOGGING_SUPPORTED = False - -_LOGGER = logging.getLogger(__name__) - -DEFAULT_CLIENT_INFO = gapic_v1.client_info.ClientInfo( - gapic_version=BASE_DEFAULT_CLIENT_INFO.gapic_version, - grpc_version=None, - rest_version=f"requests@{requests_version}", -) - -if hasattr(DEFAULT_CLIENT_INFO, "protobuf_runtime_version"): # pragma: NO COVER - DEFAULT_CLIENT_INFO.protobuf_runtime_version = google.protobuf.__version__ - - -class ConfidentialComputingRestInterceptor: - """Interceptor for ConfidentialComputing. - - Interceptors are used to manipulate requests, request metadata, and responses - in arbitrary ways. - Example use cases include: - * Logging - * Verifying requests according to service or custom semantics - * Stripping extraneous information from responses - - These use cases and more can be enabled by injecting an - instance of a custom subclass when constructing the ConfidentialComputingRestTransport. - - .. code-block:: python - class MyCustomConfidentialComputingInterceptor(ConfidentialComputingRestInterceptor): - def pre_create_challenge(self, request, metadata): - logging.log(f"Received request: {request}") - return request, metadata - - def post_create_challenge(self, response): - logging.log(f"Received response: {response}") - return response - - def pre_verify_attestation(self, request, metadata): - logging.log(f"Received request: {request}") - return request, metadata - - def post_verify_attestation(self, response): - logging.log(f"Received response: {response}") - return response - - def pre_verify_confidential_gke(self, request, metadata): - logging.log(f"Received request: {request}") - return request, metadata - - def post_verify_confidential_gke(self, response): - logging.log(f"Received response: {response}") - return response - - def pre_verify_confidential_space(self, request, metadata): - logging.log(f"Received request: {request}") - return request, metadata - - def post_verify_confidential_space(self, response): - logging.log(f"Received response: {response}") - return response - - transport = ConfidentialComputingRestTransport(interceptor=MyCustomConfidentialComputingInterceptor()) - client = ConfidentialComputingClient(transport=transport) - - - """ - def pre_create_challenge(self, request: service.CreateChallengeRequest, metadata: Sequence[Tuple[str, Union[str, bytes]]]) -> Tuple[service.CreateChallengeRequest, Sequence[Tuple[str, Union[str, bytes]]]]: - """Pre-rpc interceptor for create_challenge - - Override in a subclass to manipulate the request or metadata - before they are sent to the ConfidentialComputing server. - """ - return request, metadata - - def post_create_challenge(self, response: service.Challenge) -> service.Challenge: - """Post-rpc interceptor for create_challenge - - DEPRECATED. Please use the `post_create_challenge_with_metadata` - interceptor instead. - - Override in a subclass to read or manipulate the response - after it is returned by the ConfidentialComputing server but before - it is returned to user code. This `post_create_challenge` interceptor runs - before the `post_create_challenge_with_metadata` interceptor. - """ - return response - - def post_create_challenge_with_metadata(self, response: service.Challenge, metadata: Sequence[Tuple[str, Union[str, bytes]]]) -> Tuple[service.Challenge, Sequence[Tuple[str, Union[str, bytes]]]]: - """Post-rpc interceptor for create_challenge - - Override in a subclass to read or manipulate the response or metadata after it - is returned by the ConfidentialComputing server but before it is returned to user code. - - We recommend only using this `post_create_challenge_with_metadata` - interceptor in new development instead of the `post_create_challenge` interceptor. - When both interceptors are used, this `post_create_challenge_with_metadata` interceptor runs after the - `post_create_challenge` interceptor. The (possibly modified) response returned by - `post_create_challenge` will be passed to - `post_create_challenge_with_metadata`. - """ - return response, metadata - - def pre_verify_attestation(self, request: service.VerifyAttestationRequest, metadata: Sequence[Tuple[str, Union[str, bytes]]]) -> Tuple[service.VerifyAttestationRequest, Sequence[Tuple[str, Union[str, bytes]]]]: - """Pre-rpc interceptor for verify_attestation - - Override in a subclass to manipulate the request or metadata - before they are sent to the ConfidentialComputing server. - """ - return request, metadata - - def post_verify_attestation(self, response: service.VerifyAttestationResponse) -> service.VerifyAttestationResponse: - """Post-rpc interceptor for verify_attestation - - DEPRECATED. Please use the `post_verify_attestation_with_metadata` - interceptor instead. - - Override in a subclass to read or manipulate the response - after it is returned by the ConfidentialComputing server but before - it is returned to user code. This `post_verify_attestation` interceptor runs - before the `post_verify_attestation_with_metadata` interceptor. - """ - return response - - def post_verify_attestation_with_metadata(self, response: service.VerifyAttestationResponse, metadata: Sequence[Tuple[str, Union[str, bytes]]]) -> Tuple[service.VerifyAttestationResponse, Sequence[Tuple[str, Union[str, bytes]]]]: - """Post-rpc interceptor for verify_attestation - - Override in a subclass to read or manipulate the response or metadata after it - is returned by the ConfidentialComputing server but before it is returned to user code. - - We recommend only using this `post_verify_attestation_with_metadata` - interceptor in new development instead of the `post_verify_attestation` interceptor. - When both interceptors are used, this `post_verify_attestation_with_metadata` interceptor runs after the - `post_verify_attestation` interceptor. The (possibly modified) response returned by - `post_verify_attestation` will be passed to - `post_verify_attestation_with_metadata`. - """ - return response, metadata - - def pre_verify_confidential_gke(self, request: service.VerifyConfidentialGkeRequest, metadata: Sequence[Tuple[str, Union[str, bytes]]]) -> Tuple[service.VerifyConfidentialGkeRequest, Sequence[Tuple[str, Union[str, bytes]]]]: - """Pre-rpc interceptor for verify_confidential_gke - - Override in a subclass to manipulate the request or metadata - before they are sent to the ConfidentialComputing server. - """ - return request, metadata - - def post_verify_confidential_gke(self, response: service.VerifyConfidentialGkeResponse) -> service.VerifyConfidentialGkeResponse: - """Post-rpc interceptor for verify_confidential_gke - - DEPRECATED. Please use the `post_verify_confidential_gke_with_metadata` - interceptor instead. - - Override in a subclass to read or manipulate the response - after it is returned by the ConfidentialComputing server but before - it is returned to user code. This `post_verify_confidential_gke` interceptor runs - before the `post_verify_confidential_gke_with_metadata` interceptor. - """ - return response - - def post_verify_confidential_gke_with_metadata(self, response: service.VerifyConfidentialGkeResponse, metadata: Sequence[Tuple[str, Union[str, bytes]]]) -> Tuple[service.VerifyConfidentialGkeResponse, Sequence[Tuple[str, Union[str, bytes]]]]: - """Post-rpc interceptor for verify_confidential_gke - - Override in a subclass to read or manipulate the response or metadata after it - is returned by the ConfidentialComputing server but before it is returned to user code. - - We recommend only using this `post_verify_confidential_gke_with_metadata` - interceptor in new development instead of the `post_verify_confidential_gke` interceptor. - When both interceptors are used, this `post_verify_confidential_gke_with_metadata` interceptor runs after the - `post_verify_confidential_gke` interceptor. The (possibly modified) response returned by - `post_verify_confidential_gke` will be passed to - `post_verify_confidential_gke_with_metadata`. - """ - return response, metadata - - def pre_verify_confidential_space(self, request: service.VerifyConfidentialSpaceRequest, metadata: Sequence[Tuple[str, Union[str, bytes]]]) -> Tuple[service.VerifyConfidentialSpaceRequest, Sequence[Tuple[str, Union[str, bytes]]]]: - """Pre-rpc interceptor for verify_confidential_space - - Override in a subclass to manipulate the request or metadata - before they are sent to the ConfidentialComputing server. - """ - return request, metadata - - def post_verify_confidential_space(self, response: service.VerifyConfidentialSpaceResponse) -> service.VerifyConfidentialSpaceResponse: - """Post-rpc interceptor for verify_confidential_space - - DEPRECATED. Please use the `post_verify_confidential_space_with_metadata` - interceptor instead. - - Override in a subclass to read or manipulate the response - after it is returned by the ConfidentialComputing server but before - it is returned to user code. This `post_verify_confidential_space` interceptor runs - before the `post_verify_confidential_space_with_metadata` interceptor. - """ - return response - - def post_verify_confidential_space_with_metadata(self, response: service.VerifyConfidentialSpaceResponse, metadata: Sequence[Tuple[str, Union[str, bytes]]]) -> Tuple[service.VerifyConfidentialSpaceResponse, Sequence[Tuple[str, Union[str, bytes]]]]: - """Post-rpc interceptor for verify_confidential_space - - Override in a subclass to read or manipulate the response or metadata after it - is returned by the ConfidentialComputing server but before it is returned to user code. - - We recommend only using this `post_verify_confidential_space_with_metadata` - interceptor in new development instead of the `post_verify_confidential_space` interceptor. - When both interceptors are used, this `post_verify_confidential_space_with_metadata` interceptor runs after the - `post_verify_confidential_space` interceptor. The (possibly modified) response returned by - `post_verify_confidential_space` will be passed to - `post_verify_confidential_space_with_metadata`. - """ - return response, metadata - - def pre_get_location( - self, request: locations_pb2.GetLocationRequest, metadata: Sequence[Tuple[str, Union[str, bytes]]] - ) -> Tuple[locations_pb2.GetLocationRequest, Sequence[Tuple[str, Union[str, bytes]]]]: - """Pre-rpc interceptor for get_location - - Override in a subclass to manipulate the request or metadata - before they are sent to the ConfidentialComputing server. - """ - return request, metadata - - def post_get_location( - self, response: locations_pb2.Location - ) -> locations_pb2.Location: - """Post-rpc interceptor for get_location - - Override in a subclass to manipulate the response - after it is returned by the ConfidentialComputing server but before - it is returned to user code. - """ - return response - - def pre_list_locations( - self, request: locations_pb2.ListLocationsRequest, metadata: Sequence[Tuple[str, Union[str, bytes]]] - ) -> Tuple[locations_pb2.ListLocationsRequest, Sequence[Tuple[str, Union[str, bytes]]]]: - """Pre-rpc interceptor for list_locations - - Override in a subclass to manipulate the request or metadata - before they are sent to the ConfidentialComputing server. - """ - return request, metadata - - def post_list_locations( - self, response: locations_pb2.ListLocationsResponse - ) -> locations_pb2.ListLocationsResponse: - """Post-rpc interceptor for list_locations - - Override in a subclass to manipulate the response - after it is returned by the ConfidentialComputing server but before - it is returned to user code. - """ - return response - - -@dataclasses.dataclass -class ConfidentialComputingRestStub: - _session: AuthorizedSession - _host: str - _interceptor: ConfidentialComputingRestInterceptor - - -class ConfidentialComputingRestTransport(_BaseConfidentialComputingRestTransport): - """REST backend synchronous transport for ConfidentialComputing. - - Service describing handlers for resources - - This class defines the same methods as the primary client, so the - primary client can load the underlying transport implementation - and call it. - - It sends JSON representations of protocol buffers over HTTP/1.1 - """ - - def __init__(self, *, - host: str = 'confidentialcomputing.googleapis.com', - credentials: Optional[ga_credentials.Credentials] = None, - credentials_file: Optional[str] = None, - scopes: Optional[Sequence[str]] = None, - client_cert_source_for_mtls: Optional[Callable[[ - ], Tuple[bytes, bytes]]] = None, - quota_project_id: Optional[str] = None, - client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO, - always_use_jwt_access: Optional[bool] = False, - url_scheme: str = 'https', - interceptor: Optional[ConfidentialComputingRestInterceptor] = None, - api_audience: Optional[str] = None, - ) -> None: - """Instantiate the transport. - - Args: - host (Optional[str]): - The hostname to connect to (default: 'confidentialcomputing.googleapis.com'). - credentials (Optional[google.auth.credentials.Credentials]): The - authorization credentials to attach to requests. These - credentials identify the application to the service; if none - are specified, the client will attempt to ascertain the - credentials from the environment. - - credentials_file (Optional[str]): A file with credentials that can - be loaded with :func:`google.auth.load_credentials_from_file`. - This argument is ignored if ``channel`` is provided. - scopes (Optional(Sequence[str])): A list of scopes. This argument is - ignored if ``channel`` is provided. - client_cert_source_for_mtls (Callable[[], Tuple[bytes, bytes]]): Client - certificate to configure mutual TLS HTTP channel. It is ignored - if ``channel`` is provided. - quota_project_id (Optional[str]): An optional project to use for billing - and quota. - client_info (google.api_core.gapic_v1.client_info.ClientInfo): - The client info used to send a user-agent string along with - API requests. If ``None``, then default info will be used. - Generally, you only need to set this if you are developing - your own client library. - always_use_jwt_access (Optional[bool]): Whether self signed JWT should - be used for service account credentials. - url_scheme: the protocol scheme for the API endpoint. Normally - "https", but for testing or local servers, - "http" can be specified. - """ - # Run the base constructor - # TODO(yon-mg): resolve other ctor params i.e. scopes, quota, etc. - # TODO: When custom host (api_endpoint) is set, `scopes` must *also* be set on the - # credentials object - super().__init__( - host=host, - credentials=credentials, - client_info=client_info, - always_use_jwt_access=always_use_jwt_access, - url_scheme=url_scheme, - api_audience=api_audience - ) - self._session = AuthorizedSession( - self._credentials, default_host=self.DEFAULT_HOST) - if client_cert_source_for_mtls: - self._session.configure_mtls_channel(client_cert_source_for_mtls) - self._interceptor = interceptor or ConfidentialComputingRestInterceptor() - self._prep_wrapped_messages(client_info) - - class _CreateChallenge(_BaseConfidentialComputingRestTransport._BaseCreateChallenge, ConfidentialComputingRestStub): - def __hash__(self): - return hash("ConfidentialComputingRestTransport.CreateChallenge") - - @staticmethod - def _get_response( - host, - metadata, - query_params, - session, - timeout, - transcoded_request, - body=None): - - uri = transcoded_request['uri'] - method = transcoded_request['method'] - headers = dict(metadata) - headers['Content-Type'] = 'application/json' - response = getattr(session, method)( - "{host}{uri}".format(host=host, uri=uri), - timeout=timeout, - headers=headers, - params=rest_helpers.flatten_query_params(query_params, strict=True), - data=body, - ) - return response - - def __call__(self, - request: service.CreateChallengeRequest, *, - retry: OptionalRetry=gapic_v1.method.DEFAULT, - timeout: Optional[float]=None, - metadata: Sequence[Tuple[str, Union[str, bytes]]]=(), - ) -> service.Challenge: - r"""Call the create challenge method over HTTP. - - Args: - request (~.service.CreateChallengeRequest): - The request object. Message for creating a Challenge - retry (google.api_core.retry.Retry): Designation of what errors, if any, - should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - - Returns: - ~.service.Challenge: - A Challenge from the server used to - guarantee freshness of attestations - - """ - - http_options = _BaseConfidentialComputingRestTransport._BaseCreateChallenge._get_http_options() - - request, metadata = self._interceptor.pre_create_challenge(request, metadata) - transcoded_request = _BaseConfidentialComputingRestTransport._BaseCreateChallenge._get_transcoded_request(http_options, request) - - body = _BaseConfidentialComputingRestTransport._BaseCreateChallenge._get_request_body_json(transcoded_request) - - # Jsonify the query params - query_params = _BaseConfidentialComputingRestTransport._BaseCreateChallenge._get_query_params_json(transcoded_request) - - if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER - request_url = "{host}{uri}".format(host=self._host, uri=transcoded_request['uri']) - method = transcoded_request['method'] - try: - request_payload = type(request).to_json(request) - except: - request_payload = None - http_request = { - "payload": request_payload, - "requestMethod": method, - "requestUrl": request_url, - "headers": dict(metadata), - } - _LOGGER.debug( - f"Sending request for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.CreateChallenge", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "rpcName": "CreateChallenge", - "httpRequest": http_request, - "metadata": http_request["headers"], - }, - ) - - # Send the request - response = ConfidentialComputingRestTransport._CreateChallenge._get_response(self._host, metadata, query_params, self._session, timeout, transcoded_request, body) - - # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception - # subclass. - if response.status_code >= 400: - raise core_exceptions.from_http_response(response) - - # Return the response - resp = service.Challenge() - pb_resp = service.Challenge.pb(resp) - - json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True) - - resp = self._interceptor.post_create_challenge(resp) - response_metadata = [(k, str(v)) for k, v in response.headers.items()] - resp, _ = self._interceptor.post_create_challenge_with_metadata(resp, response_metadata) - if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER - try: - response_payload = service.Challenge.to_json(response) - except: - response_payload = None - http_response = { - "payload": response_payload, - "headers": dict(response.headers), - "status": response.status_code, - } - _LOGGER.debug( - "Received response for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.create_challenge", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "rpcName": "CreateChallenge", - "metadata": http_response["headers"], - "httpResponse": http_response, - }, - ) - return resp - - class _VerifyAttestation(_BaseConfidentialComputingRestTransport._BaseVerifyAttestation, ConfidentialComputingRestStub): - def __hash__(self): - return hash("ConfidentialComputingRestTransport.VerifyAttestation") - - @staticmethod - def _get_response( - host, - metadata, - query_params, - session, - timeout, - transcoded_request, - body=None): - - uri = transcoded_request['uri'] - method = transcoded_request['method'] - headers = dict(metadata) - headers['Content-Type'] = 'application/json' - response = getattr(session, method)( - "{host}{uri}".format(host=host, uri=uri), - timeout=timeout, - headers=headers, - params=rest_helpers.flatten_query_params(query_params, strict=True), - data=body, - ) - return response - - def __call__(self, - request: service.VerifyAttestationRequest, *, - retry: OptionalRetry=gapic_v1.method.DEFAULT, - timeout: Optional[float]=None, - metadata: Sequence[Tuple[str, Union[str, bytes]]]=(), - ) -> service.VerifyAttestationResponse: - r"""Call the verify attestation method over HTTP. - - Args: - request (~.service.VerifyAttestationRequest): - The request object. A request for an attestation token, - providing all the necessary information - needed for this service to verify the - platform state of the requestor. - retry (google.api_core.retry.Retry): Designation of what errors, if any, - should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - - Returns: - ~.service.VerifyAttestationResponse: - A response once an attestation has - been successfully verified, containing a - signed attestation token. - - """ - - http_options = _BaseConfidentialComputingRestTransport._BaseVerifyAttestation._get_http_options() - - request, metadata = self._interceptor.pre_verify_attestation(request, metadata) - transcoded_request = _BaseConfidentialComputingRestTransport._BaseVerifyAttestation._get_transcoded_request(http_options, request) - - body = _BaseConfidentialComputingRestTransport._BaseVerifyAttestation._get_request_body_json(transcoded_request) - - # Jsonify the query params - query_params = _BaseConfidentialComputingRestTransport._BaseVerifyAttestation._get_query_params_json(transcoded_request) - - if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER - request_url = "{host}{uri}".format(host=self._host, uri=transcoded_request['uri']) - method = transcoded_request['method'] - try: - request_payload = type(request).to_json(request) - except: - request_payload = None - http_request = { - "payload": request_payload, - "requestMethod": method, - "requestUrl": request_url, - "headers": dict(metadata), - } - _LOGGER.debug( - f"Sending request for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.VerifyAttestation", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "rpcName": "VerifyAttestation", - "httpRequest": http_request, - "metadata": http_request["headers"], - }, - ) - - # Send the request - response = ConfidentialComputingRestTransport._VerifyAttestation._get_response(self._host, metadata, query_params, self._session, timeout, transcoded_request, body) - - # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception - # subclass. - if response.status_code >= 400: - raise core_exceptions.from_http_response(response) - - # Return the response - resp = service.VerifyAttestationResponse() - pb_resp = service.VerifyAttestationResponse.pb(resp) - - json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True) - - resp = self._interceptor.post_verify_attestation(resp) - response_metadata = [(k, str(v)) for k, v in response.headers.items()] - resp, _ = self._interceptor.post_verify_attestation_with_metadata(resp, response_metadata) - if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER - try: - response_payload = service.VerifyAttestationResponse.to_json(response) - except: - response_payload = None - http_response = { - "payload": response_payload, - "headers": dict(response.headers), - "status": response.status_code, - } - _LOGGER.debug( - "Received response for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.verify_attestation", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "rpcName": "VerifyAttestation", - "metadata": http_response["headers"], - "httpResponse": http_response, - }, - ) - return resp - - class _VerifyConfidentialGke(_BaseConfidentialComputingRestTransport._BaseVerifyConfidentialGke, ConfidentialComputingRestStub): - def __hash__(self): - return hash("ConfidentialComputingRestTransport.VerifyConfidentialGke") - - @staticmethod - def _get_response( - host, - metadata, - query_params, - session, - timeout, - transcoded_request, - body=None): - - uri = transcoded_request['uri'] - method = transcoded_request['method'] - headers = dict(metadata) - headers['Content-Type'] = 'application/json' - response = getattr(session, method)( - "{host}{uri}".format(host=host, uri=uri), - timeout=timeout, - headers=headers, - params=rest_helpers.flatten_query_params(query_params, strict=True), - data=body, - ) - return response - - def __call__(self, - request: service.VerifyConfidentialGkeRequest, *, - retry: OptionalRetry=gapic_v1.method.DEFAULT, - timeout: Optional[float]=None, - metadata: Sequence[Tuple[str, Union[str, bytes]]]=(), - ) -> service.VerifyConfidentialGkeResponse: - r"""Call the verify confidential gke method over HTTP. - - Args: - request (~.service.VerifyConfidentialGkeRequest): - The request object. A request for an attestation token, - providing all the necessary information - needed for this service to verify - Confidential GKE platform state of the - requestor. - retry (google.api_core.retry.Retry): Designation of what errors, if any, - should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - - Returns: - ~.service.VerifyConfidentialGkeResponse: - VerifyConfidentialGkeResponse - response is returened once a - Confidential GKE attestation has been - successfully verified, containing a - signed OIDC token. - - """ - - http_options = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialGke._get_http_options() - - request, metadata = self._interceptor.pre_verify_confidential_gke(request, metadata) - transcoded_request = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialGke._get_transcoded_request(http_options, request) - - body = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialGke._get_request_body_json(transcoded_request) - - # Jsonify the query params - query_params = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialGke._get_query_params_json(transcoded_request) - - if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER - request_url = "{host}{uri}".format(host=self._host, uri=transcoded_request['uri']) - method = transcoded_request['method'] - try: - request_payload = type(request).to_json(request) - except: - request_payload = None - http_request = { - "payload": request_payload, - "requestMethod": method, - "requestUrl": request_url, - "headers": dict(metadata), - } - _LOGGER.debug( - f"Sending request for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.VerifyConfidentialGke", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "rpcName": "VerifyConfidentialGke", - "httpRequest": http_request, - "metadata": http_request["headers"], - }, - ) - - # Send the request - response = ConfidentialComputingRestTransport._VerifyConfidentialGke._get_response(self._host, metadata, query_params, self._session, timeout, transcoded_request, body) - - # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception - # subclass. - if response.status_code >= 400: - raise core_exceptions.from_http_response(response) - - # Return the response - resp = service.VerifyConfidentialGkeResponse() - pb_resp = service.VerifyConfidentialGkeResponse.pb(resp) - - json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True) - - resp = self._interceptor.post_verify_confidential_gke(resp) - response_metadata = [(k, str(v)) for k, v in response.headers.items()] - resp, _ = self._interceptor.post_verify_confidential_gke_with_metadata(resp, response_metadata) - if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER - try: - response_payload = service.VerifyConfidentialGkeResponse.to_json(response) - except: - response_payload = None - http_response = { - "payload": response_payload, - "headers": dict(response.headers), - "status": response.status_code, - } - _LOGGER.debug( - "Received response for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.verify_confidential_gke", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "rpcName": "VerifyConfidentialGke", - "metadata": http_response["headers"], - "httpResponse": http_response, - }, - ) - return resp - - class _VerifyConfidentialSpace(_BaseConfidentialComputingRestTransport._BaseVerifyConfidentialSpace, ConfidentialComputingRestStub): - def __hash__(self): - return hash("ConfidentialComputingRestTransport.VerifyConfidentialSpace") - - @staticmethod - def _get_response( - host, - metadata, - query_params, - session, - timeout, - transcoded_request, - body=None): - - uri = transcoded_request['uri'] - method = transcoded_request['method'] - headers = dict(metadata) - headers['Content-Type'] = 'application/json' - response = getattr(session, method)( - "{host}{uri}".format(host=host, uri=uri), - timeout=timeout, - headers=headers, - params=rest_helpers.flatten_query_params(query_params, strict=True), - data=body, - ) - return response - - def __call__(self, - request: service.VerifyConfidentialSpaceRequest, *, - retry: OptionalRetry=gapic_v1.method.DEFAULT, - timeout: Optional[float]=None, - metadata: Sequence[Tuple[str, Union[str, bytes]]]=(), - ) -> service.VerifyConfidentialSpaceResponse: - r"""Call the verify confidential space method over HTTP. - - Args: - request (~.service.VerifyConfidentialSpaceRequest): - The request object. A request for an attestation token, - providing all the necessary information - needed for this service to verify the - platform state of the requestor. - retry (google.api_core.retry.Retry): Designation of what errors, if any, - should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - - Returns: - ~.service.VerifyConfidentialSpaceResponse: - VerifyConfidentialSpaceResponse is - returned once a Confidential Space - attestation has been successfully - verified, containing a signed token. - - """ - - http_options = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialSpace._get_http_options() - - request, metadata = self._interceptor.pre_verify_confidential_space(request, metadata) - transcoded_request = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialSpace._get_transcoded_request(http_options, request) - - body = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialSpace._get_request_body_json(transcoded_request) - - # Jsonify the query params - query_params = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialSpace._get_query_params_json(transcoded_request) - - if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER - request_url = "{host}{uri}".format(host=self._host, uri=transcoded_request['uri']) - method = transcoded_request['method'] - try: - request_payload = type(request).to_json(request) - except: - request_payload = None - http_request = { - "payload": request_payload, - "requestMethod": method, - "requestUrl": request_url, - "headers": dict(metadata), - } - _LOGGER.debug( - f"Sending request for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.VerifyConfidentialSpace", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "rpcName": "VerifyConfidentialSpace", - "httpRequest": http_request, - "metadata": http_request["headers"], - }, - ) - - # Send the request - response = ConfidentialComputingRestTransport._VerifyConfidentialSpace._get_response(self._host, metadata, query_params, self._session, timeout, transcoded_request, body) - - # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception - # subclass. - if response.status_code >= 400: - raise core_exceptions.from_http_response(response) - - # Return the response - resp = service.VerifyConfidentialSpaceResponse() - pb_resp = service.VerifyConfidentialSpaceResponse.pb(resp) - - json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True) - - resp = self._interceptor.post_verify_confidential_space(resp) - response_metadata = [(k, str(v)) for k, v in response.headers.items()] - resp, _ = self._interceptor.post_verify_confidential_space_with_metadata(resp, response_metadata) - if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER - try: - response_payload = service.VerifyConfidentialSpaceResponse.to_json(response) - except: - response_payload = None - http_response = { - "payload": response_payload, - "headers": dict(response.headers), - "status": response.status_code, - } - _LOGGER.debug( - "Received response for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.verify_confidential_space", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "rpcName": "VerifyConfidentialSpace", - "metadata": http_response["headers"], - "httpResponse": http_response, - }, - ) - return resp - - @property - def create_challenge(self) -> Callable[ - [service.CreateChallengeRequest], - service.Challenge]: - # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here. - # In C++ this would require a dynamic_cast - return self._CreateChallenge(self._session, self._host, self._interceptor) # type: ignore - - @property - def verify_attestation(self) -> Callable[ - [service.VerifyAttestationRequest], - service.VerifyAttestationResponse]: - # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here. - # In C++ this would require a dynamic_cast - return self._VerifyAttestation(self._session, self._host, self._interceptor) # type: ignore - - @property - def verify_confidential_gke(self) -> Callable[ - [service.VerifyConfidentialGkeRequest], - service.VerifyConfidentialGkeResponse]: - # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here. - # In C++ this would require a dynamic_cast - return self._VerifyConfidentialGke(self._session, self._host, self._interceptor) # type: ignore - - @property - def verify_confidential_space(self) -> Callable[ - [service.VerifyConfidentialSpaceRequest], - service.VerifyConfidentialSpaceResponse]: - # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here. - # In C++ this would require a dynamic_cast - return self._VerifyConfidentialSpace(self._session, self._host, self._interceptor) # type: ignore - - @property - def get_location(self): - return self._GetLocation(self._session, self._host, self._interceptor) # type: ignore - - class _GetLocation(_BaseConfidentialComputingRestTransport._BaseGetLocation, ConfidentialComputingRestStub): - def __hash__(self): - return hash("ConfidentialComputingRestTransport.GetLocation") - - @staticmethod - def _get_response( - host, - metadata, - query_params, - session, - timeout, - transcoded_request, - body=None): - - uri = transcoded_request['uri'] - method = transcoded_request['method'] - headers = dict(metadata) - headers['Content-Type'] = 'application/json' - response = getattr(session, method)( - "{host}{uri}".format(host=host, uri=uri), - timeout=timeout, - headers=headers, - params=rest_helpers.flatten_query_params(query_params, strict=True), - ) - return response - - def __call__(self, - request: locations_pb2.GetLocationRequest, *, - retry: OptionalRetry=gapic_v1.method.DEFAULT, - timeout: Optional[float]=None, - metadata: Sequence[Tuple[str, Union[str, bytes]]]=(), - ) -> locations_pb2.Location: - - r"""Call the get location method over HTTP. - - Args: - request (locations_pb2.GetLocationRequest): - The request object for GetLocation method. - retry (google.api_core.retry.Retry): Designation of what errors, if any, - should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - - Returns: - locations_pb2.Location: Response from GetLocation method. - """ - - http_options = _BaseConfidentialComputingRestTransport._BaseGetLocation._get_http_options() - - request, metadata = self._interceptor.pre_get_location(request, metadata) - transcoded_request = _BaseConfidentialComputingRestTransport._BaseGetLocation._get_transcoded_request(http_options, request) - - # Jsonify the query params - query_params = _BaseConfidentialComputingRestTransport._BaseGetLocation._get_query_params_json(transcoded_request) - - if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER - request_url = "{host}{uri}".format(host=self._host, uri=transcoded_request['uri']) - method = transcoded_request['method'] - try: - request_payload = json_format.MessageToJson(request) - except: - request_payload = None - http_request = { - "payload": request_payload, - "requestMethod": method, - "requestUrl": request_url, - "headers": dict(metadata), - } - _LOGGER.debug( - f"Sending request for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.GetLocation", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "rpcName": "GetLocation", - "httpRequest": http_request, - "metadata": http_request["headers"], - }, - ) - - # Send the request - response = ConfidentialComputingRestTransport._GetLocation._get_response(self._host, metadata, query_params, self._session, timeout, transcoded_request) - - # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception - # subclass. - if response.status_code >= 400: - raise core_exceptions.from_http_response(response) - - content = response.content.decode("utf-8") - resp = locations_pb2.Location() - resp = json_format.Parse(content, resp) - resp = self._interceptor.post_get_location(resp) - if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER - try: - response_payload = json_format.MessageToJson(resp) - except: - response_payload = None - http_response = { - "payload": response_payload, - "headers": dict(response.headers), - "status": response.status_code, - } - _LOGGER.debug( - "Received response for google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient.GetLocation", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "rpcName": "GetLocation", - "httpResponse": http_response, - "metadata": http_response["headers"], - }, - ) - return resp - - @property - def list_locations(self): - return self._ListLocations(self._session, self._host, self._interceptor) # type: ignore - - class _ListLocations(_BaseConfidentialComputingRestTransport._BaseListLocations, ConfidentialComputingRestStub): - def __hash__(self): - return hash("ConfidentialComputingRestTransport.ListLocations") - - @staticmethod - def _get_response( - host, - metadata, - query_params, - session, - timeout, - transcoded_request, - body=None): - - uri = transcoded_request['uri'] - method = transcoded_request['method'] - headers = dict(metadata) - headers['Content-Type'] = 'application/json' - response = getattr(session, method)( - "{host}{uri}".format(host=host, uri=uri), - timeout=timeout, - headers=headers, - params=rest_helpers.flatten_query_params(query_params, strict=True), - ) - return response - - def __call__(self, - request: locations_pb2.ListLocationsRequest, *, - retry: OptionalRetry=gapic_v1.method.DEFAULT, - timeout: Optional[float]=None, - metadata: Sequence[Tuple[str, Union[str, bytes]]]=(), - ) -> locations_pb2.ListLocationsResponse: - - r"""Call the list locations method over HTTP. - - Args: - request (locations_pb2.ListLocationsRequest): - The request object for ListLocations method. - retry (google.api_core.retry.Retry): Designation of what errors, if any, - should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - - Returns: - locations_pb2.ListLocationsResponse: Response from ListLocations method. - """ - - http_options = _BaseConfidentialComputingRestTransport._BaseListLocations._get_http_options() - - request, metadata = self._interceptor.pre_list_locations(request, metadata) - transcoded_request = _BaseConfidentialComputingRestTransport._BaseListLocations._get_transcoded_request(http_options, request) - - # Jsonify the query params - query_params = _BaseConfidentialComputingRestTransport._BaseListLocations._get_query_params_json(transcoded_request) - - if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER - request_url = "{host}{uri}".format(host=self._host, uri=transcoded_request['uri']) - method = transcoded_request['method'] - try: - request_payload = json_format.MessageToJson(request) - except: - request_payload = None - http_request = { - "payload": request_payload, - "requestMethod": method, - "requestUrl": request_url, - "headers": dict(metadata), - } - _LOGGER.debug( - f"Sending request for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.ListLocations", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "rpcName": "ListLocations", - "httpRequest": http_request, - "metadata": http_request["headers"], - }, - ) - - # Send the request - response = ConfidentialComputingRestTransport._ListLocations._get_response(self._host, metadata, query_params, self._session, timeout, transcoded_request) - - # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception - # subclass. - if response.status_code >= 400: - raise core_exceptions.from_http_response(response) - - content = response.content.decode("utf-8") - resp = locations_pb2.ListLocationsResponse() - resp = json_format.Parse(content, resp) - resp = self._interceptor.post_list_locations(resp) - if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER - try: - response_payload = json_format.MessageToJson(resp) - except: - response_payload = None - http_response = { - "payload": response_payload, - "headers": dict(response.headers), - "status": response.status_code, - } - _LOGGER.debug( - "Received response for google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient.ListLocations", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "rpcName": "ListLocations", - "httpResponse": http_response, - "metadata": http_response["headers"], - }, - ) - return resp - - @property - def kind(self) -> str: - return "rest" - - def close(self): - self._session.close() - - -__all__=( - 'ConfidentialComputingRestTransport', -) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest_base.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest_base.py deleted file mode 100644 index b75b206a52f7..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest_base.py +++ /dev/null @@ -1,330 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -import json # type: ignore -from google.api_core import path_template -from google.api_core import gapic_v1 - -from google.protobuf import json_format -from google.cloud.location import locations_pb2 # type: ignore -from .base import ConfidentialComputingTransport, DEFAULT_CLIENT_INFO - -import re -from typing import Any, Callable, Dict, List, Optional, Sequence, Tuple, Union - - -from google.cloud.confidentialcomputing_v1.types import service - - -class _BaseConfidentialComputingRestTransport(ConfidentialComputingTransport): - """Base REST backend transport for ConfidentialComputing. - - Note: This class is not meant to be used directly. Use its sync and - async sub-classes instead. - - This class defines the same methods as the primary client, so the - primary client can load the underlying transport implementation - and call it. - - It sends JSON representations of protocol buffers over HTTP/1.1 - """ - - def __init__(self, *, - host: str = 'confidentialcomputing.googleapis.com', - credentials: Optional[Any] = None, - client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO, - always_use_jwt_access: Optional[bool] = False, - url_scheme: str = 'https', - api_audience: Optional[str] = None, - ) -> None: - """Instantiate the transport. - Args: - host (Optional[str]): - The hostname to connect to (default: 'confidentialcomputing.googleapis.com'). - credentials (Optional[Any]): The - authorization credentials to attach to requests. These - credentials identify the application to the service; if none - are specified, the client will attempt to ascertain the - credentials from the environment. - client_info (google.api_core.gapic_v1.client_info.ClientInfo): - The client info used to send a user-agent string along with - API requests. If ``None``, then default info will be used. - Generally, you only need to set this if you are developing - your own client library. - always_use_jwt_access (Optional[bool]): Whether self signed JWT should - be used for service account credentials. - url_scheme: the protocol scheme for the API endpoint. Normally - "https", but for testing or local servers, - "http" can be specified. - """ - # Run the base constructor - maybe_url_match = re.match("^(?Phttp(?:s)?://)?(?P.*)$", host) - if maybe_url_match is None: - raise ValueError(f"Unexpected hostname structure: {host}") # pragma: NO COVER - - url_match_items = maybe_url_match.groupdict() - - host = f"{url_scheme}://{host}" if not url_match_items["scheme"] else host - - super().__init__( - host=host, - credentials=credentials, - client_info=client_info, - always_use_jwt_access=always_use_jwt_access, - api_audience=api_audience - ) - - class _BaseCreateChallenge: - def __hash__(self): # pragma: NO COVER - return NotImplementedError("__hash__ must be implemented.") - - __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = { - } - - @classmethod - def _get_unset_required_fields(cls, message_dict): - return {k: v for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items() if k not in message_dict} - - @staticmethod - def _get_http_options(): - http_options: List[Dict[str, str]] = [{ - 'method': 'post', - 'uri': '/v1/{parent=projects/*/locations/*}/challenges', - 'body': 'challenge', - }, - ] - return http_options - - @staticmethod - def _get_transcoded_request(http_options, request): - pb_request = service.CreateChallengeRequest.pb(request) - transcoded_request = path_template.transcode(http_options, pb_request) - return transcoded_request - - @staticmethod - def _get_request_body_json(transcoded_request): - # Jsonify the request body - - body = json_format.MessageToJson( - transcoded_request['body'], - use_integers_for_enums=True - ) - return body - @staticmethod - def _get_query_params_json(transcoded_request): - query_params = json.loads(json_format.MessageToJson( - transcoded_request['query_params'], - use_integers_for_enums=True, - )) - query_params.update(_BaseConfidentialComputingRestTransport._BaseCreateChallenge._get_unset_required_fields(query_params)) - - query_params["$alt"] = "json;enum-encoding=int" - return query_params - - class _BaseVerifyAttestation: - def __hash__(self): # pragma: NO COVER - return NotImplementedError("__hash__ must be implemented.") - - __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = { - } - - @classmethod - def _get_unset_required_fields(cls, message_dict): - return {k: v for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items() if k not in message_dict} - - @staticmethod - def _get_http_options(): - http_options: List[Dict[str, str]] = [{ - 'method': 'post', - 'uri': '/v1/{challenge=projects/*/locations/*/challenges/*}:verifyAttestation', - 'body': '*', - }, - ] - return http_options - - @staticmethod - def _get_transcoded_request(http_options, request): - pb_request = service.VerifyAttestationRequest.pb(request) - transcoded_request = path_template.transcode(http_options, pb_request) - return transcoded_request - - @staticmethod - def _get_request_body_json(transcoded_request): - # Jsonify the request body - - body = json_format.MessageToJson( - transcoded_request['body'], - use_integers_for_enums=True - ) - return body - @staticmethod - def _get_query_params_json(transcoded_request): - query_params = json.loads(json_format.MessageToJson( - transcoded_request['query_params'], - use_integers_for_enums=True, - )) - query_params.update(_BaseConfidentialComputingRestTransport._BaseVerifyAttestation._get_unset_required_fields(query_params)) - - query_params["$alt"] = "json;enum-encoding=int" - return query_params - - class _BaseVerifyConfidentialGke: - def __hash__(self): # pragma: NO COVER - return NotImplementedError("__hash__ must be implemented.") - - __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = { - } - - @classmethod - def _get_unset_required_fields(cls, message_dict): - return {k: v for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items() if k not in message_dict} - - @staticmethod - def _get_http_options(): - http_options: List[Dict[str, str]] = [{ - 'method': 'post', - 'uri': '/v1/{challenge=projects/*/locations/*/challenges/*}:verifyConfidentialGke', - 'body': '*', - }, - ] - return http_options - - @staticmethod - def _get_transcoded_request(http_options, request): - pb_request = service.VerifyConfidentialGkeRequest.pb(request) - transcoded_request = path_template.transcode(http_options, pb_request) - return transcoded_request - - @staticmethod - def _get_request_body_json(transcoded_request): - # Jsonify the request body - - body = json_format.MessageToJson( - transcoded_request['body'], - use_integers_for_enums=True - ) - return body - @staticmethod - def _get_query_params_json(transcoded_request): - query_params = json.loads(json_format.MessageToJson( - transcoded_request['query_params'], - use_integers_for_enums=True, - )) - query_params.update(_BaseConfidentialComputingRestTransport._BaseVerifyConfidentialGke._get_unset_required_fields(query_params)) - - query_params["$alt"] = "json;enum-encoding=int" - return query_params - - class _BaseVerifyConfidentialSpace: - def __hash__(self): # pragma: NO COVER - return NotImplementedError("__hash__ must be implemented.") - - __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = { - } - - @classmethod - def _get_unset_required_fields(cls, message_dict): - return {k: v for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items() if k not in message_dict} - - @staticmethod - def _get_http_options(): - http_options: List[Dict[str, str]] = [{ - 'method': 'post', - 'uri': '/v1/{challenge=projects/*/locations/*/challenges/*}:verifyConfidentialSpace', - 'body': '*', - }, - ] - return http_options - - @staticmethod - def _get_transcoded_request(http_options, request): - pb_request = service.VerifyConfidentialSpaceRequest.pb(request) - transcoded_request = path_template.transcode(http_options, pb_request) - return transcoded_request - - @staticmethod - def _get_request_body_json(transcoded_request): - # Jsonify the request body - - body = json_format.MessageToJson( - transcoded_request['body'], - use_integers_for_enums=True - ) - return body - @staticmethod - def _get_query_params_json(transcoded_request): - query_params = json.loads(json_format.MessageToJson( - transcoded_request['query_params'], - use_integers_for_enums=True, - )) - query_params.update(_BaseConfidentialComputingRestTransport._BaseVerifyConfidentialSpace._get_unset_required_fields(query_params)) - - query_params["$alt"] = "json;enum-encoding=int" - return query_params - - class _BaseGetLocation: - def __hash__(self): # pragma: NO COVER - return NotImplementedError("__hash__ must be implemented.") - - @staticmethod - def _get_http_options(): - http_options: List[Dict[str, str]] = [{ - 'method': 'get', - 'uri': '/v1/{name=projects/*/locations/*}', - }, - ] - return http_options - - @staticmethod - def _get_transcoded_request(http_options, request): - request_kwargs = json_format.MessageToDict(request) - transcoded_request = path_template.transcode( - http_options, **request_kwargs) - return transcoded_request - - @staticmethod - def _get_query_params_json(transcoded_request): - query_params = json.loads(json.dumps(transcoded_request['query_params'])) - return query_params - - class _BaseListLocations: - def __hash__(self): # pragma: NO COVER - return NotImplementedError("__hash__ must be implemented.") - - @staticmethod - def _get_http_options(): - http_options: List[Dict[str, str]] = [{ - 'method': 'get', - 'uri': '/v1/{name=projects/*}/locations', - }, - ] - return http_options - - @staticmethod - def _get_transcoded_request(http_options, request): - request_kwargs = json_format.MessageToDict(request) - transcoded_request = path_template.transcode( - http_options, **request_kwargs) - return transcoded_request - - @staticmethod - def _get_query_params_json(transcoded_request): - query_params = json.loads(json.dumps(transcoded_request['query_params'])) - return query_params - - -__all__=( - '_BaseConfidentialComputingRestTransport', -) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/types/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/types/__init__.py deleted file mode 100644 index 7725a0653773..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/types/__init__.py +++ /dev/null @@ -1,64 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -from .service import ( - AwsPrincipalTagsOptions, - Challenge, - ConfidentialSpaceInfo, - ContainerImageSignature, - CreateChallengeRequest, - GceShieldedIdentity, - GcpCredentials, - SevSnpAttestation, - SignedEntity, - TdxCcelAttestation, - TokenOptions, - TpmAttestation, - VerifyAttestationRequest, - VerifyAttestationResponse, - VerifyConfidentialGkeRequest, - VerifyConfidentialGkeResponse, - VerifyConfidentialSpaceRequest, - VerifyConfidentialSpaceResponse, - SignatureType, - SigningAlgorithm, - TokenProfile, - TokenType, -) - -__all__ = ( - 'AwsPrincipalTagsOptions', - 'Challenge', - 'ConfidentialSpaceInfo', - 'ContainerImageSignature', - 'CreateChallengeRequest', - 'GceShieldedIdentity', - 'GcpCredentials', - 'SevSnpAttestation', - 'SignedEntity', - 'TdxCcelAttestation', - 'TokenOptions', - 'TpmAttestation', - 'VerifyAttestationRequest', - 'VerifyAttestationResponse', - 'VerifyConfidentialGkeRequest', - 'VerifyConfidentialGkeResponse', - 'VerifyConfidentialSpaceRequest', - 'VerifyConfidentialSpaceResponse', - 'SignatureType', - 'SigningAlgorithm', - 'TokenProfile', - 'TokenType', -) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/types/service.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/types/service.py deleted file mode 100644 index 9ac177e7a94a..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/types/service.py +++ /dev/null @@ -1,915 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -from __future__ import annotations - -from typing import MutableMapping, MutableSequence - -import proto # type: ignore - -from google.protobuf import timestamp_pb2 # type: ignore -from google.rpc import status_pb2 # type: ignore - - -__protobuf__ = proto.module( - package='google.cloud.confidentialcomputing.v1', - manifest={ - 'SigningAlgorithm', - 'TokenType', - 'SignatureType', - 'TokenProfile', - 'Challenge', - 'CreateChallengeRequest', - 'VerifyAttestationRequest', - 'TdxCcelAttestation', - 'SevSnpAttestation', - 'VerifyAttestationResponse', - 'GcpCredentials', - 'TokenOptions', - 'AwsPrincipalTagsOptions', - 'TpmAttestation', - 'ConfidentialSpaceInfo', - 'SignedEntity', - 'ContainerImageSignature', - 'VerifyConfidentialSpaceRequest', - 'GceShieldedIdentity', - 'VerifyConfidentialSpaceResponse', - 'VerifyConfidentialGkeRequest', - 'VerifyConfidentialGkeResponse', - }, -) - - -class SigningAlgorithm(proto.Enum): - r"""SigningAlgorithm enumerates all the supported signing - algorithms. - - Values: - SIGNING_ALGORITHM_UNSPECIFIED (0): - Unspecified signing algorithm. - RSASSA_PSS_SHA256 (1): - RSASSA-PSS with a SHA256 digest. - RSASSA_PKCS1V15_SHA256 (2): - RSASSA-PKCS1 v1.5 with a SHA256 digest. - ECDSA_P256_SHA256 (3): - ECDSA on the P-256 Curve with a SHA256 - digest. - """ - SIGNING_ALGORITHM_UNSPECIFIED = 0 - RSASSA_PSS_SHA256 = 1 - RSASSA_PKCS1V15_SHA256 = 2 - ECDSA_P256_SHA256 = 3 - - -class TokenType(proto.Enum): - r"""Token type enum contains the different types of token - responses Confidential Space supports - - Values: - TOKEN_TYPE_UNSPECIFIED (0): - Unspecified token type - TOKEN_TYPE_OIDC (1): - OpenID Connect (OIDC) token type - TOKEN_TYPE_PKI (2): - Public Key Infrastructure (PKI) token type - TOKEN_TYPE_LIMITED_AWS (3): - Limited claim token type for AWS integration - TOKEN_TYPE_AWS_PRINCIPALTAGS (4): - Principal-tag-based token for AWS integration - """ - TOKEN_TYPE_UNSPECIFIED = 0 - TOKEN_TYPE_OIDC = 1 - TOKEN_TYPE_PKI = 2 - TOKEN_TYPE_LIMITED_AWS = 3 - TOKEN_TYPE_AWS_PRINCIPALTAGS = 4 - - -class SignatureType(proto.Enum): - r"""SignatureType enumerates supported signature types for - attestation tokens. - - Values: - SIGNATURE_TYPE_UNSPECIFIED (0): - Unspecified signature type. - SIGNATURE_TYPE_OIDC (1): - Google OIDC signature. - SIGNATURE_TYPE_PKI (2): - Public Key Infrastructure (PKI) signature. - """ - SIGNATURE_TYPE_UNSPECIFIED = 0 - SIGNATURE_TYPE_OIDC = 1 - SIGNATURE_TYPE_PKI = 2 - - -class TokenProfile(proto.Enum): - r"""TokenProfile enumerates the supported token claims profiles. - - Values: - TOKEN_PROFILE_UNSPECIFIED (0): - Unspecified token profile. - TOKEN_PROFILE_DEFAULT_EAT (1): - EAT claims. - TOKEN_PROFILE_AWS (2): - AWS Principal Tags claims. - """ - TOKEN_PROFILE_UNSPECIFIED = 0 - TOKEN_PROFILE_DEFAULT_EAT = 1 - TOKEN_PROFILE_AWS = 2 - - -class Challenge(proto.Message): - r"""A Challenge from the server used to guarantee freshness of - attestations - - Attributes: - name (str): - Output only. The resource name for this Challenge in the - format ``projects/*/locations/*/challenges/*`` - create_time (google.protobuf.timestamp_pb2.Timestamp): - Output only. The time at which this Challenge - was created - expire_time (google.protobuf.timestamp_pb2.Timestamp): - Output only. The time at which this Challenge - will no longer be usable. It is also the - expiration time for any tokens generated from - this Challenge. - used (bool): - Output only. Indicates if this challenge has - been used to generate a token. - tpm_nonce (str): - Output only. Identical to nonce, but as a - string. - """ - - name: str = proto.Field( - proto.STRING, - number=1, - ) - create_time: timestamp_pb2.Timestamp = proto.Field( - proto.MESSAGE, - number=2, - message=timestamp_pb2.Timestamp, - ) - expire_time: timestamp_pb2.Timestamp = proto.Field( - proto.MESSAGE, - number=3, - message=timestamp_pb2.Timestamp, - ) - used: bool = proto.Field( - proto.BOOL, - number=4, - ) - tpm_nonce: str = proto.Field( - proto.STRING, - number=6, - ) - - -class CreateChallengeRequest(proto.Message): - r"""Message for creating a Challenge - - Attributes: - parent (str): - Required. The resource name of the location where the - Challenge will be used, in the format - ``projects/*/locations/*``. - challenge (google.cloud.confidentialcomputing_v1.types.Challenge): - Required. The Challenge to be created. - Currently this field can be empty as all the - Challenge fields are set by the server. - """ - - parent: str = proto.Field( - proto.STRING, - number=1, - ) - challenge: 'Challenge' = proto.Field( - proto.MESSAGE, - number=2, - message='Challenge', - ) - - -class VerifyAttestationRequest(proto.Message): - r"""A request for an attestation token, providing all the - necessary information needed for this service to verify the - platform state of the requestor. - - This message has `oneof`_ fields (mutually exclusive fields). - For each oneof, at most one member field can be set at the same time. - Setting any member of the oneof automatically clears all other - members. - - .. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields - - Attributes: - td_ccel (google.cloud.confidentialcomputing_v1.types.TdxCcelAttestation): - Optional. A TDX with CCEL and RTMR - Attestation Quote. - - This field is a member of `oneof`_ ``tee_attestation``. - sev_snp_attestation (google.cloud.confidentialcomputing_v1.types.SevSnpAttestation): - Optional. An SEV-SNP Attestation Report. - - This field is a member of `oneof`_ ``tee_attestation``. - challenge (str): - Required. The name of the Challenge whose nonce was used to - generate the attestation, in the format - ``projects/*/locations/*/challenges/*``. The provided - Challenge will be consumed, and cannot be used again. - gcp_credentials (google.cloud.confidentialcomputing_v1.types.GcpCredentials): - Optional. Credentials used to populate the "emails" claim in - the claims_token. - tpm_attestation (google.cloud.confidentialcomputing_v1.types.TpmAttestation): - Required. The TPM-specific data provided by - the attesting platform, used to populate any of - the claims regarding platform state. - confidential_space_info (google.cloud.confidentialcomputing_v1.types.ConfidentialSpaceInfo): - Optional. Optional information related to the - Confidential Space TEE. - token_options (google.cloud.confidentialcomputing_v1.types.TokenOptions): - Optional. A collection of optional, - workload-specified claims that modify the token - output. - attester (str): - Optional. An optional indicator of the - attester, only applies to certain products. - """ - - td_ccel: 'TdxCcelAttestation' = proto.Field( - proto.MESSAGE, - number=6, - oneof='tee_attestation', - message='TdxCcelAttestation', - ) - sev_snp_attestation: 'SevSnpAttestation' = proto.Field( - proto.MESSAGE, - number=7, - oneof='tee_attestation', - message='SevSnpAttestation', - ) - challenge: str = proto.Field( - proto.STRING, - number=1, - ) - gcp_credentials: 'GcpCredentials' = proto.Field( - proto.MESSAGE, - number=2, - message='GcpCredentials', - ) - tpm_attestation: 'TpmAttestation' = proto.Field( - proto.MESSAGE, - number=3, - message='TpmAttestation', - ) - confidential_space_info: 'ConfidentialSpaceInfo' = proto.Field( - proto.MESSAGE, - number=4, - message='ConfidentialSpaceInfo', - ) - token_options: 'TokenOptions' = proto.Field( - proto.MESSAGE, - number=5, - message='TokenOptions', - ) - attester: str = proto.Field( - proto.STRING, - number=8, - ) - - -class TdxCcelAttestation(proto.Message): - r"""A TDX Attestation quote. - - Attributes: - ccel_acpi_table (bytes): - Optional. The Confidential Computing Event - Log (CCEL) ACPI table. Formatted as described in - the ACPI Specification 6.5. - ccel_data (bytes): - Optional. The CCEL event log. Formatted as - described in the UEFI 2.10. - canonical_event_log (bytes): - Optional. An Event Log containing additional - events measured into the RTMR that are not - already present in the CCEL. - td_quote (bytes): - Optional. The TDX attestation quote from the - guest. It contains the RTMR values. - """ - - ccel_acpi_table: bytes = proto.Field( - proto.BYTES, - number=1, - ) - ccel_data: bytes = proto.Field( - proto.BYTES, - number=2, - ) - canonical_event_log: bytes = proto.Field( - proto.BYTES, - number=3, - ) - td_quote: bytes = proto.Field( - proto.BYTES, - number=4, - ) - - -class SevSnpAttestation(proto.Message): - r"""An SEV-SNP Attestation Report. - Contains the attestation report and the certificate bundle that - the client collects. - - Attributes: - report (bytes): - Optional. The SEV-SNP Attestation Report Format is in - revision 1.55, §7.3 Attestation, Table 22. - ATTESTATION_REPORT Structure in this document: - https://www.amd.com/content/dam/amd/en/documents/epyc-technical-docs/specifications/56860.pdf - aux_blob (bytes): - Optional. Certificate bundle defined in the GHCB protocol - definition Format is documented in GHCB revision 2.03, - section 4.1.8.1 struct cert_table in this document: - https://www.amd.com/content/dam/amd/en/documents/epyc-technical-docs/specifications/56421.pdf - """ - - report: bytes = proto.Field( - proto.BYTES, - number=1, - ) - aux_blob: bytes = proto.Field( - proto.BYTES, - number=2, - ) - - -class VerifyAttestationResponse(proto.Message): - r"""A response once an attestation has been successfully - verified, containing a signed attestation token. - - Attributes: - oidc_claims_token (str): - Output only. Same as claims_token, but as a string. - partial_errors (MutableSequence[google.rpc.status_pb2.Status]): - Output only. A list of messages that carry - the partial error details related to - VerifyAttestation. - """ - - oidc_claims_token: str = proto.Field( - proto.STRING, - number=2, - ) - partial_errors: MutableSequence[status_pb2.Status] = proto.RepeatedField( - proto.MESSAGE, - number=3, - message=status_pb2.Status, - ) - - -class GcpCredentials(proto.Message): - r"""Credentials issued by GCP which are linked to the platform - attestation. These will be verified server-side as part of - attestaion verification. - - Attributes: - service_account_id_tokens (MutableSequence[str]): - Same as id_tokens, but as a string. - """ - - service_account_id_tokens: MutableSequence[str] = proto.RepeatedField( - proto.STRING, - number=2, - ) - - -class TokenOptions(proto.Message): - r"""Options to modify claims in the token to generate - custom-purpose tokens. - - - .. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields - - Attributes: - aws_principal_tags_options (google.cloud.confidentialcomputing_v1.types.AwsPrincipalTagsOptions): - Optional. Options for AWS token type. - - This field is a member of `oneof`_ ``token_type_options``. - audience (str): - Optional. Optional string to issue the token - with a custom audience claim. Required if one or - more nonces are specified. - nonce (MutableSequence[str]): - Optional. Optional parameter to place one or more nonces in - the eat_nonce claim in the output token. The minimum size - for JSON-encoded EATs is 10 bytes and the maximum size is 74 - bytes. - token_type (google.cloud.confidentialcomputing_v1.types.TokenType): - Optional. Optional token type to select what - type of token to return. - """ - - aws_principal_tags_options: 'AwsPrincipalTagsOptions' = proto.Field( - proto.MESSAGE, - number=4, - oneof='token_type_options', - message='AwsPrincipalTagsOptions', - ) - audience: str = proto.Field( - proto.STRING, - number=1, - ) - nonce: MutableSequence[str] = proto.RepeatedField( - proto.STRING, - number=2, - ) - token_type: 'TokenType' = proto.Field( - proto.ENUM, - number=3, - enum='TokenType', - ) - - -class AwsPrincipalTagsOptions(proto.Message): - r"""Token options that only apply to the AWS Principal Tags token - type. - - Attributes: - allowed_principal_tags (google.cloud.confidentialcomputing_v1.types.AwsPrincipalTagsOptions.AllowedPrincipalTags): - Optional. Principal tags to allow in the - token. - """ - - class AllowedPrincipalTags(proto.Message): - r"""Allowed principal tags is used to define what principal tags - will be placed in the token. - - Attributes: - container_image_signatures (google.cloud.confidentialcomputing_v1.types.AwsPrincipalTagsOptions.AllowedPrincipalTags.ContainerImageSignatures): - Optional. Container image signatures allowed - in the token. - """ - - class ContainerImageSignatures(proto.Message): - r"""Allowed Container Image Signatures. Key IDs are required to - allow this claim to fit within the narrow AWS IAM restrictions. - - Attributes: - key_ids (MutableSequence[str]): - Optional. List of key ids to filter into the - Principal tags. Only keys that have been - validated and added to the token will be - filtered into principal tags. Unrecognized key - ids will be ignored. - """ - - key_ids: MutableSequence[str] = proto.RepeatedField( - proto.STRING, - number=1, - ) - - container_image_signatures: 'AwsPrincipalTagsOptions.AllowedPrincipalTags.ContainerImageSignatures' = proto.Field( - proto.MESSAGE, - number=1, - message='AwsPrincipalTagsOptions.AllowedPrincipalTags.ContainerImageSignatures', - ) - - allowed_principal_tags: AllowedPrincipalTags = proto.Field( - proto.MESSAGE, - number=1, - message=AllowedPrincipalTags, - ) - - -class TpmAttestation(proto.Message): - r"""TPM2 data containing everything necessary to validate any - platform state measured into the TPM. - - Attributes: - quotes (MutableSequence[google.cloud.confidentialcomputing_v1.types.TpmAttestation.Quote]): - TPM2 PCR Quotes generated by calling TPM2_Quote on each PCR - bank. - tcg_event_log (bytes): - The binary TCG Event Log containing events - measured into the TPM by the platform firmware - and operating system. Formatted as described in - the "TCG PC Client Platform Firmware Profile - Specification". - canonical_event_log (bytes): - An Event Log containing additional events measured into the - TPM that are not already present in the tcg_event_log. - Formatted as described in the "Canonical Event Log Format" - TCG Specification. - ak_cert (bytes): - DER-encoded X.509 certificate of the - Attestation Key (otherwise known as an AK or a - TPM restricted signing key) used to generate the - quotes. - cert_chain (MutableSequence[bytes]): - List of DER-encoded X.509 certificates which, together with - the ak_cert, chain back to a trusted Root Certificate. - """ - - class Quote(proto.Message): - r"""Information about Platform Control Registers (PCRs) including - a signature over their values, which can be used for remote - validation. - - Attributes: - hash_algo (int): - The hash algorithm of the PCR bank being quoted, encoded as - a TPM_ALG_ID - pcr_values (MutableMapping[int, bytes]): - Raw binary values of each PCRs being quoted. - raw_quote (bytes): - TPM2 quote, encoded as a TPMS_ATTEST - raw_signature (bytes): - TPM2 signature, encoded as a TPMT_SIGNATURE - """ - - hash_algo: int = proto.Field( - proto.INT32, - number=1, - ) - pcr_values: MutableMapping[int, bytes] = proto.MapField( - proto.INT32, - proto.BYTES, - number=2, - ) - raw_quote: bytes = proto.Field( - proto.BYTES, - number=3, - ) - raw_signature: bytes = proto.Field( - proto.BYTES, - number=4, - ) - - quotes: MutableSequence[Quote] = proto.RepeatedField( - proto.MESSAGE, - number=1, - message=Quote, - ) - tcg_event_log: bytes = proto.Field( - proto.BYTES, - number=2, - ) - canonical_event_log: bytes = proto.Field( - proto.BYTES, - number=3, - ) - ak_cert: bytes = proto.Field( - proto.BYTES, - number=4, - ) - cert_chain: MutableSequence[bytes] = proto.RepeatedField( - proto.BYTES, - number=5, - ) - - -class ConfidentialSpaceInfo(proto.Message): - r"""ConfidentialSpaceInfo contains information related to the - Confidential Space TEE. - - Attributes: - signed_entities (MutableSequence[google.cloud.confidentialcomputing_v1.types.SignedEntity]): - Optional. A list of signed entities - containing container image signatures that can - be used for server-side signature verification. - """ - - signed_entities: MutableSequence['SignedEntity'] = proto.RepeatedField( - proto.MESSAGE, - number=1, - message='SignedEntity', - ) - - -class SignedEntity(proto.Message): - r"""SignedEntity represents an OCI image object containing - everything necessary to verify container image signatures. - - Attributes: - container_image_signatures (MutableSequence[google.cloud.confidentialcomputing_v1.types.ContainerImageSignature]): - Optional. A list of container image - signatures attached to an OCI image object. - """ - - container_image_signatures: MutableSequence['ContainerImageSignature'] = proto.RepeatedField( - proto.MESSAGE, - number=1, - message='ContainerImageSignature', - ) - - -class ContainerImageSignature(proto.Message): - r"""ContainerImageSignature holds necessary metadata to verify a - container image signature. - - Attributes: - payload (bytes): - Optional. The binary signature payload following the - SimpleSigning format - https://github.com/sigstore/cosign/blob/main/specs/SIGNATURE_SPEC.md#simple-signing. - This payload includes the container image digest. - signature (bytes): - Optional. A signature over the payload. The container image - digest is incorporated into the signature as follows: - - 1. Generate a SimpleSigning format payload that includes the - container image digest. - 2. Generate a signature over SHA256 digest of the payload. - The signature generation process can be represented as - follows: - ``Sign(sha256(SimpleSigningPayload(sha256(Image Manifest))))`` - public_key (bytes): - Optional. Reserved for future use. - sig_alg (google.cloud.confidentialcomputing_v1.types.SigningAlgorithm): - Optional. Reserved for future use. - """ - - payload: bytes = proto.Field( - proto.BYTES, - number=1, - ) - signature: bytes = proto.Field( - proto.BYTES, - number=2, - ) - public_key: bytes = proto.Field( - proto.BYTES, - number=3, - ) - sig_alg: 'SigningAlgorithm' = proto.Field( - proto.ENUM, - number=4, - enum='SigningAlgorithm', - ) - - -class VerifyConfidentialSpaceRequest(proto.Message): - r"""A request for an attestation token, providing all the - necessary information needed for this service to verify the - platform state of the requestor. - - This message has `oneof`_ fields (mutually exclusive fields). - For each oneof, at most one member field can be set at the same time. - Setting any member of the oneof automatically clears all other - members. - - .. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields - - Attributes: - td_ccel (google.cloud.confidentialcomputing_v1.types.TdxCcelAttestation): - Input only. A TDX with CCEL and RTMR - Attestation Quote. - - This field is a member of `oneof`_ ``tee_attestation``. - tpm_attestation (google.cloud.confidentialcomputing_v1.types.TpmAttestation): - Input only. The TPM-specific data provided by - the attesting platform, used to populate any of - the claims regarding platform state. - - This field is a member of `oneof`_ ``tee_attestation``. - challenge (str): - Required. The name of the Challenge whose nonce was used to - generate the attestation, in the format - ``projects/*/locations/*/challenges/*``. The provided - Challenge will be consumed, and cannot be used again. - gcp_credentials (google.cloud.confidentialcomputing_v1.types.GcpCredentials): - Optional. Credentials used to populate the "emails" claim in - the claims_token. If not present, token will not contain the - "emails" claim. - signed_entities (MutableSequence[google.cloud.confidentialcomputing_v1.types.SignedEntity]): - Optional. A list of signed entities - containing container image signatures that can - be used for server-side signature verification. - gce_shielded_identity (google.cloud.confidentialcomputing_v1.types.GceShieldedIdentity): - Optional. Information about the associated Compute Engine - instance. Required for td_ccel requests only - - tpm_attestation requests will provide this information in - the attestation. - options (google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceRequest.ConfidentialSpaceOptions): - Optional. A collection of fields that modify - the token output. - """ - - class ConfidentialSpaceOptions(proto.Message): - r"""Token options for Confidential Space attestation. - - .. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields - - Attributes: - aws_principal_tags_options (google.cloud.confidentialcomputing_v1.types.AwsPrincipalTagsOptions): - Optional. Options for the AWS token type. - - This field is a member of `oneof`_ ``token_profile_options``. - audience (str): - Optional. Optional string to issue the token - with a custom audience claim. Required if custom - nonces are specified. - token_profile (google.cloud.confidentialcomputing_v1.types.TokenProfile): - Optional. Optional specification for token - claims profile. - nonce (MutableSequence[str]): - Optional. Optional parameter to place one or more nonces in - the eat_nonce claim in the output token. The minimum size - for JSON-encoded EATs is 10 bytes and the maximum size is 74 - bytes. - signature_type (google.cloud.confidentialcomputing_v1.types.SignatureType): - Optional. Optional specification for how to sign the - attestation token. Defaults to SIGNATURE_TYPE_OIDC if - unspecified. - """ - - aws_principal_tags_options: 'AwsPrincipalTagsOptions' = proto.Field( - proto.MESSAGE, - number=5, - oneof='token_profile_options', - message='AwsPrincipalTagsOptions', - ) - audience: str = proto.Field( - proto.STRING, - number=1, - ) - token_profile: 'TokenProfile' = proto.Field( - proto.ENUM, - number=2, - enum='TokenProfile', - ) - nonce: MutableSequence[str] = proto.RepeatedField( - proto.STRING, - number=3, - ) - signature_type: 'SignatureType' = proto.Field( - proto.ENUM, - number=4, - enum='SignatureType', - ) - - td_ccel: 'TdxCcelAttestation' = proto.Field( - proto.MESSAGE, - number=3, - oneof='tee_attestation', - message='TdxCcelAttestation', - ) - tpm_attestation: 'TpmAttestation' = proto.Field( - proto.MESSAGE, - number=4, - oneof='tee_attestation', - message='TpmAttestation', - ) - challenge: str = proto.Field( - proto.STRING, - number=1, - ) - gcp_credentials: 'GcpCredentials' = proto.Field( - proto.MESSAGE, - number=2, - message='GcpCredentials', - ) - signed_entities: MutableSequence['SignedEntity'] = proto.RepeatedField( - proto.MESSAGE, - number=5, - message='SignedEntity', - ) - gce_shielded_identity: 'GceShieldedIdentity' = proto.Field( - proto.MESSAGE, - number=6, - message='GceShieldedIdentity', - ) - options: ConfidentialSpaceOptions = proto.Field( - proto.MESSAGE, - number=7, - message=ConfidentialSpaceOptions, - ) - - -class GceShieldedIdentity(proto.Message): - r"""GceShieldedIdentity contains information about a Compute - Engine instance. - - Attributes: - ak_cert (bytes): - Optional. DER-encoded X.509 certificate of - the Attestation Key (otherwise known as an AK or - a TPM restricted signing key) used to generate - the quotes. - ak_cert_chain (MutableSequence[bytes]): - Optional. List of DER-encoded X.509 certificates which, - together with the ak_cert, chain back to a trusted Root - Certificate. - """ - - ak_cert: bytes = proto.Field( - proto.BYTES, - number=1, - ) - ak_cert_chain: MutableSequence[bytes] = proto.RepeatedField( - proto.BYTES, - number=2, - ) - - -class VerifyConfidentialSpaceResponse(proto.Message): - r"""VerifyConfidentialSpaceResponse is returned once a - Confidential Space attestation has been successfully verified, - containing a signed token. - - Attributes: - attestation_token (str): - Output only. The attestation token issued by - this service. It contains specific platform - claims based on the contents of the provided - attestation. - partial_errors (MutableSequence[google.rpc.status_pb2.Status]): - Output only. A list of messages that carry - the partial error details related to - VerifyConfidentialSpace. This field is populated - by errors during container image signature - verification, which may reflect problems in the - provided image signatures. This does not block - the issuing of an attestation token, but the - token will not contain claims for the failed - image signatures. - """ - - attestation_token: str = proto.Field( - proto.STRING, - number=1, - ) - partial_errors: MutableSequence[status_pb2.Status] = proto.RepeatedField( - proto.MESSAGE, - number=2, - message=status_pb2.Status, - ) - - -class VerifyConfidentialGkeRequest(proto.Message): - r"""A request for an attestation token, providing all the - necessary information needed for this service to verify - Confidential GKE platform state of the requestor. - - - .. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields - - Attributes: - tpm_attestation (google.cloud.confidentialcomputing_v1.types.TpmAttestation): - The TPM-specific data provided by the - attesting platform, used to populate any of the - claims regarding platform state. - - This field is a member of `oneof`_ ``tee_attestation``. - challenge (str): - Required. The name of the Challenge whose nonce was used to - generate the attestation, in the format - projects/\ */locations/*/challenges/*. The provided - Challenge will be consumed, and cannot be used again. - """ - - tpm_attestation: 'TpmAttestation' = proto.Field( - proto.MESSAGE, - number=2, - oneof='tee_attestation', - message='TpmAttestation', - ) - challenge: str = proto.Field( - proto.STRING, - number=1, - ) - - -class VerifyConfidentialGkeResponse(proto.Message): - r"""VerifyConfidentialGkeResponse response is returened once a - Confidential GKE attestation has been successfully verified, - containing a signed OIDC token. - - Attributes: - attestation_token (str): - Output only. The attestation token issued by - this service for Confidential GKE. It contains - specific platform claims based on the contents - of the provided attestation. - """ - - attestation_token: str = proto.Field( - proto.STRING, - number=1, - ) - - -__all__ = tuple(sorted(__protobuf__.manifest)) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/mypy.ini b/owl-bot-staging/google-cloud-confidentialcomputing/v1/mypy.ini deleted file mode 100644 index 574c5aed394b..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/mypy.ini +++ /dev/null @@ -1,3 +0,0 @@ -[mypy] -python_version = 3.7 -namespace_packages = True diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/noxfile.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/noxfile.py deleted file mode 100644 index 09565c9afa4f..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/noxfile.py +++ /dev/null @@ -1,592 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -import os -import pathlib -import re -import shutil - -from typing import Dict, List -import warnings - -import nox - -BLACK_VERSION = "black[jupyter]==23.7.0" -ISORT_VERSION = "isort==5.11.0" - -LINT_PATHS = ["docs", "google", "tests", "noxfile.py", "setup.py"] - -ALL_PYTHON = [ - "3.7", - "3.8", - "3.9", - "3.10", - "3.11", - "3.12", - "3.13", -] - -DEFAULT_PYTHON_VERSION = ALL_PYTHON[-1] - -CURRENT_DIRECTORY = pathlib.Path(__file__).parent.absolute() - -LOWER_BOUND_CONSTRAINTS_FILE = CURRENT_DIRECTORY / "constraints.txt" -PACKAGE_NAME = "google-cloud-confidentialcomputing" - -UNIT_TEST_STANDARD_DEPENDENCIES = [ - "mock", - "asyncmock", - "pytest", - "pytest-cov", - "pytest-asyncio", -] -UNIT_TEST_EXTERNAL_DEPENDENCIES: List[str] = [] -UNIT_TEST_LOCAL_DEPENDENCIES: List[str] = [] -UNIT_TEST_DEPENDENCIES: List[str] = [] -UNIT_TEST_EXTRAS: List[str] = [] -UNIT_TEST_EXTRAS_BY_PYTHON: Dict[str, List[str]] = {} - -SYSTEM_TEST_PYTHON_VERSIONS: List[str] = ["3.8", "3.9", "3.10", "3.11", "3.12", "3.13"] -SYSTEM_TEST_STANDARD_DEPENDENCIES = [ - "mock", - "pytest", - "google-cloud-testutils", -] -SYSTEM_TEST_EXTERNAL_DEPENDENCIES: List[str] = [] -SYSTEM_TEST_LOCAL_DEPENDENCIES: List[str] = [] -SYSTEM_TEST_DEPENDENCIES: List[str] = [] -SYSTEM_TEST_EXTRAS: List[str] = [] -SYSTEM_TEST_EXTRAS_BY_PYTHON: Dict[str, List[str]] = {} - -nox.options.sessions = [ - "unit", - "system", - "cover", - "lint", - "lint_setup_py", - "blacken", - "docs", -] - -# Error if a python version is missing -nox.options.error_on_missing_interpreters = True - - -@nox.session(python=ALL_PYTHON) -def mypy(session): - """Run the type checker.""" - session.install( - # TODO(https://github.com/googleapis/gapic-generator-python/issues/2410): Use the latest version of mypy - "mypy<1.16.0", - "types-requests", - "types-protobuf", - ) - session.install(".") - session.run( - "mypy", - "-p", - "google", - ) - - -@nox.session -def update_lower_bounds(session): - """Update lower bounds in constraints.txt to match setup.py""" - session.install("google-cloud-testutils") - session.install(".") - - session.run( - "lower-bound-checker", - "update", - "--package-name", - PACKAGE_NAME, - "--constraints-file", - str(LOWER_BOUND_CONSTRAINTS_FILE), - ) - - -@nox.session -def check_lower_bounds(session): - """Check lower bounds in setup.py are reflected in constraints file""" - session.install("google-cloud-testutils") - session.install(".") - - session.run( - "lower-bound-checker", - "check", - "--package-name", - PACKAGE_NAME, - "--constraints-file", - str(LOWER_BOUND_CONSTRAINTS_FILE), - ) - - -@nox.session(python=DEFAULT_PYTHON_VERSION) -def lint(session): - """Run linters. - - Returns a failure if the linters find linting errors or sufficiently - serious code quality issues. - """ - session.install("flake8", BLACK_VERSION) - session.run( - "black", - "--check", - *LINT_PATHS, - ) - - session.run("flake8", "google", "tests") - - -@nox.session(python=DEFAULT_PYTHON_VERSION) -def blacken(session): - """Run black. Format code to uniform standard.""" - session.install(BLACK_VERSION) - session.run( - "black", - *LINT_PATHS, - ) - - -@nox.session(python=DEFAULT_PYTHON_VERSION) -def format(session): - """ - Run isort to sort imports. Then run black - to format code to uniform standard. - """ - session.install(BLACK_VERSION, ISORT_VERSION) - # Use the --fss option to sort imports using strict alphabetical order. - # See https://pycqa.github.io/isort/docs/configuration/options.html#force-sort-within-sections - session.run( - "isort", - "--fss", - *LINT_PATHS, - ) - session.run( - "black", - *LINT_PATHS, - ) - - -@nox.session(python=DEFAULT_PYTHON_VERSION) -def lint_setup_py(session): - """Verify that setup.py is valid (including RST check).""" - session.install("setuptools", "docutils", "pygments") - session.run("python", "setup.py", "check", "--restructuredtext", "--strict") - - -def install_unittest_dependencies(session, *constraints): - standard_deps = UNIT_TEST_STANDARD_DEPENDENCIES + UNIT_TEST_DEPENDENCIES - session.install(*standard_deps, *constraints) - - if UNIT_TEST_EXTERNAL_DEPENDENCIES: - warnings.warn( - "'unit_test_external_dependencies' is deprecated. Instead, please " - "use 'unit_test_dependencies' or 'unit_test_local_dependencies'.", - DeprecationWarning, - ) - session.install(*UNIT_TEST_EXTERNAL_DEPENDENCIES, *constraints) - - if UNIT_TEST_LOCAL_DEPENDENCIES: - session.install(*UNIT_TEST_LOCAL_DEPENDENCIES, *constraints) - - if UNIT_TEST_EXTRAS_BY_PYTHON: - extras = UNIT_TEST_EXTRAS_BY_PYTHON.get(session.python, []) - elif UNIT_TEST_EXTRAS: - extras = UNIT_TEST_EXTRAS - else: - extras = [] - - if extras: - session.install("-e", f".[{','.join(extras)}]", *constraints) - else: - session.install("-e", ".", *constraints) - - -@nox.session(python=ALL_PYTHON) -@nox.parametrize( - "protobuf_implementation", - ["python", "upb", "cpp"], -) -def unit(session, protobuf_implementation): - # Install all test dependencies, then install this package in-place. - - if protobuf_implementation == "cpp" and session.python in ("3.11", "3.12", "3.13"): - session.skip("cpp implementation is not supported in python 3.11+") - - constraints_path = str( - CURRENT_DIRECTORY / "testing" / f"constraints-{session.python}.txt" - ) - install_unittest_dependencies(session, "-c", constraints_path) - - # TODO(https://github.com/googleapis/synthtool/issues/1976): - # Remove the 'cpp' implementation once support for Protobuf 3.x is dropped. - # The 'cpp' implementation requires Protobuf<4. - if protobuf_implementation == "cpp": - session.install("protobuf<4") - - # Run py.test against the unit tests. - session.run( - "py.test", - "--quiet", - f"--junitxml=unit_{session.python}_sponge_log.xml", - "--cov=google", - "--cov=tests/unit", - "--cov-append", - "--cov-config=.coveragerc", - "--cov-report=", - "--cov-fail-under=0", - os.path.join("tests", "unit"), - *session.posargs, - env={ - "PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION": protobuf_implementation, - }, - ) - - -def install_systemtest_dependencies(session, *constraints): - session.install("--pre", "grpcio") - - session.install(*SYSTEM_TEST_STANDARD_DEPENDENCIES, *constraints) - - if SYSTEM_TEST_EXTERNAL_DEPENDENCIES: - session.install(*SYSTEM_TEST_EXTERNAL_DEPENDENCIES, *constraints) - - if SYSTEM_TEST_LOCAL_DEPENDENCIES: - session.install("-e", *SYSTEM_TEST_LOCAL_DEPENDENCIES, *constraints) - - if SYSTEM_TEST_DEPENDENCIES: - session.install("-e", *SYSTEM_TEST_DEPENDENCIES, *constraints) - - if SYSTEM_TEST_EXTRAS_BY_PYTHON: - extras = SYSTEM_TEST_EXTRAS_BY_PYTHON.get(session.python, []) - elif SYSTEM_TEST_EXTRAS: - extras = SYSTEM_TEST_EXTRAS - else: - extras = [] - - if extras: - session.install("-e", f".[{','.join(extras)}]", *constraints) - else: - session.install("-e", ".", *constraints) - - -@nox.session(python=SYSTEM_TEST_PYTHON_VERSIONS) -def system(session): - """Run the system test suite.""" - constraints_path = str( - CURRENT_DIRECTORY / "testing" / f"constraints-{session.python}.txt" - ) - system_test_path = os.path.join("tests", "system.py") - system_test_folder_path = os.path.join("tests", "system") - - # Check the value of `RUN_SYSTEM_TESTS` env var. It defaults to true. - if os.environ.get("RUN_SYSTEM_TESTS", "true") == "false": - session.skip("RUN_SYSTEM_TESTS is set to false, skipping") - # Install pyopenssl for mTLS testing. - if os.environ.get("GOOGLE_API_USE_CLIENT_CERTIFICATE", "false") == "true": - session.install("pyopenssl") - - system_test_exists = os.path.exists(system_test_path) - system_test_folder_exists = os.path.exists(system_test_folder_path) - # Sanity check: only run tests if found. - if not system_test_exists and not system_test_folder_exists: - session.skip("System tests were not found") - - install_systemtest_dependencies(session, "-c", constraints_path) - - # Run py.test against the system tests. - if system_test_exists: - session.run( - "py.test", - "--quiet", - f"--junitxml=system_{session.python}_sponge_log.xml", - system_test_path, - *session.posargs, - ) - if system_test_folder_exists: - session.run( - "py.test", - "--quiet", - f"--junitxml=system_{session.python}_sponge_log.xml", - system_test_folder_path, - *session.posargs, - ) - - -@nox.session(python=DEFAULT_PYTHON_VERSION) -def cover(session): - """Run the final coverage report. - - This outputs the coverage report aggregating coverage from the unit - test runs (not system test runs), and then erases coverage data. - """ - session.install("coverage", "pytest-cov") - session.run("coverage", "report", "--show-missing", "--fail-under=100") - - session.run("coverage", "erase") - - -@nox.session(python="3.10") -def docs(session): - """Build the docs for this library.""" - - session.install("-e", ".") - session.install( - # We need to pin to specific versions of the `sphinxcontrib-*` packages - # which still support sphinx 4.x. - # See https://github.com/googleapis/sphinx-docfx-yaml/issues/344 - # and https://github.com/googleapis/sphinx-docfx-yaml/issues/345. - "sphinxcontrib-applehelp==1.0.4", - "sphinxcontrib-devhelp==1.0.2", - "sphinxcontrib-htmlhelp==2.0.1", - "sphinxcontrib-qthelp==1.0.3", - "sphinxcontrib-serializinghtml==1.1.5", - "sphinx==4.5.0", - "alabaster", - "recommonmark", - ) - - shutil.rmtree(os.path.join("docs", "_build"), ignore_errors=True) - session.run( - "sphinx-build", - "-W", # warnings as errors - "-T", # show full traceback on exception - "-N", # no colors - "-b", - "html", - "-d", - os.path.join("docs", "_build", "doctrees", ""), - os.path.join("docs", ""), - os.path.join("docs", "_build", "html", ""), - ) - - -@nox.session(python="3.10") -def docfx(session): - """Build the docfx yaml files for this library.""" - - session.install("-e", ".") - session.install( - # We need to pin to specific versions of the `sphinxcontrib-*` packages - # which still support sphinx 4.x. - # See https://github.com/googleapis/sphinx-docfx-yaml/issues/344 - # and https://github.com/googleapis/sphinx-docfx-yaml/issues/345. - "sphinxcontrib-applehelp==1.0.4", - "sphinxcontrib-devhelp==1.0.2", - "sphinxcontrib-htmlhelp==2.0.1", - "sphinxcontrib-qthelp==1.0.3", - "sphinxcontrib-serializinghtml==1.1.5", - "gcp-sphinx-docfx-yaml", - "alabaster", - "recommonmark", - ) - - shutil.rmtree(os.path.join("docs", "_build"), ignore_errors=True) - session.run( - "sphinx-build", - "-T", # show full traceback on exception - "-N", # no colors - "-D", - ( - "extensions=sphinx.ext.autodoc," - "sphinx.ext.autosummary," - "docfx_yaml.extension," - "sphinx.ext.intersphinx," - "sphinx.ext.coverage," - "sphinx.ext.napoleon," - "sphinx.ext.todo," - "sphinx.ext.viewcode," - "recommonmark" - ), - "-b", - "html", - "-d", - os.path.join("docs", "_build", "doctrees", ""), - os.path.join("docs", ""), - os.path.join("docs", "_build", "html", ""), - ) - - -@nox.session(python=DEFAULT_PYTHON_VERSION) -@nox.parametrize( - "protobuf_implementation", - ["python", "upb", "cpp"], -) -def prerelease_deps(session, protobuf_implementation): - """ - Run all tests with pre-release versions of dependencies installed - rather than the standard non pre-release versions. - Pre-release versions can be installed using - `pip install --pre `. - """ - - if protobuf_implementation == "cpp" and session.python in ("3.11", "3.12", "3.13"): - session.skip("cpp implementation is not supported in python 3.11+") - - # Install all dependencies - session.install("-e", ".") - - # Install dependencies for the unit test environment - unit_deps_all = UNIT_TEST_STANDARD_DEPENDENCIES + UNIT_TEST_EXTERNAL_DEPENDENCIES - session.install(*unit_deps_all) - - # Install dependencies for the system test environment - system_deps_all = ( - SYSTEM_TEST_STANDARD_DEPENDENCIES - + SYSTEM_TEST_EXTERNAL_DEPENDENCIES - + SYSTEM_TEST_EXTRAS - ) - session.install(*system_deps_all) - - # Because we test minimum dependency versions on the minimum Python - # version, the first version we test with in the unit tests sessions has a - # constraints file containing all dependencies and extras. - with open( - CURRENT_DIRECTORY / "testing" / f"constraints-{ALL_PYTHON[0]}.txt", - encoding="utf-8", - ) as constraints_file: - constraints_text = constraints_file.read() - - # Ignore leading whitespace and comment lines. - constraints_deps = [ - match.group(1) - for match in re.finditer( - r"^\s*(\S+)(?===\S+)", constraints_text, flags=re.MULTILINE - ) - ] - - # Install dependencies specified in `testing/constraints-X.txt`. - session.install(*constraints_deps) - - # Note: If a dependency is added to the `prerel_deps` list, - # the `core_dependencies_from_source` list in the `core_deps_from_source` - # nox session should also be updated. - prerel_deps = [ - "googleapis-common-protos", - "google-api-core", - "google-auth", - "grpc-google-iam-v1", - "grpcio", - "grpcio-status", - "protobuf", - "proto-plus", - ] - - for dep in prerel_deps: - session.install("--pre", "--no-deps", "--ignore-installed", dep) - # TODO(https://github.com/grpc/grpc/issues/38965): Add `grpcio-status`` - # to the dictionary below once this bug is fixed. - # TODO(https://github.com/googleapis/google-cloud-python/issues/13643): Add - # `googleapis-common-protos` and `grpc-google-iam-v1` to the dictionary below - # once this bug is fixed. - package_namespaces = { - "google-api-core": "google.api_core", - "google-auth": "google.auth", - "grpcio": "grpc", - "protobuf": "google.protobuf", - "proto-plus": "proto", - } - - version_namespace = package_namespaces.get(dep) - - print(f"Installed {dep}") - if version_namespace: - session.run( - "python", - "-c", - f"import {version_namespace}; print({version_namespace}.__version__)", - ) - - session.run( - "py.test", - "tests/unit", - env={ - "PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION": protobuf_implementation, - }, - ) - - -@nox.session(python=DEFAULT_PYTHON_VERSION) -@nox.parametrize( - "protobuf_implementation", - ["python", "upb"], -) -def core_deps_from_source(session, protobuf_implementation): - """Run all tests with core dependencies installed from source - rather than pulling the dependencies from PyPI. - """ - - # Install all dependencies - session.install("-e", ".") - - # Install dependencies for the unit test environment - unit_deps_all = UNIT_TEST_STANDARD_DEPENDENCIES + UNIT_TEST_EXTERNAL_DEPENDENCIES - session.install(*unit_deps_all) - - # Install dependencies for the system test environment - system_deps_all = ( - SYSTEM_TEST_STANDARD_DEPENDENCIES - + SYSTEM_TEST_EXTERNAL_DEPENDENCIES - + SYSTEM_TEST_EXTRAS - ) - session.install(*system_deps_all) - - # Because we test minimum dependency versions on the minimum Python - # version, the first version we test with in the unit tests sessions has a - # constraints file containing all dependencies and extras. - with open( - CURRENT_DIRECTORY / "testing" / f"constraints-{ALL_PYTHON[0]}.txt", - encoding="utf-8", - ) as constraints_file: - constraints_text = constraints_file.read() - - # Ignore leading whitespace and comment lines. - constraints_deps = [ - match.group(1) - for match in re.finditer( - r"^\s*(\S+)(?===\S+)", constraints_text, flags=re.MULTILINE - ) - ] - - # Install dependencies specified in `testing/constraints-X.txt`. - session.install(*constraints_deps) - - # TODO(https://github.com/googleapis/gapic-generator-python/issues/2358): `grpcio` and - # `grpcio-status` should be added to the list below so that they are installed from source, - # rather than PyPI. - # TODO(https://github.com/googleapis/gapic-generator-python/issues/2357): `protobuf` should be - # added to the list below so that it is installed from source, rather than PyPI - # Note: If a dependency is added to the `core_dependencies_from_source` list, - # the `prerel_deps` list in the `prerelease_deps` nox session should also be updated. - core_dependencies_from_source = [ - "googleapis-common-protos @ git+https://github.com/googleapis/google-cloud-python#egg=googleapis-common-protos&subdirectory=packages/googleapis-common-protos", - "google-api-core @ git+https://github.com/googleapis/python-api-core.git", - "google-auth @ git+https://github.com/googleapis/google-auth-library-python.git", - "grpc-google-iam-v1 @ git+https://github.com/googleapis/google-cloud-python#egg=grpc-google-iam-v1&subdirectory=packages/grpc-google-iam-v1", - "proto-plus @ git+https://github.com/googleapis/proto-plus-python.git", - ] - - for dep in core_dependencies_from_source: - session.install(dep, "--no-deps", "--ignore-installed") - print(f"Installed {dep}") - - session.run( - "py.test", - "tests/unit", - env={ - "PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION": protobuf_implementation, - }, - ) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_create_challenge_async.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_create_challenge_async.py deleted file mode 100644 index 528b0847412b..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_create_challenge_async.py +++ /dev/null @@ -1,52 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -# Generated code. DO NOT EDIT! -# -# Snippet for CreateChallenge -# NOTE: This snippet has been automatically generated for illustrative purposes only. -# It may require modifications to work in your environment. - -# To install the latest published package dependency, execute the following: -# python3 -m pip install google-cloud-confidentialcomputing - - -# [START confidentialcomputing_v1_generated_ConfidentialComputing_CreateChallenge_async] -# This snippet has been automatically generated and should be regarded as a -# code template only. -# It will require modifications to work: -# - It may require correct/in-range values for request initialization. -# - It may require specifying regional endpoints when creating the service -# client as shown in: -# https://googleapis.dev/python/google-api-core/latest/client_options.html -from google.cloud import confidentialcomputing_v1 - - -async def sample_create_challenge(): - # Create a client - client = confidentialcomputing_v1.ConfidentialComputingAsyncClient() - - # Initialize request argument(s) - request = confidentialcomputing_v1.CreateChallengeRequest( - parent="parent_value", - ) - - # Make the request - response = await client.create_challenge(request=request) - - # Handle the response - print(response) - -# [END confidentialcomputing_v1_generated_ConfidentialComputing_CreateChallenge_async] diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_create_challenge_sync.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_create_challenge_sync.py deleted file mode 100644 index 77033a817788..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_create_challenge_sync.py +++ /dev/null @@ -1,52 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -# Generated code. DO NOT EDIT! -# -# Snippet for CreateChallenge -# NOTE: This snippet has been automatically generated for illustrative purposes only. -# It may require modifications to work in your environment. - -# To install the latest published package dependency, execute the following: -# python3 -m pip install google-cloud-confidentialcomputing - - -# [START confidentialcomputing_v1_generated_ConfidentialComputing_CreateChallenge_sync] -# This snippet has been automatically generated and should be regarded as a -# code template only. -# It will require modifications to work: -# - It may require correct/in-range values for request initialization. -# - It may require specifying regional endpoints when creating the service -# client as shown in: -# https://googleapis.dev/python/google-api-core/latest/client_options.html -from google.cloud import confidentialcomputing_v1 - - -def sample_create_challenge(): - # Create a client - client = confidentialcomputing_v1.ConfidentialComputingClient() - - # Initialize request argument(s) - request = confidentialcomputing_v1.CreateChallengeRequest( - parent="parent_value", - ) - - # Make the request - response = client.create_challenge(request=request) - - # Handle the response - print(response) - -# [END confidentialcomputing_v1_generated_ConfidentialComputing_CreateChallenge_sync] diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_attestation_async.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_attestation_async.py deleted file mode 100644 index 815f2f866b48..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_attestation_async.py +++ /dev/null @@ -1,52 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -# Generated code. DO NOT EDIT! -# -# Snippet for VerifyAttestation -# NOTE: This snippet has been automatically generated for illustrative purposes only. -# It may require modifications to work in your environment. - -# To install the latest published package dependency, execute the following: -# python3 -m pip install google-cloud-confidentialcomputing - - -# [START confidentialcomputing_v1_generated_ConfidentialComputing_VerifyAttestation_async] -# This snippet has been automatically generated and should be regarded as a -# code template only. -# It will require modifications to work: -# - It may require correct/in-range values for request initialization. -# - It may require specifying regional endpoints when creating the service -# client as shown in: -# https://googleapis.dev/python/google-api-core/latest/client_options.html -from google.cloud import confidentialcomputing_v1 - - -async def sample_verify_attestation(): - # Create a client - client = confidentialcomputing_v1.ConfidentialComputingAsyncClient() - - # Initialize request argument(s) - request = confidentialcomputing_v1.VerifyAttestationRequest( - challenge="challenge_value", - ) - - # Make the request - response = await client.verify_attestation(request=request) - - # Handle the response - print(response) - -# [END confidentialcomputing_v1_generated_ConfidentialComputing_VerifyAttestation_async] diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_attestation_sync.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_attestation_sync.py deleted file mode 100644 index 724ad44eec2a..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_attestation_sync.py +++ /dev/null @@ -1,52 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -# Generated code. DO NOT EDIT! -# -# Snippet for VerifyAttestation -# NOTE: This snippet has been automatically generated for illustrative purposes only. -# It may require modifications to work in your environment. - -# To install the latest published package dependency, execute the following: -# python3 -m pip install google-cloud-confidentialcomputing - - -# [START confidentialcomputing_v1_generated_ConfidentialComputing_VerifyAttestation_sync] -# This snippet has been automatically generated and should be regarded as a -# code template only. -# It will require modifications to work: -# - It may require correct/in-range values for request initialization. -# - It may require specifying regional endpoints when creating the service -# client as shown in: -# https://googleapis.dev/python/google-api-core/latest/client_options.html -from google.cloud import confidentialcomputing_v1 - - -def sample_verify_attestation(): - # Create a client - client = confidentialcomputing_v1.ConfidentialComputingClient() - - # Initialize request argument(s) - request = confidentialcomputing_v1.VerifyAttestationRequest( - challenge="challenge_value", - ) - - # Make the request - response = client.verify_attestation(request=request) - - # Handle the response - print(response) - -# [END confidentialcomputing_v1_generated_ConfidentialComputing_VerifyAttestation_sync] diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/snippet_metadata_google.cloud.confidentialcomputing.v1.json b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/snippet_metadata_google.cloud.confidentialcomputing.v1.json deleted file mode 100644 index 1994174817f3..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/snippet_metadata_google.cloud.confidentialcomputing.v1.json +++ /dev/null @@ -1,643 +0,0 @@ -{ - "clientLibrary": { - "apis": [ - { - "id": "google.cloud.confidentialcomputing.v1", - "version": "v1" - } - ], - "language": "PYTHON", - "name": "google-cloud-confidentialcomputing", - "version": "0.1.0" - }, - "snippets": [ - { - "canonical": true, - "clientMethod": { - "async": true, - "client": { - "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient", - "shortName": "ConfidentialComputingAsyncClient" - }, - "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient.create_challenge", - "method": { - "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.CreateChallenge", - "service": { - "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "shortName": "ConfidentialComputing" - }, - "shortName": "CreateChallenge" - }, - "parameters": [ - { - "name": "request", - "type": "google.cloud.confidentialcomputing_v1.types.CreateChallengeRequest" - }, - { - "name": "parent", - "type": "str" - }, - { - "name": "challenge", - "type": "google.cloud.confidentialcomputing_v1.types.Challenge" - }, - { - "name": "retry", - "type": "google.api_core.retry.Retry" - }, - { - "name": "timeout", - "type": "float" - }, - { - "name": "metadata", - "type": "Sequence[Tuple[str, Union[str, bytes]]]" - } - ], - "resultType": "google.cloud.confidentialcomputing_v1.types.Challenge", - "shortName": "create_challenge" - }, - "description": "Sample for CreateChallenge", - "file": "confidentialcomputing_v1_generated_confidential_computing_create_challenge_async.py", - "language": "PYTHON", - "origin": "API_DEFINITION", - "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_CreateChallenge_async", - "segments": [ - { - "end": 51, - "start": 27, - "type": "FULL" - }, - { - "end": 51, - "start": 27, - "type": "SHORT" - }, - { - "end": 40, - "start": 38, - "type": "CLIENT_INITIALIZATION" - }, - { - "end": 45, - "start": 41, - "type": "REQUEST_INITIALIZATION" - }, - { - "end": 48, - "start": 46, - "type": "REQUEST_EXECUTION" - }, - { - "end": 52, - "start": 49, - "type": "RESPONSE_HANDLING" - } - ], - "title": "confidentialcomputing_v1_generated_confidential_computing_create_challenge_async.py" - }, - { - "canonical": true, - "clientMethod": { - "client": { - "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient", - "shortName": "ConfidentialComputingClient" - }, - "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.create_challenge", - "method": { - "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.CreateChallenge", - "service": { - "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "shortName": "ConfidentialComputing" - }, - "shortName": "CreateChallenge" - }, - "parameters": [ - { - "name": "request", - "type": "google.cloud.confidentialcomputing_v1.types.CreateChallengeRequest" - }, - { - "name": "parent", - "type": "str" - }, - { - "name": "challenge", - "type": "google.cloud.confidentialcomputing_v1.types.Challenge" - }, - { - "name": "retry", - "type": "google.api_core.retry.Retry" - }, - { - "name": "timeout", - "type": "float" - }, - { - "name": "metadata", - "type": "Sequence[Tuple[str, Union[str, bytes]]]" - } - ], - "resultType": "google.cloud.confidentialcomputing_v1.types.Challenge", - "shortName": "create_challenge" - }, - "description": "Sample for CreateChallenge", - "file": "confidentialcomputing_v1_generated_confidential_computing_create_challenge_sync.py", - "language": "PYTHON", - "origin": "API_DEFINITION", - "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_CreateChallenge_sync", - "segments": [ - { - "end": 51, - "start": 27, - "type": "FULL" - }, - { - "end": 51, - "start": 27, - "type": "SHORT" - }, - { - "end": 40, - "start": 38, - "type": "CLIENT_INITIALIZATION" - }, - { - "end": 45, - "start": 41, - "type": "REQUEST_INITIALIZATION" - }, - { - "end": 48, - "start": 46, - "type": "REQUEST_EXECUTION" - }, - { - "end": 52, - "start": 49, - "type": "RESPONSE_HANDLING" - } - ], - "title": "confidentialcomputing_v1_generated_confidential_computing_create_challenge_sync.py" - }, - { - "canonical": true, - "clientMethod": { - "async": true, - "client": { - "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient", - "shortName": "ConfidentialComputingAsyncClient" - }, - "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient.verify_attestation", - "method": { - "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.VerifyAttestation", - "service": { - "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "shortName": "ConfidentialComputing" - }, - "shortName": "VerifyAttestation" - }, - "parameters": [ - { - "name": "request", - "type": "google.cloud.confidentialcomputing_v1.types.VerifyAttestationRequest" - }, - { - "name": "retry", - "type": "google.api_core.retry.Retry" - }, - { - "name": "timeout", - "type": "float" - }, - { - "name": "metadata", - "type": "Sequence[Tuple[str, Union[str, bytes]]]" - } - ], - "resultType": "google.cloud.confidentialcomputing_v1.types.VerifyAttestationResponse", - "shortName": "verify_attestation" - }, - "description": "Sample for VerifyAttestation", - "file": "confidentialcomputing_v1_generated_confidential_computing_verify_attestation_async.py", - "language": "PYTHON", - "origin": "API_DEFINITION", - "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_VerifyAttestation_async", - "segments": [ - { - "end": 51, - "start": 27, - "type": "FULL" - }, - { - "end": 51, - "start": 27, - "type": "SHORT" - }, - { - "end": 40, - "start": 38, - "type": "CLIENT_INITIALIZATION" - }, - { - "end": 45, - "start": 41, - "type": "REQUEST_INITIALIZATION" - }, - { - "end": 48, - "start": 46, - "type": "REQUEST_EXECUTION" - }, - { - "end": 52, - "start": 49, - "type": "RESPONSE_HANDLING" - } - ], - "title": "confidentialcomputing_v1_generated_confidential_computing_verify_attestation_async.py" - }, - { - "canonical": true, - "clientMethod": { - "client": { - "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient", - "shortName": "ConfidentialComputingClient" - }, - "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.verify_attestation", - "method": { - "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.VerifyAttestation", - "service": { - "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "shortName": "ConfidentialComputing" - }, - "shortName": "VerifyAttestation" - }, - "parameters": [ - { - "name": "request", - "type": "google.cloud.confidentialcomputing_v1.types.VerifyAttestationRequest" - }, - { - "name": "retry", - "type": "google.api_core.retry.Retry" - }, - { - "name": "timeout", - "type": "float" - }, - { - "name": "metadata", - "type": "Sequence[Tuple[str, Union[str, bytes]]]" - } - ], - "resultType": "google.cloud.confidentialcomputing_v1.types.VerifyAttestationResponse", - "shortName": "verify_attestation" - }, - "description": "Sample for VerifyAttestation", - "file": "confidentialcomputing_v1_generated_confidential_computing_verify_attestation_sync.py", - "language": "PYTHON", - "origin": "API_DEFINITION", - "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_VerifyAttestation_sync", - "segments": [ - { - "end": 51, - "start": 27, - "type": "FULL" - }, - { - "end": 51, - "start": 27, - "type": "SHORT" - }, - { - "end": 40, - "start": 38, - "type": "CLIENT_INITIALIZATION" - }, - { - "end": 45, - "start": 41, - "type": "REQUEST_INITIALIZATION" - }, - { - "end": 48, - "start": 46, - "type": "REQUEST_EXECUTION" - }, - { - "end": 52, - "start": 49, - "type": "RESPONSE_HANDLING" - } - ], - "title": "confidentialcomputing_v1_generated_confidential_computing_verify_attestation_sync.py" - }, - { - "canonical": true, - "clientMethod": { - "async": true, - "client": { - "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient", - "shortName": "ConfidentialComputingAsyncClient" - }, - "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient.verify_confidential_gke", - "method": { - "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.VerifyConfidentialGke", - "service": { - "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "shortName": "ConfidentialComputing" - }, - "shortName": "VerifyConfidentialGke" - }, - "parameters": [ - { - "name": "request", - "type": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeRequest" - }, - { - "name": "retry", - "type": "google.api_core.retry.Retry" - }, - { - "name": "timeout", - "type": "float" - }, - { - "name": "metadata", - "type": "Sequence[Tuple[str, Union[str, bytes]]]" - } - ], - "resultType": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeResponse", - "shortName": "verify_confidential_gke" - }, - "description": "Sample for VerifyConfidentialGke", - "file": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_async.py", - "language": "PYTHON", - "origin": "API_DEFINITION", - "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialGke_async", - "segments": [ - { - "end": 51, - "start": 27, - "type": "FULL" - }, - { - "end": 51, - "start": 27, - "type": "SHORT" - }, - { - "end": 40, - "start": 38, - "type": "CLIENT_INITIALIZATION" - }, - { - "end": 45, - "start": 41, - "type": "REQUEST_INITIALIZATION" - }, - { - "end": 48, - "start": 46, - "type": "REQUEST_EXECUTION" - }, - { - "end": 52, - "start": 49, - "type": "RESPONSE_HANDLING" - } - ], - "title": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_async.py" - }, - { - "canonical": true, - "clientMethod": { - "client": { - "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient", - "shortName": "ConfidentialComputingClient" - }, - "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.verify_confidential_gke", - "method": { - "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.VerifyConfidentialGke", - "service": { - "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "shortName": "ConfidentialComputing" - }, - "shortName": "VerifyConfidentialGke" - }, - "parameters": [ - { - "name": "request", - "type": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeRequest" - }, - { - "name": "retry", - "type": "google.api_core.retry.Retry" - }, - { - "name": "timeout", - "type": "float" - }, - { - "name": "metadata", - "type": "Sequence[Tuple[str, Union[str, bytes]]]" - } - ], - "resultType": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeResponse", - "shortName": "verify_confidential_gke" - }, - "description": "Sample for VerifyConfidentialGke", - "file": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_sync.py", - "language": "PYTHON", - "origin": "API_DEFINITION", - "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialGke_sync", - "segments": [ - { - "end": 51, - "start": 27, - "type": "FULL" - }, - { - "end": 51, - "start": 27, - "type": "SHORT" - }, - { - "end": 40, - "start": 38, - "type": "CLIENT_INITIALIZATION" - }, - { - "end": 45, - "start": 41, - "type": "REQUEST_INITIALIZATION" - }, - { - "end": 48, - "start": 46, - "type": "REQUEST_EXECUTION" - }, - { - "end": 52, - "start": 49, - "type": "RESPONSE_HANDLING" - } - ], - "title": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_sync.py" - }, - { - "canonical": true, - "clientMethod": { - "async": true, - "client": { - "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient", - "shortName": "ConfidentialComputingAsyncClient" - }, - "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient.verify_confidential_space", - "method": { - "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.VerifyConfidentialSpace", - "service": { - "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "shortName": "ConfidentialComputing" - }, - "shortName": "VerifyConfidentialSpace" - }, - "parameters": [ - { - "name": "request", - "type": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceRequest" - }, - { - "name": "retry", - "type": "google.api_core.retry.Retry" - }, - { - "name": "timeout", - "type": "float" - }, - { - "name": "metadata", - "type": "Sequence[Tuple[str, Union[str, bytes]]]" - } - ], - "resultType": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceResponse", - "shortName": "verify_confidential_space" - }, - "description": "Sample for VerifyConfidentialSpace", - "file": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_async.py", - "language": "PYTHON", - "origin": "API_DEFINITION", - "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialSpace_async", - "segments": [ - { - "end": 51, - "start": 27, - "type": "FULL" - }, - { - "end": 51, - "start": 27, - "type": "SHORT" - }, - { - "end": 40, - "start": 38, - "type": "CLIENT_INITIALIZATION" - }, - { - "end": 45, - "start": 41, - "type": "REQUEST_INITIALIZATION" - }, - { - "end": 48, - "start": 46, - "type": "REQUEST_EXECUTION" - }, - { - "end": 52, - "start": 49, - "type": "RESPONSE_HANDLING" - } - ], - "title": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_async.py" - }, - { - "canonical": true, - "clientMethod": { - "client": { - "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient", - "shortName": "ConfidentialComputingClient" - }, - "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.verify_confidential_space", - "method": { - "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.VerifyConfidentialSpace", - "service": { - "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "shortName": "ConfidentialComputing" - }, - "shortName": "VerifyConfidentialSpace" - }, - "parameters": [ - { - "name": "request", - "type": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceRequest" - }, - { - "name": "retry", - "type": "google.api_core.retry.Retry" - }, - { - "name": "timeout", - "type": "float" - }, - { - "name": "metadata", - "type": "Sequence[Tuple[str, Union[str, bytes]]]" - } - ], - "resultType": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceResponse", - "shortName": "verify_confidential_space" - }, - "description": "Sample for VerifyConfidentialSpace", - "file": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_sync.py", - "language": "PYTHON", - "origin": "API_DEFINITION", - "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialSpace_sync", - "segments": [ - { - "end": 51, - "start": 27, - "type": "FULL" - }, - { - "end": 51, - "start": 27, - "type": "SHORT" - }, - { - "end": 40, - "start": 38, - "type": "CLIENT_INITIALIZATION" - }, - { - "end": 45, - "start": 41, - "type": "REQUEST_INITIALIZATION" - }, - { - "end": 48, - "start": 46, - "type": "REQUEST_EXECUTION" - }, - { - "end": 52, - "start": 49, - "type": "RESPONSE_HANDLING" - } - ], - "title": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_sync.py" - } - ] -} diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/scripts/fixup_confidentialcomputing_v1_keywords.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/scripts/fixup_confidentialcomputing_v1_keywords.py deleted file mode 100644 index 6a8e4fb95705..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/scripts/fixup_confidentialcomputing_v1_keywords.py +++ /dev/null @@ -1,179 +0,0 @@ -#! /usr/bin/env python3 -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -import argparse -import os -import libcst as cst -import pathlib -import sys -from typing import (Any, Callable, Dict, List, Sequence, Tuple) - - -def partition( - predicate: Callable[[Any], bool], - iterator: Sequence[Any] -) -> Tuple[List[Any], List[Any]]: - """A stable, out-of-place partition.""" - results = ([], []) - - for i in iterator: - results[int(predicate(i))].append(i) - - # Returns trueList, falseList - return results[1], results[0] - - -class confidentialcomputingCallTransformer(cst.CSTTransformer): - CTRL_PARAMS: Tuple[str] = ('retry', 'timeout', 'metadata') - METHOD_TO_PARAMS: Dict[str, Tuple[str]] = { - 'create_challenge': ('parent', 'challenge', ), - 'verify_attestation': ('challenge', 'tpm_attestation', 'td_ccel', 'sev_snp_attestation', 'gcp_credentials', 'confidential_space_info', 'token_options', 'attester', ), - 'verify_confidential_gke': ('challenge', 'tpm_attestation', ), - 'verify_confidential_space': ('challenge', 'td_ccel', 'tpm_attestation', 'gcp_credentials', 'signed_entities', 'gce_shielded_identity', 'options', ), - } - - def leave_Call(self, original: cst.Call, updated: cst.Call) -> cst.CSTNode: - try: - key = original.func.attr.value - kword_params = self.METHOD_TO_PARAMS[key] - except (AttributeError, KeyError): - # Either not a method from the API or too convoluted to be sure. - return updated - - # If the existing code is valid, keyword args come after positional args. - # Therefore, all positional args must map to the first parameters. - args, kwargs = partition(lambda a: not bool(a.keyword), updated.args) - if any(k.keyword.value == "request" for k in kwargs): - # We've already fixed this file, don't fix it again. - return updated - - kwargs, ctrl_kwargs = partition( - lambda a: a.keyword.value not in self.CTRL_PARAMS, - kwargs - ) - - args, ctrl_args = args[:len(kword_params)], args[len(kword_params):] - ctrl_kwargs.extend(cst.Arg(value=a.value, keyword=cst.Name(value=ctrl)) - for a, ctrl in zip(ctrl_args, self.CTRL_PARAMS)) - - request_arg = cst.Arg( - value=cst.Dict([ - cst.DictElement( - cst.SimpleString("'{}'".format(name)), -cst.Element(value=arg.value) - ) - # Note: the args + kwargs looks silly, but keep in mind that - # the control parameters had to be stripped out, and that - # those could have been passed positionally or by keyword. - for name, arg in zip(kword_params, args + kwargs)]), - keyword=cst.Name("request") - ) - - return updated.with_changes( - args=[request_arg] + ctrl_kwargs - ) - - -def fix_files( - in_dir: pathlib.Path, - out_dir: pathlib.Path, - *, - transformer=confidentialcomputingCallTransformer(), -): - """Duplicate the input dir to the output dir, fixing file method calls. - - Preconditions: - * in_dir is a real directory - * out_dir is a real, empty directory - """ - pyfile_gen = ( - pathlib.Path(os.path.join(root, f)) - for root, _, files in os.walk(in_dir) - for f in files if os.path.splitext(f)[1] == ".py" - ) - - for fpath in pyfile_gen: - with open(fpath, 'r') as f: - src = f.read() - - # Parse the code and insert method call fixes. - tree = cst.parse_module(src) - updated = tree.visit(transformer) - - # Create the path and directory structure for the new file. - updated_path = out_dir.joinpath(fpath.relative_to(in_dir)) - updated_path.parent.mkdir(parents=True, exist_ok=True) - - # Generate the updated source file at the corresponding path. - with open(updated_path, 'w') as f: - f.write(updated.code) - - -if __name__ == '__main__': - parser = argparse.ArgumentParser( - description="""Fix up source that uses the confidentialcomputing client library. - -The existing sources are NOT overwritten but are copied to output_dir with changes made. - -Note: This tool operates at a best-effort level at converting positional - parameters in client method calls to keyword based parameters. - Cases where it WILL FAIL include - A) * or ** expansion in a method call. - B) Calls via function or method alias (includes free function calls) - C) Indirect or dispatched calls (e.g. the method is looked up dynamically) - - These all constitute false negatives. The tool will also detect false - positives when an API method shares a name with another method. -""") - parser.add_argument( - '-d', - '--input-directory', - required=True, - dest='input_dir', - help='the input directory to walk for python files to fix up', - ) - parser.add_argument( - '-o', - '--output-directory', - required=True, - dest='output_dir', - help='the directory to output files fixed via un-flattening', - ) - args = parser.parse_args() - input_dir = pathlib.Path(args.input_dir) - output_dir = pathlib.Path(args.output_dir) - if not input_dir.is_dir(): - print( - f"input directory '{input_dir}' does not exist or is not a directory", - file=sys.stderr, - ) - sys.exit(-1) - - if not output_dir.is_dir(): - print( - f"output directory '{output_dir}' does not exist or is not a directory", - file=sys.stderr, - ) - sys.exit(-1) - - if os.listdir(output_dir): - print( - f"output directory '{output_dir}' is not empty", - file=sys.stderr, - ) - sys.exit(-1) - - fix_files(input_dir, output_dir) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/setup.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/setup.py deleted file mode 100644 index 1fed1a0eec9f..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/setup.py +++ /dev/null @@ -1,98 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -import io -import os -import re - -import setuptools # type: ignore - -package_root = os.path.abspath(os.path.dirname(__file__)) - -name = 'google-cloud-confidentialcomputing' - - -description = "Google Cloud Confidentialcomputing API client library" - -version = None - -with open(os.path.join(package_root, 'google/cloud/confidentialcomputing/gapic_version.py')) as fp: - version_candidates = re.findall(r"(?<=\")\d+.\d+.\d+(?=\")", fp.read()) - assert (len(version_candidates) == 1) - version = version_candidates[0] - -if version[0] == "0": - release_status = "Development Status :: 4 - Beta" -else: - release_status = "Development Status :: 5 - Production/Stable" - -dependencies = [ - "google-api-core[grpc] >= 1.34.1, <3.0.0,!=2.0.*,!=2.1.*,!=2.2.*,!=2.3.*,!=2.4.*,!=2.5.*,!=2.6.*,!=2.7.*,!=2.8.*,!=2.9.*,!=2.10.*", - # Exclude incompatible versions of `google-auth` - # See https://github.com/googleapis/google-cloud-python/issues/12364 - "google-auth >= 2.14.1, <3.0.0,!=2.24.0,!=2.25.0", - "proto-plus >= 1.22.3, <2.0.0", - "proto-plus >= 1.25.0, <2.0.0; python_version >= '3.13'", - "protobuf>=3.20.2,<7.0.0,!=4.21.0,!=4.21.1,!=4.21.2,!=4.21.3,!=4.21.4,!=4.21.5", -] -extras = { -} -url = "https://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-confidentialcomputing" - -package_root = os.path.abspath(os.path.dirname(__file__)) - -readme_filename = os.path.join(package_root, "README.rst") -with io.open(readme_filename, encoding="utf-8") as readme_file: - readme = readme_file.read() - -packages = [ - package - for package in setuptools.find_namespace_packages() - if package.startswith("google") -] - -setuptools.setup( - name=name, - version=version, - description=description, - long_description=readme, - author="Google LLC", - author_email="googleapis-packages@google.com", - license="Apache 2.0", - url=url, - classifiers=[ - release_status, - "Intended Audience :: Developers", - "License :: OSI Approved :: Apache Software License", - "Programming Language :: Python", - "Programming Language :: Python :: 3", - "Programming Language :: Python :: 3.7", - "Programming Language :: Python :: 3.8", - "Programming Language :: Python :: 3.9", - "Programming Language :: Python :: 3.10", - "Programming Language :: Python :: 3.11", - "Programming Language :: Python :: 3.12", - "Programming Language :: Python :: 3.13", - "Operating System :: OS Independent", - "Topic :: Internet", - ], - platforms="Posix; MacOS X; Windows", - packages=packages, - python_requires=">=3.7", - install_requires=dependencies, - extras_require=extras, - include_package_data=True, - zip_safe=False, -) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.10.txt b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.10.txt deleted file mode 100644 index ed7f9aed2559..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.10.txt +++ /dev/null @@ -1,6 +0,0 @@ -# -*- coding: utf-8 -*- -# This constraints file is required for unit tests. -# List all library dependencies and extras in this file. -google-api-core -proto-plus -protobuf diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.11.txt b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.11.txt deleted file mode 100644 index ed7f9aed2559..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.11.txt +++ /dev/null @@ -1,6 +0,0 @@ -# -*- coding: utf-8 -*- -# This constraints file is required for unit tests. -# List all library dependencies and extras in this file. -google-api-core -proto-plus -protobuf diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.12.txt b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.12.txt deleted file mode 100644 index ed7f9aed2559..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.12.txt +++ /dev/null @@ -1,6 +0,0 @@ -# -*- coding: utf-8 -*- -# This constraints file is required for unit tests. -# List all library dependencies and extras in this file. -google-api-core -proto-plus -protobuf diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.13.txt b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.13.txt deleted file mode 100644 index c20a77817caa..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.13.txt +++ /dev/null @@ -1,11 +0,0 @@ -# We use the constraints file for the latest Python version -# (currently this file) to check that the latest -# major versions of dependencies are supported in setup.py. -# List all library dependencies and extras in this file. -# Require the latest major version be installed for each dependency. -# e.g., if setup.py has "google-cloud-foo >= 1.14.0, < 2.0.0", -# Then this file should have google-cloud-foo>=1 -google-api-core>=2 -google-auth>=2 -proto-plus>=1 -protobuf>=6 diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.7.txt b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.7.txt deleted file mode 100644 index a77f12bc13e4..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.7.txt +++ /dev/null @@ -1,10 +0,0 @@ -# This constraints file is used to check that lower bounds -# are correct in setup.py -# List all library dependencies and extras in this file. -# Pin the version to the lower bound. -# e.g., if setup.py has "google-cloud-foo >= 1.14.0, < 2.0.0", -# Then this file should have google-cloud-foo==1.14.0 -google-api-core==1.34.1 -google-auth==2.14.1 -proto-plus==1.22.3 -protobuf==3.20.2 diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.8.txt b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.8.txt deleted file mode 100644 index ed7f9aed2559..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.8.txt +++ /dev/null @@ -1,6 +0,0 @@ -# -*- coding: utf-8 -*- -# This constraints file is required for unit tests. -# List all library dependencies and extras in this file. -google-api-core -proto-plus -protobuf diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.9.txt b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.9.txt deleted file mode 100644 index ed7f9aed2559..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.9.txt +++ /dev/null @@ -1,6 +0,0 @@ -# -*- coding: utf-8 -*- -# This constraints file is required for unit tests. -# List all library dependencies and extras in this file. -google-api-core -proto-plus -protobuf diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/__init__.py deleted file mode 100644 index 191773d5572d..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/__init__.py +++ /dev/null @@ -1,16 +0,0 @@ - -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/__init__.py deleted file mode 100644 index 191773d5572d..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/__init__.py +++ /dev/null @@ -1,16 +0,0 @@ - -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/__init__.py deleted file mode 100644 index 191773d5572d..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/__init__.py +++ /dev/null @@ -1,16 +0,0 @@ - -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/confidentialcomputing_v1/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/confidentialcomputing_v1/__init__.py deleted file mode 100644 index 191773d5572d..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/confidentialcomputing_v1/__init__.py +++ /dev/null @@ -1,16 +0,0 @@ - -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/confidentialcomputing_v1/test_confidential_computing.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/confidentialcomputing_v1/test_confidential_computing.py deleted file mode 100644 index 261b185b4d1b..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/confidentialcomputing_v1/test_confidential_computing.py +++ /dev/null @@ -1,4165 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -import os -# try/except added for compatibility with python < 3.8 -try: - from unittest import mock - from unittest.mock import AsyncMock # pragma: NO COVER -except ImportError: # pragma: NO COVER - import mock - -import grpc -from grpc.experimental import aio -from collections.abc import Iterable, AsyncIterable -from google.protobuf import json_format -import json -import math -import pytest -from google.api_core import api_core_version -from proto.marshal.rules.dates import DurationRule, TimestampRule -from proto.marshal.rules import wrappers -from requests import Response -from requests import Request, PreparedRequest -from requests.sessions import Session -from google.protobuf import json_format - -try: - from google.auth.aio import credentials as ga_credentials_async - HAS_GOOGLE_AUTH_AIO = True -except ImportError: # pragma: NO COVER - HAS_GOOGLE_AUTH_AIO = False - -from google.api_core import client_options -from google.api_core import exceptions as core_exceptions -from google.api_core import gapic_v1 -from google.api_core import grpc_helpers -from google.api_core import grpc_helpers_async -from google.api_core import path_template -from google.api_core import retry as retries -from google.auth import credentials as ga_credentials -from google.auth.exceptions import MutualTLSChannelError -from google.cloud.confidentialcomputing_v1.services.confidential_computing import ConfidentialComputingAsyncClient -from google.cloud.confidentialcomputing_v1.services.confidential_computing import ConfidentialComputingClient -from google.cloud.confidentialcomputing_v1.services.confidential_computing import transports -from google.cloud.confidentialcomputing_v1.types import service -from google.cloud.location import locations_pb2 -from google.oauth2 import service_account -from google.protobuf import timestamp_pb2 # type: ignore -from google.rpc import status_pb2 # type: ignore -import google.auth - - - -CRED_INFO_JSON = { - "credential_source": "/path/to/file", - "credential_type": "service account credentials", - "principal": "service-account@example.com", -} -CRED_INFO_STRING = json.dumps(CRED_INFO_JSON) - - -async def mock_async_gen(data, chunk_size=1): - for i in range(0, len(data)): # pragma: NO COVER - chunk = data[i : i + chunk_size] - yield chunk.encode("utf-8") - -def client_cert_source_callback(): - return b"cert bytes", b"key bytes" - -# TODO: use async auth anon credentials by default once the minimum version of google-auth is upgraded. -# See related issue: https://github.com/googleapis/gapic-generator-python/issues/2107. -def async_anonymous_credentials(): - if HAS_GOOGLE_AUTH_AIO: - return ga_credentials_async.AnonymousCredentials() - return ga_credentials.AnonymousCredentials() - -# If default endpoint is localhost, then default mtls endpoint will be the same. -# This method modifies the default endpoint so the client can produce a different -# mtls endpoint for endpoint testing purposes. -def modify_default_endpoint(client): - return "foo.googleapis.com" if ("localhost" in client.DEFAULT_ENDPOINT) else client.DEFAULT_ENDPOINT - -# If default endpoint template is localhost, then default mtls endpoint will be the same. -# This method modifies the default endpoint template so the client can produce a different -# mtls endpoint for endpoint testing purposes. -def modify_default_endpoint_template(client): - return "test.{UNIVERSE_DOMAIN}" if ("localhost" in client._DEFAULT_ENDPOINT_TEMPLATE) else client._DEFAULT_ENDPOINT_TEMPLATE - - -def test__get_default_mtls_endpoint(): - api_endpoint = "example.googleapis.com" - api_mtls_endpoint = "example.mtls.googleapis.com" - sandbox_endpoint = "example.sandbox.googleapis.com" - sandbox_mtls_endpoint = "example.mtls.sandbox.googleapis.com" - non_googleapi = "api.example.com" - - assert ConfidentialComputingClient._get_default_mtls_endpoint(None) is None - assert ConfidentialComputingClient._get_default_mtls_endpoint(api_endpoint) == api_mtls_endpoint - assert ConfidentialComputingClient._get_default_mtls_endpoint(api_mtls_endpoint) == api_mtls_endpoint - assert ConfidentialComputingClient._get_default_mtls_endpoint(sandbox_endpoint) == sandbox_mtls_endpoint - assert ConfidentialComputingClient._get_default_mtls_endpoint(sandbox_mtls_endpoint) == sandbox_mtls_endpoint - assert ConfidentialComputingClient._get_default_mtls_endpoint(non_googleapi) == non_googleapi - -def test__read_environment_variables(): - assert ConfidentialComputingClient._read_environment_variables() == (False, "auto", None) - - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "true"}): - assert ConfidentialComputingClient._read_environment_variables() == (True, "auto", None) - - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "false"}): - assert ConfidentialComputingClient._read_environment_variables() == (False, "auto", None) - - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "Unsupported"}): - with pytest.raises(ValueError) as excinfo: - ConfidentialComputingClient._read_environment_variables() - assert str(excinfo.value) == "Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`" - - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "never"}): - assert ConfidentialComputingClient._read_environment_variables() == (False, "never", None) - - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "always"}): - assert ConfidentialComputingClient._read_environment_variables() == (False, "always", None) - - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "auto"}): - assert ConfidentialComputingClient._read_environment_variables() == (False, "auto", None) - - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "Unsupported"}): - with pytest.raises(MutualTLSChannelError) as excinfo: - ConfidentialComputingClient._read_environment_variables() - assert str(excinfo.value) == "Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`" - - with mock.patch.dict(os.environ, {"GOOGLE_CLOUD_UNIVERSE_DOMAIN": "foo.com"}): - assert ConfidentialComputingClient._read_environment_variables() == (False, "auto", "foo.com") - -def test__get_client_cert_source(): - mock_provided_cert_source = mock.Mock() - mock_default_cert_source = mock.Mock() - - assert ConfidentialComputingClient._get_client_cert_source(None, False) is None - assert ConfidentialComputingClient._get_client_cert_source(mock_provided_cert_source, False) is None - assert ConfidentialComputingClient._get_client_cert_source(mock_provided_cert_source, True) == mock_provided_cert_source - - with mock.patch('google.auth.transport.mtls.has_default_client_cert_source', return_value=True): - with mock.patch('google.auth.transport.mtls.default_client_cert_source', return_value=mock_default_cert_source): - assert ConfidentialComputingClient._get_client_cert_source(None, True) is mock_default_cert_source - assert ConfidentialComputingClient._get_client_cert_source(mock_provided_cert_source, "true") is mock_provided_cert_source - -@mock.patch.object(ConfidentialComputingClient, "_DEFAULT_ENDPOINT_TEMPLATE", modify_default_endpoint_template(ConfidentialComputingClient)) -@mock.patch.object(ConfidentialComputingAsyncClient, "_DEFAULT_ENDPOINT_TEMPLATE", modify_default_endpoint_template(ConfidentialComputingAsyncClient)) -def test__get_api_endpoint(): - api_override = "foo.com" - mock_client_cert_source = mock.Mock() - default_universe = ConfidentialComputingClient._DEFAULT_UNIVERSE - default_endpoint = ConfidentialComputingClient._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=default_universe) - mock_universe = "bar.com" - mock_endpoint = ConfidentialComputingClient._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=mock_universe) - - assert ConfidentialComputingClient._get_api_endpoint(api_override, mock_client_cert_source, default_universe, "always") == api_override - assert ConfidentialComputingClient._get_api_endpoint(None, mock_client_cert_source, default_universe, "auto") == ConfidentialComputingClient.DEFAULT_MTLS_ENDPOINT - assert ConfidentialComputingClient._get_api_endpoint(None, None, default_universe, "auto") == default_endpoint - assert ConfidentialComputingClient._get_api_endpoint(None, None, default_universe, "always") == ConfidentialComputingClient.DEFAULT_MTLS_ENDPOINT - assert ConfidentialComputingClient._get_api_endpoint(None, mock_client_cert_source, default_universe, "always") == ConfidentialComputingClient.DEFAULT_MTLS_ENDPOINT - assert ConfidentialComputingClient._get_api_endpoint(None, None, mock_universe, "never") == mock_endpoint - assert ConfidentialComputingClient._get_api_endpoint(None, None, default_universe, "never") == default_endpoint - - with pytest.raises(MutualTLSChannelError) as excinfo: - ConfidentialComputingClient._get_api_endpoint(None, mock_client_cert_source, mock_universe, "auto") - assert str(excinfo.value) == "mTLS is not supported in any universe other than googleapis.com." - - -def test__get_universe_domain(): - client_universe_domain = "foo.com" - universe_domain_env = "bar.com" - - assert ConfidentialComputingClient._get_universe_domain(client_universe_domain, universe_domain_env) == client_universe_domain - assert ConfidentialComputingClient._get_universe_domain(None, universe_domain_env) == universe_domain_env - assert ConfidentialComputingClient._get_universe_domain(None, None) == ConfidentialComputingClient._DEFAULT_UNIVERSE - - with pytest.raises(ValueError) as excinfo: - ConfidentialComputingClient._get_universe_domain("", None) - assert str(excinfo.value) == "Universe Domain cannot be an empty string." - -@pytest.mark.parametrize("error_code,cred_info_json,show_cred_info", [ - (401, CRED_INFO_JSON, True), - (403, CRED_INFO_JSON, True), - (404, CRED_INFO_JSON, True), - (500, CRED_INFO_JSON, False), - (401, None, False), - (403, None, False), - (404, None, False), - (500, None, False) -]) -def test__add_cred_info_for_auth_errors(error_code, cred_info_json, show_cred_info): - cred = mock.Mock(["get_cred_info"]) - cred.get_cred_info = mock.Mock(return_value=cred_info_json) - client = ConfidentialComputingClient(credentials=cred) - client._transport._credentials = cred - - error = core_exceptions.GoogleAPICallError("message", details=["foo"]) - error.code = error_code - - client._add_cred_info_for_auth_errors(error) - if show_cred_info: - assert error.details == ["foo", CRED_INFO_STRING] - else: - assert error.details == ["foo"] - -@pytest.mark.parametrize("error_code", [401,403,404,500]) -def test__add_cred_info_for_auth_errors_no_get_cred_info(error_code): - cred = mock.Mock([]) - assert not hasattr(cred, "get_cred_info") - client = ConfidentialComputingClient(credentials=cred) - client._transport._credentials = cred - - error = core_exceptions.GoogleAPICallError("message", details=[]) - error.code = error_code - - client._add_cred_info_for_auth_errors(error) - assert error.details == [] - -@pytest.mark.parametrize("client_class,transport_name", [ - (ConfidentialComputingClient, "grpc"), - (ConfidentialComputingAsyncClient, "grpc_asyncio"), - (ConfidentialComputingClient, "rest"), -]) -def test_confidential_computing_client_from_service_account_info(client_class, transport_name): - creds = ga_credentials.AnonymousCredentials() - with mock.patch.object(service_account.Credentials, 'from_service_account_info') as factory: - factory.return_value = creds - info = {"valid": True} - client = client_class.from_service_account_info(info, transport=transport_name) - assert client.transport._credentials == creds - assert isinstance(client, client_class) - - assert client.transport._host == ( - 'confidentialcomputing.googleapis.com:443' - if transport_name in ['grpc', 'grpc_asyncio'] - else - 'https://confidentialcomputing.googleapis.com' - ) - - -@pytest.mark.parametrize("transport_class,transport_name", [ - (transports.ConfidentialComputingGrpcTransport, "grpc"), - (transports.ConfidentialComputingGrpcAsyncIOTransport, "grpc_asyncio"), - (transports.ConfidentialComputingRestTransport, "rest"), -]) -def test_confidential_computing_client_service_account_always_use_jwt(transport_class, transport_name): - with mock.patch.object(service_account.Credentials, 'with_always_use_jwt_access', create=True) as use_jwt: - creds = service_account.Credentials(None, None, None) - transport = transport_class(credentials=creds, always_use_jwt_access=True) - use_jwt.assert_called_once_with(True) - - with mock.patch.object(service_account.Credentials, 'with_always_use_jwt_access', create=True) as use_jwt: - creds = service_account.Credentials(None, None, None) - transport = transport_class(credentials=creds, always_use_jwt_access=False) - use_jwt.assert_not_called() - - -@pytest.mark.parametrize("client_class,transport_name", [ - (ConfidentialComputingClient, "grpc"), - (ConfidentialComputingAsyncClient, "grpc_asyncio"), - (ConfidentialComputingClient, "rest"), -]) -def test_confidential_computing_client_from_service_account_file(client_class, transport_name): - creds = ga_credentials.AnonymousCredentials() - with mock.patch.object(service_account.Credentials, 'from_service_account_file') as factory: - factory.return_value = creds - client = client_class.from_service_account_file("dummy/file/path.json", transport=transport_name) - assert client.transport._credentials == creds - assert isinstance(client, client_class) - - client = client_class.from_service_account_json("dummy/file/path.json", transport=transport_name) - assert client.transport._credentials == creds - assert isinstance(client, client_class) - - assert client.transport._host == ( - 'confidentialcomputing.googleapis.com:443' - if transport_name in ['grpc', 'grpc_asyncio'] - else - 'https://confidentialcomputing.googleapis.com' - ) - - -def test_confidential_computing_client_get_transport_class(): - transport = ConfidentialComputingClient.get_transport_class() - available_transports = [ - transports.ConfidentialComputingGrpcTransport, - transports.ConfidentialComputingRestTransport, - ] - assert transport in available_transports - - transport = ConfidentialComputingClient.get_transport_class("grpc") - assert transport == transports.ConfidentialComputingGrpcTransport - - -@pytest.mark.parametrize("client_class,transport_class,transport_name", [ - (ConfidentialComputingClient, transports.ConfidentialComputingGrpcTransport, "grpc"), - (ConfidentialComputingAsyncClient, transports.ConfidentialComputingGrpcAsyncIOTransport, "grpc_asyncio"), - (ConfidentialComputingClient, transports.ConfidentialComputingRestTransport, "rest"), -]) -@mock.patch.object(ConfidentialComputingClient, "_DEFAULT_ENDPOINT_TEMPLATE", modify_default_endpoint_template(ConfidentialComputingClient)) -@mock.patch.object(ConfidentialComputingAsyncClient, "_DEFAULT_ENDPOINT_TEMPLATE", modify_default_endpoint_template(ConfidentialComputingAsyncClient)) -def test_confidential_computing_client_client_options(client_class, transport_class, transport_name): - # Check that if channel is provided we won't create a new one. - with mock.patch.object(ConfidentialComputingClient, 'get_transport_class') as gtc: - transport = transport_class( - credentials=ga_credentials.AnonymousCredentials() - ) - client = client_class(transport=transport) - gtc.assert_not_called() - - # Check that if channel is provided via str we will create a new one. - with mock.patch.object(ConfidentialComputingClient, 'get_transport_class') as gtc: - client = client_class(transport=transport_name) - gtc.assert_called() - - # Check the case api_endpoint is provided. - options = client_options.ClientOptions(api_endpoint="squid.clam.whelk") - with mock.patch.object(transport_class, '__init__') as patched: - patched.return_value = None - client = client_class(transport=transport_name, client_options=options) - patched.assert_called_once_with( - credentials=None, - credentials_file=None, - host="squid.clam.whelk", - scopes=None, - client_cert_source_for_mtls=None, - quota_project_id=None, - client_info=transports.base.DEFAULT_CLIENT_INFO, - always_use_jwt_access=True, - api_audience=None, - ) - - # Check the case api_endpoint is not provided and GOOGLE_API_USE_MTLS_ENDPOINT is - # "never". - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "never"}): - with mock.patch.object(transport_class, '__init__') as patched: - patched.return_value = None - client = client_class(transport=transport_name) - patched.assert_called_once_with( - credentials=None, - credentials_file=None, - host=client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE), - scopes=None, - client_cert_source_for_mtls=None, - quota_project_id=None, - client_info=transports.base.DEFAULT_CLIENT_INFO, - always_use_jwt_access=True, - api_audience=None, - ) - - # Check the case api_endpoint is not provided and GOOGLE_API_USE_MTLS_ENDPOINT is - # "always". - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "always"}): - with mock.patch.object(transport_class, '__init__') as patched: - patched.return_value = None - client = client_class(transport=transport_name) - patched.assert_called_once_with( - credentials=None, - credentials_file=None, - host=client.DEFAULT_MTLS_ENDPOINT, - scopes=None, - client_cert_source_for_mtls=None, - quota_project_id=None, - client_info=transports.base.DEFAULT_CLIENT_INFO, - always_use_jwt_access=True, - api_audience=None, - ) - - # Check the case api_endpoint is not provided and GOOGLE_API_USE_MTLS_ENDPOINT has - # unsupported value. - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "Unsupported"}): - with pytest.raises(MutualTLSChannelError) as excinfo: - client = client_class(transport=transport_name) - assert str(excinfo.value) == "Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`" - - # Check the case GOOGLE_API_USE_CLIENT_CERTIFICATE has unsupported value. - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "Unsupported"}): - with pytest.raises(ValueError) as excinfo: - client = client_class(transport=transport_name) - assert str(excinfo.value) == "Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`" - - # Check the case quota_project_id is provided - options = client_options.ClientOptions(quota_project_id="octopus") - with mock.patch.object(transport_class, '__init__') as patched: - patched.return_value = None - client = client_class(client_options=options, transport=transport_name) - patched.assert_called_once_with( - credentials=None, - credentials_file=None, - host=client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE), - scopes=None, - client_cert_source_for_mtls=None, - quota_project_id="octopus", - client_info=transports.base.DEFAULT_CLIENT_INFO, - always_use_jwt_access=True, - api_audience=None, - ) - # Check the case api_endpoint is provided - options = client_options.ClientOptions(api_audience="https://language.googleapis.com") - with mock.patch.object(transport_class, '__init__') as patched: - patched.return_value = None - client = client_class(client_options=options, transport=transport_name) - patched.assert_called_once_with( - credentials=None, - credentials_file=None, - host=client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE), - scopes=None, - client_cert_source_for_mtls=None, - quota_project_id=None, - client_info=transports.base.DEFAULT_CLIENT_INFO, - always_use_jwt_access=True, - api_audience="https://language.googleapis.com" - ) - -@pytest.mark.parametrize("client_class,transport_class,transport_name,use_client_cert_env", [ - (ConfidentialComputingClient, transports.ConfidentialComputingGrpcTransport, "grpc", "true"), - (ConfidentialComputingAsyncClient, transports.ConfidentialComputingGrpcAsyncIOTransport, "grpc_asyncio", "true"), - (ConfidentialComputingClient, transports.ConfidentialComputingGrpcTransport, "grpc", "false"), - (ConfidentialComputingAsyncClient, transports.ConfidentialComputingGrpcAsyncIOTransport, "grpc_asyncio", "false"), - (ConfidentialComputingClient, transports.ConfidentialComputingRestTransport, "rest", "true"), - (ConfidentialComputingClient, transports.ConfidentialComputingRestTransport, "rest", "false"), -]) -@mock.patch.object(ConfidentialComputingClient, "_DEFAULT_ENDPOINT_TEMPLATE", modify_default_endpoint_template(ConfidentialComputingClient)) -@mock.patch.object(ConfidentialComputingAsyncClient, "_DEFAULT_ENDPOINT_TEMPLATE", modify_default_endpoint_template(ConfidentialComputingAsyncClient)) -@mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "auto"}) -def test_confidential_computing_client_mtls_env_auto(client_class, transport_class, transport_name, use_client_cert_env): - # This tests the endpoint autoswitch behavior. Endpoint is autoswitched to the default - # mtls endpoint, if GOOGLE_API_USE_CLIENT_CERTIFICATE is "true" and client cert exists. - - # Check the case client_cert_source is provided. Whether client cert is used depends on - # GOOGLE_API_USE_CLIENT_CERTIFICATE value. - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": use_client_cert_env}): - options = client_options.ClientOptions(client_cert_source=client_cert_source_callback) - with mock.patch.object(transport_class, '__init__') as patched: - patched.return_value = None - client = client_class(client_options=options, transport=transport_name) - - if use_client_cert_env == "false": - expected_client_cert_source = None - expected_host = client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE) - else: - expected_client_cert_source = client_cert_source_callback - expected_host = client.DEFAULT_MTLS_ENDPOINT - - patched.assert_called_once_with( - credentials=None, - credentials_file=None, - host=expected_host, - scopes=None, - client_cert_source_for_mtls=expected_client_cert_source, - quota_project_id=None, - client_info=transports.base.DEFAULT_CLIENT_INFO, - always_use_jwt_access=True, - api_audience=None, - ) - - # Check the case ADC client cert is provided. Whether client cert is used depends on - # GOOGLE_API_USE_CLIENT_CERTIFICATE value. - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": use_client_cert_env}): - with mock.patch.object(transport_class, '__init__') as patched: - with mock.patch('google.auth.transport.mtls.has_default_client_cert_source', return_value=True): - with mock.patch('google.auth.transport.mtls.default_client_cert_source', return_value=client_cert_source_callback): - if use_client_cert_env == "false": - expected_host = client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE) - expected_client_cert_source = None - else: - expected_host = client.DEFAULT_MTLS_ENDPOINT - expected_client_cert_source = client_cert_source_callback - - patched.return_value = None - client = client_class(transport=transport_name) - patched.assert_called_once_with( - credentials=None, - credentials_file=None, - host=expected_host, - scopes=None, - client_cert_source_for_mtls=expected_client_cert_source, - quota_project_id=None, - client_info=transports.base.DEFAULT_CLIENT_INFO, - always_use_jwt_access=True, - api_audience=None, - ) - - # Check the case client_cert_source and ADC client cert are not provided. - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": use_client_cert_env}): - with mock.patch.object(transport_class, '__init__') as patched: - with mock.patch("google.auth.transport.mtls.has_default_client_cert_source", return_value=False): - patched.return_value = None - client = client_class(transport=transport_name) - patched.assert_called_once_with( - credentials=None, - credentials_file=None, - host=client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE), - scopes=None, - client_cert_source_for_mtls=None, - quota_project_id=None, - client_info=transports.base.DEFAULT_CLIENT_INFO, - always_use_jwt_access=True, - api_audience=None, - ) - - -@pytest.mark.parametrize("client_class", [ - ConfidentialComputingClient, ConfidentialComputingAsyncClient -]) -@mock.patch.object(ConfidentialComputingClient, "DEFAULT_ENDPOINT", modify_default_endpoint(ConfidentialComputingClient)) -@mock.patch.object(ConfidentialComputingAsyncClient, "DEFAULT_ENDPOINT", modify_default_endpoint(ConfidentialComputingAsyncClient)) -def test_confidential_computing_client_get_mtls_endpoint_and_cert_source(client_class): - mock_client_cert_source = mock.Mock() - - # Test the case GOOGLE_API_USE_CLIENT_CERTIFICATE is "true". - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "true"}): - mock_api_endpoint = "foo" - options = client_options.ClientOptions(client_cert_source=mock_client_cert_source, api_endpoint=mock_api_endpoint) - api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source(options) - assert api_endpoint == mock_api_endpoint - assert cert_source == mock_client_cert_source - - # Test the case GOOGLE_API_USE_CLIENT_CERTIFICATE is "false". - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "false"}): - mock_client_cert_source = mock.Mock() - mock_api_endpoint = "foo" - options = client_options.ClientOptions(client_cert_source=mock_client_cert_source, api_endpoint=mock_api_endpoint) - api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source(options) - assert api_endpoint == mock_api_endpoint - assert cert_source is None - - # Test the case GOOGLE_API_USE_MTLS_ENDPOINT is "never". - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "never"}): - api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source() - assert api_endpoint == client_class.DEFAULT_ENDPOINT - assert cert_source is None - - # Test the case GOOGLE_API_USE_MTLS_ENDPOINT is "always". - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "always"}): - api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source() - assert api_endpoint == client_class.DEFAULT_MTLS_ENDPOINT - assert cert_source is None - - # Test the case GOOGLE_API_USE_MTLS_ENDPOINT is "auto" and default cert doesn't exist. - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "true"}): - with mock.patch('google.auth.transport.mtls.has_default_client_cert_source', return_value=False): - api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source() - assert api_endpoint == client_class.DEFAULT_ENDPOINT - assert cert_source is None - - # Test the case GOOGLE_API_USE_MTLS_ENDPOINT is "auto" and default cert exists. - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "true"}): - with mock.patch('google.auth.transport.mtls.has_default_client_cert_source', return_value=True): - with mock.patch('google.auth.transport.mtls.default_client_cert_source', return_value=mock_client_cert_source): - api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source() - assert api_endpoint == client_class.DEFAULT_MTLS_ENDPOINT - assert cert_source == mock_client_cert_source - - # Check the case api_endpoint is not provided and GOOGLE_API_USE_MTLS_ENDPOINT has - # unsupported value. - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "Unsupported"}): - with pytest.raises(MutualTLSChannelError) as excinfo: - client_class.get_mtls_endpoint_and_cert_source() - - assert str(excinfo.value) == "Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`" - - # Check the case GOOGLE_API_USE_CLIENT_CERTIFICATE has unsupported value. - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "Unsupported"}): - with pytest.raises(ValueError) as excinfo: - client_class.get_mtls_endpoint_and_cert_source() - - assert str(excinfo.value) == "Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`" - -@pytest.mark.parametrize("client_class", [ - ConfidentialComputingClient, ConfidentialComputingAsyncClient -]) -@mock.patch.object(ConfidentialComputingClient, "_DEFAULT_ENDPOINT_TEMPLATE", modify_default_endpoint_template(ConfidentialComputingClient)) -@mock.patch.object(ConfidentialComputingAsyncClient, "_DEFAULT_ENDPOINT_TEMPLATE", modify_default_endpoint_template(ConfidentialComputingAsyncClient)) -def test_confidential_computing_client_client_api_endpoint(client_class): - mock_client_cert_source = client_cert_source_callback - api_override = "foo.com" - default_universe = ConfidentialComputingClient._DEFAULT_UNIVERSE - default_endpoint = ConfidentialComputingClient._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=default_universe) - mock_universe = "bar.com" - mock_endpoint = ConfidentialComputingClient._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=mock_universe) - - # If ClientOptions.api_endpoint is set and GOOGLE_API_USE_CLIENT_CERTIFICATE="true", - # use ClientOptions.api_endpoint as the api endpoint regardless. - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "true"}): - with mock.patch("google.auth.transport.requests.AuthorizedSession.configure_mtls_channel"): - options = client_options.ClientOptions(client_cert_source=mock_client_cert_source, api_endpoint=api_override) - client = client_class(client_options=options, credentials=ga_credentials.AnonymousCredentials()) - assert client.api_endpoint == api_override - - # If ClientOptions.api_endpoint is not set and GOOGLE_API_USE_MTLS_ENDPOINT="never", - # use the _DEFAULT_ENDPOINT_TEMPLATE populated with GDU as the api endpoint. - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "never"}): - client = client_class(credentials=ga_credentials.AnonymousCredentials()) - assert client.api_endpoint == default_endpoint - - # If ClientOptions.api_endpoint is not set and GOOGLE_API_USE_MTLS_ENDPOINT="always", - # use the DEFAULT_MTLS_ENDPOINT as the api endpoint. - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "always"}): - client = client_class(credentials=ga_credentials.AnonymousCredentials()) - assert client.api_endpoint == client_class.DEFAULT_MTLS_ENDPOINT - - # If ClientOptions.api_endpoint is not set, GOOGLE_API_USE_MTLS_ENDPOINT="auto" (default), - # GOOGLE_API_USE_CLIENT_CERTIFICATE="false" (default), default cert source doesn't exist, - # and ClientOptions.universe_domain="bar.com", - # use the _DEFAULT_ENDPOINT_TEMPLATE populated with universe domain as the api endpoint. - options = client_options.ClientOptions() - universe_exists = hasattr(options, "universe_domain") - if universe_exists: - options = client_options.ClientOptions(universe_domain=mock_universe) - client = client_class(client_options=options, credentials=ga_credentials.AnonymousCredentials()) - else: - client = client_class(client_options=options, credentials=ga_credentials.AnonymousCredentials()) - assert client.api_endpoint == (mock_endpoint if universe_exists else default_endpoint) - assert client.universe_domain == (mock_universe if universe_exists else default_universe) - - # If ClientOptions does not have a universe domain attribute and GOOGLE_API_USE_MTLS_ENDPOINT="never", - # use the _DEFAULT_ENDPOINT_TEMPLATE populated with GDU as the api endpoint. - options = client_options.ClientOptions() - if hasattr(options, "universe_domain"): - delattr(options, "universe_domain") - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "never"}): - client = client_class(client_options=options, credentials=ga_credentials.AnonymousCredentials()) - assert client.api_endpoint == default_endpoint - - -@pytest.mark.parametrize("client_class,transport_class,transport_name", [ - (ConfidentialComputingClient, transports.ConfidentialComputingGrpcTransport, "grpc"), - (ConfidentialComputingAsyncClient, transports.ConfidentialComputingGrpcAsyncIOTransport, "grpc_asyncio"), - (ConfidentialComputingClient, transports.ConfidentialComputingRestTransport, "rest"), -]) -def test_confidential_computing_client_client_options_scopes(client_class, transport_class, transport_name): - # Check the case scopes are provided. - options = client_options.ClientOptions( - scopes=["1", "2"], - ) - with mock.patch.object(transport_class, '__init__') as patched: - patched.return_value = None - client = client_class(client_options=options, transport=transport_name) - patched.assert_called_once_with( - credentials=None, - credentials_file=None, - host=client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE), - scopes=["1", "2"], - client_cert_source_for_mtls=None, - quota_project_id=None, - client_info=transports.base.DEFAULT_CLIENT_INFO, - always_use_jwt_access=True, - api_audience=None, - ) - -@pytest.mark.parametrize("client_class,transport_class,transport_name,grpc_helpers", [ - (ConfidentialComputingClient, transports.ConfidentialComputingGrpcTransport, "grpc", grpc_helpers), - (ConfidentialComputingAsyncClient, transports.ConfidentialComputingGrpcAsyncIOTransport, "grpc_asyncio", grpc_helpers_async), - (ConfidentialComputingClient, transports.ConfidentialComputingRestTransport, "rest", None), -]) -def test_confidential_computing_client_client_options_credentials_file(client_class, transport_class, transport_name, grpc_helpers): - # Check the case credentials file is provided. - options = client_options.ClientOptions( - credentials_file="credentials.json" - ) - - with mock.patch.object(transport_class, '__init__') as patched: - patched.return_value = None - client = client_class(client_options=options, transport=transport_name) - patched.assert_called_once_with( - credentials=None, - credentials_file="credentials.json", - host=client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE), - scopes=None, - client_cert_source_for_mtls=None, - quota_project_id=None, - client_info=transports.base.DEFAULT_CLIENT_INFO, - always_use_jwt_access=True, - api_audience=None, - ) - -def test_confidential_computing_client_client_options_from_dict(): - with mock.patch('google.cloud.confidentialcomputing_v1.services.confidential_computing.transports.ConfidentialComputingGrpcTransport.__init__') as grpc_transport: - grpc_transport.return_value = None - client = ConfidentialComputingClient( - client_options={'api_endpoint': 'squid.clam.whelk'} - ) - grpc_transport.assert_called_once_with( - credentials=None, - credentials_file=None, - host="squid.clam.whelk", - scopes=None, - client_cert_source_for_mtls=None, - quota_project_id=None, - client_info=transports.base.DEFAULT_CLIENT_INFO, - always_use_jwt_access=True, - api_audience=None, - ) - - -@pytest.mark.parametrize("client_class,transport_class,transport_name,grpc_helpers", [ - (ConfidentialComputingClient, transports.ConfidentialComputingGrpcTransport, "grpc", grpc_helpers), - (ConfidentialComputingAsyncClient, transports.ConfidentialComputingGrpcAsyncIOTransport, "grpc_asyncio", grpc_helpers_async), -]) -def test_confidential_computing_client_create_channel_credentials_file(client_class, transport_class, transport_name, grpc_helpers): - # Check the case credentials file is provided. - options = client_options.ClientOptions( - credentials_file="credentials.json" - ) - - with mock.patch.object(transport_class, '__init__') as patched: - patched.return_value = None - client = client_class(client_options=options, transport=transport_name) - patched.assert_called_once_with( - credentials=None, - credentials_file="credentials.json", - host=client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE), - scopes=None, - client_cert_source_for_mtls=None, - quota_project_id=None, - client_info=transports.base.DEFAULT_CLIENT_INFO, - always_use_jwt_access=True, - api_audience=None, - ) - - # test that the credentials from file are saved and used as the credentials. - with mock.patch.object( - google.auth, "load_credentials_from_file", autospec=True - ) as load_creds, mock.patch.object( - google.auth, "default", autospec=True - ) as adc, mock.patch.object( - grpc_helpers, "create_channel" - ) as create_channel: - creds = ga_credentials.AnonymousCredentials() - file_creds = ga_credentials.AnonymousCredentials() - load_creds.return_value = (file_creds, None) - adc.return_value = (creds, None) - client = client_class(client_options=options, transport=transport_name) - create_channel.assert_called_with( - "confidentialcomputing.googleapis.com:443", - credentials=file_creds, - credentials_file=None, - quota_project_id=None, - default_scopes=( - 'https://www.googleapis.com/auth/cloud-platform', -), - scopes=None, - default_host="confidentialcomputing.googleapis.com", - ssl_credentials=None, - options=[ - ("grpc.max_send_message_length", -1), - ("grpc.max_receive_message_length", -1), - ], - ) - - -@pytest.mark.parametrize("request_type", [ - service.CreateChallengeRequest, - dict, -]) -def test_create_challenge(request_type, transport: str = 'grpc'): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport=transport, - ) - - # Everything is optional in proto3 as far as the runtime is concerned, - # and we are mocking out the actual API, so just send an empty request. - request = request_type() - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.create_challenge), - '__call__') as call: - # Designate an appropriate return value for the call. - call.return_value = service.Challenge( - name='name_value', - used=True, - tpm_nonce='tpm_nonce_value', - ) - response = client.create_challenge(request) - - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - request = service.CreateChallengeRequest() - assert args[0] == request - - # Establish that the response is the type that we expect. - assert isinstance(response, service.Challenge) - assert response.name == 'name_value' - assert response.used is True - assert response.tpm_nonce == 'tpm_nonce_value' - - -def test_create_challenge_non_empty_request_with_auto_populated_field(): - # This test is a coverage failsafe to make sure that UUID4 fields are - # automatically populated, according to AIP-4235, with non-empty requests. - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport='grpc', - ) - - # Populate all string fields in the request which are not UUID4 - # since we want to check that UUID4 are populated automatically - # if they meet the requirements of AIP 4235. - request = service.CreateChallengeRequest( - parent='parent_value', - ) - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.create_challenge), - '__call__') as call: - call.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. - client.create_challenge(request=request) - call.assert_called() - _, args, _ = call.mock_calls[0] - assert args[0] == service.CreateChallengeRequest( - parent='parent_value', - ) - -def test_create_challenge_use_cached_wrapped_rpc(): - # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, - # instead of constructing them on each call - with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="grpc", - ) - - # Should wrap all calls on client creation - assert wrapper_fn.call_count > 0 - wrapper_fn.reset_mock() - - # Ensure method has been cached - assert client._transport.create_challenge in client._transport._wrapped_methods - - # Replace cached wrapped function with mock - mock_rpc = mock.Mock() - mock_rpc.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. - client._transport._wrapped_methods[client._transport.create_challenge] = mock_rpc - request = {} - client.create_challenge(request) - - # Establish that the underlying gRPC stub method was called. - assert mock_rpc.call_count == 1 - - client.create_challenge(request) - - # Establish that a new wrapper was not created for this call - assert wrapper_fn.call_count == 0 - assert mock_rpc.call_count == 2 - -@pytest.mark.asyncio -async def test_create_challenge_async_use_cached_wrapped_rpc(transport: str = "grpc_asyncio"): - # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, - # instead of constructing them on each call - with mock.patch("google.api_core.gapic_v1.method_async.wrap_method") as wrapper_fn: - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - transport=transport, - ) - - # Should wrap all calls on client creation - assert wrapper_fn.call_count > 0 - wrapper_fn.reset_mock() - - # Ensure method has been cached - assert client._client._transport.create_challenge in client._client._transport._wrapped_methods - - # Replace cached wrapped function with mock - mock_rpc = mock.AsyncMock() - mock_rpc.return_value = mock.Mock() - client._client._transport._wrapped_methods[client._client._transport.create_challenge] = mock_rpc - - request = {} - await client.create_challenge(request) - - # Establish that the underlying gRPC stub method was called. - assert mock_rpc.call_count == 1 - - await client.create_challenge(request) - - # Establish that a new wrapper was not created for this call - assert wrapper_fn.call_count == 0 - assert mock_rpc.call_count == 2 - -@pytest.mark.asyncio -async def test_create_challenge_async(transport: str = 'grpc_asyncio', request_type=service.CreateChallengeRequest): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - transport=transport, - ) - - # Everything is optional in proto3 as far as the runtime is concerned, - # and we are mocking out the actual API, so just send an empty request. - request = request_type() - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.create_challenge), - '__call__') as call: - # Designate an appropriate return value for the call. - call.return_value =grpc_helpers_async.FakeUnaryUnaryCall(service.Challenge( - name='name_value', - used=True, - tpm_nonce='tpm_nonce_value', - )) - response = await client.create_challenge(request) - - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) - _, args, _ = call.mock_calls[0] - request = service.CreateChallengeRequest() - assert args[0] == request - - # Establish that the response is the type that we expect. - assert isinstance(response, service.Challenge) - assert response.name == 'name_value' - assert response.used is True - assert response.tpm_nonce == 'tpm_nonce_value' - - -@pytest.mark.asyncio -async def test_create_challenge_async_from_dict(): - await test_create_challenge_async(request_type=dict) - -def test_create_challenge_field_headers(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - ) - - # Any value that is part of the HTTP/1.1 URI should be sent as - # a field header. Set these to a non-empty value. - request = service.CreateChallengeRequest() - - request.parent = 'parent_value' - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.create_challenge), - '__call__') as call: - call.return_value = service.Challenge() - client.create_challenge(request) - - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - assert args[0] == request - - # Establish that the field header was sent. - _, _, kw = call.mock_calls[0] - assert ( - 'x-goog-request-params', - 'parent=parent_value', - ) in kw['metadata'] - - -@pytest.mark.asyncio -async def test_create_challenge_field_headers_async(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - ) - - # Any value that is part of the HTTP/1.1 URI should be sent as - # a field header. Set these to a non-empty value. - request = service.CreateChallengeRequest() - - request.parent = 'parent_value' - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.create_challenge), - '__call__') as call: - call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.Challenge()) - await client.create_challenge(request) - - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) - _, args, _ = call.mock_calls[0] - assert args[0] == request - - # Establish that the field header was sent. - _, _, kw = call.mock_calls[0] - assert ( - 'x-goog-request-params', - 'parent=parent_value', - ) in kw['metadata'] - - -def test_create_challenge_flattened(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - ) - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.create_challenge), - '__call__') as call: - # Designate an appropriate return value for the call. - call.return_value = service.Challenge() - # Call the method with a truthy value for each flattened field, - # using the keyword arguments to the method. - client.create_challenge( - parent='parent_value', - challenge=service.Challenge(name='name_value'), - ) - - # Establish that the underlying call was made with the expected - # request object values. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - arg = args[0].parent - mock_val = 'parent_value' - assert arg == mock_val - arg = args[0].challenge - mock_val = service.Challenge(name='name_value') - assert arg == mock_val - - -def test_create_challenge_flattened_error(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - ) - - # Attempting to call a method with both a request object and flattened - # fields is an error. - with pytest.raises(ValueError): - client.create_challenge( - service.CreateChallengeRequest(), - parent='parent_value', - challenge=service.Challenge(name='name_value'), - ) - -@pytest.mark.asyncio -async def test_create_challenge_flattened_async(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - ) - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.create_challenge), - '__call__') as call: - # Designate an appropriate return value for the call. - call.return_value = service.Challenge() - - call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.Challenge()) - # Call the method with a truthy value for each flattened field, - # using the keyword arguments to the method. - response = await client.create_challenge( - parent='parent_value', - challenge=service.Challenge(name='name_value'), - ) - - # Establish that the underlying call was made with the expected - # request object values. - assert len(call.mock_calls) - _, args, _ = call.mock_calls[0] - arg = args[0].parent - mock_val = 'parent_value' - assert arg == mock_val - arg = args[0].challenge - mock_val = service.Challenge(name='name_value') - assert arg == mock_val - -@pytest.mark.asyncio -async def test_create_challenge_flattened_error_async(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - ) - - # Attempting to call a method with both a request object and flattened - # fields is an error. - with pytest.raises(ValueError): - await client.create_challenge( - service.CreateChallengeRequest(), - parent='parent_value', - challenge=service.Challenge(name='name_value'), - ) - - -@pytest.mark.parametrize("request_type", [ - service.VerifyAttestationRequest, - dict, -]) -def test_verify_attestation(request_type, transport: str = 'grpc'): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport=transport, - ) - - # Everything is optional in proto3 as far as the runtime is concerned, - # and we are mocking out the actual API, so just send an empty request. - request = request_type() - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.verify_attestation), - '__call__') as call: - # Designate an appropriate return value for the call. - call.return_value = service.VerifyAttestationResponse( - oidc_claims_token='oidc_claims_token_value', - ) - response = client.verify_attestation(request) - - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - request = service.VerifyAttestationRequest() - assert args[0] == request - - # Establish that the response is the type that we expect. - assert isinstance(response, service.VerifyAttestationResponse) - assert response.oidc_claims_token == 'oidc_claims_token_value' - - -def test_verify_attestation_non_empty_request_with_auto_populated_field(): - # This test is a coverage failsafe to make sure that UUID4 fields are - # automatically populated, according to AIP-4235, with non-empty requests. - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport='grpc', - ) - - # Populate all string fields in the request which are not UUID4 - # since we want to check that UUID4 are populated automatically - # if they meet the requirements of AIP 4235. - request = service.VerifyAttestationRequest( - challenge='challenge_value', - attester='attester_value', - ) - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.verify_attestation), - '__call__') as call: - call.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. - client.verify_attestation(request=request) - call.assert_called() - _, args, _ = call.mock_calls[0] - assert args[0] == service.VerifyAttestationRequest( - challenge='challenge_value', - attester='attester_value', - ) - -def test_verify_attestation_use_cached_wrapped_rpc(): - # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, - # instead of constructing them on each call - with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="grpc", - ) - - # Should wrap all calls on client creation - assert wrapper_fn.call_count > 0 - wrapper_fn.reset_mock() - - # Ensure method has been cached - assert client._transport.verify_attestation in client._transport._wrapped_methods - - # Replace cached wrapped function with mock - mock_rpc = mock.Mock() - mock_rpc.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. - client._transport._wrapped_methods[client._transport.verify_attestation] = mock_rpc - request = {} - client.verify_attestation(request) - - # Establish that the underlying gRPC stub method was called. - assert mock_rpc.call_count == 1 - - client.verify_attestation(request) - - # Establish that a new wrapper was not created for this call - assert wrapper_fn.call_count == 0 - assert mock_rpc.call_count == 2 - -@pytest.mark.asyncio -async def test_verify_attestation_async_use_cached_wrapped_rpc(transport: str = "grpc_asyncio"): - # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, - # instead of constructing them on each call - with mock.patch("google.api_core.gapic_v1.method_async.wrap_method") as wrapper_fn: - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - transport=transport, - ) - - # Should wrap all calls on client creation - assert wrapper_fn.call_count > 0 - wrapper_fn.reset_mock() - - # Ensure method has been cached - assert client._client._transport.verify_attestation in client._client._transport._wrapped_methods - - # Replace cached wrapped function with mock - mock_rpc = mock.AsyncMock() - mock_rpc.return_value = mock.Mock() - client._client._transport._wrapped_methods[client._client._transport.verify_attestation] = mock_rpc - - request = {} - await client.verify_attestation(request) - - # Establish that the underlying gRPC stub method was called. - assert mock_rpc.call_count == 1 - - await client.verify_attestation(request) - - # Establish that a new wrapper was not created for this call - assert wrapper_fn.call_count == 0 - assert mock_rpc.call_count == 2 - -@pytest.mark.asyncio -async def test_verify_attestation_async(transport: str = 'grpc_asyncio', request_type=service.VerifyAttestationRequest): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - transport=transport, - ) - - # Everything is optional in proto3 as far as the runtime is concerned, - # and we are mocking out the actual API, so just send an empty request. - request = request_type() - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.verify_attestation), - '__call__') as call: - # Designate an appropriate return value for the call. - call.return_value =grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyAttestationResponse( - oidc_claims_token='oidc_claims_token_value', - )) - response = await client.verify_attestation(request) - - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) - _, args, _ = call.mock_calls[0] - request = service.VerifyAttestationRequest() - assert args[0] == request - - # Establish that the response is the type that we expect. - assert isinstance(response, service.VerifyAttestationResponse) - assert response.oidc_claims_token == 'oidc_claims_token_value' - - -@pytest.mark.asyncio -async def test_verify_attestation_async_from_dict(): - await test_verify_attestation_async(request_type=dict) - -def test_verify_attestation_field_headers(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - ) - - # Any value that is part of the HTTP/1.1 URI should be sent as - # a field header. Set these to a non-empty value. - request = service.VerifyAttestationRequest() - - request.challenge = 'challenge_value' - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.verify_attestation), - '__call__') as call: - call.return_value = service.VerifyAttestationResponse() - client.verify_attestation(request) - - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - assert args[0] == request - - # Establish that the field header was sent. - _, _, kw = call.mock_calls[0] - assert ( - 'x-goog-request-params', - 'challenge=challenge_value', - ) in kw['metadata'] - - -@pytest.mark.asyncio -async def test_verify_attestation_field_headers_async(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - ) - - # Any value that is part of the HTTP/1.1 URI should be sent as - # a field header. Set these to a non-empty value. - request = service.VerifyAttestationRequest() - - request.challenge = 'challenge_value' - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.verify_attestation), - '__call__') as call: - call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyAttestationResponse()) - await client.verify_attestation(request) - - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) - _, args, _ = call.mock_calls[0] - assert args[0] == request - - # Establish that the field header was sent. - _, _, kw = call.mock_calls[0] - assert ( - 'x-goog-request-params', - 'challenge=challenge_value', - ) in kw['metadata'] - - -@pytest.mark.parametrize("request_type", [ - service.VerifyConfidentialSpaceRequest, - dict, -]) -def test_verify_confidential_space(request_type, transport: str = 'grpc'): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport=transport, - ) - - # Everything is optional in proto3 as far as the runtime is concerned, - # and we are mocking out the actual API, so just send an empty request. - request = request_type() - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.verify_confidential_space), - '__call__') as call: - # Designate an appropriate return value for the call. - call.return_value = service.VerifyConfidentialSpaceResponse( - attestation_token='attestation_token_value', - ) - response = client.verify_confidential_space(request) - - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - request = service.VerifyConfidentialSpaceRequest() - assert args[0] == request - - # Establish that the response is the type that we expect. - assert isinstance(response, service.VerifyConfidentialSpaceResponse) - assert response.attestation_token == 'attestation_token_value' - - -def test_verify_confidential_space_non_empty_request_with_auto_populated_field(): - # This test is a coverage failsafe to make sure that UUID4 fields are - # automatically populated, according to AIP-4235, with non-empty requests. - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport='grpc', - ) - - # Populate all string fields in the request which are not UUID4 - # since we want to check that UUID4 are populated automatically - # if they meet the requirements of AIP 4235. - request = service.VerifyConfidentialSpaceRequest( - challenge='challenge_value', - ) - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.verify_confidential_space), - '__call__') as call: - call.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. - client.verify_confidential_space(request=request) - call.assert_called() - _, args, _ = call.mock_calls[0] - assert args[0] == service.VerifyConfidentialSpaceRequest( - challenge='challenge_value', - ) - -def test_verify_confidential_space_use_cached_wrapped_rpc(): - # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, - # instead of constructing them on each call - with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="grpc", - ) - - # Should wrap all calls on client creation - assert wrapper_fn.call_count > 0 - wrapper_fn.reset_mock() - - # Ensure method has been cached - assert client._transport.verify_confidential_space in client._transport._wrapped_methods - - # Replace cached wrapped function with mock - mock_rpc = mock.Mock() - mock_rpc.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. - client._transport._wrapped_methods[client._transport.verify_confidential_space] = mock_rpc - request = {} - client.verify_confidential_space(request) - - # Establish that the underlying gRPC stub method was called. - assert mock_rpc.call_count == 1 - - client.verify_confidential_space(request) - - # Establish that a new wrapper was not created for this call - assert wrapper_fn.call_count == 0 - assert mock_rpc.call_count == 2 - -@pytest.mark.asyncio -async def test_verify_confidential_space_async_use_cached_wrapped_rpc(transport: str = "grpc_asyncio"): - # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, - # instead of constructing them on each call - with mock.patch("google.api_core.gapic_v1.method_async.wrap_method") as wrapper_fn: - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - transport=transport, - ) - - # Should wrap all calls on client creation - assert wrapper_fn.call_count > 0 - wrapper_fn.reset_mock() - - # Ensure method has been cached - assert client._client._transport.verify_confidential_space in client._client._transport._wrapped_methods - - # Replace cached wrapped function with mock - mock_rpc = mock.AsyncMock() - mock_rpc.return_value = mock.Mock() - client._client._transport._wrapped_methods[client._client._transport.verify_confidential_space] = mock_rpc - - request = {} - await client.verify_confidential_space(request) - - # Establish that the underlying gRPC stub method was called. - assert mock_rpc.call_count == 1 - - await client.verify_confidential_space(request) - - # Establish that a new wrapper was not created for this call - assert wrapper_fn.call_count == 0 - assert mock_rpc.call_count == 2 - -@pytest.mark.asyncio -async def test_verify_confidential_space_async(transport: str = 'grpc_asyncio', request_type=service.VerifyConfidentialSpaceRequest): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - transport=transport, - ) - - # Everything is optional in proto3 as far as the runtime is concerned, - # and we are mocking out the actual API, so just send an empty request. - request = request_type() - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.verify_confidential_space), - '__call__') as call: - # Designate an appropriate return value for the call. - call.return_value =grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyConfidentialSpaceResponse( - attestation_token='attestation_token_value', - )) - response = await client.verify_confidential_space(request) - - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) - _, args, _ = call.mock_calls[0] - request = service.VerifyConfidentialSpaceRequest() - assert args[0] == request - - # Establish that the response is the type that we expect. - assert isinstance(response, service.VerifyConfidentialSpaceResponse) - assert response.attestation_token == 'attestation_token_value' - - -@pytest.mark.asyncio -async def test_verify_confidential_space_async_from_dict(): - await test_verify_confidential_space_async(request_type=dict) - -def test_verify_confidential_space_field_headers(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - ) - - # Any value that is part of the HTTP/1.1 URI should be sent as - # a field header. Set these to a non-empty value. - request = service.VerifyConfidentialSpaceRequest() - - request.challenge = 'challenge_value' - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.verify_confidential_space), - '__call__') as call: - call.return_value = service.VerifyConfidentialSpaceResponse() - client.verify_confidential_space(request) - - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - assert args[0] == request - - # Establish that the field header was sent. - _, _, kw = call.mock_calls[0] - assert ( - 'x-goog-request-params', - 'challenge=challenge_value', - ) in kw['metadata'] - - -@pytest.mark.asyncio -async def test_verify_confidential_space_field_headers_async(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - ) - - # Any value that is part of the HTTP/1.1 URI should be sent as - # a field header. Set these to a non-empty value. - request = service.VerifyConfidentialSpaceRequest() - - request.challenge = 'challenge_value' - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.verify_confidential_space), - '__call__') as call: - call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyConfidentialSpaceResponse()) - await client.verify_confidential_space(request) - - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) - _, args, _ = call.mock_calls[0] - assert args[0] == request - - # Establish that the field header was sent. - _, _, kw = call.mock_calls[0] - assert ( - 'x-goog-request-params', - 'challenge=challenge_value', - ) in kw['metadata'] - - -@pytest.mark.parametrize("request_type", [ - service.VerifyConfidentialGkeRequest, - dict, -]) -def test_verify_confidential_gke(request_type, transport: str = 'grpc'): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport=transport, - ) - - # Everything is optional in proto3 as far as the runtime is concerned, - # and we are mocking out the actual API, so just send an empty request. - request = request_type() - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.verify_confidential_gke), - '__call__') as call: - # Designate an appropriate return value for the call. - call.return_value = service.VerifyConfidentialGkeResponse( - attestation_token='attestation_token_value', - ) - response = client.verify_confidential_gke(request) - - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - request = service.VerifyConfidentialGkeRequest() - assert args[0] == request - - # Establish that the response is the type that we expect. - assert isinstance(response, service.VerifyConfidentialGkeResponse) - assert response.attestation_token == 'attestation_token_value' - - -def test_verify_confidential_gke_non_empty_request_with_auto_populated_field(): - # This test is a coverage failsafe to make sure that UUID4 fields are - # automatically populated, according to AIP-4235, with non-empty requests. - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport='grpc', - ) - - # Populate all string fields in the request which are not UUID4 - # since we want to check that UUID4 are populated automatically - # if they meet the requirements of AIP 4235. - request = service.VerifyConfidentialGkeRequest( - challenge='challenge_value', - ) - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.verify_confidential_gke), - '__call__') as call: - call.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. - client.verify_confidential_gke(request=request) - call.assert_called() - _, args, _ = call.mock_calls[0] - assert args[0] == service.VerifyConfidentialGkeRequest( - challenge='challenge_value', - ) - -def test_verify_confidential_gke_use_cached_wrapped_rpc(): - # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, - # instead of constructing them on each call - with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="grpc", - ) - - # Should wrap all calls on client creation - assert wrapper_fn.call_count > 0 - wrapper_fn.reset_mock() - - # Ensure method has been cached - assert client._transport.verify_confidential_gke in client._transport._wrapped_methods - - # Replace cached wrapped function with mock - mock_rpc = mock.Mock() - mock_rpc.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. - client._transport._wrapped_methods[client._transport.verify_confidential_gke] = mock_rpc - request = {} - client.verify_confidential_gke(request) - - # Establish that the underlying gRPC stub method was called. - assert mock_rpc.call_count == 1 - - client.verify_confidential_gke(request) - - # Establish that a new wrapper was not created for this call - assert wrapper_fn.call_count == 0 - assert mock_rpc.call_count == 2 - -@pytest.mark.asyncio -async def test_verify_confidential_gke_async_use_cached_wrapped_rpc(transport: str = "grpc_asyncio"): - # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, - # instead of constructing them on each call - with mock.patch("google.api_core.gapic_v1.method_async.wrap_method") as wrapper_fn: - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - transport=transport, - ) - - # Should wrap all calls on client creation - assert wrapper_fn.call_count > 0 - wrapper_fn.reset_mock() - - # Ensure method has been cached - assert client._client._transport.verify_confidential_gke in client._client._transport._wrapped_methods - - # Replace cached wrapped function with mock - mock_rpc = mock.AsyncMock() - mock_rpc.return_value = mock.Mock() - client._client._transport._wrapped_methods[client._client._transport.verify_confidential_gke] = mock_rpc - - request = {} - await client.verify_confidential_gke(request) - - # Establish that the underlying gRPC stub method was called. - assert mock_rpc.call_count == 1 - - await client.verify_confidential_gke(request) - - # Establish that a new wrapper was not created for this call - assert wrapper_fn.call_count == 0 - assert mock_rpc.call_count == 2 - -@pytest.mark.asyncio -async def test_verify_confidential_gke_async(transport: str = 'grpc_asyncio', request_type=service.VerifyConfidentialGkeRequest): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - transport=transport, - ) - - # Everything is optional in proto3 as far as the runtime is concerned, - # and we are mocking out the actual API, so just send an empty request. - request = request_type() - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.verify_confidential_gke), - '__call__') as call: - # Designate an appropriate return value for the call. - call.return_value =grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyConfidentialGkeResponse( - attestation_token='attestation_token_value', - )) - response = await client.verify_confidential_gke(request) - - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) - _, args, _ = call.mock_calls[0] - request = service.VerifyConfidentialGkeRequest() - assert args[0] == request - - # Establish that the response is the type that we expect. - assert isinstance(response, service.VerifyConfidentialGkeResponse) - assert response.attestation_token == 'attestation_token_value' - - -@pytest.mark.asyncio -async def test_verify_confidential_gke_async_from_dict(): - await test_verify_confidential_gke_async(request_type=dict) - -def test_verify_confidential_gke_field_headers(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - ) - - # Any value that is part of the HTTP/1.1 URI should be sent as - # a field header. Set these to a non-empty value. - request = service.VerifyConfidentialGkeRequest() - - request.challenge = 'challenge_value' - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.verify_confidential_gke), - '__call__') as call: - call.return_value = service.VerifyConfidentialGkeResponse() - client.verify_confidential_gke(request) - - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - assert args[0] == request - - # Establish that the field header was sent. - _, _, kw = call.mock_calls[0] - assert ( - 'x-goog-request-params', - 'challenge=challenge_value', - ) in kw['metadata'] - - -@pytest.mark.asyncio -async def test_verify_confidential_gke_field_headers_async(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - ) - - # Any value that is part of the HTTP/1.1 URI should be sent as - # a field header. Set these to a non-empty value. - request = service.VerifyConfidentialGkeRequest() - - request.challenge = 'challenge_value' - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.verify_confidential_gke), - '__call__') as call: - call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyConfidentialGkeResponse()) - await client.verify_confidential_gke(request) - - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) - _, args, _ = call.mock_calls[0] - assert args[0] == request - - # Establish that the field header was sent. - _, _, kw = call.mock_calls[0] - assert ( - 'x-goog-request-params', - 'challenge=challenge_value', - ) in kw['metadata'] - - -def test_create_challenge_rest_use_cached_wrapped_rpc(): - # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, - # instead of constructing them on each call - with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest", - ) - - # Should wrap all calls on client creation - assert wrapper_fn.call_count > 0 - wrapper_fn.reset_mock() - - # Ensure method has been cached - assert client._transport.create_challenge in client._transport._wrapped_methods - - # Replace cached wrapped function with mock - mock_rpc = mock.Mock() - mock_rpc.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. - client._transport._wrapped_methods[client._transport.create_challenge] = mock_rpc - - request = {} - client.create_challenge(request) - - # Establish that the underlying gRPC stub method was called. - assert mock_rpc.call_count == 1 - - client.create_challenge(request) - - # Establish that a new wrapper was not created for this call - assert wrapper_fn.call_count == 0 - assert mock_rpc.call_count == 2 - - -def test_create_challenge_rest_required_fields(request_type=service.CreateChallengeRequest): - transport_class = transports.ConfidentialComputingRestTransport - - request_init = {} - request_init["parent"] = "" - request = request_type(**request_init) - pb_request = request_type.pb(request) - jsonified_request = json.loads(json_format.MessageToJson( - pb_request, - use_integers_for_enums=False - )) - - # verify fields with default values are dropped - - unset_fields = transport_class(credentials=ga_credentials.AnonymousCredentials()).create_challenge._get_unset_required_fields(jsonified_request) - jsonified_request.update(unset_fields) - - # verify required fields with default values are now present - - jsonified_request["parent"] = 'parent_value' - - unset_fields = transport_class(credentials=ga_credentials.AnonymousCredentials()).create_challenge._get_unset_required_fields(jsonified_request) - jsonified_request.update(unset_fields) - - # verify required fields with non-default values are left alone - assert "parent" in jsonified_request - assert jsonified_request["parent"] == 'parent_value' - - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport='rest', - ) - request = request_type(**request_init) - - # Designate an appropriate value for the returned response. - return_value = service.Challenge() - # Mock the http request call within the method and fake a response. - with mock.patch.object(Session, 'request') as req: - # We need to mock transcode() because providing default values - # for required fields will fail the real version if the http_options - # expect actual values for those fields. - with mock.patch.object(path_template, 'transcode') as transcode: - # A uri without fields and an empty body will force all the - # request fields to show up in the query_params. - pb_request = request_type.pb(request) - transcode_result = { - 'uri': 'v1/sample_method', - 'method': "post", - 'query_params': pb_request, - } - transcode_result['body'] = pb_request - transcode.return_value = transcode_result - - response_value = Response() - response_value.status_code = 200 - - # Convert return value to protobuf type - return_value = service.Challenge.pb(return_value) - json_return_value = json_format.MessageToJson(return_value) - - response_value._content = json_return_value.encode('UTF-8') - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - - response = client.create_challenge(request) - - expected_params = [ - ('$alt', 'json;enum-encoding=int') - ] - actual_params = req.call_args.kwargs['params'] - assert expected_params == actual_params - - -def test_create_challenge_rest_unset_required_fields(): - transport = transports.ConfidentialComputingRestTransport(credentials=ga_credentials.AnonymousCredentials) - - unset_fields = transport.create_challenge._get_unset_required_fields({}) - assert set(unset_fields) == (set(()) & set(("parent", "challenge", ))) - - -def test_create_challenge_rest_flattened(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest", - ) - - # Mock the http request call within the method and fake a response. - with mock.patch.object(type(client.transport._session), 'request') as req: - # Designate an appropriate value for the returned response. - return_value = service.Challenge() - - # get arguments that satisfy an http rule for this method - sample_request = {'parent': 'projects/sample1/locations/sample2'} - - # get truthy value for each flattened field - mock_args = dict( - parent='parent_value', - challenge=service.Challenge(name='name_value'), - ) - mock_args.update(sample_request) - - # Wrap the value into a proper Response obj - response_value = Response() - response_value.status_code = 200 - # Convert return value to protobuf type - return_value = service.Challenge.pb(return_value) - json_return_value = json_format.MessageToJson(return_value) - response_value._content = json_return_value.encode('UTF-8') - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - - client.create_challenge(**mock_args) - - # Establish that the underlying call was made with the expected - # request object values. - assert len(req.mock_calls) == 1 - _, args, _ = req.mock_calls[0] - assert path_template.validate("%s/v1/{parent=projects/*/locations/*}/challenges" % client.transport._host, args[1]) - - -def test_create_challenge_rest_flattened_error(transport: str = 'rest'): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport=transport, - ) - - # Attempting to call a method with both a request object and flattened - # fields is an error. - with pytest.raises(ValueError): - client.create_challenge( - service.CreateChallengeRequest(), - parent='parent_value', - challenge=service.Challenge(name='name_value'), - ) - - -def test_verify_attestation_rest_use_cached_wrapped_rpc(): - # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, - # instead of constructing them on each call - with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest", - ) - - # Should wrap all calls on client creation - assert wrapper_fn.call_count > 0 - wrapper_fn.reset_mock() - - # Ensure method has been cached - assert client._transport.verify_attestation in client._transport._wrapped_methods - - # Replace cached wrapped function with mock - mock_rpc = mock.Mock() - mock_rpc.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. - client._transport._wrapped_methods[client._transport.verify_attestation] = mock_rpc - - request = {} - client.verify_attestation(request) - - # Establish that the underlying gRPC stub method was called. - assert mock_rpc.call_count == 1 - - client.verify_attestation(request) - - # Establish that a new wrapper was not created for this call - assert wrapper_fn.call_count == 0 - assert mock_rpc.call_count == 2 - - -def test_verify_attestation_rest_required_fields(request_type=service.VerifyAttestationRequest): - transport_class = transports.ConfidentialComputingRestTransport - - request_init = {} - request_init["challenge"] = "" - request = request_type(**request_init) - pb_request = request_type.pb(request) - jsonified_request = json.loads(json_format.MessageToJson( - pb_request, - use_integers_for_enums=False - )) - - # verify fields with default values are dropped - - unset_fields = transport_class(credentials=ga_credentials.AnonymousCredentials()).verify_attestation._get_unset_required_fields(jsonified_request) - jsonified_request.update(unset_fields) - - # verify required fields with default values are now present - - jsonified_request["challenge"] = 'challenge_value' - - unset_fields = transport_class(credentials=ga_credentials.AnonymousCredentials()).verify_attestation._get_unset_required_fields(jsonified_request) - jsonified_request.update(unset_fields) - - # verify required fields with non-default values are left alone - assert "challenge" in jsonified_request - assert jsonified_request["challenge"] == 'challenge_value' - - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport='rest', - ) - request = request_type(**request_init) - - # Designate an appropriate value for the returned response. - return_value = service.VerifyAttestationResponse() - # Mock the http request call within the method and fake a response. - with mock.patch.object(Session, 'request') as req: - # We need to mock transcode() because providing default values - # for required fields will fail the real version if the http_options - # expect actual values for those fields. - with mock.patch.object(path_template, 'transcode') as transcode: - # A uri without fields and an empty body will force all the - # request fields to show up in the query_params. - pb_request = request_type.pb(request) - transcode_result = { - 'uri': 'v1/sample_method', - 'method': "post", - 'query_params': pb_request, - } - transcode_result['body'] = pb_request - transcode.return_value = transcode_result - - response_value = Response() - response_value.status_code = 200 - - # Convert return value to protobuf type - return_value = service.VerifyAttestationResponse.pb(return_value) - json_return_value = json_format.MessageToJson(return_value) - - response_value._content = json_return_value.encode('UTF-8') - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - - response = client.verify_attestation(request) - - expected_params = [ - ('$alt', 'json;enum-encoding=int') - ] - actual_params = req.call_args.kwargs['params'] - assert expected_params == actual_params - - -def test_verify_attestation_rest_unset_required_fields(): - transport = transports.ConfidentialComputingRestTransport(credentials=ga_credentials.AnonymousCredentials) - - unset_fields = transport.verify_attestation._get_unset_required_fields({}) - assert set(unset_fields) == (set(()) & set(("challenge", "tpmAttestation", ))) - - -def test_verify_confidential_space_rest_use_cached_wrapped_rpc(): - # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, - # instead of constructing them on each call - with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest", - ) - - # Should wrap all calls on client creation - assert wrapper_fn.call_count > 0 - wrapper_fn.reset_mock() - - # Ensure method has been cached - assert client._transport.verify_confidential_space in client._transport._wrapped_methods - - # Replace cached wrapped function with mock - mock_rpc = mock.Mock() - mock_rpc.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. - client._transport._wrapped_methods[client._transport.verify_confidential_space] = mock_rpc - - request = {} - client.verify_confidential_space(request) - - # Establish that the underlying gRPC stub method was called. - assert mock_rpc.call_count == 1 - - client.verify_confidential_space(request) - - # Establish that a new wrapper was not created for this call - assert wrapper_fn.call_count == 0 - assert mock_rpc.call_count == 2 - - -def test_verify_confidential_space_rest_required_fields(request_type=service.VerifyConfidentialSpaceRequest): - transport_class = transports.ConfidentialComputingRestTransport - - request_init = {} - request_init["challenge"] = "" - request = request_type(**request_init) - pb_request = request_type.pb(request) - jsonified_request = json.loads(json_format.MessageToJson( - pb_request, - use_integers_for_enums=False - )) - - # verify fields with default values are dropped - - unset_fields = transport_class(credentials=ga_credentials.AnonymousCredentials()).verify_confidential_space._get_unset_required_fields(jsonified_request) - jsonified_request.update(unset_fields) - - # verify required fields with default values are now present - - jsonified_request["challenge"] = 'challenge_value' - - unset_fields = transport_class(credentials=ga_credentials.AnonymousCredentials()).verify_confidential_space._get_unset_required_fields(jsonified_request) - jsonified_request.update(unset_fields) - - # verify required fields with non-default values are left alone - assert "challenge" in jsonified_request - assert jsonified_request["challenge"] == 'challenge_value' - - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport='rest', - ) - request = request_type(**request_init) - - # Designate an appropriate value for the returned response. - return_value = service.VerifyConfidentialSpaceResponse() - # Mock the http request call within the method and fake a response. - with mock.patch.object(Session, 'request') as req: - # We need to mock transcode() because providing default values - # for required fields will fail the real version if the http_options - # expect actual values for those fields. - with mock.patch.object(path_template, 'transcode') as transcode: - # A uri without fields and an empty body will force all the - # request fields to show up in the query_params. - pb_request = request_type.pb(request) - transcode_result = { - 'uri': 'v1/sample_method', - 'method': "post", - 'query_params': pb_request, - } - transcode_result['body'] = pb_request - transcode.return_value = transcode_result - - response_value = Response() - response_value.status_code = 200 - - # Convert return value to protobuf type - return_value = service.VerifyConfidentialSpaceResponse.pb(return_value) - json_return_value = json_format.MessageToJson(return_value) - - response_value._content = json_return_value.encode('UTF-8') - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - - response = client.verify_confidential_space(request) - - expected_params = [ - ('$alt', 'json;enum-encoding=int') - ] - actual_params = req.call_args.kwargs['params'] - assert expected_params == actual_params - - -def test_verify_confidential_space_rest_unset_required_fields(): - transport = transports.ConfidentialComputingRestTransport(credentials=ga_credentials.AnonymousCredentials) - - unset_fields = transport.verify_confidential_space._get_unset_required_fields({}) - assert set(unset_fields) == (set(()) & set(("challenge", ))) - - -def test_verify_confidential_gke_rest_use_cached_wrapped_rpc(): - # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, - # instead of constructing them on each call - with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest", - ) - - # Should wrap all calls on client creation - assert wrapper_fn.call_count > 0 - wrapper_fn.reset_mock() - - # Ensure method has been cached - assert client._transport.verify_confidential_gke in client._transport._wrapped_methods - - # Replace cached wrapped function with mock - mock_rpc = mock.Mock() - mock_rpc.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. - client._transport._wrapped_methods[client._transport.verify_confidential_gke] = mock_rpc - - request = {} - client.verify_confidential_gke(request) - - # Establish that the underlying gRPC stub method was called. - assert mock_rpc.call_count == 1 - - client.verify_confidential_gke(request) - - # Establish that a new wrapper was not created for this call - assert wrapper_fn.call_count == 0 - assert mock_rpc.call_count == 2 - - -def test_verify_confidential_gke_rest_required_fields(request_type=service.VerifyConfidentialGkeRequest): - transport_class = transports.ConfidentialComputingRestTransport - - request_init = {} - request_init["challenge"] = "" - request = request_type(**request_init) - pb_request = request_type.pb(request) - jsonified_request = json.loads(json_format.MessageToJson( - pb_request, - use_integers_for_enums=False - )) - - # verify fields with default values are dropped - - unset_fields = transport_class(credentials=ga_credentials.AnonymousCredentials()).verify_confidential_gke._get_unset_required_fields(jsonified_request) - jsonified_request.update(unset_fields) - - # verify required fields with default values are now present - - jsonified_request["challenge"] = 'challenge_value' - - unset_fields = transport_class(credentials=ga_credentials.AnonymousCredentials()).verify_confidential_gke._get_unset_required_fields(jsonified_request) - jsonified_request.update(unset_fields) - - # verify required fields with non-default values are left alone - assert "challenge" in jsonified_request - assert jsonified_request["challenge"] == 'challenge_value' - - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport='rest', - ) - request = request_type(**request_init) - - # Designate an appropriate value for the returned response. - return_value = service.VerifyConfidentialGkeResponse() - # Mock the http request call within the method and fake a response. - with mock.patch.object(Session, 'request') as req: - # We need to mock transcode() because providing default values - # for required fields will fail the real version if the http_options - # expect actual values for those fields. - with mock.patch.object(path_template, 'transcode') as transcode: - # A uri without fields and an empty body will force all the - # request fields to show up in the query_params. - pb_request = request_type.pb(request) - transcode_result = { - 'uri': 'v1/sample_method', - 'method': "post", - 'query_params': pb_request, - } - transcode_result['body'] = pb_request - transcode.return_value = transcode_result - - response_value = Response() - response_value.status_code = 200 - - # Convert return value to protobuf type - return_value = service.VerifyConfidentialGkeResponse.pb(return_value) - json_return_value = json_format.MessageToJson(return_value) - - response_value._content = json_return_value.encode('UTF-8') - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - - response = client.verify_confidential_gke(request) - - expected_params = [ - ('$alt', 'json;enum-encoding=int') - ] - actual_params = req.call_args.kwargs['params'] - assert expected_params == actual_params - - -def test_verify_confidential_gke_rest_unset_required_fields(): - transport = transports.ConfidentialComputingRestTransport(credentials=ga_credentials.AnonymousCredentials) - - unset_fields = transport.verify_confidential_gke._get_unset_required_fields({}) - assert set(unset_fields) == (set(()) & set(("challenge", ))) - - -def test_credentials_transport_error(): - # It is an error to provide credentials and a transport instance. - transport = transports.ConfidentialComputingGrpcTransport( - credentials=ga_credentials.AnonymousCredentials(), - ) - with pytest.raises(ValueError): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport=transport, - ) - - # It is an error to provide a credentials file and a transport instance. - transport = transports.ConfidentialComputingGrpcTransport( - credentials=ga_credentials.AnonymousCredentials(), - ) - with pytest.raises(ValueError): - client = ConfidentialComputingClient( - client_options={"credentials_file": "credentials.json"}, - transport=transport, - ) - - # It is an error to provide an api_key and a transport instance. - transport = transports.ConfidentialComputingGrpcTransport( - credentials=ga_credentials.AnonymousCredentials(), - ) - options = client_options.ClientOptions() - options.api_key = "api_key" - with pytest.raises(ValueError): - client = ConfidentialComputingClient( - client_options=options, - transport=transport, - ) - - # It is an error to provide an api_key and a credential. - options = client_options.ClientOptions() - options.api_key = "api_key" - with pytest.raises(ValueError): - client = ConfidentialComputingClient( - client_options=options, - credentials=ga_credentials.AnonymousCredentials() - ) - - # It is an error to provide scopes and a transport instance. - transport = transports.ConfidentialComputingGrpcTransport( - credentials=ga_credentials.AnonymousCredentials(), - ) - with pytest.raises(ValueError): - client = ConfidentialComputingClient( - client_options={"scopes": ["1", "2"]}, - transport=transport, - ) - - -def test_transport_instance(): - # A client may be instantiated with a custom transport instance. - transport = transports.ConfidentialComputingGrpcTransport( - credentials=ga_credentials.AnonymousCredentials(), - ) - client = ConfidentialComputingClient(transport=transport) - assert client.transport is transport - -def test_transport_get_channel(): - # A client may be instantiated with a custom transport instance. - transport = transports.ConfidentialComputingGrpcTransport( - credentials=ga_credentials.AnonymousCredentials(), - ) - channel = transport.grpc_channel - assert channel - - transport = transports.ConfidentialComputingGrpcAsyncIOTransport( - credentials=ga_credentials.AnonymousCredentials(), - ) - channel = transport.grpc_channel - assert channel - -@pytest.mark.parametrize("transport_class", [ - transports.ConfidentialComputingGrpcTransport, - transports.ConfidentialComputingGrpcAsyncIOTransport, - transports.ConfidentialComputingRestTransport, -]) -def test_transport_adc(transport_class): - # Test default credentials are used if not provided. - with mock.patch.object(google.auth, 'default') as adc: - adc.return_value = (ga_credentials.AnonymousCredentials(), None) - transport_class() - adc.assert_called_once() - -def test_transport_kind_grpc(): - transport = ConfidentialComputingClient.get_transport_class("grpc")( - credentials=ga_credentials.AnonymousCredentials() - ) - assert transport.kind == "grpc" - - -def test_initialize_client_w_grpc(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="grpc" - ) - assert client is not None - - -# This test is a coverage failsafe to make sure that totally empty calls, -# i.e. request == None and no flattened fields passed, work. -def test_create_challenge_empty_call_grpc(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="grpc", - ) - - # Mock the actual call, and fake the request. - with mock.patch.object( - type(client.transport.create_challenge), - '__call__') as call: - call.return_value = service.Challenge() - client.create_challenge(request=None) - - # Establish that the underlying stub method was called. - call.assert_called() - _, args, _ = call.mock_calls[0] - request_msg = service.CreateChallengeRequest() - - assert args[0] == request_msg - - -# This test is a coverage failsafe to make sure that totally empty calls, -# i.e. request == None and no flattened fields passed, work. -def test_verify_attestation_empty_call_grpc(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="grpc", - ) - - # Mock the actual call, and fake the request. - with mock.patch.object( - type(client.transport.verify_attestation), - '__call__') as call: - call.return_value = service.VerifyAttestationResponse() - client.verify_attestation(request=None) - - # Establish that the underlying stub method was called. - call.assert_called() - _, args, _ = call.mock_calls[0] - request_msg = service.VerifyAttestationRequest() - - assert args[0] == request_msg - - -# This test is a coverage failsafe to make sure that totally empty calls, -# i.e. request == None and no flattened fields passed, work. -def test_verify_confidential_space_empty_call_grpc(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="grpc", - ) - - # Mock the actual call, and fake the request. - with mock.patch.object( - type(client.transport.verify_confidential_space), - '__call__') as call: - call.return_value = service.VerifyConfidentialSpaceResponse() - client.verify_confidential_space(request=None) - - # Establish that the underlying stub method was called. - call.assert_called() - _, args, _ = call.mock_calls[0] - request_msg = service.VerifyConfidentialSpaceRequest() - - assert args[0] == request_msg - - -# This test is a coverage failsafe to make sure that totally empty calls, -# i.e. request == None and no flattened fields passed, work. -def test_verify_confidential_gke_empty_call_grpc(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="grpc", - ) - - # Mock the actual call, and fake the request. - with mock.patch.object( - type(client.transport.verify_confidential_gke), - '__call__') as call: - call.return_value = service.VerifyConfidentialGkeResponse() - client.verify_confidential_gke(request=None) - - # Establish that the underlying stub method was called. - call.assert_called() - _, args, _ = call.mock_calls[0] - request_msg = service.VerifyConfidentialGkeRequest() - - assert args[0] == request_msg - - -def test_transport_kind_grpc_asyncio(): - transport = ConfidentialComputingAsyncClient.get_transport_class("grpc_asyncio")( - credentials=async_anonymous_credentials() - ) - assert transport.kind == "grpc_asyncio" - - -def test_initialize_client_w_grpc_asyncio(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - transport="grpc_asyncio" - ) - assert client is not None - - -# This test is a coverage failsafe to make sure that totally empty calls, -# i.e. request == None and no flattened fields passed, work. -@pytest.mark.asyncio -async def test_create_challenge_empty_call_grpc_asyncio(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - transport="grpc_asyncio", - ) - - # Mock the actual call, and fake the request. - with mock.patch.object( - type(client.transport.create_challenge), - '__call__') as call: - # Designate an appropriate return value for the call. - call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.Challenge( - name='name_value', - used=True, - tpm_nonce='tpm_nonce_value', - )) - await client.create_challenge(request=None) - - # Establish that the underlying stub method was called. - call.assert_called() - _, args, _ = call.mock_calls[0] - request_msg = service.CreateChallengeRequest() - - assert args[0] == request_msg - - -# This test is a coverage failsafe to make sure that totally empty calls, -# i.e. request == None and no flattened fields passed, work. -@pytest.mark.asyncio -async def test_verify_attestation_empty_call_grpc_asyncio(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - transport="grpc_asyncio", - ) - - # Mock the actual call, and fake the request. - with mock.patch.object( - type(client.transport.verify_attestation), - '__call__') as call: - # Designate an appropriate return value for the call. - call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyAttestationResponse( - oidc_claims_token='oidc_claims_token_value', - )) - await client.verify_attestation(request=None) - - # Establish that the underlying stub method was called. - call.assert_called() - _, args, _ = call.mock_calls[0] - request_msg = service.VerifyAttestationRequest() - - assert args[0] == request_msg - - -# This test is a coverage failsafe to make sure that totally empty calls, -# i.e. request == None and no flattened fields passed, work. -@pytest.mark.asyncio -async def test_verify_confidential_space_empty_call_grpc_asyncio(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - transport="grpc_asyncio", - ) - - # Mock the actual call, and fake the request. - with mock.patch.object( - type(client.transport.verify_confidential_space), - '__call__') as call: - # Designate an appropriate return value for the call. - call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyConfidentialSpaceResponse( - attestation_token='attestation_token_value', - )) - await client.verify_confidential_space(request=None) - - # Establish that the underlying stub method was called. - call.assert_called() - _, args, _ = call.mock_calls[0] - request_msg = service.VerifyConfidentialSpaceRequest() - - assert args[0] == request_msg - - -# This test is a coverage failsafe to make sure that totally empty calls, -# i.e. request == None and no flattened fields passed, work. -@pytest.mark.asyncio -async def test_verify_confidential_gke_empty_call_grpc_asyncio(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - transport="grpc_asyncio", - ) - - # Mock the actual call, and fake the request. - with mock.patch.object( - type(client.transport.verify_confidential_gke), - '__call__') as call: - # Designate an appropriate return value for the call. - call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyConfidentialGkeResponse( - attestation_token='attestation_token_value', - )) - await client.verify_confidential_gke(request=None) - - # Establish that the underlying stub method was called. - call.assert_called() - _, args, _ = call.mock_calls[0] - request_msg = service.VerifyConfidentialGkeRequest() - - assert args[0] == request_msg - - -def test_transport_kind_rest(): - transport = ConfidentialComputingClient.get_transport_class("rest")( - credentials=ga_credentials.AnonymousCredentials() - ) - assert transport.kind == "rest" - - -def test_create_challenge_rest_bad_request(request_type=service.CreateChallengeRequest): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest" - ) - # send a request that will satisfy transcoding - request_init = {'parent': 'projects/sample1/locations/sample2'} - request = request_type(**request_init) - - # Mock the http request call within the method and fake a BadRequest error. - with mock.patch.object(Session, 'request') as req, pytest.raises(core_exceptions.BadRequest): - # Wrap the value into a proper Response obj - response_value = mock.Mock() - json_return_value = '' - response_value.json = mock.Mock(return_value={}) - response_value.status_code = 400 - response_value.request = mock.Mock() - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - client.create_challenge(request) - - -@pytest.mark.parametrize("request_type", [ - service.CreateChallengeRequest, - dict, -]) -def test_create_challenge_rest_call_success(request_type): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest" - ) - - # send a request that will satisfy transcoding - request_init = {'parent': 'projects/sample1/locations/sample2'} - request_init["challenge"] = {'name': 'name_value', 'create_time': {'seconds': 751, 'nanos': 543}, 'expire_time': {}, 'used': True, 'tpm_nonce': 'tpm_nonce_value'} - # The version of a generated dependency at test runtime may differ from the version used during generation. - # Delete any fields which are not present in the current runtime dependency - # See https://github.com/googleapis/gapic-generator-python/issues/1748 - - # Determine if the message type is proto-plus or protobuf - test_field = service.CreateChallengeRequest.meta.fields["challenge"] - - def get_message_fields(field): - # Given a field which is a message (composite type), return a list with - # all the fields of the message. - # If the field is not a composite type, return an empty list. - message_fields = [] - - if hasattr(field, "message") and field.message: - is_field_type_proto_plus_type = not hasattr(field.message, "DESCRIPTOR") - - if is_field_type_proto_plus_type: - message_fields = field.message.meta.fields.values() - # Add `# pragma: NO COVER` because there may not be any `*_pb2` field types - else: # pragma: NO COVER - message_fields = field.message.DESCRIPTOR.fields - return message_fields - - runtime_nested_fields = [ - (field.name, nested_field.name) - for field in get_message_fields(test_field) - for nested_field in get_message_fields(field) - ] - - subfields_not_in_runtime = [] - - # For each item in the sample request, create a list of sub fields which are not present at runtime - # Add `# pragma: NO COVER` because this test code will not run if all subfields are present at runtime - for field, value in request_init["challenge"].items(): # pragma: NO COVER - result = None - is_repeated = False - # For repeated fields - if isinstance(value, list) and len(value): - is_repeated = True - result = value[0] - # For fields where the type is another message - if isinstance(value, dict): - result = value - - if result and hasattr(result, "keys"): - for subfield in result.keys(): - if (field, subfield) not in runtime_nested_fields: - subfields_not_in_runtime.append( - {"field": field, "subfield": subfield, "is_repeated": is_repeated} - ) - - # Remove fields from the sample request which are not present in the runtime version of the dependency - # Add `# pragma: NO COVER` because this test code will not run if all subfields are present at runtime - for subfield_to_delete in subfields_not_in_runtime: # pragma: NO COVER - field = subfield_to_delete.get("field") - field_repeated = subfield_to_delete.get("is_repeated") - subfield = subfield_to_delete.get("subfield") - if subfield: - if field_repeated: - for i in range(0, len(request_init["challenge"][field])): - del request_init["challenge"][field][i][subfield] - else: - del request_init["challenge"][field][subfield] - request = request_type(**request_init) - - # Mock the http request call within the method and fake a response. - with mock.patch.object(type(client.transport._session), 'request') as req: - # Designate an appropriate value for the returned response. - return_value = service.Challenge( - name='name_value', - used=True, - tpm_nonce='tpm_nonce_value', - ) - - # Wrap the value into a proper Response obj - response_value = mock.Mock() - response_value.status_code = 200 - - # Convert return value to protobuf type - return_value = service.Challenge.pb(return_value) - json_return_value = json_format.MessageToJson(return_value) - response_value.content = json_return_value.encode('UTF-8') - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - response = client.create_challenge(request) - - # Establish that the response is the type that we expect. - assert isinstance(response, service.Challenge) - assert response.name == 'name_value' - assert response.used is True - assert response.tpm_nonce == 'tpm_nonce_value' - - -@pytest.mark.parametrize("null_interceptor", [True, False]) -def test_create_challenge_rest_interceptors(null_interceptor): - transport = transports.ConfidentialComputingRestTransport( - credentials=ga_credentials.AnonymousCredentials(), - interceptor=None if null_interceptor else transports.ConfidentialComputingRestInterceptor(), - ) - client = ConfidentialComputingClient(transport=transport) - - with mock.patch.object(type(client.transport._session), "request") as req, \ - mock.patch.object(path_template, "transcode") as transcode, \ - mock.patch.object(transports.ConfidentialComputingRestInterceptor, "post_create_challenge") as post, \ - mock.patch.object(transports.ConfidentialComputingRestInterceptor, "post_create_challenge_with_metadata") as post_with_metadata, \ - mock.patch.object(transports.ConfidentialComputingRestInterceptor, "pre_create_challenge") as pre: - pre.assert_not_called() - post.assert_not_called() - post_with_metadata.assert_not_called() - pb_message = service.CreateChallengeRequest.pb(service.CreateChallengeRequest()) - transcode.return_value = { - "method": "post", - "uri": "my_uri", - "body": pb_message, - "query_params": pb_message, - } - - req.return_value = mock.Mock() - req.return_value.status_code = 200 - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - return_value = service.Challenge.to_json(service.Challenge()) - req.return_value.content = return_value - - request = service.CreateChallengeRequest() - metadata =[ - ("key", "val"), - ("cephalopod", "squid"), - ] - pre.return_value = request, metadata - post.return_value = service.Challenge() - post_with_metadata.return_value = service.Challenge(), metadata - - client.create_challenge(request, metadata=[("key", "val"), ("cephalopod", "squid"),]) - - pre.assert_called_once() - post.assert_called_once() - post_with_metadata.assert_called_once() - - -def test_verify_attestation_rest_bad_request(request_type=service.VerifyAttestationRequest): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest" - ) - # send a request that will satisfy transcoding - request_init = {'challenge': 'projects/sample1/locations/sample2/challenges/sample3'} - request = request_type(**request_init) - - # Mock the http request call within the method and fake a BadRequest error. - with mock.patch.object(Session, 'request') as req, pytest.raises(core_exceptions.BadRequest): - # Wrap the value into a proper Response obj - response_value = mock.Mock() - json_return_value = '' - response_value.json = mock.Mock(return_value={}) - response_value.status_code = 400 - response_value.request = mock.Mock() - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - client.verify_attestation(request) - - -@pytest.mark.parametrize("request_type", [ - service.VerifyAttestationRequest, - dict, -]) -def test_verify_attestation_rest_call_success(request_type): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest" - ) - - # send a request that will satisfy transcoding - request_init = {'challenge': 'projects/sample1/locations/sample2/challenges/sample3'} - request = request_type(**request_init) - - # Mock the http request call within the method and fake a response. - with mock.patch.object(type(client.transport._session), 'request') as req: - # Designate an appropriate value for the returned response. - return_value = service.VerifyAttestationResponse( - oidc_claims_token='oidc_claims_token_value', - ) - - # Wrap the value into a proper Response obj - response_value = mock.Mock() - response_value.status_code = 200 - - # Convert return value to protobuf type - return_value = service.VerifyAttestationResponse.pb(return_value) - json_return_value = json_format.MessageToJson(return_value) - response_value.content = json_return_value.encode('UTF-8') - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - response = client.verify_attestation(request) - - # Establish that the response is the type that we expect. - assert isinstance(response, service.VerifyAttestationResponse) - assert response.oidc_claims_token == 'oidc_claims_token_value' - - -@pytest.mark.parametrize("null_interceptor", [True, False]) -def test_verify_attestation_rest_interceptors(null_interceptor): - transport = transports.ConfidentialComputingRestTransport( - credentials=ga_credentials.AnonymousCredentials(), - interceptor=None if null_interceptor else transports.ConfidentialComputingRestInterceptor(), - ) - client = ConfidentialComputingClient(transport=transport) - - with mock.patch.object(type(client.transport._session), "request") as req, \ - mock.patch.object(path_template, "transcode") as transcode, \ - mock.patch.object(transports.ConfidentialComputingRestInterceptor, "post_verify_attestation") as post, \ - mock.patch.object(transports.ConfidentialComputingRestInterceptor, "post_verify_attestation_with_metadata") as post_with_metadata, \ - mock.patch.object(transports.ConfidentialComputingRestInterceptor, "pre_verify_attestation") as pre: - pre.assert_not_called() - post.assert_not_called() - post_with_metadata.assert_not_called() - pb_message = service.VerifyAttestationRequest.pb(service.VerifyAttestationRequest()) - transcode.return_value = { - "method": "post", - "uri": "my_uri", - "body": pb_message, - "query_params": pb_message, - } - - req.return_value = mock.Mock() - req.return_value.status_code = 200 - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - return_value = service.VerifyAttestationResponse.to_json(service.VerifyAttestationResponse()) - req.return_value.content = return_value - - request = service.VerifyAttestationRequest() - metadata =[ - ("key", "val"), - ("cephalopod", "squid"), - ] - pre.return_value = request, metadata - post.return_value = service.VerifyAttestationResponse() - post_with_metadata.return_value = service.VerifyAttestationResponse(), metadata - - client.verify_attestation(request, metadata=[("key", "val"), ("cephalopod", "squid"),]) - - pre.assert_called_once() - post.assert_called_once() - post_with_metadata.assert_called_once() - - -def test_verify_confidential_space_rest_bad_request(request_type=service.VerifyConfidentialSpaceRequest): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest" - ) - # send a request that will satisfy transcoding - request_init = {'challenge': 'projects/sample1/locations/sample2/challenges/sample3'} - request = request_type(**request_init) - - # Mock the http request call within the method and fake a BadRequest error. - with mock.patch.object(Session, 'request') as req, pytest.raises(core_exceptions.BadRequest): - # Wrap the value into a proper Response obj - response_value = mock.Mock() - json_return_value = '' - response_value.json = mock.Mock(return_value={}) - response_value.status_code = 400 - response_value.request = mock.Mock() - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - client.verify_confidential_space(request) - - -@pytest.mark.parametrize("request_type", [ - service.VerifyConfidentialSpaceRequest, - dict, -]) -def test_verify_confidential_space_rest_call_success(request_type): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest" - ) - - # send a request that will satisfy transcoding - request_init = {'challenge': 'projects/sample1/locations/sample2/challenges/sample3'} - request = request_type(**request_init) - - # Mock the http request call within the method and fake a response. - with mock.patch.object(type(client.transport._session), 'request') as req: - # Designate an appropriate value for the returned response. - return_value = service.VerifyConfidentialSpaceResponse( - attestation_token='attestation_token_value', - ) - - # Wrap the value into a proper Response obj - response_value = mock.Mock() - response_value.status_code = 200 - - # Convert return value to protobuf type - return_value = service.VerifyConfidentialSpaceResponse.pb(return_value) - json_return_value = json_format.MessageToJson(return_value) - response_value.content = json_return_value.encode('UTF-8') - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - response = client.verify_confidential_space(request) - - # Establish that the response is the type that we expect. - assert isinstance(response, service.VerifyConfidentialSpaceResponse) - assert response.attestation_token == 'attestation_token_value' - - -@pytest.mark.parametrize("null_interceptor", [True, False]) -def test_verify_confidential_space_rest_interceptors(null_interceptor): - transport = transports.ConfidentialComputingRestTransport( - credentials=ga_credentials.AnonymousCredentials(), - interceptor=None if null_interceptor else transports.ConfidentialComputingRestInterceptor(), - ) - client = ConfidentialComputingClient(transport=transport) - - with mock.patch.object(type(client.transport._session), "request") as req, \ - mock.patch.object(path_template, "transcode") as transcode, \ - mock.patch.object(transports.ConfidentialComputingRestInterceptor, "post_verify_confidential_space") as post, \ - mock.patch.object(transports.ConfidentialComputingRestInterceptor, "post_verify_confidential_space_with_metadata") as post_with_metadata, \ - mock.patch.object(transports.ConfidentialComputingRestInterceptor, "pre_verify_confidential_space") as pre: - pre.assert_not_called() - post.assert_not_called() - post_with_metadata.assert_not_called() - pb_message = service.VerifyConfidentialSpaceRequest.pb(service.VerifyConfidentialSpaceRequest()) - transcode.return_value = { - "method": "post", - "uri": "my_uri", - "body": pb_message, - "query_params": pb_message, - } - - req.return_value = mock.Mock() - req.return_value.status_code = 200 - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - return_value = service.VerifyConfidentialSpaceResponse.to_json(service.VerifyConfidentialSpaceResponse()) - req.return_value.content = return_value - - request = service.VerifyConfidentialSpaceRequest() - metadata =[ - ("key", "val"), - ("cephalopod", "squid"), - ] - pre.return_value = request, metadata - post.return_value = service.VerifyConfidentialSpaceResponse() - post_with_metadata.return_value = service.VerifyConfidentialSpaceResponse(), metadata - - client.verify_confidential_space(request, metadata=[("key", "val"), ("cephalopod", "squid"),]) - - pre.assert_called_once() - post.assert_called_once() - post_with_metadata.assert_called_once() - - -def test_verify_confidential_gke_rest_bad_request(request_type=service.VerifyConfidentialGkeRequest): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest" - ) - # send a request that will satisfy transcoding - request_init = {'challenge': 'projects/sample1/locations/sample2/challenges/sample3'} - request = request_type(**request_init) - - # Mock the http request call within the method and fake a BadRequest error. - with mock.patch.object(Session, 'request') as req, pytest.raises(core_exceptions.BadRequest): - # Wrap the value into a proper Response obj - response_value = mock.Mock() - json_return_value = '' - response_value.json = mock.Mock(return_value={}) - response_value.status_code = 400 - response_value.request = mock.Mock() - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - client.verify_confidential_gke(request) - - -@pytest.mark.parametrize("request_type", [ - service.VerifyConfidentialGkeRequest, - dict, -]) -def test_verify_confidential_gke_rest_call_success(request_type): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest" - ) - - # send a request that will satisfy transcoding - request_init = {'challenge': 'projects/sample1/locations/sample2/challenges/sample3'} - request = request_type(**request_init) - - # Mock the http request call within the method and fake a response. - with mock.patch.object(type(client.transport._session), 'request') as req: - # Designate an appropriate value for the returned response. - return_value = service.VerifyConfidentialGkeResponse( - attestation_token='attestation_token_value', - ) - - # Wrap the value into a proper Response obj - response_value = mock.Mock() - response_value.status_code = 200 - - # Convert return value to protobuf type - return_value = service.VerifyConfidentialGkeResponse.pb(return_value) - json_return_value = json_format.MessageToJson(return_value) - response_value.content = json_return_value.encode('UTF-8') - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - response = client.verify_confidential_gke(request) - - # Establish that the response is the type that we expect. - assert isinstance(response, service.VerifyConfidentialGkeResponse) - assert response.attestation_token == 'attestation_token_value' - - -@pytest.mark.parametrize("null_interceptor", [True, False]) -def test_verify_confidential_gke_rest_interceptors(null_interceptor): - transport = transports.ConfidentialComputingRestTransport( - credentials=ga_credentials.AnonymousCredentials(), - interceptor=None if null_interceptor else transports.ConfidentialComputingRestInterceptor(), - ) - client = ConfidentialComputingClient(transport=transport) - - with mock.patch.object(type(client.transport._session), "request") as req, \ - mock.patch.object(path_template, "transcode") as transcode, \ - mock.patch.object(transports.ConfidentialComputingRestInterceptor, "post_verify_confidential_gke") as post, \ - mock.patch.object(transports.ConfidentialComputingRestInterceptor, "post_verify_confidential_gke_with_metadata") as post_with_metadata, \ - mock.patch.object(transports.ConfidentialComputingRestInterceptor, "pre_verify_confidential_gke") as pre: - pre.assert_not_called() - post.assert_not_called() - post_with_metadata.assert_not_called() - pb_message = service.VerifyConfidentialGkeRequest.pb(service.VerifyConfidentialGkeRequest()) - transcode.return_value = { - "method": "post", - "uri": "my_uri", - "body": pb_message, - "query_params": pb_message, - } - - req.return_value = mock.Mock() - req.return_value.status_code = 200 - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - return_value = service.VerifyConfidentialGkeResponse.to_json(service.VerifyConfidentialGkeResponse()) - req.return_value.content = return_value - - request = service.VerifyConfidentialGkeRequest() - metadata =[ - ("key", "val"), - ("cephalopod", "squid"), - ] - pre.return_value = request, metadata - post.return_value = service.VerifyConfidentialGkeResponse() - post_with_metadata.return_value = service.VerifyConfidentialGkeResponse(), metadata - - client.verify_confidential_gke(request, metadata=[("key", "val"), ("cephalopod", "squid"),]) - - pre.assert_called_once() - post.assert_called_once() - post_with_metadata.assert_called_once() - - -def test_get_location_rest_bad_request(request_type=locations_pb2.GetLocationRequest): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest", - ) - request = request_type() - request = json_format.ParseDict({'name': 'projects/sample1/locations/sample2'}, request) - - # Mock the http request call within the method and fake a BadRequest error. - with mock.patch.object(Session, 'request') as req, pytest.raises(core_exceptions.BadRequest): - # Wrap the value into a proper Response obj - response_value = Response() - json_return_value = '' - response_value.json = mock.Mock(return_value={}) - response_value.status_code = 400 - response_value.request = Request() - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - client.get_location(request) - - -@pytest.mark.parametrize("request_type", [ - locations_pb2.GetLocationRequest, - dict, -]) -def test_get_location_rest(request_type): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest", - ) - - request_init = {'name': 'projects/sample1/locations/sample2'} - request = request_type(**request_init) - # Mock the http request call within the method and fake a response. - with mock.patch.object(Session, 'request') as req: - # Designate an appropriate value for the returned response. - return_value = locations_pb2.Location() - - # Wrap the value into a proper Response obj - response_value = mock.Mock() - response_value.status_code = 200 - json_return_value = json_format.MessageToJson(return_value) - response_value.content = json_return_value.encode('UTF-8') - - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - - response = client.get_location(request) - - # Establish that the response is the type that we expect. - assert isinstance(response, locations_pb2.Location) - - -def test_list_locations_rest_bad_request(request_type=locations_pb2.ListLocationsRequest): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest", - ) - request = request_type() - request = json_format.ParseDict({'name': 'projects/sample1'}, request) - - # Mock the http request call within the method and fake a BadRequest error. - with mock.patch.object(Session, 'request') as req, pytest.raises(core_exceptions.BadRequest): - # Wrap the value into a proper Response obj - response_value = Response() - json_return_value = '' - response_value.json = mock.Mock(return_value={}) - response_value.status_code = 400 - response_value.request = Request() - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - client.list_locations(request) - - -@pytest.mark.parametrize("request_type", [ - locations_pb2.ListLocationsRequest, - dict, -]) -def test_list_locations_rest(request_type): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest", - ) - - request_init = {'name': 'projects/sample1'} - request = request_type(**request_init) - # Mock the http request call within the method and fake a response. - with mock.patch.object(Session, 'request') as req: - # Designate an appropriate value for the returned response. - return_value = locations_pb2.ListLocationsResponse() - - # Wrap the value into a proper Response obj - response_value = mock.Mock() - response_value.status_code = 200 - json_return_value = json_format.MessageToJson(return_value) - response_value.content = json_return_value.encode('UTF-8') - - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - - response = client.list_locations(request) - - # Establish that the response is the type that we expect. - assert isinstance(response, locations_pb2.ListLocationsResponse) - -def test_initialize_client_w_rest(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest" - ) - assert client is not None - - -# This test is a coverage failsafe to make sure that totally empty calls, -# i.e. request == None and no flattened fields passed, work. -def test_create_challenge_empty_call_rest(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest", - ) - - # Mock the actual call, and fake the request. - with mock.patch.object( - type(client.transport.create_challenge), - '__call__') as call: - client.create_challenge(request=None) - - # Establish that the underlying stub method was called. - call.assert_called() - _, args, _ = call.mock_calls[0] - request_msg = service.CreateChallengeRequest() - - assert args[0] == request_msg - - -# This test is a coverage failsafe to make sure that totally empty calls, -# i.e. request == None and no flattened fields passed, work. -def test_verify_attestation_empty_call_rest(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest", - ) - - # Mock the actual call, and fake the request. - with mock.patch.object( - type(client.transport.verify_attestation), - '__call__') as call: - client.verify_attestation(request=None) - - # Establish that the underlying stub method was called. - call.assert_called() - _, args, _ = call.mock_calls[0] - request_msg = service.VerifyAttestationRequest() - - assert args[0] == request_msg - - -# This test is a coverage failsafe to make sure that totally empty calls, -# i.e. request == None and no flattened fields passed, work. -def test_verify_confidential_space_empty_call_rest(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest", - ) - - # Mock the actual call, and fake the request. - with mock.patch.object( - type(client.transport.verify_confidential_space), - '__call__') as call: - client.verify_confidential_space(request=None) - - # Establish that the underlying stub method was called. - call.assert_called() - _, args, _ = call.mock_calls[0] - request_msg = service.VerifyConfidentialSpaceRequest() - - assert args[0] == request_msg - - -# This test is a coverage failsafe to make sure that totally empty calls, -# i.e. request == None and no flattened fields passed, work. -def test_verify_confidential_gke_empty_call_rest(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest", - ) - - # Mock the actual call, and fake the request. - with mock.patch.object( - type(client.transport.verify_confidential_gke), - '__call__') as call: - client.verify_confidential_gke(request=None) - - # Establish that the underlying stub method was called. - call.assert_called() - _, args, _ = call.mock_calls[0] - request_msg = service.VerifyConfidentialGkeRequest() - - assert args[0] == request_msg - - -def test_transport_grpc_default(): - # A client should use the gRPC transport by default. - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - ) - assert isinstance( - client.transport, - transports.ConfidentialComputingGrpcTransport, - ) - -def test_confidential_computing_base_transport_error(): - # Passing both a credentials object and credentials_file should raise an error - with pytest.raises(core_exceptions.DuplicateCredentialArgs): - transport = transports.ConfidentialComputingTransport( - credentials=ga_credentials.AnonymousCredentials(), - credentials_file="credentials.json" - ) - - -def test_confidential_computing_base_transport(): - # Instantiate the base transport. - with mock.patch('google.cloud.confidentialcomputing_v1.services.confidential_computing.transports.ConfidentialComputingTransport.__init__') as Transport: - Transport.return_value = None - transport = transports.ConfidentialComputingTransport( - credentials=ga_credentials.AnonymousCredentials(), - ) - - # Every method on the transport should just blindly - # raise NotImplementedError. - methods = ( - 'create_challenge', - 'verify_attestation', - 'verify_confidential_space', - 'verify_confidential_gke', - 'get_location', - 'list_locations', - ) - for method in methods: - with pytest.raises(NotImplementedError): - getattr(transport, method)(request=object()) - - with pytest.raises(NotImplementedError): - transport.close() - - # Catch all for all remaining methods and properties - remainder = [ - 'kind', - ] - for r in remainder: - with pytest.raises(NotImplementedError): - getattr(transport, r)() - - -def test_confidential_computing_base_transport_with_credentials_file(): - # Instantiate the base transport with a credentials file - with mock.patch.object(google.auth, 'load_credentials_from_file', autospec=True) as load_creds, mock.patch('google.cloud.confidentialcomputing_v1.services.confidential_computing.transports.ConfidentialComputingTransport._prep_wrapped_messages') as Transport: - Transport.return_value = None - load_creds.return_value = (ga_credentials.AnonymousCredentials(), None) - transport = transports.ConfidentialComputingTransport( - credentials_file="credentials.json", - quota_project_id="octopus", - ) - load_creds.assert_called_once_with("credentials.json", - scopes=None, - default_scopes=( - 'https://www.googleapis.com/auth/cloud-platform', -), - quota_project_id="octopus", - ) - - -def test_confidential_computing_base_transport_with_adc(): - # Test the default credentials are used if credentials and credentials_file are None. - with mock.patch.object(google.auth, 'default', autospec=True) as adc, mock.patch('google.cloud.confidentialcomputing_v1.services.confidential_computing.transports.ConfidentialComputingTransport._prep_wrapped_messages') as Transport: - Transport.return_value = None - adc.return_value = (ga_credentials.AnonymousCredentials(), None) - transport = transports.ConfidentialComputingTransport() - adc.assert_called_once() - - -def test_confidential_computing_auth_adc(): - # If no credentials are provided, we should use ADC credentials. - with mock.patch.object(google.auth, 'default', autospec=True) as adc: - adc.return_value = (ga_credentials.AnonymousCredentials(), None) - ConfidentialComputingClient() - adc.assert_called_once_with( - scopes=None, - default_scopes=( - 'https://www.googleapis.com/auth/cloud-platform', -), - quota_project_id=None, - ) - - -@pytest.mark.parametrize( - "transport_class", - [ - transports.ConfidentialComputingGrpcTransport, - transports.ConfidentialComputingGrpcAsyncIOTransport, - ], -) -def test_confidential_computing_transport_auth_adc(transport_class): - # If credentials and host are not provided, the transport class should use - # ADC credentials. - with mock.patch.object(google.auth, 'default', autospec=True) as adc: - adc.return_value = (ga_credentials.AnonymousCredentials(), None) - transport_class(quota_project_id="octopus", scopes=["1", "2"]) - adc.assert_called_once_with( - scopes=["1", "2"], - default_scopes=( 'https://www.googleapis.com/auth/cloud-platform',), - quota_project_id="octopus", - ) - - -@pytest.mark.parametrize( - "transport_class", - [ - transports.ConfidentialComputingGrpcTransport, - transports.ConfidentialComputingGrpcAsyncIOTransport, - transports.ConfidentialComputingRestTransport, - ], -) -def test_confidential_computing_transport_auth_gdch_credentials(transport_class): - host = 'https://language.com' - api_audience_tests = [None, 'https://language2.com'] - api_audience_expect = [host, 'https://language2.com'] - for t, e in zip(api_audience_tests, api_audience_expect): - with mock.patch.object(google.auth, 'default', autospec=True) as adc: - gdch_mock = mock.MagicMock() - type(gdch_mock).with_gdch_audience = mock.PropertyMock(return_value=gdch_mock) - adc.return_value = (gdch_mock, None) - transport_class(host=host, api_audience=t) - gdch_mock.with_gdch_audience.assert_called_once_with( - e - ) - - -@pytest.mark.parametrize( - "transport_class,grpc_helpers", - [ - (transports.ConfidentialComputingGrpcTransport, grpc_helpers), - (transports.ConfidentialComputingGrpcAsyncIOTransport, grpc_helpers_async) - ], -) -def test_confidential_computing_transport_create_channel(transport_class, grpc_helpers): - # If credentials and host are not provided, the transport class should use - # ADC credentials. - with mock.patch.object(google.auth, "default", autospec=True) as adc, mock.patch.object( - grpc_helpers, "create_channel", autospec=True - ) as create_channel: - creds = ga_credentials.AnonymousCredentials() - adc.return_value = (creds, None) - transport_class( - quota_project_id="octopus", - scopes=["1", "2"] - ) - - create_channel.assert_called_with( - "confidentialcomputing.googleapis.com:443", - credentials=creds, - credentials_file=None, - quota_project_id="octopus", - default_scopes=( - 'https://www.googleapis.com/auth/cloud-platform', -), - scopes=["1", "2"], - default_host="confidentialcomputing.googleapis.com", - ssl_credentials=None, - options=[ - ("grpc.max_send_message_length", -1), - ("grpc.max_receive_message_length", -1), - ], - ) - - -@pytest.mark.parametrize("transport_class", [transports.ConfidentialComputingGrpcTransport, transports.ConfidentialComputingGrpcAsyncIOTransport]) -def test_confidential_computing_grpc_transport_client_cert_source_for_mtls( - transport_class -): - cred = ga_credentials.AnonymousCredentials() - - # Check ssl_channel_credentials is used if provided. - with mock.patch.object(transport_class, "create_channel") as mock_create_channel: - mock_ssl_channel_creds = mock.Mock() - transport_class( - host="squid.clam.whelk", - credentials=cred, - ssl_channel_credentials=mock_ssl_channel_creds - ) - mock_create_channel.assert_called_once_with( - "squid.clam.whelk:443", - credentials=cred, - credentials_file=None, - scopes=None, - ssl_credentials=mock_ssl_channel_creds, - quota_project_id=None, - options=[ - ("grpc.max_send_message_length", -1), - ("grpc.max_receive_message_length", -1), - ], - ) - - # Check if ssl_channel_credentials is not provided, then client_cert_source_for_mtls - # is used. - with mock.patch.object(transport_class, "create_channel", return_value=mock.Mock()): - with mock.patch("grpc.ssl_channel_credentials") as mock_ssl_cred: - transport_class( - credentials=cred, - client_cert_source_for_mtls=client_cert_source_callback - ) - expected_cert, expected_key = client_cert_source_callback() - mock_ssl_cred.assert_called_once_with( - certificate_chain=expected_cert, - private_key=expected_key - ) - -def test_confidential_computing_http_transport_client_cert_source_for_mtls(): - cred = ga_credentials.AnonymousCredentials() - with mock.patch("google.auth.transport.requests.AuthorizedSession.configure_mtls_channel") as mock_configure_mtls_channel: - transports.ConfidentialComputingRestTransport ( - credentials=cred, - client_cert_source_for_mtls=client_cert_source_callback - ) - mock_configure_mtls_channel.assert_called_once_with(client_cert_source_callback) - - -@pytest.mark.parametrize("transport_name", [ - "grpc", - "grpc_asyncio", - "rest", -]) -def test_confidential_computing_host_no_port(transport_name): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - client_options=client_options.ClientOptions(api_endpoint='confidentialcomputing.googleapis.com'), - transport=transport_name, - ) - assert client.transport._host == ( - 'confidentialcomputing.googleapis.com:443' - if transport_name in ['grpc', 'grpc_asyncio'] - else 'https://confidentialcomputing.googleapis.com' - ) - -@pytest.mark.parametrize("transport_name", [ - "grpc", - "grpc_asyncio", - "rest", -]) -def test_confidential_computing_host_with_port(transport_name): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - client_options=client_options.ClientOptions(api_endpoint='confidentialcomputing.googleapis.com:8000'), - transport=transport_name, - ) - assert client.transport._host == ( - 'confidentialcomputing.googleapis.com:8000' - if transport_name in ['grpc', 'grpc_asyncio'] - else 'https://confidentialcomputing.googleapis.com:8000' - ) - -@pytest.mark.parametrize("transport_name", [ - "rest", -]) -def test_confidential_computing_client_transport_session_collision(transport_name): - creds1 = ga_credentials.AnonymousCredentials() - creds2 = ga_credentials.AnonymousCredentials() - client1 = ConfidentialComputingClient( - credentials=creds1, - transport=transport_name, - ) - client2 = ConfidentialComputingClient( - credentials=creds2, - transport=transport_name, - ) - session1 = client1.transport.create_challenge._session - session2 = client2.transport.create_challenge._session - assert session1 != session2 - session1 = client1.transport.verify_attestation._session - session2 = client2.transport.verify_attestation._session - assert session1 != session2 - session1 = client1.transport.verify_confidential_space._session - session2 = client2.transport.verify_confidential_space._session - assert session1 != session2 - session1 = client1.transport.verify_confidential_gke._session - session2 = client2.transport.verify_confidential_gke._session - assert session1 != session2 -def test_confidential_computing_grpc_transport_channel(): - channel = grpc.secure_channel('http://localhost/', grpc.local_channel_credentials()) - - # Check that channel is used if provided. - transport = transports.ConfidentialComputingGrpcTransport( - host="squid.clam.whelk", - channel=channel, - ) - assert transport.grpc_channel == channel - assert transport._host == "squid.clam.whelk:443" - assert transport._ssl_channel_credentials == None - - -def test_confidential_computing_grpc_asyncio_transport_channel(): - channel = aio.secure_channel('http://localhost/', grpc.local_channel_credentials()) - - # Check that channel is used if provided. - transport = transports.ConfidentialComputingGrpcAsyncIOTransport( - host="squid.clam.whelk", - channel=channel, - ) - assert transport.grpc_channel == channel - assert transport._host == "squid.clam.whelk:443" - assert transport._ssl_channel_credentials == None - - -# Remove this test when deprecated arguments (api_mtls_endpoint, client_cert_source) are -# removed from grpc/grpc_asyncio transport constructor. -@pytest.mark.parametrize("transport_class", [transports.ConfidentialComputingGrpcTransport, transports.ConfidentialComputingGrpcAsyncIOTransport]) -def test_confidential_computing_transport_channel_mtls_with_client_cert_source( - transport_class -): - with mock.patch("grpc.ssl_channel_credentials", autospec=True) as grpc_ssl_channel_cred: - with mock.patch.object(transport_class, "create_channel") as grpc_create_channel: - mock_ssl_cred = mock.Mock() - grpc_ssl_channel_cred.return_value = mock_ssl_cred - - mock_grpc_channel = mock.Mock() - grpc_create_channel.return_value = mock_grpc_channel - - cred = ga_credentials.AnonymousCredentials() - with pytest.warns(DeprecationWarning): - with mock.patch.object(google.auth, 'default') as adc: - adc.return_value = (cred, None) - transport = transport_class( - host="squid.clam.whelk", - api_mtls_endpoint="mtls.squid.clam.whelk", - client_cert_source=client_cert_source_callback, - ) - adc.assert_called_once() - - grpc_ssl_channel_cred.assert_called_once_with( - certificate_chain=b"cert bytes", private_key=b"key bytes" - ) - grpc_create_channel.assert_called_once_with( - "mtls.squid.clam.whelk:443", - credentials=cred, - credentials_file=None, - scopes=None, - ssl_credentials=mock_ssl_cred, - quota_project_id=None, - options=[ - ("grpc.max_send_message_length", -1), - ("grpc.max_receive_message_length", -1), - ], - ) - assert transport.grpc_channel == mock_grpc_channel - assert transport._ssl_channel_credentials == mock_ssl_cred - - -# Remove this test when deprecated arguments (api_mtls_endpoint, client_cert_source) are -# removed from grpc/grpc_asyncio transport constructor. -@pytest.mark.parametrize("transport_class", [transports.ConfidentialComputingGrpcTransport, transports.ConfidentialComputingGrpcAsyncIOTransport]) -def test_confidential_computing_transport_channel_mtls_with_adc( - transport_class -): - mock_ssl_cred = mock.Mock() - with mock.patch.multiple( - "google.auth.transport.grpc.SslCredentials", - __init__=mock.Mock(return_value=None), - ssl_credentials=mock.PropertyMock(return_value=mock_ssl_cred), - ): - with mock.patch.object(transport_class, "create_channel") as grpc_create_channel: - mock_grpc_channel = mock.Mock() - grpc_create_channel.return_value = mock_grpc_channel - mock_cred = mock.Mock() - - with pytest.warns(DeprecationWarning): - transport = transport_class( - host="squid.clam.whelk", - credentials=mock_cred, - api_mtls_endpoint="mtls.squid.clam.whelk", - client_cert_source=None, - ) - - grpc_create_channel.assert_called_once_with( - "mtls.squid.clam.whelk:443", - credentials=mock_cred, - credentials_file=None, - scopes=None, - ssl_credentials=mock_ssl_cred, - quota_project_id=None, - options=[ - ("grpc.max_send_message_length", -1), - ("grpc.max_receive_message_length", -1), - ], - ) - assert transport.grpc_channel == mock_grpc_channel - - -def test_challenge_path(): - project = "squid" - location = "clam" - uuid = "whelk" - expected = "projects/{project}/locations/{location}/challenges/{uuid}".format(project=project, location=location, uuid=uuid, ) - actual = ConfidentialComputingClient.challenge_path(project, location, uuid) - assert expected == actual - - -def test_parse_challenge_path(): - expected = { - "project": "octopus", - "location": "oyster", - "uuid": "nudibranch", - } - path = ConfidentialComputingClient.challenge_path(**expected) - - # Check that the path construction is reversible. - actual = ConfidentialComputingClient.parse_challenge_path(path) - assert expected == actual - -def test_common_billing_account_path(): - billing_account = "cuttlefish" - expected = "billingAccounts/{billing_account}".format(billing_account=billing_account, ) - actual = ConfidentialComputingClient.common_billing_account_path(billing_account) - assert expected == actual - - -def test_parse_common_billing_account_path(): - expected = { - "billing_account": "mussel", - } - path = ConfidentialComputingClient.common_billing_account_path(**expected) - - # Check that the path construction is reversible. - actual = ConfidentialComputingClient.parse_common_billing_account_path(path) - assert expected == actual - -def test_common_folder_path(): - folder = "winkle" - expected = "folders/{folder}".format(folder=folder, ) - actual = ConfidentialComputingClient.common_folder_path(folder) - assert expected == actual - - -def test_parse_common_folder_path(): - expected = { - "folder": "nautilus", - } - path = ConfidentialComputingClient.common_folder_path(**expected) - - # Check that the path construction is reversible. - actual = ConfidentialComputingClient.parse_common_folder_path(path) - assert expected == actual - -def test_common_organization_path(): - organization = "scallop" - expected = "organizations/{organization}".format(organization=organization, ) - actual = ConfidentialComputingClient.common_organization_path(organization) - assert expected == actual - - -def test_parse_common_organization_path(): - expected = { - "organization": "abalone", - } - path = ConfidentialComputingClient.common_organization_path(**expected) - - # Check that the path construction is reversible. - actual = ConfidentialComputingClient.parse_common_organization_path(path) - assert expected == actual - -def test_common_project_path(): - project = "squid" - expected = "projects/{project}".format(project=project, ) - actual = ConfidentialComputingClient.common_project_path(project) - assert expected == actual - - -def test_parse_common_project_path(): - expected = { - "project": "clam", - } - path = ConfidentialComputingClient.common_project_path(**expected) - - # Check that the path construction is reversible. - actual = ConfidentialComputingClient.parse_common_project_path(path) - assert expected == actual - -def test_common_location_path(): - project = "whelk" - location = "octopus" - expected = "projects/{project}/locations/{location}".format(project=project, location=location, ) - actual = ConfidentialComputingClient.common_location_path(project, location) - assert expected == actual - - -def test_parse_common_location_path(): - expected = { - "project": "oyster", - "location": "nudibranch", - } - path = ConfidentialComputingClient.common_location_path(**expected) - - # Check that the path construction is reversible. - actual = ConfidentialComputingClient.parse_common_location_path(path) - assert expected == actual - - -def test_client_with_default_client_info(): - client_info = gapic_v1.client_info.ClientInfo() - - with mock.patch.object(transports.ConfidentialComputingTransport, '_prep_wrapped_messages') as prep: - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - client_info=client_info, - ) - prep.assert_called_once_with(client_info) - - with mock.patch.object(transports.ConfidentialComputingTransport, '_prep_wrapped_messages') as prep: - transport_class = ConfidentialComputingClient.get_transport_class() - transport = transport_class( - credentials=ga_credentials.AnonymousCredentials(), - client_info=client_info, - ) - prep.assert_called_once_with(client_info) - - -def test_list_locations(transport: str = "grpc"): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), transport=transport, - ) - - # Everything is optional in proto3 as far as the runtime is concerned, - # and we are mocking out the actual API, so just send an empty request. - request = locations_pb2.ListLocationsRequest() - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object(type(client.transport.list_locations), "__call__") as call: - # Designate an appropriate return value for the call. - call.return_value = locations_pb2.ListLocationsResponse() - response = client.list_locations(request) - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - assert args[0] == request - - # Establish that the response is the type that we expect. - assert isinstance(response, locations_pb2.ListLocationsResponse) -@pytest.mark.asyncio -async def test_list_locations_async(transport: str = "grpc_asyncio"): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), transport=transport, - ) - - # Everything is optional in proto3 as far as the runtime is concerned, - # and we are mocking out the actual API, so just send an empty request. - request = locations_pb2.ListLocationsRequest() - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object(type(client.transport.list_locations), "__call__") as call: - # Designate an appropriate return value for the call. - call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( - locations_pb2.ListLocationsResponse() - ) - response = await client.list_locations(request) - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - assert args[0] == request - - # Establish that the response is the type that we expect. - assert isinstance(response, locations_pb2.ListLocationsResponse) - -def test_list_locations_field_headers(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - ) - - # Any value that is part of the HTTP/1.1 URI should be sent as - # a field header. Set these to a non-empty value. - request = locations_pb2.ListLocationsRequest() - request.name = "locations" - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object(type(client.transport.list_locations), "__call__") as call: - call.return_value = locations_pb2.ListLocationsResponse() - - client.list_locations(request) - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - assert args[0] == request - - # Establish that the field header was sent. - _, _, kw = call.mock_calls[0] - assert ("x-goog-request-params", "name=locations",) in kw["metadata"] -@pytest.mark.asyncio -async def test_list_locations_field_headers_async(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - ) - - # Any value that is part of the HTTP/1.1 URI should be sent as - # a field header. Set these to a non-empty value. - request = locations_pb2.ListLocationsRequest() - request.name = "locations" - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object(type(client.transport.list_locations), "__call__") as call: - call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( - locations_pb2.ListLocationsResponse() - ) - await client.list_locations(request) - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - assert args[0] == request - - # Establish that the field header was sent. - _, _, kw = call.mock_calls[0] - assert ("x-goog-request-params", "name=locations",) in kw["metadata"] - -def test_list_locations_from_dict(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - ) - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object(type(client.transport.list_locations), "__call__") as call: - # Designate an appropriate return value for the call. - call.return_value = locations_pb2.ListLocationsResponse() - - response = client.list_locations( - request={ - "name": "locations", - } - ) - call.assert_called() -@pytest.mark.asyncio -async def test_list_locations_from_dict_async(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - ) - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object(type(client.transport.list_locations), "__call__") as call: - # Designate an appropriate return value for the call. - call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( - locations_pb2.ListLocationsResponse() - ) - response = await client.list_locations( - request={ - "name": "locations", - } - ) - call.assert_called() - - -def test_get_location(transport: str = "grpc"): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), transport=transport, - ) - - # Everything is optional in proto3 as far as the runtime is concerned, - # and we are mocking out the actual API, so just send an empty request. - request = locations_pb2.GetLocationRequest() - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object(type(client.transport.get_location), "__call__") as call: - # Designate an appropriate return value for the call. - call.return_value = locations_pb2.Location() - response = client.get_location(request) - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - assert args[0] == request - - # Establish that the response is the type that we expect. - assert isinstance(response, locations_pb2.Location) -@pytest.mark.asyncio -async def test_get_location_async(transport: str = "grpc_asyncio"): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), transport=transport, - ) - - # Everything is optional in proto3 as far as the runtime is concerned, - # and we are mocking out the actual API, so just send an empty request. - request = locations_pb2.GetLocationRequest() - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object(type(client.transport.get_location), "__call__") as call: - # Designate an appropriate return value for the call. - call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( - locations_pb2.Location() - ) - response = await client.get_location(request) - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - assert args[0] == request - - # Establish that the response is the type that we expect. - assert isinstance(response, locations_pb2.Location) - -def test_get_location_field_headers(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials()) - - # Any value that is part of the HTTP/1.1 URI should be sent as - # a field header. Set these to a non-empty value. - request = locations_pb2.GetLocationRequest() - request.name = "locations/abc" - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object(type(client.transport.get_location), "__call__") as call: - call.return_value = locations_pb2.Location() - - client.get_location(request) - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - assert args[0] == request - - # Establish that the field header was sent. - _, _, kw = call.mock_calls[0] - assert ("x-goog-request-params", "name=locations/abc",) in kw["metadata"] -@pytest.mark.asyncio -async def test_get_location_field_headers_async(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials() - ) - - # Any value that is part of the HTTP/1.1 URI should be sent as - # a field header. Set these to a non-empty value. - request = locations_pb2.GetLocationRequest() - request.name = "locations/abc" - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object(type(client.transport.get_location), "__call__") as call: - call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( - locations_pb2.Location() - ) - await client.get_location(request) - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - assert args[0] == request - - # Establish that the field header was sent. - _, _, kw = call.mock_calls[0] - assert ("x-goog-request-params", "name=locations/abc",) in kw["metadata"] - -def test_get_location_from_dict(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - ) - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object(type(client.transport.list_locations), "__call__") as call: - # Designate an appropriate return value for the call. - call.return_value = locations_pb2.Location() - - response = client.get_location( - request={ - "name": "locations/abc", - } - ) - call.assert_called() -@pytest.mark.asyncio -async def test_get_location_from_dict_async(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - ) - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object(type(client.transport.list_locations), "__call__") as call: - # Designate an appropriate return value for the call. - call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( - locations_pb2.Location() - ) - response = await client.get_location( - request={ - "name": "locations", - } - ) - call.assert_called() - - -def test_transport_close_grpc(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="grpc" - ) - with mock.patch.object(type(getattr(client.transport, "_grpc_channel")), "close") as close: - with client: - close.assert_not_called() - close.assert_called_once() - - -@pytest.mark.asyncio -async def test_transport_close_grpc_asyncio(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - transport="grpc_asyncio" - ) - with mock.patch.object(type(getattr(client.transport, "_grpc_channel")), "close") as close: - async with client: - close.assert_not_called() - close.assert_called_once() - - -def test_transport_close_rest(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest" - ) - with mock.patch.object(type(getattr(client.transport, "_session")), "close") as close: - with client: - close.assert_not_called() - close.assert_called_once() - - -def test_client_ctx(): - transports = [ - 'rest', - 'grpc', - ] - for transport in transports: - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport=transport - ) - # Test client calls underlying transport. - with mock.patch.object(type(client.transport), "close") as close: - close.assert_not_called() - with client: - pass - close.assert_called() - -@pytest.mark.parametrize("client_class,transport_class", [ - (ConfidentialComputingClient, transports.ConfidentialComputingGrpcTransport), - (ConfidentialComputingAsyncClient, transports.ConfidentialComputingGrpcAsyncIOTransport), -]) -def test_api_key_credentials(client_class, transport_class): - with mock.patch.object( - google.auth._default, "get_api_key_credentials", create=True - ) as get_api_key_credentials: - mock_cred = mock.Mock() - get_api_key_credentials.return_value = mock_cred - options = client_options.ClientOptions() - options.api_key = "api_key" - with mock.patch.object(transport_class, "__init__") as patched: - patched.return_value = None - client = client_class(client_options=options) - patched.assert_called_once_with( - credentials=mock_cred, - credentials_file=None, - host=client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE), - scopes=None, - client_cert_source_for_mtls=None, - quota_project_id=None, - client_info=transports.base.DEFAULT_CLIENT_INFO, - always_use_jwt_access=True, - api_audience=None, - ) diff --git a/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing/__init__.py b/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing/__init__.py index a3bdbca55a1e..75f635a85f29 100644 --- a/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing/__init__.py +++ b/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing/__init__.py @@ -25,29 +25,39 @@ ConfidentialComputingClient, ) from google.cloud.confidentialcomputing_v1.types.service import ( + AwsPrincipalTagsOptions, Challenge, ConfidentialSpaceInfo, ContainerImageSignature, CreateChallengeRequest, + GceShieldedIdentity, GcpCredentials, SevSnpAttestation, + SignatureType, SignedEntity, SigningAlgorithm, TdxCcelAttestation, TokenOptions, + TokenProfile, TokenType, TpmAttestation, VerifyAttestationRequest, VerifyAttestationResponse, + VerifyConfidentialGkeRequest, + VerifyConfidentialGkeResponse, + VerifyConfidentialSpaceRequest, + VerifyConfidentialSpaceResponse, ) __all__ = ( "ConfidentialComputingClient", "ConfidentialComputingAsyncClient", + "AwsPrincipalTagsOptions", "Challenge", "ConfidentialSpaceInfo", "ContainerImageSignature", "CreateChallengeRequest", + "GceShieldedIdentity", "GcpCredentials", "SevSnpAttestation", "SignedEntity", @@ -56,6 +66,12 @@ "TpmAttestation", "VerifyAttestationRequest", "VerifyAttestationResponse", + "VerifyConfidentialGkeRequest", + "VerifyConfidentialGkeResponse", + "VerifyConfidentialSpaceRequest", + "VerifyConfidentialSpaceResponse", + "SignatureType", "SigningAlgorithm", + "TokenProfile", "TokenType", ) diff --git a/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/__init__.py b/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/__init__.py index 5dfeeeefd0c4..e2de97741c72 100644 --- a/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/__init__.py +++ b/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/__init__.py @@ -23,37 +23,53 @@ ConfidentialComputingClient, ) from .types.service import ( + AwsPrincipalTagsOptions, Challenge, ConfidentialSpaceInfo, ContainerImageSignature, CreateChallengeRequest, + GceShieldedIdentity, GcpCredentials, SevSnpAttestation, + SignatureType, SignedEntity, SigningAlgorithm, TdxCcelAttestation, TokenOptions, + TokenProfile, TokenType, TpmAttestation, VerifyAttestationRequest, VerifyAttestationResponse, + VerifyConfidentialGkeRequest, + VerifyConfidentialGkeResponse, + VerifyConfidentialSpaceRequest, + VerifyConfidentialSpaceResponse, ) __all__ = ( "ConfidentialComputingAsyncClient", + "AwsPrincipalTagsOptions", "Challenge", "ConfidentialComputingClient", "ConfidentialSpaceInfo", "ContainerImageSignature", "CreateChallengeRequest", + "GceShieldedIdentity", "GcpCredentials", "SevSnpAttestation", + "SignatureType", "SignedEntity", "SigningAlgorithm", "TdxCcelAttestation", "TokenOptions", + "TokenProfile", "TokenType", "TpmAttestation", "VerifyAttestationRequest", "VerifyAttestationResponse", + "VerifyConfidentialGkeRequest", + "VerifyConfidentialGkeResponse", + "VerifyConfidentialSpaceRequest", + "VerifyConfidentialSpaceResponse", ) diff --git a/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/gapic_metadata.json b/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/gapic_metadata.json index 1f03d82e18a7..5227e556513e 100644 --- a/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/gapic_metadata.json +++ b/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/gapic_metadata.json @@ -19,6 +19,16 @@ "methods": [ "verify_attestation" ] + }, + "VerifyConfidentialGke": { + "methods": [ + "verify_confidential_gke" + ] + }, + "VerifyConfidentialSpace": { + "methods": [ + "verify_confidential_space" + ] } } }, @@ -34,6 +44,16 @@ "methods": [ "verify_attestation" ] + }, + "VerifyConfidentialGke": { + "methods": [ + "verify_confidential_gke" + ] + }, + "VerifyConfidentialSpace": { + "methods": [ + "verify_confidential_space" + ] } } }, @@ -49,6 +69,16 @@ "methods": [ "verify_attestation" ] + }, + "VerifyConfidentialGke": { + "methods": [ + "verify_confidential_gke" + ] + }, + "VerifyConfidentialSpace": { + "methods": [ + "verify_confidential_space" + ] } } } diff --git a/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/services/confidential_computing/async_client.py b/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/services/confidential_computing/async_client.py index 35c979469389..8e048194152f 100644 --- a/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/services/confidential_computing/async_client.py +++ b/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/services/confidential_computing/async_client.py @@ -431,7 +431,7 @@ async def verify_attestation( metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), ) -> service.VerifyAttestationResponse: r"""Verifies the provided attestation info, returning a - signed OIDC token. + signed attestation token. .. code-block:: python @@ -461,7 +461,7 @@ async def sample_verify_attestation(): Args: request (Optional[Union[google.cloud.confidentialcomputing_v1.types.VerifyAttestationRequest, dict]]): - The request object. A request for an OIDC token, + The request object. A request for an attestation token, providing all the necessary information needed for this service to verify the platform state of the requestor. @@ -477,7 +477,7 @@ async def sample_verify_attestation(): google.cloud.confidentialcomputing_v1.types.VerifyAttestationResponse: A response once an attestation has been successfully verified, containing a - signed OIDC token. + signed attestation token. """ # Create or coerce a protobuf request object. @@ -514,6 +514,194 @@ async def sample_verify_attestation(): # Done; return the response. return response + async def verify_confidential_space( + self, + request: Optional[Union[service.VerifyConfidentialSpaceRequest, dict]] = None, + *, + retry: OptionalRetry = gapic_v1.method.DEFAULT, + timeout: Union[float, object] = gapic_v1.method.DEFAULT, + metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), + ) -> service.VerifyConfidentialSpaceResponse: + r"""Verifies whether the provided attestation info is + valid, returning a signed attestation token if so. + + .. code-block:: python + + # This snippet has been automatically generated and should be regarded as a + # code template only. + # It will require modifications to work: + # - It may require correct/in-range values for request initialization. + # - It may require specifying regional endpoints when creating the service + # client as shown in: + # https://googleapis.dev/python/google-api-core/latest/client_options.html + from google.cloud import confidentialcomputing_v1 + + async def sample_verify_confidential_space(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingAsyncClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.VerifyConfidentialSpaceRequest( + challenge="challenge_value", + ) + + # Make the request + response = await client.verify_confidential_space(request=request) + + # Handle the response + print(response) + + Args: + request (Optional[Union[google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceRequest, dict]]): + The request object. A request for an attestation token, + providing all the necessary information + needed for this service to verify the + platform state of the requestor. + retry (google.api_core.retry_async.AsyncRetry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceResponse: + VerifyConfidentialSpaceResponse is + returned once a Confidential Space + attestation has been successfully + verified, containing a signed token. + + """ + # Create or coerce a protobuf request object. + # - Use the request object if provided (there's no risk of modifying the input as + # there are no flattened fields), or create one. + if not isinstance(request, service.VerifyConfidentialSpaceRequest): + request = service.VerifyConfidentialSpaceRequest(request) + + # Wrap the RPC method; this adds retry and timeout information, + # and friendly error handling. + rpc = self._client._transport._wrapped_methods[ + self._client._transport.verify_confidential_space + ] + + # Certain fields should be provided within the metadata header; + # add these here. + metadata = tuple(metadata) + ( + gapic_v1.routing_header.to_grpc_metadata( + (("challenge", request.challenge),) + ), + ) + + # Validate the universe domain. + self._client._validate_universe_domain() + + # Send the request. + response = await rpc( + request, + retry=retry, + timeout=timeout, + metadata=metadata, + ) + + # Done; return the response. + return response + + async def verify_confidential_gke( + self, + request: Optional[Union[service.VerifyConfidentialGkeRequest, dict]] = None, + *, + retry: OptionalRetry = gapic_v1.method.DEFAULT, + timeout: Union[float, object] = gapic_v1.method.DEFAULT, + metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), + ) -> service.VerifyConfidentialGkeResponse: + r"""Verifies the provided Confidential GKE attestation + info, returning a signed OIDC token. + + .. code-block:: python + + # This snippet has been automatically generated and should be regarded as a + # code template only. + # It will require modifications to work: + # - It may require correct/in-range values for request initialization. + # - It may require specifying regional endpoints when creating the service + # client as shown in: + # https://googleapis.dev/python/google-api-core/latest/client_options.html + from google.cloud import confidentialcomputing_v1 + + async def sample_verify_confidential_gke(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingAsyncClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.VerifyConfidentialGkeRequest( + challenge="challenge_value", + ) + + # Make the request + response = await client.verify_confidential_gke(request=request) + + # Handle the response + print(response) + + Args: + request (Optional[Union[google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeRequest, dict]]): + The request object. A request for an attestation token, + providing all the necessary information + needed for this service to verify + Confidential GKE platform state of the + requestor. + retry (google.api_core.retry_async.AsyncRetry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeResponse: + VerifyConfidentialGkeResponse + response is returened once a + Confidential GKE attestation has been + successfully verified, containing a + signed OIDC token. + + """ + # Create or coerce a protobuf request object. + # - Use the request object if provided (there's no risk of modifying the input as + # there are no flattened fields), or create one. + if not isinstance(request, service.VerifyConfidentialGkeRequest): + request = service.VerifyConfidentialGkeRequest(request) + + # Wrap the RPC method; this adds retry and timeout information, + # and friendly error handling. + rpc = self._client._transport._wrapped_methods[ + self._client._transport.verify_confidential_gke + ] + + # Certain fields should be provided within the metadata header; + # add these here. + metadata = tuple(metadata) + ( + gapic_v1.routing_header.to_grpc_metadata( + (("challenge", request.challenge),) + ), + ) + + # Validate the universe domain. + self._client._validate_universe_domain() + + # Send the request. + response = await rpc( + request, + retry=retry, + timeout=timeout, + metadata=metadata, + ) + + # Done; return the response. + return response + async def get_location( self, request: Optional[locations_pb2.GetLocationRequest] = None, diff --git a/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/services/confidential_computing/client.py b/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/services/confidential_computing/client.py index 69e3c75a8edf..9a38a0016d49 100644 --- a/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/services/confidential_computing/client.py +++ b/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/services/confidential_computing/client.py @@ -850,7 +850,7 @@ def verify_attestation( metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), ) -> service.VerifyAttestationResponse: r"""Verifies the provided attestation info, returning a - signed OIDC token. + signed attestation token. .. code-block:: python @@ -880,7 +880,7 @@ def sample_verify_attestation(): Args: request (Union[google.cloud.confidentialcomputing_v1.types.VerifyAttestationRequest, dict]): - The request object. A request for an OIDC token, + The request object. A request for an attestation token, providing all the necessary information needed for this service to verify the platform state of the requestor. @@ -896,7 +896,7 @@ def sample_verify_attestation(): google.cloud.confidentialcomputing_v1.types.VerifyAttestationResponse: A response once an attestation has been successfully verified, containing a - signed OIDC token. + signed attestation token. """ # Create or coerce a protobuf request object. @@ -931,6 +931,192 @@ def sample_verify_attestation(): # Done; return the response. return response + def verify_confidential_space( + self, + request: Optional[Union[service.VerifyConfidentialSpaceRequest, dict]] = None, + *, + retry: OptionalRetry = gapic_v1.method.DEFAULT, + timeout: Union[float, object] = gapic_v1.method.DEFAULT, + metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), + ) -> service.VerifyConfidentialSpaceResponse: + r"""Verifies whether the provided attestation info is + valid, returning a signed attestation token if so. + + .. code-block:: python + + # This snippet has been automatically generated and should be regarded as a + # code template only. + # It will require modifications to work: + # - It may require correct/in-range values for request initialization. + # - It may require specifying regional endpoints when creating the service + # client as shown in: + # https://googleapis.dev/python/google-api-core/latest/client_options.html + from google.cloud import confidentialcomputing_v1 + + def sample_verify_confidential_space(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.VerifyConfidentialSpaceRequest( + challenge="challenge_value", + ) + + # Make the request + response = client.verify_confidential_space(request=request) + + # Handle the response + print(response) + + Args: + request (Union[google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceRequest, dict]): + The request object. A request for an attestation token, + providing all the necessary information + needed for this service to verify the + platform state of the requestor. + retry (google.api_core.retry.Retry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceResponse: + VerifyConfidentialSpaceResponse is + returned once a Confidential Space + attestation has been successfully + verified, containing a signed token. + + """ + # Create or coerce a protobuf request object. + # - Use the request object if provided (there's no risk of modifying the input as + # there are no flattened fields), or create one. + if not isinstance(request, service.VerifyConfidentialSpaceRequest): + request = service.VerifyConfidentialSpaceRequest(request) + + # Wrap the RPC method; this adds retry and timeout information, + # and friendly error handling. + rpc = self._transport._wrapped_methods[ + self._transport.verify_confidential_space + ] + + # Certain fields should be provided within the metadata header; + # add these here. + metadata = tuple(metadata) + ( + gapic_v1.routing_header.to_grpc_metadata( + (("challenge", request.challenge),) + ), + ) + + # Validate the universe domain. + self._validate_universe_domain() + + # Send the request. + response = rpc( + request, + retry=retry, + timeout=timeout, + metadata=metadata, + ) + + # Done; return the response. + return response + + def verify_confidential_gke( + self, + request: Optional[Union[service.VerifyConfidentialGkeRequest, dict]] = None, + *, + retry: OptionalRetry = gapic_v1.method.DEFAULT, + timeout: Union[float, object] = gapic_v1.method.DEFAULT, + metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), + ) -> service.VerifyConfidentialGkeResponse: + r"""Verifies the provided Confidential GKE attestation + info, returning a signed OIDC token. + + .. code-block:: python + + # This snippet has been automatically generated and should be regarded as a + # code template only. + # It will require modifications to work: + # - It may require correct/in-range values for request initialization. + # - It may require specifying regional endpoints when creating the service + # client as shown in: + # https://googleapis.dev/python/google-api-core/latest/client_options.html + from google.cloud import confidentialcomputing_v1 + + def sample_verify_confidential_gke(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.VerifyConfidentialGkeRequest( + challenge="challenge_value", + ) + + # Make the request + response = client.verify_confidential_gke(request=request) + + # Handle the response + print(response) + + Args: + request (Union[google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeRequest, dict]): + The request object. A request for an attestation token, + providing all the necessary information + needed for this service to verify + Confidential GKE platform state of the + requestor. + retry (google.api_core.retry.Retry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeResponse: + VerifyConfidentialGkeResponse + response is returened once a + Confidential GKE attestation has been + successfully verified, containing a + signed OIDC token. + + """ + # Create or coerce a protobuf request object. + # - Use the request object if provided (there's no risk of modifying the input as + # there are no flattened fields), or create one. + if not isinstance(request, service.VerifyConfidentialGkeRequest): + request = service.VerifyConfidentialGkeRequest(request) + + # Wrap the RPC method; this adds retry and timeout information, + # and friendly error handling. + rpc = self._transport._wrapped_methods[self._transport.verify_confidential_gke] + + # Certain fields should be provided within the metadata header; + # add these here. + metadata = tuple(metadata) + ( + gapic_v1.routing_header.to_grpc_metadata( + (("challenge", request.challenge),) + ), + ) + + # Validate the universe domain. + self._validate_universe_domain() + + # Send the request. + response = rpc( + request, + retry=retry, + timeout=timeout, + metadata=metadata, + ) + + # Done; return the response. + return response + def __enter__(self) -> "ConfidentialComputingClient": return self diff --git a/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/base.py b/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/base.py index 33e00a6a33c1..9e54ddafc32a 100644 --- a/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/base.py +++ b/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/base.py @@ -161,6 +161,34 @@ def _prep_wrapped_messages(self, client_info): default_timeout=60.0, client_info=client_info, ), + self.verify_confidential_space: gapic_v1.method.wrap_method( + self.verify_confidential_space, + default_retry=retries.Retry( + initial=1.0, + maximum=60.0, + multiplier=1.3, + predicate=retries.if_exception_type( + core_exceptions.ServiceUnavailable, + ), + deadline=60.0, + ), + default_timeout=60.0, + client_info=client_info, + ), + self.verify_confidential_gke: gapic_v1.method.wrap_method( + self.verify_confidential_gke, + default_retry=retries.Retry( + initial=1.0, + maximum=60.0, + multiplier=1.3, + predicate=retries.if_exception_type( + core_exceptions.ServiceUnavailable, + ), + deadline=60.0, + ), + default_timeout=60.0, + client_info=client_info, + ), self.get_location: gapic_v1.method.wrap_method( self.get_location, default_timeout=None, @@ -203,6 +231,30 @@ def verify_attestation( ]: raise NotImplementedError() + @property + def verify_confidential_space( + self, + ) -> Callable[ + [service.VerifyConfidentialSpaceRequest], + Union[ + service.VerifyConfidentialSpaceResponse, + Awaitable[service.VerifyConfidentialSpaceResponse], + ], + ]: + raise NotImplementedError() + + @property + def verify_confidential_gke( + self, + ) -> Callable[ + [service.VerifyConfidentialGkeRequest], + Union[ + service.VerifyConfidentialGkeResponse, + Awaitable[service.VerifyConfidentialGkeResponse], + ], + ]: + raise NotImplementedError() + @property def get_location( self, diff --git a/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc.py b/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc.py index 4753b77aa2d9..893159f6fca3 100644 --- a/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc.py +++ b/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc.py @@ -356,7 +356,7 @@ def verify_attestation( r"""Return a callable for the verify attestation method over gRPC. Verifies the provided attestation info, returning a - signed OIDC token. + signed attestation token. Returns: Callable[[~.VerifyAttestationRequest], @@ -376,6 +376,65 @@ def verify_attestation( ) return self._stubs["verify_attestation"] + @property + def verify_confidential_space( + self, + ) -> Callable[ + [service.VerifyConfidentialSpaceRequest], + service.VerifyConfidentialSpaceResponse, + ]: + r"""Return a callable for the verify confidential space method over gRPC. + + Verifies whether the provided attestation info is + valid, returning a signed attestation token if so. + + Returns: + Callable[[~.VerifyConfidentialSpaceRequest], + ~.VerifyConfidentialSpaceResponse]: + A function that, when called, will call the underlying RPC + on the server. + """ + # Generate a "stub function" on-the-fly which will actually make + # the request. + # gRPC handles serialization and deserialization, so we just need + # to pass in the functions for each. + if "verify_confidential_space" not in self._stubs: + self._stubs["verify_confidential_space"] = self._logged_channel.unary_unary( + "/google.cloud.confidentialcomputing.v1.ConfidentialComputing/VerifyConfidentialSpace", + request_serializer=service.VerifyConfidentialSpaceRequest.serialize, + response_deserializer=service.VerifyConfidentialSpaceResponse.deserialize, + ) + return self._stubs["verify_confidential_space"] + + @property + def verify_confidential_gke( + self, + ) -> Callable[ + [service.VerifyConfidentialGkeRequest], service.VerifyConfidentialGkeResponse + ]: + r"""Return a callable for the verify confidential gke method over gRPC. + + Verifies the provided Confidential GKE attestation + info, returning a signed OIDC token. + + Returns: + Callable[[~.VerifyConfidentialGkeRequest], + ~.VerifyConfidentialGkeResponse]: + A function that, when called, will call the underlying RPC + on the server. + """ + # Generate a "stub function" on-the-fly which will actually make + # the request. + # gRPC handles serialization and deserialization, so we just need + # to pass in the functions for each. + if "verify_confidential_gke" not in self._stubs: + self._stubs["verify_confidential_gke"] = self._logged_channel.unary_unary( + "/google.cloud.confidentialcomputing.v1.ConfidentialComputing/VerifyConfidentialGke", + request_serializer=service.VerifyConfidentialGkeRequest.serialize, + response_deserializer=service.VerifyConfidentialGkeResponse.deserialize, + ) + return self._stubs["verify_confidential_gke"] + def close(self): self._logged_channel.close() diff --git a/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc_asyncio.py b/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc_asyncio.py index 848c4fc51d04..393da1d16924 100644 --- a/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc_asyncio.py +++ b/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc_asyncio.py @@ -364,7 +364,7 @@ def verify_attestation( r"""Return a callable for the verify attestation method over gRPC. Verifies the provided attestation info, returning a - signed OIDC token. + signed attestation token. Returns: Callable[[~.VerifyAttestationRequest], @@ -384,6 +384,66 @@ def verify_attestation( ) return self._stubs["verify_attestation"] + @property + def verify_confidential_space( + self, + ) -> Callable[ + [service.VerifyConfidentialSpaceRequest], + Awaitable[service.VerifyConfidentialSpaceResponse], + ]: + r"""Return a callable for the verify confidential space method over gRPC. + + Verifies whether the provided attestation info is + valid, returning a signed attestation token if so. + + Returns: + Callable[[~.VerifyConfidentialSpaceRequest], + Awaitable[~.VerifyConfidentialSpaceResponse]]: + A function that, when called, will call the underlying RPC + on the server. + """ + # Generate a "stub function" on-the-fly which will actually make + # the request. + # gRPC handles serialization and deserialization, so we just need + # to pass in the functions for each. + if "verify_confidential_space" not in self._stubs: + self._stubs["verify_confidential_space"] = self._logged_channel.unary_unary( + "/google.cloud.confidentialcomputing.v1.ConfidentialComputing/VerifyConfidentialSpace", + request_serializer=service.VerifyConfidentialSpaceRequest.serialize, + response_deserializer=service.VerifyConfidentialSpaceResponse.deserialize, + ) + return self._stubs["verify_confidential_space"] + + @property + def verify_confidential_gke( + self, + ) -> Callable[ + [service.VerifyConfidentialGkeRequest], + Awaitable[service.VerifyConfidentialGkeResponse], + ]: + r"""Return a callable for the verify confidential gke method over gRPC. + + Verifies the provided Confidential GKE attestation + info, returning a signed OIDC token. + + Returns: + Callable[[~.VerifyConfidentialGkeRequest], + Awaitable[~.VerifyConfidentialGkeResponse]]: + A function that, when called, will call the underlying RPC + on the server. + """ + # Generate a "stub function" on-the-fly which will actually make + # the request. + # gRPC handles serialization and deserialization, so we just need + # to pass in the functions for each. + if "verify_confidential_gke" not in self._stubs: + self._stubs["verify_confidential_gke"] = self._logged_channel.unary_unary( + "/google.cloud.confidentialcomputing.v1.ConfidentialComputing/VerifyConfidentialGke", + request_serializer=service.VerifyConfidentialGkeRequest.serialize, + response_deserializer=service.VerifyConfidentialGkeResponse.deserialize, + ) + return self._stubs["verify_confidential_gke"] + def _prep_wrapped_messages(self, client_info): """Precompute the wrapped methods, overriding the base class method to use async wrappers.""" self._wrapped_methods = { @@ -415,6 +475,34 @@ def _prep_wrapped_messages(self, client_info): default_timeout=60.0, client_info=client_info, ), + self.verify_confidential_space: self._wrap_method( + self.verify_confidential_space, + default_retry=retries.AsyncRetry( + initial=1.0, + maximum=60.0, + multiplier=1.3, + predicate=retries.if_exception_type( + core_exceptions.ServiceUnavailable, + ), + deadline=60.0, + ), + default_timeout=60.0, + client_info=client_info, + ), + self.verify_confidential_gke: self._wrap_method( + self.verify_confidential_gke, + default_retry=retries.AsyncRetry( + initial=1.0, + maximum=60.0, + multiplier=1.3, + predicate=retries.if_exception_type( + core_exceptions.ServiceUnavailable, + ), + deadline=60.0, + ), + default_timeout=60.0, + client_info=client_info, + ), self.get_location: self._wrap_method( self.get_location, default_timeout=None, diff --git a/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest.py b/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest.py index c580012d37d8..f4b10615fa46 100644 --- a/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest.py +++ b/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest.py @@ -89,6 +89,22 @@ def post_verify_attestation(self, response): logging.log(f"Received response: {response}") return response + def pre_verify_confidential_gke(self, request, metadata): + logging.log(f"Received request: {request}") + return request, metadata + + def post_verify_confidential_gke(self, response): + logging.log(f"Received response: {response}") + return response + + def pre_verify_confidential_space(self, request, metadata): + logging.log(f"Received request: {request}") + return request, metadata + + def post_verify_confidential_space(self, response): + logging.log(f"Received response: {response}") + return response + transport = ConfidentialComputingRestTransport(interceptor=MyCustomConfidentialComputingInterceptor()) client = ConfidentialComputingClient(transport=transport) @@ -189,6 +205,106 @@ def post_verify_attestation_with_metadata( """ return response, metadata + def pre_verify_confidential_gke( + self, + request: service.VerifyConfidentialGkeRequest, + metadata: Sequence[Tuple[str, Union[str, bytes]]], + ) -> Tuple[ + service.VerifyConfidentialGkeRequest, Sequence[Tuple[str, Union[str, bytes]]] + ]: + """Pre-rpc interceptor for verify_confidential_gke + + Override in a subclass to manipulate the request or metadata + before they are sent to the ConfidentialComputing server. + """ + return request, metadata + + def post_verify_confidential_gke( + self, response: service.VerifyConfidentialGkeResponse + ) -> service.VerifyConfidentialGkeResponse: + """Post-rpc interceptor for verify_confidential_gke + + DEPRECATED. Please use the `post_verify_confidential_gke_with_metadata` + interceptor instead. + + Override in a subclass to read or manipulate the response + after it is returned by the ConfidentialComputing server but before + it is returned to user code. This `post_verify_confidential_gke` interceptor runs + before the `post_verify_confidential_gke_with_metadata` interceptor. + """ + return response + + def post_verify_confidential_gke_with_metadata( + self, + response: service.VerifyConfidentialGkeResponse, + metadata: Sequence[Tuple[str, Union[str, bytes]]], + ) -> Tuple[ + service.VerifyConfidentialGkeResponse, Sequence[Tuple[str, Union[str, bytes]]] + ]: + """Post-rpc interceptor for verify_confidential_gke + + Override in a subclass to read or manipulate the response or metadata after it + is returned by the ConfidentialComputing server but before it is returned to user code. + + We recommend only using this `post_verify_confidential_gke_with_metadata` + interceptor in new development instead of the `post_verify_confidential_gke` interceptor. + When both interceptors are used, this `post_verify_confidential_gke_with_metadata` interceptor runs after the + `post_verify_confidential_gke` interceptor. The (possibly modified) response returned by + `post_verify_confidential_gke` will be passed to + `post_verify_confidential_gke_with_metadata`. + """ + return response, metadata + + def pre_verify_confidential_space( + self, + request: service.VerifyConfidentialSpaceRequest, + metadata: Sequence[Tuple[str, Union[str, bytes]]], + ) -> Tuple[ + service.VerifyConfidentialSpaceRequest, Sequence[Tuple[str, Union[str, bytes]]] + ]: + """Pre-rpc interceptor for verify_confidential_space + + Override in a subclass to manipulate the request or metadata + before they are sent to the ConfidentialComputing server. + """ + return request, metadata + + def post_verify_confidential_space( + self, response: service.VerifyConfidentialSpaceResponse + ) -> service.VerifyConfidentialSpaceResponse: + """Post-rpc interceptor for verify_confidential_space + + DEPRECATED. Please use the `post_verify_confidential_space_with_metadata` + interceptor instead. + + Override in a subclass to read or manipulate the response + after it is returned by the ConfidentialComputing server but before + it is returned to user code. This `post_verify_confidential_space` interceptor runs + before the `post_verify_confidential_space_with_metadata` interceptor. + """ + return response + + def post_verify_confidential_space_with_metadata( + self, + response: service.VerifyConfidentialSpaceResponse, + metadata: Sequence[Tuple[str, Union[str, bytes]]], + ) -> Tuple[ + service.VerifyConfidentialSpaceResponse, Sequence[Tuple[str, Union[str, bytes]]] + ]: + """Post-rpc interceptor for verify_confidential_space + + Override in a subclass to read or manipulate the response or metadata after it + is returned by the ConfidentialComputing server but before it is returned to user code. + + We recommend only using this `post_verify_confidential_space_with_metadata` + interceptor in new development instead of the `post_verify_confidential_space` interceptor. + When both interceptors are used, this `post_verify_confidential_space_with_metadata` interceptor runs after the + `post_verify_confidential_space` interceptor. The (possibly modified) response returned by + `post_verify_confidential_space` will be passed to + `post_verify_confidential_space_with_metadata`. + """ + return response, metadata + def pre_get_location( self, request: locations_pb2.GetLocationRequest, @@ -525,7 +641,7 @@ def __call__( Args: request (~.service.VerifyAttestationRequest): - The request object. A request for an OIDC token, + The request object. A request for an attestation token, providing all the necessary information needed for this service to verify the platform state of the requestor. @@ -541,7 +657,7 @@ def __call__( ~.service.VerifyAttestationResponse: A response once an attestation has been successfully verified, containing a - signed OIDC token. + signed attestation token. """ @@ -646,6 +762,334 @@ def __call__( ) return resp + class _VerifyConfidentialGke( + _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialGke, + ConfidentialComputingRestStub, + ): + def __hash__(self): + return hash("ConfidentialComputingRestTransport.VerifyConfidentialGke") + + @staticmethod + def _get_response( + host, + metadata, + query_params, + session, + timeout, + transcoded_request, + body=None, + ): + uri = transcoded_request["uri"] + method = transcoded_request["method"] + headers = dict(metadata) + headers["Content-Type"] = "application/json" + response = getattr(session, method)( + "{host}{uri}".format(host=host, uri=uri), + timeout=timeout, + headers=headers, + params=rest_helpers.flatten_query_params(query_params, strict=True), + data=body, + ) + return response + + def __call__( + self, + request: service.VerifyConfidentialGkeRequest, + *, + retry: OptionalRetry = gapic_v1.method.DEFAULT, + timeout: Optional[float] = None, + metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), + ) -> service.VerifyConfidentialGkeResponse: + r"""Call the verify confidential gke method over HTTP. + + Args: + request (~.service.VerifyConfidentialGkeRequest): + The request object. A request for an attestation token, + providing all the necessary information + needed for this service to verify + Confidential GKE platform state of the + requestor. + retry (google.api_core.retry.Retry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + ~.service.VerifyConfidentialGkeResponse: + VerifyConfidentialGkeResponse + response is returened once a + Confidential GKE attestation has been + successfully verified, containing a + signed OIDC token. + + """ + + http_options = ( + _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialGke._get_http_options() + ) + + request, metadata = self._interceptor.pre_verify_confidential_gke( + request, metadata + ) + transcoded_request = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialGke._get_transcoded_request( + http_options, request + ) + + body = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialGke._get_request_body_json( + transcoded_request + ) + + # Jsonify the query params + query_params = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialGke._get_query_params_json( + transcoded_request + ) + + if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor( + logging.DEBUG + ): # pragma: NO COVER + request_url = "{host}{uri}".format( + host=self._host, uri=transcoded_request["uri"] + ) + method = transcoded_request["method"] + try: + request_payload = type(request).to_json(request) + except: + request_payload = None + http_request = { + "payload": request_payload, + "requestMethod": method, + "requestUrl": request_url, + "headers": dict(metadata), + } + _LOGGER.debug( + f"Sending request for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.VerifyConfidentialGke", + extra={ + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": "VerifyConfidentialGke", + "httpRequest": http_request, + "metadata": http_request["headers"], + }, + ) + + # Send the request + response = ( + ConfidentialComputingRestTransport._VerifyConfidentialGke._get_response( + self._host, + metadata, + query_params, + self._session, + timeout, + transcoded_request, + body, + ) + ) + + # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception + # subclass. + if response.status_code >= 400: + raise core_exceptions.from_http_response(response) + + # Return the response + resp = service.VerifyConfidentialGkeResponse() + pb_resp = service.VerifyConfidentialGkeResponse.pb(resp) + + json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True) + + resp = self._interceptor.post_verify_confidential_gke(resp) + response_metadata = [(k, str(v)) for k, v in response.headers.items()] + resp, _ = self._interceptor.post_verify_confidential_gke_with_metadata( + resp, response_metadata + ) + if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor( + logging.DEBUG + ): # pragma: NO COVER + try: + response_payload = service.VerifyConfidentialGkeResponse.to_json( + response + ) + except: + response_payload = None + http_response = { + "payload": response_payload, + "headers": dict(response.headers), + "status": response.status_code, + } + _LOGGER.debug( + "Received response for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.verify_confidential_gke", + extra={ + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": "VerifyConfidentialGke", + "metadata": http_response["headers"], + "httpResponse": http_response, + }, + ) + return resp + + class _VerifyConfidentialSpace( + _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialSpace, + ConfidentialComputingRestStub, + ): + def __hash__(self): + return hash("ConfidentialComputingRestTransport.VerifyConfidentialSpace") + + @staticmethod + def _get_response( + host, + metadata, + query_params, + session, + timeout, + transcoded_request, + body=None, + ): + uri = transcoded_request["uri"] + method = transcoded_request["method"] + headers = dict(metadata) + headers["Content-Type"] = "application/json" + response = getattr(session, method)( + "{host}{uri}".format(host=host, uri=uri), + timeout=timeout, + headers=headers, + params=rest_helpers.flatten_query_params(query_params, strict=True), + data=body, + ) + return response + + def __call__( + self, + request: service.VerifyConfidentialSpaceRequest, + *, + retry: OptionalRetry = gapic_v1.method.DEFAULT, + timeout: Optional[float] = None, + metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), + ) -> service.VerifyConfidentialSpaceResponse: + r"""Call the verify confidential space method over HTTP. + + Args: + request (~.service.VerifyConfidentialSpaceRequest): + The request object. A request for an attestation token, + providing all the necessary information + needed for this service to verify the + platform state of the requestor. + retry (google.api_core.retry.Retry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + ~.service.VerifyConfidentialSpaceResponse: + VerifyConfidentialSpaceResponse is + returned once a Confidential Space + attestation has been successfully + verified, containing a signed token. + + """ + + http_options = ( + _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialSpace._get_http_options() + ) + + request, metadata = self._interceptor.pre_verify_confidential_space( + request, metadata + ) + transcoded_request = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialSpace._get_transcoded_request( + http_options, request + ) + + body = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialSpace._get_request_body_json( + transcoded_request + ) + + # Jsonify the query params + query_params = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialSpace._get_query_params_json( + transcoded_request + ) + + if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor( + logging.DEBUG + ): # pragma: NO COVER + request_url = "{host}{uri}".format( + host=self._host, uri=transcoded_request["uri"] + ) + method = transcoded_request["method"] + try: + request_payload = type(request).to_json(request) + except: + request_payload = None + http_request = { + "payload": request_payload, + "requestMethod": method, + "requestUrl": request_url, + "headers": dict(metadata), + } + _LOGGER.debug( + f"Sending request for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.VerifyConfidentialSpace", + extra={ + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": "VerifyConfidentialSpace", + "httpRequest": http_request, + "metadata": http_request["headers"], + }, + ) + + # Send the request + response = ConfidentialComputingRestTransport._VerifyConfidentialSpace._get_response( + self._host, + metadata, + query_params, + self._session, + timeout, + transcoded_request, + body, + ) + + # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception + # subclass. + if response.status_code >= 400: + raise core_exceptions.from_http_response(response) + + # Return the response + resp = service.VerifyConfidentialSpaceResponse() + pb_resp = service.VerifyConfidentialSpaceResponse.pb(resp) + + json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True) + + resp = self._interceptor.post_verify_confidential_space(resp) + response_metadata = [(k, str(v)) for k, v in response.headers.items()] + resp, _ = self._interceptor.post_verify_confidential_space_with_metadata( + resp, response_metadata + ) + if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor( + logging.DEBUG + ): # pragma: NO COVER + try: + response_payload = service.VerifyConfidentialSpaceResponse.to_json( + response + ) + except: + response_payload = None + http_response = { + "payload": response_payload, + "headers": dict(response.headers), + "status": response.status_code, + } + _LOGGER.debug( + "Received response for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.verify_confidential_space", + extra={ + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": "VerifyConfidentialSpace", + "metadata": http_response["headers"], + "httpResponse": http_response, + }, + ) + return resp + @property def create_challenge( self, @@ -664,6 +1108,27 @@ def verify_attestation( # In C++ this would require a dynamic_cast return self._VerifyAttestation(self._session, self._host, self._interceptor) # type: ignore + @property + def verify_confidential_gke( + self, + ) -> Callable[ + [service.VerifyConfidentialGkeRequest], service.VerifyConfidentialGkeResponse + ]: + # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here. + # In C++ this would require a dynamic_cast + return self._VerifyConfidentialGke(self._session, self._host, self._interceptor) # type: ignore + + @property + def verify_confidential_space( + self, + ) -> Callable[ + [service.VerifyConfidentialSpaceRequest], + service.VerifyConfidentialSpaceResponse, + ]: + # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here. + # In C++ this would require a dynamic_cast + return self._VerifyConfidentialSpace(self._session, self._host, self._interceptor) # type: ignore + @property def get_location(self): return self._GetLocation(self._session, self._host, self._interceptor) # type: ignore diff --git a/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest_base.py b/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest_base.py index 118c5c977bdc..7e04713b4c04 100644 --- a/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest_base.py +++ b/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest_base.py @@ -202,6 +202,120 @@ def _get_query_params_json(transcoded_request): query_params["$alt"] = "json;enum-encoding=int" return query_params + class _BaseVerifyConfidentialGke: + def __hash__(self): # pragma: NO COVER + return NotImplementedError("__hash__ must be implemented.") + + __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = {} + + @classmethod + def _get_unset_required_fields(cls, message_dict): + return { + k: v + for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items() + if k not in message_dict + } + + @staticmethod + def _get_http_options(): + http_options: List[Dict[str, str]] = [ + { + "method": "post", + "uri": "/v1/{challenge=projects/*/locations/*/challenges/*}:verifyConfidentialGke", + "body": "*", + }, + ] + return http_options + + @staticmethod + def _get_transcoded_request(http_options, request): + pb_request = service.VerifyConfidentialGkeRequest.pb(request) + transcoded_request = path_template.transcode(http_options, pb_request) + return transcoded_request + + @staticmethod + def _get_request_body_json(transcoded_request): + # Jsonify the request body + + body = json_format.MessageToJson( + transcoded_request["body"], use_integers_for_enums=True + ) + return body + + @staticmethod + def _get_query_params_json(transcoded_request): + query_params = json.loads( + json_format.MessageToJson( + transcoded_request["query_params"], + use_integers_for_enums=True, + ) + ) + query_params.update( + _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialGke._get_unset_required_fields( + query_params + ) + ) + + query_params["$alt"] = "json;enum-encoding=int" + return query_params + + class _BaseVerifyConfidentialSpace: + def __hash__(self): # pragma: NO COVER + return NotImplementedError("__hash__ must be implemented.") + + __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = {} + + @classmethod + def _get_unset_required_fields(cls, message_dict): + return { + k: v + for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items() + if k not in message_dict + } + + @staticmethod + def _get_http_options(): + http_options: List[Dict[str, str]] = [ + { + "method": "post", + "uri": "/v1/{challenge=projects/*/locations/*/challenges/*}:verifyConfidentialSpace", + "body": "*", + }, + ] + return http_options + + @staticmethod + def _get_transcoded_request(http_options, request): + pb_request = service.VerifyConfidentialSpaceRequest.pb(request) + transcoded_request = path_template.transcode(http_options, pb_request) + return transcoded_request + + @staticmethod + def _get_request_body_json(transcoded_request): + # Jsonify the request body + + body = json_format.MessageToJson( + transcoded_request["body"], use_integers_for_enums=True + ) + return body + + @staticmethod + def _get_query_params_json(transcoded_request): + query_params = json.loads( + json_format.MessageToJson( + transcoded_request["query_params"], + use_integers_for_enums=True, + ) + ) + query_params.update( + _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialSpace._get_unset_required_fields( + query_params + ) + ) + + query_params["$alt"] = "json;enum-encoding=int" + return query_params + class _BaseGetLocation: def __hash__(self): # pragma: NO COVER return NotImplementedError("__hash__ must be implemented.") diff --git a/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/types/__init__.py b/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/types/__init__.py index fda613300f9f..32812c04e204 100644 --- a/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/types/__init__.py +++ b/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/types/__init__.py @@ -14,27 +14,37 @@ # limitations under the License. # from .service import ( + AwsPrincipalTagsOptions, Challenge, ConfidentialSpaceInfo, ContainerImageSignature, CreateChallengeRequest, + GceShieldedIdentity, GcpCredentials, SevSnpAttestation, + SignatureType, SignedEntity, SigningAlgorithm, TdxCcelAttestation, TokenOptions, + TokenProfile, TokenType, TpmAttestation, VerifyAttestationRequest, VerifyAttestationResponse, + VerifyConfidentialGkeRequest, + VerifyConfidentialGkeResponse, + VerifyConfidentialSpaceRequest, + VerifyConfidentialSpaceResponse, ) __all__ = ( + "AwsPrincipalTagsOptions", "Challenge", "ConfidentialSpaceInfo", "ContainerImageSignature", "CreateChallengeRequest", + "GceShieldedIdentity", "GcpCredentials", "SevSnpAttestation", "SignedEntity", @@ -43,6 +53,12 @@ "TpmAttestation", "VerifyAttestationRequest", "VerifyAttestationResponse", + "VerifyConfidentialGkeRequest", + "VerifyConfidentialGkeResponse", + "VerifyConfidentialSpaceRequest", + "VerifyConfidentialSpaceResponse", + "SignatureType", "SigningAlgorithm", + "TokenProfile", "TokenType", ) diff --git a/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/types/service.py b/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/types/service.py index c23bded7fdf0..1a6ecaca8fe3 100644 --- a/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/types/service.py +++ b/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/types/service.py @@ -26,6 +26,8 @@ manifest={ "SigningAlgorithm", "TokenType", + "SignatureType", + "TokenProfile", "Challenge", "CreateChallengeRequest", "VerifyAttestationRequest", @@ -34,10 +36,16 @@ "VerifyAttestationResponse", "GcpCredentials", "TokenOptions", + "AwsPrincipalTagsOptions", "TpmAttestation", "ConfidentialSpaceInfo", "SignedEntity", "ContainerImageSignature", + "VerifyConfidentialSpaceRequest", + "GceShieldedIdentity", + "VerifyConfidentialSpaceResponse", + "VerifyConfidentialGkeRequest", + "VerifyConfidentialGkeResponse", }, ) @@ -86,6 +94,39 @@ class TokenType(proto.Enum): TOKEN_TYPE_AWS_PRINCIPALTAGS = 4 +class SignatureType(proto.Enum): + r"""SignatureType enumerates supported signature types for + attestation tokens. + + Values: + SIGNATURE_TYPE_UNSPECIFIED (0): + Unspecified signature type. + SIGNATURE_TYPE_OIDC (1): + Google OIDC signature. + SIGNATURE_TYPE_PKI (2): + Public Key Infrastructure (PKI) signature. + """ + SIGNATURE_TYPE_UNSPECIFIED = 0 + SIGNATURE_TYPE_OIDC = 1 + SIGNATURE_TYPE_PKI = 2 + + +class TokenProfile(proto.Enum): + r"""TokenProfile enumerates the supported token claims profiles. + + Values: + TOKEN_PROFILE_UNSPECIFIED (0): + Unspecified token profile. + TOKEN_PROFILE_DEFAULT_EAT (1): + EAT claims. + TOKEN_PROFILE_AWS (2): + AWS Principal Tags claims. + """ + TOKEN_PROFILE_UNSPECIFIED = 0 + TOKEN_PROFILE_DEFAULT_EAT = 1 + TOKEN_PROFILE_AWS = 2 + + class Challenge(proto.Message): r"""A Challenge from the server used to guarantee freshness of attestations @@ -160,9 +201,9 @@ class CreateChallengeRequest(proto.Message): class VerifyAttestationRequest(proto.Message): - r"""A request for an OIDC token, providing all the necessary - information needed for this service to verify the platform state - of the requestor. + r"""A request for an attestation token, providing all the + necessary information needed for this service to verify the + platform state of the requestor. This message has `oneof`_ fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. @@ -315,7 +356,7 @@ class SevSnpAttestation(proto.Message): class VerifyAttestationResponse(proto.Message): r"""A response once an attestation has been successfully - verified, containing a signed OIDC token. + verified, containing a signed attestation token. Attributes: oidc_claims_token (str): @@ -361,9 +402,8 @@ class TokenOptions(proto.Message): .. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields Attributes: - aws_principal_tags_options (google.cloud.confidentialcomputing_v1.types.TokenOptions.AwsPrincipalTagsOptions): - Optional. Options for the Limited AWS token - type. + aws_principal_tags_options (google.cloud.confidentialcomputing_v1.types.AwsPrincipalTagsOptions): + Optional. Options for AWS token type. This field is a member of `oneof`_ ``token_type_options``. audience (str): @@ -380,74 +420,75 @@ class TokenOptions(proto.Message): type of token to return. """ - class AwsPrincipalTagsOptions(proto.Message): - r"""Token options that only apply to the AWS Principal Tags token - type. + aws_principal_tags_options: "AwsPrincipalTagsOptions" = proto.Field( + proto.MESSAGE, + number=4, + oneof="token_type_options", + message="AwsPrincipalTagsOptions", + ) + audience: str = proto.Field( + proto.STRING, + number=1, + ) + nonce: MutableSequence[str] = proto.RepeatedField( + proto.STRING, + number=2, + ) + token_type: "TokenType" = proto.Field( + proto.ENUM, + number=3, + enum="TokenType", + ) + + +class AwsPrincipalTagsOptions(proto.Message): + r"""Token options that only apply to the AWS Principal Tags token + type. + + Attributes: + allowed_principal_tags (google.cloud.confidentialcomputing_v1.types.AwsPrincipalTagsOptions.AllowedPrincipalTags): + Optional. Principal tags to allow in the + token. + """ + + class AllowedPrincipalTags(proto.Message): + r"""Allowed principal tags is used to define what principal tags + will be placed in the token. Attributes: - allowed_principal_tags (google.cloud.confidentialcomputing_v1.types.TokenOptions.AwsPrincipalTagsOptions.AllowedPrincipalTags): - Optional. Principal tags to allow in the - token. + container_image_signatures (google.cloud.confidentialcomputing_v1.types.AwsPrincipalTagsOptions.AllowedPrincipalTags.ContainerImageSignatures): + Optional. Container image signatures allowed + in the token. """ - class AllowedPrincipalTags(proto.Message): - r"""Allowed principal tags is used to define what principal tags - will be placed in the token. + class ContainerImageSignatures(proto.Message): + r"""Allowed Container Image Signatures. Key IDs are required to + allow this claim to fit within the narrow AWS IAM restrictions. Attributes: - container_image_signatures (google.cloud.confidentialcomputing_v1.types.TokenOptions.AwsPrincipalTagsOptions.AllowedPrincipalTags.ContainerImageSignatures): - Optional. Container image signatures allowed - in the token. + key_ids (MutableSequence[str]): + Optional. List of key ids to filter into the + Principal tags. Only keys that have been + validated and added to the token will be + filtered into principal tags. Unrecognized key + ids will be ignored. """ - class ContainerImageSignatures(proto.Message): - r"""Allowed Container Image Signatures. Key IDs are required to - allow this claim to fit within the narrow AWS IAM restrictions. - - Attributes: - key_ids (MutableSequence[str]): - Optional. List of key ids to filter into the - Principal tags. Only keys that have been - validated and added to the token will be - filtered into principal tags. Unrecognized key - ids will be ignored. - """ - - key_ids: MutableSequence[str] = proto.RepeatedField( - proto.STRING, - number=1, - ) - - container_image_signatures: "TokenOptions.AwsPrincipalTagsOptions.AllowedPrincipalTags.ContainerImageSignatures" = proto.Field( - proto.MESSAGE, + key_ids: MutableSequence[str] = proto.RepeatedField( + proto.STRING, number=1, - message="TokenOptions.AwsPrincipalTagsOptions.AllowedPrincipalTags.ContainerImageSignatures", ) - allowed_principal_tags: "TokenOptions.AwsPrincipalTagsOptions.AllowedPrincipalTags" = proto.Field( + container_image_signatures: "AwsPrincipalTagsOptions.AllowedPrincipalTags.ContainerImageSignatures" = proto.Field( proto.MESSAGE, number=1, - message="TokenOptions.AwsPrincipalTagsOptions.AllowedPrincipalTags", + message="AwsPrincipalTagsOptions.AllowedPrincipalTags.ContainerImageSignatures", ) - aws_principal_tags_options: AwsPrincipalTagsOptions = proto.Field( + allowed_principal_tags: AllowedPrincipalTags = proto.Field( proto.MESSAGE, - number=4, - oneof="token_type_options", - message=AwsPrincipalTagsOptions, - ) - audience: str = proto.Field( - proto.STRING, number=1, - ) - nonce: MutableSequence[str] = proto.RepeatedField( - proto.STRING, - number=2, - ) - token_type: "TokenType" = proto.Field( - proto.ENUM, - number=3, - enum="TokenType", + message=AllowedPrincipalTags, ) @@ -620,4 +661,255 @@ class ContainerImageSignature(proto.Message): ) +class VerifyConfidentialSpaceRequest(proto.Message): + r"""A request for an attestation token, providing all the + necessary information needed for this service to verify the + platform state of the requestor. + + This message has `oneof`_ fields (mutually exclusive fields). + For each oneof, at most one member field can be set at the same time. + Setting any member of the oneof automatically clears all other + members. + + .. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields + + Attributes: + td_ccel (google.cloud.confidentialcomputing_v1.types.TdxCcelAttestation): + Input only. A TDX with CCEL and RTMR + Attestation Quote. + + This field is a member of `oneof`_ ``tee_attestation``. + tpm_attestation (google.cloud.confidentialcomputing_v1.types.TpmAttestation): + Input only. The TPM-specific data provided by + the attesting platform, used to populate any of + the claims regarding platform state. + + This field is a member of `oneof`_ ``tee_attestation``. + challenge (str): + Required. The name of the Challenge whose nonce was used to + generate the attestation, in the format + ``projects/*/locations/*/challenges/*``. The provided + Challenge will be consumed, and cannot be used again. + gcp_credentials (google.cloud.confidentialcomputing_v1.types.GcpCredentials): + Optional. Credentials used to populate the "emails" claim in + the claims_token. If not present, token will not contain the + "emails" claim. + signed_entities (MutableSequence[google.cloud.confidentialcomputing_v1.types.SignedEntity]): + Optional. A list of signed entities + containing container image signatures that can + be used for server-side signature verification. + gce_shielded_identity (google.cloud.confidentialcomputing_v1.types.GceShieldedIdentity): + Optional. Information about the associated Compute Engine + instance. Required for td_ccel requests only - + tpm_attestation requests will provide this information in + the attestation. + options (google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceRequest.ConfidentialSpaceOptions): + Optional. A collection of fields that modify + the token output. + """ + + class ConfidentialSpaceOptions(proto.Message): + r"""Token options for Confidential Space attestation. + + .. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields + + Attributes: + aws_principal_tags_options (google.cloud.confidentialcomputing_v1.types.AwsPrincipalTagsOptions): + Optional. Options for the AWS token type. + + This field is a member of `oneof`_ ``token_profile_options``. + audience (str): + Optional. Optional string to issue the token + with a custom audience claim. Required if custom + nonces are specified. + token_profile (google.cloud.confidentialcomputing_v1.types.TokenProfile): + Optional. Optional specification for token + claims profile. + nonce (MutableSequence[str]): + Optional. Optional parameter to place one or more nonces in + the eat_nonce claim in the output token. The minimum size + for JSON-encoded EATs is 10 bytes and the maximum size is 74 + bytes. + signature_type (google.cloud.confidentialcomputing_v1.types.SignatureType): + Optional. Optional specification for how to sign the + attestation token. Defaults to SIGNATURE_TYPE_OIDC if + unspecified. + """ + + aws_principal_tags_options: "AwsPrincipalTagsOptions" = proto.Field( + proto.MESSAGE, + number=5, + oneof="token_profile_options", + message="AwsPrincipalTagsOptions", + ) + audience: str = proto.Field( + proto.STRING, + number=1, + ) + token_profile: "TokenProfile" = proto.Field( + proto.ENUM, + number=2, + enum="TokenProfile", + ) + nonce: MutableSequence[str] = proto.RepeatedField( + proto.STRING, + number=3, + ) + signature_type: "SignatureType" = proto.Field( + proto.ENUM, + number=4, + enum="SignatureType", + ) + + td_ccel: "TdxCcelAttestation" = proto.Field( + proto.MESSAGE, + number=3, + oneof="tee_attestation", + message="TdxCcelAttestation", + ) + tpm_attestation: "TpmAttestation" = proto.Field( + proto.MESSAGE, + number=4, + oneof="tee_attestation", + message="TpmAttestation", + ) + challenge: str = proto.Field( + proto.STRING, + number=1, + ) + gcp_credentials: "GcpCredentials" = proto.Field( + proto.MESSAGE, + number=2, + message="GcpCredentials", + ) + signed_entities: MutableSequence["SignedEntity"] = proto.RepeatedField( + proto.MESSAGE, + number=5, + message="SignedEntity", + ) + gce_shielded_identity: "GceShieldedIdentity" = proto.Field( + proto.MESSAGE, + number=6, + message="GceShieldedIdentity", + ) + options: ConfidentialSpaceOptions = proto.Field( + proto.MESSAGE, + number=7, + message=ConfidentialSpaceOptions, + ) + + +class GceShieldedIdentity(proto.Message): + r"""GceShieldedIdentity contains information about a Compute + Engine instance. + + Attributes: + ak_cert (bytes): + Optional. DER-encoded X.509 certificate of + the Attestation Key (otherwise known as an AK or + a TPM restricted signing key) used to generate + the quotes. + ak_cert_chain (MutableSequence[bytes]): + Optional. List of DER-encoded X.509 certificates which, + together with the ak_cert, chain back to a trusted Root + Certificate. + """ + + ak_cert: bytes = proto.Field( + proto.BYTES, + number=1, + ) + ak_cert_chain: MutableSequence[bytes] = proto.RepeatedField( + proto.BYTES, + number=2, + ) + + +class VerifyConfidentialSpaceResponse(proto.Message): + r"""VerifyConfidentialSpaceResponse is returned once a + Confidential Space attestation has been successfully verified, + containing a signed token. + + Attributes: + attestation_token (str): + Output only. The attestation token issued by + this service. It contains specific platform + claims based on the contents of the provided + attestation. + partial_errors (MutableSequence[google.rpc.status_pb2.Status]): + Output only. A list of messages that carry + the partial error details related to + VerifyConfidentialSpace. This field is populated + by errors during container image signature + verification, which may reflect problems in the + provided image signatures. This does not block + the issuing of an attestation token, but the + token will not contain claims for the failed + image signatures. + """ + + attestation_token: str = proto.Field( + proto.STRING, + number=1, + ) + partial_errors: MutableSequence[status_pb2.Status] = proto.RepeatedField( + proto.MESSAGE, + number=2, + message=status_pb2.Status, + ) + + +class VerifyConfidentialGkeRequest(proto.Message): + r"""A request for an attestation token, providing all the + necessary information needed for this service to verify + Confidential GKE platform state of the requestor. + + + .. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields + + Attributes: + tpm_attestation (google.cloud.confidentialcomputing_v1.types.TpmAttestation): + The TPM-specific data provided by the + attesting platform, used to populate any of the + claims regarding platform state. + + This field is a member of `oneof`_ ``tee_attestation``. + challenge (str): + Required. The name of the Challenge whose nonce was used to + generate the attestation, in the format + projects/\ */locations/*/challenges/*. The provided + Challenge will be consumed, and cannot be used again. + """ + + tpm_attestation: "TpmAttestation" = proto.Field( + proto.MESSAGE, + number=2, + oneof="tee_attestation", + message="TpmAttestation", + ) + challenge: str = proto.Field( + proto.STRING, + number=1, + ) + + +class VerifyConfidentialGkeResponse(proto.Message): + r"""VerifyConfidentialGkeResponse response is returened once a + Confidential GKE attestation has been successfully verified, + containing a signed OIDC token. + + Attributes: + attestation_token (str): + Output only. The attestation token issued by + this service for Confidential GKE. It contains + specific platform claims based on the contents + of the provided attestation. + """ + + attestation_token: str = proto.Field( + proto.STRING, + number=1, + ) + + __all__ = tuple(sorted(__protobuf__.manifest)) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_async.py b/packages/google-cloud-confidentialcomputing/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_async.py similarity index 100% rename from owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_async.py rename to packages/google-cloud-confidentialcomputing/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_async.py diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_sync.py b/packages/google-cloud-confidentialcomputing/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_sync.py similarity index 100% rename from owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_sync.py rename to packages/google-cloud-confidentialcomputing/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_sync.py diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_async.py b/packages/google-cloud-confidentialcomputing/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_async.py similarity index 100% rename from owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_async.py rename to packages/google-cloud-confidentialcomputing/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_async.py diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_sync.py b/packages/google-cloud-confidentialcomputing/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_sync.py similarity index 100% rename from owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_sync.py rename to packages/google-cloud-confidentialcomputing/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_sync.py diff --git a/packages/google-cloud-confidentialcomputing/samples/generated_samples/snippet_metadata_google.cloud.confidentialcomputing.v1.json b/packages/google-cloud-confidentialcomputing/samples/generated_samples/snippet_metadata_google.cloud.confidentialcomputing.v1.json index 09c4ea010a47..1994174817f3 100644 --- a/packages/google-cloud-confidentialcomputing/samples/generated_samples/snippet_metadata_google.cloud.confidentialcomputing.v1.json +++ b/packages/google-cloud-confidentialcomputing/samples/generated_samples/snippet_metadata_google.cloud.confidentialcomputing.v1.json @@ -332,6 +332,312 @@ } ], "title": "confidentialcomputing_v1_generated_confidential_computing_verify_attestation_sync.py" + }, + { + "canonical": true, + "clientMethod": { + "async": true, + "client": { + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient", + "shortName": "ConfidentialComputingAsyncClient" + }, + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient.verify_confidential_gke", + "method": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.VerifyConfidentialGke", + "service": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "shortName": "ConfidentialComputing" + }, + "shortName": "VerifyConfidentialGke" + }, + "parameters": [ + { + "name": "request", + "type": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeRequest" + }, + { + "name": "retry", + "type": "google.api_core.retry.Retry" + }, + { + "name": "timeout", + "type": "float" + }, + { + "name": "metadata", + "type": "Sequence[Tuple[str, Union[str, bytes]]]" + } + ], + "resultType": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeResponse", + "shortName": "verify_confidential_gke" + }, + "description": "Sample for VerifyConfidentialGke", + "file": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_async.py", + "language": "PYTHON", + "origin": "API_DEFINITION", + "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialGke_async", + "segments": [ + { + "end": 51, + "start": 27, + "type": "FULL" + }, + { + "end": 51, + "start": 27, + "type": "SHORT" + }, + { + "end": 40, + "start": 38, + "type": "CLIENT_INITIALIZATION" + }, + { + "end": 45, + "start": 41, + "type": "REQUEST_INITIALIZATION" + }, + { + "end": 48, + "start": 46, + "type": "REQUEST_EXECUTION" + }, + { + "end": 52, + "start": 49, + "type": "RESPONSE_HANDLING" + } + ], + "title": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_async.py" + }, + { + "canonical": true, + "clientMethod": { + "client": { + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient", + "shortName": "ConfidentialComputingClient" + }, + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.verify_confidential_gke", + "method": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.VerifyConfidentialGke", + "service": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "shortName": "ConfidentialComputing" + }, + "shortName": "VerifyConfidentialGke" + }, + "parameters": [ + { + "name": "request", + "type": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeRequest" + }, + { + "name": "retry", + "type": "google.api_core.retry.Retry" + }, + { + "name": "timeout", + "type": "float" + }, + { + "name": "metadata", + "type": "Sequence[Tuple[str, Union[str, bytes]]]" + } + ], + "resultType": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeResponse", + "shortName": "verify_confidential_gke" + }, + "description": "Sample for VerifyConfidentialGke", + "file": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_sync.py", + "language": "PYTHON", + "origin": "API_DEFINITION", + "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialGke_sync", + "segments": [ + { + "end": 51, + "start": 27, + "type": "FULL" + }, + { + "end": 51, + "start": 27, + "type": "SHORT" + }, + { + "end": 40, + "start": 38, + "type": "CLIENT_INITIALIZATION" + }, + { + "end": 45, + "start": 41, + "type": "REQUEST_INITIALIZATION" + }, + { + "end": 48, + "start": 46, + "type": "REQUEST_EXECUTION" + }, + { + "end": 52, + "start": 49, + "type": "RESPONSE_HANDLING" + } + ], + "title": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_sync.py" + }, + { + "canonical": true, + "clientMethod": { + "async": true, + "client": { + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient", + "shortName": "ConfidentialComputingAsyncClient" + }, + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient.verify_confidential_space", + "method": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.VerifyConfidentialSpace", + "service": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "shortName": "ConfidentialComputing" + }, + "shortName": "VerifyConfidentialSpace" + }, + "parameters": [ + { + "name": "request", + "type": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceRequest" + }, + { + "name": "retry", + "type": "google.api_core.retry.Retry" + }, + { + "name": "timeout", + "type": "float" + }, + { + "name": "metadata", + "type": "Sequence[Tuple[str, Union[str, bytes]]]" + } + ], + "resultType": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceResponse", + "shortName": "verify_confidential_space" + }, + "description": "Sample for VerifyConfidentialSpace", + "file": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_async.py", + "language": "PYTHON", + "origin": "API_DEFINITION", + "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialSpace_async", + "segments": [ + { + "end": 51, + "start": 27, + "type": "FULL" + }, + { + "end": 51, + "start": 27, + "type": "SHORT" + }, + { + "end": 40, + "start": 38, + "type": "CLIENT_INITIALIZATION" + }, + { + "end": 45, + "start": 41, + "type": "REQUEST_INITIALIZATION" + }, + { + "end": 48, + "start": 46, + "type": "REQUEST_EXECUTION" + }, + { + "end": 52, + "start": 49, + "type": "RESPONSE_HANDLING" + } + ], + "title": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_async.py" + }, + { + "canonical": true, + "clientMethod": { + "client": { + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient", + "shortName": "ConfidentialComputingClient" + }, + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.verify_confidential_space", + "method": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.VerifyConfidentialSpace", + "service": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "shortName": "ConfidentialComputing" + }, + "shortName": "VerifyConfidentialSpace" + }, + "parameters": [ + { + "name": "request", + "type": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceRequest" + }, + { + "name": "retry", + "type": "google.api_core.retry.Retry" + }, + { + "name": "timeout", + "type": "float" + }, + { + "name": "metadata", + "type": "Sequence[Tuple[str, Union[str, bytes]]]" + } + ], + "resultType": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceResponse", + "shortName": "verify_confidential_space" + }, + "description": "Sample for VerifyConfidentialSpace", + "file": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_sync.py", + "language": "PYTHON", + "origin": "API_DEFINITION", + "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialSpace_sync", + "segments": [ + { + "end": 51, + "start": 27, + "type": "FULL" + }, + { + "end": 51, + "start": 27, + "type": "SHORT" + }, + { + "end": 40, + "start": 38, + "type": "CLIENT_INITIALIZATION" + }, + { + "end": 45, + "start": 41, + "type": "REQUEST_INITIALIZATION" + }, + { + "end": 48, + "start": 46, + "type": "REQUEST_EXECUTION" + }, + { + "end": 52, + "start": 49, + "type": "RESPONSE_HANDLING" + } + ], + "title": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_sync.py" } ] } diff --git a/packages/google-cloud-confidentialcomputing/scripts/fixup_confidentialcomputing_v1_keywords.py b/packages/google-cloud-confidentialcomputing/scripts/fixup_confidentialcomputing_v1_keywords.py index 344a4f1c8a8b..6a8e4fb95705 100644 --- a/packages/google-cloud-confidentialcomputing/scripts/fixup_confidentialcomputing_v1_keywords.py +++ b/packages/google-cloud-confidentialcomputing/scripts/fixup_confidentialcomputing_v1_keywords.py @@ -41,6 +41,8 @@ class confidentialcomputingCallTransformer(cst.CSTTransformer): METHOD_TO_PARAMS: Dict[str, Tuple[str]] = { 'create_challenge': ('parent', 'challenge', ), 'verify_attestation': ('challenge', 'tpm_attestation', 'td_ccel', 'sev_snp_attestation', 'gcp_credentials', 'confidential_space_info', 'token_options', 'attester', ), + 'verify_confidential_gke': ('challenge', 'tpm_attestation', ), + 'verify_confidential_space': ('challenge', 'td_ccel', 'tpm_attestation', 'gcp_credentials', 'signed_entities', 'gce_shielded_identity', 'options', ), } def leave_Call(self, original: cst.Call, updated: cst.Call) -> cst.CSTNode: diff --git a/packages/google-cloud-confidentialcomputing/tests/unit/gapic/confidentialcomputing_v1/test_confidential_computing.py b/packages/google-cloud-confidentialcomputing/tests/unit/gapic/confidentialcomputing_v1/test_confidential_computing.py index 930cdc8c9a09..18bdd65dd627 100644 --- a/packages/google-cloud-confidentialcomputing/tests/unit/gapic/confidentialcomputing_v1/test_confidential_computing.py +++ b/packages/google-cloud-confidentialcomputing/tests/unit/gapic/confidentialcomputing_v1/test_confidential_computing.py @@ -1770,13 +1770,81 @@ async def test_verify_attestation_field_headers_async(): ) in kw["metadata"] -def test_create_challenge_rest_use_cached_wrapped_rpc(): +@pytest.mark.parametrize( + "request_type", + [ + service.VerifyConfidentialSpaceRequest, + dict, + ], +) +def test_verify_confidential_space(request_type, transport: str = "grpc"): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport=transport, + ) + + # Everything is optional in proto3 as far as the runtime is concerned, + # and we are mocking out the actual API, so just send an empty request. + request = request_type() + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_space), "__call__" + ) as call: + # Designate an appropriate return value for the call. + call.return_value = service.VerifyConfidentialSpaceResponse( + attestation_token="attestation_token_value", + ) + response = client.verify_confidential_space(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + request = service.VerifyConfidentialSpaceRequest() + assert args[0] == request + + # Establish that the response is the type that we expect. + assert isinstance(response, service.VerifyConfidentialSpaceResponse) + assert response.attestation_token == "attestation_token_value" + + +def test_verify_confidential_space_non_empty_request_with_auto_populated_field(): + # This test is a coverage failsafe to make sure that UUID4 fields are + # automatically populated, according to AIP-4235, with non-empty requests. + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="grpc", + ) + + # Populate all string fields in the request which are not UUID4 + # since we want to check that UUID4 are populated automatically + # if they meet the requirements of AIP 4235. + request = service.VerifyConfidentialSpaceRequest( + challenge="challenge_value", + ) + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_space), "__call__" + ) as call: + call.return_value.name = ( + "foo" # operation_request.operation in compute client(s) expect a string. + ) + client.verify_confidential_space(request=request) + call.assert_called() + _, args, _ = call.mock_calls[0] + assert args[0] == service.VerifyConfidentialSpaceRequest( + challenge="challenge_value", + ) + + +def test_verify_confidential_space_use_cached_wrapped_rpc(): # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, # instead of constructing them on each call with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: client = ConfidentialComputingClient( credentials=ga_credentials.AnonymousCredentials(), - transport="rest", + transport="grpc", ) # Should wrap all calls on client creation @@ -1784,7 +1852,10 @@ def test_create_challenge_rest_use_cached_wrapped_rpc(): wrapper_fn.reset_mock() # Ensure method has been cached - assert client._transport.create_challenge in client._transport._wrapped_methods + assert ( + client._transport.verify_confidential_space + in client._transport._wrapped_methods + ) # Replace cached wrapped function with mock mock_rpc = mock.Mock() @@ -1792,181 +1863,244 @@ def test_create_challenge_rest_use_cached_wrapped_rpc(): "foo" # operation_request.operation in compute client(s) expect a string. ) client._transport._wrapped_methods[ - client._transport.create_challenge + client._transport.verify_confidential_space ] = mock_rpc - request = {} - client.create_challenge(request) + client.verify_confidential_space(request) # Establish that the underlying gRPC stub method was called. assert mock_rpc.call_count == 1 - client.create_challenge(request) + client.verify_confidential_space(request) # Establish that a new wrapper was not created for this call assert wrapper_fn.call_count == 0 assert mock_rpc.call_count == 2 -def test_create_challenge_rest_required_fields( - request_type=service.CreateChallengeRequest, +@pytest.mark.asyncio +async def test_verify_confidential_space_async_use_cached_wrapped_rpc( + transport: str = "grpc_asyncio", ): - transport_class = transports.ConfidentialComputingRestTransport - - request_init = {} - request_init["parent"] = "" - request = request_type(**request_init) - pb_request = request_type.pb(request) - jsonified_request = json.loads( - json_format.MessageToJson(pb_request, use_integers_for_enums=False) - ) - - # verify fields with default values are dropped + # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, + # instead of constructing them on each call + with mock.patch("google.api_core.gapic_v1.method_async.wrap_method") as wrapper_fn: + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport=transport, + ) - unset_fields = transport_class( - credentials=ga_credentials.AnonymousCredentials() - ).create_challenge._get_unset_required_fields(jsonified_request) - jsonified_request.update(unset_fields) + # Should wrap all calls on client creation + assert wrapper_fn.call_count > 0 + wrapper_fn.reset_mock() - # verify required fields with default values are now present + # Ensure method has been cached + assert ( + client._client._transport.verify_confidential_space + in client._client._transport._wrapped_methods + ) - jsonified_request["parent"] = "parent_value" + # Replace cached wrapped function with mock + mock_rpc = mock.AsyncMock() + mock_rpc.return_value = mock.Mock() + client._client._transport._wrapped_methods[ + client._client._transport.verify_confidential_space + ] = mock_rpc - unset_fields = transport_class( - credentials=ga_credentials.AnonymousCredentials() - ).create_challenge._get_unset_required_fields(jsonified_request) - jsonified_request.update(unset_fields) + request = {} + await client.verify_confidential_space(request) - # verify required fields with non-default values are left alone - assert "parent" in jsonified_request - assert jsonified_request["parent"] == "parent_value" + # Establish that the underlying gRPC stub method was called. + assert mock_rpc.call_count == 1 - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest", - ) - request = request_type(**request_init) + await client.verify_confidential_space(request) - # Designate an appropriate value for the returned response. - return_value = service.Challenge() - # Mock the http request call within the method and fake a response. - with mock.patch.object(Session, "request") as req: - # We need to mock transcode() because providing default values - # for required fields will fail the real version if the http_options - # expect actual values for those fields. - with mock.patch.object(path_template, "transcode") as transcode: - # A uri without fields and an empty body will force all the - # request fields to show up in the query_params. - pb_request = request_type.pb(request) - transcode_result = { - "uri": "v1/sample_method", - "method": "post", - "query_params": pb_request, - } - transcode_result["body"] = pb_request - transcode.return_value = transcode_result + # Establish that a new wrapper was not created for this call + assert wrapper_fn.call_count == 0 + assert mock_rpc.call_count == 2 - response_value = Response() - response_value.status_code = 200 - # Convert return value to protobuf type - return_value = service.Challenge.pb(return_value) - json_return_value = json_format.MessageToJson(return_value) +@pytest.mark.asyncio +async def test_verify_confidential_space_async( + transport: str = "grpc_asyncio", request_type=service.VerifyConfidentialSpaceRequest +): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport=transport, + ) - response_value._content = json_return_value.encode("UTF-8") - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + # Everything is optional in proto3 as far as the runtime is concerned, + # and we are mocking out the actual API, so just send an empty request. + request = request_type() - response = client.create_challenge(request) + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_space), "__call__" + ) as call: + # Designate an appropriate return value for the call. + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( + service.VerifyConfidentialSpaceResponse( + attestation_token="attestation_token_value", + ) + ) + response = await client.verify_confidential_space(request) - expected_params = [("$alt", "json;enum-encoding=int")] - actual_params = req.call_args.kwargs["params"] - assert expected_params == actual_params + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) + _, args, _ = call.mock_calls[0] + request = service.VerifyConfidentialSpaceRequest() + assert args[0] == request + # Establish that the response is the type that we expect. + assert isinstance(response, service.VerifyConfidentialSpaceResponse) + assert response.attestation_token == "attestation_token_value" -def test_create_challenge_rest_unset_required_fields(): - transport = transports.ConfidentialComputingRestTransport( - credentials=ga_credentials.AnonymousCredentials - ) - unset_fields = transport.create_challenge._get_unset_required_fields({}) - assert set(unset_fields) == ( - set(()) - & set( - ( - "parent", - "challenge", - ) - ) - ) +@pytest.mark.asyncio +async def test_verify_confidential_space_async_from_dict(): + await test_verify_confidential_space_async(request_type=dict) -def test_create_challenge_rest_flattened(): +def test_verify_confidential_space_field_headers(): client = ConfidentialComputingClient( credentials=ga_credentials.AnonymousCredentials(), - transport="rest", ) - # Mock the http request call within the method and fake a response. - with mock.patch.object(type(client.transport._session), "request") as req: - # Designate an appropriate value for the returned response. - return_value = service.Challenge() - - # get arguments that satisfy an http rule for this method - sample_request = {"parent": "projects/sample1/locations/sample2"} + # Any value that is part of the HTTP/1.1 URI should be sent as + # a field header. Set these to a non-empty value. + request = service.VerifyConfidentialSpaceRequest() - # get truthy value for each flattened field - mock_args = dict( - parent="parent_value", - challenge=service.Challenge(name="name_value"), - ) - mock_args.update(sample_request) + request.challenge = "challenge_value" - # Wrap the value into a proper Response obj - response_value = Response() - response_value.status_code = 200 - # Convert return value to protobuf type - return_value = service.Challenge.pb(return_value) - json_return_value = json_format.MessageToJson(return_value) - response_value._content = json_return_value.encode("UTF-8") - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_space), "__call__" + ) as call: + call.return_value = service.VerifyConfidentialSpaceResponse() + client.verify_confidential_space(request) - client.create_challenge(**mock_args) + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + assert args[0] == request - # Establish that the underlying call was made with the expected - # request object values. - assert len(req.mock_calls) == 1 - _, args, _ = req.mock_calls[0] - assert path_template.validate( - "%s/v1/{parent=projects/*/locations/*}/challenges" % client.transport._host, - args[1], - ) + # Establish that the field header was sent. + _, _, kw = call.mock_calls[0] + assert ( + "x-goog-request-params", + "challenge=challenge_value", + ) in kw["metadata"] -def test_create_challenge_rest_flattened_error(transport: str = "rest"): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport=transport, +@pytest.mark.asyncio +async def test_verify_confidential_space_field_headers_async(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), ) - # Attempting to call a method with both a request object and flattened - # fields is an error. - with pytest.raises(ValueError): - client.create_challenge( - service.CreateChallengeRequest(), - parent="parent_value", - challenge=service.Challenge(name="name_value"), - ) + # Any value that is part of the HTTP/1.1 URI should be sent as + # a field header. Set these to a non-empty value. + request = service.VerifyConfidentialSpaceRequest() + request.challenge = "challenge_value" -def test_verify_attestation_rest_use_cached_wrapped_rpc(): + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_space), "__call__" + ) as call: + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( + service.VerifyConfidentialSpaceResponse() + ) + await client.verify_confidential_space(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the field header was sent. + _, _, kw = call.mock_calls[0] + assert ( + "x-goog-request-params", + "challenge=challenge_value", + ) in kw["metadata"] + + +@pytest.mark.parametrize( + "request_type", + [ + service.VerifyConfidentialGkeRequest, + dict, + ], +) +def test_verify_confidential_gke(request_type, transport: str = "grpc"): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport=transport, + ) + + # Everything is optional in proto3 as far as the runtime is concerned, + # and we are mocking out the actual API, so just send an empty request. + request = request_type() + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_gke), "__call__" + ) as call: + # Designate an appropriate return value for the call. + call.return_value = service.VerifyConfidentialGkeResponse( + attestation_token="attestation_token_value", + ) + response = client.verify_confidential_gke(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + request = service.VerifyConfidentialGkeRequest() + assert args[0] == request + + # Establish that the response is the type that we expect. + assert isinstance(response, service.VerifyConfidentialGkeResponse) + assert response.attestation_token == "attestation_token_value" + + +def test_verify_confidential_gke_non_empty_request_with_auto_populated_field(): + # This test is a coverage failsafe to make sure that UUID4 fields are + # automatically populated, according to AIP-4235, with non-empty requests. + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="grpc", + ) + + # Populate all string fields in the request which are not UUID4 + # since we want to check that UUID4 are populated automatically + # if they meet the requirements of AIP 4235. + request = service.VerifyConfidentialGkeRequest( + challenge="challenge_value", + ) + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_gke), "__call__" + ) as call: + call.return_value.name = ( + "foo" # operation_request.operation in compute client(s) expect a string. + ) + client.verify_confidential_gke(request=request) + call.assert_called() + _, args, _ = call.mock_calls[0] + assert args[0] == service.VerifyConfidentialGkeRequest( + challenge="challenge_value", + ) + + +def test_verify_confidential_gke_use_cached_wrapped_rpc(): # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, # instead of constructing them on each call with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: client = ConfidentialComputingClient( credentials=ga_credentials.AnonymousCredentials(), - transport="rest", + transport="grpc", ) # Should wrap all calls on client creation @@ -1975,7 +2109,8 @@ def test_verify_attestation_rest_use_cached_wrapped_rpc(): # Ensure method has been cached assert ( - client._transport.verify_attestation in client._transport._wrapped_methods + client._transport.verify_confidential_gke + in client._transport._wrapped_methods ) # Replace cached wrapped function with mock @@ -1984,29 +2119,214 @@ def test_verify_attestation_rest_use_cached_wrapped_rpc(): "foo" # operation_request.operation in compute client(s) expect a string. ) client._transport._wrapped_methods[ - client._transport.verify_attestation + client._transport.verify_confidential_gke + ] = mock_rpc + request = {} + client.verify_confidential_gke(request) + + # Establish that the underlying gRPC stub method was called. + assert mock_rpc.call_count == 1 + + client.verify_confidential_gke(request) + + # Establish that a new wrapper was not created for this call + assert wrapper_fn.call_count == 0 + assert mock_rpc.call_count == 2 + + +@pytest.mark.asyncio +async def test_verify_confidential_gke_async_use_cached_wrapped_rpc( + transport: str = "grpc_asyncio", +): + # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, + # instead of constructing them on each call + with mock.patch("google.api_core.gapic_v1.method_async.wrap_method") as wrapper_fn: + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport=transport, + ) + + # Should wrap all calls on client creation + assert wrapper_fn.call_count > 0 + wrapper_fn.reset_mock() + + # Ensure method has been cached + assert ( + client._client._transport.verify_confidential_gke + in client._client._transport._wrapped_methods + ) + + # Replace cached wrapped function with mock + mock_rpc = mock.AsyncMock() + mock_rpc.return_value = mock.Mock() + client._client._transport._wrapped_methods[ + client._client._transport.verify_confidential_gke ] = mock_rpc request = {} - client.verify_attestation(request) + await client.verify_confidential_gke(request) # Establish that the underlying gRPC stub method was called. assert mock_rpc.call_count == 1 - client.verify_attestation(request) + await client.verify_confidential_gke(request) # Establish that a new wrapper was not created for this call assert wrapper_fn.call_count == 0 assert mock_rpc.call_count == 2 -def test_verify_attestation_rest_required_fields( - request_type=service.VerifyAttestationRequest, +@pytest.mark.asyncio +async def test_verify_confidential_gke_async( + transport: str = "grpc_asyncio", request_type=service.VerifyConfidentialGkeRequest +): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport=transport, + ) + + # Everything is optional in proto3 as far as the runtime is concerned, + # and we are mocking out the actual API, so just send an empty request. + request = request_type() + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_gke), "__call__" + ) as call: + # Designate an appropriate return value for the call. + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( + service.VerifyConfidentialGkeResponse( + attestation_token="attestation_token_value", + ) + ) + response = await client.verify_confidential_gke(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) + _, args, _ = call.mock_calls[0] + request = service.VerifyConfidentialGkeRequest() + assert args[0] == request + + # Establish that the response is the type that we expect. + assert isinstance(response, service.VerifyConfidentialGkeResponse) + assert response.attestation_token == "attestation_token_value" + + +@pytest.mark.asyncio +async def test_verify_confidential_gke_async_from_dict(): + await test_verify_confidential_gke_async(request_type=dict) + + +def test_verify_confidential_gke_field_headers(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + ) + + # Any value that is part of the HTTP/1.1 URI should be sent as + # a field header. Set these to a non-empty value. + request = service.VerifyConfidentialGkeRequest() + + request.challenge = "challenge_value" + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_gke), "__call__" + ) as call: + call.return_value = service.VerifyConfidentialGkeResponse() + client.verify_confidential_gke(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the field header was sent. + _, _, kw = call.mock_calls[0] + assert ( + "x-goog-request-params", + "challenge=challenge_value", + ) in kw["metadata"] + + +@pytest.mark.asyncio +async def test_verify_confidential_gke_field_headers_async(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + ) + + # Any value that is part of the HTTP/1.1 URI should be sent as + # a field header. Set these to a non-empty value. + request = service.VerifyConfidentialGkeRequest() + + request.challenge = "challenge_value" + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_gke), "__call__" + ) as call: + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( + service.VerifyConfidentialGkeResponse() + ) + await client.verify_confidential_gke(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the field header was sent. + _, _, kw = call.mock_calls[0] + assert ( + "x-goog-request-params", + "challenge=challenge_value", + ) in kw["metadata"] + + +def test_create_challenge_rest_use_cached_wrapped_rpc(): + # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, + # instead of constructing them on each call + with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", + ) + + # Should wrap all calls on client creation + assert wrapper_fn.call_count > 0 + wrapper_fn.reset_mock() + + # Ensure method has been cached + assert client._transport.create_challenge in client._transport._wrapped_methods + + # Replace cached wrapped function with mock + mock_rpc = mock.Mock() + mock_rpc.return_value.name = ( + "foo" # operation_request.operation in compute client(s) expect a string. + ) + client._transport._wrapped_methods[ + client._transport.create_challenge + ] = mock_rpc + + request = {} + client.create_challenge(request) + + # Establish that the underlying gRPC stub method was called. + assert mock_rpc.call_count == 1 + + client.create_challenge(request) + + # Establish that a new wrapper was not created for this call + assert wrapper_fn.call_count == 0 + assert mock_rpc.call_count == 2 + + +def test_create_challenge_rest_required_fields( + request_type=service.CreateChallengeRequest, ): transport_class = transports.ConfidentialComputingRestTransport request_init = {} - request_init["challenge"] = "" + request_init["parent"] = "" request = request_type(**request_init) pb_request = request_type.pb(request) jsonified_request = json.loads( @@ -2017,21 +2337,21 @@ def test_verify_attestation_rest_required_fields( unset_fields = transport_class( credentials=ga_credentials.AnonymousCredentials() - ).verify_attestation._get_unset_required_fields(jsonified_request) + ).create_challenge._get_unset_required_fields(jsonified_request) jsonified_request.update(unset_fields) # verify required fields with default values are now present - jsonified_request["challenge"] = "challenge_value" + jsonified_request["parent"] = "parent_value" unset_fields = transport_class( credentials=ga_credentials.AnonymousCredentials() - ).verify_attestation._get_unset_required_fields(jsonified_request) + ).create_challenge._get_unset_required_fields(jsonified_request) jsonified_request.update(unset_fields) # verify required fields with non-default values are left alone - assert "challenge" in jsonified_request - assert jsonified_request["challenge"] == "challenge_value" + assert "parent" in jsonified_request + assert jsonified_request["parent"] == "parent_value" client = ConfidentialComputingClient( credentials=ga_credentials.AnonymousCredentials(), @@ -2040,7 +2360,7 @@ def test_verify_attestation_rest_required_fields( request = request_type(**request_init) # Designate an appropriate value for the returned response. - return_value = service.VerifyAttestationResponse() + return_value = service.Challenge() # Mock the http request call within the method and fake a response. with mock.patch.object(Session, "request") as req: # We need to mock transcode() because providing default values @@ -2062,272 +2382,1160 @@ def test_verify_attestation_rest_required_fields( response_value.status_code = 200 # Convert return value to protobuf type - return_value = service.VerifyAttestationResponse.pb(return_value) + return_value = service.Challenge.pb(return_value) json_return_value = json_format.MessageToJson(return_value) response_value._content = json_return_value.encode("UTF-8") req.return_value = response_value req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - response = client.verify_attestation(request) + response = client.create_challenge(request) expected_params = [("$alt", "json;enum-encoding=int")] actual_params = req.call_args.kwargs["params"] assert expected_params == actual_params -def test_verify_attestation_rest_unset_required_fields(): +def test_create_challenge_rest_unset_required_fields(): transport = transports.ConfidentialComputingRestTransport( credentials=ga_credentials.AnonymousCredentials ) - unset_fields = transport.verify_attestation._get_unset_required_fields({}) + unset_fields = transport.create_challenge._get_unset_required_fields({}) assert set(unset_fields) == ( set(()) & set( ( + "parent", "challenge", - "tpmAttestation", ) ) ) -def test_credentials_transport_error(): - # It is an error to provide credentials and a transport instance. - transport = transports.ConfidentialComputingGrpcTransport( +def test_create_challenge_rest_flattened(): + client = ConfidentialComputingClient( credentials=ga_credentials.AnonymousCredentials(), + transport="rest", ) - with pytest.raises(ValueError): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport=transport, + + # Mock the http request call within the method and fake a response. + with mock.patch.object(type(client.transport._session), "request") as req: + # Designate an appropriate value for the returned response. + return_value = service.Challenge() + + # get arguments that satisfy an http rule for this method + sample_request = {"parent": "projects/sample1/locations/sample2"} + + # get truthy value for each flattened field + mock_args = dict( + parent="parent_value", + challenge=service.Challenge(name="name_value"), ) + mock_args.update(sample_request) - # It is an error to provide a credentials file and a transport instance. - transport = transports.ConfidentialComputingGrpcTransport( - credentials=ga_credentials.AnonymousCredentials(), - ) - with pytest.raises(ValueError): - client = ConfidentialComputingClient( - client_options={"credentials_file": "credentials.json"}, - transport=transport, + # Wrap the value into a proper Response obj + response_value = Response() + response_value.status_code = 200 + # Convert return value to protobuf type + return_value = service.Challenge.pb(return_value) + json_return_value = json_format.MessageToJson(return_value) + response_value._content = json_return_value.encode("UTF-8") + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + + client.create_challenge(**mock_args) + + # Establish that the underlying call was made with the expected + # request object values. + assert len(req.mock_calls) == 1 + _, args, _ = req.mock_calls[0] + assert path_template.validate( + "%s/v1/{parent=projects/*/locations/*}/challenges" % client.transport._host, + args[1], ) - # It is an error to provide an api_key and a transport instance. - transport = transports.ConfidentialComputingGrpcTransport( + +def test_create_challenge_rest_flattened_error(transport: str = "rest"): + client = ConfidentialComputingClient( credentials=ga_credentials.AnonymousCredentials(), + transport=transport, ) - options = client_options.ClientOptions() - options.api_key = "api_key" - with pytest.raises(ValueError): - client = ConfidentialComputingClient( - client_options=options, - transport=transport, - ) - # It is an error to provide an api_key and a credential. - options = client_options.ClientOptions() - options.api_key = "api_key" + # Attempting to call a method with both a request object and flattened + # fields is an error. with pytest.raises(ValueError): - client = ConfidentialComputingClient( - client_options=options, credentials=ga_credentials.AnonymousCredentials() + client.create_challenge( + service.CreateChallengeRequest(), + parent="parent_value", + challenge=service.Challenge(name="name_value"), ) - # It is an error to provide scopes and a transport instance. - transport = transports.ConfidentialComputingGrpcTransport( - credentials=ga_credentials.AnonymousCredentials(), - ) - with pytest.raises(ValueError): + +def test_verify_attestation_rest_use_cached_wrapped_rpc(): + # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, + # instead of constructing them on each call + with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: client = ConfidentialComputingClient( - client_options={"scopes": ["1", "2"]}, - transport=transport, + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", ) + # Should wrap all calls on client creation + assert wrapper_fn.call_count > 0 + wrapper_fn.reset_mock() -def test_transport_instance(): - # A client may be instantiated with a custom transport instance. - transport = transports.ConfidentialComputingGrpcTransport( - credentials=ga_credentials.AnonymousCredentials(), - ) - client = ConfidentialComputingClient(transport=transport) - assert client.transport is transport - + # Ensure method has been cached + assert ( + client._transport.verify_attestation in client._transport._wrapped_methods + ) -def test_transport_get_channel(): - # A client may be instantiated with a custom transport instance. - transport = transports.ConfidentialComputingGrpcTransport( - credentials=ga_credentials.AnonymousCredentials(), - ) - channel = transport.grpc_channel - assert channel + # Replace cached wrapped function with mock + mock_rpc = mock.Mock() + mock_rpc.return_value.name = ( + "foo" # operation_request.operation in compute client(s) expect a string. + ) + client._transport._wrapped_methods[ + client._transport.verify_attestation + ] = mock_rpc - transport = transports.ConfidentialComputingGrpcAsyncIOTransport( - credentials=ga_credentials.AnonymousCredentials(), - ) - channel = transport.grpc_channel - assert channel + request = {} + client.verify_attestation(request) + # Establish that the underlying gRPC stub method was called. + assert mock_rpc.call_count == 1 -@pytest.mark.parametrize( - "transport_class", - [ - transports.ConfidentialComputingGrpcTransport, - transports.ConfidentialComputingGrpcAsyncIOTransport, - transports.ConfidentialComputingRestTransport, - ], -) -def test_transport_adc(transport_class): - # Test default credentials are used if not provided. - with mock.patch.object(google.auth, "default") as adc: - adc.return_value = (ga_credentials.AnonymousCredentials(), None) - transport_class() - adc.assert_called_once() + client.verify_attestation(request) + # Establish that a new wrapper was not created for this call + assert wrapper_fn.call_count == 0 + assert mock_rpc.call_count == 2 -def test_transport_kind_grpc(): - transport = ConfidentialComputingClient.get_transport_class("grpc")( - credentials=ga_credentials.AnonymousCredentials() - ) - assert transport.kind == "grpc" +def test_verify_attestation_rest_required_fields( + request_type=service.VerifyAttestationRequest, +): + transport_class = transports.ConfidentialComputingRestTransport -def test_initialize_client_w_grpc(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), transport="grpc" + request_init = {} + request_init["challenge"] = "" + request = request_type(**request_init) + pb_request = request_type.pb(request) + jsonified_request = json.loads( + json_format.MessageToJson(pb_request, use_integers_for_enums=False) ) - assert client is not None + # verify fields with default values are dropped -# This test is a coverage failsafe to make sure that totally empty calls, -# i.e. request == None and no flattened fields passed, work. -def test_create_challenge_empty_call_grpc(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="grpc", - ) + unset_fields = transport_class( + credentials=ga_credentials.AnonymousCredentials() + ).verify_attestation._get_unset_required_fields(jsonified_request) + jsonified_request.update(unset_fields) - # Mock the actual call, and fake the request. - with mock.patch.object(type(client.transport.create_challenge), "__call__") as call: - call.return_value = service.Challenge() - client.create_challenge(request=None) + # verify required fields with default values are now present - # Establish that the underlying stub method was called. - call.assert_called() - _, args, _ = call.mock_calls[0] - request_msg = service.CreateChallengeRequest() + jsonified_request["challenge"] = "challenge_value" - assert args[0] == request_msg + unset_fields = transport_class( + credentials=ga_credentials.AnonymousCredentials() + ).verify_attestation._get_unset_required_fields(jsonified_request) + jsonified_request.update(unset_fields) + # verify required fields with non-default values are left alone + assert "challenge" in jsonified_request + assert jsonified_request["challenge"] == "challenge_value" -# This test is a coverage failsafe to make sure that totally empty calls, -# i.e. request == None and no flattened fields passed, work. -def test_verify_attestation_empty_call_grpc(): client = ConfidentialComputingClient( credentials=ga_credentials.AnonymousCredentials(), - transport="grpc", + transport="rest", ) + request = request_type(**request_init) - # Mock the actual call, and fake the request. - with mock.patch.object( - type(client.transport.verify_attestation), "__call__" - ) as call: - call.return_value = service.VerifyAttestationResponse() - client.verify_attestation(request=None) - - # Establish that the underlying stub method was called. - call.assert_called() - _, args, _ = call.mock_calls[0] - request_msg = service.VerifyAttestationRequest() + # Designate an appropriate value for the returned response. + return_value = service.VerifyAttestationResponse() + # Mock the http request call within the method and fake a response. + with mock.patch.object(Session, "request") as req: + # We need to mock transcode() because providing default values + # for required fields will fail the real version if the http_options + # expect actual values for those fields. + with mock.patch.object(path_template, "transcode") as transcode: + # A uri without fields and an empty body will force all the + # request fields to show up in the query_params. + pb_request = request_type.pb(request) + transcode_result = { + "uri": "v1/sample_method", + "method": "post", + "query_params": pb_request, + } + transcode_result["body"] = pb_request + transcode.return_value = transcode_result - assert args[0] == request_msg + response_value = Response() + response_value.status_code = 200 + # Convert return value to protobuf type + return_value = service.VerifyAttestationResponse.pb(return_value) + json_return_value = json_format.MessageToJson(return_value) -def test_transport_kind_grpc_asyncio(): - transport = ConfidentialComputingAsyncClient.get_transport_class("grpc_asyncio")( - credentials=async_anonymous_credentials() - ) - assert transport.kind == "grpc_asyncio" + response_value._content = json_return_value.encode("UTF-8") + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + response = client.verify_attestation(request) -def test_initialize_client_w_grpc_asyncio(): + expected_params = [("$alt", "json;enum-encoding=int")] + actual_params = req.call_args.kwargs["params"] + assert expected_params == actual_params + + +def test_verify_attestation_rest_unset_required_fields(): + transport = transports.ConfidentialComputingRestTransport( + credentials=ga_credentials.AnonymousCredentials + ) + + unset_fields = transport.verify_attestation._get_unset_required_fields({}) + assert set(unset_fields) == ( + set(()) + & set( + ( + "challenge", + "tpmAttestation", + ) + ) + ) + + +def test_verify_confidential_space_rest_use_cached_wrapped_rpc(): + # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, + # instead of constructing them on each call + with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", + ) + + # Should wrap all calls on client creation + assert wrapper_fn.call_count > 0 + wrapper_fn.reset_mock() + + # Ensure method has been cached + assert ( + client._transport.verify_confidential_space + in client._transport._wrapped_methods + ) + + # Replace cached wrapped function with mock + mock_rpc = mock.Mock() + mock_rpc.return_value.name = ( + "foo" # operation_request.operation in compute client(s) expect a string. + ) + client._transport._wrapped_methods[ + client._transport.verify_confidential_space + ] = mock_rpc + + request = {} + client.verify_confidential_space(request) + + # Establish that the underlying gRPC stub method was called. + assert mock_rpc.call_count == 1 + + client.verify_confidential_space(request) + + # Establish that a new wrapper was not created for this call + assert wrapper_fn.call_count == 0 + assert mock_rpc.call_count == 2 + + +def test_verify_confidential_space_rest_required_fields( + request_type=service.VerifyConfidentialSpaceRequest, +): + transport_class = transports.ConfidentialComputingRestTransport + + request_init = {} + request_init["challenge"] = "" + request = request_type(**request_init) + pb_request = request_type.pb(request) + jsonified_request = json.loads( + json_format.MessageToJson(pb_request, use_integers_for_enums=False) + ) + + # verify fields with default values are dropped + + unset_fields = transport_class( + credentials=ga_credentials.AnonymousCredentials() + ).verify_confidential_space._get_unset_required_fields(jsonified_request) + jsonified_request.update(unset_fields) + + # verify required fields with default values are now present + + jsonified_request["challenge"] = "challenge_value" + + unset_fields = transport_class( + credentials=ga_credentials.AnonymousCredentials() + ).verify_confidential_space._get_unset_required_fields(jsonified_request) + jsonified_request.update(unset_fields) + + # verify required fields with non-default values are left alone + assert "challenge" in jsonified_request + assert jsonified_request["challenge"] == "challenge_value" + + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", + ) + request = request_type(**request_init) + + # Designate an appropriate value for the returned response. + return_value = service.VerifyConfidentialSpaceResponse() + # Mock the http request call within the method and fake a response. + with mock.patch.object(Session, "request") as req: + # We need to mock transcode() because providing default values + # for required fields will fail the real version if the http_options + # expect actual values for those fields. + with mock.patch.object(path_template, "transcode") as transcode: + # A uri without fields and an empty body will force all the + # request fields to show up in the query_params. + pb_request = request_type.pb(request) + transcode_result = { + "uri": "v1/sample_method", + "method": "post", + "query_params": pb_request, + } + transcode_result["body"] = pb_request + transcode.return_value = transcode_result + + response_value = Response() + response_value.status_code = 200 + + # Convert return value to protobuf type + return_value = service.VerifyConfidentialSpaceResponse.pb(return_value) + json_return_value = json_format.MessageToJson(return_value) + + response_value._content = json_return_value.encode("UTF-8") + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + + response = client.verify_confidential_space(request) + + expected_params = [("$alt", "json;enum-encoding=int")] + actual_params = req.call_args.kwargs["params"] + assert expected_params == actual_params + + +def test_verify_confidential_space_rest_unset_required_fields(): + transport = transports.ConfidentialComputingRestTransport( + credentials=ga_credentials.AnonymousCredentials + ) + + unset_fields = transport.verify_confidential_space._get_unset_required_fields({}) + assert set(unset_fields) == (set(()) & set(("challenge",))) + + +def test_verify_confidential_gke_rest_use_cached_wrapped_rpc(): + # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, + # instead of constructing them on each call + with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", + ) + + # Should wrap all calls on client creation + assert wrapper_fn.call_count > 0 + wrapper_fn.reset_mock() + + # Ensure method has been cached + assert ( + client._transport.verify_confidential_gke + in client._transport._wrapped_methods + ) + + # Replace cached wrapped function with mock + mock_rpc = mock.Mock() + mock_rpc.return_value.name = ( + "foo" # operation_request.operation in compute client(s) expect a string. + ) + client._transport._wrapped_methods[ + client._transport.verify_confidential_gke + ] = mock_rpc + + request = {} + client.verify_confidential_gke(request) + + # Establish that the underlying gRPC stub method was called. + assert mock_rpc.call_count == 1 + + client.verify_confidential_gke(request) + + # Establish that a new wrapper was not created for this call + assert wrapper_fn.call_count == 0 + assert mock_rpc.call_count == 2 + + +def test_verify_confidential_gke_rest_required_fields( + request_type=service.VerifyConfidentialGkeRequest, +): + transport_class = transports.ConfidentialComputingRestTransport + + request_init = {} + request_init["challenge"] = "" + request = request_type(**request_init) + pb_request = request_type.pb(request) + jsonified_request = json.loads( + json_format.MessageToJson(pb_request, use_integers_for_enums=False) + ) + + # verify fields with default values are dropped + + unset_fields = transport_class( + credentials=ga_credentials.AnonymousCredentials() + ).verify_confidential_gke._get_unset_required_fields(jsonified_request) + jsonified_request.update(unset_fields) + + # verify required fields with default values are now present + + jsonified_request["challenge"] = "challenge_value" + + unset_fields = transport_class( + credentials=ga_credentials.AnonymousCredentials() + ).verify_confidential_gke._get_unset_required_fields(jsonified_request) + jsonified_request.update(unset_fields) + + # verify required fields with non-default values are left alone + assert "challenge" in jsonified_request + assert jsonified_request["challenge"] == "challenge_value" + + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", + ) + request = request_type(**request_init) + + # Designate an appropriate value for the returned response. + return_value = service.VerifyConfidentialGkeResponse() + # Mock the http request call within the method and fake a response. + with mock.patch.object(Session, "request") as req: + # We need to mock transcode() because providing default values + # for required fields will fail the real version if the http_options + # expect actual values for those fields. + with mock.patch.object(path_template, "transcode") as transcode: + # A uri without fields and an empty body will force all the + # request fields to show up in the query_params. + pb_request = request_type.pb(request) + transcode_result = { + "uri": "v1/sample_method", + "method": "post", + "query_params": pb_request, + } + transcode_result["body"] = pb_request + transcode.return_value = transcode_result + + response_value = Response() + response_value.status_code = 200 + + # Convert return value to protobuf type + return_value = service.VerifyConfidentialGkeResponse.pb(return_value) + json_return_value = json_format.MessageToJson(return_value) + + response_value._content = json_return_value.encode("UTF-8") + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + + response = client.verify_confidential_gke(request) + + expected_params = [("$alt", "json;enum-encoding=int")] + actual_params = req.call_args.kwargs["params"] + assert expected_params == actual_params + + +def test_verify_confidential_gke_rest_unset_required_fields(): + transport = transports.ConfidentialComputingRestTransport( + credentials=ga_credentials.AnonymousCredentials + ) + + unset_fields = transport.verify_confidential_gke._get_unset_required_fields({}) + assert set(unset_fields) == (set(()) & set(("challenge",))) + + +def test_credentials_transport_error(): + # It is an error to provide credentials and a transport instance. + transport = transports.ConfidentialComputingGrpcTransport( + credentials=ga_credentials.AnonymousCredentials(), + ) + with pytest.raises(ValueError): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport=transport, + ) + + # It is an error to provide a credentials file and a transport instance. + transport = transports.ConfidentialComputingGrpcTransport( + credentials=ga_credentials.AnonymousCredentials(), + ) + with pytest.raises(ValueError): + client = ConfidentialComputingClient( + client_options={"credentials_file": "credentials.json"}, + transport=transport, + ) + + # It is an error to provide an api_key and a transport instance. + transport = transports.ConfidentialComputingGrpcTransport( + credentials=ga_credentials.AnonymousCredentials(), + ) + options = client_options.ClientOptions() + options.api_key = "api_key" + with pytest.raises(ValueError): + client = ConfidentialComputingClient( + client_options=options, + transport=transport, + ) + + # It is an error to provide an api_key and a credential. + options = client_options.ClientOptions() + options.api_key = "api_key" + with pytest.raises(ValueError): + client = ConfidentialComputingClient( + client_options=options, credentials=ga_credentials.AnonymousCredentials() + ) + + # It is an error to provide scopes and a transport instance. + transport = transports.ConfidentialComputingGrpcTransport( + credentials=ga_credentials.AnonymousCredentials(), + ) + with pytest.raises(ValueError): + client = ConfidentialComputingClient( + client_options={"scopes": ["1", "2"]}, + transport=transport, + ) + + +def test_transport_instance(): + # A client may be instantiated with a custom transport instance. + transport = transports.ConfidentialComputingGrpcTransport( + credentials=ga_credentials.AnonymousCredentials(), + ) + client = ConfidentialComputingClient(transport=transport) + assert client.transport is transport + + +def test_transport_get_channel(): + # A client may be instantiated with a custom transport instance. + transport = transports.ConfidentialComputingGrpcTransport( + credentials=ga_credentials.AnonymousCredentials(), + ) + channel = transport.grpc_channel + assert channel + + transport = transports.ConfidentialComputingGrpcAsyncIOTransport( + credentials=ga_credentials.AnonymousCredentials(), + ) + channel = transport.grpc_channel + assert channel + + +@pytest.mark.parametrize( + "transport_class", + [ + transports.ConfidentialComputingGrpcTransport, + transports.ConfidentialComputingGrpcAsyncIOTransport, + transports.ConfidentialComputingRestTransport, + ], +) +def test_transport_adc(transport_class): + # Test default credentials are used if not provided. + with mock.patch.object(google.auth, "default") as adc: + adc.return_value = (ga_credentials.AnonymousCredentials(), None) + transport_class() + adc.assert_called_once() + + +def test_transport_kind_grpc(): + transport = ConfidentialComputingClient.get_transport_class("grpc")( + credentials=ga_credentials.AnonymousCredentials() + ) + assert transport.kind == "grpc" + + +def test_initialize_client_w_grpc(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), transport="grpc" + ) + assert client is not None + + +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +def test_create_challenge_empty_call_grpc(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="grpc", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object(type(client.transport.create_challenge), "__call__") as call: + call.return_value = service.Challenge() + client.create_challenge(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.CreateChallengeRequest() + + assert args[0] == request_msg + + +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +def test_verify_attestation_empty_call_grpc(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="grpc", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object( + type(client.transport.verify_attestation), "__call__" + ) as call: + call.return_value = service.VerifyAttestationResponse() + client.verify_attestation(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.VerifyAttestationRequest() + + assert args[0] == request_msg + + +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +def test_verify_confidential_space_empty_call_grpc(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="grpc", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_space), "__call__" + ) as call: + call.return_value = service.VerifyConfidentialSpaceResponse() + client.verify_confidential_space(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.VerifyConfidentialSpaceRequest() + + assert args[0] == request_msg + + +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +def test_verify_confidential_gke_empty_call_grpc(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="grpc", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_gke), "__call__" + ) as call: + call.return_value = service.VerifyConfidentialGkeResponse() + client.verify_confidential_gke(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.VerifyConfidentialGkeRequest() + + assert args[0] == request_msg + + +def test_transport_kind_grpc_asyncio(): + transport = ConfidentialComputingAsyncClient.get_transport_class("grpc_asyncio")( + credentials=async_anonymous_credentials() + ) + assert transport.kind == "grpc_asyncio" + + +def test_initialize_client_w_grpc_asyncio(): client = ConfidentialComputingAsyncClient( credentials=async_anonymous_credentials(), transport="grpc_asyncio" ) - assert client is not None + assert client is not None + + +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +@pytest.mark.asyncio +async def test_create_challenge_empty_call_grpc_asyncio(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport="grpc_asyncio", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object(type(client.transport.create_challenge), "__call__") as call: + # Designate an appropriate return value for the call. + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( + service.Challenge( + name="name_value", + used=True, + tpm_nonce="tpm_nonce_value", + ) + ) + await client.create_challenge(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.CreateChallengeRequest() + + assert args[0] == request_msg + + +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +@pytest.mark.asyncio +async def test_verify_attestation_empty_call_grpc_asyncio(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport="grpc_asyncio", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object( + type(client.transport.verify_attestation), "__call__" + ) as call: + # Designate an appropriate return value for the call. + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( + service.VerifyAttestationResponse( + oidc_claims_token="oidc_claims_token_value", + ) + ) + await client.verify_attestation(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.VerifyAttestationRequest() + + assert args[0] == request_msg + + +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +@pytest.mark.asyncio +async def test_verify_confidential_space_empty_call_grpc_asyncio(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport="grpc_asyncio", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_space), "__call__" + ) as call: + # Designate an appropriate return value for the call. + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( + service.VerifyConfidentialSpaceResponse( + attestation_token="attestation_token_value", + ) + ) + await client.verify_confidential_space(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.VerifyConfidentialSpaceRequest() + + assert args[0] == request_msg + + +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +@pytest.mark.asyncio +async def test_verify_confidential_gke_empty_call_grpc_asyncio(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport="grpc_asyncio", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_gke), "__call__" + ) as call: + # Designate an appropriate return value for the call. + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( + service.VerifyConfidentialGkeResponse( + attestation_token="attestation_token_value", + ) + ) + await client.verify_confidential_gke(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.VerifyConfidentialGkeRequest() + + assert args[0] == request_msg + + +def test_transport_kind_rest(): + transport = ConfidentialComputingClient.get_transport_class("rest")( + credentials=ga_credentials.AnonymousCredentials() + ) + assert transport.kind == "rest" + + +def test_create_challenge_rest_bad_request(request_type=service.CreateChallengeRequest): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), transport="rest" + ) + # send a request that will satisfy transcoding + request_init = {"parent": "projects/sample1/locations/sample2"} + request = request_type(**request_init) + + # Mock the http request call within the method and fake a BadRequest error. + with mock.patch.object(Session, "request") as req, pytest.raises( + core_exceptions.BadRequest + ): + # Wrap the value into a proper Response obj + response_value = mock.Mock() + json_return_value = "" + response_value.json = mock.Mock(return_value={}) + response_value.status_code = 400 + response_value.request = mock.Mock() + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + client.create_challenge(request) + + +@pytest.mark.parametrize( + "request_type", + [ + service.CreateChallengeRequest, + dict, + ], +) +def test_create_challenge_rest_call_success(request_type): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), transport="rest" + ) + + # send a request that will satisfy transcoding + request_init = {"parent": "projects/sample1/locations/sample2"} + request_init["challenge"] = { + "name": "name_value", + "create_time": {"seconds": 751, "nanos": 543}, + "expire_time": {}, + "used": True, + "tpm_nonce": "tpm_nonce_value", + } + # The version of a generated dependency at test runtime may differ from the version used during generation. + # Delete any fields which are not present in the current runtime dependency + # See https://github.com/googleapis/gapic-generator-python/issues/1748 + # Determine if the message type is proto-plus or protobuf + test_field = service.CreateChallengeRequest.meta.fields["challenge"] -# This test is a coverage failsafe to make sure that totally empty calls, -# i.e. request == None and no flattened fields passed, work. -@pytest.mark.asyncio -async def test_create_challenge_empty_call_grpc_asyncio(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - transport="grpc_asyncio", + def get_message_fields(field): + # Given a field which is a message (composite type), return a list with + # all the fields of the message. + # If the field is not a composite type, return an empty list. + message_fields = [] + + if hasattr(field, "message") and field.message: + is_field_type_proto_plus_type = not hasattr(field.message, "DESCRIPTOR") + + if is_field_type_proto_plus_type: + message_fields = field.message.meta.fields.values() + # Add `# pragma: NO COVER` because there may not be any `*_pb2` field types + else: # pragma: NO COVER + message_fields = field.message.DESCRIPTOR.fields + return message_fields + + runtime_nested_fields = [ + (field.name, nested_field.name) + for field in get_message_fields(test_field) + for nested_field in get_message_fields(field) + ] + + subfields_not_in_runtime = [] + + # For each item in the sample request, create a list of sub fields which are not present at runtime + # Add `# pragma: NO COVER` because this test code will not run if all subfields are present at runtime + for field, value in request_init["challenge"].items(): # pragma: NO COVER + result = None + is_repeated = False + # For repeated fields + if isinstance(value, list) and len(value): + is_repeated = True + result = value[0] + # For fields where the type is another message + if isinstance(value, dict): + result = value + + if result and hasattr(result, "keys"): + for subfield in result.keys(): + if (field, subfield) not in runtime_nested_fields: + subfields_not_in_runtime.append( + { + "field": field, + "subfield": subfield, + "is_repeated": is_repeated, + } + ) + + # Remove fields from the sample request which are not present in the runtime version of the dependency + # Add `# pragma: NO COVER` because this test code will not run if all subfields are present at runtime + for subfield_to_delete in subfields_not_in_runtime: # pragma: NO COVER + field = subfield_to_delete.get("field") + field_repeated = subfield_to_delete.get("is_repeated") + subfield = subfield_to_delete.get("subfield") + if subfield: + if field_repeated: + for i in range(0, len(request_init["challenge"][field])): + del request_init["challenge"][field][i][subfield] + else: + del request_init["challenge"][field][subfield] + request = request_type(**request_init) + + # Mock the http request call within the method and fake a response. + with mock.patch.object(type(client.transport._session), "request") as req: + # Designate an appropriate value for the returned response. + return_value = service.Challenge( + name="name_value", + used=True, + tpm_nonce="tpm_nonce_value", + ) + + # Wrap the value into a proper Response obj + response_value = mock.Mock() + response_value.status_code = 200 + + # Convert return value to protobuf type + return_value = service.Challenge.pb(return_value) + json_return_value = json_format.MessageToJson(return_value) + response_value.content = json_return_value.encode("UTF-8") + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + response = client.create_challenge(request) + + # Establish that the response is the type that we expect. + assert isinstance(response, service.Challenge) + assert response.name == "name_value" + assert response.used is True + assert response.tpm_nonce == "tpm_nonce_value" + + +@pytest.mark.parametrize("null_interceptor", [True, False]) +def test_create_challenge_rest_interceptors(null_interceptor): + transport = transports.ConfidentialComputingRestTransport( + credentials=ga_credentials.AnonymousCredentials(), + interceptor=None + if null_interceptor + else transports.ConfidentialComputingRestInterceptor(), ) + client = ConfidentialComputingClient(transport=transport) - # Mock the actual call, and fake the request. - with mock.patch.object(type(client.transport.create_challenge), "__call__") as call: - # Designate an appropriate return value for the call. - call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( - service.Challenge( - name="name_value", - used=True, - tpm_nonce="tpm_nonce_value", - ) + with mock.patch.object( + type(client.transport._session), "request" + ) as req, mock.patch.object( + path_template, "transcode" + ) as transcode, mock.patch.object( + transports.ConfidentialComputingRestInterceptor, "post_create_challenge" + ) as post, mock.patch.object( + transports.ConfidentialComputingRestInterceptor, + "post_create_challenge_with_metadata", + ) as post_with_metadata, mock.patch.object( + transports.ConfidentialComputingRestInterceptor, "pre_create_challenge" + ) as pre: + pre.assert_not_called() + post.assert_not_called() + post_with_metadata.assert_not_called() + pb_message = service.CreateChallengeRequest.pb(service.CreateChallengeRequest()) + transcode.return_value = { + "method": "post", + "uri": "my_uri", + "body": pb_message, + "query_params": pb_message, + } + + req.return_value = mock.Mock() + req.return_value.status_code = 200 + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + return_value = service.Challenge.to_json(service.Challenge()) + req.return_value.content = return_value + + request = service.CreateChallengeRequest() + metadata = [ + ("key", "val"), + ("cephalopod", "squid"), + ] + pre.return_value = request, metadata + post.return_value = service.Challenge() + post_with_metadata.return_value = service.Challenge(), metadata + + client.create_challenge( + request, + metadata=[ + ("key", "val"), + ("cephalopod", "squid"), + ], ) - await client.create_challenge(request=None) - # Establish that the underlying stub method was called. - call.assert_called() - _, args, _ = call.mock_calls[0] - request_msg = service.CreateChallengeRequest() + pre.assert_called_once() + post.assert_called_once() + post_with_metadata.assert_called_once() + + +def test_verify_attestation_rest_bad_request( + request_type=service.VerifyAttestationRequest, +): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), transport="rest" + ) + # send a request that will satisfy transcoding + request_init = { + "challenge": "projects/sample1/locations/sample2/challenges/sample3" + } + request = request_type(**request_init) + + # Mock the http request call within the method and fake a BadRequest error. + with mock.patch.object(Session, "request") as req, pytest.raises( + core_exceptions.BadRequest + ): + # Wrap the value into a proper Response obj + response_value = mock.Mock() + json_return_value = "" + response_value.json = mock.Mock(return_value={}) + response_value.status_code = 400 + response_value.request = mock.Mock() + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + client.verify_attestation(request) + + +@pytest.mark.parametrize( + "request_type", + [ + service.VerifyAttestationRequest, + dict, + ], +) +def test_verify_attestation_rest_call_success(request_type): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), transport="rest" + ) + + # send a request that will satisfy transcoding + request_init = { + "challenge": "projects/sample1/locations/sample2/challenges/sample3" + } + request = request_type(**request_init) + + # Mock the http request call within the method and fake a response. + with mock.patch.object(type(client.transport._session), "request") as req: + # Designate an appropriate value for the returned response. + return_value = service.VerifyAttestationResponse( + oidc_claims_token="oidc_claims_token_value", + ) + + # Wrap the value into a proper Response obj + response_value = mock.Mock() + response_value.status_code = 200 + + # Convert return value to protobuf type + return_value = service.VerifyAttestationResponse.pb(return_value) + json_return_value = json_format.MessageToJson(return_value) + response_value.content = json_return_value.encode("UTF-8") + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + response = client.verify_attestation(request) - assert args[0] == request_msg + # Establish that the response is the type that we expect. + assert isinstance(response, service.VerifyAttestationResponse) + assert response.oidc_claims_token == "oidc_claims_token_value" -# This test is a coverage failsafe to make sure that totally empty calls, -# i.e. request == None and no flattened fields passed, work. -@pytest.mark.asyncio -async def test_verify_attestation_empty_call_grpc_asyncio(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - transport="grpc_asyncio", +@pytest.mark.parametrize("null_interceptor", [True, False]) +def test_verify_attestation_rest_interceptors(null_interceptor): + transport = transports.ConfidentialComputingRestTransport( + credentials=ga_credentials.AnonymousCredentials(), + interceptor=None + if null_interceptor + else transports.ConfidentialComputingRestInterceptor(), ) + client = ConfidentialComputingClient(transport=transport) - # Mock the actual call, and fake the request. with mock.patch.object( - type(client.transport.verify_attestation), "__call__" - ) as call: - # Designate an appropriate return value for the call. - call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( - service.VerifyAttestationResponse( - oidc_claims_token="oidc_claims_token_value", - ) + type(client.transport._session), "request" + ) as req, mock.patch.object( + path_template, "transcode" + ) as transcode, mock.patch.object( + transports.ConfidentialComputingRestInterceptor, "post_verify_attestation" + ) as post, mock.patch.object( + transports.ConfidentialComputingRestInterceptor, + "post_verify_attestation_with_metadata", + ) as post_with_metadata, mock.patch.object( + transports.ConfidentialComputingRestInterceptor, "pre_verify_attestation" + ) as pre: + pre.assert_not_called() + post.assert_not_called() + post_with_metadata.assert_not_called() + pb_message = service.VerifyAttestationRequest.pb( + service.VerifyAttestationRequest() ) - await client.verify_attestation(request=None) + transcode.return_value = { + "method": "post", + "uri": "my_uri", + "body": pb_message, + "query_params": pb_message, + } - # Establish that the underlying stub method was called. - call.assert_called() - _, args, _ = call.mock_calls[0] - request_msg = service.VerifyAttestationRequest() + req.return_value = mock.Mock() + req.return_value.status_code = 200 + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + return_value = service.VerifyAttestationResponse.to_json( + service.VerifyAttestationResponse() + ) + req.return_value.content = return_value - assert args[0] == request_msg + request = service.VerifyAttestationRequest() + metadata = [ + ("key", "val"), + ("cephalopod", "squid"), + ] + pre.return_value = request, metadata + post.return_value = service.VerifyAttestationResponse() + post_with_metadata.return_value = service.VerifyAttestationResponse(), metadata + client.verify_attestation( + request, + metadata=[ + ("key", "val"), + ("cephalopod", "squid"), + ], + ) -def test_transport_kind_rest(): - transport = ConfidentialComputingClient.get_transport_class("rest")( - credentials=ga_credentials.AnonymousCredentials() - ) - assert transport.kind == "rest" + pre.assert_called_once() + post.assert_called_once() + post_with_metadata.assert_called_once() -def test_create_challenge_rest_bad_request(request_type=service.CreateChallengeRequest): +def test_verify_confidential_space_rest_bad_request( + request_type=service.VerifyConfidentialSpaceRequest, +): client = ConfidentialComputingClient( credentials=ga_credentials.AnonymousCredentials(), transport="rest" ) # send a request that will satisfy transcoding - request_init = {"parent": "projects/sample1/locations/sample2"} + request_init = { + "challenge": "projects/sample1/locations/sample2/challenges/sample3" + } request = request_type(**request_init) # Mock the http request call within the method and fake a BadRequest error. @@ -2342,106 +3550,32 @@ def test_create_challenge_rest_bad_request(request_type=service.CreateChallengeR response_value.request = mock.Mock() req.return_value = response_value req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - client.create_challenge(request) + client.verify_confidential_space(request) @pytest.mark.parametrize( "request_type", [ - service.CreateChallengeRequest, + service.VerifyConfidentialSpaceRequest, dict, ], ) -def test_create_challenge_rest_call_success(request_type): +def test_verify_confidential_space_rest_call_success(request_type): client = ConfidentialComputingClient( credentials=ga_credentials.AnonymousCredentials(), transport="rest" ) # send a request that will satisfy transcoding - request_init = {"parent": "projects/sample1/locations/sample2"} - request_init["challenge"] = { - "name": "name_value", - "create_time": {"seconds": 751, "nanos": 543}, - "expire_time": {}, - "used": True, - "tpm_nonce": "tpm_nonce_value", + request_init = { + "challenge": "projects/sample1/locations/sample2/challenges/sample3" } - # The version of a generated dependency at test runtime may differ from the version used during generation. - # Delete any fields which are not present in the current runtime dependency - # See https://github.com/googleapis/gapic-generator-python/issues/1748 - - # Determine if the message type is proto-plus or protobuf - test_field = service.CreateChallengeRequest.meta.fields["challenge"] - - def get_message_fields(field): - # Given a field which is a message (composite type), return a list with - # all the fields of the message. - # If the field is not a composite type, return an empty list. - message_fields = [] - - if hasattr(field, "message") and field.message: - is_field_type_proto_plus_type = not hasattr(field.message, "DESCRIPTOR") - - if is_field_type_proto_plus_type: - message_fields = field.message.meta.fields.values() - # Add `# pragma: NO COVER` because there may not be any `*_pb2` field types - else: # pragma: NO COVER - message_fields = field.message.DESCRIPTOR.fields - return message_fields - - runtime_nested_fields = [ - (field.name, nested_field.name) - for field in get_message_fields(test_field) - for nested_field in get_message_fields(field) - ] - - subfields_not_in_runtime = [] - - # For each item in the sample request, create a list of sub fields which are not present at runtime - # Add `# pragma: NO COVER` because this test code will not run if all subfields are present at runtime - for field, value in request_init["challenge"].items(): # pragma: NO COVER - result = None - is_repeated = False - # For repeated fields - if isinstance(value, list) and len(value): - is_repeated = True - result = value[0] - # For fields where the type is another message - if isinstance(value, dict): - result = value - - if result and hasattr(result, "keys"): - for subfield in result.keys(): - if (field, subfield) not in runtime_nested_fields: - subfields_not_in_runtime.append( - { - "field": field, - "subfield": subfield, - "is_repeated": is_repeated, - } - ) - - # Remove fields from the sample request which are not present in the runtime version of the dependency - # Add `# pragma: NO COVER` because this test code will not run if all subfields are present at runtime - for subfield_to_delete in subfields_not_in_runtime: # pragma: NO COVER - field = subfield_to_delete.get("field") - field_repeated = subfield_to_delete.get("is_repeated") - subfield = subfield_to_delete.get("subfield") - if subfield: - if field_repeated: - for i in range(0, len(request_init["challenge"][field])): - del request_init["challenge"][field][i][subfield] - else: - del request_init["challenge"][field][subfield] request = request_type(**request_init) # Mock the http request call within the method and fake a response. with mock.patch.object(type(client.transport._session), "request") as req: # Designate an appropriate value for the returned response. - return_value = service.Challenge( - name="name_value", - used=True, - tpm_nonce="tpm_nonce_value", + return_value = service.VerifyConfidentialSpaceResponse( + attestation_token="attestation_token_value", ) # Wrap the value into a proper Response obj @@ -2449,22 +3583,20 @@ def get_message_fields(field): response_value.status_code = 200 # Convert return value to protobuf type - return_value = service.Challenge.pb(return_value) + return_value = service.VerifyConfidentialSpaceResponse.pb(return_value) json_return_value = json_format.MessageToJson(return_value) response_value.content = json_return_value.encode("UTF-8") req.return_value = response_value req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - response = client.create_challenge(request) + response = client.verify_confidential_space(request) # Establish that the response is the type that we expect. - assert isinstance(response, service.Challenge) - assert response.name == "name_value" - assert response.used is True - assert response.tpm_nonce == "tpm_nonce_value" + assert isinstance(response, service.VerifyConfidentialSpaceResponse) + assert response.attestation_token == "attestation_token_value" @pytest.mark.parametrize("null_interceptor", [True, False]) -def test_create_challenge_rest_interceptors(null_interceptor): +def test_verify_confidential_space_rest_interceptors(null_interceptor): transport = transports.ConfidentialComputingRestTransport( credentials=ga_credentials.AnonymousCredentials(), interceptor=None @@ -2478,17 +3610,20 @@ def test_create_challenge_rest_interceptors(null_interceptor): ) as req, mock.patch.object( path_template, "transcode" ) as transcode, mock.patch.object( - transports.ConfidentialComputingRestInterceptor, "post_create_challenge" + transports.ConfidentialComputingRestInterceptor, + "post_verify_confidential_space", ) as post, mock.patch.object( transports.ConfidentialComputingRestInterceptor, - "post_create_challenge_with_metadata", + "post_verify_confidential_space_with_metadata", ) as post_with_metadata, mock.patch.object( - transports.ConfidentialComputingRestInterceptor, "pre_create_challenge" + transports.ConfidentialComputingRestInterceptor, "pre_verify_confidential_space" ) as pre: pre.assert_not_called() post.assert_not_called() post_with_metadata.assert_not_called() - pb_message = service.CreateChallengeRequest.pb(service.CreateChallengeRequest()) + pb_message = service.VerifyConfidentialSpaceRequest.pb( + service.VerifyConfidentialSpaceRequest() + ) transcode.return_value = { "method": "post", "uri": "my_uri", @@ -2499,19 +3634,24 @@ def test_create_challenge_rest_interceptors(null_interceptor): req.return_value = mock.Mock() req.return_value.status_code = 200 req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - return_value = service.Challenge.to_json(service.Challenge()) + return_value = service.VerifyConfidentialSpaceResponse.to_json( + service.VerifyConfidentialSpaceResponse() + ) req.return_value.content = return_value - request = service.CreateChallengeRequest() + request = service.VerifyConfidentialSpaceRequest() metadata = [ ("key", "val"), ("cephalopod", "squid"), ] pre.return_value = request, metadata - post.return_value = service.Challenge() - post_with_metadata.return_value = service.Challenge(), metadata + post.return_value = service.VerifyConfidentialSpaceResponse() + post_with_metadata.return_value = ( + service.VerifyConfidentialSpaceResponse(), + metadata, + ) - client.create_challenge( + client.verify_confidential_space( request, metadata=[ ("key", "val"), @@ -2524,8 +3664,8 @@ def test_create_challenge_rest_interceptors(null_interceptor): post_with_metadata.assert_called_once() -def test_verify_attestation_rest_bad_request( - request_type=service.VerifyAttestationRequest, +def test_verify_confidential_gke_rest_bad_request( + request_type=service.VerifyConfidentialGkeRequest, ): client = ConfidentialComputingClient( credentials=ga_credentials.AnonymousCredentials(), transport="rest" @@ -2548,17 +3688,17 @@ def test_verify_attestation_rest_bad_request( response_value.request = mock.Mock() req.return_value = response_value req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - client.verify_attestation(request) + client.verify_confidential_gke(request) @pytest.mark.parametrize( "request_type", [ - service.VerifyAttestationRequest, + service.VerifyConfidentialGkeRequest, dict, ], ) -def test_verify_attestation_rest_call_success(request_type): +def test_verify_confidential_gke_rest_call_success(request_type): client = ConfidentialComputingClient( credentials=ga_credentials.AnonymousCredentials(), transport="rest" ) @@ -2572,8 +3712,8 @@ def test_verify_attestation_rest_call_success(request_type): # Mock the http request call within the method and fake a response. with mock.patch.object(type(client.transport._session), "request") as req: # Designate an appropriate value for the returned response. - return_value = service.VerifyAttestationResponse( - oidc_claims_token="oidc_claims_token_value", + return_value = service.VerifyConfidentialGkeResponse( + attestation_token="attestation_token_value", ) # Wrap the value into a proper Response obj @@ -2581,20 +3721,20 @@ def test_verify_attestation_rest_call_success(request_type): response_value.status_code = 200 # Convert return value to protobuf type - return_value = service.VerifyAttestationResponse.pb(return_value) + return_value = service.VerifyConfidentialGkeResponse.pb(return_value) json_return_value = json_format.MessageToJson(return_value) response_value.content = json_return_value.encode("UTF-8") req.return_value = response_value req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - response = client.verify_attestation(request) + response = client.verify_confidential_gke(request) # Establish that the response is the type that we expect. - assert isinstance(response, service.VerifyAttestationResponse) - assert response.oidc_claims_token == "oidc_claims_token_value" + assert isinstance(response, service.VerifyConfidentialGkeResponse) + assert response.attestation_token == "attestation_token_value" @pytest.mark.parametrize("null_interceptor", [True, False]) -def test_verify_attestation_rest_interceptors(null_interceptor): +def test_verify_confidential_gke_rest_interceptors(null_interceptor): transport = transports.ConfidentialComputingRestTransport( credentials=ga_credentials.AnonymousCredentials(), interceptor=None @@ -2608,18 +3748,18 @@ def test_verify_attestation_rest_interceptors(null_interceptor): ) as req, mock.patch.object( path_template, "transcode" ) as transcode, mock.patch.object( - transports.ConfidentialComputingRestInterceptor, "post_verify_attestation" + transports.ConfidentialComputingRestInterceptor, "post_verify_confidential_gke" ) as post, mock.patch.object( transports.ConfidentialComputingRestInterceptor, - "post_verify_attestation_with_metadata", + "post_verify_confidential_gke_with_metadata", ) as post_with_metadata, mock.patch.object( - transports.ConfidentialComputingRestInterceptor, "pre_verify_attestation" + transports.ConfidentialComputingRestInterceptor, "pre_verify_confidential_gke" ) as pre: pre.assert_not_called() post.assert_not_called() post_with_metadata.assert_not_called() - pb_message = service.VerifyAttestationRequest.pb( - service.VerifyAttestationRequest() + pb_message = service.VerifyConfidentialGkeRequest.pb( + service.VerifyConfidentialGkeRequest() ) transcode.return_value = { "method": "post", @@ -2631,21 +3771,24 @@ def test_verify_attestation_rest_interceptors(null_interceptor): req.return_value = mock.Mock() req.return_value.status_code = 200 req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - return_value = service.VerifyAttestationResponse.to_json( - service.VerifyAttestationResponse() + return_value = service.VerifyConfidentialGkeResponse.to_json( + service.VerifyConfidentialGkeResponse() ) req.return_value.content = return_value - request = service.VerifyAttestationRequest() + request = service.VerifyConfidentialGkeRequest() metadata = [ ("key", "val"), ("cephalopod", "squid"), ] pre.return_value = request, metadata - post.return_value = service.VerifyAttestationResponse() - post_with_metadata.return_value = service.VerifyAttestationResponse(), metadata + post.return_value = service.VerifyConfidentialGkeResponse() + post_with_metadata.return_value = ( + service.VerifyConfidentialGkeResponse(), + metadata, + ) - client.verify_attestation( + client.verify_confidential_gke( request, metadata=[ ("key", "val"), @@ -2827,6 +3970,50 @@ def test_verify_attestation_empty_call_rest(): assert args[0] == request_msg +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +def test_verify_confidential_space_empty_call_rest(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_space), "__call__" + ) as call: + client.verify_confidential_space(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.VerifyConfidentialSpaceRequest() + + assert args[0] == request_msg + + +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +def test_verify_confidential_gke_empty_call_rest(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_gke), "__call__" + ) as call: + client.verify_confidential_gke(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.VerifyConfidentialGkeRequest() + + assert args[0] == request_msg + + def test_transport_grpc_default(): # A client should use the gRPC transport by default. client = ConfidentialComputingClient( @@ -2862,6 +4049,8 @@ def test_confidential_computing_base_transport(): methods = ( "create_challenge", "verify_attestation", + "verify_confidential_space", + "verify_confidential_gke", "get_location", "list_locations", ) @@ -3130,6 +4319,12 @@ def test_confidential_computing_client_transport_session_collision(transport_nam session1 = client1.transport.verify_attestation._session session2 = client2.transport.verify_attestation._session assert session1 != session2 + session1 = client1.transport.verify_confidential_space._session + session2 = client2.transport.verify_confidential_space._session + assert session1 != session2 + session1 = client1.transport.verify_confidential_gke._session + session2 = client2.transport.verify_confidential_gke._session + assert session1 != session2 def test_confidential_computing_grpc_transport_channel(): From df57aedea1fe1988649c3d6556d9b1356db78217 Mon Sep 17 00:00:00 2001 From: Owl Bot Date: Tue, 2 Sep 2025 20:25:09 +0000 Subject: [PATCH 3/4] chore: Update gapic-generator-python to 1.26.2 PiperOrigin-RevId: 802200836 Source-Link: https://github.com/googleapis/googleapis/commit/d300b151a973ce0425ae4ad07b3de957ca31bec6 Source-Link: https://github.com/googleapis/googleapis-gen/commit/a1ff0ae72ddcb68a259215d8c77661e2cdbb9b02 Copy-Tag: eyJwIjoicGFja2FnZXMvZ29vZ2xlLWNsb3VkLWNvbmZpZGVudGlhbGNvbXB1dGluZy8uT3dsQm90LnlhbWwiLCJoIjoiYTFmZjBhZTcyZGRjYjY4YTI1OTIxNWQ4Yzc3NjYxZTJjZGJiOWIwMiJ9 --- .../v1/.coveragerc | 13 + .../v1/.flake8 | 34 + .../v1/LICENSE | 202 + .../v1/MANIFEST.in | 20 + .../v1/README.rst | 143 + .../v1/docs/_static/custom.css | 20 + .../v1/docs/_templates/layout.html | 50 + .../v1/docs/conf.py | 385 ++ .../confidential_computing.rst | 6 + .../confidentialcomputing_v1/services_.rst | 6 + .../docs/confidentialcomputing_v1/types_.rst | 6 + .../v1/docs/index.rst | 10 + .../v1/docs/multiprocessing.rst | 7 + .../cloud/confidentialcomputing/__init__.py | 71 + .../confidentialcomputing/gapic_version.py | 16 + .../cloud/confidentialcomputing/py.typed | 2 + .../confidentialcomputing_v1/__init__.py | 72 + .../gapic_metadata.json | 88 + .../confidentialcomputing_v1/gapic_version.py | 16 + .../cloud/confidentialcomputing_v1/py.typed | 2 + .../services/__init__.py | 15 + .../confidential_computing/__init__.py | 22 + .../confidential_computing/async_client.py | 760 +++ .../services/confidential_computing/client.py | 1123 +++++ .../transports/README.rst | 9 + .../transports/__init__.py | 38 + .../confidential_computing/transports/base.py | 264 ++ .../confidential_computing/transports/grpc.py | 465 ++ .../transports/grpc_asyncio.py | 547 +++ .../confidential_computing/transports/rest.py | 1179 +++++ .../transports/rest_base.py | 330 ++ .../types/__init__.py | 64 + .../confidentialcomputing_v1/types/service.py | 915 ++++ .../v1/mypy.ini | 3 + .../v1/noxfile.py | 591 +++ ...ential_computing_create_challenge_async.py | 52 + ...dential_computing_create_challenge_sync.py | 52 + ...tial_computing_verify_attestation_async.py | 52 + ...ntial_computing_verify_attestation_sync.py | 52 + ...computing_verify_confidential_gke_async.py | 52 + ..._computing_verify_confidential_gke_sync.py | 52 + ...mputing_verify_confidential_space_async.py | 52 + ...omputing_verify_confidential_space_sync.py | 52 + ...google.cloud.confidentialcomputing.v1.json | 643 +++ ...fixup_confidentialcomputing_v1_keywords.py | 179 + .../v1/setup.py | 98 + .../v1/testing/constraints-3.10.txt | 6 + .../v1/testing/constraints-3.11.txt | 6 + .../v1/testing/constraints-3.12.txt | 6 + .../v1/testing/constraints-3.13.txt | 11 + .../v1/testing/constraints-3.7.txt | 10 + .../v1/testing/constraints-3.8.txt | 6 + .../v1/testing/constraints-3.9.txt | 6 + .../v1/tests/__init__.py | 16 + .../v1/tests/unit/__init__.py | 16 + .../v1/tests/unit/gapic/__init__.py | 16 + .../confidentialcomputing_v1/__init__.py | 16 + .../test_confidential_computing.py | 4165 +++++++++++++++++ 58 files changed, 13110 insertions(+) create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/.coveragerc create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/.flake8 create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/LICENSE create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/MANIFEST.in create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/README.rst create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/_static/custom.css create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/_templates/layout.html create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/conf.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/confidential_computing.rst create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/services_.rst create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/types_.rst create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/index.rst create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/multiprocessing.rst create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/__init__.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/gapic_version.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/py.typed create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/__init__.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/gapic_metadata.json create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/gapic_version.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/py.typed create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/__init__.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/__init__.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/async_client.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/client.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/README.rst create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/__init__.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/base.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc_asyncio.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest_base.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/types/__init__.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/types/service.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/mypy.ini create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/noxfile.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_create_challenge_async.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_create_challenge_sync.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_attestation_async.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_attestation_sync.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_async.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_sync.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_async.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_sync.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/snippet_metadata_google.cloud.confidentialcomputing.v1.json create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/scripts/fixup_confidentialcomputing_v1_keywords.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/setup.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.10.txt create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.11.txt create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.12.txt create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.13.txt create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.7.txt create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.8.txt create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.9.txt create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/__init__.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/__init__.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/__init__.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/confidentialcomputing_v1/__init__.py create mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/confidentialcomputing_v1/test_confidential_computing.py diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/.coveragerc b/owl-bot-staging/google-cloud-confidentialcomputing/v1/.coveragerc new file mode 100644 index 000000000000..ecca1f30bedc --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/.coveragerc @@ -0,0 +1,13 @@ +[run] +branch = True + +[report] +show_missing = True +omit = + google/cloud/confidentialcomputing/__init__.py + google/cloud/confidentialcomputing/gapic_version.py +exclude_lines = + # Re-enable the standard pragma + pragma: NO COVER + # Ignore debug-only repr + def __repr__ diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/.flake8 b/owl-bot-staging/google-cloud-confidentialcomputing/v1/.flake8 new file mode 100644 index 000000000000..90316de21489 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/.flake8 @@ -0,0 +1,34 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +[flake8] +# TODO(https://github.com/googleapis/gapic-generator-python/issues/2333): +# Resolve flake8 lint issues +ignore = E203, E231, E266, E501, W503 +exclude = + # TODO(https://github.com/googleapis/gapic-generator-python/issues/2333): + # Ensure that generated code passes flake8 lint + **/gapic/** + **/services/** + **/types/** + # Exclude Protobuf gencode + *_pb2.py + + # Standard linting exemptions. + **/.nox/** + __pycache__, + .git, + *.pyc, + conf.py diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/LICENSE b/owl-bot-staging/google-cloud-confidentialcomputing/v1/LICENSE new file mode 100644 index 000000000000..d64569567334 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/LICENSE @@ -0,0 +1,202 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/MANIFEST.in b/owl-bot-staging/google-cloud-confidentialcomputing/v1/MANIFEST.in new file mode 100644 index 000000000000..dae249ec8976 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/MANIFEST.in @@ -0,0 +1,20 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +include README.rst LICENSE +recursive-include google *.py *.pyi *.json *.proto py.typed +recursive-include tests * +global-exclude *.py[co] +global-exclude __pycache__ diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/README.rst b/owl-bot-staging/google-cloud-confidentialcomputing/v1/README.rst new file mode 100644 index 000000000000..593004344023 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/README.rst @@ -0,0 +1,143 @@ +Python Client for Google Cloud Confidentialcomputing API +================================================= + +Quick Start +----------- + +In order to use this library, you first need to go through the following steps: + +1. `Select or create a Cloud Platform project.`_ +2. `Enable billing for your project.`_ +3. Enable the Google Cloud Confidentialcomputing API. +4. `Setup Authentication.`_ + +.. _Select or create a Cloud Platform project.: https://console.cloud.google.com/project +.. _Enable billing for your project.: https://cloud.google.com/billing/docs/how-to/modify-project#enable_billing_for_a_project +.. _Setup Authentication.: https://googleapis.dev/python/google-api-core/latest/auth.html + +Installation +~~~~~~~~~~~~ + +Install this library in a `virtualenv`_ using pip. `virtualenv`_ is a tool to +create isolated Python environments. The basic problem it addresses is one of +dependencies and versions, and indirectly permissions. + +With `virtualenv`_, it's possible to install this library without needing system +install permissions, and without clashing with the installed system +dependencies. + +.. _`virtualenv`: https://virtualenv.pypa.io/en/latest/ + + +Mac/Linux +^^^^^^^^^ + +.. code-block:: console + + python3 -m venv + source /bin/activate + /bin/pip install /path/to/library + + +Windows +^^^^^^^ + +.. code-block:: console + + python3 -m venv + \Scripts\activate + \Scripts\pip.exe install \path\to\library + + +Logging +------- + +This library uses the standard Python :code:`logging` functionality to log some RPC events that could be of interest for debugging and monitoring purposes. +Note the following: + +#. Logs may contain sensitive information. Take care to **restrict access to the logs** if they are saved, whether it be on local storage or on Google Cloud Logging. +#. Google may refine the occurrence, level, and content of various log messages in this library without flagging such changes as breaking. **Do not depend on immutability of the logging events**. +#. By default, the logging events from this library are not handled. You must **explicitly configure log handling** using one of the mechanisms below. + + +Simple, environment-based configuration +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +To enable logging for this library without any changes in your code, set the :code:`GOOGLE_SDK_PYTHON_LOGGING_SCOPE` environment variable to a valid Google +logging scope. This configures handling of logging events (at level :code:`logging.DEBUG` or higher) from this library in a default manner, emitting the logged +messages in a structured format. It does not currently allow customizing the logging levels captured nor the handlers, formatters, etc. used for any logging +event. + +A logging scope is a period-separated namespace that begins with :code:`google`, identifying the Python module or package to log. + +- Valid logging scopes: :code:`google`, :code:`google.cloud.asset.v1`, :code:`google.api`, :code:`google.auth`, etc. +- Invalid logging scopes: :code:`foo`, :code:`123`, etc. + +**NOTE**: If the logging scope is invalid, the library does not set up any logging handlers. + + +Examples +^^^^^^^^ + +- Enabling the default handler for all Google-based loggers + +.. code-block:: console + + export GOOGLE_SDK_PYTHON_LOGGING_SCOPE=google + +- Enabling the default handler for a specific Google module (for a client library called :code:`library_v1`): + +.. code-block:: console + + export GOOGLE_SDK_PYTHON_LOGGING_SCOPE=google.cloud.library_v1 + + +Advanced, code-based configuration +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +You can also configure a valid logging scope using Python's standard `logging` mechanism. + + +Examples +^^^^^^^^ + +- Configuring a handler for all Google-based loggers + +.. code-block:: python + + import logging + + from google.cloud.translate_v3 import translate + + base_logger = logging.getLogger("google") + base_logger.addHandler(logging.StreamHandler()) + base_logger.setLevel(logging.DEBUG) + +- Configuring a handler for a specific Google module (for a client library called :code:`library_v1`): + +.. code-block:: python + + import logging + + from google.cloud.translate_v3 import translate + + base_logger = logging.getLogger("google.cloud.library_v1") + base_logger.addHandler(logging.StreamHandler()) + base_logger.setLevel(logging.DEBUG) + + +Logging details +~~~~~~~~~~~~~~~ + +#. Regardless of which of the mechanisms above you use to configure logging for this library, by default logging events are not propagated up to the root + logger from the `google`-level logger. If you need the events to be propagated to the root logger, you must explicitly set + :code:`logging.getLogger("google").propagate = True` in your code. +#. You can mix the different logging configurations above for different Google modules. For example, you may want use a code-based logging configuration for + one library, but decide you need to also set up environment-based logging configuration for another library. + + #. If you attempt to use both code-based and environment-based configuration for the same module, the environment-based configuration will be ineffectual + if the code -based configuration gets applied first. + +#. The Google-specific logging configurations (default handlers for environment-based configuration; not propagating logging events to the root logger) get + executed the first time *any* client library is instantiated in your application, and only if the affected loggers have not been previously configured. + (This is the reason for 2.i. above.) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/_static/custom.css b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/_static/custom.css new file mode 100644 index 000000000000..b0a295464b23 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/_static/custom.css @@ -0,0 +1,20 @@ +div#python2-eol { + border-color: red; + border-width: medium; +} + +/* Ensure minimum width for 'Parameters' / 'Returns' column */ +dl.field-list > dt { + min-width: 100px +} + +/* Insert space between methods for readability */ +dl.method { + padding-top: 10px; + padding-bottom: 10px +} + +/* Insert empty space between classes */ +dl.class { + padding-bottom: 50px +} diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/_templates/layout.html b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/_templates/layout.html new file mode 100644 index 000000000000..95e9c77fcfe1 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/_templates/layout.html @@ -0,0 +1,50 @@ + +{% extends "!layout.html" %} +{%- block content %} +{%- if theme_fixed_sidebar|lower == 'true' %} +
+ {{ sidebar() }} + {%- block document %} +
+ {%- if render_sidebar %} +
+ {%- endif %} + + {%- block relbar_top %} + {%- if theme_show_relbar_top|tobool %} +
+   + {{- rellink_markup () }} +
+ {%- endif %} + {% endblock %} + +
+
+ As of January 1, 2020 this library no longer supports Python 2 on the latest released version. + Library versions released prior to that date will continue to be available. For more information please + visit Python 2 support on Google Cloud. +
+ {% block body %} {% endblock %} +
+ + {%- block relbar_bottom %} + {%- if theme_show_relbar_bottom|tobool %} +
+   + {{- rellink_markup () }} +
+ {%- endif %} + {% endblock %} + + {%- if render_sidebar %} +
+ {%- endif %} +
+ {%- endblock %} +
+
+{%- else %} +{{ super() }} +{%- endif %} +{%- endblock %} diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/conf.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/conf.py new file mode 100644 index 000000000000..e25ab393e702 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/conf.py @@ -0,0 +1,385 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# +# google-cloud-confidentialcomputing documentation build configuration file +# +# This file is execfile()d with the current directory set to its +# containing dir. +# +# Note that not all possible configuration values are present in this +# autogenerated file. +# +# All configuration values have a default; values that are commented out +# serve to show the default. + +import sys +import os +import shlex + +# If extensions (or modules to document with autodoc) are in another directory, +# add these directories to sys.path here. If the directory is relative to the +# documentation root, use os.path.abspath to make it absolute, like shown here. +sys.path.insert(0, os.path.abspath("..")) + +# For plugins that can not read conf.py. +# See also: https://github.com/docascode/sphinx-docfx-yaml/issues/85 +sys.path.insert(0, os.path.abspath(".")) + +__version__ = "" + +# -- General configuration ------------------------------------------------ + +# If your documentation needs a minimal Sphinx version, state it here. +needs_sphinx = "4.5.0" + +# Add any Sphinx extension module names here, as strings. They can be +# extensions coming with Sphinx (named 'sphinx.ext.*') or your custom +# ones. +extensions = [ + "sphinx.ext.autodoc", + "sphinx.ext.autosummary", + "sphinx.ext.intersphinx", + "sphinx.ext.coverage", + "sphinx.ext.doctest", + "sphinx.ext.napoleon", + "sphinx.ext.todo", + "sphinx.ext.viewcode", + "recommonmark", +] + +# autodoc/autosummary flags +autoclass_content = "both" +autodoc_default_options = {"members": True} +autosummary_generate = True + + +# Add any paths that contain templates here, relative to this directory. +templates_path = ["_templates"] + +# The suffix(es) of source filenames. +# You can specify multiple suffix as a list of string: +# source_suffix = ['.rst', '.md'] +source_suffix = [".rst", ".md"] + +# The encoding of source files. +# source_encoding = 'utf-8-sig' + +# The root toctree document. +root_doc = "index" + +# General information about the project. +project = u"google-cloud-confidentialcomputing" +copyright = u"2025, Google, LLC" +author = u"Google APIs" + +# The version info for the project you're documenting, acts as replacement for +# |version| and |release|, also used in various other places throughout the +# built documents. +# +# The full version, including alpha/beta/rc tags. +release = __version__ +# The short X.Y version. +version = ".".join(release.split(".")[0:2]) + +# The language for content autogenerated by Sphinx. Refer to documentation +# for a list of supported languages. +# +# This is also used if you do content translation via gettext catalogs. +# Usually you set "language" from the command line for these cases. +language = None + +# There are two options for replacing |today|: either, you set today to some +# non-false value, then it is used: +# today = '' +# Else, today_fmt is used as the format for a strftime call. +# today_fmt = '%B %d, %Y' + +# List of patterns, relative to source directory, that match files and +# directories to ignore when looking for source files. +exclude_patterns = [ + "_build", + "**/.nox/**/*", + "samples/AUTHORING_GUIDE.md", + "samples/CONTRIBUTING.md", + "samples/snippets/README.rst", +] + +# The reST default role (used for this markup: `text`) to use for all +# documents. +# default_role = None + +# If true, '()' will be appended to :func: etc. cross-reference text. +# add_function_parentheses = True + +# If true, the current module name will be prepended to all description +# unit titles (such as .. function::). +# add_module_names = True + +# If true, sectionauthor and moduleauthor directives will be shown in the +# output. They are ignored by default. +# show_authors = False + +# The name of the Pygments (syntax highlighting) style to use. +pygments_style = "sphinx" + +# A list of ignored prefixes for module index sorting. +# modindex_common_prefix = [] + +# If true, keep warnings as "system message" paragraphs in the built documents. +# keep_warnings = False + +# If true, `todo` and `todoList` produce output, else they produce nothing. +todo_include_todos = True + + +# -- Options for HTML output ---------------------------------------------- + +# The theme to use for HTML and HTML Help pages. See the documentation for +# a list of builtin themes. +html_theme = "alabaster" + +# Theme options are theme-specific and customize the look and feel of a theme +# further. For a list of options available for each theme, see the +# documentation. +html_theme_options = { + "description": "Google Cloud Client Libraries for google-cloud-confidentialcomputing", + "github_user": "googleapis", + "github_repo": "google-cloud-python", + "github_banner": True, + "font_family": "'Roboto', Georgia, sans", + "head_font_family": "'Roboto', Georgia, serif", + "code_font_family": "'Roboto Mono', 'Consolas', monospace", +} + +# Add any paths that contain custom themes here, relative to this directory. +# html_theme_path = [] + +# The name for this set of Sphinx documents. If None, it defaults to +# " v documentation". +# html_title = None + +# A shorter title for the navigation bar. Default is the same as html_title. +# html_short_title = None + +# The name of an image file (relative to this directory) to place at the top +# of the sidebar. +# html_logo = None + +# The name of an image file (within the static path) to use as favicon of the +# docs. This file should be a Windows icon file (.ico) being 16x16 or 32x32 +# pixels large. +# html_favicon = None + +# Add any paths that contain custom static files (such as style sheets) here, +# relative to this directory. They are copied after the builtin static files, +# so a file named "default.css" will overwrite the builtin "default.css". +html_static_path = ["_static"] + +# Add any extra paths that contain custom files (such as robots.txt or +# .htaccess) here, relative to this directory. These files are copied +# directly to the root of the documentation. +# html_extra_path = [] + +# If not '', a 'Last updated on:' timestamp is inserted at every page bottom, +# using the given strftime format. +# html_last_updated_fmt = '%b %d, %Y' + +# If true, SmartyPants will be used to convert quotes and dashes to +# typographically correct entities. +# html_use_smartypants = True + +# Custom sidebar templates, maps document names to template names. +# html_sidebars = {} + +# Additional templates that should be rendered to pages, maps page names to +# template names. +# html_additional_pages = {} + +# If false, no module index is generated. +# html_domain_indices = True + +# If false, no index is generated. +# html_use_index = True + +# If true, the index is split into individual pages for each letter. +# html_split_index = False + +# If true, links to the reST sources are added to the pages. +# html_show_sourcelink = True + +# If true, "Created using Sphinx" is shown in the HTML footer. Default is True. +# html_show_sphinx = True + +# If true, "(C) Copyright ..." is shown in the HTML footer. Default is True. +# html_show_copyright = True + +# If true, an OpenSearch description file will be output, and all pages will +# contain a tag referring to it. The value of this option must be the +# base URL from which the finished HTML is served. +# html_use_opensearch = '' + +# This is the file name suffix for HTML files (e.g. ".xhtml"). +# html_file_suffix = None + +# Language to be used for generating the HTML full-text search index. +# Sphinx supports the following languages: +# 'da', 'de', 'en', 'es', 'fi', 'fr', 'hu', 'it', 'ja' +# 'nl', 'no', 'pt', 'ro', 'ru', 'sv', 'tr' +# html_search_language = 'en' + +# A dictionary with options for the search language support, empty by default. +# Now only 'ja' uses this config value +# html_search_options = {'type': 'default'} + +# The name of a javascript file (relative to the configuration directory) that +# implements a search results scorer. If empty, the default will be used. +# html_search_scorer = 'scorer.js' + +# Output file base name for HTML help builder. +htmlhelp_basename = "google-cloud-confidentialcomputing-doc" + +# -- Options for warnings ------------------------------------------------------ + + +suppress_warnings = [ + # Temporarily suppress this to avoid "more than one target found for + # cross-reference" warning, which are intractable for us to avoid while in + # a mono-repo. + # See https://github.com/sphinx-doc/sphinx/blob + # /2a65ffeef5c107c19084fabdd706cdff3f52d93c/sphinx/domains/python.py#L843 + "ref.python" +] + +# -- Options for LaTeX output --------------------------------------------- + +latex_elements = { + # The paper size ('letterpaper' or 'a4paper'). + # 'papersize': 'letterpaper', + # The font size ('10pt', '11pt' or '12pt'). + # 'pointsize': '10pt', + # Additional stuff for the LaTeX preamble. + # 'preamble': '', + # Latex figure (float) alignment + # 'figure_align': 'htbp', +} + +# Grouping the document tree into LaTeX files. List of tuples +# (source start file, target name, title, +# author, documentclass [howto, manual, or own class]). +latex_documents = [ + ( + root_doc, + "google-cloud-confidentialcomputing.tex", + u"google-cloud-confidentialcomputing Documentation", + author, + "manual", + ) +] + +# The name of an image file (relative to this directory) to place at the top of +# the title page. +# latex_logo = None + +# For "manual" documents, if this is true, then toplevel headings are parts, +# not chapters. +# latex_use_parts = False + +# If true, show page references after internal links. +# latex_show_pagerefs = False + +# If true, show URL addresses after external links. +# latex_show_urls = False + +# Documents to append as an appendix to all manuals. +# latex_appendices = [] + +# If false, no module index is generated. +# latex_domain_indices = True + + +# -- Options for manual page output --------------------------------------- + +# One entry per manual page. List of tuples +# (source start file, name, description, authors, manual section). +man_pages = [ + ( + root_doc, + "google-cloud-confidentialcomputing", + "google-cloud-confidentialcomputing Documentation", + [author], + 1, + ) +] + +# If true, show URL addresses after external links. +# man_show_urls = False + + +# -- Options for Texinfo output ------------------------------------------- + +# Grouping the document tree into Texinfo files. List of tuples +# (source start file, target name, title, author, +# dir menu entry, description, category) +texinfo_documents = [ + ( + root_doc, + "google-cloud-confidentialcomputing", + "google-cloud-confidentialcomputing Documentation", + author, + "google-cloud-confidentialcomputing", + "google-cloud-confidentialcomputing Library", + "APIs", + ) +] + +# Documents to append as an appendix to all manuals. +# texinfo_appendices = [] + +# If false, no module index is generated. +# texinfo_domain_indices = True + +# How to display URL addresses: 'footnote', 'no', or 'inline'. +# texinfo_show_urls = 'footnote' + +# If true, do not generate a @detailmenu in the "Top" node's menu. +# texinfo_no_detailmenu = False + + +# Example configuration for intersphinx: refer to the Python standard library. +intersphinx_mapping = { + "python": ("https://python.readthedocs.org/en/latest/", None), + "google-auth": ("https://googleapis.dev/python/google-auth/latest/", None), + "google.api_core": ( + "https://googleapis.dev/python/google-api-core/latest/", + None, + ), + "grpc": ("https://grpc.github.io/grpc/python/", None), + "proto-plus": ("https://proto-plus-python.readthedocs.io/en/latest/", None), + "protobuf": ("https://googleapis.dev/python/protobuf/latest/", None), +} + + +# Napoleon settings +napoleon_google_docstring = True +napoleon_numpy_docstring = True +napoleon_include_private_with_doc = False +napoleon_include_special_with_doc = True +napoleon_use_admonition_for_examples = False +napoleon_use_admonition_for_notes = False +napoleon_use_admonition_for_references = False +napoleon_use_ivar = False +napoleon_use_param = True +napoleon_use_rtype = True diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/confidential_computing.rst b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/confidential_computing.rst new file mode 100644 index 000000000000..06d7e01926a9 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/confidential_computing.rst @@ -0,0 +1,6 @@ +ConfidentialComputing +--------------------------------------- + +.. automodule:: google.cloud.confidentialcomputing_v1.services.confidential_computing + :members: + :inherited-members: diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/services_.rst b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/services_.rst new file mode 100644 index 000000000000..0e44260b2eae --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/services_.rst @@ -0,0 +1,6 @@ +Services for Google Cloud Confidentialcomputing v1 API +====================================================== +.. toctree:: + :maxdepth: 2 + + confidential_computing diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/types_.rst b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/types_.rst new file mode 100644 index 000000000000..ae5970c73d34 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/types_.rst @@ -0,0 +1,6 @@ +Types for Google Cloud Confidentialcomputing v1 API +=================================================== + +.. automodule:: google.cloud.confidentialcomputing_v1.types + :members: + :show-inheritance: diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/index.rst b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/index.rst new file mode 100644 index 000000000000..0566de600bc8 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/index.rst @@ -0,0 +1,10 @@ +.. include:: multiprocessing.rst + + +API Reference +------------- +.. toctree:: + :maxdepth: 2 + + confidentialcomputing_v1/services_ + confidentialcomputing_v1/types_ diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/multiprocessing.rst b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/multiprocessing.rst new file mode 100644 index 000000000000..536d17b2ea65 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/multiprocessing.rst @@ -0,0 +1,7 @@ +.. note:: + + Because this client uses :mod:`grpc` library, it is safe to + share instances across threads. In multiprocessing scenarios, the best + practice is to create client instances *after* the invocation of + :func:`os.fork` by :class:`multiprocessing.pool.Pool` or + :class:`multiprocessing.Process`. diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/__init__.py new file mode 100644 index 000000000000..9dabe5d04bb0 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/__init__.py @@ -0,0 +1,71 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +from google.cloud.confidentialcomputing import gapic_version as package_version + +__version__ = package_version.__version__ + + +from google.cloud.confidentialcomputing_v1.services.confidential_computing.client import ConfidentialComputingClient +from google.cloud.confidentialcomputing_v1.services.confidential_computing.async_client import ConfidentialComputingAsyncClient + +from google.cloud.confidentialcomputing_v1.types.service import AwsPrincipalTagsOptions +from google.cloud.confidentialcomputing_v1.types.service import Challenge +from google.cloud.confidentialcomputing_v1.types.service import ConfidentialSpaceInfo +from google.cloud.confidentialcomputing_v1.types.service import ContainerImageSignature +from google.cloud.confidentialcomputing_v1.types.service import CreateChallengeRequest +from google.cloud.confidentialcomputing_v1.types.service import GceShieldedIdentity +from google.cloud.confidentialcomputing_v1.types.service import GcpCredentials +from google.cloud.confidentialcomputing_v1.types.service import SevSnpAttestation +from google.cloud.confidentialcomputing_v1.types.service import SignedEntity +from google.cloud.confidentialcomputing_v1.types.service import TdxCcelAttestation +from google.cloud.confidentialcomputing_v1.types.service import TokenOptions +from google.cloud.confidentialcomputing_v1.types.service import TpmAttestation +from google.cloud.confidentialcomputing_v1.types.service import VerifyAttestationRequest +from google.cloud.confidentialcomputing_v1.types.service import VerifyAttestationResponse +from google.cloud.confidentialcomputing_v1.types.service import VerifyConfidentialGkeRequest +from google.cloud.confidentialcomputing_v1.types.service import VerifyConfidentialGkeResponse +from google.cloud.confidentialcomputing_v1.types.service import VerifyConfidentialSpaceRequest +from google.cloud.confidentialcomputing_v1.types.service import VerifyConfidentialSpaceResponse +from google.cloud.confidentialcomputing_v1.types.service import SignatureType +from google.cloud.confidentialcomputing_v1.types.service import SigningAlgorithm +from google.cloud.confidentialcomputing_v1.types.service import TokenProfile +from google.cloud.confidentialcomputing_v1.types.service import TokenType + +__all__ = ('ConfidentialComputingClient', + 'ConfidentialComputingAsyncClient', + 'AwsPrincipalTagsOptions', + 'Challenge', + 'ConfidentialSpaceInfo', + 'ContainerImageSignature', + 'CreateChallengeRequest', + 'GceShieldedIdentity', + 'GcpCredentials', + 'SevSnpAttestation', + 'SignedEntity', + 'TdxCcelAttestation', + 'TokenOptions', + 'TpmAttestation', + 'VerifyAttestationRequest', + 'VerifyAttestationResponse', + 'VerifyConfidentialGkeRequest', + 'VerifyConfidentialGkeResponse', + 'VerifyConfidentialSpaceRequest', + 'VerifyConfidentialSpaceResponse', + 'SignatureType', + 'SigningAlgorithm', + 'TokenProfile', + 'TokenType', +) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/gapic_version.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/gapic_version.py new file mode 100644 index 000000000000..20a9cd975b02 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/gapic_version.py @@ -0,0 +1,16 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +__version__ = "0.0.0" # {x-release-please-version} diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/py.typed b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/py.typed new file mode 100644 index 000000000000..5e085fa19b06 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/py.typed @@ -0,0 +1,2 @@ +# Marker file for PEP 561. +# The google-cloud-confidentialcomputing package uses inline types. diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/__init__.py new file mode 100644 index 000000000000..2674431e4ee1 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/__init__.py @@ -0,0 +1,72 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +from google.cloud.confidentialcomputing_v1 import gapic_version as package_version + +__version__ = package_version.__version__ + + +from .services.confidential_computing import ConfidentialComputingClient +from .services.confidential_computing import ConfidentialComputingAsyncClient + +from .types.service import AwsPrincipalTagsOptions +from .types.service import Challenge +from .types.service import ConfidentialSpaceInfo +from .types.service import ContainerImageSignature +from .types.service import CreateChallengeRequest +from .types.service import GceShieldedIdentity +from .types.service import GcpCredentials +from .types.service import SevSnpAttestation +from .types.service import SignedEntity +from .types.service import TdxCcelAttestation +from .types.service import TokenOptions +from .types.service import TpmAttestation +from .types.service import VerifyAttestationRequest +from .types.service import VerifyAttestationResponse +from .types.service import VerifyConfidentialGkeRequest +from .types.service import VerifyConfidentialGkeResponse +from .types.service import VerifyConfidentialSpaceRequest +from .types.service import VerifyConfidentialSpaceResponse +from .types.service import SignatureType +from .types.service import SigningAlgorithm +from .types.service import TokenProfile +from .types.service import TokenType + +__all__ = ( + 'ConfidentialComputingAsyncClient', +'AwsPrincipalTagsOptions', +'Challenge', +'ConfidentialComputingClient', +'ConfidentialSpaceInfo', +'ContainerImageSignature', +'CreateChallengeRequest', +'GceShieldedIdentity', +'GcpCredentials', +'SevSnpAttestation', +'SignatureType', +'SignedEntity', +'SigningAlgorithm', +'TdxCcelAttestation', +'TokenOptions', +'TokenProfile', +'TokenType', +'TpmAttestation', +'VerifyAttestationRequest', +'VerifyAttestationResponse', +'VerifyConfidentialGkeRequest', +'VerifyConfidentialGkeResponse', +'VerifyConfidentialSpaceRequest', +'VerifyConfidentialSpaceResponse', +) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/gapic_metadata.json b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/gapic_metadata.json new file mode 100644 index 000000000000..5227e556513e --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/gapic_metadata.json @@ -0,0 +1,88 @@ + { + "comment": "This file maps proto services/RPCs to the corresponding library clients/methods", + "language": "python", + "libraryPackage": "google.cloud.confidentialcomputing_v1", + "protoPackage": "google.cloud.confidentialcomputing.v1", + "schema": "1.0", + "services": { + "ConfidentialComputing": { + "clients": { + "grpc": { + "libraryClient": "ConfidentialComputingClient", + "rpcs": { + "CreateChallenge": { + "methods": [ + "create_challenge" + ] + }, + "VerifyAttestation": { + "methods": [ + "verify_attestation" + ] + }, + "VerifyConfidentialGke": { + "methods": [ + "verify_confidential_gke" + ] + }, + "VerifyConfidentialSpace": { + "methods": [ + "verify_confidential_space" + ] + } + } + }, + "grpc-async": { + "libraryClient": "ConfidentialComputingAsyncClient", + "rpcs": { + "CreateChallenge": { + "methods": [ + "create_challenge" + ] + }, + "VerifyAttestation": { + "methods": [ + "verify_attestation" + ] + }, + "VerifyConfidentialGke": { + "methods": [ + "verify_confidential_gke" + ] + }, + "VerifyConfidentialSpace": { + "methods": [ + "verify_confidential_space" + ] + } + } + }, + "rest": { + "libraryClient": "ConfidentialComputingClient", + "rpcs": { + "CreateChallenge": { + "methods": [ + "create_challenge" + ] + }, + "VerifyAttestation": { + "methods": [ + "verify_attestation" + ] + }, + "VerifyConfidentialGke": { + "methods": [ + "verify_confidential_gke" + ] + }, + "VerifyConfidentialSpace": { + "methods": [ + "verify_confidential_space" + ] + } + } + } + } + } + } +} diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/gapic_version.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/gapic_version.py new file mode 100644 index 000000000000..20a9cd975b02 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/gapic_version.py @@ -0,0 +1,16 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +__version__ = "0.0.0" # {x-release-please-version} diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/py.typed b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/py.typed new file mode 100644 index 000000000000..5e085fa19b06 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/py.typed @@ -0,0 +1,2 @@ +# Marker file for PEP 561. +# The google-cloud-confidentialcomputing package uses inline types. diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/__init__.py new file mode 100644 index 000000000000..cbf94b283c70 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/__init__.py @@ -0,0 +1,15 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/__init__.py new file mode 100644 index 000000000000..000ad9033f05 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/__init__.py @@ -0,0 +1,22 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +from .client import ConfidentialComputingClient +from .async_client import ConfidentialComputingAsyncClient + +__all__ = ( + 'ConfidentialComputingClient', + 'ConfidentialComputingAsyncClient', +) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/async_client.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/async_client.py new file mode 100644 index 000000000000..97512c2a575f --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/async_client.py @@ -0,0 +1,760 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +import logging as std_logging +from collections import OrderedDict +import re +from typing import Dict, Callable, Mapping, MutableMapping, MutableSequence, Optional, Sequence, Tuple, Type, Union + +from google.cloud.confidentialcomputing_v1 import gapic_version as package_version + +from google.api_core.client_options import ClientOptions +from google.api_core import exceptions as core_exceptions +from google.api_core import gapic_v1 +from google.api_core import retry_async as retries +from google.auth import credentials as ga_credentials # type: ignore +from google.oauth2 import service_account # type: ignore +import google.protobuf + + +try: + OptionalRetry = Union[retries.AsyncRetry, gapic_v1.method._MethodDefault, None] +except AttributeError: # pragma: NO COVER + OptionalRetry = Union[retries.AsyncRetry, object, None] # type: ignore + +from google.cloud.confidentialcomputing_v1.types import service +from google.cloud.location import locations_pb2 # type: ignore +from google.protobuf import timestamp_pb2 # type: ignore +from google.rpc import status_pb2 # type: ignore +from .transports.base import ConfidentialComputingTransport, DEFAULT_CLIENT_INFO +from .transports.grpc_asyncio import ConfidentialComputingGrpcAsyncIOTransport +from .client import ConfidentialComputingClient + +try: + from google.api_core import client_logging # type: ignore + CLIENT_LOGGING_SUPPORTED = True # pragma: NO COVER +except ImportError: # pragma: NO COVER + CLIENT_LOGGING_SUPPORTED = False + +_LOGGER = std_logging.getLogger(__name__) + +class ConfidentialComputingAsyncClient: + """Service describing handlers for resources""" + + _client: ConfidentialComputingClient + + # Copy defaults from the synchronous client for use here. + # Note: DEFAULT_ENDPOINT is deprecated. Use _DEFAULT_ENDPOINT_TEMPLATE instead. + DEFAULT_ENDPOINT = ConfidentialComputingClient.DEFAULT_ENDPOINT + DEFAULT_MTLS_ENDPOINT = ConfidentialComputingClient.DEFAULT_MTLS_ENDPOINT + _DEFAULT_ENDPOINT_TEMPLATE = ConfidentialComputingClient._DEFAULT_ENDPOINT_TEMPLATE + _DEFAULT_UNIVERSE = ConfidentialComputingClient._DEFAULT_UNIVERSE + + challenge_path = staticmethod(ConfidentialComputingClient.challenge_path) + parse_challenge_path = staticmethod(ConfidentialComputingClient.parse_challenge_path) + common_billing_account_path = staticmethod(ConfidentialComputingClient.common_billing_account_path) + parse_common_billing_account_path = staticmethod(ConfidentialComputingClient.parse_common_billing_account_path) + common_folder_path = staticmethod(ConfidentialComputingClient.common_folder_path) + parse_common_folder_path = staticmethod(ConfidentialComputingClient.parse_common_folder_path) + common_organization_path = staticmethod(ConfidentialComputingClient.common_organization_path) + parse_common_organization_path = staticmethod(ConfidentialComputingClient.parse_common_organization_path) + common_project_path = staticmethod(ConfidentialComputingClient.common_project_path) + parse_common_project_path = staticmethod(ConfidentialComputingClient.parse_common_project_path) + common_location_path = staticmethod(ConfidentialComputingClient.common_location_path) + parse_common_location_path = staticmethod(ConfidentialComputingClient.parse_common_location_path) + + @classmethod + def from_service_account_info(cls, info: dict, *args, **kwargs): + """Creates an instance of this client using the provided credentials + info. + + Args: + info (dict): The service account private key info. + args: Additional arguments to pass to the constructor. + kwargs: Additional arguments to pass to the constructor. + + Returns: + ConfidentialComputingAsyncClient: The constructed client. + """ + return ConfidentialComputingClient.from_service_account_info.__func__(ConfidentialComputingAsyncClient, info, *args, **kwargs) # type: ignore + + @classmethod + def from_service_account_file(cls, filename: str, *args, **kwargs): + """Creates an instance of this client using the provided credentials + file. + + Args: + filename (str): The path to the service account private key json + file. + args: Additional arguments to pass to the constructor. + kwargs: Additional arguments to pass to the constructor. + + Returns: + ConfidentialComputingAsyncClient: The constructed client. + """ + return ConfidentialComputingClient.from_service_account_file.__func__(ConfidentialComputingAsyncClient, filename, *args, **kwargs) # type: ignore + + from_service_account_json = from_service_account_file + + @classmethod + def get_mtls_endpoint_and_cert_source(cls, client_options: Optional[ClientOptions] = None): + """Return the API endpoint and client cert source for mutual TLS. + + The client cert source is determined in the following order: + (1) if `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is not "true", the + client cert source is None. + (2) if `client_options.client_cert_source` is provided, use the provided one; if the + default client cert source exists, use the default one; otherwise the client cert + source is None. + + The API endpoint is determined in the following order: + (1) if `client_options.api_endpoint` if provided, use the provided one. + (2) if `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is "always", use the + default mTLS endpoint; if the environment variable is "never", use the default API + endpoint; otherwise if client cert source exists, use the default mTLS endpoint, otherwise + use the default API endpoint. + + More details can be found at https://google.aip.dev/auth/4114. + + Args: + client_options (google.api_core.client_options.ClientOptions): Custom options for the + client. Only the `api_endpoint` and `client_cert_source` properties may be used + in this method. + + Returns: + Tuple[str, Callable[[], Tuple[bytes, bytes]]]: returns the API endpoint and the + client cert source to use. + + Raises: + google.auth.exceptions.MutualTLSChannelError: If any errors happen. + """ + return ConfidentialComputingClient.get_mtls_endpoint_and_cert_source(client_options) # type: ignore + + @property + def transport(self) -> ConfidentialComputingTransport: + """Returns the transport used by the client instance. + + Returns: + ConfidentialComputingTransport: The transport used by the client instance. + """ + return self._client.transport + + @property + def api_endpoint(self): + """Return the API endpoint used by the client instance. + + Returns: + str: The API endpoint used by the client instance. + """ + return self._client._api_endpoint + + @property + def universe_domain(self) -> str: + """Return the universe domain used by the client instance. + + Returns: + str: The universe domain used + by the client instance. + """ + return self._client._universe_domain + + get_transport_class = ConfidentialComputingClient.get_transport_class + + def __init__(self, *, + credentials: Optional[ga_credentials.Credentials] = None, + transport: Optional[Union[str, ConfidentialComputingTransport, Callable[..., ConfidentialComputingTransport]]] = "grpc_asyncio", + client_options: Optional[ClientOptions] = None, + client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO, + ) -> None: + """Instantiates the confidential computing async client. + + Args: + credentials (Optional[google.auth.credentials.Credentials]): The + authorization credentials to attach to requests. These + credentials identify the application to the service; if none + are specified, the client will attempt to ascertain the + credentials from the environment. + transport (Optional[Union[str,ConfidentialComputingTransport,Callable[..., ConfidentialComputingTransport]]]): + The transport to use, or a Callable that constructs and returns a new transport to use. + If a Callable is given, it will be called with the same set of initialization + arguments as used in the ConfidentialComputingTransport constructor. + If set to None, a transport is chosen automatically. + client_options (Optional[Union[google.api_core.client_options.ClientOptions, dict]]): + Custom options for the client. + + 1. The ``api_endpoint`` property can be used to override the + default endpoint provided by the client when ``transport`` is + not explicitly provided. Only if this property is not set and + ``transport`` was not explicitly provided, the endpoint is + determined by the GOOGLE_API_USE_MTLS_ENDPOINT environment + variable, which have one of the following values: + "always" (always use the default mTLS endpoint), "never" (always + use the default regular endpoint) and "auto" (auto-switch to the + default mTLS endpoint if client certificate is present; this is + the default value). + + 2. If the GOOGLE_API_USE_CLIENT_CERTIFICATE environment variable + is "true", then the ``client_cert_source`` property can be used + to provide a client certificate for mTLS transport. If + not provided, the default SSL client certificate will be used if + present. If GOOGLE_API_USE_CLIENT_CERTIFICATE is "false" or not + set, no client certificate will be used. + + 3. The ``universe_domain`` property can be used to override the + default "googleapis.com" universe. Note that ``api_endpoint`` + property still takes precedence; and ``universe_domain`` is + currently not supported for mTLS. + + client_info (google.api_core.gapic_v1.client_info.ClientInfo): + The client info used to send a user-agent string along with + API requests. If ``None``, then default info will be used. + Generally, you only need to set this if you're developing + your own client library. + + Raises: + google.auth.exceptions.MutualTlsChannelError: If mutual TLS transport + creation failed for any reason. + """ + self._client = ConfidentialComputingClient( + credentials=credentials, + transport=transport, + client_options=client_options, + client_info=client_info, + + ) + + if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(std_logging.DEBUG): # pragma: NO COVER + _LOGGER.debug( + "Created client `google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient`.", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "universeDomain": getattr(self._client._transport._credentials, "universe_domain", ""), + "credentialsType": f"{type(self._client._transport._credentials).__module__}.{type(self._client._transport._credentials).__qualname__}", + "credentialsInfo": getattr(self.transport._credentials, "get_cred_info", lambda: None)(), + } if hasattr(self._client._transport, "_credentials") else { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "credentialsType": None, + } + ) + + async def create_challenge(self, + request: Optional[Union[service.CreateChallengeRequest, dict]] = None, + *, + parent: Optional[str] = None, + challenge: Optional[service.Challenge] = None, + retry: OptionalRetry = gapic_v1.method.DEFAULT, + timeout: Union[float, object] = gapic_v1.method.DEFAULT, + metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), + ) -> service.Challenge: + r"""Creates a new Challenge in a given project and + location. + + .. code-block:: python + + # This snippet has been automatically generated and should be regarded as a + # code template only. + # It will require modifications to work: + # - It may require correct/in-range values for request initialization. + # - It may require specifying regional endpoints when creating the service + # client as shown in: + # https://googleapis.dev/python/google-api-core/latest/client_options.html + from google.cloud import confidentialcomputing_v1 + + async def sample_create_challenge(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingAsyncClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.CreateChallengeRequest( + parent="parent_value", + ) + + # Make the request + response = await client.create_challenge(request=request) + + # Handle the response + print(response) + + Args: + request (Optional[Union[google.cloud.confidentialcomputing_v1.types.CreateChallengeRequest, dict]]): + The request object. Message for creating a Challenge + parent (:class:`str`): + Required. The resource name of the location where the + Challenge will be used, in the format + ``projects/*/locations/*``. + + This corresponds to the ``parent`` field + on the ``request`` instance; if ``request`` is provided, this + should not be set. + challenge (:class:`google.cloud.confidentialcomputing_v1.types.Challenge`): + Required. The Challenge to be + created. Currently this field can be + empty as all the Challenge fields are + set by the server. + + This corresponds to the ``challenge`` field + on the ``request`` instance; if ``request`` is provided, this + should not be set. + retry (google.api_core.retry_async.AsyncRetry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + google.cloud.confidentialcomputing_v1.types.Challenge: + A Challenge from the server used to + guarantee freshness of attestations + + """ + # Create or coerce a protobuf request object. + # - Quick check: If we got a request object, we should *not* have + # gotten any keyword arguments that map to the request. + flattened_params = [parent, challenge] + has_flattened_params = len([param for param in flattened_params if param is not None]) > 0 + if request is not None and has_flattened_params: + raise ValueError("If the `request` argument is set, then none of " + "the individual field arguments should be set.") + + # - Use the request object if provided (there's no risk of modifying the input as + # there are no flattened fields), or create one. + if not isinstance(request, service.CreateChallengeRequest): + request = service.CreateChallengeRequest(request) + + # If we have keyword arguments corresponding to fields on the + # request, apply these. + if parent is not None: + request.parent = parent + if challenge is not None: + request.challenge = challenge + + # Wrap the RPC method; this adds retry and timeout information, + # and friendly error handling. + rpc = self._client._transport._wrapped_methods[self._client._transport.create_challenge] + + # Certain fields should be provided within the metadata header; + # add these here. + metadata = tuple(metadata) + ( + gapic_v1.routing_header.to_grpc_metadata(( + ("parent", request.parent), + )), + ) + + # Validate the universe domain. + self._client._validate_universe_domain() + + # Send the request. + response = await rpc( + request, + retry=retry, + timeout=timeout, + metadata=metadata, + ) + + # Done; return the response. + return response + + async def verify_attestation(self, + request: Optional[Union[service.VerifyAttestationRequest, dict]] = None, + *, + retry: OptionalRetry = gapic_v1.method.DEFAULT, + timeout: Union[float, object] = gapic_v1.method.DEFAULT, + metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), + ) -> service.VerifyAttestationResponse: + r"""Verifies the provided attestation info, returning a + signed attestation token. + + .. code-block:: python + + # This snippet has been automatically generated and should be regarded as a + # code template only. + # It will require modifications to work: + # - It may require correct/in-range values for request initialization. + # - It may require specifying regional endpoints when creating the service + # client as shown in: + # https://googleapis.dev/python/google-api-core/latest/client_options.html + from google.cloud import confidentialcomputing_v1 + + async def sample_verify_attestation(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingAsyncClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.VerifyAttestationRequest( + challenge="challenge_value", + ) + + # Make the request + response = await client.verify_attestation(request=request) + + # Handle the response + print(response) + + Args: + request (Optional[Union[google.cloud.confidentialcomputing_v1.types.VerifyAttestationRequest, dict]]): + The request object. A request for an attestation token, + providing all the necessary information + needed for this service to verify the + platform state of the requestor. + retry (google.api_core.retry_async.AsyncRetry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + google.cloud.confidentialcomputing_v1.types.VerifyAttestationResponse: + A response once an attestation has + been successfully verified, containing a + signed attestation token. + + """ + # Create or coerce a protobuf request object. + # - Use the request object if provided (there's no risk of modifying the input as + # there are no flattened fields), or create one. + if not isinstance(request, service.VerifyAttestationRequest): + request = service.VerifyAttestationRequest(request) + + # Wrap the RPC method; this adds retry and timeout information, + # and friendly error handling. + rpc = self._client._transport._wrapped_methods[self._client._transport.verify_attestation] + + # Certain fields should be provided within the metadata header; + # add these here. + metadata = tuple(metadata) + ( + gapic_v1.routing_header.to_grpc_metadata(( + ("challenge", request.challenge), + )), + ) + + # Validate the universe domain. + self._client._validate_universe_domain() + + # Send the request. + response = await rpc( + request, + retry=retry, + timeout=timeout, + metadata=metadata, + ) + + # Done; return the response. + return response + + async def verify_confidential_space(self, + request: Optional[Union[service.VerifyConfidentialSpaceRequest, dict]] = None, + *, + retry: OptionalRetry = gapic_v1.method.DEFAULT, + timeout: Union[float, object] = gapic_v1.method.DEFAULT, + metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), + ) -> service.VerifyConfidentialSpaceResponse: + r"""Verifies whether the provided attestation info is + valid, returning a signed attestation token if so. + + .. code-block:: python + + # This snippet has been automatically generated and should be regarded as a + # code template only. + # It will require modifications to work: + # - It may require correct/in-range values for request initialization. + # - It may require specifying regional endpoints when creating the service + # client as shown in: + # https://googleapis.dev/python/google-api-core/latest/client_options.html + from google.cloud import confidentialcomputing_v1 + + async def sample_verify_confidential_space(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingAsyncClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.VerifyConfidentialSpaceRequest( + challenge="challenge_value", + ) + + # Make the request + response = await client.verify_confidential_space(request=request) + + # Handle the response + print(response) + + Args: + request (Optional[Union[google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceRequest, dict]]): + The request object. A request for an attestation token, + providing all the necessary information + needed for this service to verify the + platform state of the requestor. + retry (google.api_core.retry_async.AsyncRetry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceResponse: + VerifyConfidentialSpaceResponse is + returned once a Confidential Space + attestation has been successfully + verified, containing a signed token. + + """ + # Create or coerce a protobuf request object. + # - Use the request object if provided (there's no risk of modifying the input as + # there are no flattened fields), or create one. + if not isinstance(request, service.VerifyConfidentialSpaceRequest): + request = service.VerifyConfidentialSpaceRequest(request) + + # Wrap the RPC method; this adds retry and timeout information, + # and friendly error handling. + rpc = self._client._transport._wrapped_methods[self._client._transport.verify_confidential_space] + + # Certain fields should be provided within the metadata header; + # add these here. + metadata = tuple(metadata) + ( + gapic_v1.routing_header.to_grpc_metadata(( + ("challenge", request.challenge), + )), + ) + + # Validate the universe domain. + self._client._validate_universe_domain() + + # Send the request. + response = await rpc( + request, + retry=retry, + timeout=timeout, + metadata=metadata, + ) + + # Done; return the response. + return response + + async def verify_confidential_gke(self, + request: Optional[Union[service.VerifyConfidentialGkeRequest, dict]] = None, + *, + retry: OptionalRetry = gapic_v1.method.DEFAULT, + timeout: Union[float, object] = gapic_v1.method.DEFAULT, + metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), + ) -> service.VerifyConfidentialGkeResponse: + r"""Verifies the provided Confidential GKE attestation + info, returning a signed OIDC token. + + .. code-block:: python + + # This snippet has been automatically generated and should be regarded as a + # code template only. + # It will require modifications to work: + # - It may require correct/in-range values for request initialization. + # - It may require specifying regional endpoints when creating the service + # client as shown in: + # https://googleapis.dev/python/google-api-core/latest/client_options.html + from google.cloud import confidentialcomputing_v1 + + async def sample_verify_confidential_gke(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingAsyncClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.VerifyConfidentialGkeRequest( + challenge="challenge_value", + ) + + # Make the request + response = await client.verify_confidential_gke(request=request) + + # Handle the response + print(response) + + Args: + request (Optional[Union[google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeRequest, dict]]): + The request object. A request for an attestation token, + providing all the necessary information + needed for this service to verify + Confidential GKE platform state of the + requestor. + retry (google.api_core.retry_async.AsyncRetry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeResponse: + VerifyConfidentialGkeResponse + response is returened once a + Confidential GKE attestation has been + successfully verified, containing a + signed OIDC token. + + """ + # Create or coerce a protobuf request object. + # - Use the request object if provided (there's no risk of modifying the input as + # there are no flattened fields), or create one. + if not isinstance(request, service.VerifyConfidentialGkeRequest): + request = service.VerifyConfidentialGkeRequest(request) + + # Wrap the RPC method; this adds retry and timeout information, + # and friendly error handling. + rpc = self._client._transport._wrapped_methods[self._client._transport.verify_confidential_gke] + + # Certain fields should be provided within the metadata header; + # add these here. + metadata = tuple(metadata) + ( + gapic_v1.routing_header.to_grpc_metadata(( + ("challenge", request.challenge), + )), + ) + + # Validate the universe domain. + self._client._validate_universe_domain() + + # Send the request. + response = await rpc( + request, + retry=retry, + timeout=timeout, + metadata=metadata, + ) + + # Done; return the response. + return response + + async def get_location( + self, + request: Optional[locations_pb2.GetLocationRequest] = None, + *, + retry: OptionalRetry = gapic_v1.method.DEFAULT, + timeout: Union[float, object] = gapic_v1.method.DEFAULT, + metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), + ) -> locations_pb2.Location: + r"""Gets information about a location. + + Args: + request (:class:`~.location_pb2.GetLocationRequest`): + The request object. Request message for + `GetLocation` method. + retry (google.api_core.retry_async.AsyncRetry): Designation of what errors, + if any, should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + Returns: + ~.location_pb2.Location: + Location object. + """ + # Create or coerce a protobuf request object. + # The request isn't a proto-plus wrapped type, + # so it must be constructed via keyword expansion. + if isinstance(request, dict): + request = locations_pb2.GetLocationRequest(**request) + + # Wrap the RPC method; this adds retry and timeout information, + # and friendly error handling. + rpc = self.transport._wrapped_methods[self._client._transport.get_location] + + # Certain fields should be provided within the metadata header; + # add these here. + metadata = tuple(metadata) + ( + gapic_v1.routing_header.to_grpc_metadata( + (("name", request.name),)), + ) + + # Validate the universe domain. + self._client._validate_universe_domain() + + # Send the request. + response = await rpc( + request, retry=retry, timeout=timeout, metadata=metadata,) + + # Done; return the response. + return response + + async def list_locations( + self, + request: Optional[locations_pb2.ListLocationsRequest] = None, + *, + retry: OptionalRetry = gapic_v1.method.DEFAULT, + timeout: Union[float, object] = gapic_v1.method.DEFAULT, + metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), + ) -> locations_pb2.ListLocationsResponse: + r"""Lists information about the supported locations for this service. + + Args: + request (:class:`~.location_pb2.ListLocationsRequest`): + The request object. Request message for + `ListLocations` method. + retry (google.api_core.retry_async.AsyncRetry): Designation of what errors, + if any, should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + Returns: + ~.location_pb2.ListLocationsResponse: + Response message for ``ListLocations`` method. + """ + # Create or coerce a protobuf request object. + # The request isn't a proto-plus wrapped type, + # so it must be constructed via keyword expansion. + if isinstance(request, dict): + request = locations_pb2.ListLocationsRequest(**request) + + # Wrap the RPC method; this adds retry and timeout information, + # and friendly error handling. + rpc = self.transport._wrapped_methods[self._client._transport.list_locations] + + # Certain fields should be provided within the metadata header; + # add these here. + metadata = tuple(metadata) + ( + gapic_v1.routing_header.to_grpc_metadata( + (("name", request.name),)), + ) + + # Validate the universe domain. + self._client._validate_universe_domain() + + # Send the request. + response = await rpc( + request, retry=retry, timeout=timeout, metadata=metadata,) + + # Done; return the response. + return response + + async def __aenter__(self) -> "ConfidentialComputingAsyncClient": + return self + + async def __aexit__(self, exc_type, exc, tb): + await self.transport.close() + +DEFAULT_CLIENT_INFO = gapic_v1.client_info.ClientInfo(gapic_version=package_version.__version__) + +if hasattr(DEFAULT_CLIENT_INFO, "protobuf_runtime_version"): # pragma: NO COVER + DEFAULT_CLIENT_INFO.protobuf_runtime_version = google.protobuf.__version__ + + +__all__ = ( + "ConfidentialComputingAsyncClient", +) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/client.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/client.py new file mode 100644 index 000000000000..b269902f541e --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/client.py @@ -0,0 +1,1123 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +from collections import OrderedDict +from http import HTTPStatus +import json +import logging as std_logging +import os +import re +from typing import Dict, Callable, Mapping, MutableMapping, MutableSequence, Optional, Sequence, Tuple, Type, Union, cast +import warnings + +from google.cloud.confidentialcomputing_v1 import gapic_version as package_version + +from google.api_core import client_options as client_options_lib +from google.api_core import exceptions as core_exceptions +from google.api_core import gapic_v1 +from google.api_core import retry as retries +from google.auth import credentials as ga_credentials # type: ignore +from google.auth.transport import mtls # type: ignore +from google.auth.transport.grpc import SslCredentials # type: ignore +from google.auth.exceptions import MutualTLSChannelError # type: ignore +from google.oauth2 import service_account # type: ignore +import google.protobuf + +try: + OptionalRetry = Union[retries.Retry, gapic_v1.method._MethodDefault, None] +except AttributeError: # pragma: NO COVER + OptionalRetry = Union[retries.Retry, object, None] # type: ignore + +try: + from google.api_core import client_logging # type: ignore + CLIENT_LOGGING_SUPPORTED = True # pragma: NO COVER +except ImportError: # pragma: NO COVER + CLIENT_LOGGING_SUPPORTED = False + +_LOGGER = std_logging.getLogger(__name__) + +from google.cloud.confidentialcomputing_v1.types import service +from google.cloud.location import locations_pb2 # type: ignore +from google.protobuf import timestamp_pb2 # type: ignore +from google.rpc import status_pb2 # type: ignore +from .transports.base import ConfidentialComputingTransport, DEFAULT_CLIENT_INFO +from .transports.grpc import ConfidentialComputingGrpcTransport +from .transports.grpc_asyncio import ConfidentialComputingGrpcAsyncIOTransport +from .transports.rest import ConfidentialComputingRestTransport + + +class ConfidentialComputingClientMeta(type): + """Metaclass for the ConfidentialComputing client. + + This provides class-level methods for building and retrieving + support objects (e.g. transport) without polluting the client instance + objects. + """ + _transport_registry = OrderedDict() # type: Dict[str, Type[ConfidentialComputingTransport]] + _transport_registry["grpc"] = ConfidentialComputingGrpcTransport + _transport_registry["grpc_asyncio"] = ConfidentialComputingGrpcAsyncIOTransport + _transport_registry["rest"] = ConfidentialComputingRestTransport + + def get_transport_class(cls, + label: Optional[str] = None, + ) -> Type[ConfidentialComputingTransport]: + """Returns an appropriate transport class. + + Args: + label: The name of the desired transport. If none is + provided, then the first transport in the registry is used. + + Returns: + The transport class to use. + """ + # If a specific transport is requested, return that one. + if label: + return cls._transport_registry[label] + + # No transport is requested; return the default (that is, the first one + # in the dictionary). + return next(iter(cls._transport_registry.values())) + + +class ConfidentialComputingClient(metaclass=ConfidentialComputingClientMeta): + """Service describing handlers for resources""" + + @staticmethod + def _get_default_mtls_endpoint(api_endpoint): + """Converts api endpoint to mTLS endpoint. + + Convert "*.sandbox.googleapis.com" and "*.googleapis.com" to + "*.mtls.sandbox.googleapis.com" and "*.mtls.googleapis.com" respectively. + Args: + api_endpoint (Optional[str]): the api endpoint to convert. + Returns: + str: converted mTLS api endpoint. + """ + if not api_endpoint: + return api_endpoint + + mtls_endpoint_re = re.compile( + r"(?P[^.]+)(?P\.mtls)?(?P\.sandbox)?(?P\.googleapis\.com)?" + ) + + m = mtls_endpoint_re.match(api_endpoint) + name, mtls, sandbox, googledomain = m.groups() + if mtls or not googledomain: + return api_endpoint + + if sandbox: + return api_endpoint.replace( + "sandbox.googleapis.com", "mtls.sandbox.googleapis.com" + ) + + return api_endpoint.replace(".googleapis.com", ".mtls.googleapis.com") + + # Note: DEFAULT_ENDPOINT is deprecated. Use _DEFAULT_ENDPOINT_TEMPLATE instead. + DEFAULT_ENDPOINT = "confidentialcomputing.googleapis.com" + DEFAULT_MTLS_ENDPOINT = _get_default_mtls_endpoint.__func__( # type: ignore + DEFAULT_ENDPOINT + ) + + _DEFAULT_ENDPOINT_TEMPLATE = "confidentialcomputing.{UNIVERSE_DOMAIN}" + _DEFAULT_UNIVERSE = "googleapis.com" + + @classmethod + def from_service_account_info(cls, info: dict, *args, **kwargs): + """Creates an instance of this client using the provided credentials + info. + + Args: + info (dict): The service account private key info. + args: Additional arguments to pass to the constructor. + kwargs: Additional arguments to pass to the constructor. + + Returns: + ConfidentialComputingClient: The constructed client. + """ + credentials = service_account.Credentials.from_service_account_info(info) + kwargs["credentials"] = credentials + return cls(*args, **kwargs) + + @classmethod + def from_service_account_file(cls, filename: str, *args, **kwargs): + """Creates an instance of this client using the provided credentials + file. + + Args: + filename (str): The path to the service account private key json + file. + args: Additional arguments to pass to the constructor. + kwargs: Additional arguments to pass to the constructor. + + Returns: + ConfidentialComputingClient: The constructed client. + """ + credentials = service_account.Credentials.from_service_account_file( + filename) + kwargs["credentials"] = credentials + return cls(*args, **kwargs) + + from_service_account_json = from_service_account_file + + @property + def transport(self) -> ConfidentialComputingTransport: + """Returns the transport used by the client instance. + + Returns: + ConfidentialComputingTransport: The transport used by the client + instance. + """ + return self._transport + + @staticmethod + def challenge_path(project: str,location: str,uuid: str,) -> str: + """Returns a fully-qualified challenge string.""" + return "projects/{project}/locations/{location}/challenges/{uuid}".format(project=project, location=location, uuid=uuid, ) + + @staticmethod + def parse_challenge_path(path: str) -> Dict[str,str]: + """Parses a challenge path into its component segments.""" + m = re.match(r"^projects/(?P.+?)/locations/(?P.+?)/challenges/(?P.+?)$", path) + return m.groupdict() if m else {} + + @staticmethod + def common_billing_account_path(billing_account: str, ) -> str: + """Returns a fully-qualified billing_account string.""" + return "billingAccounts/{billing_account}".format(billing_account=billing_account, ) + + @staticmethod + def parse_common_billing_account_path(path: str) -> Dict[str,str]: + """Parse a billing_account path into its component segments.""" + m = re.match(r"^billingAccounts/(?P.+?)$", path) + return m.groupdict() if m else {} + + @staticmethod + def common_folder_path(folder: str, ) -> str: + """Returns a fully-qualified folder string.""" + return "folders/{folder}".format(folder=folder, ) + + @staticmethod + def parse_common_folder_path(path: str) -> Dict[str,str]: + """Parse a folder path into its component segments.""" + m = re.match(r"^folders/(?P.+?)$", path) + return m.groupdict() if m else {} + + @staticmethod + def common_organization_path(organization: str, ) -> str: + """Returns a fully-qualified organization string.""" + return "organizations/{organization}".format(organization=organization, ) + + @staticmethod + def parse_common_organization_path(path: str) -> Dict[str,str]: + """Parse a organization path into its component segments.""" + m = re.match(r"^organizations/(?P.+?)$", path) + return m.groupdict() if m else {} + + @staticmethod + def common_project_path(project: str, ) -> str: + """Returns a fully-qualified project string.""" + return "projects/{project}".format(project=project, ) + + @staticmethod + def parse_common_project_path(path: str) -> Dict[str,str]: + """Parse a project path into its component segments.""" + m = re.match(r"^projects/(?P.+?)$", path) + return m.groupdict() if m else {} + + @staticmethod + def common_location_path(project: str, location: str, ) -> str: + """Returns a fully-qualified location string.""" + return "projects/{project}/locations/{location}".format(project=project, location=location, ) + + @staticmethod + def parse_common_location_path(path: str) -> Dict[str,str]: + """Parse a location path into its component segments.""" + m = re.match(r"^projects/(?P.+?)/locations/(?P.+?)$", path) + return m.groupdict() if m else {} + + @classmethod + def get_mtls_endpoint_and_cert_source(cls, client_options: Optional[client_options_lib.ClientOptions] = None): + """Deprecated. Return the API endpoint and client cert source for mutual TLS. + + The client cert source is determined in the following order: + (1) if `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is not "true", the + client cert source is None. + (2) if `client_options.client_cert_source` is provided, use the provided one; if the + default client cert source exists, use the default one; otherwise the client cert + source is None. + + The API endpoint is determined in the following order: + (1) if `client_options.api_endpoint` if provided, use the provided one. + (2) if `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is "always", use the + default mTLS endpoint; if the environment variable is "never", use the default API + endpoint; otherwise if client cert source exists, use the default mTLS endpoint, otherwise + use the default API endpoint. + + More details can be found at https://google.aip.dev/auth/4114. + + Args: + client_options (google.api_core.client_options.ClientOptions): Custom options for the + client. Only the `api_endpoint` and `client_cert_source` properties may be used + in this method. + + Returns: + Tuple[str, Callable[[], Tuple[bytes, bytes]]]: returns the API endpoint and the + client cert source to use. + + Raises: + google.auth.exceptions.MutualTLSChannelError: If any errors happen. + """ + + warnings.warn("get_mtls_endpoint_and_cert_source is deprecated. Use the api_endpoint property instead.", + DeprecationWarning) + if client_options is None: + client_options = client_options_lib.ClientOptions() + use_client_cert = os.getenv("GOOGLE_API_USE_CLIENT_CERTIFICATE", "false") + use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto") + if use_client_cert not in ("true", "false"): + raise ValueError("Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`") + if use_mtls_endpoint not in ("auto", "never", "always"): + raise MutualTLSChannelError("Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`") + + # Figure out the client cert source to use. + client_cert_source = None + if use_client_cert == "true": + if client_options.client_cert_source: + client_cert_source = client_options.client_cert_source + elif mtls.has_default_client_cert_source(): + client_cert_source = mtls.default_client_cert_source() + + # Figure out which api endpoint to use. + if client_options.api_endpoint is not None: + api_endpoint = client_options.api_endpoint + elif use_mtls_endpoint == "always" or (use_mtls_endpoint == "auto" and client_cert_source): + api_endpoint = cls.DEFAULT_MTLS_ENDPOINT + else: + api_endpoint = cls.DEFAULT_ENDPOINT + + return api_endpoint, client_cert_source + + @staticmethod + def _read_environment_variables(): + """Returns the environment variables used by the client. + + Returns: + Tuple[bool, str, str]: returns the GOOGLE_API_USE_CLIENT_CERTIFICATE, + GOOGLE_API_USE_MTLS_ENDPOINT, and GOOGLE_CLOUD_UNIVERSE_DOMAIN environment variables. + + Raises: + ValueError: If GOOGLE_API_USE_CLIENT_CERTIFICATE is not + any of ["true", "false"]. + google.auth.exceptions.MutualTLSChannelError: If GOOGLE_API_USE_MTLS_ENDPOINT + is not any of ["auto", "never", "always"]. + """ + use_client_cert = os.getenv("GOOGLE_API_USE_CLIENT_CERTIFICATE", "false").lower() + use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower() + universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN") + if use_client_cert not in ("true", "false"): + raise ValueError("Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`") + if use_mtls_endpoint not in ("auto", "never", "always"): + raise MutualTLSChannelError("Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`") + return use_client_cert == "true", use_mtls_endpoint, universe_domain_env + + @staticmethod + def _get_client_cert_source(provided_cert_source, use_cert_flag): + """Return the client cert source to be used by the client. + + Args: + provided_cert_source (bytes): The client certificate source provided. + use_cert_flag (bool): A flag indicating whether to use the client certificate. + + Returns: + bytes or None: The client cert source to be used by the client. + """ + client_cert_source = None + if use_cert_flag: + if provided_cert_source: + client_cert_source = provided_cert_source + elif mtls.has_default_client_cert_source(): + client_cert_source = mtls.default_client_cert_source() + return client_cert_source + + @staticmethod + def _get_api_endpoint(api_override, client_cert_source, universe_domain, use_mtls_endpoint): + """Return the API endpoint used by the client. + + Args: + api_override (str): The API endpoint override. If specified, this is always + the return value of this function and the other arguments are not used. + client_cert_source (bytes): The client certificate source used by the client. + universe_domain (str): The universe domain used by the client. + use_mtls_endpoint (str): How to use the mTLS endpoint, which depends also on the other parameters. + Possible values are "always", "auto", or "never". + + Returns: + str: The API endpoint to be used by the client. + """ + if api_override is not None: + api_endpoint = api_override + elif use_mtls_endpoint == "always" or (use_mtls_endpoint == "auto" and client_cert_source): + _default_universe = ConfidentialComputingClient._DEFAULT_UNIVERSE + if universe_domain != _default_universe: + raise MutualTLSChannelError(f"mTLS is not supported in any universe other than {_default_universe}.") + api_endpoint = ConfidentialComputingClient.DEFAULT_MTLS_ENDPOINT + else: + api_endpoint = ConfidentialComputingClient._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=universe_domain) + return api_endpoint + + @staticmethod + def _get_universe_domain(client_universe_domain: Optional[str], universe_domain_env: Optional[str]) -> str: + """Return the universe domain used by the client. + + Args: + client_universe_domain (Optional[str]): The universe domain configured via the client options. + universe_domain_env (Optional[str]): The universe domain configured via the "GOOGLE_CLOUD_UNIVERSE_DOMAIN" environment variable. + + Returns: + str: The universe domain to be used by the client. + + Raises: + ValueError: If the universe domain is an empty string. + """ + universe_domain = ConfidentialComputingClient._DEFAULT_UNIVERSE + if client_universe_domain is not None: + universe_domain = client_universe_domain + elif universe_domain_env is not None: + universe_domain = universe_domain_env + if len(universe_domain.strip()) == 0: + raise ValueError("Universe Domain cannot be an empty string.") + return universe_domain + + def _validate_universe_domain(self): + """Validates client's and credentials' universe domains are consistent. + + Returns: + bool: True iff the configured universe domain is valid. + + Raises: + ValueError: If the configured universe domain is not valid. + """ + + # NOTE (b/349488459): universe validation is disabled until further notice. + return True + + def _add_cred_info_for_auth_errors( + self, + error: core_exceptions.GoogleAPICallError + ) -> None: + """Adds credential info string to error details for 401/403/404 errors. + + Args: + error (google.api_core.exceptions.GoogleAPICallError): The error to add the cred info. + """ + if error.code not in [HTTPStatus.UNAUTHORIZED, HTTPStatus.FORBIDDEN, HTTPStatus.NOT_FOUND]: + return + + cred = self._transport._credentials + + # get_cred_info is only available in google-auth>=2.35.0 + if not hasattr(cred, "get_cred_info"): + return + + # ignore the type check since pypy test fails when get_cred_info + # is not available + cred_info = cred.get_cred_info() # type: ignore + if cred_info and hasattr(error._details, "append"): + error._details.append(json.dumps(cred_info)) + + @property + def api_endpoint(self): + """Return the API endpoint used by the client instance. + + Returns: + str: The API endpoint used by the client instance. + """ + return self._api_endpoint + + @property + def universe_domain(self) -> str: + """Return the universe domain used by the client instance. + + Returns: + str: The universe domain used by the client instance. + """ + return self._universe_domain + + def __init__(self, *, + credentials: Optional[ga_credentials.Credentials] = None, + transport: Optional[Union[str, ConfidentialComputingTransport, Callable[..., ConfidentialComputingTransport]]] = None, + client_options: Optional[Union[client_options_lib.ClientOptions, dict]] = None, + client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO, + ) -> None: + """Instantiates the confidential computing client. + + Args: + credentials (Optional[google.auth.credentials.Credentials]): The + authorization credentials to attach to requests. These + credentials identify the application to the service; if none + are specified, the client will attempt to ascertain the + credentials from the environment. + transport (Optional[Union[str,ConfidentialComputingTransport,Callable[..., ConfidentialComputingTransport]]]): + The transport to use, or a Callable that constructs and returns a new transport. + If a Callable is given, it will be called with the same set of initialization + arguments as used in the ConfidentialComputingTransport constructor. + If set to None, a transport is chosen automatically. + client_options (Optional[Union[google.api_core.client_options.ClientOptions, dict]]): + Custom options for the client. + + 1. The ``api_endpoint`` property can be used to override the + default endpoint provided by the client when ``transport`` is + not explicitly provided. Only if this property is not set and + ``transport`` was not explicitly provided, the endpoint is + determined by the GOOGLE_API_USE_MTLS_ENDPOINT environment + variable, which have one of the following values: + "always" (always use the default mTLS endpoint), "never" (always + use the default regular endpoint) and "auto" (auto-switch to the + default mTLS endpoint if client certificate is present; this is + the default value). + + 2. If the GOOGLE_API_USE_CLIENT_CERTIFICATE environment variable + is "true", then the ``client_cert_source`` property can be used + to provide a client certificate for mTLS transport. If + not provided, the default SSL client certificate will be used if + present. If GOOGLE_API_USE_CLIENT_CERTIFICATE is "false" or not + set, no client certificate will be used. + + 3. The ``universe_domain`` property can be used to override the + default "googleapis.com" universe. Note that the ``api_endpoint`` + property still takes precedence; and ``universe_domain`` is + currently not supported for mTLS. + + client_info (google.api_core.gapic_v1.client_info.ClientInfo): + The client info used to send a user-agent string along with + API requests. If ``None``, then default info will be used. + Generally, you only need to set this if you're developing + your own client library. + + Raises: + google.auth.exceptions.MutualTLSChannelError: If mutual TLS transport + creation failed for any reason. + """ + self._client_options = client_options + if isinstance(self._client_options, dict): + self._client_options = client_options_lib.from_dict(self._client_options) + if self._client_options is None: + self._client_options = client_options_lib.ClientOptions() + self._client_options = cast(client_options_lib.ClientOptions, self._client_options) + + universe_domain_opt = getattr(self._client_options, 'universe_domain', None) + + self._use_client_cert, self._use_mtls_endpoint, self._universe_domain_env = ConfidentialComputingClient._read_environment_variables() + self._client_cert_source = ConfidentialComputingClient._get_client_cert_source(self._client_options.client_cert_source, self._use_client_cert) + self._universe_domain = ConfidentialComputingClient._get_universe_domain(universe_domain_opt, self._universe_domain_env) + self._api_endpoint = None # updated below, depending on `transport` + + # Initialize the universe domain validation. + self._is_universe_domain_valid = False + + if CLIENT_LOGGING_SUPPORTED: # pragma: NO COVER + # Setup logging. + client_logging.initialize_logging() + + api_key_value = getattr(self._client_options, "api_key", None) + if api_key_value and credentials: + raise ValueError("client_options.api_key and credentials are mutually exclusive") + + # Save or instantiate the transport. + # Ordinarily, we provide the transport, but allowing a custom transport + # instance provides an extensibility point for unusual situations. + transport_provided = isinstance(transport, ConfidentialComputingTransport) + if transport_provided: + # transport is a ConfidentialComputingTransport instance. + if credentials or self._client_options.credentials_file or api_key_value: + raise ValueError("When providing a transport instance, " + "provide its credentials directly.") + if self._client_options.scopes: + raise ValueError( + "When providing a transport instance, provide its scopes " + "directly." + ) + self._transport = cast(ConfidentialComputingTransport, transport) + self._api_endpoint = self._transport.host + + self._api_endpoint = (self._api_endpoint or + ConfidentialComputingClient._get_api_endpoint( + self._client_options.api_endpoint, + self._client_cert_source, + self._universe_domain, + self._use_mtls_endpoint)) + + if not transport_provided: + import google.auth._default # type: ignore + + if api_key_value and hasattr(google.auth._default, "get_api_key_credentials"): + credentials = google.auth._default.get_api_key_credentials(api_key_value) + + transport_init: Union[Type[ConfidentialComputingTransport], Callable[..., ConfidentialComputingTransport]] = ( + ConfidentialComputingClient.get_transport_class(transport) + if isinstance(transport, str) or transport is None + else cast(Callable[..., ConfidentialComputingTransport], transport) + ) + # initialize with the provided callable or the passed in class + self._transport = transport_init( + credentials=credentials, + credentials_file=self._client_options.credentials_file, + host=self._api_endpoint, + scopes=self._client_options.scopes, + client_cert_source_for_mtls=self._client_cert_source, + quota_project_id=self._client_options.quota_project_id, + client_info=client_info, + always_use_jwt_access=True, + api_audience=self._client_options.api_audience, + ) + + if "async" not in str(self._transport): + if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(std_logging.DEBUG): # pragma: NO COVER + _LOGGER.debug( + "Created client `google.cloud.confidentialcomputing_v1.ConfidentialComputingClient`.", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "universeDomain": getattr(self._transport._credentials, "universe_domain", ""), + "credentialsType": f"{type(self._transport._credentials).__module__}.{type(self._transport._credentials).__qualname__}", + "credentialsInfo": getattr(self.transport._credentials, "get_cred_info", lambda: None)(), + } if hasattr(self._transport, "_credentials") else { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "credentialsType": None, + } + ) + + def create_challenge(self, + request: Optional[Union[service.CreateChallengeRequest, dict]] = None, + *, + parent: Optional[str] = None, + challenge: Optional[service.Challenge] = None, + retry: OptionalRetry = gapic_v1.method.DEFAULT, + timeout: Union[float, object] = gapic_v1.method.DEFAULT, + metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), + ) -> service.Challenge: + r"""Creates a new Challenge in a given project and + location. + + .. code-block:: python + + # This snippet has been automatically generated and should be regarded as a + # code template only. + # It will require modifications to work: + # - It may require correct/in-range values for request initialization. + # - It may require specifying regional endpoints when creating the service + # client as shown in: + # https://googleapis.dev/python/google-api-core/latest/client_options.html + from google.cloud import confidentialcomputing_v1 + + def sample_create_challenge(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.CreateChallengeRequest( + parent="parent_value", + ) + + # Make the request + response = client.create_challenge(request=request) + + # Handle the response + print(response) + + Args: + request (Union[google.cloud.confidentialcomputing_v1.types.CreateChallengeRequest, dict]): + The request object. Message for creating a Challenge + parent (str): + Required. The resource name of the location where the + Challenge will be used, in the format + ``projects/*/locations/*``. + + This corresponds to the ``parent`` field + on the ``request`` instance; if ``request`` is provided, this + should not be set. + challenge (google.cloud.confidentialcomputing_v1.types.Challenge): + Required. The Challenge to be + created. Currently this field can be + empty as all the Challenge fields are + set by the server. + + This corresponds to the ``challenge`` field + on the ``request`` instance; if ``request`` is provided, this + should not be set. + retry (google.api_core.retry.Retry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + google.cloud.confidentialcomputing_v1.types.Challenge: + A Challenge from the server used to + guarantee freshness of attestations + + """ + # Create or coerce a protobuf request object. + # - Quick check: If we got a request object, we should *not* have + # gotten any keyword arguments that map to the request. + flattened_params = [parent, challenge] + has_flattened_params = len([param for param in flattened_params if param is not None]) > 0 + if request is not None and has_flattened_params: + raise ValueError('If the `request` argument is set, then none of ' + 'the individual field arguments should be set.') + + # - Use the request object if provided (there's no risk of modifying the input as + # there are no flattened fields), or create one. + if not isinstance(request, service.CreateChallengeRequest): + request = service.CreateChallengeRequest(request) + # If we have keyword arguments corresponding to fields on the + # request, apply these. + if parent is not None: + request.parent = parent + if challenge is not None: + request.challenge = challenge + + # Wrap the RPC method; this adds retry and timeout information, + # and friendly error handling. + rpc = self._transport._wrapped_methods[self._transport.create_challenge] + + # Certain fields should be provided within the metadata header; + # add these here. + metadata = tuple(metadata) + ( + gapic_v1.routing_header.to_grpc_metadata(( + ("parent", request.parent), + )), + ) + + # Validate the universe domain. + self._validate_universe_domain() + + # Send the request. + response = rpc( + request, + retry=retry, + timeout=timeout, + metadata=metadata, + ) + + # Done; return the response. + return response + + def verify_attestation(self, + request: Optional[Union[service.VerifyAttestationRequest, dict]] = None, + *, + retry: OptionalRetry = gapic_v1.method.DEFAULT, + timeout: Union[float, object] = gapic_v1.method.DEFAULT, + metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), + ) -> service.VerifyAttestationResponse: + r"""Verifies the provided attestation info, returning a + signed attestation token. + + .. code-block:: python + + # This snippet has been automatically generated and should be regarded as a + # code template only. + # It will require modifications to work: + # - It may require correct/in-range values for request initialization. + # - It may require specifying regional endpoints when creating the service + # client as shown in: + # https://googleapis.dev/python/google-api-core/latest/client_options.html + from google.cloud import confidentialcomputing_v1 + + def sample_verify_attestation(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.VerifyAttestationRequest( + challenge="challenge_value", + ) + + # Make the request + response = client.verify_attestation(request=request) + + # Handle the response + print(response) + + Args: + request (Union[google.cloud.confidentialcomputing_v1.types.VerifyAttestationRequest, dict]): + The request object. A request for an attestation token, + providing all the necessary information + needed for this service to verify the + platform state of the requestor. + retry (google.api_core.retry.Retry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + google.cloud.confidentialcomputing_v1.types.VerifyAttestationResponse: + A response once an attestation has + been successfully verified, containing a + signed attestation token. + + """ + # Create or coerce a protobuf request object. + # - Use the request object if provided (there's no risk of modifying the input as + # there are no flattened fields), or create one. + if not isinstance(request, service.VerifyAttestationRequest): + request = service.VerifyAttestationRequest(request) + + # Wrap the RPC method; this adds retry and timeout information, + # and friendly error handling. + rpc = self._transport._wrapped_methods[self._transport.verify_attestation] + + # Certain fields should be provided within the metadata header; + # add these here. + metadata = tuple(metadata) + ( + gapic_v1.routing_header.to_grpc_metadata(( + ("challenge", request.challenge), + )), + ) + + # Validate the universe domain. + self._validate_universe_domain() + + # Send the request. + response = rpc( + request, + retry=retry, + timeout=timeout, + metadata=metadata, + ) + + # Done; return the response. + return response + + def verify_confidential_space(self, + request: Optional[Union[service.VerifyConfidentialSpaceRequest, dict]] = None, + *, + retry: OptionalRetry = gapic_v1.method.DEFAULT, + timeout: Union[float, object] = gapic_v1.method.DEFAULT, + metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), + ) -> service.VerifyConfidentialSpaceResponse: + r"""Verifies whether the provided attestation info is + valid, returning a signed attestation token if so. + + .. code-block:: python + + # This snippet has been automatically generated and should be regarded as a + # code template only. + # It will require modifications to work: + # - It may require correct/in-range values for request initialization. + # - It may require specifying regional endpoints when creating the service + # client as shown in: + # https://googleapis.dev/python/google-api-core/latest/client_options.html + from google.cloud import confidentialcomputing_v1 + + def sample_verify_confidential_space(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.VerifyConfidentialSpaceRequest( + challenge="challenge_value", + ) + + # Make the request + response = client.verify_confidential_space(request=request) + + # Handle the response + print(response) + + Args: + request (Union[google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceRequest, dict]): + The request object. A request for an attestation token, + providing all the necessary information + needed for this service to verify the + platform state of the requestor. + retry (google.api_core.retry.Retry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceResponse: + VerifyConfidentialSpaceResponse is + returned once a Confidential Space + attestation has been successfully + verified, containing a signed token. + + """ + # Create or coerce a protobuf request object. + # - Use the request object if provided (there's no risk of modifying the input as + # there are no flattened fields), or create one. + if not isinstance(request, service.VerifyConfidentialSpaceRequest): + request = service.VerifyConfidentialSpaceRequest(request) + + # Wrap the RPC method; this adds retry and timeout information, + # and friendly error handling. + rpc = self._transport._wrapped_methods[self._transport.verify_confidential_space] + + # Certain fields should be provided within the metadata header; + # add these here. + metadata = tuple(metadata) + ( + gapic_v1.routing_header.to_grpc_metadata(( + ("challenge", request.challenge), + )), + ) + + # Validate the universe domain. + self._validate_universe_domain() + + # Send the request. + response = rpc( + request, + retry=retry, + timeout=timeout, + metadata=metadata, + ) + + # Done; return the response. + return response + + def verify_confidential_gke(self, + request: Optional[Union[service.VerifyConfidentialGkeRequest, dict]] = None, + *, + retry: OptionalRetry = gapic_v1.method.DEFAULT, + timeout: Union[float, object] = gapic_v1.method.DEFAULT, + metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), + ) -> service.VerifyConfidentialGkeResponse: + r"""Verifies the provided Confidential GKE attestation + info, returning a signed OIDC token. + + .. code-block:: python + + # This snippet has been automatically generated and should be regarded as a + # code template only. + # It will require modifications to work: + # - It may require correct/in-range values for request initialization. + # - It may require specifying regional endpoints when creating the service + # client as shown in: + # https://googleapis.dev/python/google-api-core/latest/client_options.html + from google.cloud import confidentialcomputing_v1 + + def sample_verify_confidential_gke(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.VerifyConfidentialGkeRequest( + challenge="challenge_value", + ) + + # Make the request + response = client.verify_confidential_gke(request=request) + + # Handle the response + print(response) + + Args: + request (Union[google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeRequest, dict]): + The request object. A request for an attestation token, + providing all the necessary information + needed for this service to verify + Confidential GKE platform state of the + requestor. + retry (google.api_core.retry.Retry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeResponse: + VerifyConfidentialGkeResponse + response is returened once a + Confidential GKE attestation has been + successfully verified, containing a + signed OIDC token. + + """ + # Create or coerce a protobuf request object. + # - Use the request object if provided (there's no risk of modifying the input as + # there are no flattened fields), or create one. + if not isinstance(request, service.VerifyConfidentialGkeRequest): + request = service.VerifyConfidentialGkeRequest(request) + + # Wrap the RPC method; this adds retry and timeout information, + # and friendly error handling. + rpc = self._transport._wrapped_methods[self._transport.verify_confidential_gke] + + # Certain fields should be provided within the metadata header; + # add these here. + metadata = tuple(metadata) + ( + gapic_v1.routing_header.to_grpc_metadata(( + ("challenge", request.challenge), + )), + ) + + # Validate the universe domain. + self._validate_universe_domain() + + # Send the request. + response = rpc( + request, + retry=retry, + timeout=timeout, + metadata=metadata, + ) + + # Done; return the response. + return response + + def __enter__(self) -> "ConfidentialComputingClient": + return self + + def __exit__(self, type, value, traceback): + """Releases underlying transport's resources. + + .. warning:: + ONLY use as a context manager if the transport is NOT shared + with other clients! Exiting the with block will CLOSE the transport + and may cause errors in other clients! + """ + self.transport.close() + + def get_location( + self, + request: Optional[locations_pb2.GetLocationRequest] = None, + *, + retry: OptionalRetry = gapic_v1.method.DEFAULT, + timeout: Union[float, object] = gapic_v1.method.DEFAULT, + metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), + ) -> locations_pb2.Location: + r"""Gets information about a location. + + Args: + request (:class:`~.location_pb2.GetLocationRequest`): + The request object. Request message for + `GetLocation` method. + retry (google.api_core.retry.Retry): Designation of what errors, + if any, should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + Returns: + ~.location_pb2.Location: + Location object. + """ + # Create or coerce a protobuf request object. + # The request isn't a proto-plus wrapped type, + # so it must be constructed via keyword expansion. + if isinstance(request, dict): + request = locations_pb2.GetLocationRequest(**request) + + # Wrap the RPC method; this adds retry and timeout information, + # and friendly error handling. + rpc = self._transport._wrapped_methods[self._transport.get_location] + + # Certain fields should be provided within the metadata header; + # add these here. + metadata = tuple(metadata) + ( + gapic_v1.routing_header.to_grpc_metadata( + (("name", request.name),)), + ) + + # Validate the universe domain. + self._validate_universe_domain() + + try: + # Send the request. + response = rpc( + request, retry=retry, timeout=timeout, metadata=metadata,) + + # Done; return the response. + return response + except core_exceptions.GoogleAPICallError as e: + self._add_cred_info_for_auth_errors(e) + raise e + + def list_locations( + self, + request: Optional[locations_pb2.ListLocationsRequest] = None, + *, + retry: OptionalRetry = gapic_v1.method.DEFAULT, + timeout: Union[float, object] = gapic_v1.method.DEFAULT, + metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), + ) -> locations_pb2.ListLocationsResponse: + r"""Lists information about the supported locations for this service. + + Args: + request (:class:`~.location_pb2.ListLocationsRequest`): + The request object. Request message for + `ListLocations` method. + retry (google.api_core.retry.Retry): Designation of what errors, + if any, should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + Returns: + ~.location_pb2.ListLocationsResponse: + Response message for ``ListLocations`` method. + """ + # Create or coerce a protobuf request object. + # The request isn't a proto-plus wrapped type, + # so it must be constructed via keyword expansion. + if isinstance(request, dict): + request = locations_pb2.ListLocationsRequest(**request) + + # Wrap the RPC method; this adds retry and timeout information, + # and friendly error handling. + rpc = self._transport._wrapped_methods[self._transport.list_locations] + + # Certain fields should be provided within the metadata header; + # add these here. + metadata = tuple(metadata) + ( + gapic_v1.routing_header.to_grpc_metadata( + (("name", request.name),)), + ) + + # Validate the universe domain. + self._validate_universe_domain() + + try: + # Send the request. + response = rpc( + request, retry=retry, timeout=timeout, metadata=metadata,) + + # Done; return the response. + return response + except core_exceptions.GoogleAPICallError as e: + self._add_cred_info_for_auth_errors(e) + raise e + + +DEFAULT_CLIENT_INFO = gapic_v1.client_info.ClientInfo(gapic_version=package_version.__version__) + +if hasattr(DEFAULT_CLIENT_INFO, "protobuf_runtime_version"): # pragma: NO COVER + DEFAULT_CLIENT_INFO.protobuf_runtime_version = google.protobuf.__version__ + +__all__ = ( + "ConfidentialComputingClient", +) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/README.rst b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/README.rst new file mode 100644 index 000000000000..2bf126ac1dec --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/README.rst @@ -0,0 +1,9 @@ + +transport inheritance structure +_______________________________ + +`ConfidentialComputingTransport` is the ABC for all transports. +- public child `ConfidentialComputingGrpcTransport` for sync gRPC transport (defined in `grpc.py`). +- public child `ConfidentialComputingGrpcAsyncIOTransport` for async gRPC transport (defined in `grpc_asyncio.py`). +- private child `_BaseConfidentialComputingRestTransport` for base REST transport with inner classes `_BaseMETHOD` (defined in `rest_base.py`). +- public child `ConfidentialComputingRestTransport` for sync REST transport with inner classes `METHOD` derived from the parent's corresponding `_BaseMETHOD` classes (defined in `rest.py`). diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/__init__.py new file mode 100644 index 000000000000..c7d682081e49 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/__init__.py @@ -0,0 +1,38 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +from collections import OrderedDict +from typing import Dict, Type + +from .base import ConfidentialComputingTransport +from .grpc import ConfidentialComputingGrpcTransport +from .grpc_asyncio import ConfidentialComputingGrpcAsyncIOTransport +from .rest import ConfidentialComputingRestTransport +from .rest import ConfidentialComputingRestInterceptor + + +# Compile a registry of transports. +_transport_registry = OrderedDict() # type: Dict[str, Type[ConfidentialComputingTransport]] +_transport_registry['grpc'] = ConfidentialComputingGrpcTransport +_transport_registry['grpc_asyncio'] = ConfidentialComputingGrpcAsyncIOTransport +_transport_registry['rest'] = ConfidentialComputingRestTransport + +__all__ = ( + 'ConfidentialComputingTransport', + 'ConfidentialComputingGrpcTransport', + 'ConfidentialComputingGrpcAsyncIOTransport', + 'ConfidentialComputingRestTransport', + 'ConfidentialComputingRestInterceptor', +) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/base.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/base.py new file mode 100644 index 000000000000..40ff08bd7b14 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/base.py @@ -0,0 +1,264 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +import abc +from typing import Awaitable, Callable, Dict, Optional, Sequence, Union + +from google.cloud.confidentialcomputing_v1 import gapic_version as package_version + +import google.auth # type: ignore +import google.api_core +from google.api_core import exceptions as core_exceptions +from google.api_core import gapic_v1 +from google.api_core import retry as retries +from google.auth import credentials as ga_credentials # type: ignore +from google.oauth2 import service_account # type: ignore +import google.protobuf + +from google.cloud.confidentialcomputing_v1.types import service +from google.cloud.location import locations_pb2 # type: ignore + +DEFAULT_CLIENT_INFO = gapic_v1.client_info.ClientInfo(gapic_version=package_version.__version__) + +if hasattr(DEFAULT_CLIENT_INFO, "protobuf_runtime_version"): # pragma: NO COVER + DEFAULT_CLIENT_INFO.protobuf_runtime_version = google.protobuf.__version__ + + +class ConfidentialComputingTransport(abc.ABC): + """Abstract transport class for ConfidentialComputing.""" + + AUTH_SCOPES = ( + 'https://www.googleapis.com/auth/cloud-platform', + ) + + DEFAULT_HOST: str = 'confidentialcomputing.googleapis.com' + + def __init__( + self, *, + host: str = DEFAULT_HOST, + credentials: Optional[ga_credentials.Credentials] = None, + credentials_file: Optional[str] = None, + scopes: Optional[Sequence[str]] = None, + quota_project_id: Optional[str] = None, + client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO, + always_use_jwt_access: Optional[bool] = False, + api_audience: Optional[str] = None, + **kwargs, + ) -> None: + """Instantiate the transport. + + Args: + host (Optional[str]): + The hostname to connect to (default: 'confidentialcomputing.googleapis.com'). + credentials (Optional[google.auth.credentials.Credentials]): The + authorization credentials to attach to requests. These + credentials identify the application to the service; if none + are specified, the client will attempt to ascertain the + credentials from the environment. + credentials_file (Optional[str]): A file with credentials that can + be loaded with :func:`google.auth.load_credentials_from_file`. + This argument is mutually exclusive with credentials. + scopes (Optional[Sequence[str]]): A list of scopes. + quota_project_id (Optional[str]): An optional project to use for billing + and quota. + client_info (google.api_core.gapic_v1.client_info.ClientInfo): + The client info used to send a user-agent string along with + API requests. If ``None``, then default info will be used. + Generally, you only need to set this if you're developing + your own client library. + always_use_jwt_access (Optional[bool]): Whether self signed JWT should + be used for service account credentials. + """ + + scopes_kwargs = {"scopes": scopes, "default_scopes": self.AUTH_SCOPES} + + # Save the scopes. + self._scopes = scopes + if not hasattr(self, "_ignore_credentials"): + self._ignore_credentials: bool = False + + # If no credentials are provided, then determine the appropriate + # defaults. + if credentials and credentials_file: + raise core_exceptions.DuplicateCredentialArgs("'credentials_file' and 'credentials' are mutually exclusive") + + if credentials_file is not None: + credentials, _ = google.auth.load_credentials_from_file( + credentials_file, + **scopes_kwargs, + quota_project_id=quota_project_id + ) + elif credentials is None and not self._ignore_credentials: + credentials, _ = google.auth.default(**scopes_kwargs, quota_project_id=quota_project_id) + # Don't apply audience if the credentials file passed from user. + if hasattr(credentials, "with_gdch_audience"): + credentials = credentials.with_gdch_audience(api_audience if api_audience else host) + + # If the credentials are service account credentials, then always try to use self signed JWT. + if always_use_jwt_access and isinstance(credentials, service_account.Credentials) and hasattr(service_account.Credentials, "with_always_use_jwt_access"): + credentials = credentials.with_always_use_jwt_access(True) + + # Save the credentials. + self._credentials = credentials + + # Save the hostname. Default to port 443 (HTTPS) if none is specified. + if ':' not in host: + host += ':443' + self._host = host + + @property + def host(self): + return self._host + + def _prep_wrapped_messages(self, client_info): + # Precompute the wrapped methods. + self._wrapped_methods = { + self.create_challenge: gapic_v1.method.wrap_method( + self.create_challenge, + default_retry=retries.Retry( + initial=1.0, + maximum=60.0, + multiplier=1.3, + predicate=retries.if_exception_type( + core_exceptions.ServiceUnavailable, + ), + deadline=60.0, + ), + default_timeout=60.0, + client_info=client_info, + ), + self.verify_attestation: gapic_v1.method.wrap_method( + self.verify_attestation, + default_retry=retries.Retry( + initial=1.0, + maximum=60.0, + multiplier=1.3, + predicate=retries.if_exception_type( + core_exceptions.ServiceUnavailable, + ), + deadline=60.0, + ), + default_timeout=60.0, + client_info=client_info, + ), + self.verify_confidential_space: gapic_v1.method.wrap_method( + self.verify_confidential_space, + default_retry=retries.Retry( + initial=1.0, + maximum=60.0, + multiplier=1.3, + predicate=retries.if_exception_type( + core_exceptions.ServiceUnavailable, + ), + deadline=60.0, + ), + default_timeout=60.0, + client_info=client_info, + ), + self.verify_confidential_gke: gapic_v1.method.wrap_method( + self.verify_confidential_gke, + default_retry=retries.Retry( + initial=1.0, + maximum=60.0, + multiplier=1.3, + predicate=retries.if_exception_type( + core_exceptions.ServiceUnavailable, + ), + deadline=60.0, + ), + default_timeout=60.0, + client_info=client_info, + ), + self.get_location: gapic_v1.method.wrap_method( + self.get_location, + default_timeout=None, + client_info=client_info, + ), + self.list_locations: gapic_v1.method.wrap_method( + self.list_locations, + default_timeout=None, + client_info=client_info, + ), + } + + def close(self): + """Closes resources associated with the transport. + + .. warning:: + Only call this method if the transport is NOT shared + with other clients - this may cause errors in other clients! + """ + raise NotImplementedError() + + @property + def create_challenge(self) -> Callable[ + [service.CreateChallengeRequest], + Union[ + service.Challenge, + Awaitable[service.Challenge] + ]]: + raise NotImplementedError() + + @property + def verify_attestation(self) -> Callable[ + [service.VerifyAttestationRequest], + Union[ + service.VerifyAttestationResponse, + Awaitable[service.VerifyAttestationResponse] + ]]: + raise NotImplementedError() + + @property + def verify_confidential_space(self) -> Callable[ + [service.VerifyConfidentialSpaceRequest], + Union[ + service.VerifyConfidentialSpaceResponse, + Awaitable[service.VerifyConfidentialSpaceResponse] + ]]: + raise NotImplementedError() + + @property + def verify_confidential_gke(self) -> Callable[ + [service.VerifyConfidentialGkeRequest], + Union[ + service.VerifyConfidentialGkeResponse, + Awaitable[service.VerifyConfidentialGkeResponse] + ]]: + raise NotImplementedError() + + @property + def get_location(self, + ) -> Callable[ + [locations_pb2.GetLocationRequest], + Union[locations_pb2.Location, Awaitable[locations_pb2.Location]], + ]: + raise NotImplementedError() + + @property + def list_locations(self, + ) -> Callable[ + [locations_pb2.ListLocationsRequest], + Union[locations_pb2.ListLocationsResponse, Awaitable[locations_pb2.ListLocationsResponse]], + ]: + raise NotImplementedError() + + @property + def kind(self) -> str: + raise NotImplementedError() + + +__all__ = ( + 'ConfidentialComputingTransport', +) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc.py new file mode 100644 index 000000000000..7aa894736780 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc.py @@ -0,0 +1,465 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +import json +import logging as std_logging +import pickle +import warnings +from typing import Callable, Dict, Optional, Sequence, Tuple, Union + +from google.api_core import grpc_helpers +from google.api_core import gapic_v1 +import google.auth # type: ignore +from google.auth import credentials as ga_credentials # type: ignore +from google.auth.transport.grpc import SslCredentials # type: ignore +from google.protobuf.json_format import MessageToJson +import google.protobuf.message + +import grpc # type: ignore +import proto # type: ignore + +from google.cloud.confidentialcomputing_v1.types import service +from google.cloud.location import locations_pb2 # type: ignore +from .base import ConfidentialComputingTransport, DEFAULT_CLIENT_INFO + +try: + from google.api_core import client_logging # type: ignore + CLIENT_LOGGING_SUPPORTED = True # pragma: NO COVER +except ImportError: # pragma: NO COVER + CLIENT_LOGGING_SUPPORTED = False + +_LOGGER = std_logging.getLogger(__name__) + + +class _LoggingClientInterceptor(grpc.UnaryUnaryClientInterceptor): # pragma: NO COVER + def intercept_unary_unary(self, continuation, client_call_details, request): + logging_enabled = CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(std_logging.DEBUG) + if logging_enabled: # pragma: NO COVER + request_metadata = client_call_details.metadata + if isinstance(request, proto.Message): + request_payload = type(request).to_json(request) + elif isinstance(request, google.protobuf.message.Message): + request_payload = MessageToJson(request) + else: + request_payload = f"{type(request).__name__}: {pickle.dumps(request)}" + + request_metadata = { + key: value.decode("utf-8") if isinstance(value, bytes) else value + for key, value in request_metadata + } + grpc_request = { + "payload": request_payload, + "requestMethod": "grpc", + "metadata": dict(request_metadata), + } + _LOGGER.debug( + f"Sending request for {client_call_details.method}", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": str(client_call_details.method), + "request": grpc_request, + "metadata": grpc_request["metadata"], + }, + ) + response = continuation(client_call_details, request) + if logging_enabled: # pragma: NO COVER + response_metadata = response.trailing_metadata() + # Convert gRPC metadata `` to list of tuples + metadata = dict([(k, str(v)) for k, v in response_metadata]) if response_metadata else None + result = response.result() + if isinstance(result, proto.Message): + response_payload = type(result).to_json(result) + elif isinstance(result, google.protobuf.message.Message): + response_payload = MessageToJson(result) + else: + response_payload = f"{type(result).__name__}: {pickle.dumps(result)}" + grpc_response = { + "payload": response_payload, + "metadata": metadata, + "status": "OK", + } + _LOGGER.debug( + f"Received response for {client_call_details.method}.", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": client_call_details.method, + "response": grpc_response, + "metadata": grpc_response["metadata"], + }, + ) + return response + + +class ConfidentialComputingGrpcTransport(ConfidentialComputingTransport): + """gRPC backend transport for ConfidentialComputing. + + Service describing handlers for resources + + This class defines the same methods as the primary client, so the + primary client can load the underlying transport implementation + and call it. + + It sends protocol buffers over the wire using gRPC (which is built on + top of HTTP/2); the ``grpcio`` package must be installed. + """ + _stubs: Dict[str, Callable] + + def __init__(self, *, + host: str = 'confidentialcomputing.googleapis.com', + credentials: Optional[ga_credentials.Credentials] = None, + credentials_file: Optional[str] = None, + scopes: Optional[Sequence[str]] = None, + channel: Optional[Union[grpc.Channel, Callable[..., grpc.Channel]]] = None, + api_mtls_endpoint: Optional[str] = None, + client_cert_source: Optional[Callable[[], Tuple[bytes, bytes]]] = None, + ssl_channel_credentials: Optional[grpc.ChannelCredentials] = None, + client_cert_source_for_mtls: Optional[Callable[[], Tuple[bytes, bytes]]] = None, + quota_project_id: Optional[str] = None, + client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO, + always_use_jwt_access: Optional[bool] = False, + api_audience: Optional[str] = None, + ) -> None: + """Instantiate the transport. + + Args: + host (Optional[str]): + The hostname to connect to (default: 'confidentialcomputing.googleapis.com'). + credentials (Optional[google.auth.credentials.Credentials]): The + authorization credentials to attach to requests. These + credentials identify the application to the service; if none + are specified, the client will attempt to ascertain the + credentials from the environment. + This argument is ignored if a ``channel`` instance is provided. + credentials_file (Optional[str]): A file with credentials that can + be loaded with :func:`google.auth.load_credentials_from_file`. + This argument is ignored if a ``channel`` instance is provided. + scopes (Optional(Sequence[str])): A list of scopes. This argument is + ignored if a ``channel`` instance is provided. + channel (Optional[Union[grpc.Channel, Callable[..., grpc.Channel]]]): + A ``Channel`` instance through which to make calls, or a Callable + that constructs and returns one. If set to None, ``self.create_channel`` + is used to create the channel. If a Callable is given, it will be called + with the same arguments as used in ``self.create_channel``. + api_mtls_endpoint (Optional[str]): Deprecated. The mutual TLS endpoint. + If provided, it overrides the ``host`` argument and tries to create + a mutual TLS channel with client SSL credentials from + ``client_cert_source`` or application default SSL credentials. + client_cert_source (Optional[Callable[[], Tuple[bytes, bytes]]]): + Deprecated. A callback to provide client SSL certificate bytes and + private key bytes, both in PEM format. It is ignored if + ``api_mtls_endpoint`` is None. + ssl_channel_credentials (grpc.ChannelCredentials): SSL credentials + for the grpc channel. It is ignored if a ``channel`` instance is provided. + client_cert_source_for_mtls (Optional[Callable[[], Tuple[bytes, bytes]]]): + A callback to provide client certificate bytes and private key bytes, + both in PEM format. It is used to configure a mutual TLS channel. It is + ignored if a ``channel`` instance or ``ssl_channel_credentials`` is provided. + quota_project_id (Optional[str]): An optional project to use for billing + and quota. + client_info (google.api_core.gapic_v1.client_info.ClientInfo): + The client info used to send a user-agent string along with + API requests. If ``None``, then default info will be used. + Generally, you only need to set this if you're developing + your own client library. + always_use_jwt_access (Optional[bool]): Whether self signed JWT should + be used for service account credentials. + + Raises: + google.auth.exceptions.MutualTLSChannelError: If mutual TLS transport + creation failed for any reason. + google.api_core.exceptions.DuplicateCredentialArgs: If both ``credentials`` + and ``credentials_file`` are passed. + """ + self._grpc_channel = None + self._ssl_channel_credentials = ssl_channel_credentials + self._stubs: Dict[str, Callable] = {} + + if api_mtls_endpoint: + warnings.warn("api_mtls_endpoint is deprecated", DeprecationWarning) + if client_cert_source: + warnings.warn("client_cert_source is deprecated", DeprecationWarning) + + if isinstance(channel, grpc.Channel): + # Ignore credentials if a channel was passed. + credentials = None + self._ignore_credentials = True + # If a channel was explicitly provided, set it. + self._grpc_channel = channel + self._ssl_channel_credentials = None + + else: + if api_mtls_endpoint: + host = api_mtls_endpoint + + # Create SSL credentials with client_cert_source or application + # default SSL credentials. + if client_cert_source: + cert, key = client_cert_source() + self._ssl_channel_credentials = grpc.ssl_channel_credentials( + certificate_chain=cert, private_key=key + ) + else: + self._ssl_channel_credentials = SslCredentials().ssl_credentials + + else: + if client_cert_source_for_mtls and not ssl_channel_credentials: + cert, key = client_cert_source_for_mtls() + self._ssl_channel_credentials = grpc.ssl_channel_credentials( + certificate_chain=cert, private_key=key + ) + + # The base transport sets the host, credentials and scopes + super().__init__( + host=host, + credentials=credentials, + credentials_file=credentials_file, + scopes=scopes, + quota_project_id=quota_project_id, + client_info=client_info, + always_use_jwt_access=always_use_jwt_access, + api_audience=api_audience, + ) + + if not self._grpc_channel: + # initialize with the provided callable or the default channel + channel_init = channel or type(self).create_channel + self._grpc_channel = channel_init( + self._host, + # use the credentials which are saved + credentials=self._credentials, + # Set ``credentials_file`` to ``None`` here as + # the credentials that we saved earlier should be used. + credentials_file=None, + scopes=self._scopes, + ssl_credentials=self._ssl_channel_credentials, + quota_project_id=quota_project_id, + options=[ + ("grpc.max_send_message_length", -1), + ("grpc.max_receive_message_length", -1), + ], + ) + + self._interceptor = _LoggingClientInterceptor() + self._logged_channel = grpc.intercept_channel(self._grpc_channel, self._interceptor) + + # Wrap messages. This must be done after self._logged_channel exists + self._prep_wrapped_messages(client_info) + + @classmethod + def create_channel(cls, + host: str = 'confidentialcomputing.googleapis.com', + credentials: Optional[ga_credentials.Credentials] = None, + credentials_file: Optional[str] = None, + scopes: Optional[Sequence[str]] = None, + quota_project_id: Optional[str] = None, + **kwargs) -> grpc.Channel: + """Create and return a gRPC channel object. + Args: + host (Optional[str]): The host for the channel to use. + credentials (Optional[~.Credentials]): The + authorization credentials to attach to requests. These + credentials identify this application to the service. If + none are specified, the client will attempt to ascertain + the credentials from the environment. + credentials_file (Optional[str]): A file with credentials that can + be loaded with :func:`google.auth.load_credentials_from_file`. + This argument is mutually exclusive with credentials. + scopes (Optional[Sequence[str]]): A optional list of scopes needed for this + service. These are only used when credentials are not specified and + are passed to :func:`google.auth.default`. + quota_project_id (Optional[str]): An optional project to use for billing + and quota. + kwargs (Optional[dict]): Keyword arguments, which are passed to the + channel creation. + Returns: + grpc.Channel: A gRPC channel object. + + Raises: + google.api_core.exceptions.DuplicateCredentialArgs: If both ``credentials`` + and ``credentials_file`` are passed. + """ + + return grpc_helpers.create_channel( + host, + credentials=credentials, + credentials_file=credentials_file, + quota_project_id=quota_project_id, + default_scopes=cls.AUTH_SCOPES, + scopes=scopes, + default_host=cls.DEFAULT_HOST, + **kwargs + ) + + @property + def grpc_channel(self) -> grpc.Channel: + """Return the channel designed to connect to this service. + """ + return self._grpc_channel + + @property + def create_challenge(self) -> Callable[ + [service.CreateChallengeRequest], + service.Challenge]: + r"""Return a callable for the create challenge method over gRPC. + + Creates a new Challenge in a given project and + location. + + Returns: + Callable[[~.CreateChallengeRequest], + ~.Challenge]: + A function that, when called, will call the underlying RPC + on the server. + """ + # Generate a "stub function" on-the-fly which will actually make + # the request. + # gRPC handles serialization and deserialization, so we just need + # to pass in the functions for each. + if 'create_challenge' not in self._stubs: + self._stubs['create_challenge'] = self._logged_channel.unary_unary( + '/google.cloud.confidentialcomputing.v1.ConfidentialComputing/CreateChallenge', + request_serializer=service.CreateChallengeRequest.serialize, + response_deserializer=service.Challenge.deserialize, + ) + return self._stubs['create_challenge'] + + @property + def verify_attestation(self) -> Callable[ + [service.VerifyAttestationRequest], + service.VerifyAttestationResponse]: + r"""Return a callable for the verify attestation method over gRPC. + + Verifies the provided attestation info, returning a + signed attestation token. + + Returns: + Callable[[~.VerifyAttestationRequest], + ~.VerifyAttestationResponse]: + A function that, when called, will call the underlying RPC + on the server. + """ + # Generate a "stub function" on-the-fly which will actually make + # the request. + # gRPC handles serialization and deserialization, so we just need + # to pass in the functions for each. + if 'verify_attestation' not in self._stubs: + self._stubs['verify_attestation'] = self._logged_channel.unary_unary( + '/google.cloud.confidentialcomputing.v1.ConfidentialComputing/VerifyAttestation', + request_serializer=service.VerifyAttestationRequest.serialize, + response_deserializer=service.VerifyAttestationResponse.deserialize, + ) + return self._stubs['verify_attestation'] + + @property + def verify_confidential_space(self) -> Callable[ + [service.VerifyConfidentialSpaceRequest], + service.VerifyConfidentialSpaceResponse]: + r"""Return a callable for the verify confidential space method over gRPC. + + Verifies whether the provided attestation info is + valid, returning a signed attestation token if so. + + Returns: + Callable[[~.VerifyConfidentialSpaceRequest], + ~.VerifyConfidentialSpaceResponse]: + A function that, when called, will call the underlying RPC + on the server. + """ + # Generate a "stub function" on-the-fly which will actually make + # the request. + # gRPC handles serialization and deserialization, so we just need + # to pass in the functions for each. + if 'verify_confidential_space' not in self._stubs: + self._stubs['verify_confidential_space'] = self._logged_channel.unary_unary( + '/google.cloud.confidentialcomputing.v1.ConfidentialComputing/VerifyConfidentialSpace', + request_serializer=service.VerifyConfidentialSpaceRequest.serialize, + response_deserializer=service.VerifyConfidentialSpaceResponse.deserialize, + ) + return self._stubs['verify_confidential_space'] + + @property + def verify_confidential_gke(self) -> Callable[ + [service.VerifyConfidentialGkeRequest], + service.VerifyConfidentialGkeResponse]: + r"""Return a callable for the verify confidential gke method over gRPC. + + Verifies the provided Confidential GKE attestation + info, returning a signed OIDC token. + + Returns: + Callable[[~.VerifyConfidentialGkeRequest], + ~.VerifyConfidentialGkeResponse]: + A function that, when called, will call the underlying RPC + on the server. + """ + # Generate a "stub function" on-the-fly which will actually make + # the request. + # gRPC handles serialization and deserialization, so we just need + # to pass in the functions for each. + if 'verify_confidential_gke' not in self._stubs: + self._stubs['verify_confidential_gke'] = self._logged_channel.unary_unary( + '/google.cloud.confidentialcomputing.v1.ConfidentialComputing/VerifyConfidentialGke', + request_serializer=service.VerifyConfidentialGkeRequest.serialize, + response_deserializer=service.VerifyConfidentialGkeResponse.deserialize, + ) + return self._stubs['verify_confidential_gke'] + + def close(self): + self._logged_channel.close() + + @property + def list_locations( + self, + ) -> Callable[[locations_pb2.ListLocationsRequest], locations_pb2.ListLocationsResponse]: + r"""Return a callable for the list locations method over gRPC. + """ + # Generate a "stub function" on-the-fly which will actually make + # the request. + # gRPC handles serialization and deserialization, so we just need + # to pass in the functions for each. + if "list_locations" not in self._stubs: + self._stubs["list_locations"] = self._logged_channel.unary_unary( + "/google.cloud.location.Locations/ListLocations", + request_serializer=locations_pb2.ListLocationsRequest.SerializeToString, + response_deserializer=locations_pb2.ListLocationsResponse.FromString, + ) + return self._stubs["list_locations"] + + @property + def get_location( + self, + ) -> Callable[[locations_pb2.GetLocationRequest], locations_pb2.Location]: + r"""Return a callable for the list locations method over gRPC. + """ + # Generate a "stub function" on-the-fly which will actually make + # the request. + # gRPC handles serialization and deserialization, so we just need + # to pass in the functions for each. + if "get_location" not in self._stubs: + self._stubs["get_location"] = self._logged_channel.unary_unary( + "/google.cloud.location.Locations/GetLocation", + request_serializer=locations_pb2.GetLocationRequest.SerializeToString, + response_deserializer=locations_pb2.Location.FromString, + ) + return self._stubs["get_location"] + + @property + def kind(self) -> str: + return "grpc" + + +__all__ = ( + 'ConfidentialComputingGrpcTransport', +) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc_asyncio.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc_asyncio.py new file mode 100644 index 000000000000..4e254a73b6a2 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc_asyncio.py @@ -0,0 +1,547 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +import inspect +import json +import pickle +import logging as std_logging +import warnings +from typing import Awaitable, Callable, Dict, Optional, Sequence, Tuple, Union + +from google.api_core import gapic_v1 +from google.api_core import grpc_helpers_async +from google.api_core import exceptions as core_exceptions +from google.api_core import retry_async as retries +from google.auth import credentials as ga_credentials # type: ignore +from google.auth.transport.grpc import SslCredentials # type: ignore +from google.protobuf.json_format import MessageToJson +import google.protobuf.message + +import grpc # type: ignore +import proto # type: ignore +from grpc.experimental import aio # type: ignore + +from google.cloud.confidentialcomputing_v1.types import service +from google.cloud.location import locations_pb2 # type: ignore +from .base import ConfidentialComputingTransport, DEFAULT_CLIENT_INFO +from .grpc import ConfidentialComputingGrpcTransport + +try: + from google.api_core import client_logging # type: ignore + CLIENT_LOGGING_SUPPORTED = True # pragma: NO COVER +except ImportError: # pragma: NO COVER + CLIENT_LOGGING_SUPPORTED = False + +_LOGGER = std_logging.getLogger(__name__) + + +class _LoggingClientAIOInterceptor(grpc.aio.UnaryUnaryClientInterceptor): # pragma: NO COVER + async def intercept_unary_unary(self, continuation, client_call_details, request): + logging_enabled = CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(std_logging.DEBUG) + if logging_enabled: # pragma: NO COVER + request_metadata = client_call_details.metadata + if isinstance(request, proto.Message): + request_payload = type(request).to_json(request) + elif isinstance(request, google.protobuf.message.Message): + request_payload = MessageToJson(request) + else: + request_payload = f"{type(request).__name__}: {pickle.dumps(request)}" + + request_metadata = { + key: value.decode("utf-8") if isinstance(value, bytes) else value + for key, value in request_metadata + } + grpc_request = { + "payload": request_payload, + "requestMethod": "grpc", + "metadata": dict(request_metadata), + } + _LOGGER.debug( + f"Sending request for {client_call_details.method}", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": str(client_call_details.method), + "request": grpc_request, + "metadata": grpc_request["metadata"], + }, + ) + response = await continuation(client_call_details, request) + if logging_enabled: # pragma: NO COVER + response_metadata = await response.trailing_metadata() + # Convert gRPC metadata `` to list of tuples + metadata = dict([(k, str(v)) for k, v in response_metadata]) if response_metadata else None + result = await response + if isinstance(result, proto.Message): + response_payload = type(result).to_json(result) + elif isinstance(result, google.protobuf.message.Message): + response_payload = MessageToJson(result) + else: + response_payload = f"{type(result).__name__}: {pickle.dumps(result)}" + grpc_response = { + "payload": response_payload, + "metadata": metadata, + "status": "OK", + } + _LOGGER.debug( + f"Received response to rpc {client_call_details.method}.", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": str(client_call_details.method), + "response": grpc_response, + "metadata": grpc_response["metadata"], + }, + ) + return response + + +class ConfidentialComputingGrpcAsyncIOTransport(ConfidentialComputingTransport): + """gRPC AsyncIO backend transport for ConfidentialComputing. + + Service describing handlers for resources + + This class defines the same methods as the primary client, so the + primary client can load the underlying transport implementation + and call it. + + It sends protocol buffers over the wire using gRPC (which is built on + top of HTTP/2); the ``grpcio`` package must be installed. + """ + + _grpc_channel: aio.Channel + _stubs: Dict[str, Callable] = {} + + @classmethod + def create_channel(cls, + host: str = 'confidentialcomputing.googleapis.com', + credentials: Optional[ga_credentials.Credentials] = None, + credentials_file: Optional[str] = None, + scopes: Optional[Sequence[str]] = None, + quota_project_id: Optional[str] = None, + **kwargs) -> aio.Channel: + """Create and return a gRPC AsyncIO channel object. + Args: + host (Optional[str]): The host for the channel to use. + credentials (Optional[~.Credentials]): The + authorization credentials to attach to requests. These + credentials identify this application to the service. If + none are specified, the client will attempt to ascertain + the credentials from the environment. + credentials_file (Optional[str]): A file with credentials that can + be loaded with :func:`google.auth.load_credentials_from_file`. + scopes (Optional[Sequence[str]]): A optional list of scopes needed for this + service. These are only used when credentials are not specified and + are passed to :func:`google.auth.default`. + quota_project_id (Optional[str]): An optional project to use for billing + and quota. + kwargs (Optional[dict]): Keyword arguments, which are passed to the + channel creation. + Returns: + aio.Channel: A gRPC AsyncIO channel object. + """ + + return grpc_helpers_async.create_channel( + host, + credentials=credentials, + credentials_file=credentials_file, + quota_project_id=quota_project_id, + default_scopes=cls.AUTH_SCOPES, + scopes=scopes, + default_host=cls.DEFAULT_HOST, + **kwargs + ) + + def __init__(self, *, + host: str = 'confidentialcomputing.googleapis.com', + credentials: Optional[ga_credentials.Credentials] = None, + credentials_file: Optional[str] = None, + scopes: Optional[Sequence[str]] = None, + channel: Optional[Union[aio.Channel, Callable[..., aio.Channel]]] = None, + api_mtls_endpoint: Optional[str] = None, + client_cert_source: Optional[Callable[[], Tuple[bytes, bytes]]] = None, + ssl_channel_credentials: Optional[grpc.ChannelCredentials] = None, + client_cert_source_for_mtls: Optional[Callable[[], Tuple[bytes, bytes]]] = None, + quota_project_id: Optional[str] = None, + client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO, + always_use_jwt_access: Optional[bool] = False, + api_audience: Optional[str] = None, + ) -> None: + """Instantiate the transport. + + Args: + host (Optional[str]): + The hostname to connect to (default: 'confidentialcomputing.googleapis.com'). + credentials (Optional[google.auth.credentials.Credentials]): The + authorization credentials to attach to requests. These + credentials identify the application to the service; if none + are specified, the client will attempt to ascertain the + credentials from the environment. + This argument is ignored if a ``channel`` instance is provided. + credentials_file (Optional[str]): A file with credentials that can + be loaded with :func:`google.auth.load_credentials_from_file`. + This argument is ignored if a ``channel`` instance is provided. + scopes (Optional[Sequence[str]]): A optional list of scopes needed for this + service. These are only used when credentials are not specified and + are passed to :func:`google.auth.default`. + channel (Optional[Union[aio.Channel, Callable[..., aio.Channel]]]): + A ``Channel`` instance through which to make calls, or a Callable + that constructs and returns one. If set to None, ``self.create_channel`` + is used to create the channel. If a Callable is given, it will be called + with the same arguments as used in ``self.create_channel``. + api_mtls_endpoint (Optional[str]): Deprecated. The mutual TLS endpoint. + If provided, it overrides the ``host`` argument and tries to create + a mutual TLS channel with client SSL credentials from + ``client_cert_source`` or application default SSL credentials. + client_cert_source (Optional[Callable[[], Tuple[bytes, bytes]]]): + Deprecated. A callback to provide client SSL certificate bytes and + private key bytes, both in PEM format. It is ignored if + ``api_mtls_endpoint`` is None. + ssl_channel_credentials (grpc.ChannelCredentials): SSL credentials + for the grpc channel. It is ignored if a ``channel`` instance is provided. + client_cert_source_for_mtls (Optional[Callable[[], Tuple[bytes, bytes]]]): + A callback to provide client certificate bytes and private key bytes, + both in PEM format. It is used to configure a mutual TLS channel. It is + ignored if a ``channel`` instance or ``ssl_channel_credentials`` is provided. + quota_project_id (Optional[str]): An optional project to use for billing + and quota. + client_info (google.api_core.gapic_v1.client_info.ClientInfo): + The client info used to send a user-agent string along with + API requests. If ``None``, then default info will be used. + Generally, you only need to set this if you're developing + your own client library. + always_use_jwt_access (Optional[bool]): Whether self signed JWT should + be used for service account credentials. + + Raises: + google.auth.exceptions.MutualTlsChannelError: If mutual TLS transport + creation failed for any reason. + google.api_core.exceptions.DuplicateCredentialArgs: If both ``credentials`` + and ``credentials_file`` are passed. + """ + self._grpc_channel = None + self._ssl_channel_credentials = ssl_channel_credentials + self._stubs: Dict[str, Callable] = {} + + if api_mtls_endpoint: + warnings.warn("api_mtls_endpoint is deprecated", DeprecationWarning) + if client_cert_source: + warnings.warn("client_cert_source is deprecated", DeprecationWarning) + + if isinstance(channel, aio.Channel): + # Ignore credentials if a channel was passed. + credentials = None + self._ignore_credentials = True + # If a channel was explicitly provided, set it. + self._grpc_channel = channel + self._ssl_channel_credentials = None + else: + if api_mtls_endpoint: + host = api_mtls_endpoint + + # Create SSL credentials with client_cert_source or application + # default SSL credentials. + if client_cert_source: + cert, key = client_cert_source() + self._ssl_channel_credentials = grpc.ssl_channel_credentials( + certificate_chain=cert, private_key=key + ) + else: + self._ssl_channel_credentials = SslCredentials().ssl_credentials + + else: + if client_cert_source_for_mtls and not ssl_channel_credentials: + cert, key = client_cert_source_for_mtls() + self._ssl_channel_credentials = grpc.ssl_channel_credentials( + certificate_chain=cert, private_key=key + ) + + # The base transport sets the host, credentials and scopes + super().__init__( + host=host, + credentials=credentials, + credentials_file=credentials_file, + scopes=scopes, + quota_project_id=quota_project_id, + client_info=client_info, + always_use_jwt_access=always_use_jwt_access, + api_audience=api_audience, + ) + + if not self._grpc_channel: + # initialize with the provided callable or the default channel + channel_init = channel or type(self).create_channel + self._grpc_channel = channel_init( + self._host, + # use the credentials which are saved + credentials=self._credentials, + # Set ``credentials_file`` to ``None`` here as + # the credentials that we saved earlier should be used. + credentials_file=None, + scopes=self._scopes, + ssl_credentials=self._ssl_channel_credentials, + quota_project_id=quota_project_id, + options=[ + ("grpc.max_send_message_length", -1), + ("grpc.max_receive_message_length", -1), + ], + ) + + self._interceptor = _LoggingClientAIOInterceptor() + self._grpc_channel._unary_unary_interceptors.append(self._interceptor) + self._logged_channel = self._grpc_channel + self._wrap_with_kind = "kind" in inspect.signature(gapic_v1.method_async.wrap_method).parameters + # Wrap messages. This must be done after self._logged_channel exists + self._prep_wrapped_messages(client_info) + + @property + def grpc_channel(self) -> aio.Channel: + """Create the channel designed to connect to this service. + + This property caches on the instance; repeated calls return + the same channel. + """ + # Return the channel from cache. + return self._grpc_channel + + @property + def create_challenge(self) -> Callable[ + [service.CreateChallengeRequest], + Awaitable[service.Challenge]]: + r"""Return a callable for the create challenge method over gRPC. + + Creates a new Challenge in a given project and + location. + + Returns: + Callable[[~.CreateChallengeRequest], + Awaitable[~.Challenge]]: + A function that, when called, will call the underlying RPC + on the server. + """ + # Generate a "stub function" on-the-fly which will actually make + # the request. + # gRPC handles serialization and deserialization, so we just need + # to pass in the functions for each. + if 'create_challenge' not in self._stubs: + self._stubs['create_challenge'] = self._logged_channel.unary_unary( + '/google.cloud.confidentialcomputing.v1.ConfidentialComputing/CreateChallenge', + request_serializer=service.CreateChallengeRequest.serialize, + response_deserializer=service.Challenge.deserialize, + ) + return self._stubs['create_challenge'] + + @property + def verify_attestation(self) -> Callable[ + [service.VerifyAttestationRequest], + Awaitable[service.VerifyAttestationResponse]]: + r"""Return a callable for the verify attestation method over gRPC. + + Verifies the provided attestation info, returning a + signed attestation token. + + Returns: + Callable[[~.VerifyAttestationRequest], + Awaitable[~.VerifyAttestationResponse]]: + A function that, when called, will call the underlying RPC + on the server. + """ + # Generate a "stub function" on-the-fly which will actually make + # the request. + # gRPC handles serialization and deserialization, so we just need + # to pass in the functions for each. + if 'verify_attestation' not in self._stubs: + self._stubs['verify_attestation'] = self._logged_channel.unary_unary( + '/google.cloud.confidentialcomputing.v1.ConfidentialComputing/VerifyAttestation', + request_serializer=service.VerifyAttestationRequest.serialize, + response_deserializer=service.VerifyAttestationResponse.deserialize, + ) + return self._stubs['verify_attestation'] + + @property + def verify_confidential_space(self) -> Callable[ + [service.VerifyConfidentialSpaceRequest], + Awaitable[service.VerifyConfidentialSpaceResponse]]: + r"""Return a callable for the verify confidential space method over gRPC. + + Verifies whether the provided attestation info is + valid, returning a signed attestation token if so. + + Returns: + Callable[[~.VerifyConfidentialSpaceRequest], + Awaitable[~.VerifyConfidentialSpaceResponse]]: + A function that, when called, will call the underlying RPC + on the server. + """ + # Generate a "stub function" on-the-fly which will actually make + # the request. + # gRPC handles serialization and deserialization, so we just need + # to pass in the functions for each. + if 'verify_confidential_space' not in self._stubs: + self._stubs['verify_confidential_space'] = self._logged_channel.unary_unary( + '/google.cloud.confidentialcomputing.v1.ConfidentialComputing/VerifyConfidentialSpace', + request_serializer=service.VerifyConfidentialSpaceRequest.serialize, + response_deserializer=service.VerifyConfidentialSpaceResponse.deserialize, + ) + return self._stubs['verify_confidential_space'] + + @property + def verify_confidential_gke(self) -> Callable[ + [service.VerifyConfidentialGkeRequest], + Awaitable[service.VerifyConfidentialGkeResponse]]: + r"""Return a callable for the verify confidential gke method over gRPC. + + Verifies the provided Confidential GKE attestation + info, returning a signed OIDC token. + + Returns: + Callable[[~.VerifyConfidentialGkeRequest], + Awaitable[~.VerifyConfidentialGkeResponse]]: + A function that, when called, will call the underlying RPC + on the server. + """ + # Generate a "stub function" on-the-fly which will actually make + # the request. + # gRPC handles serialization and deserialization, so we just need + # to pass in the functions for each. + if 'verify_confidential_gke' not in self._stubs: + self._stubs['verify_confidential_gke'] = self._logged_channel.unary_unary( + '/google.cloud.confidentialcomputing.v1.ConfidentialComputing/VerifyConfidentialGke', + request_serializer=service.VerifyConfidentialGkeRequest.serialize, + response_deserializer=service.VerifyConfidentialGkeResponse.deserialize, + ) + return self._stubs['verify_confidential_gke'] + + def _prep_wrapped_messages(self, client_info): + """ Precompute the wrapped methods, overriding the base class method to use async wrappers.""" + self._wrapped_methods = { + self.create_challenge: self._wrap_method( + self.create_challenge, + default_retry=retries.AsyncRetry( + initial=1.0, + maximum=60.0, + multiplier=1.3, + predicate=retries.if_exception_type( + core_exceptions.ServiceUnavailable, + ), + deadline=60.0, + ), + default_timeout=60.0, + client_info=client_info, + ), + self.verify_attestation: self._wrap_method( + self.verify_attestation, + default_retry=retries.AsyncRetry( + initial=1.0, + maximum=60.0, + multiplier=1.3, + predicate=retries.if_exception_type( + core_exceptions.ServiceUnavailable, + ), + deadline=60.0, + ), + default_timeout=60.0, + client_info=client_info, + ), + self.verify_confidential_space: self._wrap_method( + self.verify_confidential_space, + default_retry=retries.AsyncRetry( + initial=1.0, + maximum=60.0, + multiplier=1.3, + predicate=retries.if_exception_type( + core_exceptions.ServiceUnavailable, + ), + deadline=60.0, + ), + default_timeout=60.0, + client_info=client_info, + ), + self.verify_confidential_gke: self._wrap_method( + self.verify_confidential_gke, + default_retry=retries.AsyncRetry( + initial=1.0, + maximum=60.0, + multiplier=1.3, + predicate=retries.if_exception_type( + core_exceptions.ServiceUnavailable, + ), + deadline=60.0, + ), + default_timeout=60.0, + client_info=client_info, + ), + self.get_location: self._wrap_method( + self.get_location, + default_timeout=None, + client_info=client_info, + ), + self.list_locations: self._wrap_method( + self.list_locations, + default_timeout=None, + client_info=client_info, + ), + } + + def _wrap_method(self, func, *args, **kwargs): + if self._wrap_with_kind: # pragma: NO COVER + kwargs["kind"] = self.kind + return gapic_v1.method_async.wrap_method(func, *args, **kwargs) + + def close(self): + return self._logged_channel.close() + + @property + def kind(self) -> str: + return "grpc_asyncio" + + @property + def list_locations( + self, + ) -> Callable[[locations_pb2.ListLocationsRequest], locations_pb2.ListLocationsResponse]: + r"""Return a callable for the list locations method over gRPC. + """ + # Generate a "stub function" on-the-fly which will actually make + # the request. + # gRPC handles serialization and deserialization, so we just need + # to pass in the functions for each. + if "list_locations" not in self._stubs: + self._stubs["list_locations"] = self._logged_channel.unary_unary( + "/google.cloud.location.Locations/ListLocations", + request_serializer=locations_pb2.ListLocationsRequest.SerializeToString, + response_deserializer=locations_pb2.ListLocationsResponse.FromString, + ) + return self._stubs["list_locations"] + + @property + def get_location( + self, + ) -> Callable[[locations_pb2.GetLocationRequest], locations_pb2.Location]: + r"""Return a callable for the list locations method over gRPC. + """ + # Generate a "stub function" on-the-fly which will actually make + # the request. + # gRPC handles serialization and deserialization, so we just need + # to pass in the functions for each. + if "get_location" not in self._stubs: + self._stubs["get_location"] = self._logged_channel.unary_unary( + "/google.cloud.location.Locations/GetLocation", + request_serializer=locations_pb2.GetLocationRequest.SerializeToString, + response_deserializer=locations_pb2.Location.FromString, + ) + return self._stubs["get_location"] + + +__all__ = ( + 'ConfidentialComputingGrpcAsyncIOTransport', +) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest.py new file mode 100644 index 000000000000..440084e79181 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest.py @@ -0,0 +1,1179 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +import logging +import json # type: ignore + +from google.auth.transport.requests import AuthorizedSession # type: ignore +from google.auth import credentials as ga_credentials # type: ignore +from google.api_core import exceptions as core_exceptions +from google.api_core import retry as retries +from google.api_core import rest_helpers +from google.api_core import rest_streaming +from google.api_core import gapic_v1 +import google.protobuf + +from google.protobuf import json_format +from google.cloud.location import locations_pb2 # type: ignore + +from requests import __version__ as requests_version +import dataclasses +from typing import Any, Callable, Dict, List, Optional, Sequence, Tuple, Union +import warnings + + +from google.cloud.confidentialcomputing_v1.types import service + + +from .rest_base import _BaseConfidentialComputingRestTransport +from .base import DEFAULT_CLIENT_INFO as BASE_DEFAULT_CLIENT_INFO + +try: + OptionalRetry = Union[retries.Retry, gapic_v1.method._MethodDefault, None] +except AttributeError: # pragma: NO COVER + OptionalRetry = Union[retries.Retry, object, None] # type: ignore + +try: + from google.api_core import client_logging # type: ignore + CLIENT_LOGGING_SUPPORTED = True # pragma: NO COVER +except ImportError: # pragma: NO COVER + CLIENT_LOGGING_SUPPORTED = False + +_LOGGER = logging.getLogger(__name__) + +DEFAULT_CLIENT_INFO = gapic_v1.client_info.ClientInfo( + gapic_version=BASE_DEFAULT_CLIENT_INFO.gapic_version, + grpc_version=None, + rest_version=f"requests@{requests_version}", +) + +if hasattr(DEFAULT_CLIENT_INFO, "protobuf_runtime_version"): # pragma: NO COVER + DEFAULT_CLIENT_INFO.protobuf_runtime_version = google.protobuf.__version__ + + +class ConfidentialComputingRestInterceptor: + """Interceptor for ConfidentialComputing. + + Interceptors are used to manipulate requests, request metadata, and responses + in arbitrary ways. + Example use cases include: + * Logging + * Verifying requests according to service or custom semantics + * Stripping extraneous information from responses + + These use cases and more can be enabled by injecting an + instance of a custom subclass when constructing the ConfidentialComputingRestTransport. + + .. code-block:: python + class MyCustomConfidentialComputingInterceptor(ConfidentialComputingRestInterceptor): + def pre_create_challenge(self, request, metadata): + logging.log(f"Received request: {request}") + return request, metadata + + def post_create_challenge(self, response): + logging.log(f"Received response: {response}") + return response + + def pre_verify_attestation(self, request, metadata): + logging.log(f"Received request: {request}") + return request, metadata + + def post_verify_attestation(self, response): + logging.log(f"Received response: {response}") + return response + + def pre_verify_confidential_gke(self, request, metadata): + logging.log(f"Received request: {request}") + return request, metadata + + def post_verify_confidential_gke(self, response): + logging.log(f"Received response: {response}") + return response + + def pre_verify_confidential_space(self, request, metadata): + logging.log(f"Received request: {request}") + return request, metadata + + def post_verify_confidential_space(self, response): + logging.log(f"Received response: {response}") + return response + + transport = ConfidentialComputingRestTransport(interceptor=MyCustomConfidentialComputingInterceptor()) + client = ConfidentialComputingClient(transport=transport) + + + """ + def pre_create_challenge(self, request: service.CreateChallengeRequest, metadata: Sequence[Tuple[str, Union[str, bytes]]]) -> Tuple[service.CreateChallengeRequest, Sequence[Tuple[str, Union[str, bytes]]]]: + """Pre-rpc interceptor for create_challenge + + Override in a subclass to manipulate the request or metadata + before they are sent to the ConfidentialComputing server. + """ + return request, metadata + + def post_create_challenge(self, response: service.Challenge) -> service.Challenge: + """Post-rpc interceptor for create_challenge + + DEPRECATED. Please use the `post_create_challenge_with_metadata` + interceptor instead. + + Override in a subclass to read or manipulate the response + after it is returned by the ConfidentialComputing server but before + it is returned to user code. This `post_create_challenge` interceptor runs + before the `post_create_challenge_with_metadata` interceptor. + """ + return response + + def post_create_challenge_with_metadata(self, response: service.Challenge, metadata: Sequence[Tuple[str, Union[str, bytes]]]) -> Tuple[service.Challenge, Sequence[Tuple[str, Union[str, bytes]]]]: + """Post-rpc interceptor for create_challenge + + Override in a subclass to read or manipulate the response or metadata after it + is returned by the ConfidentialComputing server but before it is returned to user code. + + We recommend only using this `post_create_challenge_with_metadata` + interceptor in new development instead of the `post_create_challenge` interceptor. + When both interceptors are used, this `post_create_challenge_with_metadata` interceptor runs after the + `post_create_challenge` interceptor. The (possibly modified) response returned by + `post_create_challenge` will be passed to + `post_create_challenge_with_metadata`. + """ + return response, metadata + + def pre_verify_attestation(self, request: service.VerifyAttestationRequest, metadata: Sequence[Tuple[str, Union[str, bytes]]]) -> Tuple[service.VerifyAttestationRequest, Sequence[Tuple[str, Union[str, bytes]]]]: + """Pre-rpc interceptor for verify_attestation + + Override in a subclass to manipulate the request or metadata + before they are sent to the ConfidentialComputing server. + """ + return request, metadata + + def post_verify_attestation(self, response: service.VerifyAttestationResponse) -> service.VerifyAttestationResponse: + """Post-rpc interceptor for verify_attestation + + DEPRECATED. Please use the `post_verify_attestation_with_metadata` + interceptor instead. + + Override in a subclass to read or manipulate the response + after it is returned by the ConfidentialComputing server but before + it is returned to user code. This `post_verify_attestation` interceptor runs + before the `post_verify_attestation_with_metadata` interceptor. + """ + return response + + def post_verify_attestation_with_metadata(self, response: service.VerifyAttestationResponse, metadata: Sequence[Tuple[str, Union[str, bytes]]]) -> Tuple[service.VerifyAttestationResponse, Sequence[Tuple[str, Union[str, bytes]]]]: + """Post-rpc interceptor for verify_attestation + + Override in a subclass to read or manipulate the response or metadata after it + is returned by the ConfidentialComputing server but before it is returned to user code. + + We recommend only using this `post_verify_attestation_with_metadata` + interceptor in new development instead of the `post_verify_attestation` interceptor. + When both interceptors are used, this `post_verify_attestation_with_metadata` interceptor runs after the + `post_verify_attestation` interceptor. The (possibly modified) response returned by + `post_verify_attestation` will be passed to + `post_verify_attestation_with_metadata`. + """ + return response, metadata + + def pre_verify_confidential_gke(self, request: service.VerifyConfidentialGkeRequest, metadata: Sequence[Tuple[str, Union[str, bytes]]]) -> Tuple[service.VerifyConfidentialGkeRequest, Sequence[Tuple[str, Union[str, bytes]]]]: + """Pre-rpc interceptor for verify_confidential_gke + + Override in a subclass to manipulate the request or metadata + before they are sent to the ConfidentialComputing server. + """ + return request, metadata + + def post_verify_confidential_gke(self, response: service.VerifyConfidentialGkeResponse) -> service.VerifyConfidentialGkeResponse: + """Post-rpc interceptor for verify_confidential_gke + + DEPRECATED. Please use the `post_verify_confidential_gke_with_metadata` + interceptor instead. + + Override in a subclass to read or manipulate the response + after it is returned by the ConfidentialComputing server but before + it is returned to user code. This `post_verify_confidential_gke` interceptor runs + before the `post_verify_confidential_gke_with_metadata` interceptor. + """ + return response + + def post_verify_confidential_gke_with_metadata(self, response: service.VerifyConfidentialGkeResponse, metadata: Sequence[Tuple[str, Union[str, bytes]]]) -> Tuple[service.VerifyConfidentialGkeResponse, Sequence[Tuple[str, Union[str, bytes]]]]: + """Post-rpc interceptor for verify_confidential_gke + + Override in a subclass to read or manipulate the response or metadata after it + is returned by the ConfidentialComputing server but before it is returned to user code. + + We recommend only using this `post_verify_confidential_gke_with_metadata` + interceptor in new development instead of the `post_verify_confidential_gke` interceptor. + When both interceptors are used, this `post_verify_confidential_gke_with_metadata` interceptor runs after the + `post_verify_confidential_gke` interceptor. The (possibly modified) response returned by + `post_verify_confidential_gke` will be passed to + `post_verify_confidential_gke_with_metadata`. + """ + return response, metadata + + def pre_verify_confidential_space(self, request: service.VerifyConfidentialSpaceRequest, metadata: Sequence[Tuple[str, Union[str, bytes]]]) -> Tuple[service.VerifyConfidentialSpaceRequest, Sequence[Tuple[str, Union[str, bytes]]]]: + """Pre-rpc interceptor for verify_confidential_space + + Override in a subclass to manipulate the request or metadata + before they are sent to the ConfidentialComputing server. + """ + return request, metadata + + def post_verify_confidential_space(self, response: service.VerifyConfidentialSpaceResponse) -> service.VerifyConfidentialSpaceResponse: + """Post-rpc interceptor for verify_confidential_space + + DEPRECATED. Please use the `post_verify_confidential_space_with_metadata` + interceptor instead. + + Override in a subclass to read or manipulate the response + after it is returned by the ConfidentialComputing server but before + it is returned to user code. This `post_verify_confidential_space` interceptor runs + before the `post_verify_confidential_space_with_metadata` interceptor. + """ + return response + + def post_verify_confidential_space_with_metadata(self, response: service.VerifyConfidentialSpaceResponse, metadata: Sequence[Tuple[str, Union[str, bytes]]]) -> Tuple[service.VerifyConfidentialSpaceResponse, Sequence[Tuple[str, Union[str, bytes]]]]: + """Post-rpc interceptor for verify_confidential_space + + Override in a subclass to read or manipulate the response or metadata after it + is returned by the ConfidentialComputing server but before it is returned to user code. + + We recommend only using this `post_verify_confidential_space_with_metadata` + interceptor in new development instead of the `post_verify_confidential_space` interceptor. + When both interceptors are used, this `post_verify_confidential_space_with_metadata` interceptor runs after the + `post_verify_confidential_space` interceptor. The (possibly modified) response returned by + `post_verify_confidential_space` will be passed to + `post_verify_confidential_space_with_metadata`. + """ + return response, metadata + + def pre_get_location( + self, request: locations_pb2.GetLocationRequest, metadata: Sequence[Tuple[str, Union[str, bytes]]] + ) -> Tuple[locations_pb2.GetLocationRequest, Sequence[Tuple[str, Union[str, bytes]]]]: + """Pre-rpc interceptor for get_location + + Override in a subclass to manipulate the request or metadata + before they are sent to the ConfidentialComputing server. + """ + return request, metadata + + def post_get_location( + self, response: locations_pb2.Location + ) -> locations_pb2.Location: + """Post-rpc interceptor for get_location + + Override in a subclass to manipulate the response + after it is returned by the ConfidentialComputing server but before + it is returned to user code. + """ + return response + + def pre_list_locations( + self, request: locations_pb2.ListLocationsRequest, metadata: Sequence[Tuple[str, Union[str, bytes]]] + ) -> Tuple[locations_pb2.ListLocationsRequest, Sequence[Tuple[str, Union[str, bytes]]]]: + """Pre-rpc interceptor for list_locations + + Override in a subclass to manipulate the request or metadata + before they are sent to the ConfidentialComputing server. + """ + return request, metadata + + def post_list_locations( + self, response: locations_pb2.ListLocationsResponse + ) -> locations_pb2.ListLocationsResponse: + """Post-rpc interceptor for list_locations + + Override in a subclass to manipulate the response + after it is returned by the ConfidentialComputing server but before + it is returned to user code. + """ + return response + + +@dataclasses.dataclass +class ConfidentialComputingRestStub: + _session: AuthorizedSession + _host: str + _interceptor: ConfidentialComputingRestInterceptor + + +class ConfidentialComputingRestTransport(_BaseConfidentialComputingRestTransport): + """REST backend synchronous transport for ConfidentialComputing. + + Service describing handlers for resources + + This class defines the same methods as the primary client, so the + primary client can load the underlying transport implementation + and call it. + + It sends JSON representations of protocol buffers over HTTP/1.1 + """ + + def __init__(self, *, + host: str = 'confidentialcomputing.googleapis.com', + credentials: Optional[ga_credentials.Credentials] = None, + credentials_file: Optional[str] = None, + scopes: Optional[Sequence[str]] = None, + client_cert_source_for_mtls: Optional[Callable[[ + ], Tuple[bytes, bytes]]] = None, + quota_project_id: Optional[str] = None, + client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO, + always_use_jwt_access: Optional[bool] = False, + url_scheme: str = 'https', + interceptor: Optional[ConfidentialComputingRestInterceptor] = None, + api_audience: Optional[str] = None, + ) -> None: + """Instantiate the transport. + + Args: + host (Optional[str]): + The hostname to connect to (default: 'confidentialcomputing.googleapis.com'). + credentials (Optional[google.auth.credentials.Credentials]): The + authorization credentials to attach to requests. These + credentials identify the application to the service; if none + are specified, the client will attempt to ascertain the + credentials from the environment. + + credentials_file (Optional[str]): A file with credentials that can + be loaded with :func:`google.auth.load_credentials_from_file`. + This argument is ignored if ``channel`` is provided. + scopes (Optional(Sequence[str])): A list of scopes. This argument is + ignored if ``channel`` is provided. + client_cert_source_for_mtls (Callable[[], Tuple[bytes, bytes]]): Client + certificate to configure mutual TLS HTTP channel. It is ignored + if ``channel`` is provided. + quota_project_id (Optional[str]): An optional project to use for billing + and quota. + client_info (google.api_core.gapic_v1.client_info.ClientInfo): + The client info used to send a user-agent string along with + API requests. If ``None``, then default info will be used. + Generally, you only need to set this if you are developing + your own client library. + always_use_jwt_access (Optional[bool]): Whether self signed JWT should + be used for service account credentials. + url_scheme: the protocol scheme for the API endpoint. Normally + "https", but for testing or local servers, + "http" can be specified. + """ + # Run the base constructor + # TODO(yon-mg): resolve other ctor params i.e. scopes, quota, etc. + # TODO: When custom host (api_endpoint) is set, `scopes` must *also* be set on the + # credentials object + super().__init__( + host=host, + credentials=credentials, + client_info=client_info, + always_use_jwt_access=always_use_jwt_access, + url_scheme=url_scheme, + api_audience=api_audience + ) + self._session = AuthorizedSession( + self._credentials, default_host=self.DEFAULT_HOST) + if client_cert_source_for_mtls: + self._session.configure_mtls_channel(client_cert_source_for_mtls) + self._interceptor = interceptor or ConfidentialComputingRestInterceptor() + self._prep_wrapped_messages(client_info) + + class _CreateChallenge(_BaseConfidentialComputingRestTransport._BaseCreateChallenge, ConfidentialComputingRestStub): + def __hash__(self): + return hash("ConfidentialComputingRestTransport.CreateChallenge") + + @staticmethod + def _get_response( + host, + metadata, + query_params, + session, + timeout, + transcoded_request, + body=None): + + uri = transcoded_request['uri'] + method = transcoded_request['method'] + headers = dict(metadata) + headers['Content-Type'] = 'application/json' + response = getattr(session, method)( + "{host}{uri}".format(host=host, uri=uri), + timeout=timeout, + headers=headers, + params=rest_helpers.flatten_query_params(query_params, strict=True), + data=body, + ) + return response + + def __call__(self, + request: service.CreateChallengeRequest, *, + retry: OptionalRetry=gapic_v1.method.DEFAULT, + timeout: Optional[float]=None, + metadata: Sequence[Tuple[str, Union[str, bytes]]]=(), + ) -> service.Challenge: + r"""Call the create challenge method over HTTP. + + Args: + request (~.service.CreateChallengeRequest): + The request object. Message for creating a Challenge + retry (google.api_core.retry.Retry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + ~.service.Challenge: + A Challenge from the server used to + guarantee freshness of attestations + + """ + + http_options = _BaseConfidentialComputingRestTransport._BaseCreateChallenge._get_http_options() + + request, metadata = self._interceptor.pre_create_challenge(request, metadata) + transcoded_request = _BaseConfidentialComputingRestTransport._BaseCreateChallenge._get_transcoded_request(http_options, request) + + body = _BaseConfidentialComputingRestTransport._BaseCreateChallenge._get_request_body_json(transcoded_request) + + # Jsonify the query params + query_params = _BaseConfidentialComputingRestTransport._BaseCreateChallenge._get_query_params_json(transcoded_request) + + if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER + request_url = "{host}{uri}".format(host=self._host, uri=transcoded_request['uri']) + method = transcoded_request['method'] + try: + request_payload = type(request).to_json(request) + except: + request_payload = None + http_request = { + "payload": request_payload, + "requestMethod": method, + "requestUrl": request_url, + "headers": dict(metadata), + } + _LOGGER.debug( + f"Sending request for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.CreateChallenge", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": "CreateChallenge", + "httpRequest": http_request, + "metadata": http_request["headers"], + }, + ) + + # Send the request + response = ConfidentialComputingRestTransport._CreateChallenge._get_response(self._host, metadata, query_params, self._session, timeout, transcoded_request, body) + + # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception + # subclass. + if response.status_code >= 400: + raise core_exceptions.from_http_response(response) + + # Return the response + resp = service.Challenge() + pb_resp = service.Challenge.pb(resp) + + json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True) + + resp = self._interceptor.post_create_challenge(resp) + response_metadata = [(k, str(v)) for k, v in response.headers.items()] + resp, _ = self._interceptor.post_create_challenge_with_metadata(resp, response_metadata) + if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER + try: + response_payload = service.Challenge.to_json(response) + except: + response_payload = None + http_response = { + "payload": response_payload, + "headers": dict(response.headers), + "status": response.status_code, + } + _LOGGER.debug( + "Received response for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.create_challenge", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": "CreateChallenge", + "metadata": http_response["headers"], + "httpResponse": http_response, + }, + ) + return resp + + class _VerifyAttestation(_BaseConfidentialComputingRestTransport._BaseVerifyAttestation, ConfidentialComputingRestStub): + def __hash__(self): + return hash("ConfidentialComputingRestTransport.VerifyAttestation") + + @staticmethod + def _get_response( + host, + metadata, + query_params, + session, + timeout, + transcoded_request, + body=None): + + uri = transcoded_request['uri'] + method = transcoded_request['method'] + headers = dict(metadata) + headers['Content-Type'] = 'application/json' + response = getattr(session, method)( + "{host}{uri}".format(host=host, uri=uri), + timeout=timeout, + headers=headers, + params=rest_helpers.flatten_query_params(query_params, strict=True), + data=body, + ) + return response + + def __call__(self, + request: service.VerifyAttestationRequest, *, + retry: OptionalRetry=gapic_v1.method.DEFAULT, + timeout: Optional[float]=None, + metadata: Sequence[Tuple[str, Union[str, bytes]]]=(), + ) -> service.VerifyAttestationResponse: + r"""Call the verify attestation method over HTTP. + + Args: + request (~.service.VerifyAttestationRequest): + The request object. A request for an attestation token, + providing all the necessary information + needed for this service to verify the + platform state of the requestor. + retry (google.api_core.retry.Retry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + ~.service.VerifyAttestationResponse: + A response once an attestation has + been successfully verified, containing a + signed attestation token. + + """ + + http_options = _BaseConfidentialComputingRestTransport._BaseVerifyAttestation._get_http_options() + + request, metadata = self._interceptor.pre_verify_attestation(request, metadata) + transcoded_request = _BaseConfidentialComputingRestTransport._BaseVerifyAttestation._get_transcoded_request(http_options, request) + + body = _BaseConfidentialComputingRestTransport._BaseVerifyAttestation._get_request_body_json(transcoded_request) + + # Jsonify the query params + query_params = _BaseConfidentialComputingRestTransport._BaseVerifyAttestation._get_query_params_json(transcoded_request) + + if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER + request_url = "{host}{uri}".format(host=self._host, uri=transcoded_request['uri']) + method = transcoded_request['method'] + try: + request_payload = type(request).to_json(request) + except: + request_payload = None + http_request = { + "payload": request_payload, + "requestMethod": method, + "requestUrl": request_url, + "headers": dict(metadata), + } + _LOGGER.debug( + f"Sending request for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.VerifyAttestation", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": "VerifyAttestation", + "httpRequest": http_request, + "metadata": http_request["headers"], + }, + ) + + # Send the request + response = ConfidentialComputingRestTransport._VerifyAttestation._get_response(self._host, metadata, query_params, self._session, timeout, transcoded_request, body) + + # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception + # subclass. + if response.status_code >= 400: + raise core_exceptions.from_http_response(response) + + # Return the response + resp = service.VerifyAttestationResponse() + pb_resp = service.VerifyAttestationResponse.pb(resp) + + json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True) + + resp = self._interceptor.post_verify_attestation(resp) + response_metadata = [(k, str(v)) for k, v in response.headers.items()] + resp, _ = self._interceptor.post_verify_attestation_with_metadata(resp, response_metadata) + if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER + try: + response_payload = service.VerifyAttestationResponse.to_json(response) + except: + response_payload = None + http_response = { + "payload": response_payload, + "headers": dict(response.headers), + "status": response.status_code, + } + _LOGGER.debug( + "Received response for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.verify_attestation", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": "VerifyAttestation", + "metadata": http_response["headers"], + "httpResponse": http_response, + }, + ) + return resp + + class _VerifyConfidentialGke(_BaseConfidentialComputingRestTransport._BaseVerifyConfidentialGke, ConfidentialComputingRestStub): + def __hash__(self): + return hash("ConfidentialComputingRestTransport.VerifyConfidentialGke") + + @staticmethod + def _get_response( + host, + metadata, + query_params, + session, + timeout, + transcoded_request, + body=None): + + uri = transcoded_request['uri'] + method = transcoded_request['method'] + headers = dict(metadata) + headers['Content-Type'] = 'application/json' + response = getattr(session, method)( + "{host}{uri}".format(host=host, uri=uri), + timeout=timeout, + headers=headers, + params=rest_helpers.flatten_query_params(query_params, strict=True), + data=body, + ) + return response + + def __call__(self, + request: service.VerifyConfidentialGkeRequest, *, + retry: OptionalRetry=gapic_v1.method.DEFAULT, + timeout: Optional[float]=None, + metadata: Sequence[Tuple[str, Union[str, bytes]]]=(), + ) -> service.VerifyConfidentialGkeResponse: + r"""Call the verify confidential gke method over HTTP. + + Args: + request (~.service.VerifyConfidentialGkeRequest): + The request object. A request for an attestation token, + providing all the necessary information + needed for this service to verify + Confidential GKE platform state of the + requestor. + retry (google.api_core.retry.Retry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + ~.service.VerifyConfidentialGkeResponse: + VerifyConfidentialGkeResponse + response is returened once a + Confidential GKE attestation has been + successfully verified, containing a + signed OIDC token. + + """ + + http_options = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialGke._get_http_options() + + request, metadata = self._interceptor.pre_verify_confidential_gke(request, metadata) + transcoded_request = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialGke._get_transcoded_request(http_options, request) + + body = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialGke._get_request_body_json(transcoded_request) + + # Jsonify the query params + query_params = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialGke._get_query_params_json(transcoded_request) + + if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER + request_url = "{host}{uri}".format(host=self._host, uri=transcoded_request['uri']) + method = transcoded_request['method'] + try: + request_payload = type(request).to_json(request) + except: + request_payload = None + http_request = { + "payload": request_payload, + "requestMethod": method, + "requestUrl": request_url, + "headers": dict(metadata), + } + _LOGGER.debug( + f"Sending request for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.VerifyConfidentialGke", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": "VerifyConfidentialGke", + "httpRequest": http_request, + "metadata": http_request["headers"], + }, + ) + + # Send the request + response = ConfidentialComputingRestTransport._VerifyConfidentialGke._get_response(self._host, metadata, query_params, self._session, timeout, transcoded_request, body) + + # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception + # subclass. + if response.status_code >= 400: + raise core_exceptions.from_http_response(response) + + # Return the response + resp = service.VerifyConfidentialGkeResponse() + pb_resp = service.VerifyConfidentialGkeResponse.pb(resp) + + json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True) + + resp = self._interceptor.post_verify_confidential_gke(resp) + response_metadata = [(k, str(v)) for k, v in response.headers.items()] + resp, _ = self._interceptor.post_verify_confidential_gke_with_metadata(resp, response_metadata) + if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER + try: + response_payload = service.VerifyConfidentialGkeResponse.to_json(response) + except: + response_payload = None + http_response = { + "payload": response_payload, + "headers": dict(response.headers), + "status": response.status_code, + } + _LOGGER.debug( + "Received response for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.verify_confidential_gke", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": "VerifyConfidentialGke", + "metadata": http_response["headers"], + "httpResponse": http_response, + }, + ) + return resp + + class _VerifyConfidentialSpace(_BaseConfidentialComputingRestTransport._BaseVerifyConfidentialSpace, ConfidentialComputingRestStub): + def __hash__(self): + return hash("ConfidentialComputingRestTransport.VerifyConfidentialSpace") + + @staticmethod + def _get_response( + host, + metadata, + query_params, + session, + timeout, + transcoded_request, + body=None): + + uri = transcoded_request['uri'] + method = transcoded_request['method'] + headers = dict(metadata) + headers['Content-Type'] = 'application/json' + response = getattr(session, method)( + "{host}{uri}".format(host=host, uri=uri), + timeout=timeout, + headers=headers, + params=rest_helpers.flatten_query_params(query_params, strict=True), + data=body, + ) + return response + + def __call__(self, + request: service.VerifyConfidentialSpaceRequest, *, + retry: OptionalRetry=gapic_v1.method.DEFAULT, + timeout: Optional[float]=None, + metadata: Sequence[Tuple[str, Union[str, bytes]]]=(), + ) -> service.VerifyConfidentialSpaceResponse: + r"""Call the verify confidential space method over HTTP. + + Args: + request (~.service.VerifyConfidentialSpaceRequest): + The request object. A request for an attestation token, + providing all the necessary information + needed for this service to verify the + platform state of the requestor. + retry (google.api_core.retry.Retry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + ~.service.VerifyConfidentialSpaceResponse: + VerifyConfidentialSpaceResponse is + returned once a Confidential Space + attestation has been successfully + verified, containing a signed token. + + """ + + http_options = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialSpace._get_http_options() + + request, metadata = self._interceptor.pre_verify_confidential_space(request, metadata) + transcoded_request = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialSpace._get_transcoded_request(http_options, request) + + body = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialSpace._get_request_body_json(transcoded_request) + + # Jsonify the query params + query_params = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialSpace._get_query_params_json(transcoded_request) + + if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER + request_url = "{host}{uri}".format(host=self._host, uri=transcoded_request['uri']) + method = transcoded_request['method'] + try: + request_payload = type(request).to_json(request) + except: + request_payload = None + http_request = { + "payload": request_payload, + "requestMethod": method, + "requestUrl": request_url, + "headers": dict(metadata), + } + _LOGGER.debug( + f"Sending request for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.VerifyConfidentialSpace", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": "VerifyConfidentialSpace", + "httpRequest": http_request, + "metadata": http_request["headers"], + }, + ) + + # Send the request + response = ConfidentialComputingRestTransport._VerifyConfidentialSpace._get_response(self._host, metadata, query_params, self._session, timeout, transcoded_request, body) + + # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception + # subclass. + if response.status_code >= 400: + raise core_exceptions.from_http_response(response) + + # Return the response + resp = service.VerifyConfidentialSpaceResponse() + pb_resp = service.VerifyConfidentialSpaceResponse.pb(resp) + + json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True) + + resp = self._interceptor.post_verify_confidential_space(resp) + response_metadata = [(k, str(v)) for k, v in response.headers.items()] + resp, _ = self._interceptor.post_verify_confidential_space_with_metadata(resp, response_metadata) + if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER + try: + response_payload = service.VerifyConfidentialSpaceResponse.to_json(response) + except: + response_payload = None + http_response = { + "payload": response_payload, + "headers": dict(response.headers), + "status": response.status_code, + } + _LOGGER.debug( + "Received response for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.verify_confidential_space", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": "VerifyConfidentialSpace", + "metadata": http_response["headers"], + "httpResponse": http_response, + }, + ) + return resp + + @property + def create_challenge(self) -> Callable[ + [service.CreateChallengeRequest], + service.Challenge]: + # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here. + # In C++ this would require a dynamic_cast + return self._CreateChallenge(self._session, self._host, self._interceptor) # type: ignore + + @property + def verify_attestation(self) -> Callable[ + [service.VerifyAttestationRequest], + service.VerifyAttestationResponse]: + # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here. + # In C++ this would require a dynamic_cast + return self._VerifyAttestation(self._session, self._host, self._interceptor) # type: ignore + + @property + def verify_confidential_gke(self) -> Callable[ + [service.VerifyConfidentialGkeRequest], + service.VerifyConfidentialGkeResponse]: + # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here. + # In C++ this would require a dynamic_cast + return self._VerifyConfidentialGke(self._session, self._host, self._interceptor) # type: ignore + + @property + def verify_confidential_space(self) -> Callable[ + [service.VerifyConfidentialSpaceRequest], + service.VerifyConfidentialSpaceResponse]: + # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here. + # In C++ this would require a dynamic_cast + return self._VerifyConfidentialSpace(self._session, self._host, self._interceptor) # type: ignore + + @property + def get_location(self): + return self._GetLocation(self._session, self._host, self._interceptor) # type: ignore + + class _GetLocation(_BaseConfidentialComputingRestTransport._BaseGetLocation, ConfidentialComputingRestStub): + def __hash__(self): + return hash("ConfidentialComputingRestTransport.GetLocation") + + @staticmethod + def _get_response( + host, + metadata, + query_params, + session, + timeout, + transcoded_request, + body=None): + + uri = transcoded_request['uri'] + method = transcoded_request['method'] + headers = dict(metadata) + headers['Content-Type'] = 'application/json' + response = getattr(session, method)( + "{host}{uri}".format(host=host, uri=uri), + timeout=timeout, + headers=headers, + params=rest_helpers.flatten_query_params(query_params, strict=True), + ) + return response + + def __call__(self, + request: locations_pb2.GetLocationRequest, *, + retry: OptionalRetry=gapic_v1.method.DEFAULT, + timeout: Optional[float]=None, + metadata: Sequence[Tuple[str, Union[str, bytes]]]=(), + ) -> locations_pb2.Location: + + r"""Call the get location method over HTTP. + + Args: + request (locations_pb2.GetLocationRequest): + The request object for GetLocation method. + retry (google.api_core.retry.Retry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + locations_pb2.Location: Response from GetLocation method. + """ + + http_options = _BaseConfidentialComputingRestTransport._BaseGetLocation._get_http_options() + + request, metadata = self._interceptor.pre_get_location(request, metadata) + transcoded_request = _BaseConfidentialComputingRestTransport._BaseGetLocation._get_transcoded_request(http_options, request) + + # Jsonify the query params + query_params = _BaseConfidentialComputingRestTransport._BaseGetLocation._get_query_params_json(transcoded_request) + + if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER + request_url = "{host}{uri}".format(host=self._host, uri=transcoded_request['uri']) + method = transcoded_request['method'] + try: + request_payload = json_format.MessageToJson(request) + except: + request_payload = None + http_request = { + "payload": request_payload, + "requestMethod": method, + "requestUrl": request_url, + "headers": dict(metadata), + } + _LOGGER.debug( + f"Sending request for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.GetLocation", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": "GetLocation", + "httpRequest": http_request, + "metadata": http_request["headers"], + }, + ) + + # Send the request + response = ConfidentialComputingRestTransport._GetLocation._get_response(self._host, metadata, query_params, self._session, timeout, transcoded_request) + + # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception + # subclass. + if response.status_code >= 400: + raise core_exceptions.from_http_response(response) + + content = response.content.decode("utf-8") + resp = locations_pb2.Location() + resp = json_format.Parse(content, resp) + resp = self._interceptor.post_get_location(resp) + if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER + try: + response_payload = json_format.MessageToJson(resp) + except: + response_payload = None + http_response = { + "payload": response_payload, + "headers": dict(response.headers), + "status": response.status_code, + } + _LOGGER.debug( + "Received response for google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient.GetLocation", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": "GetLocation", + "httpResponse": http_response, + "metadata": http_response["headers"], + }, + ) + return resp + + @property + def list_locations(self): + return self._ListLocations(self._session, self._host, self._interceptor) # type: ignore + + class _ListLocations(_BaseConfidentialComputingRestTransport._BaseListLocations, ConfidentialComputingRestStub): + def __hash__(self): + return hash("ConfidentialComputingRestTransport.ListLocations") + + @staticmethod + def _get_response( + host, + metadata, + query_params, + session, + timeout, + transcoded_request, + body=None): + + uri = transcoded_request['uri'] + method = transcoded_request['method'] + headers = dict(metadata) + headers['Content-Type'] = 'application/json' + response = getattr(session, method)( + "{host}{uri}".format(host=host, uri=uri), + timeout=timeout, + headers=headers, + params=rest_helpers.flatten_query_params(query_params, strict=True), + ) + return response + + def __call__(self, + request: locations_pb2.ListLocationsRequest, *, + retry: OptionalRetry=gapic_v1.method.DEFAULT, + timeout: Optional[float]=None, + metadata: Sequence[Tuple[str, Union[str, bytes]]]=(), + ) -> locations_pb2.ListLocationsResponse: + + r"""Call the list locations method over HTTP. + + Args: + request (locations_pb2.ListLocationsRequest): + The request object for ListLocations method. + retry (google.api_core.retry.Retry): Designation of what errors, if any, + should be retried. + timeout (float): The timeout for this request. + metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be + sent along with the request as metadata. Normally, each value must be of type `str`, + but for metadata keys ending with the suffix `-bin`, the corresponding values must + be of type `bytes`. + + Returns: + locations_pb2.ListLocationsResponse: Response from ListLocations method. + """ + + http_options = _BaseConfidentialComputingRestTransport._BaseListLocations._get_http_options() + + request, metadata = self._interceptor.pre_list_locations(request, metadata) + transcoded_request = _BaseConfidentialComputingRestTransport._BaseListLocations._get_transcoded_request(http_options, request) + + # Jsonify the query params + query_params = _BaseConfidentialComputingRestTransport._BaseListLocations._get_query_params_json(transcoded_request) + + if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER + request_url = "{host}{uri}".format(host=self._host, uri=transcoded_request['uri']) + method = transcoded_request['method'] + try: + request_payload = json_format.MessageToJson(request) + except: + request_payload = None + http_request = { + "payload": request_payload, + "requestMethod": method, + "requestUrl": request_url, + "headers": dict(metadata), + } + _LOGGER.debug( + f"Sending request for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.ListLocations", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": "ListLocations", + "httpRequest": http_request, + "metadata": http_request["headers"], + }, + ) + + # Send the request + response = ConfidentialComputingRestTransport._ListLocations._get_response(self._host, metadata, query_params, self._session, timeout, transcoded_request) + + # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception + # subclass. + if response.status_code >= 400: + raise core_exceptions.from_http_response(response) + + content = response.content.decode("utf-8") + resp = locations_pb2.ListLocationsResponse() + resp = json_format.Parse(content, resp) + resp = self._interceptor.post_list_locations(resp) + if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER + try: + response_payload = json_format.MessageToJson(resp) + except: + response_payload = None + http_response = { + "payload": response_payload, + "headers": dict(response.headers), + "status": response.status_code, + } + _LOGGER.debug( + "Received response for google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient.ListLocations", + extra = { + "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "rpcName": "ListLocations", + "httpResponse": http_response, + "metadata": http_response["headers"], + }, + ) + return resp + + @property + def kind(self) -> str: + return "rest" + + def close(self): + self._session.close() + + +__all__=( + 'ConfidentialComputingRestTransport', +) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest_base.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest_base.py new file mode 100644 index 000000000000..b75b206a52f7 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest_base.py @@ -0,0 +1,330 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +import json # type: ignore +from google.api_core import path_template +from google.api_core import gapic_v1 + +from google.protobuf import json_format +from google.cloud.location import locations_pb2 # type: ignore +from .base import ConfidentialComputingTransport, DEFAULT_CLIENT_INFO + +import re +from typing import Any, Callable, Dict, List, Optional, Sequence, Tuple, Union + + +from google.cloud.confidentialcomputing_v1.types import service + + +class _BaseConfidentialComputingRestTransport(ConfidentialComputingTransport): + """Base REST backend transport for ConfidentialComputing. + + Note: This class is not meant to be used directly. Use its sync and + async sub-classes instead. + + This class defines the same methods as the primary client, so the + primary client can load the underlying transport implementation + and call it. + + It sends JSON representations of protocol buffers over HTTP/1.1 + """ + + def __init__(self, *, + host: str = 'confidentialcomputing.googleapis.com', + credentials: Optional[Any] = None, + client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO, + always_use_jwt_access: Optional[bool] = False, + url_scheme: str = 'https', + api_audience: Optional[str] = None, + ) -> None: + """Instantiate the transport. + Args: + host (Optional[str]): + The hostname to connect to (default: 'confidentialcomputing.googleapis.com'). + credentials (Optional[Any]): The + authorization credentials to attach to requests. These + credentials identify the application to the service; if none + are specified, the client will attempt to ascertain the + credentials from the environment. + client_info (google.api_core.gapic_v1.client_info.ClientInfo): + The client info used to send a user-agent string along with + API requests. If ``None``, then default info will be used. + Generally, you only need to set this if you are developing + your own client library. + always_use_jwt_access (Optional[bool]): Whether self signed JWT should + be used for service account credentials. + url_scheme: the protocol scheme for the API endpoint. Normally + "https", but for testing or local servers, + "http" can be specified. + """ + # Run the base constructor + maybe_url_match = re.match("^(?Phttp(?:s)?://)?(?P.*)$", host) + if maybe_url_match is None: + raise ValueError(f"Unexpected hostname structure: {host}") # pragma: NO COVER + + url_match_items = maybe_url_match.groupdict() + + host = f"{url_scheme}://{host}" if not url_match_items["scheme"] else host + + super().__init__( + host=host, + credentials=credentials, + client_info=client_info, + always_use_jwt_access=always_use_jwt_access, + api_audience=api_audience + ) + + class _BaseCreateChallenge: + def __hash__(self): # pragma: NO COVER + return NotImplementedError("__hash__ must be implemented.") + + __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = { + } + + @classmethod + def _get_unset_required_fields(cls, message_dict): + return {k: v for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items() if k not in message_dict} + + @staticmethod + def _get_http_options(): + http_options: List[Dict[str, str]] = [{ + 'method': 'post', + 'uri': '/v1/{parent=projects/*/locations/*}/challenges', + 'body': 'challenge', + }, + ] + return http_options + + @staticmethod + def _get_transcoded_request(http_options, request): + pb_request = service.CreateChallengeRequest.pb(request) + transcoded_request = path_template.transcode(http_options, pb_request) + return transcoded_request + + @staticmethod + def _get_request_body_json(transcoded_request): + # Jsonify the request body + + body = json_format.MessageToJson( + transcoded_request['body'], + use_integers_for_enums=True + ) + return body + @staticmethod + def _get_query_params_json(transcoded_request): + query_params = json.loads(json_format.MessageToJson( + transcoded_request['query_params'], + use_integers_for_enums=True, + )) + query_params.update(_BaseConfidentialComputingRestTransport._BaseCreateChallenge._get_unset_required_fields(query_params)) + + query_params["$alt"] = "json;enum-encoding=int" + return query_params + + class _BaseVerifyAttestation: + def __hash__(self): # pragma: NO COVER + return NotImplementedError("__hash__ must be implemented.") + + __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = { + } + + @classmethod + def _get_unset_required_fields(cls, message_dict): + return {k: v for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items() if k not in message_dict} + + @staticmethod + def _get_http_options(): + http_options: List[Dict[str, str]] = [{ + 'method': 'post', + 'uri': '/v1/{challenge=projects/*/locations/*/challenges/*}:verifyAttestation', + 'body': '*', + }, + ] + return http_options + + @staticmethod + def _get_transcoded_request(http_options, request): + pb_request = service.VerifyAttestationRequest.pb(request) + transcoded_request = path_template.transcode(http_options, pb_request) + return transcoded_request + + @staticmethod + def _get_request_body_json(transcoded_request): + # Jsonify the request body + + body = json_format.MessageToJson( + transcoded_request['body'], + use_integers_for_enums=True + ) + return body + @staticmethod + def _get_query_params_json(transcoded_request): + query_params = json.loads(json_format.MessageToJson( + transcoded_request['query_params'], + use_integers_for_enums=True, + )) + query_params.update(_BaseConfidentialComputingRestTransport._BaseVerifyAttestation._get_unset_required_fields(query_params)) + + query_params["$alt"] = "json;enum-encoding=int" + return query_params + + class _BaseVerifyConfidentialGke: + def __hash__(self): # pragma: NO COVER + return NotImplementedError("__hash__ must be implemented.") + + __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = { + } + + @classmethod + def _get_unset_required_fields(cls, message_dict): + return {k: v for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items() if k not in message_dict} + + @staticmethod + def _get_http_options(): + http_options: List[Dict[str, str]] = [{ + 'method': 'post', + 'uri': '/v1/{challenge=projects/*/locations/*/challenges/*}:verifyConfidentialGke', + 'body': '*', + }, + ] + return http_options + + @staticmethod + def _get_transcoded_request(http_options, request): + pb_request = service.VerifyConfidentialGkeRequest.pb(request) + transcoded_request = path_template.transcode(http_options, pb_request) + return transcoded_request + + @staticmethod + def _get_request_body_json(transcoded_request): + # Jsonify the request body + + body = json_format.MessageToJson( + transcoded_request['body'], + use_integers_for_enums=True + ) + return body + @staticmethod + def _get_query_params_json(transcoded_request): + query_params = json.loads(json_format.MessageToJson( + transcoded_request['query_params'], + use_integers_for_enums=True, + )) + query_params.update(_BaseConfidentialComputingRestTransport._BaseVerifyConfidentialGke._get_unset_required_fields(query_params)) + + query_params["$alt"] = "json;enum-encoding=int" + return query_params + + class _BaseVerifyConfidentialSpace: + def __hash__(self): # pragma: NO COVER + return NotImplementedError("__hash__ must be implemented.") + + __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = { + } + + @classmethod + def _get_unset_required_fields(cls, message_dict): + return {k: v for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items() if k not in message_dict} + + @staticmethod + def _get_http_options(): + http_options: List[Dict[str, str]] = [{ + 'method': 'post', + 'uri': '/v1/{challenge=projects/*/locations/*/challenges/*}:verifyConfidentialSpace', + 'body': '*', + }, + ] + return http_options + + @staticmethod + def _get_transcoded_request(http_options, request): + pb_request = service.VerifyConfidentialSpaceRequest.pb(request) + transcoded_request = path_template.transcode(http_options, pb_request) + return transcoded_request + + @staticmethod + def _get_request_body_json(transcoded_request): + # Jsonify the request body + + body = json_format.MessageToJson( + transcoded_request['body'], + use_integers_for_enums=True + ) + return body + @staticmethod + def _get_query_params_json(transcoded_request): + query_params = json.loads(json_format.MessageToJson( + transcoded_request['query_params'], + use_integers_for_enums=True, + )) + query_params.update(_BaseConfidentialComputingRestTransport._BaseVerifyConfidentialSpace._get_unset_required_fields(query_params)) + + query_params["$alt"] = "json;enum-encoding=int" + return query_params + + class _BaseGetLocation: + def __hash__(self): # pragma: NO COVER + return NotImplementedError("__hash__ must be implemented.") + + @staticmethod + def _get_http_options(): + http_options: List[Dict[str, str]] = [{ + 'method': 'get', + 'uri': '/v1/{name=projects/*/locations/*}', + }, + ] + return http_options + + @staticmethod + def _get_transcoded_request(http_options, request): + request_kwargs = json_format.MessageToDict(request) + transcoded_request = path_template.transcode( + http_options, **request_kwargs) + return transcoded_request + + @staticmethod + def _get_query_params_json(transcoded_request): + query_params = json.loads(json.dumps(transcoded_request['query_params'])) + return query_params + + class _BaseListLocations: + def __hash__(self): # pragma: NO COVER + return NotImplementedError("__hash__ must be implemented.") + + @staticmethod + def _get_http_options(): + http_options: List[Dict[str, str]] = [{ + 'method': 'get', + 'uri': '/v1/{name=projects/*}/locations', + }, + ] + return http_options + + @staticmethod + def _get_transcoded_request(http_options, request): + request_kwargs = json_format.MessageToDict(request) + transcoded_request = path_template.transcode( + http_options, **request_kwargs) + return transcoded_request + + @staticmethod + def _get_query_params_json(transcoded_request): + query_params = json.loads(json.dumps(transcoded_request['query_params'])) + return query_params + + +__all__=( + '_BaseConfidentialComputingRestTransport', +) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/types/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/types/__init__.py new file mode 100644 index 000000000000..7725a0653773 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/types/__init__.py @@ -0,0 +1,64 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +from .service import ( + AwsPrincipalTagsOptions, + Challenge, + ConfidentialSpaceInfo, + ContainerImageSignature, + CreateChallengeRequest, + GceShieldedIdentity, + GcpCredentials, + SevSnpAttestation, + SignedEntity, + TdxCcelAttestation, + TokenOptions, + TpmAttestation, + VerifyAttestationRequest, + VerifyAttestationResponse, + VerifyConfidentialGkeRequest, + VerifyConfidentialGkeResponse, + VerifyConfidentialSpaceRequest, + VerifyConfidentialSpaceResponse, + SignatureType, + SigningAlgorithm, + TokenProfile, + TokenType, +) + +__all__ = ( + 'AwsPrincipalTagsOptions', + 'Challenge', + 'ConfidentialSpaceInfo', + 'ContainerImageSignature', + 'CreateChallengeRequest', + 'GceShieldedIdentity', + 'GcpCredentials', + 'SevSnpAttestation', + 'SignedEntity', + 'TdxCcelAttestation', + 'TokenOptions', + 'TpmAttestation', + 'VerifyAttestationRequest', + 'VerifyAttestationResponse', + 'VerifyConfidentialGkeRequest', + 'VerifyConfidentialGkeResponse', + 'VerifyConfidentialSpaceRequest', + 'VerifyConfidentialSpaceResponse', + 'SignatureType', + 'SigningAlgorithm', + 'TokenProfile', + 'TokenType', +) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/types/service.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/types/service.py new file mode 100644 index 000000000000..2007fcde2983 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/types/service.py @@ -0,0 +1,915 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +from __future__ import annotations + +from typing import MutableMapping, MutableSequence + +import proto # type: ignore + +from google.protobuf import timestamp_pb2 # type: ignore +from google.rpc import status_pb2 # type: ignore + + +__protobuf__ = proto.module( + package='google.cloud.confidentialcomputing.v1', + manifest={ + 'SigningAlgorithm', + 'TokenType', + 'SignatureType', + 'TokenProfile', + 'Challenge', + 'CreateChallengeRequest', + 'VerifyAttestationRequest', + 'TdxCcelAttestation', + 'SevSnpAttestation', + 'VerifyAttestationResponse', + 'GcpCredentials', + 'TokenOptions', + 'AwsPrincipalTagsOptions', + 'TpmAttestation', + 'ConfidentialSpaceInfo', + 'SignedEntity', + 'ContainerImageSignature', + 'VerifyConfidentialSpaceRequest', + 'GceShieldedIdentity', + 'VerifyConfidentialSpaceResponse', + 'VerifyConfidentialGkeRequest', + 'VerifyConfidentialGkeResponse', + }, +) + + +class SigningAlgorithm(proto.Enum): + r"""SigningAlgorithm enumerates all the supported signing + algorithms. + + Values: + SIGNING_ALGORITHM_UNSPECIFIED (0): + Unspecified signing algorithm. + RSASSA_PSS_SHA256 (1): + RSASSA-PSS with a SHA256 digest. + RSASSA_PKCS1V15_SHA256 (2): + RSASSA-PKCS1 v1.5 with a SHA256 digest. + ECDSA_P256_SHA256 (3): + ECDSA on the P-256 Curve with a SHA256 + digest. + """ + SIGNING_ALGORITHM_UNSPECIFIED = 0 + RSASSA_PSS_SHA256 = 1 + RSASSA_PKCS1V15_SHA256 = 2 + ECDSA_P256_SHA256 = 3 + + +class TokenType(proto.Enum): + r"""Token type enum contains the different types of token + responses Confidential Space supports + + Values: + TOKEN_TYPE_UNSPECIFIED (0): + Unspecified token type + TOKEN_TYPE_OIDC (1): + OpenID Connect (OIDC) token type + TOKEN_TYPE_PKI (2): + Public Key Infrastructure (PKI) token type + TOKEN_TYPE_LIMITED_AWS (3): + Limited claim token type for AWS integration + TOKEN_TYPE_AWS_PRINCIPALTAGS (4): + Principal-tag-based token for AWS integration + """ + TOKEN_TYPE_UNSPECIFIED = 0 + TOKEN_TYPE_OIDC = 1 + TOKEN_TYPE_PKI = 2 + TOKEN_TYPE_LIMITED_AWS = 3 + TOKEN_TYPE_AWS_PRINCIPALTAGS = 4 + + +class SignatureType(proto.Enum): + r"""SignatureType enumerates supported signature types for + attestation tokens. + + Values: + SIGNATURE_TYPE_UNSPECIFIED (0): + Unspecified signature type. + SIGNATURE_TYPE_OIDC (1): + Google OIDC signature. + SIGNATURE_TYPE_PKI (2): + Public Key Infrastructure (PKI) signature. + """ + SIGNATURE_TYPE_UNSPECIFIED = 0 + SIGNATURE_TYPE_OIDC = 1 + SIGNATURE_TYPE_PKI = 2 + + +class TokenProfile(proto.Enum): + r"""TokenProfile enumerates the supported token claims profiles. + + Values: + TOKEN_PROFILE_UNSPECIFIED (0): + Unspecified token profile. + TOKEN_PROFILE_DEFAULT_EAT (1): + EAT claims. + TOKEN_PROFILE_AWS (2): + AWS Principal Tags claims. + """ + TOKEN_PROFILE_UNSPECIFIED = 0 + TOKEN_PROFILE_DEFAULT_EAT = 1 + TOKEN_PROFILE_AWS = 2 + + +class Challenge(proto.Message): + r"""A Challenge from the server used to guarantee freshness of + attestations + + Attributes: + name (str): + Output only. The resource name for this Challenge in the + format ``projects/*/locations/*/challenges/*`` + create_time (google.protobuf.timestamp_pb2.Timestamp): + Output only. The time at which this Challenge + was created + expire_time (google.protobuf.timestamp_pb2.Timestamp): + Output only. The time at which this Challenge + will no longer be usable. It is also the + expiration time for any tokens generated from + this Challenge. + used (bool): + Output only. Indicates if this challenge has + been used to generate a token. + tpm_nonce (str): + Output only. Identical to nonce, but as a + string. + """ + + name: str = proto.Field( + proto.STRING, + number=1, + ) + create_time: timestamp_pb2.Timestamp = proto.Field( + proto.MESSAGE, + number=2, + message=timestamp_pb2.Timestamp, + ) + expire_time: timestamp_pb2.Timestamp = proto.Field( + proto.MESSAGE, + number=3, + message=timestamp_pb2.Timestamp, + ) + used: bool = proto.Field( + proto.BOOL, + number=4, + ) + tpm_nonce: str = proto.Field( + proto.STRING, + number=6, + ) + + +class CreateChallengeRequest(proto.Message): + r"""Message for creating a Challenge + + Attributes: + parent (str): + Required. The resource name of the location where the + Challenge will be used, in the format + ``projects/*/locations/*``. + challenge (google.cloud.confidentialcomputing_v1.types.Challenge): + Required. The Challenge to be created. + Currently this field can be empty as all the + Challenge fields are set by the server. + """ + + parent: str = proto.Field( + proto.STRING, + number=1, + ) + challenge: 'Challenge' = proto.Field( + proto.MESSAGE, + number=2, + message='Challenge', + ) + + +class VerifyAttestationRequest(proto.Message): + r"""A request for an attestation token, providing all the + necessary information needed for this service to verify the + platform state of the requestor. + + This message has `oneof`_ fields (mutually exclusive fields). + For each oneof, at most one member field can be set at the same time. + Setting any member of the oneof automatically clears all other + members. + + .. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields + + Attributes: + td_ccel (google.cloud.confidentialcomputing_v1.types.TdxCcelAttestation): + Optional. A TDX with CCEL and RTMR + Attestation Quote. + + This field is a member of `oneof`_ ``tee_attestation``. + sev_snp_attestation (google.cloud.confidentialcomputing_v1.types.SevSnpAttestation): + Optional. An SEV-SNP Attestation Report. + + This field is a member of `oneof`_ ``tee_attestation``. + challenge (str): + Required. The name of the Challenge whose nonce was used to + generate the attestation, in the format + ``projects/*/locations/*/challenges/*``. The provided + Challenge will be consumed, and cannot be used again. + gcp_credentials (google.cloud.confidentialcomputing_v1.types.GcpCredentials): + Optional. Credentials used to populate the "emails" claim in + the claims_token. + tpm_attestation (google.cloud.confidentialcomputing_v1.types.TpmAttestation): + Required. The TPM-specific data provided by + the attesting platform, used to populate any of + the claims regarding platform state. + confidential_space_info (google.cloud.confidentialcomputing_v1.types.ConfidentialSpaceInfo): + Optional. Optional information related to the + Confidential Space TEE. + token_options (google.cloud.confidentialcomputing_v1.types.TokenOptions): + Optional. A collection of optional, + workload-specified claims that modify the token + output. + attester (str): + Optional. An optional indicator of the + attester, only applies to certain products. + """ + + td_ccel: 'TdxCcelAttestation' = proto.Field( + proto.MESSAGE, + number=6, + oneof='tee_attestation', + message='TdxCcelAttestation', + ) + sev_snp_attestation: 'SevSnpAttestation' = proto.Field( + proto.MESSAGE, + number=7, + oneof='tee_attestation', + message='SevSnpAttestation', + ) + challenge: str = proto.Field( + proto.STRING, + number=1, + ) + gcp_credentials: 'GcpCredentials' = proto.Field( + proto.MESSAGE, + number=2, + message='GcpCredentials', + ) + tpm_attestation: 'TpmAttestation' = proto.Field( + proto.MESSAGE, + number=3, + message='TpmAttestation', + ) + confidential_space_info: 'ConfidentialSpaceInfo' = proto.Field( + proto.MESSAGE, + number=4, + message='ConfidentialSpaceInfo', + ) + token_options: 'TokenOptions' = proto.Field( + proto.MESSAGE, + number=5, + message='TokenOptions', + ) + attester: str = proto.Field( + proto.STRING, + number=8, + ) + + +class TdxCcelAttestation(proto.Message): + r"""A TDX Attestation quote. + + Attributes: + ccel_acpi_table (bytes): + Optional. The Confidential Computing Event + Log (CCEL) ACPI table. Formatted as described in + the ACPI Specification 6.5. + ccel_data (bytes): + Optional. The CCEL event log. Formatted as + described in the UEFI 2.10. + canonical_event_log (bytes): + Optional. An Event Log containing additional + events measured into the RTMR that are not + already present in the CCEL. + td_quote (bytes): + Optional. The TDX attestation quote from the + guest. It contains the RTMR values. + """ + + ccel_acpi_table: bytes = proto.Field( + proto.BYTES, + number=1, + ) + ccel_data: bytes = proto.Field( + proto.BYTES, + number=2, + ) + canonical_event_log: bytes = proto.Field( + proto.BYTES, + number=3, + ) + td_quote: bytes = proto.Field( + proto.BYTES, + number=4, + ) + + +class SevSnpAttestation(proto.Message): + r"""An SEV-SNP Attestation Report. + Contains the attestation report and the certificate bundle that + the client collects. + + Attributes: + report (bytes): + Optional. The SEV-SNP Attestation Report Format is in + revision 1.55, §7.3 Attestation, Table 22. + ATTESTATION_REPORT Structure in this document: + https://www.amd.com/content/dam/amd/en/documents/epyc-technical-docs/specifications/56860.pdf + aux_blob (bytes): + Optional. Certificate bundle defined in the GHCB protocol + definition Format is documented in GHCB revision 2.03, + section 4.1.8.1 struct cert_table in this document: + https://www.amd.com/content/dam/amd/en/documents/epyc-technical-docs/specifications/56421.pdf + """ + + report: bytes = proto.Field( + proto.BYTES, + number=1, + ) + aux_blob: bytes = proto.Field( + proto.BYTES, + number=2, + ) + + +class VerifyAttestationResponse(proto.Message): + r"""A response once an attestation has been successfully + verified, containing a signed attestation token. + + Attributes: + oidc_claims_token (str): + Output only. Same as claims_token, but as a string. + partial_errors (MutableSequence[google.rpc.status_pb2.Status]): + Output only. A list of messages that carry + the partial error details related to + VerifyAttestation. + """ + + oidc_claims_token: str = proto.Field( + proto.STRING, + number=2, + ) + partial_errors: MutableSequence[status_pb2.Status] = proto.RepeatedField( + proto.MESSAGE, + number=3, + message=status_pb2.Status, + ) + + +class GcpCredentials(proto.Message): + r"""Credentials issued by GCP which are linked to the platform + attestation. These will be verified server-side as part of + attestaion verification. + + Attributes: + service_account_id_tokens (MutableSequence[str]): + Same as id_tokens, but as a string. + """ + + service_account_id_tokens: MutableSequence[str] = proto.RepeatedField( + proto.STRING, + number=2, + ) + + +class TokenOptions(proto.Message): + r"""Options to modify claims in the token to generate + custom-purpose tokens. + + + .. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields + + Attributes: + aws_principal_tags_options (google.cloud.confidentialcomputing_v1.types.AwsPrincipalTagsOptions): + Optional. Options for AWS token type. + + This field is a member of `oneof`_ ``token_type_options``. + audience (str): + Optional. Optional string to issue the token + with a custom audience claim. Required if one or + more nonces are specified. + nonce (MutableSequence[str]): + Optional. Optional parameter to place one or more nonces in + the eat_nonce claim in the output token. The minimum size + for JSON-encoded EATs is 10 bytes and the maximum size is 74 + bytes. + token_type (google.cloud.confidentialcomputing_v1.types.TokenType): + Optional. Optional token type to select what + type of token to return. + """ + + aws_principal_tags_options: 'AwsPrincipalTagsOptions' = proto.Field( + proto.MESSAGE, + number=4, + oneof='token_type_options', + message='AwsPrincipalTagsOptions', + ) + audience: str = proto.Field( + proto.STRING, + number=1, + ) + nonce: MutableSequence[str] = proto.RepeatedField( + proto.STRING, + number=2, + ) + token_type: 'TokenType' = proto.Field( + proto.ENUM, + number=3, + enum='TokenType', + ) + + +class AwsPrincipalTagsOptions(proto.Message): + r"""Token options that only apply to the AWS Principal Tags token + type. + + Attributes: + allowed_principal_tags (google.cloud.confidentialcomputing_v1.types.AwsPrincipalTagsOptions.AllowedPrincipalTags): + Optional. Principal tags to allow in the + token. + """ + + class AllowedPrincipalTags(proto.Message): + r"""Allowed principal tags is used to define what principal tags + will be placed in the token. + + Attributes: + container_image_signatures (google.cloud.confidentialcomputing_v1.types.AwsPrincipalTagsOptions.AllowedPrincipalTags.ContainerImageSignatures): + Optional. Container image signatures allowed + in the token. + """ + + class ContainerImageSignatures(proto.Message): + r"""Allowed Container Image Signatures. Key IDs are required to + allow this claim to fit within the narrow AWS IAM restrictions. + + Attributes: + key_ids (MutableSequence[str]): + Optional. List of key ids to filter into the + Principal tags. Only keys that have been + validated and added to the token will be + filtered into principal tags. Unrecognized key + ids will be ignored. + """ + + key_ids: MutableSequence[str] = proto.RepeatedField( + proto.STRING, + number=1, + ) + + container_image_signatures: 'AwsPrincipalTagsOptions.AllowedPrincipalTags.ContainerImageSignatures' = proto.Field( + proto.MESSAGE, + number=1, + message='AwsPrincipalTagsOptions.AllowedPrincipalTags.ContainerImageSignatures', + ) + + allowed_principal_tags: AllowedPrincipalTags = proto.Field( + proto.MESSAGE, + number=1, + message=AllowedPrincipalTags, + ) + + +class TpmAttestation(proto.Message): + r"""TPM2 data containing everything necessary to validate any + platform state measured into the TPM. + + Attributes: + quotes (MutableSequence[google.cloud.confidentialcomputing_v1.types.TpmAttestation.Quote]): + TPM2 PCR Quotes generated by calling TPM2_Quote on each PCR + bank. + tcg_event_log (bytes): + The binary TCG Event Log containing events + measured into the TPM by the platform firmware + and operating system. Formatted as described in + the "TCG PC Client Platform Firmware Profile + Specification". + canonical_event_log (bytes): + An Event Log containing additional events measured into the + TPM that are not already present in the tcg_event_log. + Formatted as described in the "Canonical Event Log Format" + TCG Specification. + ak_cert (bytes): + DER-encoded X.509 certificate of the + Attestation Key (otherwise known as an AK or a + TPM restricted signing key) used to generate the + quotes. + cert_chain (MutableSequence[bytes]): + List of DER-encoded X.509 certificates which, together with + the ak_cert, chain back to a trusted Root Certificate. + """ + + class Quote(proto.Message): + r"""Information about Platform Control Registers (PCRs) including + a signature over their values, which can be used for remote + validation. + + Attributes: + hash_algo (int): + The hash algorithm of the PCR bank being quoted, encoded as + a TPM_ALG_ID + pcr_values (MutableMapping[int, bytes]): + Raw binary values of each PCRs being quoted. + raw_quote (bytes): + TPM2 quote, encoded as a TPMS_ATTEST + raw_signature (bytes): + TPM2 signature, encoded as a TPMT_SIGNATURE + """ + + hash_algo: int = proto.Field( + proto.INT32, + number=1, + ) + pcr_values: MutableMapping[int, bytes] = proto.MapField( + proto.INT32, + proto.BYTES, + number=2, + ) + raw_quote: bytes = proto.Field( + proto.BYTES, + number=3, + ) + raw_signature: bytes = proto.Field( + proto.BYTES, + number=4, + ) + + quotes: MutableSequence[Quote] = proto.RepeatedField( + proto.MESSAGE, + number=1, + message=Quote, + ) + tcg_event_log: bytes = proto.Field( + proto.BYTES, + number=2, + ) + canonical_event_log: bytes = proto.Field( + proto.BYTES, + number=3, + ) + ak_cert: bytes = proto.Field( + proto.BYTES, + number=4, + ) + cert_chain: MutableSequence[bytes] = proto.RepeatedField( + proto.BYTES, + number=5, + ) + + +class ConfidentialSpaceInfo(proto.Message): + r"""ConfidentialSpaceInfo contains information related to the + Confidential Space TEE. + + Attributes: + signed_entities (MutableSequence[google.cloud.confidentialcomputing_v1.types.SignedEntity]): + Optional. A list of signed entities + containing container image signatures that can + be used for server-side signature verification. + """ + + signed_entities: MutableSequence['SignedEntity'] = proto.RepeatedField( + proto.MESSAGE, + number=1, + message='SignedEntity', + ) + + +class SignedEntity(proto.Message): + r"""SignedEntity represents an OCI image object containing + everything necessary to verify container image signatures. + + Attributes: + container_image_signatures (MutableSequence[google.cloud.confidentialcomputing_v1.types.ContainerImageSignature]): + Optional. A list of container image + signatures attached to an OCI image object. + """ + + container_image_signatures: MutableSequence['ContainerImageSignature'] = proto.RepeatedField( + proto.MESSAGE, + number=1, + message='ContainerImageSignature', + ) + + +class ContainerImageSignature(proto.Message): + r"""ContainerImageSignature holds necessary metadata to verify a + container image signature. + + Attributes: + payload (bytes): + Optional. The binary signature payload following the + SimpleSigning format + https://github.com/sigstore/cosign/blob/main/specs/SIGNATURE_SPEC.md#simple-signing. + This payload includes the container image digest. + signature (bytes): + Optional. A signature over the payload. The container image + digest is incorporated into the signature as follows: + + 1. Generate a SimpleSigning format payload that includes the + container image digest. + 2. Generate a signature over SHA256 digest of the payload. + The signature generation process can be represented as + follows: + ``Sign(sha256(SimpleSigningPayload(sha256(Image Manifest))))`` + public_key (bytes): + Optional. Reserved for future use. + sig_alg (google.cloud.confidentialcomputing_v1.types.SigningAlgorithm): + Optional. Reserved for future use. + """ + + payload: bytes = proto.Field( + proto.BYTES, + number=1, + ) + signature: bytes = proto.Field( + proto.BYTES, + number=2, + ) + public_key: bytes = proto.Field( + proto.BYTES, + number=3, + ) + sig_alg: 'SigningAlgorithm' = proto.Field( + proto.ENUM, + number=4, + enum='SigningAlgorithm', + ) + + +class VerifyConfidentialSpaceRequest(proto.Message): + r"""A request for an attestation token, providing all the + necessary information needed for this service to verify the + platform state of the requestor. + + This message has `oneof`_ fields (mutually exclusive fields). + For each oneof, at most one member field can be set at the same time. + Setting any member of the oneof automatically clears all other + members. + + .. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields + + Attributes: + td_ccel (google.cloud.confidentialcomputing_v1.types.TdxCcelAttestation): + Input only. A TDX with CCEL and RTMR + Attestation Quote. + + This field is a member of `oneof`_ ``tee_attestation``. + tpm_attestation (google.cloud.confidentialcomputing_v1.types.TpmAttestation): + Input only. The TPM-specific data provided by + the attesting platform, used to populate any of + the claims regarding platform state. + + This field is a member of `oneof`_ ``tee_attestation``. + challenge (str): + Required. The name of the Challenge whose nonce was used to + generate the attestation, in the format + ``projects/*/locations/*/challenges/*``. The provided + Challenge will be consumed, and cannot be used again. + gcp_credentials (google.cloud.confidentialcomputing_v1.types.GcpCredentials): + Optional. Credentials used to populate the "emails" claim in + the claims_token. If not present, token will not contain the + "emails" claim. + signed_entities (MutableSequence[google.cloud.confidentialcomputing_v1.types.SignedEntity]): + Optional. A list of signed entities + containing container image signatures that can + be used for server-side signature verification. + gce_shielded_identity (google.cloud.confidentialcomputing_v1.types.GceShieldedIdentity): + Optional. Information about the associated Compute Engine + instance. Required for td_ccel requests only - + tpm_attestation requests will provide this information in + the attestation. + options (google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceRequest.ConfidentialSpaceOptions): + Optional. A collection of fields that modify + the token output. + """ + + class ConfidentialSpaceOptions(proto.Message): + r"""Token options for Confidential Space attestation. + + .. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields + + Attributes: + aws_principal_tags_options (google.cloud.confidentialcomputing_v1.types.AwsPrincipalTagsOptions): + Optional. Options for the AWS token type. + + This field is a member of `oneof`_ ``token_profile_options``. + audience (str): + Optional. Optional string to issue the token + with a custom audience claim. Required if custom + nonces are specified. + token_profile (google.cloud.confidentialcomputing_v1.types.TokenProfile): + Optional. Optional specification for token + claims profile. + nonce (MutableSequence[str]): + Optional. Optional parameter to place one or more nonces in + the eat_nonce claim in the output token. The minimum size + for JSON-encoded EATs is 10 bytes and the maximum size is 74 + bytes. + signature_type (google.cloud.confidentialcomputing_v1.types.SignatureType): + Optional. Optional specification for how to sign the + attestation token. Defaults to SIGNATURE_TYPE_OIDC if + unspecified. + """ + + aws_principal_tags_options: 'AwsPrincipalTagsOptions' = proto.Field( + proto.MESSAGE, + number=5, + oneof='token_profile_options', + message='AwsPrincipalTagsOptions', + ) + audience: str = proto.Field( + proto.STRING, + number=1, + ) + token_profile: 'TokenProfile' = proto.Field( + proto.ENUM, + number=2, + enum='TokenProfile', + ) + nonce: MutableSequence[str] = proto.RepeatedField( + proto.STRING, + number=3, + ) + signature_type: 'SignatureType' = proto.Field( + proto.ENUM, + number=4, + enum='SignatureType', + ) + + td_ccel: 'TdxCcelAttestation' = proto.Field( + proto.MESSAGE, + number=3, + oneof='tee_attestation', + message='TdxCcelAttestation', + ) + tpm_attestation: 'TpmAttestation' = proto.Field( + proto.MESSAGE, + number=4, + oneof='tee_attestation', + message='TpmAttestation', + ) + challenge: str = proto.Field( + proto.STRING, + number=1, + ) + gcp_credentials: 'GcpCredentials' = proto.Field( + proto.MESSAGE, + number=2, + message='GcpCredentials', + ) + signed_entities: MutableSequence['SignedEntity'] = proto.RepeatedField( + proto.MESSAGE, + number=5, + message='SignedEntity', + ) + gce_shielded_identity: 'GceShieldedIdentity' = proto.Field( + proto.MESSAGE, + number=6, + message='GceShieldedIdentity', + ) + options: ConfidentialSpaceOptions = proto.Field( + proto.MESSAGE, + number=7, + message=ConfidentialSpaceOptions, + ) + + +class GceShieldedIdentity(proto.Message): + r"""GceShieldedIdentity contains information about a Compute + Engine instance. + + Attributes: + ak_cert (bytes): + Optional. DER-encoded X.509 certificate of + the Attestation Key (otherwise known as an AK or + a TPM restricted signing key) used to generate + the quotes. + ak_cert_chain (MutableSequence[bytes]): + Optional. List of DER-encoded X.509 certificates which, + together with the ak_cert, chain back to a trusted Root + Certificate. + """ + + ak_cert: bytes = proto.Field( + proto.BYTES, + number=1, + ) + ak_cert_chain: MutableSequence[bytes] = proto.RepeatedField( + proto.BYTES, + number=2, + ) + + +class VerifyConfidentialSpaceResponse(proto.Message): + r"""VerifyConfidentialSpaceResponse is returned once a + Confidential Space attestation has been successfully verified, + containing a signed token. + + Attributes: + attestation_token (str): + Output only. The attestation token issued by + this service. It contains specific platform + claims based on the contents of the provided + attestation. + partial_errors (MutableSequence[google.rpc.status_pb2.Status]): + Output only. A list of messages that carry + the partial error details related to + VerifyConfidentialSpace. This field is populated + by errors during container image signature + verification, which may reflect problems in the + provided image signatures. This does not block + the issuing of an attestation token, but the + token will not contain claims for the failed + image signatures. + """ + + attestation_token: str = proto.Field( + proto.STRING, + number=1, + ) + partial_errors: MutableSequence[status_pb2.Status] = proto.RepeatedField( + proto.MESSAGE, + number=2, + message=status_pb2.Status, + ) + + +class VerifyConfidentialGkeRequest(proto.Message): + r"""A request for an attestation token, providing all the + necessary information needed for this service to verify + Confidential GKE platform state of the requestor. + + + .. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields + + Attributes: + tpm_attestation (google.cloud.confidentialcomputing_v1.types.TpmAttestation): + The TPM-specific data provided by the + attesting platform, used to populate any of the + claims regarding platform state. + + This field is a member of `oneof`_ ``tee_attestation``. + challenge (str): + Required. The name of the Challenge whose nonce was used to + generate the attestation, in the format + projects/*/locations/*/challenges/\*. The provided Challenge + will be consumed, and cannot be used again. + """ + + tpm_attestation: 'TpmAttestation' = proto.Field( + proto.MESSAGE, + number=2, + oneof='tee_attestation', + message='TpmAttestation', + ) + challenge: str = proto.Field( + proto.STRING, + number=1, + ) + + +class VerifyConfidentialGkeResponse(proto.Message): + r"""VerifyConfidentialGkeResponse response is returened once a + Confidential GKE attestation has been successfully verified, + containing a signed OIDC token. + + Attributes: + attestation_token (str): + Output only. The attestation token issued by + this service for Confidential GKE. It contains + specific platform claims based on the contents + of the provided attestation. + """ + + attestation_token: str = proto.Field( + proto.STRING, + number=1, + ) + + +__all__ = tuple(sorted(__protobuf__.manifest)) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/mypy.ini b/owl-bot-staging/google-cloud-confidentialcomputing/v1/mypy.ini new file mode 100644 index 000000000000..574c5aed394b --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/mypy.ini @@ -0,0 +1,3 @@ +[mypy] +python_version = 3.7 +namespace_packages = True diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/noxfile.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/noxfile.py new file mode 100644 index 000000000000..3f0101ad8bd3 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/noxfile.py @@ -0,0 +1,591 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +import os +import pathlib +import re +import shutil + +from typing import Dict, List +import warnings + +import nox + +BLACK_VERSION = "black[jupyter]==23.7.0" +ISORT_VERSION = "isort==5.11.0" + +LINT_PATHS = ["docs", "google", "tests", "noxfile.py", "setup.py"] + +ALL_PYTHON = [ + "3.7", + "3.8", + "3.9", + "3.10", + "3.11", + "3.12", + "3.13", +] + +DEFAULT_PYTHON_VERSION = ALL_PYTHON[-1] + +CURRENT_DIRECTORY = pathlib.Path(__file__).parent.absolute() + +LOWER_BOUND_CONSTRAINTS_FILE = CURRENT_DIRECTORY / "constraints.txt" +PACKAGE_NAME = "google-cloud-confidentialcomputing" + +UNIT_TEST_STANDARD_DEPENDENCIES = [ + "mock", + "asyncmock", + "pytest", + "pytest-cov", + "pytest-asyncio", +] +UNIT_TEST_EXTERNAL_DEPENDENCIES: List[str] = [] +UNIT_TEST_LOCAL_DEPENDENCIES: List[str] = [] +UNIT_TEST_DEPENDENCIES: List[str] = [] +UNIT_TEST_EXTRAS: List[str] = [] +UNIT_TEST_EXTRAS_BY_PYTHON: Dict[str, List[str]] = {} + +SYSTEM_TEST_PYTHON_VERSIONS: List[str] = ["3.8", "3.9", "3.10", "3.11", "3.12", "3.13"] +SYSTEM_TEST_STANDARD_DEPENDENCIES = [ + "mock", + "pytest", + "google-cloud-testutils", +] +SYSTEM_TEST_EXTERNAL_DEPENDENCIES: List[str] = [] +SYSTEM_TEST_LOCAL_DEPENDENCIES: List[str] = [] +SYSTEM_TEST_DEPENDENCIES: List[str] = [] +SYSTEM_TEST_EXTRAS: List[str] = [] +SYSTEM_TEST_EXTRAS_BY_PYTHON: Dict[str, List[str]] = {} + +nox.options.sessions = [ + "unit", + "system", + "cover", + "lint", + "lint_setup_py", + "blacken", + "docs", +] + +# Error if a python version is missing +nox.options.error_on_missing_interpreters = True + + +@nox.session(python=ALL_PYTHON) +def mypy(session): + """Run the type checker.""" + session.install( + # TODO(https://github.com/googleapis/gapic-generator-python/issues/2410): Use the latest version of mypy + "mypy<1.16.0", + "types-requests", + "types-protobuf", + ) + session.install(".") + session.run( + "mypy", + "-p", + "google", + ) + + +@nox.session +def update_lower_bounds(session): + """Update lower bounds in constraints.txt to match setup.py""" + session.install("google-cloud-testutils") + session.install(".") + + session.run( + "lower-bound-checker", + "update", + "--package-name", + PACKAGE_NAME, + "--constraints-file", + str(LOWER_BOUND_CONSTRAINTS_FILE), + ) + + +@nox.session +def check_lower_bounds(session): + """Check lower bounds in setup.py are reflected in constraints file""" + session.install("google-cloud-testutils") + session.install(".") + + session.run( + "lower-bound-checker", + "check", + "--package-name", + PACKAGE_NAME, + "--constraints-file", + str(LOWER_BOUND_CONSTRAINTS_FILE), + ) + + +@nox.session(python=DEFAULT_PYTHON_VERSION) +def lint(session): + """Run linters. + + Returns a failure if the linters find linting errors or sufficiently + serious code quality issues. + """ + session.install("flake8", BLACK_VERSION) + session.run( + "black", + "--check", + *LINT_PATHS, + ) + + session.run("flake8", "google", "tests") + + +@nox.session(python=DEFAULT_PYTHON_VERSION) +def blacken(session): + """Run black. Format code to uniform standard.""" + session.install(BLACK_VERSION) + session.run( + "black", + *LINT_PATHS, + ) + + +@nox.session(python=DEFAULT_PYTHON_VERSION) +def format(session): + """ + Run isort to sort imports. Then run black + to format code to uniform standard. + """ + session.install(BLACK_VERSION, ISORT_VERSION) + # Use the --fss option to sort imports using strict alphabetical order. + # See https://pycqa.github.io/isort/docs/configuration/options.html#force-sort-within-sections + session.run( + "isort", + "--fss", + *LINT_PATHS, + ) + session.run( + "black", + *LINT_PATHS, + ) + + +@nox.session(python=DEFAULT_PYTHON_VERSION) +def lint_setup_py(session): + """Verify that setup.py is valid (including RST check).""" + session.install("setuptools", "docutils", "pygments") + session.run("python", "setup.py", "check", "--restructuredtext", "--strict") + + +def install_unittest_dependencies(session, *constraints): + standard_deps = UNIT_TEST_STANDARD_DEPENDENCIES + UNIT_TEST_DEPENDENCIES + session.install(*standard_deps, *constraints) + + if UNIT_TEST_EXTERNAL_DEPENDENCIES: + warnings.warn( + "'unit_test_external_dependencies' is deprecated. Instead, please " + "use 'unit_test_dependencies' or 'unit_test_local_dependencies'.", + DeprecationWarning, + ) + session.install(*UNIT_TEST_EXTERNAL_DEPENDENCIES, *constraints) + + if UNIT_TEST_LOCAL_DEPENDENCIES: + session.install(*UNIT_TEST_LOCAL_DEPENDENCIES, *constraints) + + if UNIT_TEST_EXTRAS_BY_PYTHON: + extras = UNIT_TEST_EXTRAS_BY_PYTHON.get(session.python, []) + elif UNIT_TEST_EXTRAS: + extras = UNIT_TEST_EXTRAS + else: + extras = [] + + if extras: + session.install("-e", f".[{','.join(extras)}]", *constraints) + else: + session.install("-e", ".", *constraints) + + +@nox.session(python=ALL_PYTHON) +@nox.parametrize( + "protobuf_implementation", + ["python", "upb", "cpp"], +) +def unit(session, protobuf_implementation): + # Install all test dependencies, then install this package in-place. + + if protobuf_implementation == "cpp" and session.python in ("3.11", "3.12", "3.13"): + session.skip("cpp implementation is not supported in python 3.11+") + + constraints_path = str( + CURRENT_DIRECTORY / "testing" / f"constraints-{session.python}.txt" + ) + install_unittest_dependencies(session, "-c", constraints_path) + + # TODO(https://github.com/googleapis/synthtool/issues/1976): + # Remove the 'cpp' implementation once support for Protobuf 3.x is dropped. + # The 'cpp' implementation requires Protobuf<4. + if protobuf_implementation == "cpp": + session.install("protobuf<4") + + # Run py.test against the unit tests. + session.run( + "py.test", + "--quiet", + f"--junitxml=unit_{session.python}_sponge_log.xml", + "--cov=google", + "--cov=tests/unit", + "--cov-append", + "--cov-config=.coveragerc", + "--cov-report=", + "--cov-fail-under=0", + os.path.join("tests", "unit"), + *session.posargs, + env={ + "PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION": protobuf_implementation, + }, + ) + + +def install_systemtest_dependencies(session, *constraints): + session.install("--pre", "grpcio") + + session.install(*SYSTEM_TEST_STANDARD_DEPENDENCIES, *constraints) + + if SYSTEM_TEST_EXTERNAL_DEPENDENCIES: + session.install(*SYSTEM_TEST_EXTERNAL_DEPENDENCIES, *constraints) + + if SYSTEM_TEST_LOCAL_DEPENDENCIES: + session.install("-e", *SYSTEM_TEST_LOCAL_DEPENDENCIES, *constraints) + + if SYSTEM_TEST_DEPENDENCIES: + session.install("-e", *SYSTEM_TEST_DEPENDENCIES, *constraints) + + if SYSTEM_TEST_EXTRAS_BY_PYTHON: + extras = SYSTEM_TEST_EXTRAS_BY_PYTHON.get(session.python, []) + elif SYSTEM_TEST_EXTRAS: + extras = SYSTEM_TEST_EXTRAS + else: + extras = [] + + if extras: + session.install("-e", f".[{','.join(extras)}]", *constraints) + else: + session.install("-e", ".", *constraints) + + +@nox.session(python=SYSTEM_TEST_PYTHON_VERSIONS) +def system(session): + """Run the system test suite.""" + constraints_path = str( + CURRENT_DIRECTORY / "testing" / f"constraints-{session.python}.txt" + ) + system_test_path = os.path.join("tests", "system.py") + system_test_folder_path = os.path.join("tests", "system") + + # Check the value of `RUN_SYSTEM_TESTS` env var. It defaults to true. + if os.environ.get("RUN_SYSTEM_TESTS", "true") == "false": + session.skip("RUN_SYSTEM_TESTS is set to false, skipping") + # Install pyopenssl for mTLS testing. + if os.environ.get("GOOGLE_API_USE_CLIENT_CERTIFICATE", "false") == "true": + session.install("pyopenssl") + + system_test_exists = os.path.exists(system_test_path) + system_test_folder_exists = os.path.exists(system_test_folder_path) + # Sanity check: only run tests if found. + if not system_test_exists and not system_test_folder_exists: + session.skip("System tests were not found") + + install_systemtest_dependencies(session, "-c", constraints_path) + + # Run py.test against the system tests. + if system_test_exists: + session.run( + "py.test", + "--quiet", + f"--junitxml=system_{session.python}_sponge_log.xml", + system_test_path, + *session.posargs, + ) + if system_test_folder_exists: + session.run( + "py.test", + "--quiet", + f"--junitxml=system_{session.python}_sponge_log.xml", + system_test_folder_path, + *session.posargs, + ) + + +@nox.session(python=DEFAULT_PYTHON_VERSION) +def cover(session): + """Run the final coverage report. + + This outputs the coverage report aggregating coverage from the unit + test runs (not system test runs), and then erases coverage data. + """ + session.install("coverage", "pytest-cov") + session.run("coverage", "report", "--show-missing", "--fail-under=100") + + session.run("coverage", "erase") + + +@nox.session(python="3.10") +def docs(session): + """Build the docs for this library.""" + + session.install("-e", ".") + session.install( + # We need to pin to specific versions of the `sphinxcontrib-*` packages + # which still support sphinx 4.x. + # See https://github.com/googleapis/sphinx-docfx-yaml/issues/344 + # and https://github.com/googleapis/sphinx-docfx-yaml/issues/345. + "sphinxcontrib-applehelp==1.0.4", + "sphinxcontrib-devhelp==1.0.2", + "sphinxcontrib-htmlhelp==2.0.1", + "sphinxcontrib-qthelp==1.0.3", + "sphinxcontrib-serializinghtml==1.1.5", + "sphinx==4.5.0", + "alabaster", + "recommonmark", + ) + + shutil.rmtree(os.path.join("docs", "_build"), ignore_errors=True) + session.run( + "sphinx-build", + "-W", # warnings as errors + "-T", # show full traceback on exception + "-N", # no colors + "-b", "html", # builder + "-d", os.path.join("docs", "_build", "doctrees", ""), # cache directory + # paths to build: + os.path.join("docs", ""), + os.path.join("docs", "_build", "html", ""), + ) + + +@nox.session(python="3.10") +def docfx(session): + """Build the docfx yaml files for this library.""" + + session.install("-e", ".") + session.install( + # We need to pin to specific versions of the `sphinxcontrib-*` packages + # which still support sphinx 4.x. + # See https://github.com/googleapis/sphinx-docfx-yaml/issues/344 + # and https://github.com/googleapis/sphinx-docfx-yaml/issues/345. + "sphinxcontrib-applehelp==1.0.4", + "sphinxcontrib-devhelp==1.0.2", + "sphinxcontrib-htmlhelp==2.0.1", + "sphinxcontrib-qthelp==1.0.3", + "sphinxcontrib-serializinghtml==1.1.5", + "gcp-sphinx-docfx-yaml", + "alabaster", + "recommonmark", + ) + + shutil.rmtree(os.path.join("docs", "_build"), ignore_errors=True) + session.run( + "sphinx-build", + "-T", # show full traceback on exception + "-N", # no colors + "-D", + ( + "extensions=sphinx.ext.autodoc," + "sphinx.ext.autosummary," + "docfx_yaml.extension," + "sphinx.ext.intersphinx," + "sphinx.ext.coverage," + "sphinx.ext.napoleon," + "sphinx.ext.todo," + "sphinx.ext.viewcode," + "recommonmark" + ), + "-b", + "html", + "-d", + os.path.join("docs", "_build", "doctrees", ""), + os.path.join("docs", ""), + os.path.join("docs", "_build", "html", ""), + ) + + +@nox.session(python=DEFAULT_PYTHON_VERSION) +@nox.parametrize( + "protobuf_implementation", + ["python", "upb", "cpp"], +) +def prerelease_deps(session, protobuf_implementation): + """ + Run all tests with pre-release versions of dependencies installed + rather than the standard non pre-release versions. + Pre-release versions can be installed using + `pip install --pre `. + """ + + if protobuf_implementation == "cpp" and session.python in ("3.11", "3.12", "3.13"): + session.skip("cpp implementation is not supported in python 3.11+") + + # Install all dependencies + session.install("-e", ".") + + # Install dependencies for the unit test environment + unit_deps_all = UNIT_TEST_STANDARD_DEPENDENCIES + UNIT_TEST_EXTERNAL_DEPENDENCIES + session.install(*unit_deps_all) + + # Install dependencies for the system test environment + system_deps_all = ( + SYSTEM_TEST_STANDARD_DEPENDENCIES + + SYSTEM_TEST_EXTERNAL_DEPENDENCIES + + SYSTEM_TEST_EXTRAS + ) + session.install(*system_deps_all) + + # Because we test minimum dependency versions on the minimum Python + # version, the first version we test with in the unit tests sessions has a + # constraints file containing all dependencies and extras. + with open( + CURRENT_DIRECTORY / "testing" / f"constraints-{ALL_PYTHON[0]}.txt", + encoding="utf-8", + ) as constraints_file: + constraints_text = constraints_file.read() + + # Ignore leading whitespace and comment lines. + constraints_deps = [ + match.group(1) + for match in re.finditer( + r"^\s*(\S+)(?===\S+)", constraints_text, flags=re.MULTILINE + ) + ] + + # Install dependencies specified in `testing/constraints-X.txt`. + session.install(*constraints_deps) + + # Note: If a dependency is added to the `prerel_deps` list, + # the `core_dependencies_from_source` list in the `core_deps_from_source` + # nox session should also be updated. + prerel_deps = [ + "googleapis-common-protos", + "google-api-core", + "google-auth", + "grpc-google-iam-v1", + "grpcio", + "grpcio-status", + "protobuf", + "proto-plus", + ] + + for dep in prerel_deps: + session.install("--pre", "--no-deps", "--ignore-installed", dep) + # TODO(https://github.com/grpc/grpc/issues/38965): Add `grpcio-status`` + # to the dictionary below once this bug is fixed. + # TODO(https://github.com/googleapis/google-cloud-python/issues/13643): Add + # `googleapis-common-protos` and `grpc-google-iam-v1` to the dictionary below + # once this bug is fixed. + package_namespaces = { + "google-api-core": "google.api_core", + "google-auth": "google.auth", + "grpcio": "grpc", + "protobuf": "google.protobuf", + "proto-plus": "proto", + } + + version_namespace = package_namespaces.get(dep) + + print(f"Installed {dep}") + if version_namespace: + session.run( + "python", + "-c", + f"import {version_namespace}; print({version_namespace}.__version__)", + ) + + session.run( + "py.test", + "tests/unit", + env={ + "PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION": protobuf_implementation, + }, + ) + + +@nox.session(python=DEFAULT_PYTHON_VERSION) +@nox.parametrize( + "protobuf_implementation", + ["python", "upb"], +) +def core_deps_from_source(session, protobuf_implementation): + """Run all tests with core dependencies installed from source + rather than pulling the dependencies from PyPI. + """ + + # Install all dependencies + session.install("-e", ".") + + # Install dependencies for the unit test environment + unit_deps_all = UNIT_TEST_STANDARD_DEPENDENCIES + UNIT_TEST_EXTERNAL_DEPENDENCIES + session.install(*unit_deps_all) + + # Install dependencies for the system test environment + system_deps_all = ( + SYSTEM_TEST_STANDARD_DEPENDENCIES + + SYSTEM_TEST_EXTERNAL_DEPENDENCIES + + SYSTEM_TEST_EXTRAS + ) + session.install(*system_deps_all) + + # Because we test minimum dependency versions on the minimum Python + # version, the first version we test with in the unit tests sessions has a + # constraints file containing all dependencies and extras. + with open( + CURRENT_DIRECTORY / "testing" / f"constraints-{ALL_PYTHON[0]}.txt", + encoding="utf-8", + ) as constraints_file: + constraints_text = constraints_file.read() + + # Ignore leading whitespace and comment lines. + constraints_deps = [ + match.group(1) + for match in re.finditer( + r"^\s*(\S+)(?===\S+)", constraints_text, flags=re.MULTILINE + ) + ] + + # Install dependencies specified in `testing/constraints-X.txt`. + session.install(*constraints_deps) + + # TODO(https://github.com/googleapis/gapic-generator-python/issues/2358): `grpcio` and + # `grpcio-status` should be added to the list below so that they are installed from source, + # rather than PyPI. + # TODO(https://github.com/googleapis/gapic-generator-python/issues/2357): `protobuf` should be + # added to the list below so that it is installed from source, rather than PyPI + # Note: If a dependency is added to the `core_dependencies_from_source` list, + # the `prerel_deps` list in the `prerelease_deps` nox session should also be updated. + core_dependencies_from_source = [ + "googleapis-common-protos @ git+https://github.com/googleapis/google-cloud-python#egg=googleapis-common-protos&subdirectory=packages/googleapis-common-protos", + "google-api-core @ git+https://github.com/googleapis/python-api-core.git", + "google-auth @ git+https://github.com/googleapis/google-auth-library-python.git", + "grpc-google-iam-v1 @ git+https://github.com/googleapis/google-cloud-python#egg=grpc-google-iam-v1&subdirectory=packages/grpc-google-iam-v1", + "proto-plus @ git+https://github.com/googleapis/proto-plus-python.git", + ] + + for dep in core_dependencies_from_source: + session.install(dep, "--no-deps", "--ignore-installed") + print(f"Installed {dep}") + + session.run( + "py.test", + "tests/unit", + env={ + "PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION": protobuf_implementation, + }, + ) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_create_challenge_async.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_create_challenge_async.py new file mode 100644 index 000000000000..528b0847412b --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_create_challenge_async.py @@ -0,0 +1,52 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# Generated code. DO NOT EDIT! +# +# Snippet for CreateChallenge +# NOTE: This snippet has been automatically generated for illustrative purposes only. +# It may require modifications to work in your environment. + +# To install the latest published package dependency, execute the following: +# python3 -m pip install google-cloud-confidentialcomputing + + +# [START confidentialcomputing_v1_generated_ConfidentialComputing_CreateChallenge_async] +# This snippet has been automatically generated and should be regarded as a +# code template only. +# It will require modifications to work: +# - It may require correct/in-range values for request initialization. +# - It may require specifying regional endpoints when creating the service +# client as shown in: +# https://googleapis.dev/python/google-api-core/latest/client_options.html +from google.cloud import confidentialcomputing_v1 + + +async def sample_create_challenge(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingAsyncClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.CreateChallengeRequest( + parent="parent_value", + ) + + # Make the request + response = await client.create_challenge(request=request) + + # Handle the response + print(response) + +# [END confidentialcomputing_v1_generated_ConfidentialComputing_CreateChallenge_async] diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_create_challenge_sync.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_create_challenge_sync.py new file mode 100644 index 000000000000..77033a817788 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_create_challenge_sync.py @@ -0,0 +1,52 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# Generated code. DO NOT EDIT! +# +# Snippet for CreateChallenge +# NOTE: This snippet has been automatically generated for illustrative purposes only. +# It may require modifications to work in your environment. + +# To install the latest published package dependency, execute the following: +# python3 -m pip install google-cloud-confidentialcomputing + + +# [START confidentialcomputing_v1_generated_ConfidentialComputing_CreateChallenge_sync] +# This snippet has been automatically generated and should be regarded as a +# code template only. +# It will require modifications to work: +# - It may require correct/in-range values for request initialization. +# - It may require specifying regional endpoints when creating the service +# client as shown in: +# https://googleapis.dev/python/google-api-core/latest/client_options.html +from google.cloud import confidentialcomputing_v1 + + +def sample_create_challenge(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.CreateChallengeRequest( + parent="parent_value", + ) + + # Make the request + response = client.create_challenge(request=request) + + # Handle the response + print(response) + +# [END confidentialcomputing_v1_generated_ConfidentialComputing_CreateChallenge_sync] diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_attestation_async.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_attestation_async.py new file mode 100644 index 000000000000..815f2f866b48 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_attestation_async.py @@ -0,0 +1,52 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# Generated code. DO NOT EDIT! +# +# Snippet for VerifyAttestation +# NOTE: This snippet has been automatically generated for illustrative purposes only. +# It may require modifications to work in your environment. + +# To install the latest published package dependency, execute the following: +# python3 -m pip install google-cloud-confidentialcomputing + + +# [START confidentialcomputing_v1_generated_ConfidentialComputing_VerifyAttestation_async] +# This snippet has been automatically generated and should be regarded as a +# code template only. +# It will require modifications to work: +# - It may require correct/in-range values for request initialization. +# - It may require specifying regional endpoints when creating the service +# client as shown in: +# https://googleapis.dev/python/google-api-core/latest/client_options.html +from google.cloud import confidentialcomputing_v1 + + +async def sample_verify_attestation(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingAsyncClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.VerifyAttestationRequest( + challenge="challenge_value", + ) + + # Make the request + response = await client.verify_attestation(request=request) + + # Handle the response + print(response) + +# [END confidentialcomputing_v1_generated_ConfidentialComputing_VerifyAttestation_async] diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_attestation_sync.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_attestation_sync.py new file mode 100644 index 000000000000..724ad44eec2a --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_attestation_sync.py @@ -0,0 +1,52 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# Generated code. DO NOT EDIT! +# +# Snippet for VerifyAttestation +# NOTE: This snippet has been automatically generated for illustrative purposes only. +# It may require modifications to work in your environment. + +# To install the latest published package dependency, execute the following: +# python3 -m pip install google-cloud-confidentialcomputing + + +# [START confidentialcomputing_v1_generated_ConfidentialComputing_VerifyAttestation_sync] +# This snippet has been automatically generated and should be regarded as a +# code template only. +# It will require modifications to work: +# - It may require correct/in-range values for request initialization. +# - It may require specifying regional endpoints when creating the service +# client as shown in: +# https://googleapis.dev/python/google-api-core/latest/client_options.html +from google.cloud import confidentialcomputing_v1 + + +def sample_verify_attestation(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.VerifyAttestationRequest( + challenge="challenge_value", + ) + + # Make the request + response = client.verify_attestation(request=request) + + # Handle the response + print(response) + +# [END confidentialcomputing_v1_generated_ConfidentialComputing_VerifyAttestation_sync] diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_async.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_async.py new file mode 100644 index 000000000000..f31b51fb713f --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_async.py @@ -0,0 +1,52 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# Generated code. DO NOT EDIT! +# +# Snippet for VerifyConfidentialGke +# NOTE: This snippet has been automatically generated for illustrative purposes only. +# It may require modifications to work in your environment. + +# To install the latest published package dependency, execute the following: +# python3 -m pip install google-cloud-confidentialcomputing + + +# [START confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialGke_async] +# This snippet has been automatically generated and should be regarded as a +# code template only. +# It will require modifications to work: +# - It may require correct/in-range values for request initialization. +# - It may require specifying regional endpoints when creating the service +# client as shown in: +# https://googleapis.dev/python/google-api-core/latest/client_options.html +from google.cloud import confidentialcomputing_v1 + + +async def sample_verify_confidential_gke(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingAsyncClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.VerifyConfidentialGkeRequest( + challenge="challenge_value", + ) + + # Make the request + response = await client.verify_confidential_gke(request=request) + + # Handle the response + print(response) + +# [END confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialGke_async] diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_sync.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_sync.py new file mode 100644 index 000000000000..f48c41b7d257 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_sync.py @@ -0,0 +1,52 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# Generated code. DO NOT EDIT! +# +# Snippet for VerifyConfidentialGke +# NOTE: This snippet has been automatically generated for illustrative purposes only. +# It may require modifications to work in your environment. + +# To install the latest published package dependency, execute the following: +# python3 -m pip install google-cloud-confidentialcomputing + + +# [START confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialGke_sync] +# This snippet has been automatically generated and should be regarded as a +# code template only. +# It will require modifications to work: +# - It may require correct/in-range values for request initialization. +# - It may require specifying regional endpoints when creating the service +# client as shown in: +# https://googleapis.dev/python/google-api-core/latest/client_options.html +from google.cloud import confidentialcomputing_v1 + + +def sample_verify_confidential_gke(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.VerifyConfidentialGkeRequest( + challenge="challenge_value", + ) + + # Make the request + response = client.verify_confidential_gke(request=request) + + # Handle the response + print(response) + +# [END confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialGke_sync] diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_async.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_async.py new file mode 100644 index 000000000000..2a518ead0d28 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_async.py @@ -0,0 +1,52 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# Generated code. DO NOT EDIT! +# +# Snippet for VerifyConfidentialSpace +# NOTE: This snippet has been automatically generated for illustrative purposes only. +# It may require modifications to work in your environment. + +# To install the latest published package dependency, execute the following: +# python3 -m pip install google-cloud-confidentialcomputing + + +# [START confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialSpace_async] +# This snippet has been automatically generated and should be regarded as a +# code template only. +# It will require modifications to work: +# - It may require correct/in-range values for request initialization. +# - It may require specifying regional endpoints when creating the service +# client as shown in: +# https://googleapis.dev/python/google-api-core/latest/client_options.html +from google.cloud import confidentialcomputing_v1 + + +async def sample_verify_confidential_space(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingAsyncClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.VerifyConfidentialSpaceRequest( + challenge="challenge_value", + ) + + # Make the request + response = await client.verify_confidential_space(request=request) + + # Handle the response + print(response) + +# [END confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialSpace_async] diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_sync.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_sync.py new file mode 100644 index 000000000000..c7a2756f49bc --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_sync.py @@ -0,0 +1,52 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# Generated code. DO NOT EDIT! +# +# Snippet for VerifyConfidentialSpace +# NOTE: This snippet has been automatically generated for illustrative purposes only. +# It may require modifications to work in your environment. + +# To install the latest published package dependency, execute the following: +# python3 -m pip install google-cloud-confidentialcomputing + + +# [START confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialSpace_sync] +# This snippet has been automatically generated and should be regarded as a +# code template only. +# It will require modifications to work: +# - It may require correct/in-range values for request initialization. +# - It may require specifying regional endpoints when creating the service +# client as shown in: +# https://googleapis.dev/python/google-api-core/latest/client_options.html +from google.cloud import confidentialcomputing_v1 + + +def sample_verify_confidential_space(): + # Create a client + client = confidentialcomputing_v1.ConfidentialComputingClient() + + # Initialize request argument(s) + request = confidentialcomputing_v1.VerifyConfidentialSpaceRequest( + challenge="challenge_value", + ) + + # Make the request + response = client.verify_confidential_space(request=request) + + # Handle the response + print(response) + +# [END confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialSpace_sync] diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/snippet_metadata_google.cloud.confidentialcomputing.v1.json b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/snippet_metadata_google.cloud.confidentialcomputing.v1.json new file mode 100644 index 000000000000..1994174817f3 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/snippet_metadata_google.cloud.confidentialcomputing.v1.json @@ -0,0 +1,643 @@ +{ + "clientLibrary": { + "apis": [ + { + "id": "google.cloud.confidentialcomputing.v1", + "version": "v1" + } + ], + "language": "PYTHON", + "name": "google-cloud-confidentialcomputing", + "version": "0.1.0" + }, + "snippets": [ + { + "canonical": true, + "clientMethod": { + "async": true, + "client": { + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient", + "shortName": "ConfidentialComputingAsyncClient" + }, + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient.create_challenge", + "method": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.CreateChallenge", + "service": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "shortName": "ConfidentialComputing" + }, + "shortName": "CreateChallenge" + }, + "parameters": [ + { + "name": "request", + "type": "google.cloud.confidentialcomputing_v1.types.CreateChallengeRequest" + }, + { + "name": "parent", + "type": "str" + }, + { + "name": "challenge", + "type": "google.cloud.confidentialcomputing_v1.types.Challenge" + }, + { + "name": "retry", + "type": "google.api_core.retry.Retry" + }, + { + "name": "timeout", + "type": "float" + }, + { + "name": "metadata", + "type": "Sequence[Tuple[str, Union[str, bytes]]]" + } + ], + "resultType": "google.cloud.confidentialcomputing_v1.types.Challenge", + "shortName": "create_challenge" + }, + "description": "Sample for CreateChallenge", + "file": "confidentialcomputing_v1_generated_confidential_computing_create_challenge_async.py", + "language": "PYTHON", + "origin": "API_DEFINITION", + "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_CreateChallenge_async", + "segments": [ + { + "end": 51, + "start": 27, + "type": "FULL" + }, + { + "end": 51, + "start": 27, + "type": "SHORT" + }, + { + "end": 40, + "start": 38, + "type": "CLIENT_INITIALIZATION" + }, + { + "end": 45, + "start": 41, + "type": "REQUEST_INITIALIZATION" + }, + { + "end": 48, + "start": 46, + "type": "REQUEST_EXECUTION" + }, + { + "end": 52, + "start": 49, + "type": "RESPONSE_HANDLING" + } + ], + "title": "confidentialcomputing_v1_generated_confidential_computing_create_challenge_async.py" + }, + { + "canonical": true, + "clientMethod": { + "client": { + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient", + "shortName": "ConfidentialComputingClient" + }, + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.create_challenge", + "method": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.CreateChallenge", + "service": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "shortName": "ConfidentialComputing" + }, + "shortName": "CreateChallenge" + }, + "parameters": [ + { + "name": "request", + "type": "google.cloud.confidentialcomputing_v1.types.CreateChallengeRequest" + }, + { + "name": "parent", + "type": "str" + }, + { + "name": "challenge", + "type": "google.cloud.confidentialcomputing_v1.types.Challenge" + }, + { + "name": "retry", + "type": "google.api_core.retry.Retry" + }, + { + "name": "timeout", + "type": "float" + }, + { + "name": "metadata", + "type": "Sequence[Tuple[str, Union[str, bytes]]]" + } + ], + "resultType": "google.cloud.confidentialcomputing_v1.types.Challenge", + "shortName": "create_challenge" + }, + "description": "Sample for CreateChallenge", + "file": "confidentialcomputing_v1_generated_confidential_computing_create_challenge_sync.py", + "language": "PYTHON", + "origin": "API_DEFINITION", + "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_CreateChallenge_sync", + "segments": [ + { + "end": 51, + "start": 27, + "type": "FULL" + }, + { + "end": 51, + "start": 27, + "type": "SHORT" + }, + { + "end": 40, + "start": 38, + "type": "CLIENT_INITIALIZATION" + }, + { + "end": 45, + "start": 41, + "type": "REQUEST_INITIALIZATION" + }, + { + "end": 48, + "start": 46, + "type": "REQUEST_EXECUTION" + }, + { + "end": 52, + "start": 49, + "type": "RESPONSE_HANDLING" + } + ], + "title": "confidentialcomputing_v1_generated_confidential_computing_create_challenge_sync.py" + }, + { + "canonical": true, + "clientMethod": { + "async": true, + "client": { + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient", + "shortName": "ConfidentialComputingAsyncClient" + }, + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient.verify_attestation", + "method": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.VerifyAttestation", + "service": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "shortName": "ConfidentialComputing" + }, + "shortName": "VerifyAttestation" + }, + "parameters": [ + { + "name": "request", + "type": "google.cloud.confidentialcomputing_v1.types.VerifyAttestationRequest" + }, + { + "name": "retry", + "type": "google.api_core.retry.Retry" + }, + { + "name": "timeout", + "type": "float" + }, + { + "name": "metadata", + "type": "Sequence[Tuple[str, Union[str, bytes]]]" + } + ], + "resultType": "google.cloud.confidentialcomputing_v1.types.VerifyAttestationResponse", + "shortName": "verify_attestation" + }, + "description": "Sample for VerifyAttestation", + "file": "confidentialcomputing_v1_generated_confidential_computing_verify_attestation_async.py", + "language": "PYTHON", + "origin": "API_DEFINITION", + "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_VerifyAttestation_async", + "segments": [ + { + "end": 51, + "start": 27, + "type": "FULL" + }, + { + "end": 51, + "start": 27, + "type": "SHORT" + }, + { + "end": 40, + "start": 38, + "type": "CLIENT_INITIALIZATION" + }, + { + "end": 45, + "start": 41, + "type": "REQUEST_INITIALIZATION" + }, + { + "end": 48, + "start": 46, + "type": "REQUEST_EXECUTION" + }, + { + "end": 52, + "start": 49, + "type": "RESPONSE_HANDLING" + } + ], + "title": "confidentialcomputing_v1_generated_confidential_computing_verify_attestation_async.py" + }, + { + "canonical": true, + "clientMethod": { + "client": { + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient", + "shortName": "ConfidentialComputingClient" + }, + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.verify_attestation", + "method": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.VerifyAttestation", + "service": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "shortName": "ConfidentialComputing" + }, + "shortName": "VerifyAttestation" + }, + "parameters": [ + { + "name": "request", + "type": "google.cloud.confidentialcomputing_v1.types.VerifyAttestationRequest" + }, + { + "name": "retry", + "type": "google.api_core.retry.Retry" + }, + { + "name": "timeout", + "type": "float" + }, + { + "name": "metadata", + "type": "Sequence[Tuple[str, Union[str, bytes]]]" + } + ], + "resultType": "google.cloud.confidentialcomputing_v1.types.VerifyAttestationResponse", + "shortName": "verify_attestation" + }, + "description": "Sample for VerifyAttestation", + "file": "confidentialcomputing_v1_generated_confidential_computing_verify_attestation_sync.py", + "language": "PYTHON", + "origin": "API_DEFINITION", + "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_VerifyAttestation_sync", + "segments": [ + { + "end": 51, + "start": 27, + "type": "FULL" + }, + { + "end": 51, + "start": 27, + "type": "SHORT" + }, + { + "end": 40, + "start": 38, + "type": "CLIENT_INITIALIZATION" + }, + { + "end": 45, + "start": 41, + "type": "REQUEST_INITIALIZATION" + }, + { + "end": 48, + "start": 46, + "type": "REQUEST_EXECUTION" + }, + { + "end": 52, + "start": 49, + "type": "RESPONSE_HANDLING" + } + ], + "title": "confidentialcomputing_v1_generated_confidential_computing_verify_attestation_sync.py" + }, + { + "canonical": true, + "clientMethod": { + "async": true, + "client": { + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient", + "shortName": "ConfidentialComputingAsyncClient" + }, + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient.verify_confidential_gke", + "method": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.VerifyConfidentialGke", + "service": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "shortName": "ConfidentialComputing" + }, + "shortName": "VerifyConfidentialGke" + }, + "parameters": [ + { + "name": "request", + "type": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeRequest" + }, + { + "name": "retry", + "type": "google.api_core.retry.Retry" + }, + { + "name": "timeout", + "type": "float" + }, + { + "name": "metadata", + "type": "Sequence[Tuple[str, Union[str, bytes]]]" + } + ], + "resultType": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeResponse", + "shortName": "verify_confidential_gke" + }, + "description": "Sample for VerifyConfidentialGke", + "file": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_async.py", + "language": "PYTHON", + "origin": "API_DEFINITION", + "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialGke_async", + "segments": [ + { + "end": 51, + "start": 27, + "type": "FULL" + }, + { + "end": 51, + "start": 27, + "type": "SHORT" + }, + { + "end": 40, + "start": 38, + "type": "CLIENT_INITIALIZATION" + }, + { + "end": 45, + "start": 41, + "type": "REQUEST_INITIALIZATION" + }, + { + "end": 48, + "start": 46, + "type": "REQUEST_EXECUTION" + }, + { + "end": 52, + "start": 49, + "type": "RESPONSE_HANDLING" + } + ], + "title": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_async.py" + }, + { + "canonical": true, + "clientMethod": { + "client": { + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient", + "shortName": "ConfidentialComputingClient" + }, + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.verify_confidential_gke", + "method": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.VerifyConfidentialGke", + "service": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "shortName": "ConfidentialComputing" + }, + "shortName": "VerifyConfidentialGke" + }, + "parameters": [ + { + "name": "request", + "type": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeRequest" + }, + { + "name": "retry", + "type": "google.api_core.retry.Retry" + }, + { + "name": "timeout", + "type": "float" + }, + { + "name": "metadata", + "type": "Sequence[Tuple[str, Union[str, bytes]]]" + } + ], + "resultType": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeResponse", + "shortName": "verify_confidential_gke" + }, + "description": "Sample for VerifyConfidentialGke", + "file": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_sync.py", + "language": "PYTHON", + "origin": "API_DEFINITION", + "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialGke_sync", + "segments": [ + { + "end": 51, + "start": 27, + "type": "FULL" + }, + { + "end": 51, + "start": 27, + "type": "SHORT" + }, + { + "end": 40, + "start": 38, + "type": "CLIENT_INITIALIZATION" + }, + { + "end": 45, + "start": 41, + "type": "REQUEST_INITIALIZATION" + }, + { + "end": 48, + "start": 46, + "type": "REQUEST_EXECUTION" + }, + { + "end": 52, + "start": 49, + "type": "RESPONSE_HANDLING" + } + ], + "title": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_sync.py" + }, + { + "canonical": true, + "clientMethod": { + "async": true, + "client": { + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient", + "shortName": "ConfidentialComputingAsyncClient" + }, + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient.verify_confidential_space", + "method": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.VerifyConfidentialSpace", + "service": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "shortName": "ConfidentialComputing" + }, + "shortName": "VerifyConfidentialSpace" + }, + "parameters": [ + { + "name": "request", + "type": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceRequest" + }, + { + "name": "retry", + "type": "google.api_core.retry.Retry" + }, + { + "name": "timeout", + "type": "float" + }, + { + "name": "metadata", + "type": "Sequence[Tuple[str, Union[str, bytes]]]" + } + ], + "resultType": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceResponse", + "shortName": "verify_confidential_space" + }, + "description": "Sample for VerifyConfidentialSpace", + "file": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_async.py", + "language": "PYTHON", + "origin": "API_DEFINITION", + "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialSpace_async", + "segments": [ + { + "end": 51, + "start": 27, + "type": "FULL" + }, + { + "end": 51, + "start": 27, + "type": "SHORT" + }, + { + "end": 40, + "start": 38, + "type": "CLIENT_INITIALIZATION" + }, + { + "end": 45, + "start": 41, + "type": "REQUEST_INITIALIZATION" + }, + { + "end": 48, + "start": 46, + "type": "REQUEST_EXECUTION" + }, + { + "end": 52, + "start": 49, + "type": "RESPONSE_HANDLING" + } + ], + "title": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_async.py" + }, + { + "canonical": true, + "clientMethod": { + "client": { + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient", + "shortName": "ConfidentialComputingClient" + }, + "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.verify_confidential_space", + "method": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.VerifyConfidentialSpace", + "service": { + "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", + "shortName": "ConfidentialComputing" + }, + "shortName": "VerifyConfidentialSpace" + }, + "parameters": [ + { + "name": "request", + "type": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceRequest" + }, + { + "name": "retry", + "type": "google.api_core.retry.Retry" + }, + { + "name": "timeout", + "type": "float" + }, + { + "name": "metadata", + "type": "Sequence[Tuple[str, Union[str, bytes]]]" + } + ], + "resultType": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceResponse", + "shortName": "verify_confidential_space" + }, + "description": "Sample for VerifyConfidentialSpace", + "file": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_sync.py", + "language": "PYTHON", + "origin": "API_DEFINITION", + "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialSpace_sync", + "segments": [ + { + "end": 51, + "start": 27, + "type": "FULL" + }, + { + "end": 51, + "start": 27, + "type": "SHORT" + }, + { + "end": 40, + "start": 38, + "type": "CLIENT_INITIALIZATION" + }, + { + "end": 45, + "start": 41, + "type": "REQUEST_INITIALIZATION" + }, + { + "end": 48, + "start": 46, + "type": "REQUEST_EXECUTION" + }, + { + "end": 52, + "start": 49, + "type": "RESPONSE_HANDLING" + } + ], + "title": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_sync.py" + } + ] +} diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/scripts/fixup_confidentialcomputing_v1_keywords.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/scripts/fixup_confidentialcomputing_v1_keywords.py new file mode 100644 index 000000000000..6a8e4fb95705 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/scripts/fixup_confidentialcomputing_v1_keywords.py @@ -0,0 +1,179 @@ +#! /usr/bin/env python3 +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +import argparse +import os +import libcst as cst +import pathlib +import sys +from typing import (Any, Callable, Dict, List, Sequence, Tuple) + + +def partition( + predicate: Callable[[Any], bool], + iterator: Sequence[Any] +) -> Tuple[List[Any], List[Any]]: + """A stable, out-of-place partition.""" + results = ([], []) + + for i in iterator: + results[int(predicate(i))].append(i) + + # Returns trueList, falseList + return results[1], results[0] + + +class confidentialcomputingCallTransformer(cst.CSTTransformer): + CTRL_PARAMS: Tuple[str] = ('retry', 'timeout', 'metadata') + METHOD_TO_PARAMS: Dict[str, Tuple[str]] = { + 'create_challenge': ('parent', 'challenge', ), + 'verify_attestation': ('challenge', 'tpm_attestation', 'td_ccel', 'sev_snp_attestation', 'gcp_credentials', 'confidential_space_info', 'token_options', 'attester', ), + 'verify_confidential_gke': ('challenge', 'tpm_attestation', ), + 'verify_confidential_space': ('challenge', 'td_ccel', 'tpm_attestation', 'gcp_credentials', 'signed_entities', 'gce_shielded_identity', 'options', ), + } + + def leave_Call(self, original: cst.Call, updated: cst.Call) -> cst.CSTNode: + try: + key = original.func.attr.value + kword_params = self.METHOD_TO_PARAMS[key] + except (AttributeError, KeyError): + # Either not a method from the API or too convoluted to be sure. + return updated + + # If the existing code is valid, keyword args come after positional args. + # Therefore, all positional args must map to the first parameters. + args, kwargs = partition(lambda a: not bool(a.keyword), updated.args) + if any(k.keyword.value == "request" for k in kwargs): + # We've already fixed this file, don't fix it again. + return updated + + kwargs, ctrl_kwargs = partition( + lambda a: a.keyword.value not in self.CTRL_PARAMS, + kwargs + ) + + args, ctrl_args = args[:len(kword_params)], args[len(kword_params):] + ctrl_kwargs.extend(cst.Arg(value=a.value, keyword=cst.Name(value=ctrl)) + for a, ctrl in zip(ctrl_args, self.CTRL_PARAMS)) + + request_arg = cst.Arg( + value=cst.Dict([ + cst.DictElement( + cst.SimpleString("'{}'".format(name)), +cst.Element(value=arg.value) + ) + # Note: the args + kwargs looks silly, but keep in mind that + # the control parameters had to be stripped out, and that + # those could have been passed positionally or by keyword. + for name, arg in zip(kword_params, args + kwargs)]), + keyword=cst.Name("request") + ) + + return updated.with_changes( + args=[request_arg] + ctrl_kwargs + ) + + +def fix_files( + in_dir: pathlib.Path, + out_dir: pathlib.Path, + *, + transformer=confidentialcomputingCallTransformer(), +): + """Duplicate the input dir to the output dir, fixing file method calls. + + Preconditions: + * in_dir is a real directory + * out_dir is a real, empty directory + """ + pyfile_gen = ( + pathlib.Path(os.path.join(root, f)) + for root, _, files in os.walk(in_dir) + for f in files if os.path.splitext(f)[1] == ".py" + ) + + for fpath in pyfile_gen: + with open(fpath, 'r') as f: + src = f.read() + + # Parse the code and insert method call fixes. + tree = cst.parse_module(src) + updated = tree.visit(transformer) + + # Create the path and directory structure for the new file. + updated_path = out_dir.joinpath(fpath.relative_to(in_dir)) + updated_path.parent.mkdir(parents=True, exist_ok=True) + + # Generate the updated source file at the corresponding path. + with open(updated_path, 'w') as f: + f.write(updated.code) + + +if __name__ == '__main__': + parser = argparse.ArgumentParser( + description="""Fix up source that uses the confidentialcomputing client library. + +The existing sources are NOT overwritten but are copied to output_dir with changes made. + +Note: This tool operates at a best-effort level at converting positional + parameters in client method calls to keyword based parameters. + Cases where it WILL FAIL include + A) * or ** expansion in a method call. + B) Calls via function or method alias (includes free function calls) + C) Indirect or dispatched calls (e.g. the method is looked up dynamically) + + These all constitute false negatives. The tool will also detect false + positives when an API method shares a name with another method. +""") + parser.add_argument( + '-d', + '--input-directory', + required=True, + dest='input_dir', + help='the input directory to walk for python files to fix up', + ) + parser.add_argument( + '-o', + '--output-directory', + required=True, + dest='output_dir', + help='the directory to output files fixed via un-flattening', + ) + args = parser.parse_args() + input_dir = pathlib.Path(args.input_dir) + output_dir = pathlib.Path(args.output_dir) + if not input_dir.is_dir(): + print( + f"input directory '{input_dir}' does not exist or is not a directory", + file=sys.stderr, + ) + sys.exit(-1) + + if not output_dir.is_dir(): + print( + f"output directory '{output_dir}' does not exist or is not a directory", + file=sys.stderr, + ) + sys.exit(-1) + + if os.listdir(output_dir): + print( + f"output directory '{output_dir}' is not empty", + file=sys.stderr, + ) + sys.exit(-1) + + fix_files(input_dir, output_dir) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/setup.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/setup.py new file mode 100644 index 000000000000..1fed1a0eec9f --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/setup.py @@ -0,0 +1,98 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +import io +import os +import re + +import setuptools # type: ignore + +package_root = os.path.abspath(os.path.dirname(__file__)) + +name = 'google-cloud-confidentialcomputing' + + +description = "Google Cloud Confidentialcomputing API client library" + +version = None + +with open(os.path.join(package_root, 'google/cloud/confidentialcomputing/gapic_version.py')) as fp: + version_candidates = re.findall(r"(?<=\")\d+.\d+.\d+(?=\")", fp.read()) + assert (len(version_candidates) == 1) + version = version_candidates[0] + +if version[0] == "0": + release_status = "Development Status :: 4 - Beta" +else: + release_status = "Development Status :: 5 - Production/Stable" + +dependencies = [ + "google-api-core[grpc] >= 1.34.1, <3.0.0,!=2.0.*,!=2.1.*,!=2.2.*,!=2.3.*,!=2.4.*,!=2.5.*,!=2.6.*,!=2.7.*,!=2.8.*,!=2.9.*,!=2.10.*", + # Exclude incompatible versions of `google-auth` + # See https://github.com/googleapis/google-cloud-python/issues/12364 + "google-auth >= 2.14.1, <3.0.0,!=2.24.0,!=2.25.0", + "proto-plus >= 1.22.3, <2.0.0", + "proto-plus >= 1.25.0, <2.0.0; python_version >= '3.13'", + "protobuf>=3.20.2,<7.0.0,!=4.21.0,!=4.21.1,!=4.21.2,!=4.21.3,!=4.21.4,!=4.21.5", +] +extras = { +} +url = "https://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-confidentialcomputing" + +package_root = os.path.abspath(os.path.dirname(__file__)) + +readme_filename = os.path.join(package_root, "README.rst") +with io.open(readme_filename, encoding="utf-8") as readme_file: + readme = readme_file.read() + +packages = [ + package + for package in setuptools.find_namespace_packages() + if package.startswith("google") +] + +setuptools.setup( + name=name, + version=version, + description=description, + long_description=readme, + author="Google LLC", + author_email="googleapis-packages@google.com", + license="Apache 2.0", + url=url, + classifiers=[ + release_status, + "Intended Audience :: Developers", + "License :: OSI Approved :: Apache Software License", + "Programming Language :: Python", + "Programming Language :: Python :: 3", + "Programming Language :: Python :: 3.7", + "Programming Language :: Python :: 3.8", + "Programming Language :: Python :: 3.9", + "Programming Language :: Python :: 3.10", + "Programming Language :: Python :: 3.11", + "Programming Language :: Python :: 3.12", + "Programming Language :: Python :: 3.13", + "Operating System :: OS Independent", + "Topic :: Internet", + ], + platforms="Posix; MacOS X; Windows", + packages=packages, + python_requires=">=3.7", + install_requires=dependencies, + extras_require=extras, + include_package_data=True, + zip_safe=False, +) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.10.txt b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.10.txt new file mode 100644 index 000000000000..ed7f9aed2559 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.10.txt @@ -0,0 +1,6 @@ +# -*- coding: utf-8 -*- +# This constraints file is required for unit tests. +# List all library dependencies and extras in this file. +google-api-core +proto-plus +protobuf diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.11.txt b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.11.txt new file mode 100644 index 000000000000..ed7f9aed2559 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.11.txt @@ -0,0 +1,6 @@ +# -*- coding: utf-8 -*- +# This constraints file is required for unit tests. +# List all library dependencies and extras in this file. +google-api-core +proto-plus +protobuf diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.12.txt b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.12.txt new file mode 100644 index 000000000000..ed7f9aed2559 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.12.txt @@ -0,0 +1,6 @@ +# -*- coding: utf-8 -*- +# This constraints file is required for unit tests. +# List all library dependencies and extras in this file. +google-api-core +proto-plus +protobuf diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.13.txt b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.13.txt new file mode 100644 index 000000000000..c20a77817caa --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.13.txt @@ -0,0 +1,11 @@ +# We use the constraints file for the latest Python version +# (currently this file) to check that the latest +# major versions of dependencies are supported in setup.py. +# List all library dependencies and extras in this file. +# Require the latest major version be installed for each dependency. +# e.g., if setup.py has "google-cloud-foo >= 1.14.0, < 2.0.0", +# Then this file should have google-cloud-foo>=1 +google-api-core>=2 +google-auth>=2 +proto-plus>=1 +protobuf>=6 diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.7.txt b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.7.txt new file mode 100644 index 000000000000..a77f12bc13e4 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.7.txt @@ -0,0 +1,10 @@ +# This constraints file is used to check that lower bounds +# are correct in setup.py +# List all library dependencies and extras in this file. +# Pin the version to the lower bound. +# e.g., if setup.py has "google-cloud-foo >= 1.14.0, < 2.0.0", +# Then this file should have google-cloud-foo==1.14.0 +google-api-core==1.34.1 +google-auth==2.14.1 +proto-plus==1.22.3 +protobuf==3.20.2 diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.8.txt b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.8.txt new file mode 100644 index 000000000000..ed7f9aed2559 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.8.txt @@ -0,0 +1,6 @@ +# -*- coding: utf-8 -*- +# This constraints file is required for unit tests. +# List all library dependencies and extras in this file. +google-api-core +proto-plus +protobuf diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.9.txt b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.9.txt new file mode 100644 index 000000000000..ed7f9aed2559 --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.9.txt @@ -0,0 +1,6 @@ +# -*- coding: utf-8 -*- +# This constraints file is required for unit tests. +# List all library dependencies and extras in this file. +google-api-core +proto-plus +protobuf diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/__init__.py new file mode 100644 index 000000000000..191773d5572d --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/__init__.py @@ -0,0 +1,16 @@ + +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/__init__.py new file mode 100644 index 000000000000..191773d5572d --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/__init__.py @@ -0,0 +1,16 @@ + +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/__init__.py new file mode 100644 index 000000000000..191773d5572d --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/__init__.py @@ -0,0 +1,16 @@ + +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/confidentialcomputing_v1/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/confidentialcomputing_v1/__init__.py new file mode 100644 index 000000000000..191773d5572d --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/confidentialcomputing_v1/__init__.py @@ -0,0 +1,16 @@ + +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/confidentialcomputing_v1/test_confidential_computing.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/confidentialcomputing_v1/test_confidential_computing.py new file mode 100644 index 000000000000..261b185b4d1b --- /dev/null +++ b/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/confidentialcomputing_v1/test_confidential_computing.py @@ -0,0 +1,4165 @@ +# -*- coding: utf-8 -*- +# Copyright 2025 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +import os +# try/except added for compatibility with python < 3.8 +try: + from unittest import mock + from unittest.mock import AsyncMock # pragma: NO COVER +except ImportError: # pragma: NO COVER + import mock + +import grpc +from grpc.experimental import aio +from collections.abc import Iterable, AsyncIterable +from google.protobuf import json_format +import json +import math +import pytest +from google.api_core import api_core_version +from proto.marshal.rules.dates import DurationRule, TimestampRule +from proto.marshal.rules import wrappers +from requests import Response +from requests import Request, PreparedRequest +from requests.sessions import Session +from google.protobuf import json_format + +try: + from google.auth.aio import credentials as ga_credentials_async + HAS_GOOGLE_AUTH_AIO = True +except ImportError: # pragma: NO COVER + HAS_GOOGLE_AUTH_AIO = False + +from google.api_core import client_options +from google.api_core import exceptions as core_exceptions +from google.api_core import gapic_v1 +from google.api_core import grpc_helpers +from google.api_core import grpc_helpers_async +from google.api_core import path_template +from google.api_core import retry as retries +from google.auth import credentials as ga_credentials +from google.auth.exceptions import MutualTLSChannelError +from google.cloud.confidentialcomputing_v1.services.confidential_computing import ConfidentialComputingAsyncClient +from google.cloud.confidentialcomputing_v1.services.confidential_computing import ConfidentialComputingClient +from google.cloud.confidentialcomputing_v1.services.confidential_computing import transports +from google.cloud.confidentialcomputing_v1.types import service +from google.cloud.location import locations_pb2 +from google.oauth2 import service_account +from google.protobuf import timestamp_pb2 # type: ignore +from google.rpc import status_pb2 # type: ignore +import google.auth + + + +CRED_INFO_JSON = { + "credential_source": "/path/to/file", + "credential_type": "service account credentials", + "principal": "service-account@example.com", +} +CRED_INFO_STRING = json.dumps(CRED_INFO_JSON) + + +async def mock_async_gen(data, chunk_size=1): + for i in range(0, len(data)): # pragma: NO COVER + chunk = data[i : i + chunk_size] + yield chunk.encode("utf-8") + +def client_cert_source_callback(): + return b"cert bytes", b"key bytes" + +# TODO: use async auth anon credentials by default once the minimum version of google-auth is upgraded. +# See related issue: https://github.com/googleapis/gapic-generator-python/issues/2107. +def async_anonymous_credentials(): + if HAS_GOOGLE_AUTH_AIO: + return ga_credentials_async.AnonymousCredentials() + return ga_credentials.AnonymousCredentials() + +# If default endpoint is localhost, then default mtls endpoint will be the same. +# This method modifies the default endpoint so the client can produce a different +# mtls endpoint for endpoint testing purposes. +def modify_default_endpoint(client): + return "foo.googleapis.com" if ("localhost" in client.DEFAULT_ENDPOINT) else client.DEFAULT_ENDPOINT + +# If default endpoint template is localhost, then default mtls endpoint will be the same. +# This method modifies the default endpoint template so the client can produce a different +# mtls endpoint for endpoint testing purposes. +def modify_default_endpoint_template(client): + return "test.{UNIVERSE_DOMAIN}" if ("localhost" in client._DEFAULT_ENDPOINT_TEMPLATE) else client._DEFAULT_ENDPOINT_TEMPLATE + + +def test__get_default_mtls_endpoint(): + api_endpoint = "example.googleapis.com" + api_mtls_endpoint = "example.mtls.googleapis.com" + sandbox_endpoint = "example.sandbox.googleapis.com" + sandbox_mtls_endpoint = "example.mtls.sandbox.googleapis.com" + non_googleapi = "api.example.com" + + assert ConfidentialComputingClient._get_default_mtls_endpoint(None) is None + assert ConfidentialComputingClient._get_default_mtls_endpoint(api_endpoint) == api_mtls_endpoint + assert ConfidentialComputingClient._get_default_mtls_endpoint(api_mtls_endpoint) == api_mtls_endpoint + assert ConfidentialComputingClient._get_default_mtls_endpoint(sandbox_endpoint) == sandbox_mtls_endpoint + assert ConfidentialComputingClient._get_default_mtls_endpoint(sandbox_mtls_endpoint) == sandbox_mtls_endpoint + assert ConfidentialComputingClient._get_default_mtls_endpoint(non_googleapi) == non_googleapi + +def test__read_environment_variables(): + assert ConfidentialComputingClient._read_environment_variables() == (False, "auto", None) + + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "true"}): + assert ConfidentialComputingClient._read_environment_variables() == (True, "auto", None) + + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "false"}): + assert ConfidentialComputingClient._read_environment_variables() == (False, "auto", None) + + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "Unsupported"}): + with pytest.raises(ValueError) as excinfo: + ConfidentialComputingClient._read_environment_variables() + assert str(excinfo.value) == "Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`" + + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "never"}): + assert ConfidentialComputingClient._read_environment_variables() == (False, "never", None) + + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "always"}): + assert ConfidentialComputingClient._read_environment_variables() == (False, "always", None) + + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "auto"}): + assert ConfidentialComputingClient._read_environment_variables() == (False, "auto", None) + + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "Unsupported"}): + with pytest.raises(MutualTLSChannelError) as excinfo: + ConfidentialComputingClient._read_environment_variables() + assert str(excinfo.value) == "Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`" + + with mock.patch.dict(os.environ, {"GOOGLE_CLOUD_UNIVERSE_DOMAIN": "foo.com"}): + assert ConfidentialComputingClient._read_environment_variables() == (False, "auto", "foo.com") + +def test__get_client_cert_source(): + mock_provided_cert_source = mock.Mock() + mock_default_cert_source = mock.Mock() + + assert ConfidentialComputingClient._get_client_cert_source(None, False) is None + assert ConfidentialComputingClient._get_client_cert_source(mock_provided_cert_source, False) is None + assert ConfidentialComputingClient._get_client_cert_source(mock_provided_cert_source, True) == mock_provided_cert_source + + with mock.patch('google.auth.transport.mtls.has_default_client_cert_source', return_value=True): + with mock.patch('google.auth.transport.mtls.default_client_cert_source', return_value=mock_default_cert_source): + assert ConfidentialComputingClient._get_client_cert_source(None, True) is mock_default_cert_source + assert ConfidentialComputingClient._get_client_cert_source(mock_provided_cert_source, "true") is mock_provided_cert_source + +@mock.patch.object(ConfidentialComputingClient, "_DEFAULT_ENDPOINT_TEMPLATE", modify_default_endpoint_template(ConfidentialComputingClient)) +@mock.patch.object(ConfidentialComputingAsyncClient, "_DEFAULT_ENDPOINT_TEMPLATE", modify_default_endpoint_template(ConfidentialComputingAsyncClient)) +def test__get_api_endpoint(): + api_override = "foo.com" + mock_client_cert_source = mock.Mock() + default_universe = ConfidentialComputingClient._DEFAULT_UNIVERSE + default_endpoint = ConfidentialComputingClient._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=default_universe) + mock_universe = "bar.com" + mock_endpoint = ConfidentialComputingClient._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=mock_universe) + + assert ConfidentialComputingClient._get_api_endpoint(api_override, mock_client_cert_source, default_universe, "always") == api_override + assert ConfidentialComputingClient._get_api_endpoint(None, mock_client_cert_source, default_universe, "auto") == ConfidentialComputingClient.DEFAULT_MTLS_ENDPOINT + assert ConfidentialComputingClient._get_api_endpoint(None, None, default_universe, "auto") == default_endpoint + assert ConfidentialComputingClient._get_api_endpoint(None, None, default_universe, "always") == ConfidentialComputingClient.DEFAULT_MTLS_ENDPOINT + assert ConfidentialComputingClient._get_api_endpoint(None, mock_client_cert_source, default_universe, "always") == ConfidentialComputingClient.DEFAULT_MTLS_ENDPOINT + assert ConfidentialComputingClient._get_api_endpoint(None, None, mock_universe, "never") == mock_endpoint + assert ConfidentialComputingClient._get_api_endpoint(None, None, default_universe, "never") == default_endpoint + + with pytest.raises(MutualTLSChannelError) as excinfo: + ConfidentialComputingClient._get_api_endpoint(None, mock_client_cert_source, mock_universe, "auto") + assert str(excinfo.value) == "mTLS is not supported in any universe other than googleapis.com." + + +def test__get_universe_domain(): + client_universe_domain = "foo.com" + universe_domain_env = "bar.com" + + assert ConfidentialComputingClient._get_universe_domain(client_universe_domain, universe_domain_env) == client_universe_domain + assert ConfidentialComputingClient._get_universe_domain(None, universe_domain_env) == universe_domain_env + assert ConfidentialComputingClient._get_universe_domain(None, None) == ConfidentialComputingClient._DEFAULT_UNIVERSE + + with pytest.raises(ValueError) as excinfo: + ConfidentialComputingClient._get_universe_domain("", None) + assert str(excinfo.value) == "Universe Domain cannot be an empty string." + +@pytest.mark.parametrize("error_code,cred_info_json,show_cred_info", [ + (401, CRED_INFO_JSON, True), + (403, CRED_INFO_JSON, True), + (404, CRED_INFO_JSON, True), + (500, CRED_INFO_JSON, False), + (401, None, False), + (403, None, False), + (404, None, False), + (500, None, False) +]) +def test__add_cred_info_for_auth_errors(error_code, cred_info_json, show_cred_info): + cred = mock.Mock(["get_cred_info"]) + cred.get_cred_info = mock.Mock(return_value=cred_info_json) + client = ConfidentialComputingClient(credentials=cred) + client._transport._credentials = cred + + error = core_exceptions.GoogleAPICallError("message", details=["foo"]) + error.code = error_code + + client._add_cred_info_for_auth_errors(error) + if show_cred_info: + assert error.details == ["foo", CRED_INFO_STRING] + else: + assert error.details == ["foo"] + +@pytest.mark.parametrize("error_code", [401,403,404,500]) +def test__add_cred_info_for_auth_errors_no_get_cred_info(error_code): + cred = mock.Mock([]) + assert not hasattr(cred, "get_cred_info") + client = ConfidentialComputingClient(credentials=cred) + client._transport._credentials = cred + + error = core_exceptions.GoogleAPICallError("message", details=[]) + error.code = error_code + + client._add_cred_info_for_auth_errors(error) + assert error.details == [] + +@pytest.mark.parametrize("client_class,transport_name", [ + (ConfidentialComputingClient, "grpc"), + (ConfidentialComputingAsyncClient, "grpc_asyncio"), + (ConfidentialComputingClient, "rest"), +]) +def test_confidential_computing_client_from_service_account_info(client_class, transport_name): + creds = ga_credentials.AnonymousCredentials() + with mock.patch.object(service_account.Credentials, 'from_service_account_info') as factory: + factory.return_value = creds + info = {"valid": True} + client = client_class.from_service_account_info(info, transport=transport_name) + assert client.transport._credentials == creds + assert isinstance(client, client_class) + + assert client.transport._host == ( + 'confidentialcomputing.googleapis.com:443' + if transport_name in ['grpc', 'grpc_asyncio'] + else + 'https://confidentialcomputing.googleapis.com' + ) + + +@pytest.mark.parametrize("transport_class,transport_name", [ + (transports.ConfidentialComputingGrpcTransport, "grpc"), + (transports.ConfidentialComputingGrpcAsyncIOTransport, "grpc_asyncio"), + (transports.ConfidentialComputingRestTransport, "rest"), +]) +def test_confidential_computing_client_service_account_always_use_jwt(transport_class, transport_name): + with mock.patch.object(service_account.Credentials, 'with_always_use_jwt_access', create=True) as use_jwt: + creds = service_account.Credentials(None, None, None) + transport = transport_class(credentials=creds, always_use_jwt_access=True) + use_jwt.assert_called_once_with(True) + + with mock.patch.object(service_account.Credentials, 'with_always_use_jwt_access', create=True) as use_jwt: + creds = service_account.Credentials(None, None, None) + transport = transport_class(credentials=creds, always_use_jwt_access=False) + use_jwt.assert_not_called() + + +@pytest.mark.parametrize("client_class,transport_name", [ + (ConfidentialComputingClient, "grpc"), + (ConfidentialComputingAsyncClient, "grpc_asyncio"), + (ConfidentialComputingClient, "rest"), +]) +def test_confidential_computing_client_from_service_account_file(client_class, transport_name): + creds = ga_credentials.AnonymousCredentials() + with mock.patch.object(service_account.Credentials, 'from_service_account_file') as factory: + factory.return_value = creds + client = client_class.from_service_account_file("dummy/file/path.json", transport=transport_name) + assert client.transport._credentials == creds + assert isinstance(client, client_class) + + client = client_class.from_service_account_json("dummy/file/path.json", transport=transport_name) + assert client.transport._credentials == creds + assert isinstance(client, client_class) + + assert client.transport._host == ( + 'confidentialcomputing.googleapis.com:443' + if transport_name in ['grpc', 'grpc_asyncio'] + else + 'https://confidentialcomputing.googleapis.com' + ) + + +def test_confidential_computing_client_get_transport_class(): + transport = ConfidentialComputingClient.get_transport_class() + available_transports = [ + transports.ConfidentialComputingGrpcTransport, + transports.ConfidentialComputingRestTransport, + ] + assert transport in available_transports + + transport = ConfidentialComputingClient.get_transport_class("grpc") + assert transport == transports.ConfidentialComputingGrpcTransport + + +@pytest.mark.parametrize("client_class,transport_class,transport_name", [ + (ConfidentialComputingClient, transports.ConfidentialComputingGrpcTransport, "grpc"), + (ConfidentialComputingAsyncClient, transports.ConfidentialComputingGrpcAsyncIOTransport, "grpc_asyncio"), + (ConfidentialComputingClient, transports.ConfidentialComputingRestTransport, "rest"), +]) +@mock.patch.object(ConfidentialComputingClient, "_DEFAULT_ENDPOINT_TEMPLATE", modify_default_endpoint_template(ConfidentialComputingClient)) +@mock.patch.object(ConfidentialComputingAsyncClient, "_DEFAULT_ENDPOINT_TEMPLATE", modify_default_endpoint_template(ConfidentialComputingAsyncClient)) +def test_confidential_computing_client_client_options(client_class, transport_class, transport_name): + # Check that if channel is provided we won't create a new one. + with mock.patch.object(ConfidentialComputingClient, 'get_transport_class') as gtc: + transport = transport_class( + credentials=ga_credentials.AnonymousCredentials() + ) + client = client_class(transport=transport) + gtc.assert_not_called() + + # Check that if channel is provided via str we will create a new one. + with mock.patch.object(ConfidentialComputingClient, 'get_transport_class') as gtc: + client = client_class(transport=transport_name) + gtc.assert_called() + + # Check the case api_endpoint is provided. + options = client_options.ClientOptions(api_endpoint="squid.clam.whelk") + with mock.patch.object(transport_class, '__init__') as patched: + patched.return_value = None + client = client_class(transport=transport_name, client_options=options) + patched.assert_called_once_with( + credentials=None, + credentials_file=None, + host="squid.clam.whelk", + scopes=None, + client_cert_source_for_mtls=None, + quota_project_id=None, + client_info=transports.base.DEFAULT_CLIENT_INFO, + always_use_jwt_access=True, + api_audience=None, + ) + + # Check the case api_endpoint is not provided and GOOGLE_API_USE_MTLS_ENDPOINT is + # "never". + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "never"}): + with mock.patch.object(transport_class, '__init__') as patched: + patched.return_value = None + client = client_class(transport=transport_name) + patched.assert_called_once_with( + credentials=None, + credentials_file=None, + host=client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE), + scopes=None, + client_cert_source_for_mtls=None, + quota_project_id=None, + client_info=transports.base.DEFAULT_CLIENT_INFO, + always_use_jwt_access=True, + api_audience=None, + ) + + # Check the case api_endpoint is not provided and GOOGLE_API_USE_MTLS_ENDPOINT is + # "always". + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "always"}): + with mock.patch.object(transport_class, '__init__') as patched: + patched.return_value = None + client = client_class(transport=transport_name) + patched.assert_called_once_with( + credentials=None, + credentials_file=None, + host=client.DEFAULT_MTLS_ENDPOINT, + scopes=None, + client_cert_source_for_mtls=None, + quota_project_id=None, + client_info=transports.base.DEFAULT_CLIENT_INFO, + always_use_jwt_access=True, + api_audience=None, + ) + + # Check the case api_endpoint is not provided and GOOGLE_API_USE_MTLS_ENDPOINT has + # unsupported value. + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "Unsupported"}): + with pytest.raises(MutualTLSChannelError) as excinfo: + client = client_class(transport=transport_name) + assert str(excinfo.value) == "Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`" + + # Check the case GOOGLE_API_USE_CLIENT_CERTIFICATE has unsupported value. + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "Unsupported"}): + with pytest.raises(ValueError) as excinfo: + client = client_class(transport=transport_name) + assert str(excinfo.value) == "Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`" + + # Check the case quota_project_id is provided + options = client_options.ClientOptions(quota_project_id="octopus") + with mock.patch.object(transport_class, '__init__') as patched: + patched.return_value = None + client = client_class(client_options=options, transport=transport_name) + patched.assert_called_once_with( + credentials=None, + credentials_file=None, + host=client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE), + scopes=None, + client_cert_source_for_mtls=None, + quota_project_id="octopus", + client_info=transports.base.DEFAULT_CLIENT_INFO, + always_use_jwt_access=True, + api_audience=None, + ) + # Check the case api_endpoint is provided + options = client_options.ClientOptions(api_audience="https://language.googleapis.com") + with mock.patch.object(transport_class, '__init__') as patched: + patched.return_value = None + client = client_class(client_options=options, transport=transport_name) + patched.assert_called_once_with( + credentials=None, + credentials_file=None, + host=client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE), + scopes=None, + client_cert_source_for_mtls=None, + quota_project_id=None, + client_info=transports.base.DEFAULT_CLIENT_INFO, + always_use_jwt_access=True, + api_audience="https://language.googleapis.com" + ) + +@pytest.mark.parametrize("client_class,transport_class,transport_name,use_client_cert_env", [ + (ConfidentialComputingClient, transports.ConfidentialComputingGrpcTransport, "grpc", "true"), + (ConfidentialComputingAsyncClient, transports.ConfidentialComputingGrpcAsyncIOTransport, "grpc_asyncio", "true"), + (ConfidentialComputingClient, transports.ConfidentialComputingGrpcTransport, "grpc", "false"), + (ConfidentialComputingAsyncClient, transports.ConfidentialComputingGrpcAsyncIOTransport, "grpc_asyncio", "false"), + (ConfidentialComputingClient, transports.ConfidentialComputingRestTransport, "rest", "true"), + (ConfidentialComputingClient, transports.ConfidentialComputingRestTransport, "rest", "false"), +]) +@mock.patch.object(ConfidentialComputingClient, "_DEFAULT_ENDPOINT_TEMPLATE", modify_default_endpoint_template(ConfidentialComputingClient)) +@mock.patch.object(ConfidentialComputingAsyncClient, "_DEFAULT_ENDPOINT_TEMPLATE", modify_default_endpoint_template(ConfidentialComputingAsyncClient)) +@mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "auto"}) +def test_confidential_computing_client_mtls_env_auto(client_class, transport_class, transport_name, use_client_cert_env): + # This tests the endpoint autoswitch behavior. Endpoint is autoswitched to the default + # mtls endpoint, if GOOGLE_API_USE_CLIENT_CERTIFICATE is "true" and client cert exists. + + # Check the case client_cert_source is provided. Whether client cert is used depends on + # GOOGLE_API_USE_CLIENT_CERTIFICATE value. + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": use_client_cert_env}): + options = client_options.ClientOptions(client_cert_source=client_cert_source_callback) + with mock.patch.object(transport_class, '__init__') as patched: + patched.return_value = None + client = client_class(client_options=options, transport=transport_name) + + if use_client_cert_env == "false": + expected_client_cert_source = None + expected_host = client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE) + else: + expected_client_cert_source = client_cert_source_callback + expected_host = client.DEFAULT_MTLS_ENDPOINT + + patched.assert_called_once_with( + credentials=None, + credentials_file=None, + host=expected_host, + scopes=None, + client_cert_source_for_mtls=expected_client_cert_source, + quota_project_id=None, + client_info=transports.base.DEFAULT_CLIENT_INFO, + always_use_jwt_access=True, + api_audience=None, + ) + + # Check the case ADC client cert is provided. Whether client cert is used depends on + # GOOGLE_API_USE_CLIENT_CERTIFICATE value. + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": use_client_cert_env}): + with mock.patch.object(transport_class, '__init__') as patched: + with mock.patch('google.auth.transport.mtls.has_default_client_cert_source', return_value=True): + with mock.patch('google.auth.transport.mtls.default_client_cert_source', return_value=client_cert_source_callback): + if use_client_cert_env == "false": + expected_host = client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE) + expected_client_cert_source = None + else: + expected_host = client.DEFAULT_MTLS_ENDPOINT + expected_client_cert_source = client_cert_source_callback + + patched.return_value = None + client = client_class(transport=transport_name) + patched.assert_called_once_with( + credentials=None, + credentials_file=None, + host=expected_host, + scopes=None, + client_cert_source_for_mtls=expected_client_cert_source, + quota_project_id=None, + client_info=transports.base.DEFAULT_CLIENT_INFO, + always_use_jwt_access=True, + api_audience=None, + ) + + # Check the case client_cert_source and ADC client cert are not provided. + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": use_client_cert_env}): + with mock.patch.object(transport_class, '__init__') as patched: + with mock.patch("google.auth.transport.mtls.has_default_client_cert_source", return_value=False): + patched.return_value = None + client = client_class(transport=transport_name) + patched.assert_called_once_with( + credentials=None, + credentials_file=None, + host=client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE), + scopes=None, + client_cert_source_for_mtls=None, + quota_project_id=None, + client_info=transports.base.DEFAULT_CLIENT_INFO, + always_use_jwt_access=True, + api_audience=None, + ) + + +@pytest.mark.parametrize("client_class", [ + ConfidentialComputingClient, ConfidentialComputingAsyncClient +]) +@mock.patch.object(ConfidentialComputingClient, "DEFAULT_ENDPOINT", modify_default_endpoint(ConfidentialComputingClient)) +@mock.patch.object(ConfidentialComputingAsyncClient, "DEFAULT_ENDPOINT", modify_default_endpoint(ConfidentialComputingAsyncClient)) +def test_confidential_computing_client_get_mtls_endpoint_and_cert_source(client_class): + mock_client_cert_source = mock.Mock() + + # Test the case GOOGLE_API_USE_CLIENT_CERTIFICATE is "true". + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "true"}): + mock_api_endpoint = "foo" + options = client_options.ClientOptions(client_cert_source=mock_client_cert_source, api_endpoint=mock_api_endpoint) + api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source(options) + assert api_endpoint == mock_api_endpoint + assert cert_source == mock_client_cert_source + + # Test the case GOOGLE_API_USE_CLIENT_CERTIFICATE is "false". + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "false"}): + mock_client_cert_source = mock.Mock() + mock_api_endpoint = "foo" + options = client_options.ClientOptions(client_cert_source=mock_client_cert_source, api_endpoint=mock_api_endpoint) + api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source(options) + assert api_endpoint == mock_api_endpoint + assert cert_source is None + + # Test the case GOOGLE_API_USE_MTLS_ENDPOINT is "never". + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "never"}): + api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source() + assert api_endpoint == client_class.DEFAULT_ENDPOINT + assert cert_source is None + + # Test the case GOOGLE_API_USE_MTLS_ENDPOINT is "always". + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "always"}): + api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source() + assert api_endpoint == client_class.DEFAULT_MTLS_ENDPOINT + assert cert_source is None + + # Test the case GOOGLE_API_USE_MTLS_ENDPOINT is "auto" and default cert doesn't exist. + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "true"}): + with mock.patch('google.auth.transport.mtls.has_default_client_cert_source', return_value=False): + api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source() + assert api_endpoint == client_class.DEFAULT_ENDPOINT + assert cert_source is None + + # Test the case GOOGLE_API_USE_MTLS_ENDPOINT is "auto" and default cert exists. + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "true"}): + with mock.patch('google.auth.transport.mtls.has_default_client_cert_source', return_value=True): + with mock.patch('google.auth.transport.mtls.default_client_cert_source', return_value=mock_client_cert_source): + api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source() + assert api_endpoint == client_class.DEFAULT_MTLS_ENDPOINT + assert cert_source == mock_client_cert_source + + # Check the case api_endpoint is not provided and GOOGLE_API_USE_MTLS_ENDPOINT has + # unsupported value. + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "Unsupported"}): + with pytest.raises(MutualTLSChannelError) as excinfo: + client_class.get_mtls_endpoint_and_cert_source() + + assert str(excinfo.value) == "Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`" + + # Check the case GOOGLE_API_USE_CLIENT_CERTIFICATE has unsupported value. + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "Unsupported"}): + with pytest.raises(ValueError) as excinfo: + client_class.get_mtls_endpoint_and_cert_source() + + assert str(excinfo.value) == "Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`" + +@pytest.mark.parametrize("client_class", [ + ConfidentialComputingClient, ConfidentialComputingAsyncClient +]) +@mock.patch.object(ConfidentialComputingClient, "_DEFAULT_ENDPOINT_TEMPLATE", modify_default_endpoint_template(ConfidentialComputingClient)) +@mock.patch.object(ConfidentialComputingAsyncClient, "_DEFAULT_ENDPOINT_TEMPLATE", modify_default_endpoint_template(ConfidentialComputingAsyncClient)) +def test_confidential_computing_client_client_api_endpoint(client_class): + mock_client_cert_source = client_cert_source_callback + api_override = "foo.com" + default_universe = ConfidentialComputingClient._DEFAULT_UNIVERSE + default_endpoint = ConfidentialComputingClient._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=default_universe) + mock_universe = "bar.com" + mock_endpoint = ConfidentialComputingClient._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=mock_universe) + + # If ClientOptions.api_endpoint is set and GOOGLE_API_USE_CLIENT_CERTIFICATE="true", + # use ClientOptions.api_endpoint as the api endpoint regardless. + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "true"}): + with mock.patch("google.auth.transport.requests.AuthorizedSession.configure_mtls_channel"): + options = client_options.ClientOptions(client_cert_source=mock_client_cert_source, api_endpoint=api_override) + client = client_class(client_options=options, credentials=ga_credentials.AnonymousCredentials()) + assert client.api_endpoint == api_override + + # If ClientOptions.api_endpoint is not set and GOOGLE_API_USE_MTLS_ENDPOINT="never", + # use the _DEFAULT_ENDPOINT_TEMPLATE populated with GDU as the api endpoint. + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "never"}): + client = client_class(credentials=ga_credentials.AnonymousCredentials()) + assert client.api_endpoint == default_endpoint + + # If ClientOptions.api_endpoint is not set and GOOGLE_API_USE_MTLS_ENDPOINT="always", + # use the DEFAULT_MTLS_ENDPOINT as the api endpoint. + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "always"}): + client = client_class(credentials=ga_credentials.AnonymousCredentials()) + assert client.api_endpoint == client_class.DEFAULT_MTLS_ENDPOINT + + # If ClientOptions.api_endpoint is not set, GOOGLE_API_USE_MTLS_ENDPOINT="auto" (default), + # GOOGLE_API_USE_CLIENT_CERTIFICATE="false" (default), default cert source doesn't exist, + # and ClientOptions.universe_domain="bar.com", + # use the _DEFAULT_ENDPOINT_TEMPLATE populated with universe domain as the api endpoint. + options = client_options.ClientOptions() + universe_exists = hasattr(options, "universe_domain") + if universe_exists: + options = client_options.ClientOptions(universe_domain=mock_universe) + client = client_class(client_options=options, credentials=ga_credentials.AnonymousCredentials()) + else: + client = client_class(client_options=options, credentials=ga_credentials.AnonymousCredentials()) + assert client.api_endpoint == (mock_endpoint if universe_exists else default_endpoint) + assert client.universe_domain == (mock_universe if universe_exists else default_universe) + + # If ClientOptions does not have a universe domain attribute and GOOGLE_API_USE_MTLS_ENDPOINT="never", + # use the _DEFAULT_ENDPOINT_TEMPLATE populated with GDU as the api endpoint. + options = client_options.ClientOptions() + if hasattr(options, "universe_domain"): + delattr(options, "universe_domain") + with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "never"}): + client = client_class(client_options=options, credentials=ga_credentials.AnonymousCredentials()) + assert client.api_endpoint == default_endpoint + + +@pytest.mark.parametrize("client_class,transport_class,transport_name", [ + (ConfidentialComputingClient, transports.ConfidentialComputingGrpcTransport, "grpc"), + (ConfidentialComputingAsyncClient, transports.ConfidentialComputingGrpcAsyncIOTransport, "grpc_asyncio"), + (ConfidentialComputingClient, transports.ConfidentialComputingRestTransport, "rest"), +]) +def test_confidential_computing_client_client_options_scopes(client_class, transport_class, transport_name): + # Check the case scopes are provided. + options = client_options.ClientOptions( + scopes=["1", "2"], + ) + with mock.patch.object(transport_class, '__init__') as patched: + patched.return_value = None + client = client_class(client_options=options, transport=transport_name) + patched.assert_called_once_with( + credentials=None, + credentials_file=None, + host=client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE), + scopes=["1", "2"], + client_cert_source_for_mtls=None, + quota_project_id=None, + client_info=transports.base.DEFAULT_CLIENT_INFO, + always_use_jwt_access=True, + api_audience=None, + ) + +@pytest.mark.parametrize("client_class,transport_class,transport_name,grpc_helpers", [ + (ConfidentialComputingClient, transports.ConfidentialComputingGrpcTransport, "grpc", grpc_helpers), + (ConfidentialComputingAsyncClient, transports.ConfidentialComputingGrpcAsyncIOTransport, "grpc_asyncio", grpc_helpers_async), + (ConfidentialComputingClient, transports.ConfidentialComputingRestTransport, "rest", None), +]) +def test_confidential_computing_client_client_options_credentials_file(client_class, transport_class, transport_name, grpc_helpers): + # Check the case credentials file is provided. + options = client_options.ClientOptions( + credentials_file="credentials.json" + ) + + with mock.patch.object(transport_class, '__init__') as patched: + patched.return_value = None + client = client_class(client_options=options, transport=transport_name) + patched.assert_called_once_with( + credentials=None, + credentials_file="credentials.json", + host=client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE), + scopes=None, + client_cert_source_for_mtls=None, + quota_project_id=None, + client_info=transports.base.DEFAULT_CLIENT_INFO, + always_use_jwt_access=True, + api_audience=None, + ) + +def test_confidential_computing_client_client_options_from_dict(): + with mock.patch('google.cloud.confidentialcomputing_v1.services.confidential_computing.transports.ConfidentialComputingGrpcTransport.__init__') as grpc_transport: + grpc_transport.return_value = None + client = ConfidentialComputingClient( + client_options={'api_endpoint': 'squid.clam.whelk'} + ) + grpc_transport.assert_called_once_with( + credentials=None, + credentials_file=None, + host="squid.clam.whelk", + scopes=None, + client_cert_source_for_mtls=None, + quota_project_id=None, + client_info=transports.base.DEFAULT_CLIENT_INFO, + always_use_jwt_access=True, + api_audience=None, + ) + + +@pytest.mark.parametrize("client_class,transport_class,transport_name,grpc_helpers", [ + (ConfidentialComputingClient, transports.ConfidentialComputingGrpcTransport, "grpc", grpc_helpers), + (ConfidentialComputingAsyncClient, transports.ConfidentialComputingGrpcAsyncIOTransport, "grpc_asyncio", grpc_helpers_async), +]) +def test_confidential_computing_client_create_channel_credentials_file(client_class, transport_class, transport_name, grpc_helpers): + # Check the case credentials file is provided. + options = client_options.ClientOptions( + credentials_file="credentials.json" + ) + + with mock.patch.object(transport_class, '__init__') as patched: + patched.return_value = None + client = client_class(client_options=options, transport=transport_name) + patched.assert_called_once_with( + credentials=None, + credentials_file="credentials.json", + host=client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE), + scopes=None, + client_cert_source_for_mtls=None, + quota_project_id=None, + client_info=transports.base.DEFAULT_CLIENT_INFO, + always_use_jwt_access=True, + api_audience=None, + ) + + # test that the credentials from file are saved and used as the credentials. + with mock.patch.object( + google.auth, "load_credentials_from_file", autospec=True + ) as load_creds, mock.patch.object( + google.auth, "default", autospec=True + ) as adc, mock.patch.object( + grpc_helpers, "create_channel" + ) as create_channel: + creds = ga_credentials.AnonymousCredentials() + file_creds = ga_credentials.AnonymousCredentials() + load_creds.return_value = (file_creds, None) + adc.return_value = (creds, None) + client = client_class(client_options=options, transport=transport_name) + create_channel.assert_called_with( + "confidentialcomputing.googleapis.com:443", + credentials=file_creds, + credentials_file=None, + quota_project_id=None, + default_scopes=( + 'https://www.googleapis.com/auth/cloud-platform', +), + scopes=None, + default_host="confidentialcomputing.googleapis.com", + ssl_credentials=None, + options=[ + ("grpc.max_send_message_length", -1), + ("grpc.max_receive_message_length", -1), + ], + ) + + +@pytest.mark.parametrize("request_type", [ + service.CreateChallengeRequest, + dict, +]) +def test_create_challenge(request_type, transport: str = 'grpc'): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport=transport, + ) + + # Everything is optional in proto3 as far as the runtime is concerned, + # and we are mocking out the actual API, so just send an empty request. + request = request_type() + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.create_challenge), + '__call__') as call: + # Designate an appropriate return value for the call. + call.return_value = service.Challenge( + name='name_value', + used=True, + tpm_nonce='tpm_nonce_value', + ) + response = client.create_challenge(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + request = service.CreateChallengeRequest() + assert args[0] == request + + # Establish that the response is the type that we expect. + assert isinstance(response, service.Challenge) + assert response.name == 'name_value' + assert response.used is True + assert response.tpm_nonce == 'tpm_nonce_value' + + +def test_create_challenge_non_empty_request_with_auto_populated_field(): + # This test is a coverage failsafe to make sure that UUID4 fields are + # automatically populated, according to AIP-4235, with non-empty requests. + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport='grpc', + ) + + # Populate all string fields in the request which are not UUID4 + # since we want to check that UUID4 are populated automatically + # if they meet the requirements of AIP 4235. + request = service.CreateChallengeRequest( + parent='parent_value', + ) + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.create_challenge), + '__call__') as call: + call.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. + client.create_challenge(request=request) + call.assert_called() + _, args, _ = call.mock_calls[0] + assert args[0] == service.CreateChallengeRequest( + parent='parent_value', + ) + +def test_create_challenge_use_cached_wrapped_rpc(): + # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, + # instead of constructing them on each call + with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="grpc", + ) + + # Should wrap all calls on client creation + assert wrapper_fn.call_count > 0 + wrapper_fn.reset_mock() + + # Ensure method has been cached + assert client._transport.create_challenge in client._transport._wrapped_methods + + # Replace cached wrapped function with mock + mock_rpc = mock.Mock() + mock_rpc.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. + client._transport._wrapped_methods[client._transport.create_challenge] = mock_rpc + request = {} + client.create_challenge(request) + + # Establish that the underlying gRPC stub method was called. + assert mock_rpc.call_count == 1 + + client.create_challenge(request) + + # Establish that a new wrapper was not created for this call + assert wrapper_fn.call_count == 0 + assert mock_rpc.call_count == 2 + +@pytest.mark.asyncio +async def test_create_challenge_async_use_cached_wrapped_rpc(transport: str = "grpc_asyncio"): + # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, + # instead of constructing them on each call + with mock.patch("google.api_core.gapic_v1.method_async.wrap_method") as wrapper_fn: + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport=transport, + ) + + # Should wrap all calls on client creation + assert wrapper_fn.call_count > 0 + wrapper_fn.reset_mock() + + # Ensure method has been cached + assert client._client._transport.create_challenge in client._client._transport._wrapped_methods + + # Replace cached wrapped function with mock + mock_rpc = mock.AsyncMock() + mock_rpc.return_value = mock.Mock() + client._client._transport._wrapped_methods[client._client._transport.create_challenge] = mock_rpc + + request = {} + await client.create_challenge(request) + + # Establish that the underlying gRPC stub method was called. + assert mock_rpc.call_count == 1 + + await client.create_challenge(request) + + # Establish that a new wrapper was not created for this call + assert wrapper_fn.call_count == 0 + assert mock_rpc.call_count == 2 + +@pytest.mark.asyncio +async def test_create_challenge_async(transport: str = 'grpc_asyncio', request_type=service.CreateChallengeRequest): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport=transport, + ) + + # Everything is optional in proto3 as far as the runtime is concerned, + # and we are mocking out the actual API, so just send an empty request. + request = request_type() + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.create_challenge), + '__call__') as call: + # Designate an appropriate return value for the call. + call.return_value =grpc_helpers_async.FakeUnaryUnaryCall(service.Challenge( + name='name_value', + used=True, + tpm_nonce='tpm_nonce_value', + )) + response = await client.create_challenge(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) + _, args, _ = call.mock_calls[0] + request = service.CreateChallengeRequest() + assert args[0] == request + + # Establish that the response is the type that we expect. + assert isinstance(response, service.Challenge) + assert response.name == 'name_value' + assert response.used is True + assert response.tpm_nonce == 'tpm_nonce_value' + + +@pytest.mark.asyncio +async def test_create_challenge_async_from_dict(): + await test_create_challenge_async(request_type=dict) + +def test_create_challenge_field_headers(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + ) + + # Any value that is part of the HTTP/1.1 URI should be sent as + # a field header. Set these to a non-empty value. + request = service.CreateChallengeRequest() + + request.parent = 'parent_value' + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.create_challenge), + '__call__') as call: + call.return_value = service.Challenge() + client.create_challenge(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the field header was sent. + _, _, kw = call.mock_calls[0] + assert ( + 'x-goog-request-params', + 'parent=parent_value', + ) in kw['metadata'] + + +@pytest.mark.asyncio +async def test_create_challenge_field_headers_async(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + ) + + # Any value that is part of the HTTP/1.1 URI should be sent as + # a field header. Set these to a non-empty value. + request = service.CreateChallengeRequest() + + request.parent = 'parent_value' + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.create_challenge), + '__call__') as call: + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.Challenge()) + await client.create_challenge(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the field header was sent. + _, _, kw = call.mock_calls[0] + assert ( + 'x-goog-request-params', + 'parent=parent_value', + ) in kw['metadata'] + + +def test_create_challenge_flattened(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + ) + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.create_challenge), + '__call__') as call: + # Designate an appropriate return value for the call. + call.return_value = service.Challenge() + # Call the method with a truthy value for each flattened field, + # using the keyword arguments to the method. + client.create_challenge( + parent='parent_value', + challenge=service.Challenge(name='name_value'), + ) + + # Establish that the underlying call was made with the expected + # request object values. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + arg = args[0].parent + mock_val = 'parent_value' + assert arg == mock_val + arg = args[0].challenge + mock_val = service.Challenge(name='name_value') + assert arg == mock_val + + +def test_create_challenge_flattened_error(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + ) + + # Attempting to call a method with both a request object and flattened + # fields is an error. + with pytest.raises(ValueError): + client.create_challenge( + service.CreateChallengeRequest(), + parent='parent_value', + challenge=service.Challenge(name='name_value'), + ) + +@pytest.mark.asyncio +async def test_create_challenge_flattened_async(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + ) + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.create_challenge), + '__call__') as call: + # Designate an appropriate return value for the call. + call.return_value = service.Challenge() + + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.Challenge()) + # Call the method with a truthy value for each flattened field, + # using the keyword arguments to the method. + response = await client.create_challenge( + parent='parent_value', + challenge=service.Challenge(name='name_value'), + ) + + # Establish that the underlying call was made with the expected + # request object values. + assert len(call.mock_calls) + _, args, _ = call.mock_calls[0] + arg = args[0].parent + mock_val = 'parent_value' + assert arg == mock_val + arg = args[0].challenge + mock_val = service.Challenge(name='name_value') + assert arg == mock_val + +@pytest.mark.asyncio +async def test_create_challenge_flattened_error_async(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + ) + + # Attempting to call a method with both a request object and flattened + # fields is an error. + with pytest.raises(ValueError): + await client.create_challenge( + service.CreateChallengeRequest(), + parent='parent_value', + challenge=service.Challenge(name='name_value'), + ) + + +@pytest.mark.parametrize("request_type", [ + service.VerifyAttestationRequest, + dict, +]) +def test_verify_attestation(request_type, transport: str = 'grpc'): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport=transport, + ) + + # Everything is optional in proto3 as far as the runtime is concerned, + # and we are mocking out the actual API, so just send an empty request. + request = request_type() + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_attestation), + '__call__') as call: + # Designate an appropriate return value for the call. + call.return_value = service.VerifyAttestationResponse( + oidc_claims_token='oidc_claims_token_value', + ) + response = client.verify_attestation(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + request = service.VerifyAttestationRequest() + assert args[0] == request + + # Establish that the response is the type that we expect. + assert isinstance(response, service.VerifyAttestationResponse) + assert response.oidc_claims_token == 'oidc_claims_token_value' + + +def test_verify_attestation_non_empty_request_with_auto_populated_field(): + # This test is a coverage failsafe to make sure that UUID4 fields are + # automatically populated, according to AIP-4235, with non-empty requests. + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport='grpc', + ) + + # Populate all string fields in the request which are not UUID4 + # since we want to check that UUID4 are populated automatically + # if they meet the requirements of AIP 4235. + request = service.VerifyAttestationRequest( + challenge='challenge_value', + attester='attester_value', + ) + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_attestation), + '__call__') as call: + call.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. + client.verify_attestation(request=request) + call.assert_called() + _, args, _ = call.mock_calls[0] + assert args[0] == service.VerifyAttestationRequest( + challenge='challenge_value', + attester='attester_value', + ) + +def test_verify_attestation_use_cached_wrapped_rpc(): + # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, + # instead of constructing them on each call + with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="grpc", + ) + + # Should wrap all calls on client creation + assert wrapper_fn.call_count > 0 + wrapper_fn.reset_mock() + + # Ensure method has been cached + assert client._transport.verify_attestation in client._transport._wrapped_methods + + # Replace cached wrapped function with mock + mock_rpc = mock.Mock() + mock_rpc.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. + client._transport._wrapped_methods[client._transport.verify_attestation] = mock_rpc + request = {} + client.verify_attestation(request) + + # Establish that the underlying gRPC stub method was called. + assert mock_rpc.call_count == 1 + + client.verify_attestation(request) + + # Establish that a new wrapper was not created for this call + assert wrapper_fn.call_count == 0 + assert mock_rpc.call_count == 2 + +@pytest.mark.asyncio +async def test_verify_attestation_async_use_cached_wrapped_rpc(transport: str = "grpc_asyncio"): + # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, + # instead of constructing them on each call + with mock.patch("google.api_core.gapic_v1.method_async.wrap_method") as wrapper_fn: + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport=transport, + ) + + # Should wrap all calls on client creation + assert wrapper_fn.call_count > 0 + wrapper_fn.reset_mock() + + # Ensure method has been cached + assert client._client._transport.verify_attestation in client._client._transport._wrapped_methods + + # Replace cached wrapped function with mock + mock_rpc = mock.AsyncMock() + mock_rpc.return_value = mock.Mock() + client._client._transport._wrapped_methods[client._client._transport.verify_attestation] = mock_rpc + + request = {} + await client.verify_attestation(request) + + # Establish that the underlying gRPC stub method was called. + assert mock_rpc.call_count == 1 + + await client.verify_attestation(request) + + # Establish that a new wrapper was not created for this call + assert wrapper_fn.call_count == 0 + assert mock_rpc.call_count == 2 + +@pytest.mark.asyncio +async def test_verify_attestation_async(transport: str = 'grpc_asyncio', request_type=service.VerifyAttestationRequest): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport=transport, + ) + + # Everything is optional in proto3 as far as the runtime is concerned, + # and we are mocking out the actual API, so just send an empty request. + request = request_type() + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_attestation), + '__call__') as call: + # Designate an appropriate return value for the call. + call.return_value =grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyAttestationResponse( + oidc_claims_token='oidc_claims_token_value', + )) + response = await client.verify_attestation(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) + _, args, _ = call.mock_calls[0] + request = service.VerifyAttestationRequest() + assert args[0] == request + + # Establish that the response is the type that we expect. + assert isinstance(response, service.VerifyAttestationResponse) + assert response.oidc_claims_token == 'oidc_claims_token_value' + + +@pytest.mark.asyncio +async def test_verify_attestation_async_from_dict(): + await test_verify_attestation_async(request_type=dict) + +def test_verify_attestation_field_headers(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + ) + + # Any value that is part of the HTTP/1.1 URI should be sent as + # a field header. Set these to a non-empty value. + request = service.VerifyAttestationRequest() + + request.challenge = 'challenge_value' + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_attestation), + '__call__') as call: + call.return_value = service.VerifyAttestationResponse() + client.verify_attestation(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the field header was sent. + _, _, kw = call.mock_calls[0] + assert ( + 'x-goog-request-params', + 'challenge=challenge_value', + ) in kw['metadata'] + + +@pytest.mark.asyncio +async def test_verify_attestation_field_headers_async(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + ) + + # Any value that is part of the HTTP/1.1 URI should be sent as + # a field header. Set these to a non-empty value. + request = service.VerifyAttestationRequest() + + request.challenge = 'challenge_value' + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_attestation), + '__call__') as call: + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyAttestationResponse()) + await client.verify_attestation(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the field header was sent. + _, _, kw = call.mock_calls[0] + assert ( + 'x-goog-request-params', + 'challenge=challenge_value', + ) in kw['metadata'] + + +@pytest.mark.parametrize("request_type", [ + service.VerifyConfidentialSpaceRequest, + dict, +]) +def test_verify_confidential_space(request_type, transport: str = 'grpc'): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport=transport, + ) + + # Everything is optional in proto3 as far as the runtime is concerned, + # and we are mocking out the actual API, so just send an empty request. + request = request_type() + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_space), + '__call__') as call: + # Designate an appropriate return value for the call. + call.return_value = service.VerifyConfidentialSpaceResponse( + attestation_token='attestation_token_value', + ) + response = client.verify_confidential_space(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + request = service.VerifyConfidentialSpaceRequest() + assert args[0] == request + + # Establish that the response is the type that we expect. + assert isinstance(response, service.VerifyConfidentialSpaceResponse) + assert response.attestation_token == 'attestation_token_value' + + +def test_verify_confidential_space_non_empty_request_with_auto_populated_field(): + # This test is a coverage failsafe to make sure that UUID4 fields are + # automatically populated, according to AIP-4235, with non-empty requests. + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport='grpc', + ) + + # Populate all string fields in the request which are not UUID4 + # since we want to check that UUID4 are populated automatically + # if they meet the requirements of AIP 4235. + request = service.VerifyConfidentialSpaceRequest( + challenge='challenge_value', + ) + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_space), + '__call__') as call: + call.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. + client.verify_confidential_space(request=request) + call.assert_called() + _, args, _ = call.mock_calls[0] + assert args[0] == service.VerifyConfidentialSpaceRequest( + challenge='challenge_value', + ) + +def test_verify_confidential_space_use_cached_wrapped_rpc(): + # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, + # instead of constructing them on each call + with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="grpc", + ) + + # Should wrap all calls on client creation + assert wrapper_fn.call_count > 0 + wrapper_fn.reset_mock() + + # Ensure method has been cached + assert client._transport.verify_confidential_space in client._transport._wrapped_methods + + # Replace cached wrapped function with mock + mock_rpc = mock.Mock() + mock_rpc.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. + client._transport._wrapped_methods[client._transport.verify_confidential_space] = mock_rpc + request = {} + client.verify_confidential_space(request) + + # Establish that the underlying gRPC stub method was called. + assert mock_rpc.call_count == 1 + + client.verify_confidential_space(request) + + # Establish that a new wrapper was not created for this call + assert wrapper_fn.call_count == 0 + assert mock_rpc.call_count == 2 + +@pytest.mark.asyncio +async def test_verify_confidential_space_async_use_cached_wrapped_rpc(transport: str = "grpc_asyncio"): + # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, + # instead of constructing them on each call + with mock.patch("google.api_core.gapic_v1.method_async.wrap_method") as wrapper_fn: + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport=transport, + ) + + # Should wrap all calls on client creation + assert wrapper_fn.call_count > 0 + wrapper_fn.reset_mock() + + # Ensure method has been cached + assert client._client._transport.verify_confidential_space in client._client._transport._wrapped_methods + + # Replace cached wrapped function with mock + mock_rpc = mock.AsyncMock() + mock_rpc.return_value = mock.Mock() + client._client._transport._wrapped_methods[client._client._transport.verify_confidential_space] = mock_rpc + + request = {} + await client.verify_confidential_space(request) + + # Establish that the underlying gRPC stub method was called. + assert mock_rpc.call_count == 1 + + await client.verify_confidential_space(request) + + # Establish that a new wrapper was not created for this call + assert wrapper_fn.call_count == 0 + assert mock_rpc.call_count == 2 + +@pytest.mark.asyncio +async def test_verify_confidential_space_async(transport: str = 'grpc_asyncio', request_type=service.VerifyConfidentialSpaceRequest): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport=transport, + ) + + # Everything is optional in proto3 as far as the runtime is concerned, + # and we are mocking out the actual API, so just send an empty request. + request = request_type() + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_space), + '__call__') as call: + # Designate an appropriate return value for the call. + call.return_value =grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyConfidentialSpaceResponse( + attestation_token='attestation_token_value', + )) + response = await client.verify_confidential_space(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) + _, args, _ = call.mock_calls[0] + request = service.VerifyConfidentialSpaceRequest() + assert args[0] == request + + # Establish that the response is the type that we expect. + assert isinstance(response, service.VerifyConfidentialSpaceResponse) + assert response.attestation_token == 'attestation_token_value' + + +@pytest.mark.asyncio +async def test_verify_confidential_space_async_from_dict(): + await test_verify_confidential_space_async(request_type=dict) + +def test_verify_confidential_space_field_headers(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + ) + + # Any value that is part of the HTTP/1.1 URI should be sent as + # a field header. Set these to a non-empty value. + request = service.VerifyConfidentialSpaceRequest() + + request.challenge = 'challenge_value' + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_space), + '__call__') as call: + call.return_value = service.VerifyConfidentialSpaceResponse() + client.verify_confidential_space(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the field header was sent. + _, _, kw = call.mock_calls[0] + assert ( + 'x-goog-request-params', + 'challenge=challenge_value', + ) in kw['metadata'] + + +@pytest.mark.asyncio +async def test_verify_confidential_space_field_headers_async(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + ) + + # Any value that is part of the HTTP/1.1 URI should be sent as + # a field header. Set these to a non-empty value. + request = service.VerifyConfidentialSpaceRequest() + + request.challenge = 'challenge_value' + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_space), + '__call__') as call: + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyConfidentialSpaceResponse()) + await client.verify_confidential_space(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the field header was sent. + _, _, kw = call.mock_calls[0] + assert ( + 'x-goog-request-params', + 'challenge=challenge_value', + ) in kw['metadata'] + + +@pytest.mark.parametrize("request_type", [ + service.VerifyConfidentialGkeRequest, + dict, +]) +def test_verify_confidential_gke(request_type, transport: str = 'grpc'): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport=transport, + ) + + # Everything is optional in proto3 as far as the runtime is concerned, + # and we are mocking out the actual API, so just send an empty request. + request = request_type() + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_gke), + '__call__') as call: + # Designate an appropriate return value for the call. + call.return_value = service.VerifyConfidentialGkeResponse( + attestation_token='attestation_token_value', + ) + response = client.verify_confidential_gke(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + request = service.VerifyConfidentialGkeRequest() + assert args[0] == request + + # Establish that the response is the type that we expect. + assert isinstance(response, service.VerifyConfidentialGkeResponse) + assert response.attestation_token == 'attestation_token_value' + + +def test_verify_confidential_gke_non_empty_request_with_auto_populated_field(): + # This test is a coverage failsafe to make sure that UUID4 fields are + # automatically populated, according to AIP-4235, with non-empty requests. + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport='grpc', + ) + + # Populate all string fields in the request which are not UUID4 + # since we want to check that UUID4 are populated automatically + # if they meet the requirements of AIP 4235. + request = service.VerifyConfidentialGkeRequest( + challenge='challenge_value', + ) + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_gke), + '__call__') as call: + call.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. + client.verify_confidential_gke(request=request) + call.assert_called() + _, args, _ = call.mock_calls[0] + assert args[0] == service.VerifyConfidentialGkeRequest( + challenge='challenge_value', + ) + +def test_verify_confidential_gke_use_cached_wrapped_rpc(): + # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, + # instead of constructing them on each call + with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="grpc", + ) + + # Should wrap all calls on client creation + assert wrapper_fn.call_count > 0 + wrapper_fn.reset_mock() + + # Ensure method has been cached + assert client._transport.verify_confidential_gke in client._transport._wrapped_methods + + # Replace cached wrapped function with mock + mock_rpc = mock.Mock() + mock_rpc.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. + client._transport._wrapped_methods[client._transport.verify_confidential_gke] = mock_rpc + request = {} + client.verify_confidential_gke(request) + + # Establish that the underlying gRPC stub method was called. + assert mock_rpc.call_count == 1 + + client.verify_confidential_gke(request) + + # Establish that a new wrapper was not created for this call + assert wrapper_fn.call_count == 0 + assert mock_rpc.call_count == 2 + +@pytest.mark.asyncio +async def test_verify_confidential_gke_async_use_cached_wrapped_rpc(transport: str = "grpc_asyncio"): + # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, + # instead of constructing them on each call + with mock.patch("google.api_core.gapic_v1.method_async.wrap_method") as wrapper_fn: + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport=transport, + ) + + # Should wrap all calls on client creation + assert wrapper_fn.call_count > 0 + wrapper_fn.reset_mock() + + # Ensure method has been cached + assert client._client._transport.verify_confidential_gke in client._client._transport._wrapped_methods + + # Replace cached wrapped function with mock + mock_rpc = mock.AsyncMock() + mock_rpc.return_value = mock.Mock() + client._client._transport._wrapped_methods[client._client._transport.verify_confidential_gke] = mock_rpc + + request = {} + await client.verify_confidential_gke(request) + + # Establish that the underlying gRPC stub method was called. + assert mock_rpc.call_count == 1 + + await client.verify_confidential_gke(request) + + # Establish that a new wrapper was not created for this call + assert wrapper_fn.call_count == 0 + assert mock_rpc.call_count == 2 + +@pytest.mark.asyncio +async def test_verify_confidential_gke_async(transport: str = 'grpc_asyncio', request_type=service.VerifyConfidentialGkeRequest): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport=transport, + ) + + # Everything is optional in proto3 as far as the runtime is concerned, + # and we are mocking out the actual API, so just send an empty request. + request = request_type() + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_gke), + '__call__') as call: + # Designate an appropriate return value for the call. + call.return_value =grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyConfidentialGkeResponse( + attestation_token='attestation_token_value', + )) + response = await client.verify_confidential_gke(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) + _, args, _ = call.mock_calls[0] + request = service.VerifyConfidentialGkeRequest() + assert args[0] == request + + # Establish that the response is the type that we expect. + assert isinstance(response, service.VerifyConfidentialGkeResponse) + assert response.attestation_token == 'attestation_token_value' + + +@pytest.mark.asyncio +async def test_verify_confidential_gke_async_from_dict(): + await test_verify_confidential_gke_async(request_type=dict) + +def test_verify_confidential_gke_field_headers(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + ) + + # Any value that is part of the HTTP/1.1 URI should be sent as + # a field header. Set these to a non-empty value. + request = service.VerifyConfidentialGkeRequest() + + request.challenge = 'challenge_value' + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_gke), + '__call__') as call: + call.return_value = service.VerifyConfidentialGkeResponse() + client.verify_confidential_gke(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the field header was sent. + _, _, kw = call.mock_calls[0] + assert ( + 'x-goog-request-params', + 'challenge=challenge_value', + ) in kw['metadata'] + + +@pytest.mark.asyncio +async def test_verify_confidential_gke_field_headers_async(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + ) + + # Any value that is part of the HTTP/1.1 URI should be sent as + # a field header. Set these to a non-empty value. + request = service.VerifyConfidentialGkeRequest() + + request.challenge = 'challenge_value' + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_gke), + '__call__') as call: + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyConfidentialGkeResponse()) + await client.verify_confidential_gke(request) + + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the field header was sent. + _, _, kw = call.mock_calls[0] + assert ( + 'x-goog-request-params', + 'challenge=challenge_value', + ) in kw['metadata'] + + +def test_create_challenge_rest_use_cached_wrapped_rpc(): + # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, + # instead of constructing them on each call + with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", + ) + + # Should wrap all calls on client creation + assert wrapper_fn.call_count > 0 + wrapper_fn.reset_mock() + + # Ensure method has been cached + assert client._transport.create_challenge in client._transport._wrapped_methods + + # Replace cached wrapped function with mock + mock_rpc = mock.Mock() + mock_rpc.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. + client._transport._wrapped_methods[client._transport.create_challenge] = mock_rpc + + request = {} + client.create_challenge(request) + + # Establish that the underlying gRPC stub method was called. + assert mock_rpc.call_count == 1 + + client.create_challenge(request) + + # Establish that a new wrapper was not created for this call + assert wrapper_fn.call_count == 0 + assert mock_rpc.call_count == 2 + + +def test_create_challenge_rest_required_fields(request_type=service.CreateChallengeRequest): + transport_class = transports.ConfidentialComputingRestTransport + + request_init = {} + request_init["parent"] = "" + request = request_type(**request_init) + pb_request = request_type.pb(request) + jsonified_request = json.loads(json_format.MessageToJson( + pb_request, + use_integers_for_enums=False + )) + + # verify fields with default values are dropped + + unset_fields = transport_class(credentials=ga_credentials.AnonymousCredentials()).create_challenge._get_unset_required_fields(jsonified_request) + jsonified_request.update(unset_fields) + + # verify required fields with default values are now present + + jsonified_request["parent"] = 'parent_value' + + unset_fields = transport_class(credentials=ga_credentials.AnonymousCredentials()).create_challenge._get_unset_required_fields(jsonified_request) + jsonified_request.update(unset_fields) + + # verify required fields with non-default values are left alone + assert "parent" in jsonified_request + assert jsonified_request["parent"] == 'parent_value' + + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport='rest', + ) + request = request_type(**request_init) + + # Designate an appropriate value for the returned response. + return_value = service.Challenge() + # Mock the http request call within the method and fake a response. + with mock.patch.object(Session, 'request') as req: + # We need to mock transcode() because providing default values + # for required fields will fail the real version if the http_options + # expect actual values for those fields. + with mock.patch.object(path_template, 'transcode') as transcode: + # A uri without fields and an empty body will force all the + # request fields to show up in the query_params. + pb_request = request_type.pb(request) + transcode_result = { + 'uri': 'v1/sample_method', + 'method': "post", + 'query_params': pb_request, + } + transcode_result['body'] = pb_request + transcode.return_value = transcode_result + + response_value = Response() + response_value.status_code = 200 + + # Convert return value to protobuf type + return_value = service.Challenge.pb(return_value) + json_return_value = json_format.MessageToJson(return_value) + + response_value._content = json_return_value.encode('UTF-8') + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + + response = client.create_challenge(request) + + expected_params = [ + ('$alt', 'json;enum-encoding=int') + ] + actual_params = req.call_args.kwargs['params'] + assert expected_params == actual_params + + +def test_create_challenge_rest_unset_required_fields(): + transport = transports.ConfidentialComputingRestTransport(credentials=ga_credentials.AnonymousCredentials) + + unset_fields = transport.create_challenge._get_unset_required_fields({}) + assert set(unset_fields) == (set(()) & set(("parent", "challenge", ))) + + +def test_create_challenge_rest_flattened(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", + ) + + # Mock the http request call within the method and fake a response. + with mock.patch.object(type(client.transport._session), 'request') as req: + # Designate an appropriate value for the returned response. + return_value = service.Challenge() + + # get arguments that satisfy an http rule for this method + sample_request = {'parent': 'projects/sample1/locations/sample2'} + + # get truthy value for each flattened field + mock_args = dict( + parent='parent_value', + challenge=service.Challenge(name='name_value'), + ) + mock_args.update(sample_request) + + # Wrap the value into a proper Response obj + response_value = Response() + response_value.status_code = 200 + # Convert return value to protobuf type + return_value = service.Challenge.pb(return_value) + json_return_value = json_format.MessageToJson(return_value) + response_value._content = json_return_value.encode('UTF-8') + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + + client.create_challenge(**mock_args) + + # Establish that the underlying call was made with the expected + # request object values. + assert len(req.mock_calls) == 1 + _, args, _ = req.mock_calls[0] + assert path_template.validate("%s/v1/{parent=projects/*/locations/*}/challenges" % client.transport._host, args[1]) + + +def test_create_challenge_rest_flattened_error(transport: str = 'rest'): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport=transport, + ) + + # Attempting to call a method with both a request object and flattened + # fields is an error. + with pytest.raises(ValueError): + client.create_challenge( + service.CreateChallengeRequest(), + parent='parent_value', + challenge=service.Challenge(name='name_value'), + ) + + +def test_verify_attestation_rest_use_cached_wrapped_rpc(): + # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, + # instead of constructing them on each call + with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", + ) + + # Should wrap all calls on client creation + assert wrapper_fn.call_count > 0 + wrapper_fn.reset_mock() + + # Ensure method has been cached + assert client._transport.verify_attestation in client._transport._wrapped_methods + + # Replace cached wrapped function with mock + mock_rpc = mock.Mock() + mock_rpc.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. + client._transport._wrapped_methods[client._transport.verify_attestation] = mock_rpc + + request = {} + client.verify_attestation(request) + + # Establish that the underlying gRPC stub method was called. + assert mock_rpc.call_count == 1 + + client.verify_attestation(request) + + # Establish that a new wrapper was not created for this call + assert wrapper_fn.call_count == 0 + assert mock_rpc.call_count == 2 + + +def test_verify_attestation_rest_required_fields(request_type=service.VerifyAttestationRequest): + transport_class = transports.ConfidentialComputingRestTransport + + request_init = {} + request_init["challenge"] = "" + request = request_type(**request_init) + pb_request = request_type.pb(request) + jsonified_request = json.loads(json_format.MessageToJson( + pb_request, + use_integers_for_enums=False + )) + + # verify fields with default values are dropped + + unset_fields = transport_class(credentials=ga_credentials.AnonymousCredentials()).verify_attestation._get_unset_required_fields(jsonified_request) + jsonified_request.update(unset_fields) + + # verify required fields with default values are now present + + jsonified_request["challenge"] = 'challenge_value' + + unset_fields = transport_class(credentials=ga_credentials.AnonymousCredentials()).verify_attestation._get_unset_required_fields(jsonified_request) + jsonified_request.update(unset_fields) + + # verify required fields with non-default values are left alone + assert "challenge" in jsonified_request + assert jsonified_request["challenge"] == 'challenge_value' + + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport='rest', + ) + request = request_type(**request_init) + + # Designate an appropriate value for the returned response. + return_value = service.VerifyAttestationResponse() + # Mock the http request call within the method and fake a response. + with mock.patch.object(Session, 'request') as req: + # We need to mock transcode() because providing default values + # for required fields will fail the real version if the http_options + # expect actual values for those fields. + with mock.patch.object(path_template, 'transcode') as transcode: + # A uri without fields and an empty body will force all the + # request fields to show up in the query_params. + pb_request = request_type.pb(request) + transcode_result = { + 'uri': 'v1/sample_method', + 'method': "post", + 'query_params': pb_request, + } + transcode_result['body'] = pb_request + transcode.return_value = transcode_result + + response_value = Response() + response_value.status_code = 200 + + # Convert return value to protobuf type + return_value = service.VerifyAttestationResponse.pb(return_value) + json_return_value = json_format.MessageToJson(return_value) + + response_value._content = json_return_value.encode('UTF-8') + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + + response = client.verify_attestation(request) + + expected_params = [ + ('$alt', 'json;enum-encoding=int') + ] + actual_params = req.call_args.kwargs['params'] + assert expected_params == actual_params + + +def test_verify_attestation_rest_unset_required_fields(): + transport = transports.ConfidentialComputingRestTransport(credentials=ga_credentials.AnonymousCredentials) + + unset_fields = transport.verify_attestation._get_unset_required_fields({}) + assert set(unset_fields) == (set(()) & set(("challenge", "tpmAttestation", ))) + + +def test_verify_confidential_space_rest_use_cached_wrapped_rpc(): + # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, + # instead of constructing them on each call + with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", + ) + + # Should wrap all calls on client creation + assert wrapper_fn.call_count > 0 + wrapper_fn.reset_mock() + + # Ensure method has been cached + assert client._transport.verify_confidential_space in client._transport._wrapped_methods + + # Replace cached wrapped function with mock + mock_rpc = mock.Mock() + mock_rpc.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. + client._transport._wrapped_methods[client._transport.verify_confidential_space] = mock_rpc + + request = {} + client.verify_confidential_space(request) + + # Establish that the underlying gRPC stub method was called. + assert mock_rpc.call_count == 1 + + client.verify_confidential_space(request) + + # Establish that a new wrapper was not created for this call + assert wrapper_fn.call_count == 0 + assert mock_rpc.call_count == 2 + + +def test_verify_confidential_space_rest_required_fields(request_type=service.VerifyConfidentialSpaceRequest): + transport_class = transports.ConfidentialComputingRestTransport + + request_init = {} + request_init["challenge"] = "" + request = request_type(**request_init) + pb_request = request_type.pb(request) + jsonified_request = json.loads(json_format.MessageToJson( + pb_request, + use_integers_for_enums=False + )) + + # verify fields with default values are dropped + + unset_fields = transport_class(credentials=ga_credentials.AnonymousCredentials()).verify_confidential_space._get_unset_required_fields(jsonified_request) + jsonified_request.update(unset_fields) + + # verify required fields with default values are now present + + jsonified_request["challenge"] = 'challenge_value' + + unset_fields = transport_class(credentials=ga_credentials.AnonymousCredentials()).verify_confidential_space._get_unset_required_fields(jsonified_request) + jsonified_request.update(unset_fields) + + # verify required fields with non-default values are left alone + assert "challenge" in jsonified_request + assert jsonified_request["challenge"] == 'challenge_value' + + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport='rest', + ) + request = request_type(**request_init) + + # Designate an appropriate value for the returned response. + return_value = service.VerifyConfidentialSpaceResponse() + # Mock the http request call within the method and fake a response. + with mock.patch.object(Session, 'request') as req: + # We need to mock transcode() because providing default values + # for required fields will fail the real version if the http_options + # expect actual values for those fields. + with mock.patch.object(path_template, 'transcode') as transcode: + # A uri without fields and an empty body will force all the + # request fields to show up in the query_params. + pb_request = request_type.pb(request) + transcode_result = { + 'uri': 'v1/sample_method', + 'method': "post", + 'query_params': pb_request, + } + transcode_result['body'] = pb_request + transcode.return_value = transcode_result + + response_value = Response() + response_value.status_code = 200 + + # Convert return value to protobuf type + return_value = service.VerifyConfidentialSpaceResponse.pb(return_value) + json_return_value = json_format.MessageToJson(return_value) + + response_value._content = json_return_value.encode('UTF-8') + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + + response = client.verify_confidential_space(request) + + expected_params = [ + ('$alt', 'json;enum-encoding=int') + ] + actual_params = req.call_args.kwargs['params'] + assert expected_params == actual_params + + +def test_verify_confidential_space_rest_unset_required_fields(): + transport = transports.ConfidentialComputingRestTransport(credentials=ga_credentials.AnonymousCredentials) + + unset_fields = transport.verify_confidential_space._get_unset_required_fields({}) + assert set(unset_fields) == (set(()) & set(("challenge", ))) + + +def test_verify_confidential_gke_rest_use_cached_wrapped_rpc(): + # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, + # instead of constructing them on each call + with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", + ) + + # Should wrap all calls on client creation + assert wrapper_fn.call_count > 0 + wrapper_fn.reset_mock() + + # Ensure method has been cached + assert client._transport.verify_confidential_gke in client._transport._wrapped_methods + + # Replace cached wrapped function with mock + mock_rpc = mock.Mock() + mock_rpc.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. + client._transport._wrapped_methods[client._transport.verify_confidential_gke] = mock_rpc + + request = {} + client.verify_confidential_gke(request) + + # Establish that the underlying gRPC stub method was called. + assert mock_rpc.call_count == 1 + + client.verify_confidential_gke(request) + + # Establish that a new wrapper was not created for this call + assert wrapper_fn.call_count == 0 + assert mock_rpc.call_count == 2 + + +def test_verify_confidential_gke_rest_required_fields(request_type=service.VerifyConfidentialGkeRequest): + transport_class = transports.ConfidentialComputingRestTransport + + request_init = {} + request_init["challenge"] = "" + request = request_type(**request_init) + pb_request = request_type.pb(request) + jsonified_request = json.loads(json_format.MessageToJson( + pb_request, + use_integers_for_enums=False + )) + + # verify fields with default values are dropped + + unset_fields = transport_class(credentials=ga_credentials.AnonymousCredentials()).verify_confidential_gke._get_unset_required_fields(jsonified_request) + jsonified_request.update(unset_fields) + + # verify required fields with default values are now present + + jsonified_request["challenge"] = 'challenge_value' + + unset_fields = transport_class(credentials=ga_credentials.AnonymousCredentials()).verify_confidential_gke._get_unset_required_fields(jsonified_request) + jsonified_request.update(unset_fields) + + # verify required fields with non-default values are left alone + assert "challenge" in jsonified_request + assert jsonified_request["challenge"] == 'challenge_value' + + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport='rest', + ) + request = request_type(**request_init) + + # Designate an appropriate value for the returned response. + return_value = service.VerifyConfidentialGkeResponse() + # Mock the http request call within the method and fake a response. + with mock.patch.object(Session, 'request') as req: + # We need to mock transcode() because providing default values + # for required fields will fail the real version if the http_options + # expect actual values for those fields. + with mock.patch.object(path_template, 'transcode') as transcode: + # A uri without fields and an empty body will force all the + # request fields to show up in the query_params. + pb_request = request_type.pb(request) + transcode_result = { + 'uri': 'v1/sample_method', + 'method': "post", + 'query_params': pb_request, + } + transcode_result['body'] = pb_request + transcode.return_value = transcode_result + + response_value = Response() + response_value.status_code = 200 + + # Convert return value to protobuf type + return_value = service.VerifyConfidentialGkeResponse.pb(return_value) + json_return_value = json_format.MessageToJson(return_value) + + response_value._content = json_return_value.encode('UTF-8') + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + + response = client.verify_confidential_gke(request) + + expected_params = [ + ('$alt', 'json;enum-encoding=int') + ] + actual_params = req.call_args.kwargs['params'] + assert expected_params == actual_params + + +def test_verify_confidential_gke_rest_unset_required_fields(): + transport = transports.ConfidentialComputingRestTransport(credentials=ga_credentials.AnonymousCredentials) + + unset_fields = transport.verify_confidential_gke._get_unset_required_fields({}) + assert set(unset_fields) == (set(()) & set(("challenge", ))) + + +def test_credentials_transport_error(): + # It is an error to provide credentials and a transport instance. + transport = transports.ConfidentialComputingGrpcTransport( + credentials=ga_credentials.AnonymousCredentials(), + ) + with pytest.raises(ValueError): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport=transport, + ) + + # It is an error to provide a credentials file and a transport instance. + transport = transports.ConfidentialComputingGrpcTransport( + credentials=ga_credentials.AnonymousCredentials(), + ) + with pytest.raises(ValueError): + client = ConfidentialComputingClient( + client_options={"credentials_file": "credentials.json"}, + transport=transport, + ) + + # It is an error to provide an api_key and a transport instance. + transport = transports.ConfidentialComputingGrpcTransport( + credentials=ga_credentials.AnonymousCredentials(), + ) + options = client_options.ClientOptions() + options.api_key = "api_key" + with pytest.raises(ValueError): + client = ConfidentialComputingClient( + client_options=options, + transport=transport, + ) + + # It is an error to provide an api_key and a credential. + options = client_options.ClientOptions() + options.api_key = "api_key" + with pytest.raises(ValueError): + client = ConfidentialComputingClient( + client_options=options, + credentials=ga_credentials.AnonymousCredentials() + ) + + # It is an error to provide scopes and a transport instance. + transport = transports.ConfidentialComputingGrpcTransport( + credentials=ga_credentials.AnonymousCredentials(), + ) + with pytest.raises(ValueError): + client = ConfidentialComputingClient( + client_options={"scopes": ["1", "2"]}, + transport=transport, + ) + + +def test_transport_instance(): + # A client may be instantiated with a custom transport instance. + transport = transports.ConfidentialComputingGrpcTransport( + credentials=ga_credentials.AnonymousCredentials(), + ) + client = ConfidentialComputingClient(transport=transport) + assert client.transport is transport + +def test_transport_get_channel(): + # A client may be instantiated with a custom transport instance. + transport = transports.ConfidentialComputingGrpcTransport( + credentials=ga_credentials.AnonymousCredentials(), + ) + channel = transport.grpc_channel + assert channel + + transport = transports.ConfidentialComputingGrpcAsyncIOTransport( + credentials=ga_credentials.AnonymousCredentials(), + ) + channel = transport.grpc_channel + assert channel + +@pytest.mark.parametrize("transport_class", [ + transports.ConfidentialComputingGrpcTransport, + transports.ConfidentialComputingGrpcAsyncIOTransport, + transports.ConfidentialComputingRestTransport, +]) +def test_transport_adc(transport_class): + # Test default credentials are used if not provided. + with mock.patch.object(google.auth, 'default') as adc: + adc.return_value = (ga_credentials.AnonymousCredentials(), None) + transport_class() + adc.assert_called_once() + +def test_transport_kind_grpc(): + transport = ConfidentialComputingClient.get_transport_class("grpc")( + credentials=ga_credentials.AnonymousCredentials() + ) + assert transport.kind == "grpc" + + +def test_initialize_client_w_grpc(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="grpc" + ) + assert client is not None + + +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +def test_create_challenge_empty_call_grpc(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="grpc", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object( + type(client.transport.create_challenge), + '__call__') as call: + call.return_value = service.Challenge() + client.create_challenge(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.CreateChallengeRequest() + + assert args[0] == request_msg + + +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +def test_verify_attestation_empty_call_grpc(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="grpc", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object( + type(client.transport.verify_attestation), + '__call__') as call: + call.return_value = service.VerifyAttestationResponse() + client.verify_attestation(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.VerifyAttestationRequest() + + assert args[0] == request_msg + + +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +def test_verify_confidential_space_empty_call_grpc(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="grpc", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_space), + '__call__') as call: + call.return_value = service.VerifyConfidentialSpaceResponse() + client.verify_confidential_space(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.VerifyConfidentialSpaceRequest() + + assert args[0] == request_msg + + +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +def test_verify_confidential_gke_empty_call_grpc(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="grpc", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_gke), + '__call__') as call: + call.return_value = service.VerifyConfidentialGkeResponse() + client.verify_confidential_gke(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.VerifyConfidentialGkeRequest() + + assert args[0] == request_msg + + +def test_transport_kind_grpc_asyncio(): + transport = ConfidentialComputingAsyncClient.get_transport_class("grpc_asyncio")( + credentials=async_anonymous_credentials() + ) + assert transport.kind == "grpc_asyncio" + + +def test_initialize_client_w_grpc_asyncio(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport="grpc_asyncio" + ) + assert client is not None + + +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +@pytest.mark.asyncio +async def test_create_challenge_empty_call_grpc_asyncio(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport="grpc_asyncio", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object( + type(client.transport.create_challenge), + '__call__') as call: + # Designate an appropriate return value for the call. + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.Challenge( + name='name_value', + used=True, + tpm_nonce='tpm_nonce_value', + )) + await client.create_challenge(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.CreateChallengeRequest() + + assert args[0] == request_msg + + +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +@pytest.mark.asyncio +async def test_verify_attestation_empty_call_grpc_asyncio(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport="grpc_asyncio", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object( + type(client.transport.verify_attestation), + '__call__') as call: + # Designate an appropriate return value for the call. + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyAttestationResponse( + oidc_claims_token='oidc_claims_token_value', + )) + await client.verify_attestation(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.VerifyAttestationRequest() + + assert args[0] == request_msg + + +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +@pytest.mark.asyncio +async def test_verify_confidential_space_empty_call_grpc_asyncio(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport="grpc_asyncio", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_space), + '__call__') as call: + # Designate an appropriate return value for the call. + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyConfidentialSpaceResponse( + attestation_token='attestation_token_value', + )) + await client.verify_confidential_space(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.VerifyConfidentialSpaceRequest() + + assert args[0] == request_msg + + +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +@pytest.mark.asyncio +async def test_verify_confidential_gke_empty_call_grpc_asyncio(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport="grpc_asyncio", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_gke), + '__call__') as call: + # Designate an appropriate return value for the call. + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyConfidentialGkeResponse( + attestation_token='attestation_token_value', + )) + await client.verify_confidential_gke(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.VerifyConfidentialGkeRequest() + + assert args[0] == request_msg + + +def test_transport_kind_rest(): + transport = ConfidentialComputingClient.get_transport_class("rest")( + credentials=ga_credentials.AnonymousCredentials() + ) + assert transport.kind == "rest" + + +def test_create_challenge_rest_bad_request(request_type=service.CreateChallengeRequest): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest" + ) + # send a request that will satisfy transcoding + request_init = {'parent': 'projects/sample1/locations/sample2'} + request = request_type(**request_init) + + # Mock the http request call within the method and fake a BadRequest error. + with mock.patch.object(Session, 'request') as req, pytest.raises(core_exceptions.BadRequest): + # Wrap the value into a proper Response obj + response_value = mock.Mock() + json_return_value = '' + response_value.json = mock.Mock(return_value={}) + response_value.status_code = 400 + response_value.request = mock.Mock() + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + client.create_challenge(request) + + +@pytest.mark.parametrize("request_type", [ + service.CreateChallengeRequest, + dict, +]) +def test_create_challenge_rest_call_success(request_type): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest" + ) + + # send a request that will satisfy transcoding + request_init = {'parent': 'projects/sample1/locations/sample2'} + request_init["challenge"] = {'name': 'name_value', 'create_time': {'seconds': 751, 'nanos': 543}, 'expire_time': {}, 'used': True, 'tpm_nonce': 'tpm_nonce_value'} + # The version of a generated dependency at test runtime may differ from the version used during generation. + # Delete any fields which are not present in the current runtime dependency + # See https://github.com/googleapis/gapic-generator-python/issues/1748 + + # Determine if the message type is proto-plus or protobuf + test_field = service.CreateChallengeRequest.meta.fields["challenge"] + + def get_message_fields(field): + # Given a field which is a message (composite type), return a list with + # all the fields of the message. + # If the field is not a composite type, return an empty list. + message_fields = [] + + if hasattr(field, "message") and field.message: + is_field_type_proto_plus_type = not hasattr(field.message, "DESCRIPTOR") + + if is_field_type_proto_plus_type: + message_fields = field.message.meta.fields.values() + # Add `# pragma: NO COVER` because there may not be any `*_pb2` field types + else: # pragma: NO COVER + message_fields = field.message.DESCRIPTOR.fields + return message_fields + + runtime_nested_fields = [ + (field.name, nested_field.name) + for field in get_message_fields(test_field) + for nested_field in get_message_fields(field) + ] + + subfields_not_in_runtime = [] + + # For each item in the sample request, create a list of sub fields which are not present at runtime + # Add `# pragma: NO COVER` because this test code will not run if all subfields are present at runtime + for field, value in request_init["challenge"].items(): # pragma: NO COVER + result = None + is_repeated = False + # For repeated fields + if isinstance(value, list) and len(value): + is_repeated = True + result = value[0] + # For fields where the type is another message + if isinstance(value, dict): + result = value + + if result and hasattr(result, "keys"): + for subfield in result.keys(): + if (field, subfield) not in runtime_nested_fields: + subfields_not_in_runtime.append( + {"field": field, "subfield": subfield, "is_repeated": is_repeated} + ) + + # Remove fields from the sample request which are not present in the runtime version of the dependency + # Add `# pragma: NO COVER` because this test code will not run if all subfields are present at runtime + for subfield_to_delete in subfields_not_in_runtime: # pragma: NO COVER + field = subfield_to_delete.get("field") + field_repeated = subfield_to_delete.get("is_repeated") + subfield = subfield_to_delete.get("subfield") + if subfield: + if field_repeated: + for i in range(0, len(request_init["challenge"][field])): + del request_init["challenge"][field][i][subfield] + else: + del request_init["challenge"][field][subfield] + request = request_type(**request_init) + + # Mock the http request call within the method and fake a response. + with mock.patch.object(type(client.transport._session), 'request') as req: + # Designate an appropriate value for the returned response. + return_value = service.Challenge( + name='name_value', + used=True, + tpm_nonce='tpm_nonce_value', + ) + + # Wrap the value into a proper Response obj + response_value = mock.Mock() + response_value.status_code = 200 + + # Convert return value to protobuf type + return_value = service.Challenge.pb(return_value) + json_return_value = json_format.MessageToJson(return_value) + response_value.content = json_return_value.encode('UTF-8') + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + response = client.create_challenge(request) + + # Establish that the response is the type that we expect. + assert isinstance(response, service.Challenge) + assert response.name == 'name_value' + assert response.used is True + assert response.tpm_nonce == 'tpm_nonce_value' + + +@pytest.mark.parametrize("null_interceptor", [True, False]) +def test_create_challenge_rest_interceptors(null_interceptor): + transport = transports.ConfidentialComputingRestTransport( + credentials=ga_credentials.AnonymousCredentials(), + interceptor=None if null_interceptor else transports.ConfidentialComputingRestInterceptor(), + ) + client = ConfidentialComputingClient(transport=transport) + + with mock.patch.object(type(client.transport._session), "request") as req, \ + mock.patch.object(path_template, "transcode") as transcode, \ + mock.patch.object(transports.ConfidentialComputingRestInterceptor, "post_create_challenge") as post, \ + mock.patch.object(transports.ConfidentialComputingRestInterceptor, "post_create_challenge_with_metadata") as post_with_metadata, \ + mock.patch.object(transports.ConfidentialComputingRestInterceptor, "pre_create_challenge") as pre: + pre.assert_not_called() + post.assert_not_called() + post_with_metadata.assert_not_called() + pb_message = service.CreateChallengeRequest.pb(service.CreateChallengeRequest()) + transcode.return_value = { + "method": "post", + "uri": "my_uri", + "body": pb_message, + "query_params": pb_message, + } + + req.return_value = mock.Mock() + req.return_value.status_code = 200 + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + return_value = service.Challenge.to_json(service.Challenge()) + req.return_value.content = return_value + + request = service.CreateChallengeRequest() + metadata =[ + ("key", "val"), + ("cephalopod", "squid"), + ] + pre.return_value = request, metadata + post.return_value = service.Challenge() + post_with_metadata.return_value = service.Challenge(), metadata + + client.create_challenge(request, metadata=[("key", "val"), ("cephalopod", "squid"),]) + + pre.assert_called_once() + post.assert_called_once() + post_with_metadata.assert_called_once() + + +def test_verify_attestation_rest_bad_request(request_type=service.VerifyAttestationRequest): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest" + ) + # send a request that will satisfy transcoding + request_init = {'challenge': 'projects/sample1/locations/sample2/challenges/sample3'} + request = request_type(**request_init) + + # Mock the http request call within the method and fake a BadRequest error. + with mock.patch.object(Session, 'request') as req, pytest.raises(core_exceptions.BadRequest): + # Wrap the value into a proper Response obj + response_value = mock.Mock() + json_return_value = '' + response_value.json = mock.Mock(return_value={}) + response_value.status_code = 400 + response_value.request = mock.Mock() + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + client.verify_attestation(request) + + +@pytest.mark.parametrize("request_type", [ + service.VerifyAttestationRequest, + dict, +]) +def test_verify_attestation_rest_call_success(request_type): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest" + ) + + # send a request that will satisfy transcoding + request_init = {'challenge': 'projects/sample1/locations/sample2/challenges/sample3'} + request = request_type(**request_init) + + # Mock the http request call within the method and fake a response. + with mock.patch.object(type(client.transport._session), 'request') as req: + # Designate an appropriate value for the returned response. + return_value = service.VerifyAttestationResponse( + oidc_claims_token='oidc_claims_token_value', + ) + + # Wrap the value into a proper Response obj + response_value = mock.Mock() + response_value.status_code = 200 + + # Convert return value to protobuf type + return_value = service.VerifyAttestationResponse.pb(return_value) + json_return_value = json_format.MessageToJson(return_value) + response_value.content = json_return_value.encode('UTF-8') + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + response = client.verify_attestation(request) + + # Establish that the response is the type that we expect. + assert isinstance(response, service.VerifyAttestationResponse) + assert response.oidc_claims_token == 'oidc_claims_token_value' + + +@pytest.mark.parametrize("null_interceptor", [True, False]) +def test_verify_attestation_rest_interceptors(null_interceptor): + transport = transports.ConfidentialComputingRestTransport( + credentials=ga_credentials.AnonymousCredentials(), + interceptor=None if null_interceptor else transports.ConfidentialComputingRestInterceptor(), + ) + client = ConfidentialComputingClient(transport=transport) + + with mock.patch.object(type(client.transport._session), "request") as req, \ + mock.patch.object(path_template, "transcode") as transcode, \ + mock.patch.object(transports.ConfidentialComputingRestInterceptor, "post_verify_attestation") as post, \ + mock.patch.object(transports.ConfidentialComputingRestInterceptor, "post_verify_attestation_with_metadata") as post_with_metadata, \ + mock.patch.object(transports.ConfidentialComputingRestInterceptor, "pre_verify_attestation") as pre: + pre.assert_not_called() + post.assert_not_called() + post_with_metadata.assert_not_called() + pb_message = service.VerifyAttestationRequest.pb(service.VerifyAttestationRequest()) + transcode.return_value = { + "method": "post", + "uri": "my_uri", + "body": pb_message, + "query_params": pb_message, + } + + req.return_value = mock.Mock() + req.return_value.status_code = 200 + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + return_value = service.VerifyAttestationResponse.to_json(service.VerifyAttestationResponse()) + req.return_value.content = return_value + + request = service.VerifyAttestationRequest() + metadata =[ + ("key", "val"), + ("cephalopod", "squid"), + ] + pre.return_value = request, metadata + post.return_value = service.VerifyAttestationResponse() + post_with_metadata.return_value = service.VerifyAttestationResponse(), metadata + + client.verify_attestation(request, metadata=[("key", "val"), ("cephalopod", "squid"),]) + + pre.assert_called_once() + post.assert_called_once() + post_with_metadata.assert_called_once() + + +def test_verify_confidential_space_rest_bad_request(request_type=service.VerifyConfidentialSpaceRequest): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest" + ) + # send a request that will satisfy transcoding + request_init = {'challenge': 'projects/sample1/locations/sample2/challenges/sample3'} + request = request_type(**request_init) + + # Mock the http request call within the method and fake a BadRequest error. + with mock.patch.object(Session, 'request') as req, pytest.raises(core_exceptions.BadRequest): + # Wrap the value into a proper Response obj + response_value = mock.Mock() + json_return_value = '' + response_value.json = mock.Mock(return_value={}) + response_value.status_code = 400 + response_value.request = mock.Mock() + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + client.verify_confidential_space(request) + + +@pytest.mark.parametrize("request_type", [ + service.VerifyConfidentialSpaceRequest, + dict, +]) +def test_verify_confidential_space_rest_call_success(request_type): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest" + ) + + # send a request that will satisfy transcoding + request_init = {'challenge': 'projects/sample1/locations/sample2/challenges/sample3'} + request = request_type(**request_init) + + # Mock the http request call within the method and fake a response. + with mock.patch.object(type(client.transport._session), 'request') as req: + # Designate an appropriate value for the returned response. + return_value = service.VerifyConfidentialSpaceResponse( + attestation_token='attestation_token_value', + ) + + # Wrap the value into a proper Response obj + response_value = mock.Mock() + response_value.status_code = 200 + + # Convert return value to protobuf type + return_value = service.VerifyConfidentialSpaceResponse.pb(return_value) + json_return_value = json_format.MessageToJson(return_value) + response_value.content = json_return_value.encode('UTF-8') + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + response = client.verify_confidential_space(request) + + # Establish that the response is the type that we expect. + assert isinstance(response, service.VerifyConfidentialSpaceResponse) + assert response.attestation_token == 'attestation_token_value' + + +@pytest.mark.parametrize("null_interceptor", [True, False]) +def test_verify_confidential_space_rest_interceptors(null_interceptor): + transport = transports.ConfidentialComputingRestTransport( + credentials=ga_credentials.AnonymousCredentials(), + interceptor=None if null_interceptor else transports.ConfidentialComputingRestInterceptor(), + ) + client = ConfidentialComputingClient(transport=transport) + + with mock.patch.object(type(client.transport._session), "request") as req, \ + mock.patch.object(path_template, "transcode") as transcode, \ + mock.patch.object(transports.ConfidentialComputingRestInterceptor, "post_verify_confidential_space") as post, \ + mock.patch.object(transports.ConfidentialComputingRestInterceptor, "post_verify_confidential_space_with_metadata") as post_with_metadata, \ + mock.patch.object(transports.ConfidentialComputingRestInterceptor, "pre_verify_confidential_space") as pre: + pre.assert_not_called() + post.assert_not_called() + post_with_metadata.assert_not_called() + pb_message = service.VerifyConfidentialSpaceRequest.pb(service.VerifyConfidentialSpaceRequest()) + transcode.return_value = { + "method": "post", + "uri": "my_uri", + "body": pb_message, + "query_params": pb_message, + } + + req.return_value = mock.Mock() + req.return_value.status_code = 200 + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + return_value = service.VerifyConfidentialSpaceResponse.to_json(service.VerifyConfidentialSpaceResponse()) + req.return_value.content = return_value + + request = service.VerifyConfidentialSpaceRequest() + metadata =[ + ("key", "val"), + ("cephalopod", "squid"), + ] + pre.return_value = request, metadata + post.return_value = service.VerifyConfidentialSpaceResponse() + post_with_metadata.return_value = service.VerifyConfidentialSpaceResponse(), metadata + + client.verify_confidential_space(request, metadata=[("key", "val"), ("cephalopod", "squid"),]) + + pre.assert_called_once() + post.assert_called_once() + post_with_metadata.assert_called_once() + + +def test_verify_confidential_gke_rest_bad_request(request_type=service.VerifyConfidentialGkeRequest): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest" + ) + # send a request that will satisfy transcoding + request_init = {'challenge': 'projects/sample1/locations/sample2/challenges/sample3'} + request = request_type(**request_init) + + # Mock the http request call within the method and fake a BadRequest error. + with mock.patch.object(Session, 'request') as req, pytest.raises(core_exceptions.BadRequest): + # Wrap the value into a proper Response obj + response_value = mock.Mock() + json_return_value = '' + response_value.json = mock.Mock(return_value={}) + response_value.status_code = 400 + response_value.request = mock.Mock() + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + client.verify_confidential_gke(request) + + +@pytest.mark.parametrize("request_type", [ + service.VerifyConfidentialGkeRequest, + dict, +]) +def test_verify_confidential_gke_rest_call_success(request_type): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest" + ) + + # send a request that will satisfy transcoding + request_init = {'challenge': 'projects/sample1/locations/sample2/challenges/sample3'} + request = request_type(**request_init) + + # Mock the http request call within the method and fake a response. + with mock.patch.object(type(client.transport._session), 'request') as req: + # Designate an appropriate value for the returned response. + return_value = service.VerifyConfidentialGkeResponse( + attestation_token='attestation_token_value', + ) + + # Wrap the value into a proper Response obj + response_value = mock.Mock() + response_value.status_code = 200 + + # Convert return value to protobuf type + return_value = service.VerifyConfidentialGkeResponse.pb(return_value) + json_return_value = json_format.MessageToJson(return_value) + response_value.content = json_return_value.encode('UTF-8') + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + response = client.verify_confidential_gke(request) + + # Establish that the response is the type that we expect. + assert isinstance(response, service.VerifyConfidentialGkeResponse) + assert response.attestation_token == 'attestation_token_value' + + +@pytest.mark.parametrize("null_interceptor", [True, False]) +def test_verify_confidential_gke_rest_interceptors(null_interceptor): + transport = transports.ConfidentialComputingRestTransport( + credentials=ga_credentials.AnonymousCredentials(), + interceptor=None if null_interceptor else transports.ConfidentialComputingRestInterceptor(), + ) + client = ConfidentialComputingClient(transport=transport) + + with mock.patch.object(type(client.transport._session), "request") as req, \ + mock.patch.object(path_template, "transcode") as transcode, \ + mock.patch.object(transports.ConfidentialComputingRestInterceptor, "post_verify_confidential_gke") as post, \ + mock.patch.object(transports.ConfidentialComputingRestInterceptor, "post_verify_confidential_gke_with_metadata") as post_with_metadata, \ + mock.patch.object(transports.ConfidentialComputingRestInterceptor, "pre_verify_confidential_gke") as pre: + pre.assert_not_called() + post.assert_not_called() + post_with_metadata.assert_not_called() + pb_message = service.VerifyConfidentialGkeRequest.pb(service.VerifyConfidentialGkeRequest()) + transcode.return_value = { + "method": "post", + "uri": "my_uri", + "body": pb_message, + "query_params": pb_message, + } + + req.return_value = mock.Mock() + req.return_value.status_code = 200 + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + return_value = service.VerifyConfidentialGkeResponse.to_json(service.VerifyConfidentialGkeResponse()) + req.return_value.content = return_value + + request = service.VerifyConfidentialGkeRequest() + metadata =[ + ("key", "val"), + ("cephalopod", "squid"), + ] + pre.return_value = request, metadata + post.return_value = service.VerifyConfidentialGkeResponse() + post_with_metadata.return_value = service.VerifyConfidentialGkeResponse(), metadata + + client.verify_confidential_gke(request, metadata=[("key", "val"), ("cephalopod", "squid"),]) + + pre.assert_called_once() + post.assert_called_once() + post_with_metadata.assert_called_once() + + +def test_get_location_rest_bad_request(request_type=locations_pb2.GetLocationRequest): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", + ) + request = request_type() + request = json_format.ParseDict({'name': 'projects/sample1/locations/sample2'}, request) + + # Mock the http request call within the method and fake a BadRequest error. + with mock.patch.object(Session, 'request') as req, pytest.raises(core_exceptions.BadRequest): + # Wrap the value into a proper Response obj + response_value = Response() + json_return_value = '' + response_value.json = mock.Mock(return_value={}) + response_value.status_code = 400 + response_value.request = Request() + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + client.get_location(request) + + +@pytest.mark.parametrize("request_type", [ + locations_pb2.GetLocationRequest, + dict, +]) +def test_get_location_rest(request_type): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", + ) + + request_init = {'name': 'projects/sample1/locations/sample2'} + request = request_type(**request_init) + # Mock the http request call within the method and fake a response. + with mock.patch.object(Session, 'request') as req: + # Designate an appropriate value for the returned response. + return_value = locations_pb2.Location() + + # Wrap the value into a proper Response obj + response_value = mock.Mock() + response_value.status_code = 200 + json_return_value = json_format.MessageToJson(return_value) + response_value.content = json_return_value.encode('UTF-8') + + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + + response = client.get_location(request) + + # Establish that the response is the type that we expect. + assert isinstance(response, locations_pb2.Location) + + +def test_list_locations_rest_bad_request(request_type=locations_pb2.ListLocationsRequest): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", + ) + request = request_type() + request = json_format.ParseDict({'name': 'projects/sample1'}, request) + + # Mock the http request call within the method and fake a BadRequest error. + with mock.patch.object(Session, 'request') as req, pytest.raises(core_exceptions.BadRequest): + # Wrap the value into a proper Response obj + response_value = Response() + json_return_value = '' + response_value.json = mock.Mock(return_value={}) + response_value.status_code = 400 + response_value.request = Request() + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + client.list_locations(request) + + +@pytest.mark.parametrize("request_type", [ + locations_pb2.ListLocationsRequest, + dict, +]) +def test_list_locations_rest(request_type): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", + ) + + request_init = {'name': 'projects/sample1'} + request = request_type(**request_init) + # Mock the http request call within the method and fake a response. + with mock.patch.object(Session, 'request') as req: + # Designate an appropriate value for the returned response. + return_value = locations_pb2.ListLocationsResponse() + + # Wrap the value into a proper Response obj + response_value = mock.Mock() + response_value.status_code = 200 + json_return_value = json_format.MessageToJson(return_value) + response_value.content = json_return_value.encode('UTF-8') + + req.return_value = response_value + req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} + + response = client.list_locations(request) + + # Establish that the response is the type that we expect. + assert isinstance(response, locations_pb2.ListLocationsResponse) + +def test_initialize_client_w_rest(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest" + ) + assert client is not None + + +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +def test_create_challenge_empty_call_rest(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object( + type(client.transport.create_challenge), + '__call__') as call: + client.create_challenge(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.CreateChallengeRequest() + + assert args[0] == request_msg + + +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +def test_verify_attestation_empty_call_rest(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object( + type(client.transport.verify_attestation), + '__call__') as call: + client.verify_attestation(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.VerifyAttestationRequest() + + assert args[0] == request_msg + + +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +def test_verify_confidential_space_empty_call_rest(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_space), + '__call__') as call: + client.verify_confidential_space(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.VerifyConfidentialSpaceRequest() + + assert args[0] == request_msg + + +# This test is a coverage failsafe to make sure that totally empty calls, +# i.e. request == None and no flattened fields passed, work. +def test_verify_confidential_gke_empty_call_rest(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest", + ) + + # Mock the actual call, and fake the request. + with mock.patch.object( + type(client.transport.verify_confidential_gke), + '__call__') as call: + client.verify_confidential_gke(request=None) + + # Establish that the underlying stub method was called. + call.assert_called() + _, args, _ = call.mock_calls[0] + request_msg = service.VerifyConfidentialGkeRequest() + + assert args[0] == request_msg + + +def test_transport_grpc_default(): + # A client should use the gRPC transport by default. + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + ) + assert isinstance( + client.transport, + transports.ConfidentialComputingGrpcTransport, + ) + +def test_confidential_computing_base_transport_error(): + # Passing both a credentials object and credentials_file should raise an error + with pytest.raises(core_exceptions.DuplicateCredentialArgs): + transport = transports.ConfidentialComputingTransport( + credentials=ga_credentials.AnonymousCredentials(), + credentials_file="credentials.json" + ) + + +def test_confidential_computing_base_transport(): + # Instantiate the base transport. + with mock.patch('google.cloud.confidentialcomputing_v1.services.confidential_computing.transports.ConfidentialComputingTransport.__init__') as Transport: + Transport.return_value = None + transport = transports.ConfidentialComputingTransport( + credentials=ga_credentials.AnonymousCredentials(), + ) + + # Every method on the transport should just blindly + # raise NotImplementedError. + methods = ( + 'create_challenge', + 'verify_attestation', + 'verify_confidential_space', + 'verify_confidential_gke', + 'get_location', + 'list_locations', + ) + for method in methods: + with pytest.raises(NotImplementedError): + getattr(transport, method)(request=object()) + + with pytest.raises(NotImplementedError): + transport.close() + + # Catch all for all remaining methods and properties + remainder = [ + 'kind', + ] + for r in remainder: + with pytest.raises(NotImplementedError): + getattr(transport, r)() + + +def test_confidential_computing_base_transport_with_credentials_file(): + # Instantiate the base transport with a credentials file + with mock.patch.object(google.auth, 'load_credentials_from_file', autospec=True) as load_creds, mock.patch('google.cloud.confidentialcomputing_v1.services.confidential_computing.transports.ConfidentialComputingTransport._prep_wrapped_messages') as Transport: + Transport.return_value = None + load_creds.return_value = (ga_credentials.AnonymousCredentials(), None) + transport = transports.ConfidentialComputingTransport( + credentials_file="credentials.json", + quota_project_id="octopus", + ) + load_creds.assert_called_once_with("credentials.json", + scopes=None, + default_scopes=( + 'https://www.googleapis.com/auth/cloud-platform', +), + quota_project_id="octopus", + ) + + +def test_confidential_computing_base_transport_with_adc(): + # Test the default credentials are used if credentials and credentials_file are None. + with mock.patch.object(google.auth, 'default', autospec=True) as adc, mock.patch('google.cloud.confidentialcomputing_v1.services.confidential_computing.transports.ConfidentialComputingTransport._prep_wrapped_messages') as Transport: + Transport.return_value = None + adc.return_value = (ga_credentials.AnonymousCredentials(), None) + transport = transports.ConfidentialComputingTransport() + adc.assert_called_once() + + +def test_confidential_computing_auth_adc(): + # If no credentials are provided, we should use ADC credentials. + with mock.patch.object(google.auth, 'default', autospec=True) as adc: + adc.return_value = (ga_credentials.AnonymousCredentials(), None) + ConfidentialComputingClient() + adc.assert_called_once_with( + scopes=None, + default_scopes=( + 'https://www.googleapis.com/auth/cloud-platform', +), + quota_project_id=None, + ) + + +@pytest.mark.parametrize( + "transport_class", + [ + transports.ConfidentialComputingGrpcTransport, + transports.ConfidentialComputingGrpcAsyncIOTransport, + ], +) +def test_confidential_computing_transport_auth_adc(transport_class): + # If credentials and host are not provided, the transport class should use + # ADC credentials. + with mock.patch.object(google.auth, 'default', autospec=True) as adc: + adc.return_value = (ga_credentials.AnonymousCredentials(), None) + transport_class(quota_project_id="octopus", scopes=["1", "2"]) + adc.assert_called_once_with( + scopes=["1", "2"], + default_scopes=( 'https://www.googleapis.com/auth/cloud-platform',), + quota_project_id="octopus", + ) + + +@pytest.mark.parametrize( + "transport_class", + [ + transports.ConfidentialComputingGrpcTransport, + transports.ConfidentialComputingGrpcAsyncIOTransport, + transports.ConfidentialComputingRestTransport, + ], +) +def test_confidential_computing_transport_auth_gdch_credentials(transport_class): + host = 'https://language.com' + api_audience_tests = [None, 'https://language2.com'] + api_audience_expect = [host, 'https://language2.com'] + for t, e in zip(api_audience_tests, api_audience_expect): + with mock.patch.object(google.auth, 'default', autospec=True) as adc: + gdch_mock = mock.MagicMock() + type(gdch_mock).with_gdch_audience = mock.PropertyMock(return_value=gdch_mock) + adc.return_value = (gdch_mock, None) + transport_class(host=host, api_audience=t) + gdch_mock.with_gdch_audience.assert_called_once_with( + e + ) + + +@pytest.mark.parametrize( + "transport_class,grpc_helpers", + [ + (transports.ConfidentialComputingGrpcTransport, grpc_helpers), + (transports.ConfidentialComputingGrpcAsyncIOTransport, grpc_helpers_async) + ], +) +def test_confidential_computing_transport_create_channel(transport_class, grpc_helpers): + # If credentials and host are not provided, the transport class should use + # ADC credentials. + with mock.patch.object(google.auth, "default", autospec=True) as adc, mock.patch.object( + grpc_helpers, "create_channel", autospec=True + ) as create_channel: + creds = ga_credentials.AnonymousCredentials() + adc.return_value = (creds, None) + transport_class( + quota_project_id="octopus", + scopes=["1", "2"] + ) + + create_channel.assert_called_with( + "confidentialcomputing.googleapis.com:443", + credentials=creds, + credentials_file=None, + quota_project_id="octopus", + default_scopes=( + 'https://www.googleapis.com/auth/cloud-platform', +), + scopes=["1", "2"], + default_host="confidentialcomputing.googleapis.com", + ssl_credentials=None, + options=[ + ("grpc.max_send_message_length", -1), + ("grpc.max_receive_message_length", -1), + ], + ) + + +@pytest.mark.parametrize("transport_class", [transports.ConfidentialComputingGrpcTransport, transports.ConfidentialComputingGrpcAsyncIOTransport]) +def test_confidential_computing_grpc_transport_client_cert_source_for_mtls( + transport_class +): + cred = ga_credentials.AnonymousCredentials() + + # Check ssl_channel_credentials is used if provided. + with mock.patch.object(transport_class, "create_channel") as mock_create_channel: + mock_ssl_channel_creds = mock.Mock() + transport_class( + host="squid.clam.whelk", + credentials=cred, + ssl_channel_credentials=mock_ssl_channel_creds + ) + mock_create_channel.assert_called_once_with( + "squid.clam.whelk:443", + credentials=cred, + credentials_file=None, + scopes=None, + ssl_credentials=mock_ssl_channel_creds, + quota_project_id=None, + options=[ + ("grpc.max_send_message_length", -1), + ("grpc.max_receive_message_length", -1), + ], + ) + + # Check if ssl_channel_credentials is not provided, then client_cert_source_for_mtls + # is used. + with mock.patch.object(transport_class, "create_channel", return_value=mock.Mock()): + with mock.patch("grpc.ssl_channel_credentials") as mock_ssl_cred: + transport_class( + credentials=cred, + client_cert_source_for_mtls=client_cert_source_callback + ) + expected_cert, expected_key = client_cert_source_callback() + mock_ssl_cred.assert_called_once_with( + certificate_chain=expected_cert, + private_key=expected_key + ) + +def test_confidential_computing_http_transport_client_cert_source_for_mtls(): + cred = ga_credentials.AnonymousCredentials() + with mock.patch("google.auth.transport.requests.AuthorizedSession.configure_mtls_channel") as mock_configure_mtls_channel: + transports.ConfidentialComputingRestTransport ( + credentials=cred, + client_cert_source_for_mtls=client_cert_source_callback + ) + mock_configure_mtls_channel.assert_called_once_with(client_cert_source_callback) + + +@pytest.mark.parametrize("transport_name", [ + "grpc", + "grpc_asyncio", + "rest", +]) +def test_confidential_computing_host_no_port(transport_name): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + client_options=client_options.ClientOptions(api_endpoint='confidentialcomputing.googleapis.com'), + transport=transport_name, + ) + assert client.transport._host == ( + 'confidentialcomputing.googleapis.com:443' + if transport_name in ['grpc', 'grpc_asyncio'] + else 'https://confidentialcomputing.googleapis.com' + ) + +@pytest.mark.parametrize("transport_name", [ + "grpc", + "grpc_asyncio", + "rest", +]) +def test_confidential_computing_host_with_port(transport_name): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + client_options=client_options.ClientOptions(api_endpoint='confidentialcomputing.googleapis.com:8000'), + transport=transport_name, + ) + assert client.transport._host == ( + 'confidentialcomputing.googleapis.com:8000' + if transport_name in ['grpc', 'grpc_asyncio'] + else 'https://confidentialcomputing.googleapis.com:8000' + ) + +@pytest.mark.parametrize("transport_name", [ + "rest", +]) +def test_confidential_computing_client_transport_session_collision(transport_name): + creds1 = ga_credentials.AnonymousCredentials() + creds2 = ga_credentials.AnonymousCredentials() + client1 = ConfidentialComputingClient( + credentials=creds1, + transport=transport_name, + ) + client2 = ConfidentialComputingClient( + credentials=creds2, + transport=transport_name, + ) + session1 = client1.transport.create_challenge._session + session2 = client2.transport.create_challenge._session + assert session1 != session2 + session1 = client1.transport.verify_attestation._session + session2 = client2.transport.verify_attestation._session + assert session1 != session2 + session1 = client1.transport.verify_confidential_space._session + session2 = client2.transport.verify_confidential_space._session + assert session1 != session2 + session1 = client1.transport.verify_confidential_gke._session + session2 = client2.transport.verify_confidential_gke._session + assert session1 != session2 +def test_confidential_computing_grpc_transport_channel(): + channel = grpc.secure_channel('http://localhost/', grpc.local_channel_credentials()) + + # Check that channel is used if provided. + transport = transports.ConfidentialComputingGrpcTransport( + host="squid.clam.whelk", + channel=channel, + ) + assert transport.grpc_channel == channel + assert transport._host == "squid.clam.whelk:443" + assert transport._ssl_channel_credentials == None + + +def test_confidential_computing_grpc_asyncio_transport_channel(): + channel = aio.secure_channel('http://localhost/', grpc.local_channel_credentials()) + + # Check that channel is used if provided. + transport = transports.ConfidentialComputingGrpcAsyncIOTransport( + host="squid.clam.whelk", + channel=channel, + ) + assert transport.grpc_channel == channel + assert transport._host == "squid.clam.whelk:443" + assert transport._ssl_channel_credentials == None + + +# Remove this test when deprecated arguments (api_mtls_endpoint, client_cert_source) are +# removed from grpc/grpc_asyncio transport constructor. +@pytest.mark.parametrize("transport_class", [transports.ConfidentialComputingGrpcTransport, transports.ConfidentialComputingGrpcAsyncIOTransport]) +def test_confidential_computing_transport_channel_mtls_with_client_cert_source( + transport_class +): + with mock.patch("grpc.ssl_channel_credentials", autospec=True) as grpc_ssl_channel_cred: + with mock.patch.object(transport_class, "create_channel") as grpc_create_channel: + mock_ssl_cred = mock.Mock() + grpc_ssl_channel_cred.return_value = mock_ssl_cred + + mock_grpc_channel = mock.Mock() + grpc_create_channel.return_value = mock_grpc_channel + + cred = ga_credentials.AnonymousCredentials() + with pytest.warns(DeprecationWarning): + with mock.patch.object(google.auth, 'default') as adc: + adc.return_value = (cred, None) + transport = transport_class( + host="squid.clam.whelk", + api_mtls_endpoint="mtls.squid.clam.whelk", + client_cert_source=client_cert_source_callback, + ) + adc.assert_called_once() + + grpc_ssl_channel_cred.assert_called_once_with( + certificate_chain=b"cert bytes", private_key=b"key bytes" + ) + grpc_create_channel.assert_called_once_with( + "mtls.squid.clam.whelk:443", + credentials=cred, + credentials_file=None, + scopes=None, + ssl_credentials=mock_ssl_cred, + quota_project_id=None, + options=[ + ("grpc.max_send_message_length", -1), + ("grpc.max_receive_message_length", -1), + ], + ) + assert transport.grpc_channel == mock_grpc_channel + assert transport._ssl_channel_credentials == mock_ssl_cred + + +# Remove this test when deprecated arguments (api_mtls_endpoint, client_cert_source) are +# removed from grpc/grpc_asyncio transport constructor. +@pytest.mark.parametrize("transport_class", [transports.ConfidentialComputingGrpcTransport, transports.ConfidentialComputingGrpcAsyncIOTransport]) +def test_confidential_computing_transport_channel_mtls_with_adc( + transport_class +): + mock_ssl_cred = mock.Mock() + with mock.patch.multiple( + "google.auth.transport.grpc.SslCredentials", + __init__=mock.Mock(return_value=None), + ssl_credentials=mock.PropertyMock(return_value=mock_ssl_cred), + ): + with mock.patch.object(transport_class, "create_channel") as grpc_create_channel: + mock_grpc_channel = mock.Mock() + grpc_create_channel.return_value = mock_grpc_channel + mock_cred = mock.Mock() + + with pytest.warns(DeprecationWarning): + transport = transport_class( + host="squid.clam.whelk", + credentials=mock_cred, + api_mtls_endpoint="mtls.squid.clam.whelk", + client_cert_source=None, + ) + + grpc_create_channel.assert_called_once_with( + "mtls.squid.clam.whelk:443", + credentials=mock_cred, + credentials_file=None, + scopes=None, + ssl_credentials=mock_ssl_cred, + quota_project_id=None, + options=[ + ("grpc.max_send_message_length", -1), + ("grpc.max_receive_message_length", -1), + ], + ) + assert transport.grpc_channel == mock_grpc_channel + + +def test_challenge_path(): + project = "squid" + location = "clam" + uuid = "whelk" + expected = "projects/{project}/locations/{location}/challenges/{uuid}".format(project=project, location=location, uuid=uuid, ) + actual = ConfidentialComputingClient.challenge_path(project, location, uuid) + assert expected == actual + + +def test_parse_challenge_path(): + expected = { + "project": "octopus", + "location": "oyster", + "uuid": "nudibranch", + } + path = ConfidentialComputingClient.challenge_path(**expected) + + # Check that the path construction is reversible. + actual = ConfidentialComputingClient.parse_challenge_path(path) + assert expected == actual + +def test_common_billing_account_path(): + billing_account = "cuttlefish" + expected = "billingAccounts/{billing_account}".format(billing_account=billing_account, ) + actual = ConfidentialComputingClient.common_billing_account_path(billing_account) + assert expected == actual + + +def test_parse_common_billing_account_path(): + expected = { + "billing_account": "mussel", + } + path = ConfidentialComputingClient.common_billing_account_path(**expected) + + # Check that the path construction is reversible. + actual = ConfidentialComputingClient.parse_common_billing_account_path(path) + assert expected == actual + +def test_common_folder_path(): + folder = "winkle" + expected = "folders/{folder}".format(folder=folder, ) + actual = ConfidentialComputingClient.common_folder_path(folder) + assert expected == actual + + +def test_parse_common_folder_path(): + expected = { + "folder": "nautilus", + } + path = ConfidentialComputingClient.common_folder_path(**expected) + + # Check that the path construction is reversible. + actual = ConfidentialComputingClient.parse_common_folder_path(path) + assert expected == actual + +def test_common_organization_path(): + organization = "scallop" + expected = "organizations/{organization}".format(organization=organization, ) + actual = ConfidentialComputingClient.common_organization_path(organization) + assert expected == actual + + +def test_parse_common_organization_path(): + expected = { + "organization": "abalone", + } + path = ConfidentialComputingClient.common_organization_path(**expected) + + # Check that the path construction is reversible. + actual = ConfidentialComputingClient.parse_common_organization_path(path) + assert expected == actual + +def test_common_project_path(): + project = "squid" + expected = "projects/{project}".format(project=project, ) + actual = ConfidentialComputingClient.common_project_path(project) + assert expected == actual + + +def test_parse_common_project_path(): + expected = { + "project": "clam", + } + path = ConfidentialComputingClient.common_project_path(**expected) + + # Check that the path construction is reversible. + actual = ConfidentialComputingClient.parse_common_project_path(path) + assert expected == actual + +def test_common_location_path(): + project = "whelk" + location = "octopus" + expected = "projects/{project}/locations/{location}".format(project=project, location=location, ) + actual = ConfidentialComputingClient.common_location_path(project, location) + assert expected == actual + + +def test_parse_common_location_path(): + expected = { + "project": "oyster", + "location": "nudibranch", + } + path = ConfidentialComputingClient.common_location_path(**expected) + + # Check that the path construction is reversible. + actual = ConfidentialComputingClient.parse_common_location_path(path) + assert expected == actual + + +def test_client_with_default_client_info(): + client_info = gapic_v1.client_info.ClientInfo() + + with mock.patch.object(transports.ConfidentialComputingTransport, '_prep_wrapped_messages') as prep: + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + client_info=client_info, + ) + prep.assert_called_once_with(client_info) + + with mock.patch.object(transports.ConfidentialComputingTransport, '_prep_wrapped_messages') as prep: + transport_class = ConfidentialComputingClient.get_transport_class() + transport = transport_class( + credentials=ga_credentials.AnonymousCredentials(), + client_info=client_info, + ) + prep.assert_called_once_with(client_info) + + +def test_list_locations(transport: str = "grpc"): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), transport=transport, + ) + + # Everything is optional in proto3 as far as the runtime is concerned, + # and we are mocking out the actual API, so just send an empty request. + request = locations_pb2.ListLocationsRequest() + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object(type(client.transport.list_locations), "__call__") as call: + # Designate an appropriate return value for the call. + call.return_value = locations_pb2.ListLocationsResponse() + response = client.list_locations(request) + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the response is the type that we expect. + assert isinstance(response, locations_pb2.ListLocationsResponse) +@pytest.mark.asyncio +async def test_list_locations_async(transport: str = "grpc_asyncio"): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), transport=transport, + ) + + # Everything is optional in proto3 as far as the runtime is concerned, + # and we are mocking out the actual API, so just send an empty request. + request = locations_pb2.ListLocationsRequest() + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object(type(client.transport.list_locations), "__call__") as call: + # Designate an appropriate return value for the call. + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( + locations_pb2.ListLocationsResponse() + ) + response = await client.list_locations(request) + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the response is the type that we expect. + assert isinstance(response, locations_pb2.ListLocationsResponse) + +def test_list_locations_field_headers(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + ) + + # Any value that is part of the HTTP/1.1 URI should be sent as + # a field header. Set these to a non-empty value. + request = locations_pb2.ListLocationsRequest() + request.name = "locations" + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object(type(client.transport.list_locations), "__call__") as call: + call.return_value = locations_pb2.ListLocationsResponse() + + client.list_locations(request) + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the field header was sent. + _, _, kw = call.mock_calls[0] + assert ("x-goog-request-params", "name=locations",) in kw["metadata"] +@pytest.mark.asyncio +async def test_list_locations_field_headers_async(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + ) + + # Any value that is part of the HTTP/1.1 URI should be sent as + # a field header. Set these to a non-empty value. + request = locations_pb2.ListLocationsRequest() + request.name = "locations" + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object(type(client.transport.list_locations), "__call__") as call: + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( + locations_pb2.ListLocationsResponse() + ) + await client.list_locations(request) + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the field header was sent. + _, _, kw = call.mock_calls[0] + assert ("x-goog-request-params", "name=locations",) in kw["metadata"] + +def test_list_locations_from_dict(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + ) + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object(type(client.transport.list_locations), "__call__") as call: + # Designate an appropriate return value for the call. + call.return_value = locations_pb2.ListLocationsResponse() + + response = client.list_locations( + request={ + "name": "locations", + } + ) + call.assert_called() +@pytest.mark.asyncio +async def test_list_locations_from_dict_async(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + ) + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object(type(client.transport.list_locations), "__call__") as call: + # Designate an appropriate return value for the call. + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( + locations_pb2.ListLocationsResponse() + ) + response = await client.list_locations( + request={ + "name": "locations", + } + ) + call.assert_called() + + +def test_get_location(transport: str = "grpc"): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), transport=transport, + ) + + # Everything is optional in proto3 as far as the runtime is concerned, + # and we are mocking out the actual API, so just send an empty request. + request = locations_pb2.GetLocationRequest() + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object(type(client.transport.get_location), "__call__") as call: + # Designate an appropriate return value for the call. + call.return_value = locations_pb2.Location() + response = client.get_location(request) + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the response is the type that we expect. + assert isinstance(response, locations_pb2.Location) +@pytest.mark.asyncio +async def test_get_location_async(transport: str = "grpc_asyncio"): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), transport=transport, + ) + + # Everything is optional in proto3 as far as the runtime is concerned, + # and we are mocking out the actual API, so just send an empty request. + request = locations_pb2.GetLocationRequest() + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object(type(client.transport.get_location), "__call__") as call: + # Designate an appropriate return value for the call. + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( + locations_pb2.Location() + ) + response = await client.get_location(request) + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the response is the type that we expect. + assert isinstance(response, locations_pb2.Location) + +def test_get_location_field_headers(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials()) + + # Any value that is part of the HTTP/1.1 URI should be sent as + # a field header. Set these to a non-empty value. + request = locations_pb2.GetLocationRequest() + request.name = "locations/abc" + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object(type(client.transport.get_location), "__call__") as call: + call.return_value = locations_pb2.Location() + + client.get_location(request) + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the field header was sent. + _, _, kw = call.mock_calls[0] + assert ("x-goog-request-params", "name=locations/abc",) in kw["metadata"] +@pytest.mark.asyncio +async def test_get_location_field_headers_async(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials() + ) + + # Any value that is part of the HTTP/1.1 URI should be sent as + # a field header. Set these to a non-empty value. + request = locations_pb2.GetLocationRequest() + request.name = "locations/abc" + + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object(type(client.transport.get_location), "__call__") as call: + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( + locations_pb2.Location() + ) + await client.get_location(request) + # Establish that the underlying gRPC stub method was called. + assert len(call.mock_calls) == 1 + _, args, _ = call.mock_calls[0] + assert args[0] == request + + # Establish that the field header was sent. + _, _, kw = call.mock_calls[0] + assert ("x-goog-request-params", "name=locations/abc",) in kw["metadata"] + +def test_get_location_from_dict(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + ) + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object(type(client.transport.list_locations), "__call__") as call: + # Designate an appropriate return value for the call. + call.return_value = locations_pb2.Location() + + response = client.get_location( + request={ + "name": "locations/abc", + } + ) + call.assert_called() +@pytest.mark.asyncio +async def test_get_location_from_dict_async(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + ) + # Mock the actual call within the gRPC stub, and fake the request. + with mock.patch.object(type(client.transport.list_locations), "__call__") as call: + # Designate an appropriate return value for the call. + call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( + locations_pb2.Location() + ) + response = await client.get_location( + request={ + "name": "locations", + } + ) + call.assert_called() + + +def test_transport_close_grpc(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="grpc" + ) + with mock.patch.object(type(getattr(client.transport, "_grpc_channel")), "close") as close: + with client: + close.assert_not_called() + close.assert_called_once() + + +@pytest.mark.asyncio +async def test_transport_close_grpc_asyncio(): + client = ConfidentialComputingAsyncClient( + credentials=async_anonymous_credentials(), + transport="grpc_asyncio" + ) + with mock.patch.object(type(getattr(client.transport, "_grpc_channel")), "close") as close: + async with client: + close.assert_not_called() + close.assert_called_once() + + +def test_transport_close_rest(): + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport="rest" + ) + with mock.patch.object(type(getattr(client.transport, "_session")), "close") as close: + with client: + close.assert_not_called() + close.assert_called_once() + + +def test_client_ctx(): + transports = [ + 'rest', + 'grpc', + ] + for transport in transports: + client = ConfidentialComputingClient( + credentials=ga_credentials.AnonymousCredentials(), + transport=transport + ) + # Test client calls underlying transport. + with mock.patch.object(type(client.transport), "close") as close: + close.assert_not_called() + with client: + pass + close.assert_called() + +@pytest.mark.parametrize("client_class,transport_class", [ + (ConfidentialComputingClient, transports.ConfidentialComputingGrpcTransport), + (ConfidentialComputingAsyncClient, transports.ConfidentialComputingGrpcAsyncIOTransport), +]) +def test_api_key_credentials(client_class, transport_class): + with mock.patch.object( + google.auth._default, "get_api_key_credentials", create=True + ) as get_api_key_credentials: + mock_cred = mock.Mock() + get_api_key_credentials.return_value = mock_cred + options = client_options.ClientOptions() + options.api_key = "api_key" + with mock.patch.object(transport_class, "__init__") as patched: + patched.return_value = None + client = client_class(client_options=options) + patched.assert_called_once_with( + credentials=mock_cred, + credentials_file=None, + host=client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE), + scopes=None, + client_cert_source_for_mtls=None, + quota_project_id=None, + client_info=transports.base.DEFAULT_CLIENT_INFO, + always_use_jwt_access=True, + api_audience=None, + ) From 3218eefc7a7b926c076bf75bf7e040c7bbb237fd Mon Sep 17 00:00:00 2001 From: Owl Bot Date: Tue, 2 Sep 2025 20:29:36 +0000 Subject: [PATCH 4/4] =?UTF-8?q?=F0=9F=A6=89=20Updates=20from=20OwlBot=20po?= =?UTF-8?q?st-processor?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md --- .../v1/.coveragerc | 13 - .../v1/.flake8 | 34 - .../v1/LICENSE | 202 - .../v1/MANIFEST.in | 20 - .../v1/README.rst | 143 - .../v1/docs/_static/custom.css | 20 - .../v1/docs/_templates/layout.html | 50 - .../v1/docs/conf.py | 385 -- .../confidential_computing.rst | 6 - .../confidentialcomputing_v1/services_.rst | 6 - .../docs/confidentialcomputing_v1/types_.rst | 6 - .../v1/docs/index.rst | 10 - .../v1/docs/multiprocessing.rst | 7 - .../cloud/confidentialcomputing/__init__.py | 71 - .../confidentialcomputing/gapic_version.py | 16 - .../cloud/confidentialcomputing/py.typed | 2 - .../confidentialcomputing_v1/__init__.py | 72 - .../gapic_metadata.json | 88 - .../confidentialcomputing_v1/gapic_version.py | 16 - .../cloud/confidentialcomputing_v1/py.typed | 2 - .../services/__init__.py | 15 - .../confidential_computing/__init__.py | 22 - .../confidential_computing/async_client.py | 760 --- .../services/confidential_computing/client.py | 1123 ----- .../transports/README.rst | 9 - .../transports/__init__.py | 38 - .../confidential_computing/transports/base.py | 264 -- .../confidential_computing/transports/grpc.py | 465 -- .../transports/grpc_asyncio.py | 547 --- .../confidential_computing/transports/rest.py | 1179 ----- .../transports/rest_base.py | 330 -- .../types/__init__.py | 64 - .../confidentialcomputing_v1/types/service.py | 915 ---- .../v1/mypy.ini | 3 - .../v1/noxfile.py | 591 --- ...ential_computing_create_challenge_async.py | 52 - ...dential_computing_create_challenge_sync.py | 52 - ...tial_computing_verify_attestation_async.py | 52 - ...ntial_computing_verify_attestation_sync.py | 52 - ...computing_verify_confidential_gke_async.py | 52 - ..._computing_verify_confidential_gke_sync.py | 52 - ...mputing_verify_confidential_space_async.py | 52 - ...omputing_verify_confidential_space_sync.py | 52 - ...google.cloud.confidentialcomputing.v1.json | 643 --- ...fixup_confidentialcomputing_v1_keywords.py | 179 - .../v1/setup.py | 98 - .../v1/testing/constraints-3.10.txt | 6 - .../v1/testing/constraints-3.11.txt | 6 - .../v1/testing/constraints-3.12.txt | 6 - .../v1/testing/constraints-3.13.txt | 11 - .../v1/testing/constraints-3.7.txt | 10 - .../v1/testing/constraints-3.8.txt | 6 - .../v1/testing/constraints-3.9.txt | 6 - .../v1/tests/__init__.py | 16 - .../v1/tests/unit/__init__.py | 16 - .../v1/tests/unit/gapic/__init__.py | 16 - .../confidentialcomputing_v1/__init__.py | 16 - .../test_confidential_computing.py | 4165 ----------------- .../confidentialcomputing_v1/types/service.py | 4 +- .../noxfile.py | 5 +- 60 files changed, 5 insertions(+), 13114 deletions(-) delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/.coveragerc delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/.flake8 delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/LICENSE delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/MANIFEST.in delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/README.rst delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/_static/custom.css delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/_templates/layout.html delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/conf.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/confidential_computing.rst delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/services_.rst delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/types_.rst delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/index.rst delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/multiprocessing.rst delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/__init__.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/gapic_version.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/py.typed delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/__init__.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/gapic_metadata.json delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/gapic_version.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/py.typed delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/__init__.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/__init__.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/async_client.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/client.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/README.rst delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/__init__.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/base.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc_asyncio.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest_base.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/types/__init__.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/types/service.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/mypy.ini delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/noxfile.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_create_challenge_async.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_create_challenge_sync.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_attestation_async.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_attestation_sync.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_async.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_sync.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_async.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_sync.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/snippet_metadata_google.cloud.confidentialcomputing.v1.json delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/scripts/fixup_confidentialcomputing_v1_keywords.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/setup.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.10.txt delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.11.txt delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.12.txt delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.13.txt delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.7.txt delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.8.txt delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.9.txt delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/__init__.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/__init__.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/__init__.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/confidentialcomputing_v1/__init__.py delete mode 100644 owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/confidentialcomputing_v1/test_confidential_computing.py diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/.coveragerc b/owl-bot-staging/google-cloud-confidentialcomputing/v1/.coveragerc deleted file mode 100644 index ecca1f30bedc..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/.coveragerc +++ /dev/null @@ -1,13 +0,0 @@ -[run] -branch = True - -[report] -show_missing = True -omit = - google/cloud/confidentialcomputing/__init__.py - google/cloud/confidentialcomputing/gapic_version.py -exclude_lines = - # Re-enable the standard pragma - pragma: NO COVER - # Ignore debug-only repr - def __repr__ diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/.flake8 b/owl-bot-staging/google-cloud-confidentialcomputing/v1/.flake8 deleted file mode 100644 index 90316de21489..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/.flake8 +++ /dev/null @@ -1,34 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -[flake8] -# TODO(https://github.com/googleapis/gapic-generator-python/issues/2333): -# Resolve flake8 lint issues -ignore = E203, E231, E266, E501, W503 -exclude = - # TODO(https://github.com/googleapis/gapic-generator-python/issues/2333): - # Ensure that generated code passes flake8 lint - **/gapic/** - **/services/** - **/types/** - # Exclude Protobuf gencode - *_pb2.py - - # Standard linting exemptions. - **/.nox/** - __pycache__, - .git, - *.pyc, - conf.py diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/LICENSE b/owl-bot-staging/google-cloud-confidentialcomputing/v1/LICENSE deleted file mode 100644 index d64569567334..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/LICENSE +++ /dev/null @@ -1,202 +0,0 @@ - - Apache License - Version 2.0, January 2004 - http://www.apache.org/licenses/ - - TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION - - 1. Definitions. - - "License" shall mean the terms and conditions for use, reproduction, - and distribution as defined by Sections 1 through 9 of this document. - - "Licensor" shall mean the copyright owner or entity authorized by - the copyright owner that is granting the License. - - "Legal Entity" shall mean the union of the acting entity and all - other entities that control, are controlled by, or are under common - control with that entity. For the purposes of this definition, - "control" means (i) the power, direct or indirect, to cause the - direction or management of such entity, whether by contract or - otherwise, or (ii) ownership of fifty percent (50%) or more of the - outstanding shares, or (iii) beneficial ownership of such entity. - - "You" (or "Your") shall mean an individual or Legal Entity - exercising permissions granted by this License. - - "Source" form shall mean the preferred form for making modifications, - including but not limited to software source code, documentation - source, and configuration files. - - "Object" form shall mean any form resulting from mechanical - transformation or translation of a Source form, including but - not limited to compiled object code, generated documentation, - and conversions to other media types. - - "Work" shall mean the work of authorship, whether in Source or - Object form, made available under the License, as indicated by a - copyright notice that is included in or attached to the work - (an example is provided in the Appendix below). - - "Derivative Works" shall mean any work, whether in Source or Object - form, that is based on (or derived from) the Work and for which the - editorial revisions, annotations, elaborations, or other modifications - represent, as a whole, an original work of authorship. For the purposes - of this License, Derivative Works shall not include works that remain - separable from, or merely link (or bind by name) to the interfaces of, - the Work and Derivative Works thereof. - - "Contribution" shall mean any work of authorship, including - the original version of the Work and any modifications or additions - to that Work or Derivative Works thereof, that is intentionally - submitted to Licensor for inclusion in the Work by the copyright owner - or by an individual or Legal Entity authorized to submit on behalf of - the copyright owner. For the purposes of this definition, "submitted" - means any form of electronic, verbal, or written communication sent - to the Licensor or its representatives, including but not limited to - communication on electronic mailing lists, source code control systems, - and issue tracking systems that are managed by, or on behalf of, the - Licensor for the purpose of discussing and improving the Work, but - excluding communication that is conspicuously marked or otherwise - designated in writing by the copyright owner as "Not a Contribution." - - "Contributor" shall mean Licensor and any individual or Legal Entity - on behalf of whom a Contribution has been received by Licensor and - subsequently incorporated within the Work. - - 2. Grant of Copyright License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - copyright license to reproduce, prepare Derivative Works of, - publicly display, publicly perform, sublicense, and distribute the - Work and such Derivative Works in Source or Object form. - - 3. Grant of Patent License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - (except as stated in this section) patent license to make, have made, - use, offer to sell, sell, import, and otherwise transfer the Work, - where such license applies only to those patent claims licensable - by such Contributor that are necessarily infringed by their - Contribution(s) alone or by combination of their Contribution(s) - with the Work to which such Contribution(s) was submitted. If You - institute patent litigation against any entity (including a - cross-claim or counterclaim in a lawsuit) alleging that the Work - or a Contribution incorporated within the Work constitutes direct - or contributory patent infringement, then any patent licenses - granted to You under this License for that Work shall terminate - as of the date such litigation is filed. - - 4. Redistribution. You may reproduce and distribute copies of the - Work or Derivative Works thereof in any medium, with or without - modifications, and in Source or Object form, provided that You - meet the following conditions: - - (a) You must give any other recipients of the Work or - Derivative Works a copy of this License; and - - (b) You must cause any modified files to carry prominent notices - stating that You changed the files; and - - (c) You must retain, in the Source form of any Derivative Works - that You distribute, all copyright, patent, trademark, and - attribution notices from the Source form of the Work, - excluding those notices that do not pertain to any part of - the Derivative Works; and - - (d) If the Work includes a "NOTICE" text file as part of its - distribution, then any Derivative Works that You distribute must - include a readable copy of the attribution notices contained - within such NOTICE file, excluding those notices that do not - pertain to any part of the Derivative Works, in at least one - of the following places: within a NOTICE text file distributed - as part of the Derivative Works; within the Source form or - documentation, if provided along with the Derivative Works; or, - within a display generated by the Derivative Works, if and - wherever such third-party notices normally appear. The contents - of the NOTICE file are for informational purposes only and - do not modify the License. You may add Your own attribution - notices within Derivative Works that You distribute, alongside - or as an addendum to the NOTICE text from the Work, provided - that such additional attribution notices cannot be construed - as modifying the License. - - You may add Your own copyright statement to Your modifications and - may provide additional or different license terms and conditions - for use, reproduction, or distribution of Your modifications, or - for any such Derivative Works as a whole, provided Your use, - reproduction, and distribution of the Work otherwise complies with - the conditions stated in this License. - - 5. Submission of Contributions. Unless You explicitly state otherwise, - any Contribution intentionally submitted for inclusion in the Work - by You to the Licensor shall be under the terms and conditions of - this License, without any additional terms or conditions. - Notwithstanding the above, nothing herein shall supersede or modify - the terms of any separate license agreement you may have executed - with Licensor regarding such Contributions. - - 6. Trademarks. This License does not grant permission to use the trade - names, trademarks, service marks, or product names of the Licensor, - except as required for reasonable and customary use in describing the - origin of the Work and reproducing the content of the NOTICE file. - - 7. Disclaimer of Warranty. Unless required by applicable law or - agreed to in writing, Licensor provides the Work (and each - Contributor provides its Contributions) on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - implied, including, without limitation, any warranties or conditions - of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A - PARTICULAR PURPOSE. You are solely responsible for determining the - appropriateness of using or redistributing the Work and assume any - risks associated with Your exercise of permissions under this License. - - 8. Limitation of Liability. In no event and under no legal theory, - whether in tort (including negligence), contract, or otherwise, - unless required by applicable law (such as deliberate and grossly - negligent acts) or agreed to in writing, shall any Contributor be - liable to You for damages, including any direct, indirect, special, - incidental, or consequential damages of any character arising as a - result of this License or out of the use or inability to use the - Work (including but not limited to damages for loss of goodwill, - work stoppage, computer failure or malfunction, or any and all - other commercial damages or losses), even if such Contributor - has been advised of the possibility of such damages. - - 9. Accepting Warranty or Additional Liability. While redistributing - the Work or Derivative Works thereof, You may choose to offer, - and charge a fee for, acceptance of support, warranty, indemnity, - or other liability obligations and/or rights consistent with this - License. However, in accepting such obligations, You may act only - on Your own behalf and on Your sole responsibility, not on behalf - of any other Contributor, and only if You agree to indemnify, - defend, and hold each Contributor harmless for any liability - incurred by, or claims asserted against, such Contributor by reason - of your accepting any such warranty or additional liability. - - END OF TERMS AND CONDITIONS - - APPENDIX: How to apply the Apache License to your work. - - To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "[]" - replaced with your own identifying information. (Don't include - the brackets!) The text should be enclosed in the appropriate - comment syntax for the file format. We also recommend that a - file or class name and description of purpose be included on the - same "printed page" as the copyright notice for easier - identification within third-party archives. - - Copyright [yyyy] [name of copyright owner] - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/MANIFEST.in b/owl-bot-staging/google-cloud-confidentialcomputing/v1/MANIFEST.in deleted file mode 100644 index dae249ec8976..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/MANIFEST.in +++ /dev/null @@ -1,20 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -include README.rst LICENSE -recursive-include google *.py *.pyi *.json *.proto py.typed -recursive-include tests * -global-exclude *.py[co] -global-exclude __pycache__ diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/README.rst b/owl-bot-staging/google-cloud-confidentialcomputing/v1/README.rst deleted file mode 100644 index 593004344023..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/README.rst +++ /dev/null @@ -1,143 +0,0 @@ -Python Client for Google Cloud Confidentialcomputing API -================================================= - -Quick Start ------------ - -In order to use this library, you first need to go through the following steps: - -1. `Select or create a Cloud Platform project.`_ -2. `Enable billing for your project.`_ -3. Enable the Google Cloud Confidentialcomputing API. -4. `Setup Authentication.`_ - -.. _Select or create a Cloud Platform project.: https://console.cloud.google.com/project -.. _Enable billing for your project.: https://cloud.google.com/billing/docs/how-to/modify-project#enable_billing_for_a_project -.. _Setup Authentication.: https://googleapis.dev/python/google-api-core/latest/auth.html - -Installation -~~~~~~~~~~~~ - -Install this library in a `virtualenv`_ using pip. `virtualenv`_ is a tool to -create isolated Python environments. The basic problem it addresses is one of -dependencies and versions, and indirectly permissions. - -With `virtualenv`_, it's possible to install this library without needing system -install permissions, and without clashing with the installed system -dependencies. - -.. _`virtualenv`: https://virtualenv.pypa.io/en/latest/ - - -Mac/Linux -^^^^^^^^^ - -.. code-block:: console - - python3 -m venv - source /bin/activate - /bin/pip install /path/to/library - - -Windows -^^^^^^^ - -.. code-block:: console - - python3 -m venv - \Scripts\activate - \Scripts\pip.exe install \path\to\library - - -Logging -------- - -This library uses the standard Python :code:`logging` functionality to log some RPC events that could be of interest for debugging and monitoring purposes. -Note the following: - -#. Logs may contain sensitive information. Take care to **restrict access to the logs** if they are saved, whether it be on local storage or on Google Cloud Logging. -#. Google may refine the occurrence, level, and content of various log messages in this library without flagging such changes as breaking. **Do not depend on immutability of the logging events**. -#. By default, the logging events from this library are not handled. You must **explicitly configure log handling** using one of the mechanisms below. - - -Simple, environment-based configuration -~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -To enable logging for this library without any changes in your code, set the :code:`GOOGLE_SDK_PYTHON_LOGGING_SCOPE` environment variable to a valid Google -logging scope. This configures handling of logging events (at level :code:`logging.DEBUG` or higher) from this library in a default manner, emitting the logged -messages in a structured format. It does not currently allow customizing the logging levels captured nor the handlers, formatters, etc. used for any logging -event. - -A logging scope is a period-separated namespace that begins with :code:`google`, identifying the Python module or package to log. - -- Valid logging scopes: :code:`google`, :code:`google.cloud.asset.v1`, :code:`google.api`, :code:`google.auth`, etc. -- Invalid logging scopes: :code:`foo`, :code:`123`, etc. - -**NOTE**: If the logging scope is invalid, the library does not set up any logging handlers. - - -Examples -^^^^^^^^ - -- Enabling the default handler for all Google-based loggers - -.. code-block:: console - - export GOOGLE_SDK_PYTHON_LOGGING_SCOPE=google - -- Enabling the default handler for a specific Google module (for a client library called :code:`library_v1`): - -.. code-block:: console - - export GOOGLE_SDK_PYTHON_LOGGING_SCOPE=google.cloud.library_v1 - - -Advanced, code-based configuration -~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -You can also configure a valid logging scope using Python's standard `logging` mechanism. - - -Examples -^^^^^^^^ - -- Configuring a handler for all Google-based loggers - -.. code-block:: python - - import logging - - from google.cloud.translate_v3 import translate - - base_logger = logging.getLogger("google") - base_logger.addHandler(logging.StreamHandler()) - base_logger.setLevel(logging.DEBUG) - -- Configuring a handler for a specific Google module (for a client library called :code:`library_v1`): - -.. code-block:: python - - import logging - - from google.cloud.translate_v3 import translate - - base_logger = logging.getLogger("google.cloud.library_v1") - base_logger.addHandler(logging.StreamHandler()) - base_logger.setLevel(logging.DEBUG) - - -Logging details -~~~~~~~~~~~~~~~ - -#. Regardless of which of the mechanisms above you use to configure logging for this library, by default logging events are not propagated up to the root - logger from the `google`-level logger. If you need the events to be propagated to the root logger, you must explicitly set - :code:`logging.getLogger("google").propagate = True` in your code. -#. You can mix the different logging configurations above for different Google modules. For example, you may want use a code-based logging configuration for - one library, but decide you need to also set up environment-based logging configuration for another library. - - #. If you attempt to use both code-based and environment-based configuration for the same module, the environment-based configuration will be ineffectual - if the code -based configuration gets applied first. - -#. The Google-specific logging configurations (default handlers for environment-based configuration; not propagating logging events to the root logger) get - executed the first time *any* client library is instantiated in your application, and only if the affected loggers have not been previously configured. - (This is the reason for 2.i. above.) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/_static/custom.css b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/_static/custom.css deleted file mode 100644 index b0a295464b23..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/_static/custom.css +++ /dev/null @@ -1,20 +0,0 @@ -div#python2-eol { - border-color: red; - border-width: medium; -} - -/* Ensure minimum width for 'Parameters' / 'Returns' column */ -dl.field-list > dt { - min-width: 100px -} - -/* Insert space between methods for readability */ -dl.method { - padding-top: 10px; - padding-bottom: 10px -} - -/* Insert empty space between classes */ -dl.class { - padding-bottom: 50px -} diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/_templates/layout.html b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/_templates/layout.html deleted file mode 100644 index 95e9c77fcfe1..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/_templates/layout.html +++ /dev/null @@ -1,50 +0,0 @@ - -{% extends "!layout.html" %} -{%- block content %} -{%- if theme_fixed_sidebar|lower == 'true' %} -
- {{ sidebar() }} - {%- block document %} -
- {%- if render_sidebar %} -
- {%- endif %} - - {%- block relbar_top %} - {%- if theme_show_relbar_top|tobool %} -
-   - {{- rellink_markup () }} -
- {%- endif %} - {% endblock %} - -
-
- As of January 1, 2020 this library no longer supports Python 2 on the latest released version. - Library versions released prior to that date will continue to be available. For more information please - visit Python 2 support on Google Cloud. -
- {% block body %} {% endblock %} -
- - {%- block relbar_bottom %} - {%- if theme_show_relbar_bottom|tobool %} -
-   - {{- rellink_markup () }} -
- {%- endif %} - {% endblock %} - - {%- if render_sidebar %} -
- {%- endif %} -
- {%- endblock %} -
-
-{%- else %} -{{ super() }} -{%- endif %} -{%- endblock %} diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/conf.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/conf.py deleted file mode 100644 index e25ab393e702..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/conf.py +++ /dev/null @@ -1,385 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -# -# google-cloud-confidentialcomputing documentation build configuration file -# -# This file is execfile()d with the current directory set to its -# containing dir. -# -# Note that not all possible configuration values are present in this -# autogenerated file. -# -# All configuration values have a default; values that are commented out -# serve to show the default. - -import sys -import os -import shlex - -# If extensions (or modules to document with autodoc) are in another directory, -# add these directories to sys.path here. If the directory is relative to the -# documentation root, use os.path.abspath to make it absolute, like shown here. -sys.path.insert(0, os.path.abspath("..")) - -# For plugins that can not read conf.py. -# See also: https://github.com/docascode/sphinx-docfx-yaml/issues/85 -sys.path.insert(0, os.path.abspath(".")) - -__version__ = "" - -# -- General configuration ------------------------------------------------ - -# If your documentation needs a minimal Sphinx version, state it here. -needs_sphinx = "4.5.0" - -# Add any Sphinx extension module names here, as strings. They can be -# extensions coming with Sphinx (named 'sphinx.ext.*') or your custom -# ones. -extensions = [ - "sphinx.ext.autodoc", - "sphinx.ext.autosummary", - "sphinx.ext.intersphinx", - "sphinx.ext.coverage", - "sphinx.ext.doctest", - "sphinx.ext.napoleon", - "sphinx.ext.todo", - "sphinx.ext.viewcode", - "recommonmark", -] - -# autodoc/autosummary flags -autoclass_content = "both" -autodoc_default_options = {"members": True} -autosummary_generate = True - - -# Add any paths that contain templates here, relative to this directory. -templates_path = ["_templates"] - -# The suffix(es) of source filenames. -# You can specify multiple suffix as a list of string: -# source_suffix = ['.rst', '.md'] -source_suffix = [".rst", ".md"] - -# The encoding of source files. -# source_encoding = 'utf-8-sig' - -# The root toctree document. -root_doc = "index" - -# General information about the project. -project = u"google-cloud-confidentialcomputing" -copyright = u"2025, Google, LLC" -author = u"Google APIs" - -# The version info for the project you're documenting, acts as replacement for -# |version| and |release|, also used in various other places throughout the -# built documents. -# -# The full version, including alpha/beta/rc tags. -release = __version__ -# The short X.Y version. -version = ".".join(release.split(".")[0:2]) - -# The language for content autogenerated by Sphinx. Refer to documentation -# for a list of supported languages. -# -# This is also used if you do content translation via gettext catalogs. -# Usually you set "language" from the command line for these cases. -language = None - -# There are two options for replacing |today|: either, you set today to some -# non-false value, then it is used: -# today = '' -# Else, today_fmt is used as the format for a strftime call. -# today_fmt = '%B %d, %Y' - -# List of patterns, relative to source directory, that match files and -# directories to ignore when looking for source files. -exclude_patterns = [ - "_build", - "**/.nox/**/*", - "samples/AUTHORING_GUIDE.md", - "samples/CONTRIBUTING.md", - "samples/snippets/README.rst", -] - -# The reST default role (used for this markup: `text`) to use for all -# documents. -# default_role = None - -# If true, '()' will be appended to :func: etc. cross-reference text. -# add_function_parentheses = True - -# If true, the current module name will be prepended to all description -# unit titles (such as .. function::). -# add_module_names = True - -# If true, sectionauthor and moduleauthor directives will be shown in the -# output. They are ignored by default. -# show_authors = False - -# The name of the Pygments (syntax highlighting) style to use. -pygments_style = "sphinx" - -# A list of ignored prefixes for module index sorting. -# modindex_common_prefix = [] - -# If true, keep warnings as "system message" paragraphs in the built documents. -# keep_warnings = False - -# If true, `todo` and `todoList` produce output, else they produce nothing. -todo_include_todos = True - - -# -- Options for HTML output ---------------------------------------------- - -# The theme to use for HTML and HTML Help pages. See the documentation for -# a list of builtin themes. -html_theme = "alabaster" - -# Theme options are theme-specific and customize the look and feel of a theme -# further. For a list of options available for each theme, see the -# documentation. -html_theme_options = { - "description": "Google Cloud Client Libraries for google-cloud-confidentialcomputing", - "github_user": "googleapis", - "github_repo": "google-cloud-python", - "github_banner": True, - "font_family": "'Roboto', Georgia, sans", - "head_font_family": "'Roboto', Georgia, serif", - "code_font_family": "'Roboto Mono', 'Consolas', monospace", -} - -# Add any paths that contain custom themes here, relative to this directory. -# html_theme_path = [] - -# The name for this set of Sphinx documents. If None, it defaults to -# " v documentation". -# html_title = None - -# A shorter title for the navigation bar. Default is the same as html_title. -# html_short_title = None - -# The name of an image file (relative to this directory) to place at the top -# of the sidebar. -# html_logo = None - -# The name of an image file (within the static path) to use as favicon of the -# docs. This file should be a Windows icon file (.ico) being 16x16 or 32x32 -# pixels large. -# html_favicon = None - -# Add any paths that contain custom static files (such as style sheets) here, -# relative to this directory. They are copied after the builtin static files, -# so a file named "default.css" will overwrite the builtin "default.css". -html_static_path = ["_static"] - -# Add any extra paths that contain custom files (such as robots.txt or -# .htaccess) here, relative to this directory. These files are copied -# directly to the root of the documentation. -# html_extra_path = [] - -# If not '', a 'Last updated on:' timestamp is inserted at every page bottom, -# using the given strftime format. -# html_last_updated_fmt = '%b %d, %Y' - -# If true, SmartyPants will be used to convert quotes and dashes to -# typographically correct entities. -# html_use_smartypants = True - -# Custom sidebar templates, maps document names to template names. -# html_sidebars = {} - -# Additional templates that should be rendered to pages, maps page names to -# template names. -# html_additional_pages = {} - -# If false, no module index is generated. -# html_domain_indices = True - -# If false, no index is generated. -# html_use_index = True - -# If true, the index is split into individual pages for each letter. -# html_split_index = False - -# If true, links to the reST sources are added to the pages. -# html_show_sourcelink = True - -# If true, "Created using Sphinx" is shown in the HTML footer. Default is True. -# html_show_sphinx = True - -# If true, "(C) Copyright ..." is shown in the HTML footer. Default is True. -# html_show_copyright = True - -# If true, an OpenSearch description file will be output, and all pages will -# contain a tag referring to it. The value of this option must be the -# base URL from which the finished HTML is served. -# html_use_opensearch = '' - -# This is the file name suffix for HTML files (e.g. ".xhtml"). -# html_file_suffix = None - -# Language to be used for generating the HTML full-text search index. -# Sphinx supports the following languages: -# 'da', 'de', 'en', 'es', 'fi', 'fr', 'hu', 'it', 'ja' -# 'nl', 'no', 'pt', 'ro', 'ru', 'sv', 'tr' -# html_search_language = 'en' - -# A dictionary with options for the search language support, empty by default. -# Now only 'ja' uses this config value -# html_search_options = {'type': 'default'} - -# The name of a javascript file (relative to the configuration directory) that -# implements a search results scorer. If empty, the default will be used. -# html_search_scorer = 'scorer.js' - -# Output file base name for HTML help builder. -htmlhelp_basename = "google-cloud-confidentialcomputing-doc" - -# -- Options for warnings ------------------------------------------------------ - - -suppress_warnings = [ - # Temporarily suppress this to avoid "more than one target found for - # cross-reference" warning, which are intractable for us to avoid while in - # a mono-repo. - # See https://github.com/sphinx-doc/sphinx/blob - # /2a65ffeef5c107c19084fabdd706cdff3f52d93c/sphinx/domains/python.py#L843 - "ref.python" -] - -# -- Options for LaTeX output --------------------------------------------- - -latex_elements = { - # The paper size ('letterpaper' or 'a4paper'). - # 'papersize': 'letterpaper', - # The font size ('10pt', '11pt' or '12pt'). - # 'pointsize': '10pt', - # Additional stuff for the LaTeX preamble. - # 'preamble': '', - # Latex figure (float) alignment - # 'figure_align': 'htbp', -} - -# Grouping the document tree into LaTeX files. List of tuples -# (source start file, target name, title, -# author, documentclass [howto, manual, or own class]). -latex_documents = [ - ( - root_doc, - "google-cloud-confidentialcomputing.tex", - u"google-cloud-confidentialcomputing Documentation", - author, - "manual", - ) -] - -# The name of an image file (relative to this directory) to place at the top of -# the title page. -# latex_logo = None - -# For "manual" documents, if this is true, then toplevel headings are parts, -# not chapters. -# latex_use_parts = False - -# If true, show page references after internal links. -# latex_show_pagerefs = False - -# If true, show URL addresses after external links. -# latex_show_urls = False - -# Documents to append as an appendix to all manuals. -# latex_appendices = [] - -# If false, no module index is generated. -# latex_domain_indices = True - - -# -- Options for manual page output --------------------------------------- - -# One entry per manual page. List of tuples -# (source start file, name, description, authors, manual section). -man_pages = [ - ( - root_doc, - "google-cloud-confidentialcomputing", - "google-cloud-confidentialcomputing Documentation", - [author], - 1, - ) -] - -# If true, show URL addresses after external links. -# man_show_urls = False - - -# -- Options for Texinfo output ------------------------------------------- - -# Grouping the document tree into Texinfo files. List of tuples -# (source start file, target name, title, author, -# dir menu entry, description, category) -texinfo_documents = [ - ( - root_doc, - "google-cloud-confidentialcomputing", - "google-cloud-confidentialcomputing Documentation", - author, - "google-cloud-confidentialcomputing", - "google-cloud-confidentialcomputing Library", - "APIs", - ) -] - -# Documents to append as an appendix to all manuals. -# texinfo_appendices = [] - -# If false, no module index is generated. -# texinfo_domain_indices = True - -# How to display URL addresses: 'footnote', 'no', or 'inline'. -# texinfo_show_urls = 'footnote' - -# If true, do not generate a @detailmenu in the "Top" node's menu. -# texinfo_no_detailmenu = False - - -# Example configuration for intersphinx: refer to the Python standard library. -intersphinx_mapping = { - "python": ("https://python.readthedocs.org/en/latest/", None), - "google-auth": ("https://googleapis.dev/python/google-auth/latest/", None), - "google.api_core": ( - "https://googleapis.dev/python/google-api-core/latest/", - None, - ), - "grpc": ("https://grpc.github.io/grpc/python/", None), - "proto-plus": ("https://proto-plus-python.readthedocs.io/en/latest/", None), - "protobuf": ("https://googleapis.dev/python/protobuf/latest/", None), -} - - -# Napoleon settings -napoleon_google_docstring = True -napoleon_numpy_docstring = True -napoleon_include_private_with_doc = False -napoleon_include_special_with_doc = True -napoleon_use_admonition_for_examples = False -napoleon_use_admonition_for_notes = False -napoleon_use_admonition_for_references = False -napoleon_use_ivar = False -napoleon_use_param = True -napoleon_use_rtype = True diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/confidential_computing.rst b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/confidential_computing.rst deleted file mode 100644 index 06d7e01926a9..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/confidential_computing.rst +++ /dev/null @@ -1,6 +0,0 @@ -ConfidentialComputing ---------------------------------------- - -.. automodule:: google.cloud.confidentialcomputing_v1.services.confidential_computing - :members: - :inherited-members: diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/services_.rst b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/services_.rst deleted file mode 100644 index 0e44260b2eae..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/services_.rst +++ /dev/null @@ -1,6 +0,0 @@ -Services for Google Cloud Confidentialcomputing v1 API -====================================================== -.. toctree:: - :maxdepth: 2 - - confidential_computing diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/types_.rst b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/types_.rst deleted file mode 100644 index ae5970c73d34..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/confidentialcomputing_v1/types_.rst +++ /dev/null @@ -1,6 +0,0 @@ -Types for Google Cloud Confidentialcomputing v1 API -=================================================== - -.. automodule:: google.cloud.confidentialcomputing_v1.types - :members: - :show-inheritance: diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/index.rst b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/index.rst deleted file mode 100644 index 0566de600bc8..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/index.rst +++ /dev/null @@ -1,10 +0,0 @@ -.. include:: multiprocessing.rst - - -API Reference -------------- -.. toctree:: - :maxdepth: 2 - - confidentialcomputing_v1/services_ - confidentialcomputing_v1/types_ diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/multiprocessing.rst b/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/multiprocessing.rst deleted file mode 100644 index 536d17b2ea65..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/docs/multiprocessing.rst +++ /dev/null @@ -1,7 +0,0 @@ -.. note:: - - Because this client uses :mod:`grpc` library, it is safe to - share instances across threads. In multiprocessing scenarios, the best - practice is to create client instances *after* the invocation of - :func:`os.fork` by :class:`multiprocessing.pool.Pool` or - :class:`multiprocessing.Process`. diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/__init__.py deleted file mode 100644 index 9dabe5d04bb0..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/__init__.py +++ /dev/null @@ -1,71 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -from google.cloud.confidentialcomputing import gapic_version as package_version - -__version__ = package_version.__version__ - - -from google.cloud.confidentialcomputing_v1.services.confidential_computing.client import ConfidentialComputingClient -from google.cloud.confidentialcomputing_v1.services.confidential_computing.async_client import ConfidentialComputingAsyncClient - -from google.cloud.confidentialcomputing_v1.types.service import AwsPrincipalTagsOptions -from google.cloud.confidentialcomputing_v1.types.service import Challenge -from google.cloud.confidentialcomputing_v1.types.service import ConfidentialSpaceInfo -from google.cloud.confidentialcomputing_v1.types.service import ContainerImageSignature -from google.cloud.confidentialcomputing_v1.types.service import CreateChallengeRequest -from google.cloud.confidentialcomputing_v1.types.service import GceShieldedIdentity -from google.cloud.confidentialcomputing_v1.types.service import GcpCredentials -from google.cloud.confidentialcomputing_v1.types.service import SevSnpAttestation -from google.cloud.confidentialcomputing_v1.types.service import SignedEntity -from google.cloud.confidentialcomputing_v1.types.service import TdxCcelAttestation -from google.cloud.confidentialcomputing_v1.types.service import TokenOptions -from google.cloud.confidentialcomputing_v1.types.service import TpmAttestation -from google.cloud.confidentialcomputing_v1.types.service import VerifyAttestationRequest -from google.cloud.confidentialcomputing_v1.types.service import VerifyAttestationResponse -from google.cloud.confidentialcomputing_v1.types.service import VerifyConfidentialGkeRequest -from google.cloud.confidentialcomputing_v1.types.service import VerifyConfidentialGkeResponse -from google.cloud.confidentialcomputing_v1.types.service import VerifyConfidentialSpaceRequest -from google.cloud.confidentialcomputing_v1.types.service import VerifyConfidentialSpaceResponse -from google.cloud.confidentialcomputing_v1.types.service import SignatureType -from google.cloud.confidentialcomputing_v1.types.service import SigningAlgorithm -from google.cloud.confidentialcomputing_v1.types.service import TokenProfile -from google.cloud.confidentialcomputing_v1.types.service import TokenType - -__all__ = ('ConfidentialComputingClient', - 'ConfidentialComputingAsyncClient', - 'AwsPrincipalTagsOptions', - 'Challenge', - 'ConfidentialSpaceInfo', - 'ContainerImageSignature', - 'CreateChallengeRequest', - 'GceShieldedIdentity', - 'GcpCredentials', - 'SevSnpAttestation', - 'SignedEntity', - 'TdxCcelAttestation', - 'TokenOptions', - 'TpmAttestation', - 'VerifyAttestationRequest', - 'VerifyAttestationResponse', - 'VerifyConfidentialGkeRequest', - 'VerifyConfidentialGkeResponse', - 'VerifyConfidentialSpaceRequest', - 'VerifyConfidentialSpaceResponse', - 'SignatureType', - 'SigningAlgorithm', - 'TokenProfile', - 'TokenType', -) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/gapic_version.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/gapic_version.py deleted file mode 100644 index 20a9cd975b02..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/gapic_version.py +++ /dev/null @@ -1,16 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -__version__ = "0.0.0" # {x-release-please-version} diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/py.typed b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/py.typed deleted file mode 100644 index 5e085fa19b06..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing/py.typed +++ /dev/null @@ -1,2 +0,0 @@ -# Marker file for PEP 561. -# The google-cloud-confidentialcomputing package uses inline types. diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/__init__.py deleted file mode 100644 index 2674431e4ee1..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/__init__.py +++ /dev/null @@ -1,72 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -from google.cloud.confidentialcomputing_v1 import gapic_version as package_version - -__version__ = package_version.__version__ - - -from .services.confidential_computing import ConfidentialComputingClient -from .services.confidential_computing import ConfidentialComputingAsyncClient - -from .types.service import AwsPrincipalTagsOptions -from .types.service import Challenge -from .types.service import ConfidentialSpaceInfo -from .types.service import ContainerImageSignature -from .types.service import CreateChallengeRequest -from .types.service import GceShieldedIdentity -from .types.service import GcpCredentials -from .types.service import SevSnpAttestation -from .types.service import SignedEntity -from .types.service import TdxCcelAttestation -from .types.service import TokenOptions -from .types.service import TpmAttestation -from .types.service import VerifyAttestationRequest -from .types.service import VerifyAttestationResponse -from .types.service import VerifyConfidentialGkeRequest -from .types.service import VerifyConfidentialGkeResponse -from .types.service import VerifyConfidentialSpaceRequest -from .types.service import VerifyConfidentialSpaceResponse -from .types.service import SignatureType -from .types.service import SigningAlgorithm -from .types.service import TokenProfile -from .types.service import TokenType - -__all__ = ( - 'ConfidentialComputingAsyncClient', -'AwsPrincipalTagsOptions', -'Challenge', -'ConfidentialComputingClient', -'ConfidentialSpaceInfo', -'ContainerImageSignature', -'CreateChallengeRequest', -'GceShieldedIdentity', -'GcpCredentials', -'SevSnpAttestation', -'SignatureType', -'SignedEntity', -'SigningAlgorithm', -'TdxCcelAttestation', -'TokenOptions', -'TokenProfile', -'TokenType', -'TpmAttestation', -'VerifyAttestationRequest', -'VerifyAttestationResponse', -'VerifyConfidentialGkeRequest', -'VerifyConfidentialGkeResponse', -'VerifyConfidentialSpaceRequest', -'VerifyConfidentialSpaceResponse', -) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/gapic_metadata.json b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/gapic_metadata.json deleted file mode 100644 index 5227e556513e..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/gapic_metadata.json +++ /dev/null @@ -1,88 +0,0 @@ - { - "comment": "This file maps proto services/RPCs to the corresponding library clients/methods", - "language": "python", - "libraryPackage": "google.cloud.confidentialcomputing_v1", - "protoPackage": "google.cloud.confidentialcomputing.v1", - "schema": "1.0", - "services": { - "ConfidentialComputing": { - "clients": { - "grpc": { - "libraryClient": "ConfidentialComputingClient", - "rpcs": { - "CreateChallenge": { - "methods": [ - "create_challenge" - ] - }, - "VerifyAttestation": { - "methods": [ - "verify_attestation" - ] - }, - "VerifyConfidentialGke": { - "methods": [ - "verify_confidential_gke" - ] - }, - "VerifyConfidentialSpace": { - "methods": [ - "verify_confidential_space" - ] - } - } - }, - "grpc-async": { - "libraryClient": "ConfidentialComputingAsyncClient", - "rpcs": { - "CreateChallenge": { - "methods": [ - "create_challenge" - ] - }, - "VerifyAttestation": { - "methods": [ - "verify_attestation" - ] - }, - "VerifyConfidentialGke": { - "methods": [ - "verify_confidential_gke" - ] - }, - "VerifyConfidentialSpace": { - "methods": [ - "verify_confidential_space" - ] - } - } - }, - "rest": { - "libraryClient": "ConfidentialComputingClient", - "rpcs": { - "CreateChallenge": { - "methods": [ - "create_challenge" - ] - }, - "VerifyAttestation": { - "methods": [ - "verify_attestation" - ] - }, - "VerifyConfidentialGke": { - "methods": [ - "verify_confidential_gke" - ] - }, - "VerifyConfidentialSpace": { - "methods": [ - "verify_confidential_space" - ] - } - } - } - } - } - } -} diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/gapic_version.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/gapic_version.py deleted file mode 100644 index 20a9cd975b02..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/gapic_version.py +++ /dev/null @@ -1,16 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -__version__ = "0.0.0" # {x-release-please-version} diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/py.typed b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/py.typed deleted file mode 100644 index 5e085fa19b06..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/py.typed +++ /dev/null @@ -1,2 +0,0 @@ -# Marker file for PEP 561. -# The google-cloud-confidentialcomputing package uses inline types. diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/__init__.py deleted file mode 100644 index cbf94b283c70..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/__init__.py +++ /dev/null @@ -1,15 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/__init__.py deleted file mode 100644 index 000ad9033f05..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/__init__.py +++ /dev/null @@ -1,22 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -from .client import ConfidentialComputingClient -from .async_client import ConfidentialComputingAsyncClient - -__all__ = ( - 'ConfidentialComputingClient', - 'ConfidentialComputingAsyncClient', -) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/async_client.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/async_client.py deleted file mode 100644 index 97512c2a575f..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/async_client.py +++ /dev/null @@ -1,760 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -import logging as std_logging -from collections import OrderedDict -import re -from typing import Dict, Callable, Mapping, MutableMapping, MutableSequence, Optional, Sequence, Tuple, Type, Union - -from google.cloud.confidentialcomputing_v1 import gapic_version as package_version - -from google.api_core.client_options import ClientOptions -from google.api_core import exceptions as core_exceptions -from google.api_core import gapic_v1 -from google.api_core import retry_async as retries -from google.auth import credentials as ga_credentials # type: ignore -from google.oauth2 import service_account # type: ignore -import google.protobuf - - -try: - OptionalRetry = Union[retries.AsyncRetry, gapic_v1.method._MethodDefault, None] -except AttributeError: # pragma: NO COVER - OptionalRetry = Union[retries.AsyncRetry, object, None] # type: ignore - -from google.cloud.confidentialcomputing_v1.types import service -from google.cloud.location import locations_pb2 # type: ignore -from google.protobuf import timestamp_pb2 # type: ignore -from google.rpc import status_pb2 # type: ignore -from .transports.base import ConfidentialComputingTransport, DEFAULT_CLIENT_INFO -from .transports.grpc_asyncio import ConfidentialComputingGrpcAsyncIOTransport -from .client import ConfidentialComputingClient - -try: - from google.api_core import client_logging # type: ignore - CLIENT_LOGGING_SUPPORTED = True # pragma: NO COVER -except ImportError: # pragma: NO COVER - CLIENT_LOGGING_SUPPORTED = False - -_LOGGER = std_logging.getLogger(__name__) - -class ConfidentialComputingAsyncClient: - """Service describing handlers for resources""" - - _client: ConfidentialComputingClient - - # Copy defaults from the synchronous client for use here. - # Note: DEFAULT_ENDPOINT is deprecated. Use _DEFAULT_ENDPOINT_TEMPLATE instead. - DEFAULT_ENDPOINT = ConfidentialComputingClient.DEFAULT_ENDPOINT - DEFAULT_MTLS_ENDPOINT = ConfidentialComputingClient.DEFAULT_MTLS_ENDPOINT - _DEFAULT_ENDPOINT_TEMPLATE = ConfidentialComputingClient._DEFAULT_ENDPOINT_TEMPLATE - _DEFAULT_UNIVERSE = ConfidentialComputingClient._DEFAULT_UNIVERSE - - challenge_path = staticmethod(ConfidentialComputingClient.challenge_path) - parse_challenge_path = staticmethod(ConfidentialComputingClient.parse_challenge_path) - common_billing_account_path = staticmethod(ConfidentialComputingClient.common_billing_account_path) - parse_common_billing_account_path = staticmethod(ConfidentialComputingClient.parse_common_billing_account_path) - common_folder_path = staticmethod(ConfidentialComputingClient.common_folder_path) - parse_common_folder_path = staticmethod(ConfidentialComputingClient.parse_common_folder_path) - common_organization_path = staticmethod(ConfidentialComputingClient.common_organization_path) - parse_common_organization_path = staticmethod(ConfidentialComputingClient.parse_common_organization_path) - common_project_path = staticmethod(ConfidentialComputingClient.common_project_path) - parse_common_project_path = staticmethod(ConfidentialComputingClient.parse_common_project_path) - common_location_path = staticmethod(ConfidentialComputingClient.common_location_path) - parse_common_location_path = staticmethod(ConfidentialComputingClient.parse_common_location_path) - - @classmethod - def from_service_account_info(cls, info: dict, *args, **kwargs): - """Creates an instance of this client using the provided credentials - info. - - Args: - info (dict): The service account private key info. - args: Additional arguments to pass to the constructor. - kwargs: Additional arguments to pass to the constructor. - - Returns: - ConfidentialComputingAsyncClient: The constructed client. - """ - return ConfidentialComputingClient.from_service_account_info.__func__(ConfidentialComputingAsyncClient, info, *args, **kwargs) # type: ignore - - @classmethod - def from_service_account_file(cls, filename: str, *args, **kwargs): - """Creates an instance of this client using the provided credentials - file. - - Args: - filename (str): The path to the service account private key json - file. - args: Additional arguments to pass to the constructor. - kwargs: Additional arguments to pass to the constructor. - - Returns: - ConfidentialComputingAsyncClient: The constructed client. - """ - return ConfidentialComputingClient.from_service_account_file.__func__(ConfidentialComputingAsyncClient, filename, *args, **kwargs) # type: ignore - - from_service_account_json = from_service_account_file - - @classmethod - def get_mtls_endpoint_and_cert_source(cls, client_options: Optional[ClientOptions] = None): - """Return the API endpoint and client cert source for mutual TLS. - - The client cert source is determined in the following order: - (1) if `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is not "true", the - client cert source is None. - (2) if `client_options.client_cert_source` is provided, use the provided one; if the - default client cert source exists, use the default one; otherwise the client cert - source is None. - - The API endpoint is determined in the following order: - (1) if `client_options.api_endpoint` if provided, use the provided one. - (2) if `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is "always", use the - default mTLS endpoint; if the environment variable is "never", use the default API - endpoint; otherwise if client cert source exists, use the default mTLS endpoint, otherwise - use the default API endpoint. - - More details can be found at https://google.aip.dev/auth/4114. - - Args: - client_options (google.api_core.client_options.ClientOptions): Custom options for the - client. Only the `api_endpoint` and `client_cert_source` properties may be used - in this method. - - Returns: - Tuple[str, Callable[[], Tuple[bytes, bytes]]]: returns the API endpoint and the - client cert source to use. - - Raises: - google.auth.exceptions.MutualTLSChannelError: If any errors happen. - """ - return ConfidentialComputingClient.get_mtls_endpoint_and_cert_source(client_options) # type: ignore - - @property - def transport(self) -> ConfidentialComputingTransport: - """Returns the transport used by the client instance. - - Returns: - ConfidentialComputingTransport: The transport used by the client instance. - """ - return self._client.transport - - @property - def api_endpoint(self): - """Return the API endpoint used by the client instance. - - Returns: - str: The API endpoint used by the client instance. - """ - return self._client._api_endpoint - - @property - def universe_domain(self) -> str: - """Return the universe domain used by the client instance. - - Returns: - str: The universe domain used - by the client instance. - """ - return self._client._universe_domain - - get_transport_class = ConfidentialComputingClient.get_transport_class - - def __init__(self, *, - credentials: Optional[ga_credentials.Credentials] = None, - transport: Optional[Union[str, ConfidentialComputingTransport, Callable[..., ConfidentialComputingTransport]]] = "grpc_asyncio", - client_options: Optional[ClientOptions] = None, - client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO, - ) -> None: - """Instantiates the confidential computing async client. - - Args: - credentials (Optional[google.auth.credentials.Credentials]): The - authorization credentials to attach to requests. These - credentials identify the application to the service; if none - are specified, the client will attempt to ascertain the - credentials from the environment. - transport (Optional[Union[str,ConfidentialComputingTransport,Callable[..., ConfidentialComputingTransport]]]): - The transport to use, or a Callable that constructs and returns a new transport to use. - If a Callable is given, it will be called with the same set of initialization - arguments as used in the ConfidentialComputingTransport constructor. - If set to None, a transport is chosen automatically. - client_options (Optional[Union[google.api_core.client_options.ClientOptions, dict]]): - Custom options for the client. - - 1. The ``api_endpoint`` property can be used to override the - default endpoint provided by the client when ``transport`` is - not explicitly provided. Only if this property is not set and - ``transport`` was not explicitly provided, the endpoint is - determined by the GOOGLE_API_USE_MTLS_ENDPOINT environment - variable, which have one of the following values: - "always" (always use the default mTLS endpoint), "never" (always - use the default regular endpoint) and "auto" (auto-switch to the - default mTLS endpoint if client certificate is present; this is - the default value). - - 2. If the GOOGLE_API_USE_CLIENT_CERTIFICATE environment variable - is "true", then the ``client_cert_source`` property can be used - to provide a client certificate for mTLS transport. If - not provided, the default SSL client certificate will be used if - present. If GOOGLE_API_USE_CLIENT_CERTIFICATE is "false" or not - set, no client certificate will be used. - - 3. The ``universe_domain`` property can be used to override the - default "googleapis.com" universe. Note that ``api_endpoint`` - property still takes precedence; and ``universe_domain`` is - currently not supported for mTLS. - - client_info (google.api_core.gapic_v1.client_info.ClientInfo): - The client info used to send a user-agent string along with - API requests. If ``None``, then default info will be used. - Generally, you only need to set this if you're developing - your own client library. - - Raises: - google.auth.exceptions.MutualTlsChannelError: If mutual TLS transport - creation failed for any reason. - """ - self._client = ConfidentialComputingClient( - credentials=credentials, - transport=transport, - client_options=client_options, - client_info=client_info, - - ) - - if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(std_logging.DEBUG): # pragma: NO COVER - _LOGGER.debug( - "Created client `google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient`.", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "universeDomain": getattr(self._client._transport._credentials, "universe_domain", ""), - "credentialsType": f"{type(self._client._transport._credentials).__module__}.{type(self._client._transport._credentials).__qualname__}", - "credentialsInfo": getattr(self.transport._credentials, "get_cred_info", lambda: None)(), - } if hasattr(self._client._transport, "_credentials") else { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "credentialsType": None, - } - ) - - async def create_challenge(self, - request: Optional[Union[service.CreateChallengeRequest, dict]] = None, - *, - parent: Optional[str] = None, - challenge: Optional[service.Challenge] = None, - retry: OptionalRetry = gapic_v1.method.DEFAULT, - timeout: Union[float, object] = gapic_v1.method.DEFAULT, - metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), - ) -> service.Challenge: - r"""Creates a new Challenge in a given project and - location. - - .. code-block:: python - - # This snippet has been automatically generated and should be regarded as a - # code template only. - # It will require modifications to work: - # - It may require correct/in-range values for request initialization. - # - It may require specifying regional endpoints when creating the service - # client as shown in: - # https://googleapis.dev/python/google-api-core/latest/client_options.html - from google.cloud import confidentialcomputing_v1 - - async def sample_create_challenge(): - # Create a client - client = confidentialcomputing_v1.ConfidentialComputingAsyncClient() - - # Initialize request argument(s) - request = confidentialcomputing_v1.CreateChallengeRequest( - parent="parent_value", - ) - - # Make the request - response = await client.create_challenge(request=request) - - # Handle the response - print(response) - - Args: - request (Optional[Union[google.cloud.confidentialcomputing_v1.types.CreateChallengeRequest, dict]]): - The request object. Message for creating a Challenge - parent (:class:`str`): - Required. The resource name of the location where the - Challenge will be used, in the format - ``projects/*/locations/*``. - - This corresponds to the ``parent`` field - on the ``request`` instance; if ``request`` is provided, this - should not be set. - challenge (:class:`google.cloud.confidentialcomputing_v1.types.Challenge`): - Required. The Challenge to be - created. Currently this field can be - empty as all the Challenge fields are - set by the server. - - This corresponds to the ``challenge`` field - on the ``request`` instance; if ``request`` is provided, this - should not be set. - retry (google.api_core.retry_async.AsyncRetry): Designation of what errors, if any, - should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - - Returns: - google.cloud.confidentialcomputing_v1.types.Challenge: - A Challenge from the server used to - guarantee freshness of attestations - - """ - # Create or coerce a protobuf request object. - # - Quick check: If we got a request object, we should *not* have - # gotten any keyword arguments that map to the request. - flattened_params = [parent, challenge] - has_flattened_params = len([param for param in flattened_params if param is not None]) > 0 - if request is not None and has_flattened_params: - raise ValueError("If the `request` argument is set, then none of " - "the individual field arguments should be set.") - - # - Use the request object if provided (there's no risk of modifying the input as - # there are no flattened fields), or create one. - if not isinstance(request, service.CreateChallengeRequest): - request = service.CreateChallengeRequest(request) - - # If we have keyword arguments corresponding to fields on the - # request, apply these. - if parent is not None: - request.parent = parent - if challenge is not None: - request.challenge = challenge - - # Wrap the RPC method; this adds retry and timeout information, - # and friendly error handling. - rpc = self._client._transport._wrapped_methods[self._client._transport.create_challenge] - - # Certain fields should be provided within the metadata header; - # add these here. - metadata = tuple(metadata) + ( - gapic_v1.routing_header.to_grpc_metadata(( - ("parent", request.parent), - )), - ) - - # Validate the universe domain. - self._client._validate_universe_domain() - - # Send the request. - response = await rpc( - request, - retry=retry, - timeout=timeout, - metadata=metadata, - ) - - # Done; return the response. - return response - - async def verify_attestation(self, - request: Optional[Union[service.VerifyAttestationRequest, dict]] = None, - *, - retry: OptionalRetry = gapic_v1.method.DEFAULT, - timeout: Union[float, object] = gapic_v1.method.DEFAULT, - metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), - ) -> service.VerifyAttestationResponse: - r"""Verifies the provided attestation info, returning a - signed attestation token. - - .. code-block:: python - - # This snippet has been automatically generated and should be regarded as a - # code template only. - # It will require modifications to work: - # - It may require correct/in-range values for request initialization. - # - It may require specifying regional endpoints when creating the service - # client as shown in: - # https://googleapis.dev/python/google-api-core/latest/client_options.html - from google.cloud import confidentialcomputing_v1 - - async def sample_verify_attestation(): - # Create a client - client = confidentialcomputing_v1.ConfidentialComputingAsyncClient() - - # Initialize request argument(s) - request = confidentialcomputing_v1.VerifyAttestationRequest( - challenge="challenge_value", - ) - - # Make the request - response = await client.verify_attestation(request=request) - - # Handle the response - print(response) - - Args: - request (Optional[Union[google.cloud.confidentialcomputing_v1.types.VerifyAttestationRequest, dict]]): - The request object. A request for an attestation token, - providing all the necessary information - needed for this service to verify the - platform state of the requestor. - retry (google.api_core.retry_async.AsyncRetry): Designation of what errors, if any, - should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - - Returns: - google.cloud.confidentialcomputing_v1.types.VerifyAttestationResponse: - A response once an attestation has - been successfully verified, containing a - signed attestation token. - - """ - # Create or coerce a protobuf request object. - # - Use the request object if provided (there's no risk of modifying the input as - # there are no flattened fields), or create one. - if not isinstance(request, service.VerifyAttestationRequest): - request = service.VerifyAttestationRequest(request) - - # Wrap the RPC method; this adds retry and timeout information, - # and friendly error handling. - rpc = self._client._transport._wrapped_methods[self._client._transport.verify_attestation] - - # Certain fields should be provided within the metadata header; - # add these here. - metadata = tuple(metadata) + ( - gapic_v1.routing_header.to_grpc_metadata(( - ("challenge", request.challenge), - )), - ) - - # Validate the universe domain. - self._client._validate_universe_domain() - - # Send the request. - response = await rpc( - request, - retry=retry, - timeout=timeout, - metadata=metadata, - ) - - # Done; return the response. - return response - - async def verify_confidential_space(self, - request: Optional[Union[service.VerifyConfidentialSpaceRequest, dict]] = None, - *, - retry: OptionalRetry = gapic_v1.method.DEFAULT, - timeout: Union[float, object] = gapic_v1.method.DEFAULT, - metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), - ) -> service.VerifyConfidentialSpaceResponse: - r"""Verifies whether the provided attestation info is - valid, returning a signed attestation token if so. - - .. code-block:: python - - # This snippet has been automatically generated and should be regarded as a - # code template only. - # It will require modifications to work: - # - It may require correct/in-range values for request initialization. - # - It may require specifying regional endpoints when creating the service - # client as shown in: - # https://googleapis.dev/python/google-api-core/latest/client_options.html - from google.cloud import confidentialcomputing_v1 - - async def sample_verify_confidential_space(): - # Create a client - client = confidentialcomputing_v1.ConfidentialComputingAsyncClient() - - # Initialize request argument(s) - request = confidentialcomputing_v1.VerifyConfidentialSpaceRequest( - challenge="challenge_value", - ) - - # Make the request - response = await client.verify_confidential_space(request=request) - - # Handle the response - print(response) - - Args: - request (Optional[Union[google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceRequest, dict]]): - The request object. A request for an attestation token, - providing all the necessary information - needed for this service to verify the - platform state of the requestor. - retry (google.api_core.retry_async.AsyncRetry): Designation of what errors, if any, - should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - - Returns: - google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceResponse: - VerifyConfidentialSpaceResponse is - returned once a Confidential Space - attestation has been successfully - verified, containing a signed token. - - """ - # Create or coerce a protobuf request object. - # - Use the request object if provided (there's no risk of modifying the input as - # there are no flattened fields), or create one. - if not isinstance(request, service.VerifyConfidentialSpaceRequest): - request = service.VerifyConfidentialSpaceRequest(request) - - # Wrap the RPC method; this adds retry and timeout information, - # and friendly error handling. - rpc = self._client._transport._wrapped_methods[self._client._transport.verify_confidential_space] - - # Certain fields should be provided within the metadata header; - # add these here. - metadata = tuple(metadata) + ( - gapic_v1.routing_header.to_grpc_metadata(( - ("challenge", request.challenge), - )), - ) - - # Validate the universe domain. - self._client._validate_universe_domain() - - # Send the request. - response = await rpc( - request, - retry=retry, - timeout=timeout, - metadata=metadata, - ) - - # Done; return the response. - return response - - async def verify_confidential_gke(self, - request: Optional[Union[service.VerifyConfidentialGkeRequest, dict]] = None, - *, - retry: OptionalRetry = gapic_v1.method.DEFAULT, - timeout: Union[float, object] = gapic_v1.method.DEFAULT, - metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), - ) -> service.VerifyConfidentialGkeResponse: - r"""Verifies the provided Confidential GKE attestation - info, returning a signed OIDC token. - - .. code-block:: python - - # This snippet has been automatically generated and should be regarded as a - # code template only. - # It will require modifications to work: - # - It may require correct/in-range values for request initialization. - # - It may require specifying regional endpoints when creating the service - # client as shown in: - # https://googleapis.dev/python/google-api-core/latest/client_options.html - from google.cloud import confidentialcomputing_v1 - - async def sample_verify_confidential_gke(): - # Create a client - client = confidentialcomputing_v1.ConfidentialComputingAsyncClient() - - # Initialize request argument(s) - request = confidentialcomputing_v1.VerifyConfidentialGkeRequest( - challenge="challenge_value", - ) - - # Make the request - response = await client.verify_confidential_gke(request=request) - - # Handle the response - print(response) - - Args: - request (Optional[Union[google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeRequest, dict]]): - The request object. A request for an attestation token, - providing all the necessary information - needed for this service to verify - Confidential GKE platform state of the - requestor. - retry (google.api_core.retry_async.AsyncRetry): Designation of what errors, if any, - should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - - Returns: - google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeResponse: - VerifyConfidentialGkeResponse - response is returened once a - Confidential GKE attestation has been - successfully verified, containing a - signed OIDC token. - - """ - # Create or coerce a protobuf request object. - # - Use the request object if provided (there's no risk of modifying the input as - # there are no flattened fields), or create one. - if not isinstance(request, service.VerifyConfidentialGkeRequest): - request = service.VerifyConfidentialGkeRequest(request) - - # Wrap the RPC method; this adds retry and timeout information, - # and friendly error handling. - rpc = self._client._transport._wrapped_methods[self._client._transport.verify_confidential_gke] - - # Certain fields should be provided within the metadata header; - # add these here. - metadata = tuple(metadata) + ( - gapic_v1.routing_header.to_grpc_metadata(( - ("challenge", request.challenge), - )), - ) - - # Validate the universe domain. - self._client._validate_universe_domain() - - # Send the request. - response = await rpc( - request, - retry=retry, - timeout=timeout, - metadata=metadata, - ) - - # Done; return the response. - return response - - async def get_location( - self, - request: Optional[locations_pb2.GetLocationRequest] = None, - *, - retry: OptionalRetry = gapic_v1.method.DEFAULT, - timeout: Union[float, object] = gapic_v1.method.DEFAULT, - metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), - ) -> locations_pb2.Location: - r"""Gets information about a location. - - Args: - request (:class:`~.location_pb2.GetLocationRequest`): - The request object. Request message for - `GetLocation` method. - retry (google.api_core.retry_async.AsyncRetry): Designation of what errors, - if any, should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - Returns: - ~.location_pb2.Location: - Location object. - """ - # Create or coerce a protobuf request object. - # The request isn't a proto-plus wrapped type, - # so it must be constructed via keyword expansion. - if isinstance(request, dict): - request = locations_pb2.GetLocationRequest(**request) - - # Wrap the RPC method; this adds retry and timeout information, - # and friendly error handling. - rpc = self.transport._wrapped_methods[self._client._transport.get_location] - - # Certain fields should be provided within the metadata header; - # add these here. - metadata = tuple(metadata) + ( - gapic_v1.routing_header.to_grpc_metadata( - (("name", request.name),)), - ) - - # Validate the universe domain. - self._client._validate_universe_domain() - - # Send the request. - response = await rpc( - request, retry=retry, timeout=timeout, metadata=metadata,) - - # Done; return the response. - return response - - async def list_locations( - self, - request: Optional[locations_pb2.ListLocationsRequest] = None, - *, - retry: OptionalRetry = gapic_v1.method.DEFAULT, - timeout: Union[float, object] = gapic_v1.method.DEFAULT, - metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), - ) -> locations_pb2.ListLocationsResponse: - r"""Lists information about the supported locations for this service. - - Args: - request (:class:`~.location_pb2.ListLocationsRequest`): - The request object. Request message for - `ListLocations` method. - retry (google.api_core.retry_async.AsyncRetry): Designation of what errors, - if any, should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - Returns: - ~.location_pb2.ListLocationsResponse: - Response message for ``ListLocations`` method. - """ - # Create or coerce a protobuf request object. - # The request isn't a proto-plus wrapped type, - # so it must be constructed via keyword expansion. - if isinstance(request, dict): - request = locations_pb2.ListLocationsRequest(**request) - - # Wrap the RPC method; this adds retry and timeout information, - # and friendly error handling. - rpc = self.transport._wrapped_methods[self._client._transport.list_locations] - - # Certain fields should be provided within the metadata header; - # add these here. - metadata = tuple(metadata) + ( - gapic_v1.routing_header.to_grpc_metadata( - (("name", request.name),)), - ) - - # Validate the universe domain. - self._client._validate_universe_domain() - - # Send the request. - response = await rpc( - request, retry=retry, timeout=timeout, metadata=metadata,) - - # Done; return the response. - return response - - async def __aenter__(self) -> "ConfidentialComputingAsyncClient": - return self - - async def __aexit__(self, exc_type, exc, tb): - await self.transport.close() - -DEFAULT_CLIENT_INFO = gapic_v1.client_info.ClientInfo(gapic_version=package_version.__version__) - -if hasattr(DEFAULT_CLIENT_INFO, "protobuf_runtime_version"): # pragma: NO COVER - DEFAULT_CLIENT_INFO.protobuf_runtime_version = google.protobuf.__version__ - - -__all__ = ( - "ConfidentialComputingAsyncClient", -) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/client.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/client.py deleted file mode 100644 index b269902f541e..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/client.py +++ /dev/null @@ -1,1123 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -from collections import OrderedDict -from http import HTTPStatus -import json -import logging as std_logging -import os -import re -from typing import Dict, Callable, Mapping, MutableMapping, MutableSequence, Optional, Sequence, Tuple, Type, Union, cast -import warnings - -from google.cloud.confidentialcomputing_v1 import gapic_version as package_version - -from google.api_core import client_options as client_options_lib -from google.api_core import exceptions as core_exceptions -from google.api_core import gapic_v1 -from google.api_core import retry as retries -from google.auth import credentials as ga_credentials # type: ignore -from google.auth.transport import mtls # type: ignore -from google.auth.transport.grpc import SslCredentials # type: ignore -from google.auth.exceptions import MutualTLSChannelError # type: ignore -from google.oauth2 import service_account # type: ignore -import google.protobuf - -try: - OptionalRetry = Union[retries.Retry, gapic_v1.method._MethodDefault, None] -except AttributeError: # pragma: NO COVER - OptionalRetry = Union[retries.Retry, object, None] # type: ignore - -try: - from google.api_core import client_logging # type: ignore - CLIENT_LOGGING_SUPPORTED = True # pragma: NO COVER -except ImportError: # pragma: NO COVER - CLIENT_LOGGING_SUPPORTED = False - -_LOGGER = std_logging.getLogger(__name__) - -from google.cloud.confidentialcomputing_v1.types import service -from google.cloud.location import locations_pb2 # type: ignore -from google.protobuf import timestamp_pb2 # type: ignore -from google.rpc import status_pb2 # type: ignore -from .transports.base import ConfidentialComputingTransport, DEFAULT_CLIENT_INFO -from .transports.grpc import ConfidentialComputingGrpcTransport -from .transports.grpc_asyncio import ConfidentialComputingGrpcAsyncIOTransport -from .transports.rest import ConfidentialComputingRestTransport - - -class ConfidentialComputingClientMeta(type): - """Metaclass for the ConfidentialComputing client. - - This provides class-level methods for building and retrieving - support objects (e.g. transport) without polluting the client instance - objects. - """ - _transport_registry = OrderedDict() # type: Dict[str, Type[ConfidentialComputingTransport]] - _transport_registry["grpc"] = ConfidentialComputingGrpcTransport - _transport_registry["grpc_asyncio"] = ConfidentialComputingGrpcAsyncIOTransport - _transport_registry["rest"] = ConfidentialComputingRestTransport - - def get_transport_class(cls, - label: Optional[str] = None, - ) -> Type[ConfidentialComputingTransport]: - """Returns an appropriate transport class. - - Args: - label: The name of the desired transport. If none is - provided, then the first transport in the registry is used. - - Returns: - The transport class to use. - """ - # If a specific transport is requested, return that one. - if label: - return cls._transport_registry[label] - - # No transport is requested; return the default (that is, the first one - # in the dictionary). - return next(iter(cls._transport_registry.values())) - - -class ConfidentialComputingClient(metaclass=ConfidentialComputingClientMeta): - """Service describing handlers for resources""" - - @staticmethod - def _get_default_mtls_endpoint(api_endpoint): - """Converts api endpoint to mTLS endpoint. - - Convert "*.sandbox.googleapis.com" and "*.googleapis.com" to - "*.mtls.sandbox.googleapis.com" and "*.mtls.googleapis.com" respectively. - Args: - api_endpoint (Optional[str]): the api endpoint to convert. - Returns: - str: converted mTLS api endpoint. - """ - if not api_endpoint: - return api_endpoint - - mtls_endpoint_re = re.compile( - r"(?P[^.]+)(?P\.mtls)?(?P\.sandbox)?(?P\.googleapis\.com)?" - ) - - m = mtls_endpoint_re.match(api_endpoint) - name, mtls, sandbox, googledomain = m.groups() - if mtls or not googledomain: - return api_endpoint - - if sandbox: - return api_endpoint.replace( - "sandbox.googleapis.com", "mtls.sandbox.googleapis.com" - ) - - return api_endpoint.replace(".googleapis.com", ".mtls.googleapis.com") - - # Note: DEFAULT_ENDPOINT is deprecated. Use _DEFAULT_ENDPOINT_TEMPLATE instead. - DEFAULT_ENDPOINT = "confidentialcomputing.googleapis.com" - DEFAULT_MTLS_ENDPOINT = _get_default_mtls_endpoint.__func__( # type: ignore - DEFAULT_ENDPOINT - ) - - _DEFAULT_ENDPOINT_TEMPLATE = "confidentialcomputing.{UNIVERSE_DOMAIN}" - _DEFAULT_UNIVERSE = "googleapis.com" - - @classmethod - def from_service_account_info(cls, info: dict, *args, **kwargs): - """Creates an instance of this client using the provided credentials - info. - - Args: - info (dict): The service account private key info. - args: Additional arguments to pass to the constructor. - kwargs: Additional arguments to pass to the constructor. - - Returns: - ConfidentialComputingClient: The constructed client. - """ - credentials = service_account.Credentials.from_service_account_info(info) - kwargs["credentials"] = credentials - return cls(*args, **kwargs) - - @classmethod - def from_service_account_file(cls, filename: str, *args, **kwargs): - """Creates an instance of this client using the provided credentials - file. - - Args: - filename (str): The path to the service account private key json - file. - args: Additional arguments to pass to the constructor. - kwargs: Additional arguments to pass to the constructor. - - Returns: - ConfidentialComputingClient: The constructed client. - """ - credentials = service_account.Credentials.from_service_account_file( - filename) - kwargs["credentials"] = credentials - return cls(*args, **kwargs) - - from_service_account_json = from_service_account_file - - @property - def transport(self) -> ConfidentialComputingTransport: - """Returns the transport used by the client instance. - - Returns: - ConfidentialComputingTransport: The transport used by the client - instance. - """ - return self._transport - - @staticmethod - def challenge_path(project: str,location: str,uuid: str,) -> str: - """Returns a fully-qualified challenge string.""" - return "projects/{project}/locations/{location}/challenges/{uuid}".format(project=project, location=location, uuid=uuid, ) - - @staticmethod - def parse_challenge_path(path: str) -> Dict[str,str]: - """Parses a challenge path into its component segments.""" - m = re.match(r"^projects/(?P.+?)/locations/(?P.+?)/challenges/(?P.+?)$", path) - return m.groupdict() if m else {} - - @staticmethod - def common_billing_account_path(billing_account: str, ) -> str: - """Returns a fully-qualified billing_account string.""" - return "billingAccounts/{billing_account}".format(billing_account=billing_account, ) - - @staticmethod - def parse_common_billing_account_path(path: str) -> Dict[str,str]: - """Parse a billing_account path into its component segments.""" - m = re.match(r"^billingAccounts/(?P.+?)$", path) - return m.groupdict() if m else {} - - @staticmethod - def common_folder_path(folder: str, ) -> str: - """Returns a fully-qualified folder string.""" - return "folders/{folder}".format(folder=folder, ) - - @staticmethod - def parse_common_folder_path(path: str) -> Dict[str,str]: - """Parse a folder path into its component segments.""" - m = re.match(r"^folders/(?P.+?)$", path) - return m.groupdict() if m else {} - - @staticmethod - def common_organization_path(organization: str, ) -> str: - """Returns a fully-qualified organization string.""" - return "organizations/{organization}".format(organization=organization, ) - - @staticmethod - def parse_common_organization_path(path: str) -> Dict[str,str]: - """Parse a organization path into its component segments.""" - m = re.match(r"^organizations/(?P.+?)$", path) - return m.groupdict() if m else {} - - @staticmethod - def common_project_path(project: str, ) -> str: - """Returns a fully-qualified project string.""" - return "projects/{project}".format(project=project, ) - - @staticmethod - def parse_common_project_path(path: str) -> Dict[str,str]: - """Parse a project path into its component segments.""" - m = re.match(r"^projects/(?P.+?)$", path) - return m.groupdict() if m else {} - - @staticmethod - def common_location_path(project: str, location: str, ) -> str: - """Returns a fully-qualified location string.""" - return "projects/{project}/locations/{location}".format(project=project, location=location, ) - - @staticmethod - def parse_common_location_path(path: str) -> Dict[str,str]: - """Parse a location path into its component segments.""" - m = re.match(r"^projects/(?P.+?)/locations/(?P.+?)$", path) - return m.groupdict() if m else {} - - @classmethod - def get_mtls_endpoint_and_cert_source(cls, client_options: Optional[client_options_lib.ClientOptions] = None): - """Deprecated. Return the API endpoint and client cert source for mutual TLS. - - The client cert source is determined in the following order: - (1) if `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is not "true", the - client cert source is None. - (2) if `client_options.client_cert_source` is provided, use the provided one; if the - default client cert source exists, use the default one; otherwise the client cert - source is None. - - The API endpoint is determined in the following order: - (1) if `client_options.api_endpoint` if provided, use the provided one. - (2) if `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is "always", use the - default mTLS endpoint; if the environment variable is "never", use the default API - endpoint; otherwise if client cert source exists, use the default mTLS endpoint, otherwise - use the default API endpoint. - - More details can be found at https://google.aip.dev/auth/4114. - - Args: - client_options (google.api_core.client_options.ClientOptions): Custom options for the - client. Only the `api_endpoint` and `client_cert_source` properties may be used - in this method. - - Returns: - Tuple[str, Callable[[], Tuple[bytes, bytes]]]: returns the API endpoint and the - client cert source to use. - - Raises: - google.auth.exceptions.MutualTLSChannelError: If any errors happen. - """ - - warnings.warn("get_mtls_endpoint_and_cert_source is deprecated. Use the api_endpoint property instead.", - DeprecationWarning) - if client_options is None: - client_options = client_options_lib.ClientOptions() - use_client_cert = os.getenv("GOOGLE_API_USE_CLIENT_CERTIFICATE", "false") - use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto") - if use_client_cert not in ("true", "false"): - raise ValueError("Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`") - if use_mtls_endpoint not in ("auto", "never", "always"): - raise MutualTLSChannelError("Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`") - - # Figure out the client cert source to use. - client_cert_source = None - if use_client_cert == "true": - if client_options.client_cert_source: - client_cert_source = client_options.client_cert_source - elif mtls.has_default_client_cert_source(): - client_cert_source = mtls.default_client_cert_source() - - # Figure out which api endpoint to use. - if client_options.api_endpoint is not None: - api_endpoint = client_options.api_endpoint - elif use_mtls_endpoint == "always" or (use_mtls_endpoint == "auto" and client_cert_source): - api_endpoint = cls.DEFAULT_MTLS_ENDPOINT - else: - api_endpoint = cls.DEFAULT_ENDPOINT - - return api_endpoint, client_cert_source - - @staticmethod - def _read_environment_variables(): - """Returns the environment variables used by the client. - - Returns: - Tuple[bool, str, str]: returns the GOOGLE_API_USE_CLIENT_CERTIFICATE, - GOOGLE_API_USE_MTLS_ENDPOINT, and GOOGLE_CLOUD_UNIVERSE_DOMAIN environment variables. - - Raises: - ValueError: If GOOGLE_API_USE_CLIENT_CERTIFICATE is not - any of ["true", "false"]. - google.auth.exceptions.MutualTLSChannelError: If GOOGLE_API_USE_MTLS_ENDPOINT - is not any of ["auto", "never", "always"]. - """ - use_client_cert = os.getenv("GOOGLE_API_USE_CLIENT_CERTIFICATE", "false").lower() - use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower() - universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN") - if use_client_cert not in ("true", "false"): - raise ValueError("Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`") - if use_mtls_endpoint not in ("auto", "never", "always"): - raise MutualTLSChannelError("Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`") - return use_client_cert == "true", use_mtls_endpoint, universe_domain_env - - @staticmethod - def _get_client_cert_source(provided_cert_source, use_cert_flag): - """Return the client cert source to be used by the client. - - Args: - provided_cert_source (bytes): The client certificate source provided. - use_cert_flag (bool): A flag indicating whether to use the client certificate. - - Returns: - bytes or None: The client cert source to be used by the client. - """ - client_cert_source = None - if use_cert_flag: - if provided_cert_source: - client_cert_source = provided_cert_source - elif mtls.has_default_client_cert_source(): - client_cert_source = mtls.default_client_cert_source() - return client_cert_source - - @staticmethod - def _get_api_endpoint(api_override, client_cert_source, universe_domain, use_mtls_endpoint): - """Return the API endpoint used by the client. - - Args: - api_override (str): The API endpoint override. If specified, this is always - the return value of this function and the other arguments are not used. - client_cert_source (bytes): The client certificate source used by the client. - universe_domain (str): The universe domain used by the client. - use_mtls_endpoint (str): How to use the mTLS endpoint, which depends also on the other parameters. - Possible values are "always", "auto", or "never". - - Returns: - str: The API endpoint to be used by the client. - """ - if api_override is not None: - api_endpoint = api_override - elif use_mtls_endpoint == "always" or (use_mtls_endpoint == "auto" and client_cert_source): - _default_universe = ConfidentialComputingClient._DEFAULT_UNIVERSE - if universe_domain != _default_universe: - raise MutualTLSChannelError(f"mTLS is not supported in any universe other than {_default_universe}.") - api_endpoint = ConfidentialComputingClient.DEFAULT_MTLS_ENDPOINT - else: - api_endpoint = ConfidentialComputingClient._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=universe_domain) - return api_endpoint - - @staticmethod - def _get_universe_domain(client_universe_domain: Optional[str], universe_domain_env: Optional[str]) -> str: - """Return the universe domain used by the client. - - Args: - client_universe_domain (Optional[str]): The universe domain configured via the client options. - universe_domain_env (Optional[str]): The universe domain configured via the "GOOGLE_CLOUD_UNIVERSE_DOMAIN" environment variable. - - Returns: - str: The universe domain to be used by the client. - - Raises: - ValueError: If the universe domain is an empty string. - """ - universe_domain = ConfidentialComputingClient._DEFAULT_UNIVERSE - if client_universe_domain is not None: - universe_domain = client_universe_domain - elif universe_domain_env is not None: - universe_domain = universe_domain_env - if len(universe_domain.strip()) == 0: - raise ValueError("Universe Domain cannot be an empty string.") - return universe_domain - - def _validate_universe_domain(self): - """Validates client's and credentials' universe domains are consistent. - - Returns: - bool: True iff the configured universe domain is valid. - - Raises: - ValueError: If the configured universe domain is not valid. - """ - - # NOTE (b/349488459): universe validation is disabled until further notice. - return True - - def _add_cred_info_for_auth_errors( - self, - error: core_exceptions.GoogleAPICallError - ) -> None: - """Adds credential info string to error details for 401/403/404 errors. - - Args: - error (google.api_core.exceptions.GoogleAPICallError): The error to add the cred info. - """ - if error.code not in [HTTPStatus.UNAUTHORIZED, HTTPStatus.FORBIDDEN, HTTPStatus.NOT_FOUND]: - return - - cred = self._transport._credentials - - # get_cred_info is only available in google-auth>=2.35.0 - if not hasattr(cred, "get_cred_info"): - return - - # ignore the type check since pypy test fails when get_cred_info - # is not available - cred_info = cred.get_cred_info() # type: ignore - if cred_info and hasattr(error._details, "append"): - error._details.append(json.dumps(cred_info)) - - @property - def api_endpoint(self): - """Return the API endpoint used by the client instance. - - Returns: - str: The API endpoint used by the client instance. - """ - return self._api_endpoint - - @property - def universe_domain(self) -> str: - """Return the universe domain used by the client instance. - - Returns: - str: The universe domain used by the client instance. - """ - return self._universe_domain - - def __init__(self, *, - credentials: Optional[ga_credentials.Credentials] = None, - transport: Optional[Union[str, ConfidentialComputingTransport, Callable[..., ConfidentialComputingTransport]]] = None, - client_options: Optional[Union[client_options_lib.ClientOptions, dict]] = None, - client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO, - ) -> None: - """Instantiates the confidential computing client. - - Args: - credentials (Optional[google.auth.credentials.Credentials]): The - authorization credentials to attach to requests. These - credentials identify the application to the service; if none - are specified, the client will attempt to ascertain the - credentials from the environment. - transport (Optional[Union[str,ConfidentialComputingTransport,Callable[..., ConfidentialComputingTransport]]]): - The transport to use, or a Callable that constructs and returns a new transport. - If a Callable is given, it will be called with the same set of initialization - arguments as used in the ConfidentialComputingTransport constructor. - If set to None, a transport is chosen automatically. - client_options (Optional[Union[google.api_core.client_options.ClientOptions, dict]]): - Custom options for the client. - - 1. The ``api_endpoint`` property can be used to override the - default endpoint provided by the client when ``transport`` is - not explicitly provided. Only if this property is not set and - ``transport`` was not explicitly provided, the endpoint is - determined by the GOOGLE_API_USE_MTLS_ENDPOINT environment - variable, which have one of the following values: - "always" (always use the default mTLS endpoint), "never" (always - use the default regular endpoint) and "auto" (auto-switch to the - default mTLS endpoint if client certificate is present; this is - the default value). - - 2. If the GOOGLE_API_USE_CLIENT_CERTIFICATE environment variable - is "true", then the ``client_cert_source`` property can be used - to provide a client certificate for mTLS transport. If - not provided, the default SSL client certificate will be used if - present. If GOOGLE_API_USE_CLIENT_CERTIFICATE is "false" or not - set, no client certificate will be used. - - 3. The ``universe_domain`` property can be used to override the - default "googleapis.com" universe. Note that the ``api_endpoint`` - property still takes precedence; and ``universe_domain`` is - currently not supported for mTLS. - - client_info (google.api_core.gapic_v1.client_info.ClientInfo): - The client info used to send a user-agent string along with - API requests. If ``None``, then default info will be used. - Generally, you only need to set this if you're developing - your own client library. - - Raises: - google.auth.exceptions.MutualTLSChannelError: If mutual TLS transport - creation failed for any reason. - """ - self._client_options = client_options - if isinstance(self._client_options, dict): - self._client_options = client_options_lib.from_dict(self._client_options) - if self._client_options is None: - self._client_options = client_options_lib.ClientOptions() - self._client_options = cast(client_options_lib.ClientOptions, self._client_options) - - universe_domain_opt = getattr(self._client_options, 'universe_domain', None) - - self._use_client_cert, self._use_mtls_endpoint, self._universe_domain_env = ConfidentialComputingClient._read_environment_variables() - self._client_cert_source = ConfidentialComputingClient._get_client_cert_source(self._client_options.client_cert_source, self._use_client_cert) - self._universe_domain = ConfidentialComputingClient._get_universe_domain(universe_domain_opt, self._universe_domain_env) - self._api_endpoint = None # updated below, depending on `transport` - - # Initialize the universe domain validation. - self._is_universe_domain_valid = False - - if CLIENT_LOGGING_SUPPORTED: # pragma: NO COVER - # Setup logging. - client_logging.initialize_logging() - - api_key_value = getattr(self._client_options, "api_key", None) - if api_key_value and credentials: - raise ValueError("client_options.api_key and credentials are mutually exclusive") - - # Save or instantiate the transport. - # Ordinarily, we provide the transport, but allowing a custom transport - # instance provides an extensibility point for unusual situations. - transport_provided = isinstance(transport, ConfidentialComputingTransport) - if transport_provided: - # transport is a ConfidentialComputingTransport instance. - if credentials or self._client_options.credentials_file or api_key_value: - raise ValueError("When providing a transport instance, " - "provide its credentials directly.") - if self._client_options.scopes: - raise ValueError( - "When providing a transport instance, provide its scopes " - "directly." - ) - self._transport = cast(ConfidentialComputingTransport, transport) - self._api_endpoint = self._transport.host - - self._api_endpoint = (self._api_endpoint or - ConfidentialComputingClient._get_api_endpoint( - self._client_options.api_endpoint, - self._client_cert_source, - self._universe_domain, - self._use_mtls_endpoint)) - - if not transport_provided: - import google.auth._default # type: ignore - - if api_key_value and hasattr(google.auth._default, "get_api_key_credentials"): - credentials = google.auth._default.get_api_key_credentials(api_key_value) - - transport_init: Union[Type[ConfidentialComputingTransport], Callable[..., ConfidentialComputingTransport]] = ( - ConfidentialComputingClient.get_transport_class(transport) - if isinstance(transport, str) or transport is None - else cast(Callable[..., ConfidentialComputingTransport], transport) - ) - # initialize with the provided callable or the passed in class - self._transport = transport_init( - credentials=credentials, - credentials_file=self._client_options.credentials_file, - host=self._api_endpoint, - scopes=self._client_options.scopes, - client_cert_source_for_mtls=self._client_cert_source, - quota_project_id=self._client_options.quota_project_id, - client_info=client_info, - always_use_jwt_access=True, - api_audience=self._client_options.api_audience, - ) - - if "async" not in str(self._transport): - if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(std_logging.DEBUG): # pragma: NO COVER - _LOGGER.debug( - "Created client `google.cloud.confidentialcomputing_v1.ConfidentialComputingClient`.", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "universeDomain": getattr(self._transport._credentials, "universe_domain", ""), - "credentialsType": f"{type(self._transport._credentials).__module__}.{type(self._transport._credentials).__qualname__}", - "credentialsInfo": getattr(self.transport._credentials, "get_cred_info", lambda: None)(), - } if hasattr(self._transport, "_credentials") else { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "credentialsType": None, - } - ) - - def create_challenge(self, - request: Optional[Union[service.CreateChallengeRequest, dict]] = None, - *, - parent: Optional[str] = None, - challenge: Optional[service.Challenge] = None, - retry: OptionalRetry = gapic_v1.method.DEFAULT, - timeout: Union[float, object] = gapic_v1.method.DEFAULT, - metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), - ) -> service.Challenge: - r"""Creates a new Challenge in a given project and - location. - - .. code-block:: python - - # This snippet has been automatically generated and should be regarded as a - # code template only. - # It will require modifications to work: - # - It may require correct/in-range values for request initialization. - # - It may require specifying regional endpoints when creating the service - # client as shown in: - # https://googleapis.dev/python/google-api-core/latest/client_options.html - from google.cloud import confidentialcomputing_v1 - - def sample_create_challenge(): - # Create a client - client = confidentialcomputing_v1.ConfidentialComputingClient() - - # Initialize request argument(s) - request = confidentialcomputing_v1.CreateChallengeRequest( - parent="parent_value", - ) - - # Make the request - response = client.create_challenge(request=request) - - # Handle the response - print(response) - - Args: - request (Union[google.cloud.confidentialcomputing_v1.types.CreateChallengeRequest, dict]): - The request object. Message for creating a Challenge - parent (str): - Required. The resource name of the location where the - Challenge will be used, in the format - ``projects/*/locations/*``. - - This corresponds to the ``parent`` field - on the ``request`` instance; if ``request`` is provided, this - should not be set. - challenge (google.cloud.confidentialcomputing_v1.types.Challenge): - Required. The Challenge to be - created. Currently this field can be - empty as all the Challenge fields are - set by the server. - - This corresponds to the ``challenge`` field - on the ``request`` instance; if ``request`` is provided, this - should not be set. - retry (google.api_core.retry.Retry): Designation of what errors, if any, - should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - - Returns: - google.cloud.confidentialcomputing_v1.types.Challenge: - A Challenge from the server used to - guarantee freshness of attestations - - """ - # Create or coerce a protobuf request object. - # - Quick check: If we got a request object, we should *not* have - # gotten any keyword arguments that map to the request. - flattened_params = [parent, challenge] - has_flattened_params = len([param for param in flattened_params if param is not None]) > 0 - if request is not None and has_flattened_params: - raise ValueError('If the `request` argument is set, then none of ' - 'the individual field arguments should be set.') - - # - Use the request object if provided (there's no risk of modifying the input as - # there are no flattened fields), or create one. - if not isinstance(request, service.CreateChallengeRequest): - request = service.CreateChallengeRequest(request) - # If we have keyword arguments corresponding to fields on the - # request, apply these. - if parent is not None: - request.parent = parent - if challenge is not None: - request.challenge = challenge - - # Wrap the RPC method; this adds retry and timeout information, - # and friendly error handling. - rpc = self._transport._wrapped_methods[self._transport.create_challenge] - - # Certain fields should be provided within the metadata header; - # add these here. - metadata = tuple(metadata) + ( - gapic_v1.routing_header.to_grpc_metadata(( - ("parent", request.parent), - )), - ) - - # Validate the universe domain. - self._validate_universe_domain() - - # Send the request. - response = rpc( - request, - retry=retry, - timeout=timeout, - metadata=metadata, - ) - - # Done; return the response. - return response - - def verify_attestation(self, - request: Optional[Union[service.VerifyAttestationRequest, dict]] = None, - *, - retry: OptionalRetry = gapic_v1.method.DEFAULT, - timeout: Union[float, object] = gapic_v1.method.DEFAULT, - metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), - ) -> service.VerifyAttestationResponse: - r"""Verifies the provided attestation info, returning a - signed attestation token. - - .. code-block:: python - - # This snippet has been automatically generated and should be regarded as a - # code template only. - # It will require modifications to work: - # - It may require correct/in-range values for request initialization. - # - It may require specifying regional endpoints when creating the service - # client as shown in: - # https://googleapis.dev/python/google-api-core/latest/client_options.html - from google.cloud import confidentialcomputing_v1 - - def sample_verify_attestation(): - # Create a client - client = confidentialcomputing_v1.ConfidentialComputingClient() - - # Initialize request argument(s) - request = confidentialcomputing_v1.VerifyAttestationRequest( - challenge="challenge_value", - ) - - # Make the request - response = client.verify_attestation(request=request) - - # Handle the response - print(response) - - Args: - request (Union[google.cloud.confidentialcomputing_v1.types.VerifyAttestationRequest, dict]): - The request object. A request for an attestation token, - providing all the necessary information - needed for this service to verify the - platform state of the requestor. - retry (google.api_core.retry.Retry): Designation of what errors, if any, - should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - - Returns: - google.cloud.confidentialcomputing_v1.types.VerifyAttestationResponse: - A response once an attestation has - been successfully verified, containing a - signed attestation token. - - """ - # Create or coerce a protobuf request object. - # - Use the request object if provided (there's no risk of modifying the input as - # there are no flattened fields), or create one. - if not isinstance(request, service.VerifyAttestationRequest): - request = service.VerifyAttestationRequest(request) - - # Wrap the RPC method; this adds retry and timeout information, - # and friendly error handling. - rpc = self._transport._wrapped_methods[self._transport.verify_attestation] - - # Certain fields should be provided within the metadata header; - # add these here. - metadata = tuple(metadata) + ( - gapic_v1.routing_header.to_grpc_metadata(( - ("challenge", request.challenge), - )), - ) - - # Validate the universe domain. - self._validate_universe_domain() - - # Send the request. - response = rpc( - request, - retry=retry, - timeout=timeout, - metadata=metadata, - ) - - # Done; return the response. - return response - - def verify_confidential_space(self, - request: Optional[Union[service.VerifyConfidentialSpaceRequest, dict]] = None, - *, - retry: OptionalRetry = gapic_v1.method.DEFAULT, - timeout: Union[float, object] = gapic_v1.method.DEFAULT, - metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), - ) -> service.VerifyConfidentialSpaceResponse: - r"""Verifies whether the provided attestation info is - valid, returning a signed attestation token if so. - - .. code-block:: python - - # This snippet has been automatically generated and should be regarded as a - # code template only. - # It will require modifications to work: - # - It may require correct/in-range values for request initialization. - # - It may require specifying regional endpoints when creating the service - # client as shown in: - # https://googleapis.dev/python/google-api-core/latest/client_options.html - from google.cloud import confidentialcomputing_v1 - - def sample_verify_confidential_space(): - # Create a client - client = confidentialcomputing_v1.ConfidentialComputingClient() - - # Initialize request argument(s) - request = confidentialcomputing_v1.VerifyConfidentialSpaceRequest( - challenge="challenge_value", - ) - - # Make the request - response = client.verify_confidential_space(request=request) - - # Handle the response - print(response) - - Args: - request (Union[google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceRequest, dict]): - The request object. A request for an attestation token, - providing all the necessary information - needed for this service to verify the - platform state of the requestor. - retry (google.api_core.retry.Retry): Designation of what errors, if any, - should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - - Returns: - google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceResponse: - VerifyConfidentialSpaceResponse is - returned once a Confidential Space - attestation has been successfully - verified, containing a signed token. - - """ - # Create or coerce a protobuf request object. - # - Use the request object if provided (there's no risk of modifying the input as - # there are no flattened fields), or create one. - if not isinstance(request, service.VerifyConfidentialSpaceRequest): - request = service.VerifyConfidentialSpaceRequest(request) - - # Wrap the RPC method; this adds retry and timeout information, - # and friendly error handling. - rpc = self._transport._wrapped_methods[self._transport.verify_confidential_space] - - # Certain fields should be provided within the metadata header; - # add these here. - metadata = tuple(metadata) + ( - gapic_v1.routing_header.to_grpc_metadata(( - ("challenge", request.challenge), - )), - ) - - # Validate the universe domain. - self._validate_universe_domain() - - # Send the request. - response = rpc( - request, - retry=retry, - timeout=timeout, - metadata=metadata, - ) - - # Done; return the response. - return response - - def verify_confidential_gke(self, - request: Optional[Union[service.VerifyConfidentialGkeRequest, dict]] = None, - *, - retry: OptionalRetry = gapic_v1.method.DEFAULT, - timeout: Union[float, object] = gapic_v1.method.DEFAULT, - metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), - ) -> service.VerifyConfidentialGkeResponse: - r"""Verifies the provided Confidential GKE attestation - info, returning a signed OIDC token. - - .. code-block:: python - - # This snippet has been automatically generated and should be regarded as a - # code template only. - # It will require modifications to work: - # - It may require correct/in-range values for request initialization. - # - It may require specifying regional endpoints when creating the service - # client as shown in: - # https://googleapis.dev/python/google-api-core/latest/client_options.html - from google.cloud import confidentialcomputing_v1 - - def sample_verify_confidential_gke(): - # Create a client - client = confidentialcomputing_v1.ConfidentialComputingClient() - - # Initialize request argument(s) - request = confidentialcomputing_v1.VerifyConfidentialGkeRequest( - challenge="challenge_value", - ) - - # Make the request - response = client.verify_confidential_gke(request=request) - - # Handle the response - print(response) - - Args: - request (Union[google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeRequest, dict]): - The request object. A request for an attestation token, - providing all the necessary information - needed for this service to verify - Confidential GKE platform state of the - requestor. - retry (google.api_core.retry.Retry): Designation of what errors, if any, - should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - - Returns: - google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeResponse: - VerifyConfidentialGkeResponse - response is returened once a - Confidential GKE attestation has been - successfully verified, containing a - signed OIDC token. - - """ - # Create or coerce a protobuf request object. - # - Use the request object if provided (there's no risk of modifying the input as - # there are no flattened fields), or create one. - if not isinstance(request, service.VerifyConfidentialGkeRequest): - request = service.VerifyConfidentialGkeRequest(request) - - # Wrap the RPC method; this adds retry and timeout information, - # and friendly error handling. - rpc = self._transport._wrapped_methods[self._transport.verify_confidential_gke] - - # Certain fields should be provided within the metadata header; - # add these here. - metadata = tuple(metadata) + ( - gapic_v1.routing_header.to_grpc_metadata(( - ("challenge", request.challenge), - )), - ) - - # Validate the universe domain. - self._validate_universe_domain() - - # Send the request. - response = rpc( - request, - retry=retry, - timeout=timeout, - metadata=metadata, - ) - - # Done; return the response. - return response - - def __enter__(self) -> "ConfidentialComputingClient": - return self - - def __exit__(self, type, value, traceback): - """Releases underlying transport's resources. - - .. warning:: - ONLY use as a context manager if the transport is NOT shared - with other clients! Exiting the with block will CLOSE the transport - and may cause errors in other clients! - """ - self.transport.close() - - def get_location( - self, - request: Optional[locations_pb2.GetLocationRequest] = None, - *, - retry: OptionalRetry = gapic_v1.method.DEFAULT, - timeout: Union[float, object] = gapic_v1.method.DEFAULT, - metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), - ) -> locations_pb2.Location: - r"""Gets information about a location. - - Args: - request (:class:`~.location_pb2.GetLocationRequest`): - The request object. Request message for - `GetLocation` method. - retry (google.api_core.retry.Retry): Designation of what errors, - if any, should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - Returns: - ~.location_pb2.Location: - Location object. - """ - # Create or coerce a protobuf request object. - # The request isn't a proto-plus wrapped type, - # so it must be constructed via keyword expansion. - if isinstance(request, dict): - request = locations_pb2.GetLocationRequest(**request) - - # Wrap the RPC method; this adds retry and timeout information, - # and friendly error handling. - rpc = self._transport._wrapped_methods[self._transport.get_location] - - # Certain fields should be provided within the metadata header; - # add these here. - metadata = tuple(metadata) + ( - gapic_v1.routing_header.to_grpc_metadata( - (("name", request.name),)), - ) - - # Validate the universe domain. - self._validate_universe_domain() - - try: - # Send the request. - response = rpc( - request, retry=retry, timeout=timeout, metadata=metadata,) - - # Done; return the response. - return response - except core_exceptions.GoogleAPICallError as e: - self._add_cred_info_for_auth_errors(e) - raise e - - def list_locations( - self, - request: Optional[locations_pb2.ListLocationsRequest] = None, - *, - retry: OptionalRetry = gapic_v1.method.DEFAULT, - timeout: Union[float, object] = gapic_v1.method.DEFAULT, - metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), - ) -> locations_pb2.ListLocationsResponse: - r"""Lists information about the supported locations for this service. - - Args: - request (:class:`~.location_pb2.ListLocationsRequest`): - The request object. Request message for - `ListLocations` method. - retry (google.api_core.retry.Retry): Designation of what errors, - if any, should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - Returns: - ~.location_pb2.ListLocationsResponse: - Response message for ``ListLocations`` method. - """ - # Create or coerce a protobuf request object. - # The request isn't a proto-plus wrapped type, - # so it must be constructed via keyword expansion. - if isinstance(request, dict): - request = locations_pb2.ListLocationsRequest(**request) - - # Wrap the RPC method; this adds retry and timeout information, - # and friendly error handling. - rpc = self._transport._wrapped_methods[self._transport.list_locations] - - # Certain fields should be provided within the metadata header; - # add these here. - metadata = tuple(metadata) + ( - gapic_v1.routing_header.to_grpc_metadata( - (("name", request.name),)), - ) - - # Validate the universe domain. - self._validate_universe_domain() - - try: - # Send the request. - response = rpc( - request, retry=retry, timeout=timeout, metadata=metadata,) - - # Done; return the response. - return response - except core_exceptions.GoogleAPICallError as e: - self._add_cred_info_for_auth_errors(e) - raise e - - -DEFAULT_CLIENT_INFO = gapic_v1.client_info.ClientInfo(gapic_version=package_version.__version__) - -if hasattr(DEFAULT_CLIENT_INFO, "protobuf_runtime_version"): # pragma: NO COVER - DEFAULT_CLIENT_INFO.protobuf_runtime_version = google.protobuf.__version__ - -__all__ = ( - "ConfidentialComputingClient", -) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/README.rst b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/README.rst deleted file mode 100644 index 2bf126ac1dec..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/README.rst +++ /dev/null @@ -1,9 +0,0 @@ - -transport inheritance structure -_______________________________ - -`ConfidentialComputingTransport` is the ABC for all transports. -- public child `ConfidentialComputingGrpcTransport` for sync gRPC transport (defined in `grpc.py`). -- public child `ConfidentialComputingGrpcAsyncIOTransport` for async gRPC transport (defined in `grpc_asyncio.py`). -- private child `_BaseConfidentialComputingRestTransport` for base REST transport with inner classes `_BaseMETHOD` (defined in `rest_base.py`). -- public child `ConfidentialComputingRestTransport` for sync REST transport with inner classes `METHOD` derived from the parent's corresponding `_BaseMETHOD` classes (defined in `rest.py`). diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/__init__.py deleted file mode 100644 index c7d682081e49..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/__init__.py +++ /dev/null @@ -1,38 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -from collections import OrderedDict -from typing import Dict, Type - -from .base import ConfidentialComputingTransport -from .grpc import ConfidentialComputingGrpcTransport -from .grpc_asyncio import ConfidentialComputingGrpcAsyncIOTransport -from .rest import ConfidentialComputingRestTransport -from .rest import ConfidentialComputingRestInterceptor - - -# Compile a registry of transports. -_transport_registry = OrderedDict() # type: Dict[str, Type[ConfidentialComputingTransport]] -_transport_registry['grpc'] = ConfidentialComputingGrpcTransport -_transport_registry['grpc_asyncio'] = ConfidentialComputingGrpcAsyncIOTransport -_transport_registry['rest'] = ConfidentialComputingRestTransport - -__all__ = ( - 'ConfidentialComputingTransport', - 'ConfidentialComputingGrpcTransport', - 'ConfidentialComputingGrpcAsyncIOTransport', - 'ConfidentialComputingRestTransport', - 'ConfidentialComputingRestInterceptor', -) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/base.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/base.py deleted file mode 100644 index 40ff08bd7b14..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/base.py +++ /dev/null @@ -1,264 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -import abc -from typing import Awaitable, Callable, Dict, Optional, Sequence, Union - -from google.cloud.confidentialcomputing_v1 import gapic_version as package_version - -import google.auth # type: ignore -import google.api_core -from google.api_core import exceptions as core_exceptions -from google.api_core import gapic_v1 -from google.api_core import retry as retries -from google.auth import credentials as ga_credentials # type: ignore -from google.oauth2 import service_account # type: ignore -import google.protobuf - -from google.cloud.confidentialcomputing_v1.types import service -from google.cloud.location import locations_pb2 # type: ignore - -DEFAULT_CLIENT_INFO = gapic_v1.client_info.ClientInfo(gapic_version=package_version.__version__) - -if hasattr(DEFAULT_CLIENT_INFO, "protobuf_runtime_version"): # pragma: NO COVER - DEFAULT_CLIENT_INFO.protobuf_runtime_version = google.protobuf.__version__ - - -class ConfidentialComputingTransport(abc.ABC): - """Abstract transport class for ConfidentialComputing.""" - - AUTH_SCOPES = ( - 'https://www.googleapis.com/auth/cloud-platform', - ) - - DEFAULT_HOST: str = 'confidentialcomputing.googleapis.com' - - def __init__( - self, *, - host: str = DEFAULT_HOST, - credentials: Optional[ga_credentials.Credentials] = None, - credentials_file: Optional[str] = None, - scopes: Optional[Sequence[str]] = None, - quota_project_id: Optional[str] = None, - client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO, - always_use_jwt_access: Optional[bool] = False, - api_audience: Optional[str] = None, - **kwargs, - ) -> None: - """Instantiate the transport. - - Args: - host (Optional[str]): - The hostname to connect to (default: 'confidentialcomputing.googleapis.com'). - credentials (Optional[google.auth.credentials.Credentials]): The - authorization credentials to attach to requests. These - credentials identify the application to the service; if none - are specified, the client will attempt to ascertain the - credentials from the environment. - credentials_file (Optional[str]): A file with credentials that can - be loaded with :func:`google.auth.load_credentials_from_file`. - This argument is mutually exclusive with credentials. - scopes (Optional[Sequence[str]]): A list of scopes. - quota_project_id (Optional[str]): An optional project to use for billing - and quota. - client_info (google.api_core.gapic_v1.client_info.ClientInfo): - The client info used to send a user-agent string along with - API requests. If ``None``, then default info will be used. - Generally, you only need to set this if you're developing - your own client library. - always_use_jwt_access (Optional[bool]): Whether self signed JWT should - be used for service account credentials. - """ - - scopes_kwargs = {"scopes": scopes, "default_scopes": self.AUTH_SCOPES} - - # Save the scopes. - self._scopes = scopes - if not hasattr(self, "_ignore_credentials"): - self._ignore_credentials: bool = False - - # If no credentials are provided, then determine the appropriate - # defaults. - if credentials and credentials_file: - raise core_exceptions.DuplicateCredentialArgs("'credentials_file' and 'credentials' are mutually exclusive") - - if credentials_file is not None: - credentials, _ = google.auth.load_credentials_from_file( - credentials_file, - **scopes_kwargs, - quota_project_id=quota_project_id - ) - elif credentials is None and not self._ignore_credentials: - credentials, _ = google.auth.default(**scopes_kwargs, quota_project_id=quota_project_id) - # Don't apply audience if the credentials file passed from user. - if hasattr(credentials, "with_gdch_audience"): - credentials = credentials.with_gdch_audience(api_audience if api_audience else host) - - # If the credentials are service account credentials, then always try to use self signed JWT. - if always_use_jwt_access and isinstance(credentials, service_account.Credentials) and hasattr(service_account.Credentials, "with_always_use_jwt_access"): - credentials = credentials.with_always_use_jwt_access(True) - - # Save the credentials. - self._credentials = credentials - - # Save the hostname. Default to port 443 (HTTPS) if none is specified. - if ':' not in host: - host += ':443' - self._host = host - - @property - def host(self): - return self._host - - def _prep_wrapped_messages(self, client_info): - # Precompute the wrapped methods. - self._wrapped_methods = { - self.create_challenge: gapic_v1.method.wrap_method( - self.create_challenge, - default_retry=retries.Retry( - initial=1.0, - maximum=60.0, - multiplier=1.3, - predicate=retries.if_exception_type( - core_exceptions.ServiceUnavailable, - ), - deadline=60.0, - ), - default_timeout=60.0, - client_info=client_info, - ), - self.verify_attestation: gapic_v1.method.wrap_method( - self.verify_attestation, - default_retry=retries.Retry( - initial=1.0, - maximum=60.0, - multiplier=1.3, - predicate=retries.if_exception_type( - core_exceptions.ServiceUnavailable, - ), - deadline=60.0, - ), - default_timeout=60.0, - client_info=client_info, - ), - self.verify_confidential_space: gapic_v1.method.wrap_method( - self.verify_confidential_space, - default_retry=retries.Retry( - initial=1.0, - maximum=60.0, - multiplier=1.3, - predicate=retries.if_exception_type( - core_exceptions.ServiceUnavailable, - ), - deadline=60.0, - ), - default_timeout=60.0, - client_info=client_info, - ), - self.verify_confidential_gke: gapic_v1.method.wrap_method( - self.verify_confidential_gke, - default_retry=retries.Retry( - initial=1.0, - maximum=60.0, - multiplier=1.3, - predicate=retries.if_exception_type( - core_exceptions.ServiceUnavailable, - ), - deadline=60.0, - ), - default_timeout=60.0, - client_info=client_info, - ), - self.get_location: gapic_v1.method.wrap_method( - self.get_location, - default_timeout=None, - client_info=client_info, - ), - self.list_locations: gapic_v1.method.wrap_method( - self.list_locations, - default_timeout=None, - client_info=client_info, - ), - } - - def close(self): - """Closes resources associated with the transport. - - .. warning:: - Only call this method if the transport is NOT shared - with other clients - this may cause errors in other clients! - """ - raise NotImplementedError() - - @property - def create_challenge(self) -> Callable[ - [service.CreateChallengeRequest], - Union[ - service.Challenge, - Awaitable[service.Challenge] - ]]: - raise NotImplementedError() - - @property - def verify_attestation(self) -> Callable[ - [service.VerifyAttestationRequest], - Union[ - service.VerifyAttestationResponse, - Awaitable[service.VerifyAttestationResponse] - ]]: - raise NotImplementedError() - - @property - def verify_confidential_space(self) -> Callable[ - [service.VerifyConfidentialSpaceRequest], - Union[ - service.VerifyConfidentialSpaceResponse, - Awaitable[service.VerifyConfidentialSpaceResponse] - ]]: - raise NotImplementedError() - - @property - def verify_confidential_gke(self) -> Callable[ - [service.VerifyConfidentialGkeRequest], - Union[ - service.VerifyConfidentialGkeResponse, - Awaitable[service.VerifyConfidentialGkeResponse] - ]]: - raise NotImplementedError() - - @property - def get_location(self, - ) -> Callable[ - [locations_pb2.GetLocationRequest], - Union[locations_pb2.Location, Awaitable[locations_pb2.Location]], - ]: - raise NotImplementedError() - - @property - def list_locations(self, - ) -> Callable[ - [locations_pb2.ListLocationsRequest], - Union[locations_pb2.ListLocationsResponse, Awaitable[locations_pb2.ListLocationsResponse]], - ]: - raise NotImplementedError() - - @property - def kind(self) -> str: - raise NotImplementedError() - - -__all__ = ( - 'ConfidentialComputingTransport', -) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc.py deleted file mode 100644 index 7aa894736780..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc.py +++ /dev/null @@ -1,465 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -import json -import logging as std_logging -import pickle -import warnings -from typing import Callable, Dict, Optional, Sequence, Tuple, Union - -from google.api_core import grpc_helpers -from google.api_core import gapic_v1 -import google.auth # type: ignore -from google.auth import credentials as ga_credentials # type: ignore -from google.auth.transport.grpc import SslCredentials # type: ignore -from google.protobuf.json_format import MessageToJson -import google.protobuf.message - -import grpc # type: ignore -import proto # type: ignore - -from google.cloud.confidentialcomputing_v1.types import service -from google.cloud.location import locations_pb2 # type: ignore -from .base import ConfidentialComputingTransport, DEFAULT_CLIENT_INFO - -try: - from google.api_core import client_logging # type: ignore - CLIENT_LOGGING_SUPPORTED = True # pragma: NO COVER -except ImportError: # pragma: NO COVER - CLIENT_LOGGING_SUPPORTED = False - -_LOGGER = std_logging.getLogger(__name__) - - -class _LoggingClientInterceptor(grpc.UnaryUnaryClientInterceptor): # pragma: NO COVER - def intercept_unary_unary(self, continuation, client_call_details, request): - logging_enabled = CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(std_logging.DEBUG) - if logging_enabled: # pragma: NO COVER - request_metadata = client_call_details.metadata - if isinstance(request, proto.Message): - request_payload = type(request).to_json(request) - elif isinstance(request, google.protobuf.message.Message): - request_payload = MessageToJson(request) - else: - request_payload = f"{type(request).__name__}: {pickle.dumps(request)}" - - request_metadata = { - key: value.decode("utf-8") if isinstance(value, bytes) else value - for key, value in request_metadata - } - grpc_request = { - "payload": request_payload, - "requestMethod": "grpc", - "metadata": dict(request_metadata), - } - _LOGGER.debug( - f"Sending request for {client_call_details.method}", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "rpcName": str(client_call_details.method), - "request": grpc_request, - "metadata": grpc_request["metadata"], - }, - ) - response = continuation(client_call_details, request) - if logging_enabled: # pragma: NO COVER - response_metadata = response.trailing_metadata() - # Convert gRPC metadata `` to list of tuples - metadata = dict([(k, str(v)) for k, v in response_metadata]) if response_metadata else None - result = response.result() - if isinstance(result, proto.Message): - response_payload = type(result).to_json(result) - elif isinstance(result, google.protobuf.message.Message): - response_payload = MessageToJson(result) - else: - response_payload = f"{type(result).__name__}: {pickle.dumps(result)}" - grpc_response = { - "payload": response_payload, - "metadata": metadata, - "status": "OK", - } - _LOGGER.debug( - f"Received response for {client_call_details.method}.", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "rpcName": client_call_details.method, - "response": grpc_response, - "metadata": grpc_response["metadata"], - }, - ) - return response - - -class ConfidentialComputingGrpcTransport(ConfidentialComputingTransport): - """gRPC backend transport for ConfidentialComputing. - - Service describing handlers for resources - - This class defines the same methods as the primary client, so the - primary client can load the underlying transport implementation - and call it. - - It sends protocol buffers over the wire using gRPC (which is built on - top of HTTP/2); the ``grpcio`` package must be installed. - """ - _stubs: Dict[str, Callable] - - def __init__(self, *, - host: str = 'confidentialcomputing.googleapis.com', - credentials: Optional[ga_credentials.Credentials] = None, - credentials_file: Optional[str] = None, - scopes: Optional[Sequence[str]] = None, - channel: Optional[Union[grpc.Channel, Callable[..., grpc.Channel]]] = None, - api_mtls_endpoint: Optional[str] = None, - client_cert_source: Optional[Callable[[], Tuple[bytes, bytes]]] = None, - ssl_channel_credentials: Optional[grpc.ChannelCredentials] = None, - client_cert_source_for_mtls: Optional[Callable[[], Tuple[bytes, bytes]]] = None, - quota_project_id: Optional[str] = None, - client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO, - always_use_jwt_access: Optional[bool] = False, - api_audience: Optional[str] = None, - ) -> None: - """Instantiate the transport. - - Args: - host (Optional[str]): - The hostname to connect to (default: 'confidentialcomputing.googleapis.com'). - credentials (Optional[google.auth.credentials.Credentials]): The - authorization credentials to attach to requests. These - credentials identify the application to the service; if none - are specified, the client will attempt to ascertain the - credentials from the environment. - This argument is ignored if a ``channel`` instance is provided. - credentials_file (Optional[str]): A file with credentials that can - be loaded with :func:`google.auth.load_credentials_from_file`. - This argument is ignored if a ``channel`` instance is provided. - scopes (Optional(Sequence[str])): A list of scopes. This argument is - ignored if a ``channel`` instance is provided. - channel (Optional[Union[grpc.Channel, Callable[..., grpc.Channel]]]): - A ``Channel`` instance through which to make calls, or a Callable - that constructs and returns one. If set to None, ``self.create_channel`` - is used to create the channel. If a Callable is given, it will be called - with the same arguments as used in ``self.create_channel``. - api_mtls_endpoint (Optional[str]): Deprecated. The mutual TLS endpoint. - If provided, it overrides the ``host`` argument and tries to create - a mutual TLS channel with client SSL credentials from - ``client_cert_source`` or application default SSL credentials. - client_cert_source (Optional[Callable[[], Tuple[bytes, bytes]]]): - Deprecated. A callback to provide client SSL certificate bytes and - private key bytes, both in PEM format. It is ignored if - ``api_mtls_endpoint`` is None. - ssl_channel_credentials (grpc.ChannelCredentials): SSL credentials - for the grpc channel. It is ignored if a ``channel`` instance is provided. - client_cert_source_for_mtls (Optional[Callable[[], Tuple[bytes, bytes]]]): - A callback to provide client certificate bytes and private key bytes, - both in PEM format. It is used to configure a mutual TLS channel. It is - ignored if a ``channel`` instance or ``ssl_channel_credentials`` is provided. - quota_project_id (Optional[str]): An optional project to use for billing - and quota. - client_info (google.api_core.gapic_v1.client_info.ClientInfo): - The client info used to send a user-agent string along with - API requests. If ``None``, then default info will be used. - Generally, you only need to set this if you're developing - your own client library. - always_use_jwt_access (Optional[bool]): Whether self signed JWT should - be used for service account credentials. - - Raises: - google.auth.exceptions.MutualTLSChannelError: If mutual TLS transport - creation failed for any reason. - google.api_core.exceptions.DuplicateCredentialArgs: If both ``credentials`` - and ``credentials_file`` are passed. - """ - self._grpc_channel = None - self._ssl_channel_credentials = ssl_channel_credentials - self._stubs: Dict[str, Callable] = {} - - if api_mtls_endpoint: - warnings.warn("api_mtls_endpoint is deprecated", DeprecationWarning) - if client_cert_source: - warnings.warn("client_cert_source is deprecated", DeprecationWarning) - - if isinstance(channel, grpc.Channel): - # Ignore credentials if a channel was passed. - credentials = None - self._ignore_credentials = True - # If a channel was explicitly provided, set it. - self._grpc_channel = channel - self._ssl_channel_credentials = None - - else: - if api_mtls_endpoint: - host = api_mtls_endpoint - - # Create SSL credentials with client_cert_source or application - # default SSL credentials. - if client_cert_source: - cert, key = client_cert_source() - self._ssl_channel_credentials = grpc.ssl_channel_credentials( - certificate_chain=cert, private_key=key - ) - else: - self._ssl_channel_credentials = SslCredentials().ssl_credentials - - else: - if client_cert_source_for_mtls and not ssl_channel_credentials: - cert, key = client_cert_source_for_mtls() - self._ssl_channel_credentials = grpc.ssl_channel_credentials( - certificate_chain=cert, private_key=key - ) - - # The base transport sets the host, credentials and scopes - super().__init__( - host=host, - credentials=credentials, - credentials_file=credentials_file, - scopes=scopes, - quota_project_id=quota_project_id, - client_info=client_info, - always_use_jwt_access=always_use_jwt_access, - api_audience=api_audience, - ) - - if not self._grpc_channel: - # initialize with the provided callable or the default channel - channel_init = channel or type(self).create_channel - self._grpc_channel = channel_init( - self._host, - # use the credentials which are saved - credentials=self._credentials, - # Set ``credentials_file`` to ``None`` here as - # the credentials that we saved earlier should be used. - credentials_file=None, - scopes=self._scopes, - ssl_credentials=self._ssl_channel_credentials, - quota_project_id=quota_project_id, - options=[ - ("grpc.max_send_message_length", -1), - ("grpc.max_receive_message_length", -1), - ], - ) - - self._interceptor = _LoggingClientInterceptor() - self._logged_channel = grpc.intercept_channel(self._grpc_channel, self._interceptor) - - # Wrap messages. This must be done after self._logged_channel exists - self._prep_wrapped_messages(client_info) - - @classmethod - def create_channel(cls, - host: str = 'confidentialcomputing.googleapis.com', - credentials: Optional[ga_credentials.Credentials] = None, - credentials_file: Optional[str] = None, - scopes: Optional[Sequence[str]] = None, - quota_project_id: Optional[str] = None, - **kwargs) -> grpc.Channel: - """Create and return a gRPC channel object. - Args: - host (Optional[str]): The host for the channel to use. - credentials (Optional[~.Credentials]): The - authorization credentials to attach to requests. These - credentials identify this application to the service. If - none are specified, the client will attempt to ascertain - the credentials from the environment. - credentials_file (Optional[str]): A file with credentials that can - be loaded with :func:`google.auth.load_credentials_from_file`. - This argument is mutually exclusive with credentials. - scopes (Optional[Sequence[str]]): A optional list of scopes needed for this - service. These are only used when credentials are not specified and - are passed to :func:`google.auth.default`. - quota_project_id (Optional[str]): An optional project to use for billing - and quota. - kwargs (Optional[dict]): Keyword arguments, which are passed to the - channel creation. - Returns: - grpc.Channel: A gRPC channel object. - - Raises: - google.api_core.exceptions.DuplicateCredentialArgs: If both ``credentials`` - and ``credentials_file`` are passed. - """ - - return grpc_helpers.create_channel( - host, - credentials=credentials, - credentials_file=credentials_file, - quota_project_id=quota_project_id, - default_scopes=cls.AUTH_SCOPES, - scopes=scopes, - default_host=cls.DEFAULT_HOST, - **kwargs - ) - - @property - def grpc_channel(self) -> grpc.Channel: - """Return the channel designed to connect to this service. - """ - return self._grpc_channel - - @property - def create_challenge(self) -> Callable[ - [service.CreateChallengeRequest], - service.Challenge]: - r"""Return a callable for the create challenge method over gRPC. - - Creates a new Challenge in a given project and - location. - - Returns: - Callable[[~.CreateChallengeRequest], - ~.Challenge]: - A function that, when called, will call the underlying RPC - on the server. - """ - # Generate a "stub function" on-the-fly which will actually make - # the request. - # gRPC handles serialization and deserialization, so we just need - # to pass in the functions for each. - if 'create_challenge' not in self._stubs: - self._stubs['create_challenge'] = self._logged_channel.unary_unary( - '/google.cloud.confidentialcomputing.v1.ConfidentialComputing/CreateChallenge', - request_serializer=service.CreateChallengeRequest.serialize, - response_deserializer=service.Challenge.deserialize, - ) - return self._stubs['create_challenge'] - - @property - def verify_attestation(self) -> Callable[ - [service.VerifyAttestationRequest], - service.VerifyAttestationResponse]: - r"""Return a callable for the verify attestation method over gRPC. - - Verifies the provided attestation info, returning a - signed attestation token. - - Returns: - Callable[[~.VerifyAttestationRequest], - ~.VerifyAttestationResponse]: - A function that, when called, will call the underlying RPC - on the server. - """ - # Generate a "stub function" on-the-fly which will actually make - # the request. - # gRPC handles serialization and deserialization, so we just need - # to pass in the functions for each. - if 'verify_attestation' not in self._stubs: - self._stubs['verify_attestation'] = self._logged_channel.unary_unary( - '/google.cloud.confidentialcomputing.v1.ConfidentialComputing/VerifyAttestation', - request_serializer=service.VerifyAttestationRequest.serialize, - response_deserializer=service.VerifyAttestationResponse.deserialize, - ) - return self._stubs['verify_attestation'] - - @property - def verify_confidential_space(self) -> Callable[ - [service.VerifyConfidentialSpaceRequest], - service.VerifyConfidentialSpaceResponse]: - r"""Return a callable for the verify confidential space method over gRPC. - - Verifies whether the provided attestation info is - valid, returning a signed attestation token if so. - - Returns: - Callable[[~.VerifyConfidentialSpaceRequest], - ~.VerifyConfidentialSpaceResponse]: - A function that, when called, will call the underlying RPC - on the server. - """ - # Generate a "stub function" on-the-fly which will actually make - # the request. - # gRPC handles serialization and deserialization, so we just need - # to pass in the functions for each. - if 'verify_confidential_space' not in self._stubs: - self._stubs['verify_confidential_space'] = self._logged_channel.unary_unary( - '/google.cloud.confidentialcomputing.v1.ConfidentialComputing/VerifyConfidentialSpace', - request_serializer=service.VerifyConfidentialSpaceRequest.serialize, - response_deserializer=service.VerifyConfidentialSpaceResponse.deserialize, - ) - return self._stubs['verify_confidential_space'] - - @property - def verify_confidential_gke(self) -> Callable[ - [service.VerifyConfidentialGkeRequest], - service.VerifyConfidentialGkeResponse]: - r"""Return a callable for the verify confidential gke method over gRPC. - - Verifies the provided Confidential GKE attestation - info, returning a signed OIDC token. - - Returns: - Callable[[~.VerifyConfidentialGkeRequest], - ~.VerifyConfidentialGkeResponse]: - A function that, when called, will call the underlying RPC - on the server. - """ - # Generate a "stub function" on-the-fly which will actually make - # the request. - # gRPC handles serialization and deserialization, so we just need - # to pass in the functions for each. - if 'verify_confidential_gke' not in self._stubs: - self._stubs['verify_confidential_gke'] = self._logged_channel.unary_unary( - '/google.cloud.confidentialcomputing.v1.ConfidentialComputing/VerifyConfidentialGke', - request_serializer=service.VerifyConfidentialGkeRequest.serialize, - response_deserializer=service.VerifyConfidentialGkeResponse.deserialize, - ) - return self._stubs['verify_confidential_gke'] - - def close(self): - self._logged_channel.close() - - @property - def list_locations( - self, - ) -> Callable[[locations_pb2.ListLocationsRequest], locations_pb2.ListLocationsResponse]: - r"""Return a callable for the list locations method over gRPC. - """ - # Generate a "stub function" on-the-fly which will actually make - # the request. - # gRPC handles serialization and deserialization, so we just need - # to pass in the functions for each. - if "list_locations" not in self._stubs: - self._stubs["list_locations"] = self._logged_channel.unary_unary( - "/google.cloud.location.Locations/ListLocations", - request_serializer=locations_pb2.ListLocationsRequest.SerializeToString, - response_deserializer=locations_pb2.ListLocationsResponse.FromString, - ) - return self._stubs["list_locations"] - - @property - def get_location( - self, - ) -> Callable[[locations_pb2.GetLocationRequest], locations_pb2.Location]: - r"""Return a callable for the list locations method over gRPC. - """ - # Generate a "stub function" on-the-fly which will actually make - # the request. - # gRPC handles serialization and deserialization, so we just need - # to pass in the functions for each. - if "get_location" not in self._stubs: - self._stubs["get_location"] = self._logged_channel.unary_unary( - "/google.cloud.location.Locations/GetLocation", - request_serializer=locations_pb2.GetLocationRequest.SerializeToString, - response_deserializer=locations_pb2.Location.FromString, - ) - return self._stubs["get_location"] - - @property - def kind(self) -> str: - return "grpc" - - -__all__ = ( - 'ConfidentialComputingGrpcTransport', -) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc_asyncio.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc_asyncio.py deleted file mode 100644 index 4e254a73b6a2..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/grpc_asyncio.py +++ /dev/null @@ -1,547 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -import inspect -import json -import pickle -import logging as std_logging -import warnings -from typing import Awaitable, Callable, Dict, Optional, Sequence, Tuple, Union - -from google.api_core import gapic_v1 -from google.api_core import grpc_helpers_async -from google.api_core import exceptions as core_exceptions -from google.api_core import retry_async as retries -from google.auth import credentials as ga_credentials # type: ignore -from google.auth.transport.grpc import SslCredentials # type: ignore -from google.protobuf.json_format import MessageToJson -import google.protobuf.message - -import grpc # type: ignore -import proto # type: ignore -from grpc.experimental import aio # type: ignore - -from google.cloud.confidentialcomputing_v1.types import service -from google.cloud.location import locations_pb2 # type: ignore -from .base import ConfidentialComputingTransport, DEFAULT_CLIENT_INFO -from .grpc import ConfidentialComputingGrpcTransport - -try: - from google.api_core import client_logging # type: ignore - CLIENT_LOGGING_SUPPORTED = True # pragma: NO COVER -except ImportError: # pragma: NO COVER - CLIENT_LOGGING_SUPPORTED = False - -_LOGGER = std_logging.getLogger(__name__) - - -class _LoggingClientAIOInterceptor(grpc.aio.UnaryUnaryClientInterceptor): # pragma: NO COVER - async def intercept_unary_unary(self, continuation, client_call_details, request): - logging_enabled = CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(std_logging.DEBUG) - if logging_enabled: # pragma: NO COVER - request_metadata = client_call_details.metadata - if isinstance(request, proto.Message): - request_payload = type(request).to_json(request) - elif isinstance(request, google.protobuf.message.Message): - request_payload = MessageToJson(request) - else: - request_payload = f"{type(request).__name__}: {pickle.dumps(request)}" - - request_metadata = { - key: value.decode("utf-8") if isinstance(value, bytes) else value - for key, value in request_metadata - } - grpc_request = { - "payload": request_payload, - "requestMethod": "grpc", - "metadata": dict(request_metadata), - } - _LOGGER.debug( - f"Sending request for {client_call_details.method}", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "rpcName": str(client_call_details.method), - "request": grpc_request, - "metadata": grpc_request["metadata"], - }, - ) - response = await continuation(client_call_details, request) - if logging_enabled: # pragma: NO COVER - response_metadata = await response.trailing_metadata() - # Convert gRPC metadata `` to list of tuples - metadata = dict([(k, str(v)) for k, v in response_metadata]) if response_metadata else None - result = await response - if isinstance(result, proto.Message): - response_payload = type(result).to_json(result) - elif isinstance(result, google.protobuf.message.Message): - response_payload = MessageToJson(result) - else: - response_payload = f"{type(result).__name__}: {pickle.dumps(result)}" - grpc_response = { - "payload": response_payload, - "metadata": metadata, - "status": "OK", - } - _LOGGER.debug( - f"Received response to rpc {client_call_details.method}.", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "rpcName": str(client_call_details.method), - "response": grpc_response, - "metadata": grpc_response["metadata"], - }, - ) - return response - - -class ConfidentialComputingGrpcAsyncIOTransport(ConfidentialComputingTransport): - """gRPC AsyncIO backend transport for ConfidentialComputing. - - Service describing handlers for resources - - This class defines the same methods as the primary client, so the - primary client can load the underlying transport implementation - and call it. - - It sends protocol buffers over the wire using gRPC (which is built on - top of HTTP/2); the ``grpcio`` package must be installed. - """ - - _grpc_channel: aio.Channel - _stubs: Dict[str, Callable] = {} - - @classmethod - def create_channel(cls, - host: str = 'confidentialcomputing.googleapis.com', - credentials: Optional[ga_credentials.Credentials] = None, - credentials_file: Optional[str] = None, - scopes: Optional[Sequence[str]] = None, - quota_project_id: Optional[str] = None, - **kwargs) -> aio.Channel: - """Create and return a gRPC AsyncIO channel object. - Args: - host (Optional[str]): The host for the channel to use. - credentials (Optional[~.Credentials]): The - authorization credentials to attach to requests. These - credentials identify this application to the service. If - none are specified, the client will attempt to ascertain - the credentials from the environment. - credentials_file (Optional[str]): A file with credentials that can - be loaded with :func:`google.auth.load_credentials_from_file`. - scopes (Optional[Sequence[str]]): A optional list of scopes needed for this - service. These are only used when credentials are not specified and - are passed to :func:`google.auth.default`. - quota_project_id (Optional[str]): An optional project to use for billing - and quota. - kwargs (Optional[dict]): Keyword arguments, which are passed to the - channel creation. - Returns: - aio.Channel: A gRPC AsyncIO channel object. - """ - - return grpc_helpers_async.create_channel( - host, - credentials=credentials, - credentials_file=credentials_file, - quota_project_id=quota_project_id, - default_scopes=cls.AUTH_SCOPES, - scopes=scopes, - default_host=cls.DEFAULT_HOST, - **kwargs - ) - - def __init__(self, *, - host: str = 'confidentialcomputing.googleapis.com', - credentials: Optional[ga_credentials.Credentials] = None, - credentials_file: Optional[str] = None, - scopes: Optional[Sequence[str]] = None, - channel: Optional[Union[aio.Channel, Callable[..., aio.Channel]]] = None, - api_mtls_endpoint: Optional[str] = None, - client_cert_source: Optional[Callable[[], Tuple[bytes, bytes]]] = None, - ssl_channel_credentials: Optional[grpc.ChannelCredentials] = None, - client_cert_source_for_mtls: Optional[Callable[[], Tuple[bytes, bytes]]] = None, - quota_project_id: Optional[str] = None, - client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO, - always_use_jwt_access: Optional[bool] = False, - api_audience: Optional[str] = None, - ) -> None: - """Instantiate the transport. - - Args: - host (Optional[str]): - The hostname to connect to (default: 'confidentialcomputing.googleapis.com'). - credentials (Optional[google.auth.credentials.Credentials]): The - authorization credentials to attach to requests. These - credentials identify the application to the service; if none - are specified, the client will attempt to ascertain the - credentials from the environment. - This argument is ignored if a ``channel`` instance is provided. - credentials_file (Optional[str]): A file with credentials that can - be loaded with :func:`google.auth.load_credentials_from_file`. - This argument is ignored if a ``channel`` instance is provided. - scopes (Optional[Sequence[str]]): A optional list of scopes needed for this - service. These are only used when credentials are not specified and - are passed to :func:`google.auth.default`. - channel (Optional[Union[aio.Channel, Callable[..., aio.Channel]]]): - A ``Channel`` instance through which to make calls, or a Callable - that constructs and returns one. If set to None, ``self.create_channel`` - is used to create the channel. If a Callable is given, it will be called - with the same arguments as used in ``self.create_channel``. - api_mtls_endpoint (Optional[str]): Deprecated. The mutual TLS endpoint. - If provided, it overrides the ``host`` argument and tries to create - a mutual TLS channel with client SSL credentials from - ``client_cert_source`` or application default SSL credentials. - client_cert_source (Optional[Callable[[], Tuple[bytes, bytes]]]): - Deprecated. A callback to provide client SSL certificate bytes and - private key bytes, both in PEM format. It is ignored if - ``api_mtls_endpoint`` is None. - ssl_channel_credentials (grpc.ChannelCredentials): SSL credentials - for the grpc channel. It is ignored if a ``channel`` instance is provided. - client_cert_source_for_mtls (Optional[Callable[[], Tuple[bytes, bytes]]]): - A callback to provide client certificate bytes and private key bytes, - both in PEM format. It is used to configure a mutual TLS channel. It is - ignored if a ``channel`` instance or ``ssl_channel_credentials`` is provided. - quota_project_id (Optional[str]): An optional project to use for billing - and quota. - client_info (google.api_core.gapic_v1.client_info.ClientInfo): - The client info used to send a user-agent string along with - API requests. If ``None``, then default info will be used. - Generally, you only need to set this if you're developing - your own client library. - always_use_jwt_access (Optional[bool]): Whether self signed JWT should - be used for service account credentials. - - Raises: - google.auth.exceptions.MutualTlsChannelError: If mutual TLS transport - creation failed for any reason. - google.api_core.exceptions.DuplicateCredentialArgs: If both ``credentials`` - and ``credentials_file`` are passed. - """ - self._grpc_channel = None - self._ssl_channel_credentials = ssl_channel_credentials - self._stubs: Dict[str, Callable] = {} - - if api_mtls_endpoint: - warnings.warn("api_mtls_endpoint is deprecated", DeprecationWarning) - if client_cert_source: - warnings.warn("client_cert_source is deprecated", DeprecationWarning) - - if isinstance(channel, aio.Channel): - # Ignore credentials if a channel was passed. - credentials = None - self._ignore_credentials = True - # If a channel was explicitly provided, set it. - self._grpc_channel = channel - self._ssl_channel_credentials = None - else: - if api_mtls_endpoint: - host = api_mtls_endpoint - - # Create SSL credentials with client_cert_source or application - # default SSL credentials. - if client_cert_source: - cert, key = client_cert_source() - self._ssl_channel_credentials = grpc.ssl_channel_credentials( - certificate_chain=cert, private_key=key - ) - else: - self._ssl_channel_credentials = SslCredentials().ssl_credentials - - else: - if client_cert_source_for_mtls and not ssl_channel_credentials: - cert, key = client_cert_source_for_mtls() - self._ssl_channel_credentials = grpc.ssl_channel_credentials( - certificate_chain=cert, private_key=key - ) - - # The base transport sets the host, credentials and scopes - super().__init__( - host=host, - credentials=credentials, - credentials_file=credentials_file, - scopes=scopes, - quota_project_id=quota_project_id, - client_info=client_info, - always_use_jwt_access=always_use_jwt_access, - api_audience=api_audience, - ) - - if not self._grpc_channel: - # initialize with the provided callable or the default channel - channel_init = channel or type(self).create_channel - self._grpc_channel = channel_init( - self._host, - # use the credentials which are saved - credentials=self._credentials, - # Set ``credentials_file`` to ``None`` here as - # the credentials that we saved earlier should be used. - credentials_file=None, - scopes=self._scopes, - ssl_credentials=self._ssl_channel_credentials, - quota_project_id=quota_project_id, - options=[ - ("grpc.max_send_message_length", -1), - ("grpc.max_receive_message_length", -1), - ], - ) - - self._interceptor = _LoggingClientAIOInterceptor() - self._grpc_channel._unary_unary_interceptors.append(self._interceptor) - self._logged_channel = self._grpc_channel - self._wrap_with_kind = "kind" in inspect.signature(gapic_v1.method_async.wrap_method).parameters - # Wrap messages. This must be done after self._logged_channel exists - self._prep_wrapped_messages(client_info) - - @property - def grpc_channel(self) -> aio.Channel: - """Create the channel designed to connect to this service. - - This property caches on the instance; repeated calls return - the same channel. - """ - # Return the channel from cache. - return self._grpc_channel - - @property - def create_challenge(self) -> Callable[ - [service.CreateChallengeRequest], - Awaitable[service.Challenge]]: - r"""Return a callable for the create challenge method over gRPC. - - Creates a new Challenge in a given project and - location. - - Returns: - Callable[[~.CreateChallengeRequest], - Awaitable[~.Challenge]]: - A function that, when called, will call the underlying RPC - on the server. - """ - # Generate a "stub function" on-the-fly which will actually make - # the request. - # gRPC handles serialization and deserialization, so we just need - # to pass in the functions for each. - if 'create_challenge' not in self._stubs: - self._stubs['create_challenge'] = self._logged_channel.unary_unary( - '/google.cloud.confidentialcomputing.v1.ConfidentialComputing/CreateChallenge', - request_serializer=service.CreateChallengeRequest.serialize, - response_deserializer=service.Challenge.deserialize, - ) - return self._stubs['create_challenge'] - - @property - def verify_attestation(self) -> Callable[ - [service.VerifyAttestationRequest], - Awaitable[service.VerifyAttestationResponse]]: - r"""Return a callable for the verify attestation method over gRPC. - - Verifies the provided attestation info, returning a - signed attestation token. - - Returns: - Callable[[~.VerifyAttestationRequest], - Awaitable[~.VerifyAttestationResponse]]: - A function that, when called, will call the underlying RPC - on the server. - """ - # Generate a "stub function" on-the-fly which will actually make - # the request. - # gRPC handles serialization and deserialization, so we just need - # to pass in the functions for each. - if 'verify_attestation' not in self._stubs: - self._stubs['verify_attestation'] = self._logged_channel.unary_unary( - '/google.cloud.confidentialcomputing.v1.ConfidentialComputing/VerifyAttestation', - request_serializer=service.VerifyAttestationRequest.serialize, - response_deserializer=service.VerifyAttestationResponse.deserialize, - ) - return self._stubs['verify_attestation'] - - @property - def verify_confidential_space(self) -> Callable[ - [service.VerifyConfidentialSpaceRequest], - Awaitable[service.VerifyConfidentialSpaceResponse]]: - r"""Return a callable for the verify confidential space method over gRPC. - - Verifies whether the provided attestation info is - valid, returning a signed attestation token if so. - - Returns: - Callable[[~.VerifyConfidentialSpaceRequest], - Awaitable[~.VerifyConfidentialSpaceResponse]]: - A function that, when called, will call the underlying RPC - on the server. - """ - # Generate a "stub function" on-the-fly which will actually make - # the request. - # gRPC handles serialization and deserialization, so we just need - # to pass in the functions for each. - if 'verify_confidential_space' not in self._stubs: - self._stubs['verify_confidential_space'] = self._logged_channel.unary_unary( - '/google.cloud.confidentialcomputing.v1.ConfidentialComputing/VerifyConfidentialSpace', - request_serializer=service.VerifyConfidentialSpaceRequest.serialize, - response_deserializer=service.VerifyConfidentialSpaceResponse.deserialize, - ) - return self._stubs['verify_confidential_space'] - - @property - def verify_confidential_gke(self) -> Callable[ - [service.VerifyConfidentialGkeRequest], - Awaitable[service.VerifyConfidentialGkeResponse]]: - r"""Return a callable for the verify confidential gke method over gRPC. - - Verifies the provided Confidential GKE attestation - info, returning a signed OIDC token. - - Returns: - Callable[[~.VerifyConfidentialGkeRequest], - Awaitable[~.VerifyConfidentialGkeResponse]]: - A function that, when called, will call the underlying RPC - on the server. - """ - # Generate a "stub function" on-the-fly which will actually make - # the request. - # gRPC handles serialization and deserialization, so we just need - # to pass in the functions for each. - if 'verify_confidential_gke' not in self._stubs: - self._stubs['verify_confidential_gke'] = self._logged_channel.unary_unary( - '/google.cloud.confidentialcomputing.v1.ConfidentialComputing/VerifyConfidentialGke', - request_serializer=service.VerifyConfidentialGkeRequest.serialize, - response_deserializer=service.VerifyConfidentialGkeResponse.deserialize, - ) - return self._stubs['verify_confidential_gke'] - - def _prep_wrapped_messages(self, client_info): - """ Precompute the wrapped methods, overriding the base class method to use async wrappers.""" - self._wrapped_methods = { - self.create_challenge: self._wrap_method( - self.create_challenge, - default_retry=retries.AsyncRetry( - initial=1.0, - maximum=60.0, - multiplier=1.3, - predicate=retries.if_exception_type( - core_exceptions.ServiceUnavailable, - ), - deadline=60.0, - ), - default_timeout=60.0, - client_info=client_info, - ), - self.verify_attestation: self._wrap_method( - self.verify_attestation, - default_retry=retries.AsyncRetry( - initial=1.0, - maximum=60.0, - multiplier=1.3, - predicate=retries.if_exception_type( - core_exceptions.ServiceUnavailable, - ), - deadline=60.0, - ), - default_timeout=60.0, - client_info=client_info, - ), - self.verify_confidential_space: self._wrap_method( - self.verify_confidential_space, - default_retry=retries.AsyncRetry( - initial=1.0, - maximum=60.0, - multiplier=1.3, - predicate=retries.if_exception_type( - core_exceptions.ServiceUnavailable, - ), - deadline=60.0, - ), - default_timeout=60.0, - client_info=client_info, - ), - self.verify_confidential_gke: self._wrap_method( - self.verify_confidential_gke, - default_retry=retries.AsyncRetry( - initial=1.0, - maximum=60.0, - multiplier=1.3, - predicate=retries.if_exception_type( - core_exceptions.ServiceUnavailable, - ), - deadline=60.0, - ), - default_timeout=60.0, - client_info=client_info, - ), - self.get_location: self._wrap_method( - self.get_location, - default_timeout=None, - client_info=client_info, - ), - self.list_locations: self._wrap_method( - self.list_locations, - default_timeout=None, - client_info=client_info, - ), - } - - def _wrap_method(self, func, *args, **kwargs): - if self._wrap_with_kind: # pragma: NO COVER - kwargs["kind"] = self.kind - return gapic_v1.method_async.wrap_method(func, *args, **kwargs) - - def close(self): - return self._logged_channel.close() - - @property - def kind(self) -> str: - return "grpc_asyncio" - - @property - def list_locations( - self, - ) -> Callable[[locations_pb2.ListLocationsRequest], locations_pb2.ListLocationsResponse]: - r"""Return a callable for the list locations method over gRPC. - """ - # Generate a "stub function" on-the-fly which will actually make - # the request. - # gRPC handles serialization and deserialization, so we just need - # to pass in the functions for each. - if "list_locations" not in self._stubs: - self._stubs["list_locations"] = self._logged_channel.unary_unary( - "/google.cloud.location.Locations/ListLocations", - request_serializer=locations_pb2.ListLocationsRequest.SerializeToString, - response_deserializer=locations_pb2.ListLocationsResponse.FromString, - ) - return self._stubs["list_locations"] - - @property - def get_location( - self, - ) -> Callable[[locations_pb2.GetLocationRequest], locations_pb2.Location]: - r"""Return a callable for the list locations method over gRPC. - """ - # Generate a "stub function" on-the-fly which will actually make - # the request. - # gRPC handles serialization and deserialization, so we just need - # to pass in the functions for each. - if "get_location" not in self._stubs: - self._stubs["get_location"] = self._logged_channel.unary_unary( - "/google.cloud.location.Locations/GetLocation", - request_serializer=locations_pb2.GetLocationRequest.SerializeToString, - response_deserializer=locations_pb2.Location.FromString, - ) - return self._stubs["get_location"] - - -__all__ = ( - 'ConfidentialComputingGrpcAsyncIOTransport', -) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest.py deleted file mode 100644 index 440084e79181..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest.py +++ /dev/null @@ -1,1179 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -import logging -import json # type: ignore - -from google.auth.transport.requests import AuthorizedSession # type: ignore -from google.auth import credentials as ga_credentials # type: ignore -from google.api_core import exceptions as core_exceptions -from google.api_core import retry as retries -from google.api_core import rest_helpers -from google.api_core import rest_streaming -from google.api_core import gapic_v1 -import google.protobuf - -from google.protobuf import json_format -from google.cloud.location import locations_pb2 # type: ignore - -from requests import __version__ as requests_version -import dataclasses -from typing import Any, Callable, Dict, List, Optional, Sequence, Tuple, Union -import warnings - - -from google.cloud.confidentialcomputing_v1.types import service - - -from .rest_base import _BaseConfidentialComputingRestTransport -from .base import DEFAULT_CLIENT_INFO as BASE_DEFAULT_CLIENT_INFO - -try: - OptionalRetry = Union[retries.Retry, gapic_v1.method._MethodDefault, None] -except AttributeError: # pragma: NO COVER - OptionalRetry = Union[retries.Retry, object, None] # type: ignore - -try: - from google.api_core import client_logging # type: ignore - CLIENT_LOGGING_SUPPORTED = True # pragma: NO COVER -except ImportError: # pragma: NO COVER - CLIENT_LOGGING_SUPPORTED = False - -_LOGGER = logging.getLogger(__name__) - -DEFAULT_CLIENT_INFO = gapic_v1.client_info.ClientInfo( - gapic_version=BASE_DEFAULT_CLIENT_INFO.gapic_version, - grpc_version=None, - rest_version=f"requests@{requests_version}", -) - -if hasattr(DEFAULT_CLIENT_INFO, "protobuf_runtime_version"): # pragma: NO COVER - DEFAULT_CLIENT_INFO.protobuf_runtime_version = google.protobuf.__version__ - - -class ConfidentialComputingRestInterceptor: - """Interceptor for ConfidentialComputing. - - Interceptors are used to manipulate requests, request metadata, and responses - in arbitrary ways. - Example use cases include: - * Logging - * Verifying requests according to service or custom semantics - * Stripping extraneous information from responses - - These use cases and more can be enabled by injecting an - instance of a custom subclass when constructing the ConfidentialComputingRestTransport. - - .. code-block:: python - class MyCustomConfidentialComputingInterceptor(ConfidentialComputingRestInterceptor): - def pre_create_challenge(self, request, metadata): - logging.log(f"Received request: {request}") - return request, metadata - - def post_create_challenge(self, response): - logging.log(f"Received response: {response}") - return response - - def pre_verify_attestation(self, request, metadata): - logging.log(f"Received request: {request}") - return request, metadata - - def post_verify_attestation(self, response): - logging.log(f"Received response: {response}") - return response - - def pre_verify_confidential_gke(self, request, metadata): - logging.log(f"Received request: {request}") - return request, metadata - - def post_verify_confidential_gke(self, response): - logging.log(f"Received response: {response}") - return response - - def pre_verify_confidential_space(self, request, metadata): - logging.log(f"Received request: {request}") - return request, metadata - - def post_verify_confidential_space(self, response): - logging.log(f"Received response: {response}") - return response - - transport = ConfidentialComputingRestTransport(interceptor=MyCustomConfidentialComputingInterceptor()) - client = ConfidentialComputingClient(transport=transport) - - - """ - def pre_create_challenge(self, request: service.CreateChallengeRequest, metadata: Sequence[Tuple[str, Union[str, bytes]]]) -> Tuple[service.CreateChallengeRequest, Sequence[Tuple[str, Union[str, bytes]]]]: - """Pre-rpc interceptor for create_challenge - - Override in a subclass to manipulate the request or metadata - before they are sent to the ConfidentialComputing server. - """ - return request, metadata - - def post_create_challenge(self, response: service.Challenge) -> service.Challenge: - """Post-rpc interceptor for create_challenge - - DEPRECATED. Please use the `post_create_challenge_with_metadata` - interceptor instead. - - Override in a subclass to read or manipulate the response - after it is returned by the ConfidentialComputing server but before - it is returned to user code. This `post_create_challenge` interceptor runs - before the `post_create_challenge_with_metadata` interceptor. - """ - return response - - def post_create_challenge_with_metadata(self, response: service.Challenge, metadata: Sequence[Tuple[str, Union[str, bytes]]]) -> Tuple[service.Challenge, Sequence[Tuple[str, Union[str, bytes]]]]: - """Post-rpc interceptor for create_challenge - - Override in a subclass to read or manipulate the response or metadata after it - is returned by the ConfidentialComputing server but before it is returned to user code. - - We recommend only using this `post_create_challenge_with_metadata` - interceptor in new development instead of the `post_create_challenge` interceptor. - When both interceptors are used, this `post_create_challenge_with_metadata` interceptor runs after the - `post_create_challenge` interceptor. The (possibly modified) response returned by - `post_create_challenge` will be passed to - `post_create_challenge_with_metadata`. - """ - return response, metadata - - def pre_verify_attestation(self, request: service.VerifyAttestationRequest, metadata: Sequence[Tuple[str, Union[str, bytes]]]) -> Tuple[service.VerifyAttestationRequest, Sequence[Tuple[str, Union[str, bytes]]]]: - """Pre-rpc interceptor for verify_attestation - - Override in a subclass to manipulate the request or metadata - before they are sent to the ConfidentialComputing server. - """ - return request, metadata - - def post_verify_attestation(self, response: service.VerifyAttestationResponse) -> service.VerifyAttestationResponse: - """Post-rpc interceptor for verify_attestation - - DEPRECATED. Please use the `post_verify_attestation_with_metadata` - interceptor instead. - - Override in a subclass to read or manipulate the response - after it is returned by the ConfidentialComputing server but before - it is returned to user code. This `post_verify_attestation` interceptor runs - before the `post_verify_attestation_with_metadata` interceptor. - """ - return response - - def post_verify_attestation_with_metadata(self, response: service.VerifyAttestationResponse, metadata: Sequence[Tuple[str, Union[str, bytes]]]) -> Tuple[service.VerifyAttestationResponse, Sequence[Tuple[str, Union[str, bytes]]]]: - """Post-rpc interceptor for verify_attestation - - Override in a subclass to read or manipulate the response or metadata after it - is returned by the ConfidentialComputing server but before it is returned to user code. - - We recommend only using this `post_verify_attestation_with_metadata` - interceptor in new development instead of the `post_verify_attestation` interceptor. - When both interceptors are used, this `post_verify_attestation_with_metadata` interceptor runs after the - `post_verify_attestation` interceptor. The (possibly modified) response returned by - `post_verify_attestation` will be passed to - `post_verify_attestation_with_metadata`. - """ - return response, metadata - - def pre_verify_confidential_gke(self, request: service.VerifyConfidentialGkeRequest, metadata: Sequence[Tuple[str, Union[str, bytes]]]) -> Tuple[service.VerifyConfidentialGkeRequest, Sequence[Tuple[str, Union[str, bytes]]]]: - """Pre-rpc interceptor for verify_confidential_gke - - Override in a subclass to manipulate the request or metadata - before they are sent to the ConfidentialComputing server. - """ - return request, metadata - - def post_verify_confidential_gke(self, response: service.VerifyConfidentialGkeResponse) -> service.VerifyConfidentialGkeResponse: - """Post-rpc interceptor for verify_confidential_gke - - DEPRECATED. Please use the `post_verify_confidential_gke_with_metadata` - interceptor instead. - - Override in a subclass to read or manipulate the response - after it is returned by the ConfidentialComputing server but before - it is returned to user code. This `post_verify_confidential_gke` interceptor runs - before the `post_verify_confidential_gke_with_metadata` interceptor. - """ - return response - - def post_verify_confidential_gke_with_metadata(self, response: service.VerifyConfidentialGkeResponse, metadata: Sequence[Tuple[str, Union[str, bytes]]]) -> Tuple[service.VerifyConfidentialGkeResponse, Sequence[Tuple[str, Union[str, bytes]]]]: - """Post-rpc interceptor for verify_confidential_gke - - Override in a subclass to read or manipulate the response or metadata after it - is returned by the ConfidentialComputing server but before it is returned to user code. - - We recommend only using this `post_verify_confidential_gke_with_metadata` - interceptor in new development instead of the `post_verify_confidential_gke` interceptor. - When both interceptors are used, this `post_verify_confidential_gke_with_metadata` interceptor runs after the - `post_verify_confidential_gke` interceptor. The (possibly modified) response returned by - `post_verify_confidential_gke` will be passed to - `post_verify_confidential_gke_with_metadata`. - """ - return response, metadata - - def pre_verify_confidential_space(self, request: service.VerifyConfidentialSpaceRequest, metadata: Sequence[Tuple[str, Union[str, bytes]]]) -> Tuple[service.VerifyConfidentialSpaceRequest, Sequence[Tuple[str, Union[str, bytes]]]]: - """Pre-rpc interceptor for verify_confidential_space - - Override in a subclass to manipulate the request or metadata - before they are sent to the ConfidentialComputing server. - """ - return request, metadata - - def post_verify_confidential_space(self, response: service.VerifyConfidentialSpaceResponse) -> service.VerifyConfidentialSpaceResponse: - """Post-rpc interceptor for verify_confidential_space - - DEPRECATED. Please use the `post_verify_confidential_space_with_metadata` - interceptor instead. - - Override in a subclass to read or manipulate the response - after it is returned by the ConfidentialComputing server but before - it is returned to user code. This `post_verify_confidential_space` interceptor runs - before the `post_verify_confidential_space_with_metadata` interceptor. - """ - return response - - def post_verify_confidential_space_with_metadata(self, response: service.VerifyConfidentialSpaceResponse, metadata: Sequence[Tuple[str, Union[str, bytes]]]) -> Tuple[service.VerifyConfidentialSpaceResponse, Sequence[Tuple[str, Union[str, bytes]]]]: - """Post-rpc interceptor for verify_confidential_space - - Override in a subclass to read or manipulate the response or metadata after it - is returned by the ConfidentialComputing server but before it is returned to user code. - - We recommend only using this `post_verify_confidential_space_with_metadata` - interceptor in new development instead of the `post_verify_confidential_space` interceptor. - When both interceptors are used, this `post_verify_confidential_space_with_metadata` interceptor runs after the - `post_verify_confidential_space` interceptor. The (possibly modified) response returned by - `post_verify_confidential_space` will be passed to - `post_verify_confidential_space_with_metadata`. - """ - return response, metadata - - def pre_get_location( - self, request: locations_pb2.GetLocationRequest, metadata: Sequence[Tuple[str, Union[str, bytes]]] - ) -> Tuple[locations_pb2.GetLocationRequest, Sequence[Tuple[str, Union[str, bytes]]]]: - """Pre-rpc interceptor for get_location - - Override in a subclass to manipulate the request or metadata - before they are sent to the ConfidentialComputing server. - """ - return request, metadata - - def post_get_location( - self, response: locations_pb2.Location - ) -> locations_pb2.Location: - """Post-rpc interceptor for get_location - - Override in a subclass to manipulate the response - after it is returned by the ConfidentialComputing server but before - it is returned to user code. - """ - return response - - def pre_list_locations( - self, request: locations_pb2.ListLocationsRequest, metadata: Sequence[Tuple[str, Union[str, bytes]]] - ) -> Tuple[locations_pb2.ListLocationsRequest, Sequence[Tuple[str, Union[str, bytes]]]]: - """Pre-rpc interceptor for list_locations - - Override in a subclass to manipulate the request or metadata - before they are sent to the ConfidentialComputing server. - """ - return request, metadata - - def post_list_locations( - self, response: locations_pb2.ListLocationsResponse - ) -> locations_pb2.ListLocationsResponse: - """Post-rpc interceptor for list_locations - - Override in a subclass to manipulate the response - after it is returned by the ConfidentialComputing server but before - it is returned to user code. - """ - return response - - -@dataclasses.dataclass -class ConfidentialComputingRestStub: - _session: AuthorizedSession - _host: str - _interceptor: ConfidentialComputingRestInterceptor - - -class ConfidentialComputingRestTransport(_BaseConfidentialComputingRestTransport): - """REST backend synchronous transport for ConfidentialComputing. - - Service describing handlers for resources - - This class defines the same methods as the primary client, so the - primary client can load the underlying transport implementation - and call it. - - It sends JSON representations of protocol buffers over HTTP/1.1 - """ - - def __init__(self, *, - host: str = 'confidentialcomputing.googleapis.com', - credentials: Optional[ga_credentials.Credentials] = None, - credentials_file: Optional[str] = None, - scopes: Optional[Sequence[str]] = None, - client_cert_source_for_mtls: Optional[Callable[[ - ], Tuple[bytes, bytes]]] = None, - quota_project_id: Optional[str] = None, - client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO, - always_use_jwt_access: Optional[bool] = False, - url_scheme: str = 'https', - interceptor: Optional[ConfidentialComputingRestInterceptor] = None, - api_audience: Optional[str] = None, - ) -> None: - """Instantiate the transport. - - Args: - host (Optional[str]): - The hostname to connect to (default: 'confidentialcomputing.googleapis.com'). - credentials (Optional[google.auth.credentials.Credentials]): The - authorization credentials to attach to requests. These - credentials identify the application to the service; if none - are specified, the client will attempt to ascertain the - credentials from the environment. - - credentials_file (Optional[str]): A file with credentials that can - be loaded with :func:`google.auth.load_credentials_from_file`. - This argument is ignored if ``channel`` is provided. - scopes (Optional(Sequence[str])): A list of scopes. This argument is - ignored if ``channel`` is provided. - client_cert_source_for_mtls (Callable[[], Tuple[bytes, bytes]]): Client - certificate to configure mutual TLS HTTP channel. It is ignored - if ``channel`` is provided. - quota_project_id (Optional[str]): An optional project to use for billing - and quota. - client_info (google.api_core.gapic_v1.client_info.ClientInfo): - The client info used to send a user-agent string along with - API requests. If ``None``, then default info will be used. - Generally, you only need to set this if you are developing - your own client library. - always_use_jwt_access (Optional[bool]): Whether self signed JWT should - be used for service account credentials. - url_scheme: the protocol scheme for the API endpoint. Normally - "https", but for testing or local servers, - "http" can be specified. - """ - # Run the base constructor - # TODO(yon-mg): resolve other ctor params i.e. scopes, quota, etc. - # TODO: When custom host (api_endpoint) is set, `scopes` must *also* be set on the - # credentials object - super().__init__( - host=host, - credentials=credentials, - client_info=client_info, - always_use_jwt_access=always_use_jwt_access, - url_scheme=url_scheme, - api_audience=api_audience - ) - self._session = AuthorizedSession( - self._credentials, default_host=self.DEFAULT_HOST) - if client_cert_source_for_mtls: - self._session.configure_mtls_channel(client_cert_source_for_mtls) - self._interceptor = interceptor or ConfidentialComputingRestInterceptor() - self._prep_wrapped_messages(client_info) - - class _CreateChallenge(_BaseConfidentialComputingRestTransport._BaseCreateChallenge, ConfidentialComputingRestStub): - def __hash__(self): - return hash("ConfidentialComputingRestTransport.CreateChallenge") - - @staticmethod - def _get_response( - host, - metadata, - query_params, - session, - timeout, - transcoded_request, - body=None): - - uri = transcoded_request['uri'] - method = transcoded_request['method'] - headers = dict(metadata) - headers['Content-Type'] = 'application/json' - response = getattr(session, method)( - "{host}{uri}".format(host=host, uri=uri), - timeout=timeout, - headers=headers, - params=rest_helpers.flatten_query_params(query_params, strict=True), - data=body, - ) - return response - - def __call__(self, - request: service.CreateChallengeRequest, *, - retry: OptionalRetry=gapic_v1.method.DEFAULT, - timeout: Optional[float]=None, - metadata: Sequence[Tuple[str, Union[str, bytes]]]=(), - ) -> service.Challenge: - r"""Call the create challenge method over HTTP. - - Args: - request (~.service.CreateChallengeRequest): - The request object. Message for creating a Challenge - retry (google.api_core.retry.Retry): Designation of what errors, if any, - should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - - Returns: - ~.service.Challenge: - A Challenge from the server used to - guarantee freshness of attestations - - """ - - http_options = _BaseConfidentialComputingRestTransport._BaseCreateChallenge._get_http_options() - - request, metadata = self._interceptor.pre_create_challenge(request, metadata) - transcoded_request = _BaseConfidentialComputingRestTransport._BaseCreateChallenge._get_transcoded_request(http_options, request) - - body = _BaseConfidentialComputingRestTransport._BaseCreateChallenge._get_request_body_json(transcoded_request) - - # Jsonify the query params - query_params = _BaseConfidentialComputingRestTransport._BaseCreateChallenge._get_query_params_json(transcoded_request) - - if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER - request_url = "{host}{uri}".format(host=self._host, uri=transcoded_request['uri']) - method = transcoded_request['method'] - try: - request_payload = type(request).to_json(request) - except: - request_payload = None - http_request = { - "payload": request_payload, - "requestMethod": method, - "requestUrl": request_url, - "headers": dict(metadata), - } - _LOGGER.debug( - f"Sending request for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.CreateChallenge", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "rpcName": "CreateChallenge", - "httpRequest": http_request, - "metadata": http_request["headers"], - }, - ) - - # Send the request - response = ConfidentialComputingRestTransport._CreateChallenge._get_response(self._host, metadata, query_params, self._session, timeout, transcoded_request, body) - - # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception - # subclass. - if response.status_code >= 400: - raise core_exceptions.from_http_response(response) - - # Return the response - resp = service.Challenge() - pb_resp = service.Challenge.pb(resp) - - json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True) - - resp = self._interceptor.post_create_challenge(resp) - response_metadata = [(k, str(v)) for k, v in response.headers.items()] - resp, _ = self._interceptor.post_create_challenge_with_metadata(resp, response_metadata) - if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER - try: - response_payload = service.Challenge.to_json(response) - except: - response_payload = None - http_response = { - "payload": response_payload, - "headers": dict(response.headers), - "status": response.status_code, - } - _LOGGER.debug( - "Received response for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.create_challenge", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "rpcName": "CreateChallenge", - "metadata": http_response["headers"], - "httpResponse": http_response, - }, - ) - return resp - - class _VerifyAttestation(_BaseConfidentialComputingRestTransport._BaseVerifyAttestation, ConfidentialComputingRestStub): - def __hash__(self): - return hash("ConfidentialComputingRestTransport.VerifyAttestation") - - @staticmethod - def _get_response( - host, - metadata, - query_params, - session, - timeout, - transcoded_request, - body=None): - - uri = transcoded_request['uri'] - method = transcoded_request['method'] - headers = dict(metadata) - headers['Content-Type'] = 'application/json' - response = getattr(session, method)( - "{host}{uri}".format(host=host, uri=uri), - timeout=timeout, - headers=headers, - params=rest_helpers.flatten_query_params(query_params, strict=True), - data=body, - ) - return response - - def __call__(self, - request: service.VerifyAttestationRequest, *, - retry: OptionalRetry=gapic_v1.method.DEFAULT, - timeout: Optional[float]=None, - metadata: Sequence[Tuple[str, Union[str, bytes]]]=(), - ) -> service.VerifyAttestationResponse: - r"""Call the verify attestation method over HTTP. - - Args: - request (~.service.VerifyAttestationRequest): - The request object. A request for an attestation token, - providing all the necessary information - needed for this service to verify the - platform state of the requestor. - retry (google.api_core.retry.Retry): Designation of what errors, if any, - should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - - Returns: - ~.service.VerifyAttestationResponse: - A response once an attestation has - been successfully verified, containing a - signed attestation token. - - """ - - http_options = _BaseConfidentialComputingRestTransport._BaseVerifyAttestation._get_http_options() - - request, metadata = self._interceptor.pre_verify_attestation(request, metadata) - transcoded_request = _BaseConfidentialComputingRestTransport._BaseVerifyAttestation._get_transcoded_request(http_options, request) - - body = _BaseConfidentialComputingRestTransport._BaseVerifyAttestation._get_request_body_json(transcoded_request) - - # Jsonify the query params - query_params = _BaseConfidentialComputingRestTransport._BaseVerifyAttestation._get_query_params_json(transcoded_request) - - if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER - request_url = "{host}{uri}".format(host=self._host, uri=transcoded_request['uri']) - method = transcoded_request['method'] - try: - request_payload = type(request).to_json(request) - except: - request_payload = None - http_request = { - "payload": request_payload, - "requestMethod": method, - "requestUrl": request_url, - "headers": dict(metadata), - } - _LOGGER.debug( - f"Sending request for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.VerifyAttestation", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "rpcName": "VerifyAttestation", - "httpRequest": http_request, - "metadata": http_request["headers"], - }, - ) - - # Send the request - response = ConfidentialComputingRestTransport._VerifyAttestation._get_response(self._host, metadata, query_params, self._session, timeout, transcoded_request, body) - - # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception - # subclass. - if response.status_code >= 400: - raise core_exceptions.from_http_response(response) - - # Return the response - resp = service.VerifyAttestationResponse() - pb_resp = service.VerifyAttestationResponse.pb(resp) - - json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True) - - resp = self._interceptor.post_verify_attestation(resp) - response_metadata = [(k, str(v)) for k, v in response.headers.items()] - resp, _ = self._interceptor.post_verify_attestation_with_metadata(resp, response_metadata) - if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER - try: - response_payload = service.VerifyAttestationResponse.to_json(response) - except: - response_payload = None - http_response = { - "payload": response_payload, - "headers": dict(response.headers), - "status": response.status_code, - } - _LOGGER.debug( - "Received response for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.verify_attestation", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "rpcName": "VerifyAttestation", - "metadata": http_response["headers"], - "httpResponse": http_response, - }, - ) - return resp - - class _VerifyConfidentialGke(_BaseConfidentialComputingRestTransport._BaseVerifyConfidentialGke, ConfidentialComputingRestStub): - def __hash__(self): - return hash("ConfidentialComputingRestTransport.VerifyConfidentialGke") - - @staticmethod - def _get_response( - host, - metadata, - query_params, - session, - timeout, - transcoded_request, - body=None): - - uri = transcoded_request['uri'] - method = transcoded_request['method'] - headers = dict(metadata) - headers['Content-Type'] = 'application/json' - response = getattr(session, method)( - "{host}{uri}".format(host=host, uri=uri), - timeout=timeout, - headers=headers, - params=rest_helpers.flatten_query_params(query_params, strict=True), - data=body, - ) - return response - - def __call__(self, - request: service.VerifyConfidentialGkeRequest, *, - retry: OptionalRetry=gapic_v1.method.DEFAULT, - timeout: Optional[float]=None, - metadata: Sequence[Tuple[str, Union[str, bytes]]]=(), - ) -> service.VerifyConfidentialGkeResponse: - r"""Call the verify confidential gke method over HTTP. - - Args: - request (~.service.VerifyConfidentialGkeRequest): - The request object. A request for an attestation token, - providing all the necessary information - needed for this service to verify - Confidential GKE platform state of the - requestor. - retry (google.api_core.retry.Retry): Designation of what errors, if any, - should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - - Returns: - ~.service.VerifyConfidentialGkeResponse: - VerifyConfidentialGkeResponse - response is returened once a - Confidential GKE attestation has been - successfully verified, containing a - signed OIDC token. - - """ - - http_options = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialGke._get_http_options() - - request, metadata = self._interceptor.pre_verify_confidential_gke(request, metadata) - transcoded_request = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialGke._get_transcoded_request(http_options, request) - - body = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialGke._get_request_body_json(transcoded_request) - - # Jsonify the query params - query_params = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialGke._get_query_params_json(transcoded_request) - - if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER - request_url = "{host}{uri}".format(host=self._host, uri=transcoded_request['uri']) - method = transcoded_request['method'] - try: - request_payload = type(request).to_json(request) - except: - request_payload = None - http_request = { - "payload": request_payload, - "requestMethod": method, - "requestUrl": request_url, - "headers": dict(metadata), - } - _LOGGER.debug( - f"Sending request for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.VerifyConfidentialGke", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "rpcName": "VerifyConfidentialGke", - "httpRequest": http_request, - "metadata": http_request["headers"], - }, - ) - - # Send the request - response = ConfidentialComputingRestTransport._VerifyConfidentialGke._get_response(self._host, metadata, query_params, self._session, timeout, transcoded_request, body) - - # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception - # subclass. - if response.status_code >= 400: - raise core_exceptions.from_http_response(response) - - # Return the response - resp = service.VerifyConfidentialGkeResponse() - pb_resp = service.VerifyConfidentialGkeResponse.pb(resp) - - json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True) - - resp = self._interceptor.post_verify_confidential_gke(resp) - response_metadata = [(k, str(v)) for k, v in response.headers.items()] - resp, _ = self._interceptor.post_verify_confidential_gke_with_metadata(resp, response_metadata) - if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER - try: - response_payload = service.VerifyConfidentialGkeResponse.to_json(response) - except: - response_payload = None - http_response = { - "payload": response_payload, - "headers": dict(response.headers), - "status": response.status_code, - } - _LOGGER.debug( - "Received response for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.verify_confidential_gke", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "rpcName": "VerifyConfidentialGke", - "metadata": http_response["headers"], - "httpResponse": http_response, - }, - ) - return resp - - class _VerifyConfidentialSpace(_BaseConfidentialComputingRestTransport._BaseVerifyConfidentialSpace, ConfidentialComputingRestStub): - def __hash__(self): - return hash("ConfidentialComputingRestTransport.VerifyConfidentialSpace") - - @staticmethod - def _get_response( - host, - metadata, - query_params, - session, - timeout, - transcoded_request, - body=None): - - uri = transcoded_request['uri'] - method = transcoded_request['method'] - headers = dict(metadata) - headers['Content-Type'] = 'application/json' - response = getattr(session, method)( - "{host}{uri}".format(host=host, uri=uri), - timeout=timeout, - headers=headers, - params=rest_helpers.flatten_query_params(query_params, strict=True), - data=body, - ) - return response - - def __call__(self, - request: service.VerifyConfidentialSpaceRequest, *, - retry: OptionalRetry=gapic_v1.method.DEFAULT, - timeout: Optional[float]=None, - metadata: Sequence[Tuple[str, Union[str, bytes]]]=(), - ) -> service.VerifyConfidentialSpaceResponse: - r"""Call the verify confidential space method over HTTP. - - Args: - request (~.service.VerifyConfidentialSpaceRequest): - The request object. A request for an attestation token, - providing all the necessary information - needed for this service to verify the - platform state of the requestor. - retry (google.api_core.retry.Retry): Designation of what errors, if any, - should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - - Returns: - ~.service.VerifyConfidentialSpaceResponse: - VerifyConfidentialSpaceResponse is - returned once a Confidential Space - attestation has been successfully - verified, containing a signed token. - - """ - - http_options = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialSpace._get_http_options() - - request, metadata = self._interceptor.pre_verify_confidential_space(request, metadata) - transcoded_request = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialSpace._get_transcoded_request(http_options, request) - - body = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialSpace._get_request_body_json(transcoded_request) - - # Jsonify the query params - query_params = _BaseConfidentialComputingRestTransport._BaseVerifyConfidentialSpace._get_query_params_json(transcoded_request) - - if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER - request_url = "{host}{uri}".format(host=self._host, uri=transcoded_request['uri']) - method = transcoded_request['method'] - try: - request_payload = type(request).to_json(request) - except: - request_payload = None - http_request = { - "payload": request_payload, - "requestMethod": method, - "requestUrl": request_url, - "headers": dict(metadata), - } - _LOGGER.debug( - f"Sending request for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.VerifyConfidentialSpace", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "rpcName": "VerifyConfidentialSpace", - "httpRequest": http_request, - "metadata": http_request["headers"], - }, - ) - - # Send the request - response = ConfidentialComputingRestTransport._VerifyConfidentialSpace._get_response(self._host, metadata, query_params, self._session, timeout, transcoded_request, body) - - # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception - # subclass. - if response.status_code >= 400: - raise core_exceptions.from_http_response(response) - - # Return the response - resp = service.VerifyConfidentialSpaceResponse() - pb_resp = service.VerifyConfidentialSpaceResponse.pb(resp) - - json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True) - - resp = self._interceptor.post_verify_confidential_space(resp) - response_metadata = [(k, str(v)) for k, v in response.headers.items()] - resp, _ = self._interceptor.post_verify_confidential_space_with_metadata(resp, response_metadata) - if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER - try: - response_payload = service.VerifyConfidentialSpaceResponse.to_json(response) - except: - response_payload = None - http_response = { - "payload": response_payload, - "headers": dict(response.headers), - "status": response.status_code, - } - _LOGGER.debug( - "Received response for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.verify_confidential_space", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "rpcName": "VerifyConfidentialSpace", - "metadata": http_response["headers"], - "httpResponse": http_response, - }, - ) - return resp - - @property - def create_challenge(self) -> Callable[ - [service.CreateChallengeRequest], - service.Challenge]: - # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here. - # In C++ this would require a dynamic_cast - return self._CreateChallenge(self._session, self._host, self._interceptor) # type: ignore - - @property - def verify_attestation(self) -> Callable[ - [service.VerifyAttestationRequest], - service.VerifyAttestationResponse]: - # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here. - # In C++ this would require a dynamic_cast - return self._VerifyAttestation(self._session, self._host, self._interceptor) # type: ignore - - @property - def verify_confidential_gke(self) -> Callable[ - [service.VerifyConfidentialGkeRequest], - service.VerifyConfidentialGkeResponse]: - # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here. - # In C++ this would require a dynamic_cast - return self._VerifyConfidentialGke(self._session, self._host, self._interceptor) # type: ignore - - @property - def verify_confidential_space(self) -> Callable[ - [service.VerifyConfidentialSpaceRequest], - service.VerifyConfidentialSpaceResponse]: - # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here. - # In C++ this would require a dynamic_cast - return self._VerifyConfidentialSpace(self._session, self._host, self._interceptor) # type: ignore - - @property - def get_location(self): - return self._GetLocation(self._session, self._host, self._interceptor) # type: ignore - - class _GetLocation(_BaseConfidentialComputingRestTransport._BaseGetLocation, ConfidentialComputingRestStub): - def __hash__(self): - return hash("ConfidentialComputingRestTransport.GetLocation") - - @staticmethod - def _get_response( - host, - metadata, - query_params, - session, - timeout, - transcoded_request, - body=None): - - uri = transcoded_request['uri'] - method = transcoded_request['method'] - headers = dict(metadata) - headers['Content-Type'] = 'application/json' - response = getattr(session, method)( - "{host}{uri}".format(host=host, uri=uri), - timeout=timeout, - headers=headers, - params=rest_helpers.flatten_query_params(query_params, strict=True), - ) - return response - - def __call__(self, - request: locations_pb2.GetLocationRequest, *, - retry: OptionalRetry=gapic_v1.method.DEFAULT, - timeout: Optional[float]=None, - metadata: Sequence[Tuple[str, Union[str, bytes]]]=(), - ) -> locations_pb2.Location: - - r"""Call the get location method over HTTP. - - Args: - request (locations_pb2.GetLocationRequest): - The request object for GetLocation method. - retry (google.api_core.retry.Retry): Designation of what errors, if any, - should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - - Returns: - locations_pb2.Location: Response from GetLocation method. - """ - - http_options = _BaseConfidentialComputingRestTransport._BaseGetLocation._get_http_options() - - request, metadata = self._interceptor.pre_get_location(request, metadata) - transcoded_request = _BaseConfidentialComputingRestTransport._BaseGetLocation._get_transcoded_request(http_options, request) - - # Jsonify the query params - query_params = _BaseConfidentialComputingRestTransport._BaseGetLocation._get_query_params_json(transcoded_request) - - if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER - request_url = "{host}{uri}".format(host=self._host, uri=transcoded_request['uri']) - method = transcoded_request['method'] - try: - request_payload = json_format.MessageToJson(request) - except: - request_payload = None - http_request = { - "payload": request_payload, - "requestMethod": method, - "requestUrl": request_url, - "headers": dict(metadata), - } - _LOGGER.debug( - f"Sending request for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.GetLocation", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "rpcName": "GetLocation", - "httpRequest": http_request, - "metadata": http_request["headers"], - }, - ) - - # Send the request - response = ConfidentialComputingRestTransport._GetLocation._get_response(self._host, metadata, query_params, self._session, timeout, transcoded_request) - - # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception - # subclass. - if response.status_code >= 400: - raise core_exceptions.from_http_response(response) - - content = response.content.decode("utf-8") - resp = locations_pb2.Location() - resp = json_format.Parse(content, resp) - resp = self._interceptor.post_get_location(resp) - if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER - try: - response_payload = json_format.MessageToJson(resp) - except: - response_payload = None - http_response = { - "payload": response_payload, - "headers": dict(response.headers), - "status": response.status_code, - } - _LOGGER.debug( - "Received response for google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient.GetLocation", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "rpcName": "GetLocation", - "httpResponse": http_response, - "metadata": http_response["headers"], - }, - ) - return resp - - @property - def list_locations(self): - return self._ListLocations(self._session, self._host, self._interceptor) # type: ignore - - class _ListLocations(_BaseConfidentialComputingRestTransport._BaseListLocations, ConfidentialComputingRestStub): - def __hash__(self): - return hash("ConfidentialComputingRestTransport.ListLocations") - - @staticmethod - def _get_response( - host, - metadata, - query_params, - session, - timeout, - transcoded_request, - body=None): - - uri = transcoded_request['uri'] - method = transcoded_request['method'] - headers = dict(metadata) - headers['Content-Type'] = 'application/json' - response = getattr(session, method)( - "{host}{uri}".format(host=host, uri=uri), - timeout=timeout, - headers=headers, - params=rest_helpers.flatten_query_params(query_params, strict=True), - ) - return response - - def __call__(self, - request: locations_pb2.ListLocationsRequest, *, - retry: OptionalRetry=gapic_v1.method.DEFAULT, - timeout: Optional[float]=None, - metadata: Sequence[Tuple[str, Union[str, bytes]]]=(), - ) -> locations_pb2.ListLocationsResponse: - - r"""Call the list locations method over HTTP. - - Args: - request (locations_pb2.ListLocationsRequest): - The request object for ListLocations method. - retry (google.api_core.retry.Retry): Designation of what errors, if any, - should be retried. - timeout (float): The timeout for this request. - metadata (Sequence[Tuple[str, Union[str, bytes]]]): Key/value pairs which should be - sent along with the request as metadata. Normally, each value must be of type `str`, - but for metadata keys ending with the suffix `-bin`, the corresponding values must - be of type `bytes`. - - Returns: - locations_pb2.ListLocationsResponse: Response from ListLocations method. - """ - - http_options = _BaseConfidentialComputingRestTransport._BaseListLocations._get_http_options() - - request, metadata = self._interceptor.pre_list_locations(request, metadata) - transcoded_request = _BaseConfidentialComputingRestTransport._BaseListLocations._get_transcoded_request(http_options, request) - - # Jsonify the query params - query_params = _BaseConfidentialComputingRestTransport._BaseListLocations._get_query_params_json(transcoded_request) - - if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER - request_url = "{host}{uri}".format(host=self._host, uri=transcoded_request['uri']) - method = transcoded_request['method'] - try: - request_payload = json_format.MessageToJson(request) - except: - request_payload = None - http_request = { - "payload": request_payload, - "requestMethod": method, - "requestUrl": request_url, - "headers": dict(metadata), - } - _LOGGER.debug( - f"Sending request for google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.ListLocations", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "rpcName": "ListLocations", - "httpRequest": http_request, - "metadata": http_request["headers"], - }, - ) - - # Send the request - response = ConfidentialComputingRestTransport._ListLocations._get_response(self._host, metadata, query_params, self._session, timeout, transcoded_request) - - # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception - # subclass. - if response.status_code >= 400: - raise core_exceptions.from_http_response(response) - - content = response.content.decode("utf-8") - resp = locations_pb2.ListLocationsResponse() - resp = json_format.Parse(content, resp) - resp = self._interceptor.post_list_locations(resp) - if CLIENT_LOGGING_SUPPORTED and _LOGGER.isEnabledFor(logging.DEBUG): # pragma: NO COVER - try: - response_payload = json_format.MessageToJson(resp) - except: - response_payload = None - http_response = { - "payload": response_payload, - "headers": dict(response.headers), - "status": response.status_code, - } - _LOGGER.debug( - "Received response for google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient.ListLocations", - extra = { - "serviceName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "rpcName": "ListLocations", - "httpResponse": http_response, - "metadata": http_response["headers"], - }, - ) - return resp - - @property - def kind(self) -> str: - return "rest" - - def close(self): - self._session.close() - - -__all__=( - 'ConfidentialComputingRestTransport', -) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest_base.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest_base.py deleted file mode 100644 index b75b206a52f7..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/services/confidential_computing/transports/rest_base.py +++ /dev/null @@ -1,330 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -import json # type: ignore -from google.api_core import path_template -from google.api_core import gapic_v1 - -from google.protobuf import json_format -from google.cloud.location import locations_pb2 # type: ignore -from .base import ConfidentialComputingTransport, DEFAULT_CLIENT_INFO - -import re -from typing import Any, Callable, Dict, List, Optional, Sequence, Tuple, Union - - -from google.cloud.confidentialcomputing_v1.types import service - - -class _BaseConfidentialComputingRestTransport(ConfidentialComputingTransport): - """Base REST backend transport for ConfidentialComputing. - - Note: This class is not meant to be used directly. Use its sync and - async sub-classes instead. - - This class defines the same methods as the primary client, so the - primary client can load the underlying transport implementation - and call it. - - It sends JSON representations of protocol buffers over HTTP/1.1 - """ - - def __init__(self, *, - host: str = 'confidentialcomputing.googleapis.com', - credentials: Optional[Any] = None, - client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO, - always_use_jwt_access: Optional[bool] = False, - url_scheme: str = 'https', - api_audience: Optional[str] = None, - ) -> None: - """Instantiate the transport. - Args: - host (Optional[str]): - The hostname to connect to (default: 'confidentialcomputing.googleapis.com'). - credentials (Optional[Any]): The - authorization credentials to attach to requests. These - credentials identify the application to the service; if none - are specified, the client will attempt to ascertain the - credentials from the environment. - client_info (google.api_core.gapic_v1.client_info.ClientInfo): - The client info used to send a user-agent string along with - API requests. If ``None``, then default info will be used. - Generally, you only need to set this if you are developing - your own client library. - always_use_jwt_access (Optional[bool]): Whether self signed JWT should - be used for service account credentials. - url_scheme: the protocol scheme for the API endpoint. Normally - "https", but for testing or local servers, - "http" can be specified. - """ - # Run the base constructor - maybe_url_match = re.match("^(?Phttp(?:s)?://)?(?P.*)$", host) - if maybe_url_match is None: - raise ValueError(f"Unexpected hostname structure: {host}") # pragma: NO COVER - - url_match_items = maybe_url_match.groupdict() - - host = f"{url_scheme}://{host}" if not url_match_items["scheme"] else host - - super().__init__( - host=host, - credentials=credentials, - client_info=client_info, - always_use_jwt_access=always_use_jwt_access, - api_audience=api_audience - ) - - class _BaseCreateChallenge: - def __hash__(self): # pragma: NO COVER - return NotImplementedError("__hash__ must be implemented.") - - __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = { - } - - @classmethod - def _get_unset_required_fields(cls, message_dict): - return {k: v for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items() if k not in message_dict} - - @staticmethod - def _get_http_options(): - http_options: List[Dict[str, str]] = [{ - 'method': 'post', - 'uri': '/v1/{parent=projects/*/locations/*}/challenges', - 'body': 'challenge', - }, - ] - return http_options - - @staticmethod - def _get_transcoded_request(http_options, request): - pb_request = service.CreateChallengeRequest.pb(request) - transcoded_request = path_template.transcode(http_options, pb_request) - return transcoded_request - - @staticmethod - def _get_request_body_json(transcoded_request): - # Jsonify the request body - - body = json_format.MessageToJson( - transcoded_request['body'], - use_integers_for_enums=True - ) - return body - @staticmethod - def _get_query_params_json(transcoded_request): - query_params = json.loads(json_format.MessageToJson( - transcoded_request['query_params'], - use_integers_for_enums=True, - )) - query_params.update(_BaseConfidentialComputingRestTransport._BaseCreateChallenge._get_unset_required_fields(query_params)) - - query_params["$alt"] = "json;enum-encoding=int" - return query_params - - class _BaseVerifyAttestation: - def __hash__(self): # pragma: NO COVER - return NotImplementedError("__hash__ must be implemented.") - - __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = { - } - - @classmethod - def _get_unset_required_fields(cls, message_dict): - return {k: v for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items() if k not in message_dict} - - @staticmethod - def _get_http_options(): - http_options: List[Dict[str, str]] = [{ - 'method': 'post', - 'uri': '/v1/{challenge=projects/*/locations/*/challenges/*}:verifyAttestation', - 'body': '*', - }, - ] - return http_options - - @staticmethod - def _get_transcoded_request(http_options, request): - pb_request = service.VerifyAttestationRequest.pb(request) - transcoded_request = path_template.transcode(http_options, pb_request) - return transcoded_request - - @staticmethod - def _get_request_body_json(transcoded_request): - # Jsonify the request body - - body = json_format.MessageToJson( - transcoded_request['body'], - use_integers_for_enums=True - ) - return body - @staticmethod - def _get_query_params_json(transcoded_request): - query_params = json.loads(json_format.MessageToJson( - transcoded_request['query_params'], - use_integers_for_enums=True, - )) - query_params.update(_BaseConfidentialComputingRestTransport._BaseVerifyAttestation._get_unset_required_fields(query_params)) - - query_params["$alt"] = "json;enum-encoding=int" - return query_params - - class _BaseVerifyConfidentialGke: - def __hash__(self): # pragma: NO COVER - return NotImplementedError("__hash__ must be implemented.") - - __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = { - } - - @classmethod - def _get_unset_required_fields(cls, message_dict): - return {k: v for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items() if k not in message_dict} - - @staticmethod - def _get_http_options(): - http_options: List[Dict[str, str]] = [{ - 'method': 'post', - 'uri': '/v1/{challenge=projects/*/locations/*/challenges/*}:verifyConfidentialGke', - 'body': '*', - }, - ] - return http_options - - @staticmethod - def _get_transcoded_request(http_options, request): - pb_request = service.VerifyConfidentialGkeRequest.pb(request) - transcoded_request = path_template.transcode(http_options, pb_request) - return transcoded_request - - @staticmethod - def _get_request_body_json(transcoded_request): - # Jsonify the request body - - body = json_format.MessageToJson( - transcoded_request['body'], - use_integers_for_enums=True - ) - return body - @staticmethod - def _get_query_params_json(transcoded_request): - query_params = json.loads(json_format.MessageToJson( - transcoded_request['query_params'], - use_integers_for_enums=True, - )) - query_params.update(_BaseConfidentialComputingRestTransport._BaseVerifyConfidentialGke._get_unset_required_fields(query_params)) - - query_params["$alt"] = "json;enum-encoding=int" - return query_params - - class _BaseVerifyConfidentialSpace: - def __hash__(self): # pragma: NO COVER - return NotImplementedError("__hash__ must be implemented.") - - __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = { - } - - @classmethod - def _get_unset_required_fields(cls, message_dict): - return {k: v for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items() if k not in message_dict} - - @staticmethod - def _get_http_options(): - http_options: List[Dict[str, str]] = [{ - 'method': 'post', - 'uri': '/v1/{challenge=projects/*/locations/*/challenges/*}:verifyConfidentialSpace', - 'body': '*', - }, - ] - return http_options - - @staticmethod - def _get_transcoded_request(http_options, request): - pb_request = service.VerifyConfidentialSpaceRequest.pb(request) - transcoded_request = path_template.transcode(http_options, pb_request) - return transcoded_request - - @staticmethod - def _get_request_body_json(transcoded_request): - # Jsonify the request body - - body = json_format.MessageToJson( - transcoded_request['body'], - use_integers_for_enums=True - ) - return body - @staticmethod - def _get_query_params_json(transcoded_request): - query_params = json.loads(json_format.MessageToJson( - transcoded_request['query_params'], - use_integers_for_enums=True, - )) - query_params.update(_BaseConfidentialComputingRestTransport._BaseVerifyConfidentialSpace._get_unset_required_fields(query_params)) - - query_params["$alt"] = "json;enum-encoding=int" - return query_params - - class _BaseGetLocation: - def __hash__(self): # pragma: NO COVER - return NotImplementedError("__hash__ must be implemented.") - - @staticmethod - def _get_http_options(): - http_options: List[Dict[str, str]] = [{ - 'method': 'get', - 'uri': '/v1/{name=projects/*/locations/*}', - }, - ] - return http_options - - @staticmethod - def _get_transcoded_request(http_options, request): - request_kwargs = json_format.MessageToDict(request) - transcoded_request = path_template.transcode( - http_options, **request_kwargs) - return transcoded_request - - @staticmethod - def _get_query_params_json(transcoded_request): - query_params = json.loads(json.dumps(transcoded_request['query_params'])) - return query_params - - class _BaseListLocations: - def __hash__(self): # pragma: NO COVER - return NotImplementedError("__hash__ must be implemented.") - - @staticmethod - def _get_http_options(): - http_options: List[Dict[str, str]] = [{ - 'method': 'get', - 'uri': '/v1/{name=projects/*}/locations', - }, - ] - return http_options - - @staticmethod - def _get_transcoded_request(http_options, request): - request_kwargs = json_format.MessageToDict(request) - transcoded_request = path_template.transcode( - http_options, **request_kwargs) - return transcoded_request - - @staticmethod - def _get_query_params_json(transcoded_request): - query_params = json.loads(json.dumps(transcoded_request['query_params'])) - return query_params - - -__all__=( - '_BaseConfidentialComputingRestTransport', -) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/types/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/types/__init__.py deleted file mode 100644 index 7725a0653773..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/types/__init__.py +++ /dev/null @@ -1,64 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -from .service import ( - AwsPrincipalTagsOptions, - Challenge, - ConfidentialSpaceInfo, - ContainerImageSignature, - CreateChallengeRequest, - GceShieldedIdentity, - GcpCredentials, - SevSnpAttestation, - SignedEntity, - TdxCcelAttestation, - TokenOptions, - TpmAttestation, - VerifyAttestationRequest, - VerifyAttestationResponse, - VerifyConfidentialGkeRequest, - VerifyConfidentialGkeResponse, - VerifyConfidentialSpaceRequest, - VerifyConfidentialSpaceResponse, - SignatureType, - SigningAlgorithm, - TokenProfile, - TokenType, -) - -__all__ = ( - 'AwsPrincipalTagsOptions', - 'Challenge', - 'ConfidentialSpaceInfo', - 'ContainerImageSignature', - 'CreateChallengeRequest', - 'GceShieldedIdentity', - 'GcpCredentials', - 'SevSnpAttestation', - 'SignedEntity', - 'TdxCcelAttestation', - 'TokenOptions', - 'TpmAttestation', - 'VerifyAttestationRequest', - 'VerifyAttestationResponse', - 'VerifyConfidentialGkeRequest', - 'VerifyConfidentialGkeResponse', - 'VerifyConfidentialSpaceRequest', - 'VerifyConfidentialSpaceResponse', - 'SignatureType', - 'SigningAlgorithm', - 'TokenProfile', - 'TokenType', -) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/types/service.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/types/service.py deleted file mode 100644 index 2007fcde2983..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/google/cloud/confidentialcomputing_v1/types/service.py +++ /dev/null @@ -1,915 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -from __future__ import annotations - -from typing import MutableMapping, MutableSequence - -import proto # type: ignore - -from google.protobuf import timestamp_pb2 # type: ignore -from google.rpc import status_pb2 # type: ignore - - -__protobuf__ = proto.module( - package='google.cloud.confidentialcomputing.v1', - manifest={ - 'SigningAlgorithm', - 'TokenType', - 'SignatureType', - 'TokenProfile', - 'Challenge', - 'CreateChallengeRequest', - 'VerifyAttestationRequest', - 'TdxCcelAttestation', - 'SevSnpAttestation', - 'VerifyAttestationResponse', - 'GcpCredentials', - 'TokenOptions', - 'AwsPrincipalTagsOptions', - 'TpmAttestation', - 'ConfidentialSpaceInfo', - 'SignedEntity', - 'ContainerImageSignature', - 'VerifyConfidentialSpaceRequest', - 'GceShieldedIdentity', - 'VerifyConfidentialSpaceResponse', - 'VerifyConfidentialGkeRequest', - 'VerifyConfidentialGkeResponse', - }, -) - - -class SigningAlgorithm(proto.Enum): - r"""SigningAlgorithm enumerates all the supported signing - algorithms. - - Values: - SIGNING_ALGORITHM_UNSPECIFIED (0): - Unspecified signing algorithm. - RSASSA_PSS_SHA256 (1): - RSASSA-PSS with a SHA256 digest. - RSASSA_PKCS1V15_SHA256 (2): - RSASSA-PKCS1 v1.5 with a SHA256 digest. - ECDSA_P256_SHA256 (3): - ECDSA on the P-256 Curve with a SHA256 - digest. - """ - SIGNING_ALGORITHM_UNSPECIFIED = 0 - RSASSA_PSS_SHA256 = 1 - RSASSA_PKCS1V15_SHA256 = 2 - ECDSA_P256_SHA256 = 3 - - -class TokenType(proto.Enum): - r"""Token type enum contains the different types of token - responses Confidential Space supports - - Values: - TOKEN_TYPE_UNSPECIFIED (0): - Unspecified token type - TOKEN_TYPE_OIDC (1): - OpenID Connect (OIDC) token type - TOKEN_TYPE_PKI (2): - Public Key Infrastructure (PKI) token type - TOKEN_TYPE_LIMITED_AWS (3): - Limited claim token type for AWS integration - TOKEN_TYPE_AWS_PRINCIPALTAGS (4): - Principal-tag-based token for AWS integration - """ - TOKEN_TYPE_UNSPECIFIED = 0 - TOKEN_TYPE_OIDC = 1 - TOKEN_TYPE_PKI = 2 - TOKEN_TYPE_LIMITED_AWS = 3 - TOKEN_TYPE_AWS_PRINCIPALTAGS = 4 - - -class SignatureType(proto.Enum): - r"""SignatureType enumerates supported signature types for - attestation tokens. - - Values: - SIGNATURE_TYPE_UNSPECIFIED (0): - Unspecified signature type. - SIGNATURE_TYPE_OIDC (1): - Google OIDC signature. - SIGNATURE_TYPE_PKI (2): - Public Key Infrastructure (PKI) signature. - """ - SIGNATURE_TYPE_UNSPECIFIED = 0 - SIGNATURE_TYPE_OIDC = 1 - SIGNATURE_TYPE_PKI = 2 - - -class TokenProfile(proto.Enum): - r"""TokenProfile enumerates the supported token claims profiles. - - Values: - TOKEN_PROFILE_UNSPECIFIED (0): - Unspecified token profile. - TOKEN_PROFILE_DEFAULT_EAT (1): - EAT claims. - TOKEN_PROFILE_AWS (2): - AWS Principal Tags claims. - """ - TOKEN_PROFILE_UNSPECIFIED = 0 - TOKEN_PROFILE_DEFAULT_EAT = 1 - TOKEN_PROFILE_AWS = 2 - - -class Challenge(proto.Message): - r"""A Challenge from the server used to guarantee freshness of - attestations - - Attributes: - name (str): - Output only. The resource name for this Challenge in the - format ``projects/*/locations/*/challenges/*`` - create_time (google.protobuf.timestamp_pb2.Timestamp): - Output only. The time at which this Challenge - was created - expire_time (google.protobuf.timestamp_pb2.Timestamp): - Output only. The time at which this Challenge - will no longer be usable. It is also the - expiration time for any tokens generated from - this Challenge. - used (bool): - Output only. Indicates if this challenge has - been used to generate a token. - tpm_nonce (str): - Output only. Identical to nonce, but as a - string. - """ - - name: str = proto.Field( - proto.STRING, - number=1, - ) - create_time: timestamp_pb2.Timestamp = proto.Field( - proto.MESSAGE, - number=2, - message=timestamp_pb2.Timestamp, - ) - expire_time: timestamp_pb2.Timestamp = proto.Field( - proto.MESSAGE, - number=3, - message=timestamp_pb2.Timestamp, - ) - used: bool = proto.Field( - proto.BOOL, - number=4, - ) - tpm_nonce: str = proto.Field( - proto.STRING, - number=6, - ) - - -class CreateChallengeRequest(proto.Message): - r"""Message for creating a Challenge - - Attributes: - parent (str): - Required. The resource name of the location where the - Challenge will be used, in the format - ``projects/*/locations/*``. - challenge (google.cloud.confidentialcomputing_v1.types.Challenge): - Required. The Challenge to be created. - Currently this field can be empty as all the - Challenge fields are set by the server. - """ - - parent: str = proto.Field( - proto.STRING, - number=1, - ) - challenge: 'Challenge' = proto.Field( - proto.MESSAGE, - number=2, - message='Challenge', - ) - - -class VerifyAttestationRequest(proto.Message): - r"""A request for an attestation token, providing all the - necessary information needed for this service to verify the - platform state of the requestor. - - This message has `oneof`_ fields (mutually exclusive fields). - For each oneof, at most one member field can be set at the same time. - Setting any member of the oneof automatically clears all other - members. - - .. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields - - Attributes: - td_ccel (google.cloud.confidentialcomputing_v1.types.TdxCcelAttestation): - Optional. A TDX with CCEL and RTMR - Attestation Quote. - - This field is a member of `oneof`_ ``tee_attestation``. - sev_snp_attestation (google.cloud.confidentialcomputing_v1.types.SevSnpAttestation): - Optional. An SEV-SNP Attestation Report. - - This field is a member of `oneof`_ ``tee_attestation``. - challenge (str): - Required. The name of the Challenge whose nonce was used to - generate the attestation, in the format - ``projects/*/locations/*/challenges/*``. The provided - Challenge will be consumed, and cannot be used again. - gcp_credentials (google.cloud.confidentialcomputing_v1.types.GcpCredentials): - Optional. Credentials used to populate the "emails" claim in - the claims_token. - tpm_attestation (google.cloud.confidentialcomputing_v1.types.TpmAttestation): - Required. The TPM-specific data provided by - the attesting platform, used to populate any of - the claims regarding platform state. - confidential_space_info (google.cloud.confidentialcomputing_v1.types.ConfidentialSpaceInfo): - Optional. Optional information related to the - Confidential Space TEE. - token_options (google.cloud.confidentialcomputing_v1.types.TokenOptions): - Optional. A collection of optional, - workload-specified claims that modify the token - output. - attester (str): - Optional. An optional indicator of the - attester, only applies to certain products. - """ - - td_ccel: 'TdxCcelAttestation' = proto.Field( - proto.MESSAGE, - number=6, - oneof='tee_attestation', - message='TdxCcelAttestation', - ) - sev_snp_attestation: 'SevSnpAttestation' = proto.Field( - proto.MESSAGE, - number=7, - oneof='tee_attestation', - message='SevSnpAttestation', - ) - challenge: str = proto.Field( - proto.STRING, - number=1, - ) - gcp_credentials: 'GcpCredentials' = proto.Field( - proto.MESSAGE, - number=2, - message='GcpCredentials', - ) - tpm_attestation: 'TpmAttestation' = proto.Field( - proto.MESSAGE, - number=3, - message='TpmAttestation', - ) - confidential_space_info: 'ConfidentialSpaceInfo' = proto.Field( - proto.MESSAGE, - number=4, - message='ConfidentialSpaceInfo', - ) - token_options: 'TokenOptions' = proto.Field( - proto.MESSAGE, - number=5, - message='TokenOptions', - ) - attester: str = proto.Field( - proto.STRING, - number=8, - ) - - -class TdxCcelAttestation(proto.Message): - r"""A TDX Attestation quote. - - Attributes: - ccel_acpi_table (bytes): - Optional. The Confidential Computing Event - Log (CCEL) ACPI table. Formatted as described in - the ACPI Specification 6.5. - ccel_data (bytes): - Optional. The CCEL event log. Formatted as - described in the UEFI 2.10. - canonical_event_log (bytes): - Optional. An Event Log containing additional - events measured into the RTMR that are not - already present in the CCEL. - td_quote (bytes): - Optional. The TDX attestation quote from the - guest. It contains the RTMR values. - """ - - ccel_acpi_table: bytes = proto.Field( - proto.BYTES, - number=1, - ) - ccel_data: bytes = proto.Field( - proto.BYTES, - number=2, - ) - canonical_event_log: bytes = proto.Field( - proto.BYTES, - number=3, - ) - td_quote: bytes = proto.Field( - proto.BYTES, - number=4, - ) - - -class SevSnpAttestation(proto.Message): - r"""An SEV-SNP Attestation Report. - Contains the attestation report and the certificate bundle that - the client collects. - - Attributes: - report (bytes): - Optional. The SEV-SNP Attestation Report Format is in - revision 1.55, §7.3 Attestation, Table 22. - ATTESTATION_REPORT Structure in this document: - https://www.amd.com/content/dam/amd/en/documents/epyc-technical-docs/specifications/56860.pdf - aux_blob (bytes): - Optional. Certificate bundle defined in the GHCB protocol - definition Format is documented in GHCB revision 2.03, - section 4.1.8.1 struct cert_table in this document: - https://www.amd.com/content/dam/amd/en/documents/epyc-technical-docs/specifications/56421.pdf - """ - - report: bytes = proto.Field( - proto.BYTES, - number=1, - ) - aux_blob: bytes = proto.Field( - proto.BYTES, - number=2, - ) - - -class VerifyAttestationResponse(proto.Message): - r"""A response once an attestation has been successfully - verified, containing a signed attestation token. - - Attributes: - oidc_claims_token (str): - Output only. Same as claims_token, but as a string. - partial_errors (MutableSequence[google.rpc.status_pb2.Status]): - Output only. A list of messages that carry - the partial error details related to - VerifyAttestation. - """ - - oidc_claims_token: str = proto.Field( - proto.STRING, - number=2, - ) - partial_errors: MutableSequence[status_pb2.Status] = proto.RepeatedField( - proto.MESSAGE, - number=3, - message=status_pb2.Status, - ) - - -class GcpCredentials(proto.Message): - r"""Credentials issued by GCP which are linked to the platform - attestation. These will be verified server-side as part of - attestaion verification. - - Attributes: - service_account_id_tokens (MutableSequence[str]): - Same as id_tokens, but as a string. - """ - - service_account_id_tokens: MutableSequence[str] = proto.RepeatedField( - proto.STRING, - number=2, - ) - - -class TokenOptions(proto.Message): - r"""Options to modify claims in the token to generate - custom-purpose tokens. - - - .. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields - - Attributes: - aws_principal_tags_options (google.cloud.confidentialcomputing_v1.types.AwsPrincipalTagsOptions): - Optional. Options for AWS token type. - - This field is a member of `oneof`_ ``token_type_options``. - audience (str): - Optional. Optional string to issue the token - with a custom audience claim. Required if one or - more nonces are specified. - nonce (MutableSequence[str]): - Optional. Optional parameter to place one or more nonces in - the eat_nonce claim in the output token. The minimum size - for JSON-encoded EATs is 10 bytes and the maximum size is 74 - bytes. - token_type (google.cloud.confidentialcomputing_v1.types.TokenType): - Optional. Optional token type to select what - type of token to return. - """ - - aws_principal_tags_options: 'AwsPrincipalTagsOptions' = proto.Field( - proto.MESSAGE, - number=4, - oneof='token_type_options', - message='AwsPrincipalTagsOptions', - ) - audience: str = proto.Field( - proto.STRING, - number=1, - ) - nonce: MutableSequence[str] = proto.RepeatedField( - proto.STRING, - number=2, - ) - token_type: 'TokenType' = proto.Field( - proto.ENUM, - number=3, - enum='TokenType', - ) - - -class AwsPrincipalTagsOptions(proto.Message): - r"""Token options that only apply to the AWS Principal Tags token - type. - - Attributes: - allowed_principal_tags (google.cloud.confidentialcomputing_v1.types.AwsPrincipalTagsOptions.AllowedPrincipalTags): - Optional. Principal tags to allow in the - token. - """ - - class AllowedPrincipalTags(proto.Message): - r"""Allowed principal tags is used to define what principal tags - will be placed in the token. - - Attributes: - container_image_signatures (google.cloud.confidentialcomputing_v1.types.AwsPrincipalTagsOptions.AllowedPrincipalTags.ContainerImageSignatures): - Optional. Container image signatures allowed - in the token. - """ - - class ContainerImageSignatures(proto.Message): - r"""Allowed Container Image Signatures. Key IDs are required to - allow this claim to fit within the narrow AWS IAM restrictions. - - Attributes: - key_ids (MutableSequence[str]): - Optional. List of key ids to filter into the - Principal tags. Only keys that have been - validated and added to the token will be - filtered into principal tags. Unrecognized key - ids will be ignored. - """ - - key_ids: MutableSequence[str] = proto.RepeatedField( - proto.STRING, - number=1, - ) - - container_image_signatures: 'AwsPrincipalTagsOptions.AllowedPrincipalTags.ContainerImageSignatures' = proto.Field( - proto.MESSAGE, - number=1, - message='AwsPrincipalTagsOptions.AllowedPrincipalTags.ContainerImageSignatures', - ) - - allowed_principal_tags: AllowedPrincipalTags = proto.Field( - proto.MESSAGE, - number=1, - message=AllowedPrincipalTags, - ) - - -class TpmAttestation(proto.Message): - r"""TPM2 data containing everything necessary to validate any - platform state measured into the TPM. - - Attributes: - quotes (MutableSequence[google.cloud.confidentialcomputing_v1.types.TpmAttestation.Quote]): - TPM2 PCR Quotes generated by calling TPM2_Quote on each PCR - bank. - tcg_event_log (bytes): - The binary TCG Event Log containing events - measured into the TPM by the platform firmware - and operating system. Formatted as described in - the "TCG PC Client Platform Firmware Profile - Specification". - canonical_event_log (bytes): - An Event Log containing additional events measured into the - TPM that are not already present in the tcg_event_log. - Formatted as described in the "Canonical Event Log Format" - TCG Specification. - ak_cert (bytes): - DER-encoded X.509 certificate of the - Attestation Key (otherwise known as an AK or a - TPM restricted signing key) used to generate the - quotes. - cert_chain (MutableSequence[bytes]): - List of DER-encoded X.509 certificates which, together with - the ak_cert, chain back to a trusted Root Certificate. - """ - - class Quote(proto.Message): - r"""Information about Platform Control Registers (PCRs) including - a signature over their values, which can be used for remote - validation. - - Attributes: - hash_algo (int): - The hash algorithm of the PCR bank being quoted, encoded as - a TPM_ALG_ID - pcr_values (MutableMapping[int, bytes]): - Raw binary values of each PCRs being quoted. - raw_quote (bytes): - TPM2 quote, encoded as a TPMS_ATTEST - raw_signature (bytes): - TPM2 signature, encoded as a TPMT_SIGNATURE - """ - - hash_algo: int = proto.Field( - proto.INT32, - number=1, - ) - pcr_values: MutableMapping[int, bytes] = proto.MapField( - proto.INT32, - proto.BYTES, - number=2, - ) - raw_quote: bytes = proto.Field( - proto.BYTES, - number=3, - ) - raw_signature: bytes = proto.Field( - proto.BYTES, - number=4, - ) - - quotes: MutableSequence[Quote] = proto.RepeatedField( - proto.MESSAGE, - number=1, - message=Quote, - ) - tcg_event_log: bytes = proto.Field( - proto.BYTES, - number=2, - ) - canonical_event_log: bytes = proto.Field( - proto.BYTES, - number=3, - ) - ak_cert: bytes = proto.Field( - proto.BYTES, - number=4, - ) - cert_chain: MutableSequence[bytes] = proto.RepeatedField( - proto.BYTES, - number=5, - ) - - -class ConfidentialSpaceInfo(proto.Message): - r"""ConfidentialSpaceInfo contains information related to the - Confidential Space TEE. - - Attributes: - signed_entities (MutableSequence[google.cloud.confidentialcomputing_v1.types.SignedEntity]): - Optional. A list of signed entities - containing container image signatures that can - be used for server-side signature verification. - """ - - signed_entities: MutableSequence['SignedEntity'] = proto.RepeatedField( - proto.MESSAGE, - number=1, - message='SignedEntity', - ) - - -class SignedEntity(proto.Message): - r"""SignedEntity represents an OCI image object containing - everything necessary to verify container image signatures. - - Attributes: - container_image_signatures (MutableSequence[google.cloud.confidentialcomputing_v1.types.ContainerImageSignature]): - Optional. A list of container image - signatures attached to an OCI image object. - """ - - container_image_signatures: MutableSequence['ContainerImageSignature'] = proto.RepeatedField( - proto.MESSAGE, - number=1, - message='ContainerImageSignature', - ) - - -class ContainerImageSignature(proto.Message): - r"""ContainerImageSignature holds necessary metadata to verify a - container image signature. - - Attributes: - payload (bytes): - Optional. The binary signature payload following the - SimpleSigning format - https://github.com/sigstore/cosign/blob/main/specs/SIGNATURE_SPEC.md#simple-signing. - This payload includes the container image digest. - signature (bytes): - Optional. A signature over the payload. The container image - digest is incorporated into the signature as follows: - - 1. Generate a SimpleSigning format payload that includes the - container image digest. - 2. Generate a signature over SHA256 digest of the payload. - The signature generation process can be represented as - follows: - ``Sign(sha256(SimpleSigningPayload(sha256(Image Manifest))))`` - public_key (bytes): - Optional. Reserved for future use. - sig_alg (google.cloud.confidentialcomputing_v1.types.SigningAlgorithm): - Optional. Reserved for future use. - """ - - payload: bytes = proto.Field( - proto.BYTES, - number=1, - ) - signature: bytes = proto.Field( - proto.BYTES, - number=2, - ) - public_key: bytes = proto.Field( - proto.BYTES, - number=3, - ) - sig_alg: 'SigningAlgorithm' = proto.Field( - proto.ENUM, - number=4, - enum='SigningAlgorithm', - ) - - -class VerifyConfidentialSpaceRequest(proto.Message): - r"""A request for an attestation token, providing all the - necessary information needed for this service to verify the - platform state of the requestor. - - This message has `oneof`_ fields (mutually exclusive fields). - For each oneof, at most one member field can be set at the same time. - Setting any member of the oneof automatically clears all other - members. - - .. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields - - Attributes: - td_ccel (google.cloud.confidentialcomputing_v1.types.TdxCcelAttestation): - Input only. A TDX with CCEL and RTMR - Attestation Quote. - - This field is a member of `oneof`_ ``tee_attestation``. - tpm_attestation (google.cloud.confidentialcomputing_v1.types.TpmAttestation): - Input only. The TPM-specific data provided by - the attesting platform, used to populate any of - the claims regarding platform state. - - This field is a member of `oneof`_ ``tee_attestation``. - challenge (str): - Required. The name of the Challenge whose nonce was used to - generate the attestation, in the format - ``projects/*/locations/*/challenges/*``. The provided - Challenge will be consumed, and cannot be used again. - gcp_credentials (google.cloud.confidentialcomputing_v1.types.GcpCredentials): - Optional. Credentials used to populate the "emails" claim in - the claims_token. If not present, token will not contain the - "emails" claim. - signed_entities (MutableSequence[google.cloud.confidentialcomputing_v1.types.SignedEntity]): - Optional. A list of signed entities - containing container image signatures that can - be used for server-side signature verification. - gce_shielded_identity (google.cloud.confidentialcomputing_v1.types.GceShieldedIdentity): - Optional. Information about the associated Compute Engine - instance. Required for td_ccel requests only - - tpm_attestation requests will provide this information in - the attestation. - options (google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceRequest.ConfidentialSpaceOptions): - Optional. A collection of fields that modify - the token output. - """ - - class ConfidentialSpaceOptions(proto.Message): - r"""Token options for Confidential Space attestation. - - .. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields - - Attributes: - aws_principal_tags_options (google.cloud.confidentialcomputing_v1.types.AwsPrincipalTagsOptions): - Optional. Options for the AWS token type. - - This field is a member of `oneof`_ ``token_profile_options``. - audience (str): - Optional. Optional string to issue the token - with a custom audience claim. Required if custom - nonces are specified. - token_profile (google.cloud.confidentialcomputing_v1.types.TokenProfile): - Optional. Optional specification for token - claims profile. - nonce (MutableSequence[str]): - Optional. Optional parameter to place one or more nonces in - the eat_nonce claim in the output token. The minimum size - for JSON-encoded EATs is 10 bytes and the maximum size is 74 - bytes. - signature_type (google.cloud.confidentialcomputing_v1.types.SignatureType): - Optional. Optional specification for how to sign the - attestation token. Defaults to SIGNATURE_TYPE_OIDC if - unspecified. - """ - - aws_principal_tags_options: 'AwsPrincipalTagsOptions' = proto.Field( - proto.MESSAGE, - number=5, - oneof='token_profile_options', - message='AwsPrincipalTagsOptions', - ) - audience: str = proto.Field( - proto.STRING, - number=1, - ) - token_profile: 'TokenProfile' = proto.Field( - proto.ENUM, - number=2, - enum='TokenProfile', - ) - nonce: MutableSequence[str] = proto.RepeatedField( - proto.STRING, - number=3, - ) - signature_type: 'SignatureType' = proto.Field( - proto.ENUM, - number=4, - enum='SignatureType', - ) - - td_ccel: 'TdxCcelAttestation' = proto.Field( - proto.MESSAGE, - number=3, - oneof='tee_attestation', - message='TdxCcelAttestation', - ) - tpm_attestation: 'TpmAttestation' = proto.Field( - proto.MESSAGE, - number=4, - oneof='tee_attestation', - message='TpmAttestation', - ) - challenge: str = proto.Field( - proto.STRING, - number=1, - ) - gcp_credentials: 'GcpCredentials' = proto.Field( - proto.MESSAGE, - number=2, - message='GcpCredentials', - ) - signed_entities: MutableSequence['SignedEntity'] = proto.RepeatedField( - proto.MESSAGE, - number=5, - message='SignedEntity', - ) - gce_shielded_identity: 'GceShieldedIdentity' = proto.Field( - proto.MESSAGE, - number=6, - message='GceShieldedIdentity', - ) - options: ConfidentialSpaceOptions = proto.Field( - proto.MESSAGE, - number=7, - message=ConfidentialSpaceOptions, - ) - - -class GceShieldedIdentity(proto.Message): - r"""GceShieldedIdentity contains information about a Compute - Engine instance. - - Attributes: - ak_cert (bytes): - Optional. DER-encoded X.509 certificate of - the Attestation Key (otherwise known as an AK or - a TPM restricted signing key) used to generate - the quotes. - ak_cert_chain (MutableSequence[bytes]): - Optional. List of DER-encoded X.509 certificates which, - together with the ak_cert, chain back to a trusted Root - Certificate. - """ - - ak_cert: bytes = proto.Field( - proto.BYTES, - number=1, - ) - ak_cert_chain: MutableSequence[bytes] = proto.RepeatedField( - proto.BYTES, - number=2, - ) - - -class VerifyConfidentialSpaceResponse(proto.Message): - r"""VerifyConfidentialSpaceResponse is returned once a - Confidential Space attestation has been successfully verified, - containing a signed token. - - Attributes: - attestation_token (str): - Output only. The attestation token issued by - this service. It contains specific platform - claims based on the contents of the provided - attestation. - partial_errors (MutableSequence[google.rpc.status_pb2.Status]): - Output only. A list of messages that carry - the partial error details related to - VerifyConfidentialSpace. This field is populated - by errors during container image signature - verification, which may reflect problems in the - provided image signatures. This does not block - the issuing of an attestation token, but the - token will not contain claims for the failed - image signatures. - """ - - attestation_token: str = proto.Field( - proto.STRING, - number=1, - ) - partial_errors: MutableSequence[status_pb2.Status] = proto.RepeatedField( - proto.MESSAGE, - number=2, - message=status_pb2.Status, - ) - - -class VerifyConfidentialGkeRequest(proto.Message): - r"""A request for an attestation token, providing all the - necessary information needed for this service to verify - Confidential GKE platform state of the requestor. - - - .. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields - - Attributes: - tpm_attestation (google.cloud.confidentialcomputing_v1.types.TpmAttestation): - The TPM-specific data provided by the - attesting platform, used to populate any of the - claims regarding platform state. - - This field is a member of `oneof`_ ``tee_attestation``. - challenge (str): - Required. The name of the Challenge whose nonce was used to - generate the attestation, in the format - projects/*/locations/*/challenges/\*. The provided Challenge - will be consumed, and cannot be used again. - """ - - tpm_attestation: 'TpmAttestation' = proto.Field( - proto.MESSAGE, - number=2, - oneof='tee_attestation', - message='TpmAttestation', - ) - challenge: str = proto.Field( - proto.STRING, - number=1, - ) - - -class VerifyConfidentialGkeResponse(proto.Message): - r"""VerifyConfidentialGkeResponse response is returened once a - Confidential GKE attestation has been successfully verified, - containing a signed OIDC token. - - Attributes: - attestation_token (str): - Output only. The attestation token issued by - this service for Confidential GKE. It contains - specific platform claims based on the contents - of the provided attestation. - """ - - attestation_token: str = proto.Field( - proto.STRING, - number=1, - ) - - -__all__ = tuple(sorted(__protobuf__.manifest)) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/mypy.ini b/owl-bot-staging/google-cloud-confidentialcomputing/v1/mypy.ini deleted file mode 100644 index 574c5aed394b..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/mypy.ini +++ /dev/null @@ -1,3 +0,0 @@ -[mypy] -python_version = 3.7 -namespace_packages = True diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/noxfile.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/noxfile.py deleted file mode 100644 index 3f0101ad8bd3..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/noxfile.py +++ /dev/null @@ -1,591 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -import os -import pathlib -import re -import shutil - -from typing import Dict, List -import warnings - -import nox - -BLACK_VERSION = "black[jupyter]==23.7.0" -ISORT_VERSION = "isort==5.11.0" - -LINT_PATHS = ["docs", "google", "tests", "noxfile.py", "setup.py"] - -ALL_PYTHON = [ - "3.7", - "3.8", - "3.9", - "3.10", - "3.11", - "3.12", - "3.13", -] - -DEFAULT_PYTHON_VERSION = ALL_PYTHON[-1] - -CURRENT_DIRECTORY = pathlib.Path(__file__).parent.absolute() - -LOWER_BOUND_CONSTRAINTS_FILE = CURRENT_DIRECTORY / "constraints.txt" -PACKAGE_NAME = "google-cloud-confidentialcomputing" - -UNIT_TEST_STANDARD_DEPENDENCIES = [ - "mock", - "asyncmock", - "pytest", - "pytest-cov", - "pytest-asyncio", -] -UNIT_TEST_EXTERNAL_DEPENDENCIES: List[str] = [] -UNIT_TEST_LOCAL_DEPENDENCIES: List[str] = [] -UNIT_TEST_DEPENDENCIES: List[str] = [] -UNIT_TEST_EXTRAS: List[str] = [] -UNIT_TEST_EXTRAS_BY_PYTHON: Dict[str, List[str]] = {} - -SYSTEM_TEST_PYTHON_VERSIONS: List[str] = ["3.8", "3.9", "3.10", "3.11", "3.12", "3.13"] -SYSTEM_TEST_STANDARD_DEPENDENCIES = [ - "mock", - "pytest", - "google-cloud-testutils", -] -SYSTEM_TEST_EXTERNAL_DEPENDENCIES: List[str] = [] -SYSTEM_TEST_LOCAL_DEPENDENCIES: List[str] = [] -SYSTEM_TEST_DEPENDENCIES: List[str] = [] -SYSTEM_TEST_EXTRAS: List[str] = [] -SYSTEM_TEST_EXTRAS_BY_PYTHON: Dict[str, List[str]] = {} - -nox.options.sessions = [ - "unit", - "system", - "cover", - "lint", - "lint_setup_py", - "blacken", - "docs", -] - -# Error if a python version is missing -nox.options.error_on_missing_interpreters = True - - -@nox.session(python=ALL_PYTHON) -def mypy(session): - """Run the type checker.""" - session.install( - # TODO(https://github.com/googleapis/gapic-generator-python/issues/2410): Use the latest version of mypy - "mypy<1.16.0", - "types-requests", - "types-protobuf", - ) - session.install(".") - session.run( - "mypy", - "-p", - "google", - ) - - -@nox.session -def update_lower_bounds(session): - """Update lower bounds in constraints.txt to match setup.py""" - session.install("google-cloud-testutils") - session.install(".") - - session.run( - "lower-bound-checker", - "update", - "--package-name", - PACKAGE_NAME, - "--constraints-file", - str(LOWER_BOUND_CONSTRAINTS_FILE), - ) - - -@nox.session -def check_lower_bounds(session): - """Check lower bounds in setup.py are reflected in constraints file""" - session.install("google-cloud-testutils") - session.install(".") - - session.run( - "lower-bound-checker", - "check", - "--package-name", - PACKAGE_NAME, - "--constraints-file", - str(LOWER_BOUND_CONSTRAINTS_FILE), - ) - - -@nox.session(python=DEFAULT_PYTHON_VERSION) -def lint(session): - """Run linters. - - Returns a failure if the linters find linting errors or sufficiently - serious code quality issues. - """ - session.install("flake8", BLACK_VERSION) - session.run( - "black", - "--check", - *LINT_PATHS, - ) - - session.run("flake8", "google", "tests") - - -@nox.session(python=DEFAULT_PYTHON_VERSION) -def blacken(session): - """Run black. Format code to uniform standard.""" - session.install(BLACK_VERSION) - session.run( - "black", - *LINT_PATHS, - ) - - -@nox.session(python=DEFAULT_PYTHON_VERSION) -def format(session): - """ - Run isort to sort imports. Then run black - to format code to uniform standard. - """ - session.install(BLACK_VERSION, ISORT_VERSION) - # Use the --fss option to sort imports using strict alphabetical order. - # See https://pycqa.github.io/isort/docs/configuration/options.html#force-sort-within-sections - session.run( - "isort", - "--fss", - *LINT_PATHS, - ) - session.run( - "black", - *LINT_PATHS, - ) - - -@nox.session(python=DEFAULT_PYTHON_VERSION) -def lint_setup_py(session): - """Verify that setup.py is valid (including RST check).""" - session.install("setuptools", "docutils", "pygments") - session.run("python", "setup.py", "check", "--restructuredtext", "--strict") - - -def install_unittest_dependencies(session, *constraints): - standard_deps = UNIT_TEST_STANDARD_DEPENDENCIES + UNIT_TEST_DEPENDENCIES - session.install(*standard_deps, *constraints) - - if UNIT_TEST_EXTERNAL_DEPENDENCIES: - warnings.warn( - "'unit_test_external_dependencies' is deprecated. Instead, please " - "use 'unit_test_dependencies' or 'unit_test_local_dependencies'.", - DeprecationWarning, - ) - session.install(*UNIT_TEST_EXTERNAL_DEPENDENCIES, *constraints) - - if UNIT_TEST_LOCAL_DEPENDENCIES: - session.install(*UNIT_TEST_LOCAL_DEPENDENCIES, *constraints) - - if UNIT_TEST_EXTRAS_BY_PYTHON: - extras = UNIT_TEST_EXTRAS_BY_PYTHON.get(session.python, []) - elif UNIT_TEST_EXTRAS: - extras = UNIT_TEST_EXTRAS - else: - extras = [] - - if extras: - session.install("-e", f".[{','.join(extras)}]", *constraints) - else: - session.install("-e", ".", *constraints) - - -@nox.session(python=ALL_PYTHON) -@nox.parametrize( - "protobuf_implementation", - ["python", "upb", "cpp"], -) -def unit(session, protobuf_implementation): - # Install all test dependencies, then install this package in-place. - - if protobuf_implementation == "cpp" and session.python in ("3.11", "3.12", "3.13"): - session.skip("cpp implementation is not supported in python 3.11+") - - constraints_path = str( - CURRENT_DIRECTORY / "testing" / f"constraints-{session.python}.txt" - ) - install_unittest_dependencies(session, "-c", constraints_path) - - # TODO(https://github.com/googleapis/synthtool/issues/1976): - # Remove the 'cpp' implementation once support for Protobuf 3.x is dropped. - # The 'cpp' implementation requires Protobuf<4. - if protobuf_implementation == "cpp": - session.install("protobuf<4") - - # Run py.test against the unit tests. - session.run( - "py.test", - "--quiet", - f"--junitxml=unit_{session.python}_sponge_log.xml", - "--cov=google", - "--cov=tests/unit", - "--cov-append", - "--cov-config=.coveragerc", - "--cov-report=", - "--cov-fail-under=0", - os.path.join("tests", "unit"), - *session.posargs, - env={ - "PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION": protobuf_implementation, - }, - ) - - -def install_systemtest_dependencies(session, *constraints): - session.install("--pre", "grpcio") - - session.install(*SYSTEM_TEST_STANDARD_DEPENDENCIES, *constraints) - - if SYSTEM_TEST_EXTERNAL_DEPENDENCIES: - session.install(*SYSTEM_TEST_EXTERNAL_DEPENDENCIES, *constraints) - - if SYSTEM_TEST_LOCAL_DEPENDENCIES: - session.install("-e", *SYSTEM_TEST_LOCAL_DEPENDENCIES, *constraints) - - if SYSTEM_TEST_DEPENDENCIES: - session.install("-e", *SYSTEM_TEST_DEPENDENCIES, *constraints) - - if SYSTEM_TEST_EXTRAS_BY_PYTHON: - extras = SYSTEM_TEST_EXTRAS_BY_PYTHON.get(session.python, []) - elif SYSTEM_TEST_EXTRAS: - extras = SYSTEM_TEST_EXTRAS - else: - extras = [] - - if extras: - session.install("-e", f".[{','.join(extras)}]", *constraints) - else: - session.install("-e", ".", *constraints) - - -@nox.session(python=SYSTEM_TEST_PYTHON_VERSIONS) -def system(session): - """Run the system test suite.""" - constraints_path = str( - CURRENT_DIRECTORY / "testing" / f"constraints-{session.python}.txt" - ) - system_test_path = os.path.join("tests", "system.py") - system_test_folder_path = os.path.join("tests", "system") - - # Check the value of `RUN_SYSTEM_TESTS` env var. It defaults to true. - if os.environ.get("RUN_SYSTEM_TESTS", "true") == "false": - session.skip("RUN_SYSTEM_TESTS is set to false, skipping") - # Install pyopenssl for mTLS testing. - if os.environ.get("GOOGLE_API_USE_CLIENT_CERTIFICATE", "false") == "true": - session.install("pyopenssl") - - system_test_exists = os.path.exists(system_test_path) - system_test_folder_exists = os.path.exists(system_test_folder_path) - # Sanity check: only run tests if found. - if not system_test_exists and not system_test_folder_exists: - session.skip("System tests were not found") - - install_systemtest_dependencies(session, "-c", constraints_path) - - # Run py.test against the system tests. - if system_test_exists: - session.run( - "py.test", - "--quiet", - f"--junitxml=system_{session.python}_sponge_log.xml", - system_test_path, - *session.posargs, - ) - if system_test_folder_exists: - session.run( - "py.test", - "--quiet", - f"--junitxml=system_{session.python}_sponge_log.xml", - system_test_folder_path, - *session.posargs, - ) - - -@nox.session(python=DEFAULT_PYTHON_VERSION) -def cover(session): - """Run the final coverage report. - - This outputs the coverage report aggregating coverage from the unit - test runs (not system test runs), and then erases coverage data. - """ - session.install("coverage", "pytest-cov") - session.run("coverage", "report", "--show-missing", "--fail-under=100") - - session.run("coverage", "erase") - - -@nox.session(python="3.10") -def docs(session): - """Build the docs for this library.""" - - session.install("-e", ".") - session.install( - # We need to pin to specific versions of the `sphinxcontrib-*` packages - # which still support sphinx 4.x. - # See https://github.com/googleapis/sphinx-docfx-yaml/issues/344 - # and https://github.com/googleapis/sphinx-docfx-yaml/issues/345. - "sphinxcontrib-applehelp==1.0.4", - "sphinxcontrib-devhelp==1.0.2", - "sphinxcontrib-htmlhelp==2.0.1", - "sphinxcontrib-qthelp==1.0.3", - "sphinxcontrib-serializinghtml==1.1.5", - "sphinx==4.5.0", - "alabaster", - "recommonmark", - ) - - shutil.rmtree(os.path.join("docs", "_build"), ignore_errors=True) - session.run( - "sphinx-build", - "-W", # warnings as errors - "-T", # show full traceback on exception - "-N", # no colors - "-b", "html", # builder - "-d", os.path.join("docs", "_build", "doctrees", ""), # cache directory - # paths to build: - os.path.join("docs", ""), - os.path.join("docs", "_build", "html", ""), - ) - - -@nox.session(python="3.10") -def docfx(session): - """Build the docfx yaml files for this library.""" - - session.install("-e", ".") - session.install( - # We need to pin to specific versions of the `sphinxcontrib-*` packages - # which still support sphinx 4.x. - # See https://github.com/googleapis/sphinx-docfx-yaml/issues/344 - # and https://github.com/googleapis/sphinx-docfx-yaml/issues/345. - "sphinxcontrib-applehelp==1.0.4", - "sphinxcontrib-devhelp==1.0.2", - "sphinxcontrib-htmlhelp==2.0.1", - "sphinxcontrib-qthelp==1.0.3", - "sphinxcontrib-serializinghtml==1.1.5", - "gcp-sphinx-docfx-yaml", - "alabaster", - "recommonmark", - ) - - shutil.rmtree(os.path.join("docs", "_build"), ignore_errors=True) - session.run( - "sphinx-build", - "-T", # show full traceback on exception - "-N", # no colors - "-D", - ( - "extensions=sphinx.ext.autodoc," - "sphinx.ext.autosummary," - "docfx_yaml.extension," - "sphinx.ext.intersphinx," - "sphinx.ext.coverage," - "sphinx.ext.napoleon," - "sphinx.ext.todo," - "sphinx.ext.viewcode," - "recommonmark" - ), - "-b", - "html", - "-d", - os.path.join("docs", "_build", "doctrees", ""), - os.path.join("docs", ""), - os.path.join("docs", "_build", "html", ""), - ) - - -@nox.session(python=DEFAULT_PYTHON_VERSION) -@nox.parametrize( - "protobuf_implementation", - ["python", "upb", "cpp"], -) -def prerelease_deps(session, protobuf_implementation): - """ - Run all tests with pre-release versions of dependencies installed - rather than the standard non pre-release versions. - Pre-release versions can be installed using - `pip install --pre `. - """ - - if protobuf_implementation == "cpp" and session.python in ("3.11", "3.12", "3.13"): - session.skip("cpp implementation is not supported in python 3.11+") - - # Install all dependencies - session.install("-e", ".") - - # Install dependencies for the unit test environment - unit_deps_all = UNIT_TEST_STANDARD_DEPENDENCIES + UNIT_TEST_EXTERNAL_DEPENDENCIES - session.install(*unit_deps_all) - - # Install dependencies for the system test environment - system_deps_all = ( - SYSTEM_TEST_STANDARD_DEPENDENCIES - + SYSTEM_TEST_EXTERNAL_DEPENDENCIES - + SYSTEM_TEST_EXTRAS - ) - session.install(*system_deps_all) - - # Because we test minimum dependency versions on the minimum Python - # version, the first version we test with in the unit tests sessions has a - # constraints file containing all dependencies and extras. - with open( - CURRENT_DIRECTORY / "testing" / f"constraints-{ALL_PYTHON[0]}.txt", - encoding="utf-8", - ) as constraints_file: - constraints_text = constraints_file.read() - - # Ignore leading whitespace and comment lines. - constraints_deps = [ - match.group(1) - for match in re.finditer( - r"^\s*(\S+)(?===\S+)", constraints_text, flags=re.MULTILINE - ) - ] - - # Install dependencies specified in `testing/constraints-X.txt`. - session.install(*constraints_deps) - - # Note: If a dependency is added to the `prerel_deps` list, - # the `core_dependencies_from_source` list in the `core_deps_from_source` - # nox session should also be updated. - prerel_deps = [ - "googleapis-common-protos", - "google-api-core", - "google-auth", - "grpc-google-iam-v1", - "grpcio", - "grpcio-status", - "protobuf", - "proto-plus", - ] - - for dep in prerel_deps: - session.install("--pre", "--no-deps", "--ignore-installed", dep) - # TODO(https://github.com/grpc/grpc/issues/38965): Add `grpcio-status`` - # to the dictionary below once this bug is fixed. - # TODO(https://github.com/googleapis/google-cloud-python/issues/13643): Add - # `googleapis-common-protos` and `grpc-google-iam-v1` to the dictionary below - # once this bug is fixed. - package_namespaces = { - "google-api-core": "google.api_core", - "google-auth": "google.auth", - "grpcio": "grpc", - "protobuf": "google.protobuf", - "proto-plus": "proto", - } - - version_namespace = package_namespaces.get(dep) - - print(f"Installed {dep}") - if version_namespace: - session.run( - "python", - "-c", - f"import {version_namespace}; print({version_namespace}.__version__)", - ) - - session.run( - "py.test", - "tests/unit", - env={ - "PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION": protobuf_implementation, - }, - ) - - -@nox.session(python=DEFAULT_PYTHON_VERSION) -@nox.parametrize( - "protobuf_implementation", - ["python", "upb"], -) -def core_deps_from_source(session, protobuf_implementation): - """Run all tests with core dependencies installed from source - rather than pulling the dependencies from PyPI. - """ - - # Install all dependencies - session.install("-e", ".") - - # Install dependencies for the unit test environment - unit_deps_all = UNIT_TEST_STANDARD_DEPENDENCIES + UNIT_TEST_EXTERNAL_DEPENDENCIES - session.install(*unit_deps_all) - - # Install dependencies for the system test environment - system_deps_all = ( - SYSTEM_TEST_STANDARD_DEPENDENCIES - + SYSTEM_TEST_EXTERNAL_DEPENDENCIES - + SYSTEM_TEST_EXTRAS - ) - session.install(*system_deps_all) - - # Because we test minimum dependency versions on the minimum Python - # version, the first version we test with in the unit tests sessions has a - # constraints file containing all dependencies and extras. - with open( - CURRENT_DIRECTORY / "testing" / f"constraints-{ALL_PYTHON[0]}.txt", - encoding="utf-8", - ) as constraints_file: - constraints_text = constraints_file.read() - - # Ignore leading whitespace and comment lines. - constraints_deps = [ - match.group(1) - for match in re.finditer( - r"^\s*(\S+)(?===\S+)", constraints_text, flags=re.MULTILINE - ) - ] - - # Install dependencies specified in `testing/constraints-X.txt`. - session.install(*constraints_deps) - - # TODO(https://github.com/googleapis/gapic-generator-python/issues/2358): `grpcio` and - # `grpcio-status` should be added to the list below so that they are installed from source, - # rather than PyPI. - # TODO(https://github.com/googleapis/gapic-generator-python/issues/2357): `protobuf` should be - # added to the list below so that it is installed from source, rather than PyPI - # Note: If a dependency is added to the `core_dependencies_from_source` list, - # the `prerel_deps` list in the `prerelease_deps` nox session should also be updated. - core_dependencies_from_source = [ - "googleapis-common-protos @ git+https://github.com/googleapis/google-cloud-python#egg=googleapis-common-protos&subdirectory=packages/googleapis-common-protos", - "google-api-core @ git+https://github.com/googleapis/python-api-core.git", - "google-auth @ git+https://github.com/googleapis/google-auth-library-python.git", - "grpc-google-iam-v1 @ git+https://github.com/googleapis/google-cloud-python#egg=grpc-google-iam-v1&subdirectory=packages/grpc-google-iam-v1", - "proto-plus @ git+https://github.com/googleapis/proto-plus-python.git", - ] - - for dep in core_dependencies_from_source: - session.install(dep, "--no-deps", "--ignore-installed") - print(f"Installed {dep}") - - session.run( - "py.test", - "tests/unit", - env={ - "PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION": protobuf_implementation, - }, - ) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_create_challenge_async.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_create_challenge_async.py deleted file mode 100644 index 528b0847412b..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_create_challenge_async.py +++ /dev/null @@ -1,52 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -# Generated code. DO NOT EDIT! -# -# Snippet for CreateChallenge -# NOTE: This snippet has been automatically generated for illustrative purposes only. -# It may require modifications to work in your environment. - -# To install the latest published package dependency, execute the following: -# python3 -m pip install google-cloud-confidentialcomputing - - -# [START confidentialcomputing_v1_generated_ConfidentialComputing_CreateChallenge_async] -# This snippet has been automatically generated and should be regarded as a -# code template only. -# It will require modifications to work: -# - It may require correct/in-range values for request initialization. -# - It may require specifying regional endpoints when creating the service -# client as shown in: -# https://googleapis.dev/python/google-api-core/latest/client_options.html -from google.cloud import confidentialcomputing_v1 - - -async def sample_create_challenge(): - # Create a client - client = confidentialcomputing_v1.ConfidentialComputingAsyncClient() - - # Initialize request argument(s) - request = confidentialcomputing_v1.CreateChallengeRequest( - parent="parent_value", - ) - - # Make the request - response = await client.create_challenge(request=request) - - # Handle the response - print(response) - -# [END confidentialcomputing_v1_generated_ConfidentialComputing_CreateChallenge_async] diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_create_challenge_sync.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_create_challenge_sync.py deleted file mode 100644 index 77033a817788..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_create_challenge_sync.py +++ /dev/null @@ -1,52 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -# Generated code. DO NOT EDIT! -# -# Snippet for CreateChallenge -# NOTE: This snippet has been automatically generated for illustrative purposes only. -# It may require modifications to work in your environment. - -# To install the latest published package dependency, execute the following: -# python3 -m pip install google-cloud-confidentialcomputing - - -# [START confidentialcomputing_v1_generated_ConfidentialComputing_CreateChallenge_sync] -# This snippet has been automatically generated and should be regarded as a -# code template only. -# It will require modifications to work: -# - It may require correct/in-range values for request initialization. -# - It may require specifying regional endpoints when creating the service -# client as shown in: -# https://googleapis.dev/python/google-api-core/latest/client_options.html -from google.cloud import confidentialcomputing_v1 - - -def sample_create_challenge(): - # Create a client - client = confidentialcomputing_v1.ConfidentialComputingClient() - - # Initialize request argument(s) - request = confidentialcomputing_v1.CreateChallengeRequest( - parent="parent_value", - ) - - # Make the request - response = client.create_challenge(request=request) - - # Handle the response - print(response) - -# [END confidentialcomputing_v1_generated_ConfidentialComputing_CreateChallenge_sync] diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_attestation_async.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_attestation_async.py deleted file mode 100644 index 815f2f866b48..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_attestation_async.py +++ /dev/null @@ -1,52 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -# Generated code. DO NOT EDIT! -# -# Snippet for VerifyAttestation -# NOTE: This snippet has been automatically generated for illustrative purposes only. -# It may require modifications to work in your environment. - -# To install the latest published package dependency, execute the following: -# python3 -m pip install google-cloud-confidentialcomputing - - -# [START confidentialcomputing_v1_generated_ConfidentialComputing_VerifyAttestation_async] -# This snippet has been automatically generated and should be regarded as a -# code template only. -# It will require modifications to work: -# - It may require correct/in-range values for request initialization. -# - It may require specifying regional endpoints when creating the service -# client as shown in: -# https://googleapis.dev/python/google-api-core/latest/client_options.html -from google.cloud import confidentialcomputing_v1 - - -async def sample_verify_attestation(): - # Create a client - client = confidentialcomputing_v1.ConfidentialComputingAsyncClient() - - # Initialize request argument(s) - request = confidentialcomputing_v1.VerifyAttestationRequest( - challenge="challenge_value", - ) - - # Make the request - response = await client.verify_attestation(request=request) - - # Handle the response - print(response) - -# [END confidentialcomputing_v1_generated_ConfidentialComputing_VerifyAttestation_async] diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_attestation_sync.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_attestation_sync.py deleted file mode 100644 index 724ad44eec2a..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_attestation_sync.py +++ /dev/null @@ -1,52 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -# Generated code. DO NOT EDIT! -# -# Snippet for VerifyAttestation -# NOTE: This snippet has been automatically generated for illustrative purposes only. -# It may require modifications to work in your environment. - -# To install the latest published package dependency, execute the following: -# python3 -m pip install google-cloud-confidentialcomputing - - -# [START confidentialcomputing_v1_generated_ConfidentialComputing_VerifyAttestation_sync] -# This snippet has been automatically generated and should be regarded as a -# code template only. -# It will require modifications to work: -# - It may require correct/in-range values for request initialization. -# - It may require specifying regional endpoints when creating the service -# client as shown in: -# https://googleapis.dev/python/google-api-core/latest/client_options.html -from google.cloud import confidentialcomputing_v1 - - -def sample_verify_attestation(): - # Create a client - client = confidentialcomputing_v1.ConfidentialComputingClient() - - # Initialize request argument(s) - request = confidentialcomputing_v1.VerifyAttestationRequest( - challenge="challenge_value", - ) - - # Make the request - response = client.verify_attestation(request=request) - - # Handle the response - print(response) - -# [END confidentialcomputing_v1_generated_ConfidentialComputing_VerifyAttestation_sync] diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_async.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_async.py deleted file mode 100644 index f31b51fb713f..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_async.py +++ /dev/null @@ -1,52 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -# Generated code. DO NOT EDIT! -# -# Snippet for VerifyConfidentialGke -# NOTE: This snippet has been automatically generated for illustrative purposes only. -# It may require modifications to work in your environment. - -# To install the latest published package dependency, execute the following: -# python3 -m pip install google-cloud-confidentialcomputing - - -# [START confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialGke_async] -# This snippet has been automatically generated and should be regarded as a -# code template only. -# It will require modifications to work: -# - It may require correct/in-range values for request initialization. -# - It may require specifying regional endpoints when creating the service -# client as shown in: -# https://googleapis.dev/python/google-api-core/latest/client_options.html -from google.cloud import confidentialcomputing_v1 - - -async def sample_verify_confidential_gke(): - # Create a client - client = confidentialcomputing_v1.ConfidentialComputingAsyncClient() - - # Initialize request argument(s) - request = confidentialcomputing_v1.VerifyConfidentialGkeRequest( - challenge="challenge_value", - ) - - # Make the request - response = await client.verify_confidential_gke(request=request) - - # Handle the response - print(response) - -# [END confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialGke_async] diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_sync.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_sync.py deleted file mode 100644 index f48c41b7d257..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_sync.py +++ /dev/null @@ -1,52 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -# Generated code. DO NOT EDIT! -# -# Snippet for VerifyConfidentialGke -# NOTE: This snippet has been automatically generated for illustrative purposes only. -# It may require modifications to work in your environment. - -# To install the latest published package dependency, execute the following: -# python3 -m pip install google-cloud-confidentialcomputing - - -# [START confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialGke_sync] -# This snippet has been automatically generated and should be regarded as a -# code template only. -# It will require modifications to work: -# - It may require correct/in-range values for request initialization. -# - It may require specifying regional endpoints when creating the service -# client as shown in: -# https://googleapis.dev/python/google-api-core/latest/client_options.html -from google.cloud import confidentialcomputing_v1 - - -def sample_verify_confidential_gke(): - # Create a client - client = confidentialcomputing_v1.ConfidentialComputingClient() - - # Initialize request argument(s) - request = confidentialcomputing_v1.VerifyConfidentialGkeRequest( - challenge="challenge_value", - ) - - # Make the request - response = client.verify_confidential_gke(request=request) - - # Handle the response - print(response) - -# [END confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialGke_sync] diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_async.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_async.py deleted file mode 100644 index 2a518ead0d28..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_async.py +++ /dev/null @@ -1,52 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -# Generated code. DO NOT EDIT! -# -# Snippet for VerifyConfidentialSpace -# NOTE: This snippet has been automatically generated for illustrative purposes only. -# It may require modifications to work in your environment. - -# To install the latest published package dependency, execute the following: -# python3 -m pip install google-cloud-confidentialcomputing - - -# [START confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialSpace_async] -# This snippet has been automatically generated and should be regarded as a -# code template only. -# It will require modifications to work: -# - It may require correct/in-range values for request initialization. -# - It may require specifying regional endpoints when creating the service -# client as shown in: -# https://googleapis.dev/python/google-api-core/latest/client_options.html -from google.cloud import confidentialcomputing_v1 - - -async def sample_verify_confidential_space(): - # Create a client - client = confidentialcomputing_v1.ConfidentialComputingAsyncClient() - - # Initialize request argument(s) - request = confidentialcomputing_v1.VerifyConfidentialSpaceRequest( - challenge="challenge_value", - ) - - # Make the request - response = await client.verify_confidential_space(request=request) - - # Handle the response - print(response) - -# [END confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialSpace_async] diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_sync.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_sync.py deleted file mode 100644 index c7a2756f49bc..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_sync.py +++ /dev/null @@ -1,52 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -# Generated code. DO NOT EDIT! -# -# Snippet for VerifyConfidentialSpace -# NOTE: This snippet has been automatically generated for illustrative purposes only. -# It may require modifications to work in your environment. - -# To install the latest published package dependency, execute the following: -# python3 -m pip install google-cloud-confidentialcomputing - - -# [START confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialSpace_sync] -# This snippet has been automatically generated and should be regarded as a -# code template only. -# It will require modifications to work: -# - It may require correct/in-range values for request initialization. -# - It may require specifying regional endpoints when creating the service -# client as shown in: -# https://googleapis.dev/python/google-api-core/latest/client_options.html -from google.cloud import confidentialcomputing_v1 - - -def sample_verify_confidential_space(): - # Create a client - client = confidentialcomputing_v1.ConfidentialComputingClient() - - # Initialize request argument(s) - request = confidentialcomputing_v1.VerifyConfidentialSpaceRequest( - challenge="challenge_value", - ) - - # Make the request - response = client.verify_confidential_space(request=request) - - # Handle the response - print(response) - -# [END confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialSpace_sync] diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/snippet_metadata_google.cloud.confidentialcomputing.v1.json b/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/snippet_metadata_google.cloud.confidentialcomputing.v1.json deleted file mode 100644 index 1994174817f3..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/samples/generated_samples/snippet_metadata_google.cloud.confidentialcomputing.v1.json +++ /dev/null @@ -1,643 +0,0 @@ -{ - "clientLibrary": { - "apis": [ - { - "id": "google.cloud.confidentialcomputing.v1", - "version": "v1" - } - ], - "language": "PYTHON", - "name": "google-cloud-confidentialcomputing", - "version": "0.1.0" - }, - "snippets": [ - { - "canonical": true, - "clientMethod": { - "async": true, - "client": { - "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient", - "shortName": "ConfidentialComputingAsyncClient" - }, - "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient.create_challenge", - "method": { - "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.CreateChallenge", - "service": { - "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "shortName": "ConfidentialComputing" - }, - "shortName": "CreateChallenge" - }, - "parameters": [ - { - "name": "request", - "type": "google.cloud.confidentialcomputing_v1.types.CreateChallengeRequest" - }, - { - "name": "parent", - "type": "str" - }, - { - "name": "challenge", - "type": "google.cloud.confidentialcomputing_v1.types.Challenge" - }, - { - "name": "retry", - "type": "google.api_core.retry.Retry" - }, - { - "name": "timeout", - "type": "float" - }, - { - "name": "metadata", - "type": "Sequence[Tuple[str, Union[str, bytes]]]" - } - ], - "resultType": "google.cloud.confidentialcomputing_v1.types.Challenge", - "shortName": "create_challenge" - }, - "description": "Sample for CreateChallenge", - "file": "confidentialcomputing_v1_generated_confidential_computing_create_challenge_async.py", - "language": "PYTHON", - "origin": "API_DEFINITION", - "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_CreateChallenge_async", - "segments": [ - { - "end": 51, - "start": 27, - "type": "FULL" - }, - { - "end": 51, - "start": 27, - "type": "SHORT" - }, - { - "end": 40, - "start": 38, - "type": "CLIENT_INITIALIZATION" - }, - { - "end": 45, - "start": 41, - "type": "REQUEST_INITIALIZATION" - }, - { - "end": 48, - "start": 46, - "type": "REQUEST_EXECUTION" - }, - { - "end": 52, - "start": 49, - "type": "RESPONSE_HANDLING" - } - ], - "title": "confidentialcomputing_v1_generated_confidential_computing_create_challenge_async.py" - }, - { - "canonical": true, - "clientMethod": { - "client": { - "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient", - "shortName": "ConfidentialComputingClient" - }, - "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.create_challenge", - "method": { - "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.CreateChallenge", - "service": { - "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "shortName": "ConfidentialComputing" - }, - "shortName": "CreateChallenge" - }, - "parameters": [ - { - "name": "request", - "type": "google.cloud.confidentialcomputing_v1.types.CreateChallengeRequest" - }, - { - "name": "parent", - "type": "str" - }, - { - "name": "challenge", - "type": "google.cloud.confidentialcomputing_v1.types.Challenge" - }, - { - "name": "retry", - "type": "google.api_core.retry.Retry" - }, - { - "name": "timeout", - "type": "float" - }, - { - "name": "metadata", - "type": "Sequence[Tuple[str, Union[str, bytes]]]" - } - ], - "resultType": "google.cloud.confidentialcomputing_v1.types.Challenge", - "shortName": "create_challenge" - }, - "description": "Sample for CreateChallenge", - "file": "confidentialcomputing_v1_generated_confidential_computing_create_challenge_sync.py", - "language": "PYTHON", - "origin": "API_DEFINITION", - "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_CreateChallenge_sync", - "segments": [ - { - "end": 51, - "start": 27, - "type": "FULL" - }, - { - "end": 51, - "start": 27, - "type": "SHORT" - }, - { - "end": 40, - "start": 38, - "type": "CLIENT_INITIALIZATION" - }, - { - "end": 45, - "start": 41, - "type": "REQUEST_INITIALIZATION" - }, - { - "end": 48, - "start": 46, - "type": "REQUEST_EXECUTION" - }, - { - "end": 52, - "start": 49, - "type": "RESPONSE_HANDLING" - } - ], - "title": "confidentialcomputing_v1_generated_confidential_computing_create_challenge_sync.py" - }, - { - "canonical": true, - "clientMethod": { - "async": true, - "client": { - "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient", - "shortName": "ConfidentialComputingAsyncClient" - }, - "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient.verify_attestation", - "method": { - "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.VerifyAttestation", - "service": { - "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "shortName": "ConfidentialComputing" - }, - "shortName": "VerifyAttestation" - }, - "parameters": [ - { - "name": "request", - "type": "google.cloud.confidentialcomputing_v1.types.VerifyAttestationRequest" - }, - { - "name": "retry", - "type": "google.api_core.retry.Retry" - }, - { - "name": "timeout", - "type": "float" - }, - { - "name": "metadata", - "type": "Sequence[Tuple[str, Union[str, bytes]]]" - } - ], - "resultType": "google.cloud.confidentialcomputing_v1.types.VerifyAttestationResponse", - "shortName": "verify_attestation" - }, - "description": "Sample for VerifyAttestation", - "file": "confidentialcomputing_v1_generated_confidential_computing_verify_attestation_async.py", - "language": "PYTHON", - "origin": "API_DEFINITION", - "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_VerifyAttestation_async", - "segments": [ - { - "end": 51, - "start": 27, - "type": "FULL" - }, - { - "end": 51, - "start": 27, - "type": "SHORT" - }, - { - "end": 40, - "start": 38, - "type": "CLIENT_INITIALIZATION" - }, - { - "end": 45, - "start": 41, - "type": "REQUEST_INITIALIZATION" - }, - { - "end": 48, - "start": 46, - "type": "REQUEST_EXECUTION" - }, - { - "end": 52, - "start": 49, - "type": "RESPONSE_HANDLING" - } - ], - "title": "confidentialcomputing_v1_generated_confidential_computing_verify_attestation_async.py" - }, - { - "canonical": true, - "clientMethod": { - "client": { - "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient", - "shortName": "ConfidentialComputingClient" - }, - "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.verify_attestation", - "method": { - "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.VerifyAttestation", - "service": { - "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "shortName": "ConfidentialComputing" - }, - "shortName": "VerifyAttestation" - }, - "parameters": [ - { - "name": "request", - "type": "google.cloud.confidentialcomputing_v1.types.VerifyAttestationRequest" - }, - { - "name": "retry", - "type": "google.api_core.retry.Retry" - }, - { - "name": "timeout", - "type": "float" - }, - { - "name": "metadata", - "type": "Sequence[Tuple[str, Union[str, bytes]]]" - } - ], - "resultType": "google.cloud.confidentialcomputing_v1.types.VerifyAttestationResponse", - "shortName": "verify_attestation" - }, - "description": "Sample for VerifyAttestation", - "file": "confidentialcomputing_v1_generated_confidential_computing_verify_attestation_sync.py", - "language": "PYTHON", - "origin": "API_DEFINITION", - "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_VerifyAttestation_sync", - "segments": [ - { - "end": 51, - "start": 27, - "type": "FULL" - }, - { - "end": 51, - "start": 27, - "type": "SHORT" - }, - { - "end": 40, - "start": 38, - "type": "CLIENT_INITIALIZATION" - }, - { - "end": 45, - "start": 41, - "type": "REQUEST_INITIALIZATION" - }, - { - "end": 48, - "start": 46, - "type": "REQUEST_EXECUTION" - }, - { - "end": 52, - "start": 49, - "type": "RESPONSE_HANDLING" - } - ], - "title": "confidentialcomputing_v1_generated_confidential_computing_verify_attestation_sync.py" - }, - { - "canonical": true, - "clientMethod": { - "async": true, - "client": { - "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient", - "shortName": "ConfidentialComputingAsyncClient" - }, - "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient.verify_confidential_gke", - "method": { - "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.VerifyConfidentialGke", - "service": { - "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "shortName": "ConfidentialComputing" - }, - "shortName": "VerifyConfidentialGke" - }, - "parameters": [ - { - "name": "request", - "type": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeRequest" - }, - { - "name": "retry", - "type": "google.api_core.retry.Retry" - }, - { - "name": "timeout", - "type": "float" - }, - { - "name": "metadata", - "type": "Sequence[Tuple[str, Union[str, bytes]]]" - } - ], - "resultType": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeResponse", - "shortName": "verify_confidential_gke" - }, - "description": "Sample for VerifyConfidentialGke", - "file": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_async.py", - "language": "PYTHON", - "origin": "API_DEFINITION", - "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialGke_async", - "segments": [ - { - "end": 51, - "start": 27, - "type": "FULL" - }, - { - "end": 51, - "start": 27, - "type": "SHORT" - }, - { - "end": 40, - "start": 38, - "type": "CLIENT_INITIALIZATION" - }, - { - "end": 45, - "start": 41, - "type": "REQUEST_INITIALIZATION" - }, - { - "end": 48, - "start": 46, - "type": "REQUEST_EXECUTION" - }, - { - "end": 52, - "start": 49, - "type": "RESPONSE_HANDLING" - } - ], - "title": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_async.py" - }, - { - "canonical": true, - "clientMethod": { - "client": { - "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient", - "shortName": "ConfidentialComputingClient" - }, - "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.verify_confidential_gke", - "method": { - "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.VerifyConfidentialGke", - "service": { - "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "shortName": "ConfidentialComputing" - }, - "shortName": "VerifyConfidentialGke" - }, - "parameters": [ - { - "name": "request", - "type": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeRequest" - }, - { - "name": "retry", - "type": "google.api_core.retry.Retry" - }, - { - "name": "timeout", - "type": "float" - }, - { - "name": "metadata", - "type": "Sequence[Tuple[str, Union[str, bytes]]]" - } - ], - "resultType": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialGkeResponse", - "shortName": "verify_confidential_gke" - }, - "description": "Sample for VerifyConfidentialGke", - "file": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_sync.py", - "language": "PYTHON", - "origin": "API_DEFINITION", - "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialGke_sync", - "segments": [ - { - "end": 51, - "start": 27, - "type": "FULL" - }, - { - "end": 51, - "start": 27, - "type": "SHORT" - }, - { - "end": 40, - "start": 38, - "type": "CLIENT_INITIALIZATION" - }, - { - "end": 45, - "start": 41, - "type": "REQUEST_INITIALIZATION" - }, - { - "end": 48, - "start": 46, - "type": "REQUEST_EXECUTION" - }, - { - "end": 52, - "start": 49, - "type": "RESPONSE_HANDLING" - } - ], - "title": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_gke_sync.py" - }, - { - "canonical": true, - "clientMethod": { - "async": true, - "client": { - "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient", - "shortName": "ConfidentialComputingAsyncClient" - }, - "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingAsyncClient.verify_confidential_space", - "method": { - "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.VerifyConfidentialSpace", - "service": { - "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "shortName": "ConfidentialComputing" - }, - "shortName": "VerifyConfidentialSpace" - }, - "parameters": [ - { - "name": "request", - "type": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceRequest" - }, - { - "name": "retry", - "type": "google.api_core.retry.Retry" - }, - { - "name": "timeout", - "type": "float" - }, - { - "name": "metadata", - "type": "Sequence[Tuple[str, Union[str, bytes]]]" - } - ], - "resultType": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceResponse", - "shortName": "verify_confidential_space" - }, - "description": "Sample for VerifyConfidentialSpace", - "file": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_async.py", - "language": "PYTHON", - "origin": "API_DEFINITION", - "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialSpace_async", - "segments": [ - { - "end": 51, - "start": 27, - "type": "FULL" - }, - { - "end": 51, - "start": 27, - "type": "SHORT" - }, - { - "end": 40, - "start": 38, - "type": "CLIENT_INITIALIZATION" - }, - { - "end": 45, - "start": 41, - "type": "REQUEST_INITIALIZATION" - }, - { - "end": 48, - "start": 46, - "type": "REQUEST_EXECUTION" - }, - { - "end": 52, - "start": 49, - "type": "RESPONSE_HANDLING" - } - ], - "title": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_async.py" - }, - { - "canonical": true, - "clientMethod": { - "client": { - "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient", - "shortName": "ConfidentialComputingClient" - }, - "fullName": "google.cloud.confidentialcomputing_v1.ConfidentialComputingClient.verify_confidential_space", - "method": { - "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing.VerifyConfidentialSpace", - "service": { - "fullName": "google.cloud.confidentialcomputing.v1.ConfidentialComputing", - "shortName": "ConfidentialComputing" - }, - "shortName": "VerifyConfidentialSpace" - }, - "parameters": [ - { - "name": "request", - "type": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceRequest" - }, - { - "name": "retry", - "type": "google.api_core.retry.Retry" - }, - { - "name": "timeout", - "type": "float" - }, - { - "name": "metadata", - "type": "Sequence[Tuple[str, Union[str, bytes]]]" - } - ], - "resultType": "google.cloud.confidentialcomputing_v1.types.VerifyConfidentialSpaceResponse", - "shortName": "verify_confidential_space" - }, - "description": "Sample for VerifyConfidentialSpace", - "file": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_sync.py", - "language": "PYTHON", - "origin": "API_DEFINITION", - "regionTag": "confidentialcomputing_v1_generated_ConfidentialComputing_VerifyConfidentialSpace_sync", - "segments": [ - { - "end": 51, - "start": 27, - "type": "FULL" - }, - { - "end": 51, - "start": 27, - "type": "SHORT" - }, - { - "end": 40, - "start": 38, - "type": "CLIENT_INITIALIZATION" - }, - { - "end": 45, - "start": 41, - "type": "REQUEST_INITIALIZATION" - }, - { - "end": 48, - "start": 46, - "type": "REQUEST_EXECUTION" - }, - { - "end": 52, - "start": 49, - "type": "RESPONSE_HANDLING" - } - ], - "title": "confidentialcomputing_v1_generated_confidential_computing_verify_confidential_space_sync.py" - } - ] -} diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/scripts/fixup_confidentialcomputing_v1_keywords.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/scripts/fixup_confidentialcomputing_v1_keywords.py deleted file mode 100644 index 6a8e4fb95705..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/scripts/fixup_confidentialcomputing_v1_keywords.py +++ /dev/null @@ -1,179 +0,0 @@ -#! /usr/bin/env python3 -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -import argparse -import os -import libcst as cst -import pathlib -import sys -from typing import (Any, Callable, Dict, List, Sequence, Tuple) - - -def partition( - predicate: Callable[[Any], bool], - iterator: Sequence[Any] -) -> Tuple[List[Any], List[Any]]: - """A stable, out-of-place partition.""" - results = ([], []) - - for i in iterator: - results[int(predicate(i))].append(i) - - # Returns trueList, falseList - return results[1], results[0] - - -class confidentialcomputingCallTransformer(cst.CSTTransformer): - CTRL_PARAMS: Tuple[str] = ('retry', 'timeout', 'metadata') - METHOD_TO_PARAMS: Dict[str, Tuple[str]] = { - 'create_challenge': ('parent', 'challenge', ), - 'verify_attestation': ('challenge', 'tpm_attestation', 'td_ccel', 'sev_snp_attestation', 'gcp_credentials', 'confidential_space_info', 'token_options', 'attester', ), - 'verify_confidential_gke': ('challenge', 'tpm_attestation', ), - 'verify_confidential_space': ('challenge', 'td_ccel', 'tpm_attestation', 'gcp_credentials', 'signed_entities', 'gce_shielded_identity', 'options', ), - } - - def leave_Call(self, original: cst.Call, updated: cst.Call) -> cst.CSTNode: - try: - key = original.func.attr.value - kword_params = self.METHOD_TO_PARAMS[key] - except (AttributeError, KeyError): - # Either not a method from the API or too convoluted to be sure. - return updated - - # If the existing code is valid, keyword args come after positional args. - # Therefore, all positional args must map to the first parameters. - args, kwargs = partition(lambda a: not bool(a.keyword), updated.args) - if any(k.keyword.value == "request" for k in kwargs): - # We've already fixed this file, don't fix it again. - return updated - - kwargs, ctrl_kwargs = partition( - lambda a: a.keyword.value not in self.CTRL_PARAMS, - kwargs - ) - - args, ctrl_args = args[:len(kword_params)], args[len(kword_params):] - ctrl_kwargs.extend(cst.Arg(value=a.value, keyword=cst.Name(value=ctrl)) - for a, ctrl in zip(ctrl_args, self.CTRL_PARAMS)) - - request_arg = cst.Arg( - value=cst.Dict([ - cst.DictElement( - cst.SimpleString("'{}'".format(name)), -cst.Element(value=arg.value) - ) - # Note: the args + kwargs looks silly, but keep in mind that - # the control parameters had to be stripped out, and that - # those could have been passed positionally or by keyword. - for name, arg in zip(kword_params, args + kwargs)]), - keyword=cst.Name("request") - ) - - return updated.with_changes( - args=[request_arg] + ctrl_kwargs - ) - - -def fix_files( - in_dir: pathlib.Path, - out_dir: pathlib.Path, - *, - transformer=confidentialcomputingCallTransformer(), -): - """Duplicate the input dir to the output dir, fixing file method calls. - - Preconditions: - * in_dir is a real directory - * out_dir is a real, empty directory - """ - pyfile_gen = ( - pathlib.Path(os.path.join(root, f)) - for root, _, files in os.walk(in_dir) - for f in files if os.path.splitext(f)[1] == ".py" - ) - - for fpath in pyfile_gen: - with open(fpath, 'r') as f: - src = f.read() - - # Parse the code and insert method call fixes. - tree = cst.parse_module(src) - updated = tree.visit(transformer) - - # Create the path and directory structure for the new file. - updated_path = out_dir.joinpath(fpath.relative_to(in_dir)) - updated_path.parent.mkdir(parents=True, exist_ok=True) - - # Generate the updated source file at the corresponding path. - with open(updated_path, 'w') as f: - f.write(updated.code) - - -if __name__ == '__main__': - parser = argparse.ArgumentParser( - description="""Fix up source that uses the confidentialcomputing client library. - -The existing sources are NOT overwritten but are copied to output_dir with changes made. - -Note: This tool operates at a best-effort level at converting positional - parameters in client method calls to keyword based parameters. - Cases where it WILL FAIL include - A) * or ** expansion in a method call. - B) Calls via function or method alias (includes free function calls) - C) Indirect or dispatched calls (e.g. the method is looked up dynamically) - - These all constitute false negatives. The tool will also detect false - positives when an API method shares a name with another method. -""") - parser.add_argument( - '-d', - '--input-directory', - required=True, - dest='input_dir', - help='the input directory to walk for python files to fix up', - ) - parser.add_argument( - '-o', - '--output-directory', - required=True, - dest='output_dir', - help='the directory to output files fixed via un-flattening', - ) - args = parser.parse_args() - input_dir = pathlib.Path(args.input_dir) - output_dir = pathlib.Path(args.output_dir) - if not input_dir.is_dir(): - print( - f"input directory '{input_dir}' does not exist or is not a directory", - file=sys.stderr, - ) - sys.exit(-1) - - if not output_dir.is_dir(): - print( - f"output directory '{output_dir}' does not exist or is not a directory", - file=sys.stderr, - ) - sys.exit(-1) - - if os.listdir(output_dir): - print( - f"output directory '{output_dir}' is not empty", - file=sys.stderr, - ) - sys.exit(-1) - - fix_files(input_dir, output_dir) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/setup.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/setup.py deleted file mode 100644 index 1fed1a0eec9f..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/setup.py +++ /dev/null @@ -1,98 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -import io -import os -import re - -import setuptools # type: ignore - -package_root = os.path.abspath(os.path.dirname(__file__)) - -name = 'google-cloud-confidentialcomputing' - - -description = "Google Cloud Confidentialcomputing API client library" - -version = None - -with open(os.path.join(package_root, 'google/cloud/confidentialcomputing/gapic_version.py')) as fp: - version_candidates = re.findall(r"(?<=\")\d+.\d+.\d+(?=\")", fp.read()) - assert (len(version_candidates) == 1) - version = version_candidates[0] - -if version[0] == "0": - release_status = "Development Status :: 4 - Beta" -else: - release_status = "Development Status :: 5 - Production/Stable" - -dependencies = [ - "google-api-core[grpc] >= 1.34.1, <3.0.0,!=2.0.*,!=2.1.*,!=2.2.*,!=2.3.*,!=2.4.*,!=2.5.*,!=2.6.*,!=2.7.*,!=2.8.*,!=2.9.*,!=2.10.*", - # Exclude incompatible versions of `google-auth` - # See https://github.com/googleapis/google-cloud-python/issues/12364 - "google-auth >= 2.14.1, <3.0.0,!=2.24.0,!=2.25.0", - "proto-plus >= 1.22.3, <2.0.0", - "proto-plus >= 1.25.0, <2.0.0; python_version >= '3.13'", - "protobuf>=3.20.2,<7.0.0,!=4.21.0,!=4.21.1,!=4.21.2,!=4.21.3,!=4.21.4,!=4.21.5", -] -extras = { -} -url = "https://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-confidentialcomputing" - -package_root = os.path.abspath(os.path.dirname(__file__)) - -readme_filename = os.path.join(package_root, "README.rst") -with io.open(readme_filename, encoding="utf-8") as readme_file: - readme = readme_file.read() - -packages = [ - package - for package in setuptools.find_namespace_packages() - if package.startswith("google") -] - -setuptools.setup( - name=name, - version=version, - description=description, - long_description=readme, - author="Google LLC", - author_email="googleapis-packages@google.com", - license="Apache 2.0", - url=url, - classifiers=[ - release_status, - "Intended Audience :: Developers", - "License :: OSI Approved :: Apache Software License", - "Programming Language :: Python", - "Programming Language :: Python :: 3", - "Programming Language :: Python :: 3.7", - "Programming Language :: Python :: 3.8", - "Programming Language :: Python :: 3.9", - "Programming Language :: Python :: 3.10", - "Programming Language :: Python :: 3.11", - "Programming Language :: Python :: 3.12", - "Programming Language :: Python :: 3.13", - "Operating System :: OS Independent", - "Topic :: Internet", - ], - platforms="Posix; MacOS X; Windows", - packages=packages, - python_requires=">=3.7", - install_requires=dependencies, - extras_require=extras, - include_package_data=True, - zip_safe=False, -) diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.10.txt b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.10.txt deleted file mode 100644 index ed7f9aed2559..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.10.txt +++ /dev/null @@ -1,6 +0,0 @@ -# -*- coding: utf-8 -*- -# This constraints file is required for unit tests. -# List all library dependencies and extras in this file. -google-api-core -proto-plus -protobuf diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.11.txt b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.11.txt deleted file mode 100644 index ed7f9aed2559..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.11.txt +++ /dev/null @@ -1,6 +0,0 @@ -# -*- coding: utf-8 -*- -# This constraints file is required for unit tests. -# List all library dependencies and extras in this file. -google-api-core -proto-plus -protobuf diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.12.txt b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.12.txt deleted file mode 100644 index ed7f9aed2559..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.12.txt +++ /dev/null @@ -1,6 +0,0 @@ -# -*- coding: utf-8 -*- -# This constraints file is required for unit tests. -# List all library dependencies and extras in this file. -google-api-core -proto-plus -protobuf diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.13.txt b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.13.txt deleted file mode 100644 index c20a77817caa..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.13.txt +++ /dev/null @@ -1,11 +0,0 @@ -# We use the constraints file for the latest Python version -# (currently this file) to check that the latest -# major versions of dependencies are supported in setup.py. -# List all library dependencies and extras in this file. -# Require the latest major version be installed for each dependency. -# e.g., if setup.py has "google-cloud-foo >= 1.14.0, < 2.0.0", -# Then this file should have google-cloud-foo>=1 -google-api-core>=2 -google-auth>=2 -proto-plus>=1 -protobuf>=6 diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.7.txt b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.7.txt deleted file mode 100644 index a77f12bc13e4..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.7.txt +++ /dev/null @@ -1,10 +0,0 @@ -# This constraints file is used to check that lower bounds -# are correct in setup.py -# List all library dependencies and extras in this file. -# Pin the version to the lower bound. -# e.g., if setup.py has "google-cloud-foo >= 1.14.0, < 2.0.0", -# Then this file should have google-cloud-foo==1.14.0 -google-api-core==1.34.1 -google-auth==2.14.1 -proto-plus==1.22.3 -protobuf==3.20.2 diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.8.txt b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.8.txt deleted file mode 100644 index ed7f9aed2559..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.8.txt +++ /dev/null @@ -1,6 +0,0 @@ -# -*- coding: utf-8 -*- -# This constraints file is required for unit tests. -# List all library dependencies and extras in this file. -google-api-core -proto-plus -protobuf diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.9.txt b/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.9.txt deleted file mode 100644 index ed7f9aed2559..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/testing/constraints-3.9.txt +++ /dev/null @@ -1,6 +0,0 @@ -# -*- coding: utf-8 -*- -# This constraints file is required for unit tests. -# List all library dependencies and extras in this file. -google-api-core -proto-plus -protobuf diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/__init__.py deleted file mode 100644 index 191773d5572d..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/__init__.py +++ /dev/null @@ -1,16 +0,0 @@ - -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/__init__.py deleted file mode 100644 index 191773d5572d..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/__init__.py +++ /dev/null @@ -1,16 +0,0 @@ - -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/__init__.py deleted file mode 100644 index 191773d5572d..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/__init__.py +++ /dev/null @@ -1,16 +0,0 @@ - -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/confidentialcomputing_v1/__init__.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/confidentialcomputing_v1/__init__.py deleted file mode 100644 index 191773d5572d..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/confidentialcomputing_v1/__init__.py +++ /dev/null @@ -1,16 +0,0 @@ - -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# diff --git a/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/confidentialcomputing_v1/test_confidential_computing.py b/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/confidentialcomputing_v1/test_confidential_computing.py deleted file mode 100644 index 261b185b4d1b..000000000000 --- a/owl-bot-staging/google-cloud-confidentialcomputing/v1/tests/unit/gapic/confidentialcomputing_v1/test_confidential_computing.py +++ /dev/null @@ -1,4165 +0,0 @@ -# -*- coding: utf-8 -*- -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -import os -# try/except added for compatibility with python < 3.8 -try: - from unittest import mock - from unittest.mock import AsyncMock # pragma: NO COVER -except ImportError: # pragma: NO COVER - import mock - -import grpc -from grpc.experimental import aio -from collections.abc import Iterable, AsyncIterable -from google.protobuf import json_format -import json -import math -import pytest -from google.api_core import api_core_version -from proto.marshal.rules.dates import DurationRule, TimestampRule -from proto.marshal.rules import wrappers -from requests import Response -from requests import Request, PreparedRequest -from requests.sessions import Session -from google.protobuf import json_format - -try: - from google.auth.aio import credentials as ga_credentials_async - HAS_GOOGLE_AUTH_AIO = True -except ImportError: # pragma: NO COVER - HAS_GOOGLE_AUTH_AIO = False - -from google.api_core import client_options -from google.api_core import exceptions as core_exceptions -from google.api_core import gapic_v1 -from google.api_core import grpc_helpers -from google.api_core import grpc_helpers_async -from google.api_core import path_template -from google.api_core import retry as retries -from google.auth import credentials as ga_credentials -from google.auth.exceptions import MutualTLSChannelError -from google.cloud.confidentialcomputing_v1.services.confidential_computing import ConfidentialComputingAsyncClient -from google.cloud.confidentialcomputing_v1.services.confidential_computing import ConfidentialComputingClient -from google.cloud.confidentialcomputing_v1.services.confidential_computing import transports -from google.cloud.confidentialcomputing_v1.types import service -from google.cloud.location import locations_pb2 -from google.oauth2 import service_account -from google.protobuf import timestamp_pb2 # type: ignore -from google.rpc import status_pb2 # type: ignore -import google.auth - - - -CRED_INFO_JSON = { - "credential_source": "/path/to/file", - "credential_type": "service account credentials", - "principal": "service-account@example.com", -} -CRED_INFO_STRING = json.dumps(CRED_INFO_JSON) - - -async def mock_async_gen(data, chunk_size=1): - for i in range(0, len(data)): # pragma: NO COVER - chunk = data[i : i + chunk_size] - yield chunk.encode("utf-8") - -def client_cert_source_callback(): - return b"cert bytes", b"key bytes" - -# TODO: use async auth anon credentials by default once the minimum version of google-auth is upgraded. -# See related issue: https://github.com/googleapis/gapic-generator-python/issues/2107. -def async_anonymous_credentials(): - if HAS_GOOGLE_AUTH_AIO: - return ga_credentials_async.AnonymousCredentials() - return ga_credentials.AnonymousCredentials() - -# If default endpoint is localhost, then default mtls endpoint will be the same. -# This method modifies the default endpoint so the client can produce a different -# mtls endpoint for endpoint testing purposes. -def modify_default_endpoint(client): - return "foo.googleapis.com" if ("localhost" in client.DEFAULT_ENDPOINT) else client.DEFAULT_ENDPOINT - -# If default endpoint template is localhost, then default mtls endpoint will be the same. -# This method modifies the default endpoint template so the client can produce a different -# mtls endpoint for endpoint testing purposes. -def modify_default_endpoint_template(client): - return "test.{UNIVERSE_DOMAIN}" if ("localhost" in client._DEFAULT_ENDPOINT_TEMPLATE) else client._DEFAULT_ENDPOINT_TEMPLATE - - -def test__get_default_mtls_endpoint(): - api_endpoint = "example.googleapis.com" - api_mtls_endpoint = "example.mtls.googleapis.com" - sandbox_endpoint = "example.sandbox.googleapis.com" - sandbox_mtls_endpoint = "example.mtls.sandbox.googleapis.com" - non_googleapi = "api.example.com" - - assert ConfidentialComputingClient._get_default_mtls_endpoint(None) is None - assert ConfidentialComputingClient._get_default_mtls_endpoint(api_endpoint) == api_mtls_endpoint - assert ConfidentialComputingClient._get_default_mtls_endpoint(api_mtls_endpoint) == api_mtls_endpoint - assert ConfidentialComputingClient._get_default_mtls_endpoint(sandbox_endpoint) == sandbox_mtls_endpoint - assert ConfidentialComputingClient._get_default_mtls_endpoint(sandbox_mtls_endpoint) == sandbox_mtls_endpoint - assert ConfidentialComputingClient._get_default_mtls_endpoint(non_googleapi) == non_googleapi - -def test__read_environment_variables(): - assert ConfidentialComputingClient._read_environment_variables() == (False, "auto", None) - - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "true"}): - assert ConfidentialComputingClient._read_environment_variables() == (True, "auto", None) - - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "false"}): - assert ConfidentialComputingClient._read_environment_variables() == (False, "auto", None) - - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "Unsupported"}): - with pytest.raises(ValueError) as excinfo: - ConfidentialComputingClient._read_environment_variables() - assert str(excinfo.value) == "Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`" - - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "never"}): - assert ConfidentialComputingClient._read_environment_variables() == (False, "never", None) - - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "always"}): - assert ConfidentialComputingClient._read_environment_variables() == (False, "always", None) - - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "auto"}): - assert ConfidentialComputingClient._read_environment_variables() == (False, "auto", None) - - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "Unsupported"}): - with pytest.raises(MutualTLSChannelError) as excinfo: - ConfidentialComputingClient._read_environment_variables() - assert str(excinfo.value) == "Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`" - - with mock.patch.dict(os.environ, {"GOOGLE_CLOUD_UNIVERSE_DOMAIN": "foo.com"}): - assert ConfidentialComputingClient._read_environment_variables() == (False, "auto", "foo.com") - -def test__get_client_cert_source(): - mock_provided_cert_source = mock.Mock() - mock_default_cert_source = mock.Mock() - - assert ConfidentialComputingClient._get_client_cert_source(None, False) is None - assert ConfidentialComputingClient._get_client_cert_source(mock_provided_cert_source, False) is None - assert ConfidentialComputingClient._get_client_cert_source(mock_provided_cert_source, True) == mock_provided_cert_source - - with mock.patch('google.auth.transport.mtls.has_default_client_cert_source', return_value=True): - with mock.patch('google.auth.transport.mtls.default_client_cert_source', return_value=mock_default_cert_source): - assert ConfidentialComputingClient._get_client_cert_source(None, True) is mock_default_cert_source - assert ConfidentialComputingClient._get_client_cert_source(mock_provided_cert_source, "true") is mock_provided_cert_source - -@mock.patch.object(ConfidentialComputingClient, "_DEFAULT_ENDPOINT_TEMPLATE", modify_default_endpoint_template(ConfidentialComputingClient)) -@mock.patch.object(ConfidentialComputingAsyncClient, "_DEFAULT_ENDPOINT_TEMPLATE", modify_default_endpoint_template(ConfidentialComputingAsyncClient)) -def test__get_api_endpoint(): - api_override = "foo.com" - mock_client_cert_source = mock.Mock() - default_universe = ConfidentialComputingClient._DEFAULT_UNIVERSE - default_endpoint = ConfidentialComputingClient._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=default_universe) - mock_universe = "bar.com" - mock_endpoint = ConfidentialComputingClient._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=mock_universe) - - assert ConfidentialComputingClient._get_api_endpoint(api_override, mock_client_cert_source, default_universe, "always") == api_override - assert ConfidentialComputingClient._get_api_endpoint(None, mock_client_cert_source, default_universe, "auto") == ConfidentialComputingClient.DEFAULT_MTLS_ENDPOINT - assert ConfidentialComputingClient._get_api_endpoint(None, None, default_universe, "auto") == default_endpoint - assert ConfidentialComputingClient._get_api_endpoint(None, None, default_universe, "always") == ConfidentialComputingClient.DEFAULT_MTLS_ENDPOINT - assert ConfidentialComputingClient._get_api_endpoint(None, mock_client_cert_source, default_universe, "always") == ConfidentialComputingClient.DEFAULT_MTLS_ENDPOINT - assert ConfidentialComputingClient._get_api_endpoint(None, None, mock_universe, "never") == mock_endpoint - assert ConfidentialComputingClient._get_api_endpoint(None, None, default_universe, "never") == default_endpoint - - with pytest.raises(MutualTLSChannelError) as excinfo: - ConfidentialComputingClient._get_api_endpoint(None, mock_client_cert_source, mock_universe, "auto") - assert str(excinfo.value) == "mTLS is not supported in any universe other than googleapis.com." - - -def test__get_universe_domain(): - client_universe_domain = "foo.com" - universe_domain_env = "bar.com" - - assert ConfidentialComputingClient._get_universe_domain(client_universe_domain, universe_domain_env) == client_universe_domain - assert ConfidentialComputingClient._get_universe_domain(None, universe_domain_env) == universe_domain_env - assert ConfidentialComputingClient._get_universe_domain(None, None) == ConfidentialComputingClient._DEFAULT_UNIVERSE - - with pytest.raises(ValueError) as excinfo: - ConfidentialComputingClient._get_universe_domain("", None) - assert str(excinfo.value) == "Universe Domain cannot be an empty string." - -@pytest.mark.parametrize("error_code,cred_info_json,show_cred_info", [ - (401, CRED_INFO_JSON, True), - (403, CRED_INFO_JSON, True), - (404, CRED_INFO_JSON, True), - (500, CRED_INFO_JSON, False), - (401, None, False), - (403, None, False), - (404, None, False), - (500, None, False) -]) -def test__add_cred_info_for_auth_errors(error_code, cred_info_json, show_cred_info): - cred = mock.Mock(["get_cred_info"]) - cred.get_cred_info = mock.Mock(return_value=cred_info_json) - client = ConfidentialComputingClient(credentials=cred) - client._transport._credentials = cred - - error = core_exceptions.GoogleAPICallError("message", details=["foo"]) - error.code = error_code - - client._add_cred_info_for_auth_errors(error) - if show_cred_info: - assert error.details == ["foo", CRED_INFO_STRING] - else: - assert error.details == ["foo"] - -@pytest.mark.parametrize("error_code", [401,403,404,500]) -def test__add_cred_info_for_auth_errors_no_get_cred_info(error_code): - cred = mock.Mock([]) - assert not hasattr(cred, "get_cred_info") - client = ConfidentialComputingClient(credentials=cred) - client._transport._credentials = cred - - error = core_exceptions.GoogleAPICallError("message", details=[]) - error.code = error_code - - client._add_cred_info_for_auth_errors(error) - assert error.details == [] - -@pytest.mark.parametrize("client_class,transport_name", [ - (ConfidentialComputingClient, "grpc"), - (ConfidentialComputingAsyncClient, "grpc_asyncio"), - (ConfidentialComputingClient, "rest"), -]) -def test_confidential_computing_client_from_service_account_info(client_class, transport_name): - creds = ga_credentials.AnonymousCredentials() - with mock.patch.object(service_account.Credentials, 'from_service_account_info') as factory: - factory.return_value = creds - info = {"valid": True} - client = client_class.from_service_account_info(info, transport=transport_name) - assert client.transport._credentials == creds - assert isinstance(client, client_class) - - assert client.transport._host == ( - 'confidentialcomputing.googleapis.com:443' - if transport_name in ['grpc', 'grpc_asyncio'] - else - 'https://confidentialcomputing.googleapis.com' - ) - - -@pytest.mark.parametrize("transport_class,transport_name", [ - (transports.ConfidentialComputingGrpcTransport, "grpc"), - (transports.ConfidentialComputingGrpcAsyncIOTransport, "grpc_asyncio"), - (transports.ConfidentialComputingRestTransport, "rest"), -]) -def test_confidential_computing_client_service_account_always_use_jwt(transport_class, transport_name): - with mock.patch.object(service_account.Credentials, 'with_always_use_jwt_access', create=True) as use_jwt: - creds = service_account.Credentials(None, None, None) - transport = transport_class(credentials=creds, always_use_jwt_access=True) - use_jwt.assert_called_once_with(True) - - with mock.patch.object(service_account.Credentials, 'with_always_use_jwt_access', create=True) as use_jwt: - creds = service_account.Credentials(None, None, None) - transport = transport_class(credentials=creds, always_use_jwt_access=False) - use_jwt.assert_not_called() - - -@pytest.mark.parametrize("client_class,transport_name", [ - (ConfidentialComputingClient, "grpc"), - (ConfidentialComputingAsyncClient, "grpc_asyncio"), - (ConfidentialComputingClient, "rest"), -]) -def test_confidential_computing_client_from_service_account_file(client_class, transport_name): - creds = ga_credentials.AnonymousCredentials() - with mock.patch.object(service_account.Credentials, 'from_service_account_file') as factory: - factory.return_value = creds - client = client_class.from_service_account_file("dummy/file/path.json", transport=transport_name) - assert client.transport._credentials == creds - assert isinstance(client, client_class) - - client = client_class.from_service_account_json("dummy/file/path.json", transport=transport_name) - assert client.transport._credentials == creds - assert isinstance(client, client_class) - - assert client.transport._host == ( - 'confidentialcomputing.googleapis.com:443' - if transport_name in ['grpc', 'grpc_asyncio'] - else - 'https://confidentialcomputing.googleapis.com' - ) - - -def test_confidential_computing_client_get_transport_class(): - transport = ConfidentialComputingClient.get_transport_class() - available_transports = [ - transports.ConfidentialComputingGrpcTransport, - transports.ConfidentialComputingRestTransport, - ] - assert transport in available_transports - - transport = ConfidentialComputingClient.get_transport_class("grpc") - assert transport == transports.ConfidentialComputingGrpcTransport - - -@pytest.mark.parametrize("client_class,transport_class,transport_name", [ - (ConfidentialComputingClient, transports.ConfidentialComputingGrpcTransport, "grpc"), - (ConfidentialComputingAsyncClient, transports.ConfidentialComputingGrpcAsyncIOTransport, "grpc_asyncio"), - (ConfidentialComputingClient, transports.ConfidentialComputingRestTransport, "rest"), -]) -@mock.patch.object(ConfidentialComputingClient, "_DEFAULT_ENDPOINT_TEMPLATE", modify_default_endpoint_template(ConfidentialComputingClient)) -@mock.patch.object(ConfidentialComputingAsyncClient, "_DEFAULT_ENDPOINT_TEMPLATE", modify_default_endpoint_template(ConfidentialComputingAsyncClient)) -def test_confidential_computing_client_client_options(client_class, transport_class, transport_name): - # Check that if channel is provided we won't create a new one. - with mock.patch.object(ConfidentialComputingClient, 'get_transport_class') as gtc: - transport = transport_class( - credentials=ga_credentials.AnonymousCredentials() - ) - client = client_class(transport=transport) - gtc.assert_not_called() - - # Check that if channel is provided via str we will create a new one. - with mock.patch.object(ConfidentialComputingClient, 'get_transport_class') as gtc: - client = client_class(transport=transport_name) - gtc.assert_called() - - # Check the case api_endpoint is provided. - options = client_options.ClientOptions(api_endpoint="squid.clam.whelk") - with mock.patch.object(transport_class, '__init__') as patched: - patched.return_value = None - client = client_class(transport=transport_name, client_options=options) - patched.assert_called_once_with( - credentials=None, - credentials_file=None, - host="squid.clam.whelk", - scopes=None, - client_cert_source_for_mtls=None, - quota_project_id=None, - client_info=transports.base.DEFAULT_CLIENT_INFO, - always_use_jwt_access=True, - api_audience=None, - ) - - # Check the case api_endpoint is not provided and GOOGLE_API_USE_MTLS_ENDPOINT is - # "never". - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "never"}): - with mock.patch.object(transport_class, '__init__') as patched: - patched.return_value = None - client = client_class(transport=transport_name) - patched.assert_called_once_with( - credentials=None, - credentials_file=None, - host=client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE), - scopes=None, - client_cert_source_for_mtls=None, - quota_project_id=None, - client_info=transports.base.DEFAULT_CLIENT_INFO, - always_use_jwt_access=True, - api_audience=None, - ) - - # Check the case api_endpoint is not provided and GOOGLE_API_USE_MTLS_ENDPOINT is - # "always". - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "always"}): - with mock.patch.object(transport_class, '__init__') as patched: - patched.return_value = None - client = client_class(transport=transport_name) - patched.assert_called_once_with( - credentials=None, - credentials_file=None, - host=client.DEFAULT_MTLS_ENDPOINT, - scopes=None, - client_cert_source_for_mtls=None, - quota_project_id=None, - client_info=transports.base.DEFAULT_CLIENT_INFO, - always_use_jwt_access=True, - api_audience=None, - ) - - # Check the case api_endpoint is not provided and GOOGLE_API_USE_MTLS_ENDPOINT has - # unsupported value. - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "Unsupported"}): - with pytest.raises(MutualTLSChannelError) as excinfo: - client = client_class(transport=transport_name) - assert str(excinfo.value) == "Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`" - - # Check the case GOOGLE_API_USE_CLIENT_CERTIFICATE has unsupported value. - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "Unsupported"}): - with pytest.raises(ValueError) as excinfo: - client = client_class(transport=transport_name) - assert str(excinfo.value) == "Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`" - - # Check the case quota_project_id is provided - options = client_options.ClientOptions(quota_project_id="octopus") - with mock.patch.object(transport_class, '__init__') as patched: - patched.return_value = None - client = client_class(client_options=options, transport=transport_name) - patched.assert_called_once_with( - credentials=None, - credentials_file=None, - host=client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE), - scopes=None, - client_cert_source_for_mtls=None, - quota_project_id="octopus", - client_info=transports.base.DEFAULT_CLIENT_INFO, - always_use_jwt_access=True, - api_audience=None, - ) - # Check the case api_endpoint is provided - options = client_options.ClientOptions(api_audience="https://language.googleapis.com") - with mock.patch.object(transport_class, '__init__') as patched: - patched.return_value = None - client = client_class(client_options=options, transport=transport_name) - patched.assert_called_once_with( - credentials=None, - credentials_file=None, - host=client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE), - scopes=None, - client_cert_source_for_mtls=None, - quota_project_id=None, - client_info=transports.base.DEFAULT_CLIENT_INFO, - always_use_jwt_access=True, - api_audience="https://language.googleapis.com" - ) - -@pytest.mark.parametrize("client_class,transport_class,transport_name,use_client_cert_env", [ - (ConfidentialComputingClient, transports.ConfidentialComputingGrpcTransport, "grpc", "true"), - (ConfidentialComputingAsyncClient, transports.ConfidentialComputingGrpcAsyncIOTransport, "grpc_asyncio", "true"), - (ConfidentialComputingClient, transports.ConfidentialComputingGrpcTransport, "grpc", "false"), - (ConfidentialComputingAsyncClient, transports.ConfidentialComputingGrpcAsyncIOTransport, "grpc_asyncio", "false"), - (ConfidentialComputingClient, transports.ConfidentialComputingRestTransport, "rest", "true"), - (ConfidentialComputingClient, transports.ConfidentialComputingRestTransport, "rest", "false"), -]) -@mock.patch.object(ConfidentialComputingClient, "_DEFAULT_ENDPOINT_TEMPLATE", modify_default_endpoint_template(ConfidentialComputingClient)) -@mock.patch.object(ConfidentialComputingAsyncClient, "_DEFAULT_ENDPOINT_TEMPLATE", modify_default_endpoint_template(ConfidentialComputingAsyncClient)) -@mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "auto"}) -def test_confidential_computing_client_mtls_env_auto(client_class, transport_class, transport_name, use_client_cert_env): - # This tests the endpoint autoswitch behavior. Endpoint is autoswitched to the default - # mtls endpoint, if GOOGLE_API_USE_CLIENT_CERTIFICATE is "true" and client cert exists. - - # Check the case client_cert_source is provided. Whether client cert is used depends on - # GOOGLE_API_USE_CLIENT_CERTIFICATE value. - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": use_client_cert_env}): - options = client_options.ClientOptions(client_cert_source=client_cert_source_callback) - with mock.patch.object(transport_class, '__init__') as patched: - patched.return_value = None - client = client_class(client_options=options, transport=transport_name) - - if use_client_cert_env == "false": - expected_client_cert_source = None - expected_host = client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE) - else: - expected_client_cert_source = client_cert_source_callback - expected_host = client.DEFAULT_MTLS_ENDPOINT - - patched.assert_called_once_with( - credentials=None, - credentials_file=None, - host=expected_host, - scopes=None, - client_cert_source_for_mtls=expected_client_cert_source, - quota_project_id=None, - client_info=transports.base.DEFAULT_CLIENT_INFO, - always_use_jwt_access=True, - api_audience=None, - ) - - # Check the case ADC client cert is provided. Whether client cert is used depends on - # GOOGLE_API_USE_CLIENT_CERTIFICATE value. - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": use_client_cert_env}): - with mock.patch.object(transport_class, '__init__') as patched: - with mock.patch('google.auth.transport.mtls.has_default_client_cert_source', return_value=True): - with mock.patch('google.auth.transport.mtls.default_client_cert_source', return_value=client_cert_source_callback): - if use_client_cert_env == "false": - expected_host = client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE) - expected_client_cert_source = None - else: - expected_host = client.DEFAULT_MTLS_ENDPOINT - expected_client_cert_source = client_cert_source_callback - - patched.return_value = None - client = client_class(transport=transport_name) - patched.assert_called_once_with( - credentials=None, - credentials_file=None, - host=expected_host, - scopes=None, - client_cert_source_for_mtls=expected_client_cert_source, - quota_project_id=None, - client_info=transports.base.DEFAULT_CLIENT_INFO, - always_use_jwt_access=True, - api_audience=None, - ) - - # Check the case client_cert_source and ADC client cert are not provided. - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": use_client_cert_env}): - with mock.patch.object(transport_class, '__init__') as patched: - with mock.patch("google.auth.transport.mtls.has_default_client_cert_source", return_value=False): - patched.return_value = None - client = client_class(transport=transport_name) - patched.assert_called_once_with( - credentials=None, - credentials_file=None, - host=client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE), - scopes=None, - client_cert_source_for_mtls=None, - quota_project_id=None, - client_info=transports.base.DEFAULT_CLIENT_INFO, - always_use_jwt_access=True, - api_audience=None, - ) - - -@pytest.mark.parametrize("client_class", [ - ConfidentialComputingClient, ConfidentialComputingAsyncClient -]) -@mock.patch.object(ConfidentialComputingClient, "DEFAULT_ENDPOINT", modify_default_endpoint(ConfidentialComputingClient)) -@mock.patch.object(ConfidentialComputingAsyncClient, "DEFAULT_ENDPOINT", modify_default_endpoint(ConfidentialComputingAsyncClient)) -def test_confidential_computing_client_get_mtls_endpoint_and_cert_source(client_class): - mock_client_cert_source = mock.Mock() - - # Test the case GOOGLE_API_USE_CLIENT_CERTIFICATE is "true". - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "true"}): - mock_api_endpoint = "foo" - options = client_options.ClientOptions(client_cert_source=mock_client_cert_source, api_endpoint=mock_api_endpoint) - api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source(options) - assert api_endpoint == mock_api_endpoint - assert cert_source == mock_client_cert_source - - # Test the case GOOGLE_API_USE_CLIENT_CERTIFICATE is "false". - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "false"}): - mock_client_cert_source = mock.Mock() - mock_api_endpoint = "foo" - options = client_options.ClientOptions(client_cert_source=mock_client_cert_source, api_endpoint=mock_api_endpoint) - api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source(options) - assert api_endpoint == mock_api_endpoint - assert cert_source is None - - # Test the case GOOGLE_API_USE_MTLS_ENDPOINT is "never". - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "never"}): - api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source() - assert api_endpoint == client_class.DEFAULT_ENDPOINT - assert cert_source is None - - # Test the case GOOGLE_API_USE_MTLS_ENDPOINT is "always". - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "always"}): - api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source() - assert api_endpoint == client_class.DEFAULT_MTLS_ENDPOINT - assert cert_source is None - - # Test the case GOOGLE_API_USE_MTLS_ENDPOINT is "auto" and default cert doesn't exist. - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "true"}): - with mock.patch('google.auth.transport.mtls.has_default_client_cert_source', return_value=False): - api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source() - assert api_endpoint == client_class.DEFAULT_ENDPOINT - assert cert_source is None - - # Test the case GOOGLE_API_USE_MTLS_ENDPOINT is "auto" and default cert exists. - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "true"}): - with mock.patch('google.auth.transport.mtls.has_default_client_cert_source', return_value=True): - with mock.patch('google.auth.transport.mtls.default_client_cert_source', return_value=mock_client_cert_source): - api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source() - assert api_endpoint == client_class.DEFAULT_MTLS_ENDPOINT - assert cert_source == mock_client_cert_source - - # Check the case api_endpoint is not provided and GOOGLE_API_USE_MTLS_ENDPOINT has - # unsupported value. - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "Unsupported"}): - with pytest.raises(MutualTLSChannelError) as excinfo: - client_class.get_mtls_endpoint_and_cert_source() - - assert str(excinfo.value) == "Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`" - - # Check the case GOOGLE_API_USE_CLIENT_CERTIFICATE has unsupported value. - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "Unsupported"}): - with pytest.raises(ValueError) as excinfo: - client_class.get_mtls_endpoint_and_cert_source() - - assert str(excinfo.value) == "Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`" - -@pytest.mark.parametrize("client_class", [ - ConfidentialComputingClient, ConfidentialComputingAsyncClient -]) -@mock.patch.object(ConfidentialComputingClient, "_DEFAULT_ENDPOINT_TEMPLATE", modify_default_endpoint_template(ConfidentialComputingClient)) -@mock.patch.object(ConfidentialComputingAsyncClient, "_DEFAULT_ENDPOINT_TEMPLATE", modify_default_endpoint_template(ConfidentialComputingAsyncClient)) -def test_confidential_computing_client_client_api_endpoint(client_class): - mock_client_cert_source = client_cert_source_callback - api_override = "foo.com" - default_universe = ConfidentialComputingClient._DEFAULT_UNIVERSE - default_endpoint = ConfidentialComputingClient._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=default_universe) - mock_universe = "bar.com" - mock_endpoint = ConfidentialComputingClient._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=mock_universe) - - # If ClientOptions.api_endpoint is set and GOOGLE_API_USE_CLIENT_CERTIFICATE="true", - # use ClientOptions.api_endpoint as the api endpoint regardless. - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "true"}): - with mock.patch("google.auth.transport.requests.AuthorizedSession.configure_mtls_channel"): - options = client_options.ClientOptions(client_cert_source=mock_client_cert_source, api_endpoint=api_override) - client = client_class(client_options=options, credentials=ga_credentials.AnonymousCredentials()) - assert client.api_endpoint == api_override - - # If ClientOptions.api_endpoint is not set and GOOGLE_API_USE_MTLS_ENDPOINT="never", - # use the _DEFAULT_ENDPOINT_TEMPLATE populated with GDU as the api endpoint. - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "never"}): - client = client_class(credentials=ga_credentials.AnonymousCredentials()) - assert client.api_endpoint == default_endpoint - - # If ClientOptions.api_endpoint is not set and GOOGLE_API_USE_MTLS_ENDPOINT="always", - # use the DEFAULT_MTLS_ENDPOINT as the api endpoint. - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "always"}): - client = client_class(credentials=ga_credentials.AnonymousCredentials()) - assert client.api_endpoint == client_class.DEFAULT_MTLS_ENDPOINT - - # If ClientOptions.api_endpoint is not set, GOOGLE_API_USE_MTLS_ENDPOINT="auto" (default), - # GOOGLE_API_USE_CLIENT_CERTIFICATE="false" (default), default cert source doesn't exist, - # and ClientOptions.universe_domain="bar.com", - # use the _DEFAULT_ENDPOINT_TEMPLATE populated with universe domain as the api endpoint. - options = client_options.ClientOptions() - universe_exists = hasattr(options, "universe_domain") - if universe_exists: - options = client_options.ClientOptions(universe_domain=mock_universe) - client = client_class(client_options=options, credentials=ga_credentials.AnonymousCredentials()) - else: - client = client_class(client_options=options, credentials=ga_credentials.AnonymousCredentials()) - assert client.api_endpoint == (mock_endpoint if universe_exists else default_endpoint) - assert client.universe_domain == (mock_universe if universe_exists else default_universe) - - # If ClientOptions does not have a universe domain attribute and GOOGLE_API_USE_MTLS_ENDPOINT="never", - # use the _DEFAULT_ENDPOINT_TEMPLATE populated with GDU as the api endpoint. - options = client_options.ClientOptions() - if hasattr(options, "universe_domain"): - delattr(options, "universe_domain") - with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "never"}): - client = client_class(client_options=options, credentials=ga_credentials.AnonymousCredentials()) - assert client.api_endpoint == default_endpoint - - -@pytest.mark.parametrize("client_class,transport_class,transport_name", [ - (ConfidentialComputingClient, transports.ConfidentialComputingGrpcTransport, "grpc"), - (ConfidentialComputingAsyncClient, transports.ConfidentialComputingGrpcAsyncIOTransport, "grpc_asyncio"), - (ConfidentialComputingClient, transports.ConfidentialComputingRestTransport, "rest"), -]) -def test_confidential_computing_client_client_options_scopes(client_class, transport_class, transport_name): - # Check the case scopes are provided. - options = client_options.ClientOptions( - scopes=["1", "2"], - ) - with mock.patch.object(transport_class, '__init__') as patched: - patched.return_value = None - client = client_class(client_options=options, transport=transport_name) - patched.assert_called_once_with( - credentials=None, - credentials_file=None, - host=client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE), - scopes=["1", "2"], - client_cert_source_for_mtls=None, - quota_project_id=None, - client_info=transports.base.DEFAULT_CLIENT_INFO, - always_use_jwt_access=True, - api_audience=None, - ) - -@pytest.mark.parametrize("client_class,transport_class,transport_name,grpc_helpers", [ - (ConfidentialComputingClient, transports.ConfidentialComputingGrpcTransport, "grpc", grpc_helpers), - (ConfidentialComputingAsyncClient, transports.ConfidentialComputingGrpcAsyncIOTransport, "grpc_asyncio", grpc_helpers_async), - (ConfidentialComputingClient, transports.ConfidentialComputingRestTransport, "rest", None), -]) -def test_confidential_computing_client_client_options_credentials_file(client_class, transport_class, transport_name, grpc_helpers): - # Check the case credentials file is provided. - options = client_options.ClientOptions( - credentials_file="credentials.json" - ) - - with mock.patch.object(transport_class, '__init__') as patched: - patched.return_value = None - client = client_class(client_options=options, transport=transport_name) - patched.assert_called_once_with( - credentials=None, - credentials_file="credentials.json", - host=client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE), - scopes=None, - client_cert_source_for_mtls=None, - quota_project_id=None, - client_info=transports.base.DEFAULT_CLIENT_INFO, - always_use_jwt_access=True, - api_audience=None, - ) - -def test_confidential_computing_client_client_options_from_dict(): - with mock.patch('google.cloud.confidentialcomputing_v1.services.confidential_computing.transports.ConfidentialComputingGrpcTransport.__init__') as grpc_transport: - grpc_transport.return_value = None - client = ConfidentialComputingClient( - client_options={'api_endpoint': 'squid.clam.whelk'} - ) - grpc_transport.assert_called_once_with( - credentials=None, - credentials_file=None, - host="squid.clam.whelk", - scopes=None, - client_cert_source_for_mtls=None, - quota_project_id=None, - client_info=transports.base.DEFAULT_CLIENT_INFO, - always_use_jwt_access=True, - api_audience=None, - ) - - -@pytest.mark.parametrize("client_class,transport_class,transport_name,grpc_helpers", [ - (ConfidentialComputingClient, transports.ConfidentialComputingGrpcTransport, "grpc", grpc_helpers), - (ConfidentialComputingAsyncClient, transports.ConfidentialComputingGrpcAsyncIOTransport, "grpc_asyncio", grpc_helpers_async), -]) -def test_confidential_computing_client_create_channel_credentials_file(client_class, transport_class, transport_name, grpc_helpers): - # Check the case credentials file is provided. - options = client_options.ClientOptions( - credentials_file="credentials.json" - ) - - with mock.patch.object(transport_class, '__init__') as patched: - patched.return_value = None - client = client_class(client_options=options, transport=transport_name) - patched.assert_called_once_with( - credentials=None, - credentials_file="credentials.json", - host=client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE), - scopes=None, - client_cert_source_for_mtls=None, - quota_project_id=None, - client_info=transports.base.DEFAULT_CLIENT_INFO, - always_use_jwt_access=True, - api_audience=None, - ) - - # test that the credentials from file are saved and used as the credentials. - with mock.patch.object( - google.auth, "load_credentials_from_file", autospec=True - ) as load_creds, mock.patch.object( - google.auth, "default", autospec=True - ) as adc, mock.patch.object( - grpc_helpers, "create_channel" - ) as create_channel: - creds = ga_credentials.AnonymousCredentials() - file_creds = ga_credentials.AnonymousCredentials() - load_creds.return_value = (file_creds, None) - adc.return_value = (creds, None) - client = client_class(client_options=options, transport=transport_name) - create_channel.assert_called_with( - "confidentialcomputing.googleapis.com:443", - credentials=file_creds, - credentials_file=None, - quota_project_id=None, - default_scopes=( - 'https://www.googleapis.com/auth/cloud-platform', -), - scopes=None, - default_host="confidentialcomputing.googleapis.com", - ssl_credentials=None, - options=[ - ("grpc.max_send_message_length", -1), - ("grpc.max_receive_message_length", -1), - ], - ) - - -@pytest.mark.parametrize("request_type", [ - service.CreateChallengeRequest, - dict, -]) -def test_create_challenge(request_type, transport: str = 'grpc'): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport=transport, - ) - - # Everything is optional in proto3 as far as the runtime is concerned, - # and we are mocking out the actual API, so just send an empty request. - request = request_type() - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.create_challenge), - '__call__') as call: - # Designate an appropriate return value for the call. - call.return_value = service.Challenge( - name='name_value', - used=True, - tpm_nonce='tpm_nonce_value', - ) - response = client.create_challenge(request) - - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - request = service.CreateChallengeRequest() - assert args[0] == request - - # Establish that the response is the type that we expect. - assert isinstance(response, service.Challenge) - assert response.name == 'name_value' - assert response.used is True - assert response.tpm_nonce == 'tpm_nonce_value' - - -def test_create_challenge_non_empty_request_with_auto_populated_field(): - # This test is a coverage failsafe to make sure that UUID4 fields are - # automatically populated, according to AIP-4235, with non-empty requests. - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport='grpc', - ) - - # Populate all string fields in the request which are not UUID4 - # since we want to check that UUID4 are populated automatically - # if they meet the requirements of AIP 4235. - request = service.CreateChallengeRequest( - parent='parent_value', - ) - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.create_challenge), - '__call__') as call: - call.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. - client.create_challenge(request=request) - call.assert_called() - _, args, _ = call.mock_calls[0] - assert args[0] == service.CreateChallengeRequest( - parent='parent_value', - ) - -def test_create_challenge_use_cached_wrapped_rpc(): - # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, - # instead of constructing them on each call - with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="grpc", - ) - - # Should wrap all calls on client creation - assert wrapper_fn.call_count > 0 - wrapper_fn.reset_mock() - - # Ensure method has been cached - assert client._transport.create_challenge in client._transport._wrapped_methods - - # Replace cached wrapped function with mock - mock_rpc = mock.Mock() - mock_rpc.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. - client._transport._wrapped_methods[client._transport.create_challenge] = mock_rpc - request = {} - client.create_challenge(request) - - # Establish that the underlying gRPC stub method was called. - assert mock_rpc.call_count == 1 - - client.create_challenge(request) - - # Establish that a new wrapper was not created for this call - assert wrapper_fn.call_count == 0 - assert mock_rpc.call_count == 2 - -@pytest.mark.asyncio -async def test_create_challenge_async_use_cached_wrapped_rpc(transport: str = "grpc_asyncio"): - # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, - # instead of constructing them on each call - with mock.patch("google.api_core.gapic_v1.method_async.wrap_method") as wrapper_fn: - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - transport=transport, - ) - - # Should wrap all calls on client creation - assert wrapper_fn.call_count > 0 - wrapper_fn.reset_mock() - - # Ensure method has been cached - assert client._client._transport.create_challenge in client._client._transport._wrapped_methods - - # Replace cached wrapped function with mock - mock_rpc = mock.AsyncMock() - mock_rpc.return_value = mock.Mock() - client._client._transport._wrapped_methods[client._client._transport.create_challenge] = mock_rpc - - request = {} - await client.create_challenge(request) - - # Establish that the underlying gRPC stub method was called. - assert mock_rpc.call_count == 1 - - await client.create_challenge(request) - - # Establish that a new wrapper was not created for this call - assert wrapper_fn.call_count == 0 - assert mock_rpc.call_count == 2 - -@pytest.mark.asyncio -async def test_create_challenge_async(transport: str = 'grpc_asyncio', request_type=service.CreateChallengeRequest): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - transport=transport, - ) - - # Everything is optional in proto3 as far as the runtime is concerned, - # and we are mocking out the actual API, so just send an empty request. - request = request_type() - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.create_challenge), - '__call__') as call: - # Designate an appropriate return value for the call. - call.return_value =grpc_helpers_async.FakeUnaryUnaryCall(service.Challenge( - name='name_value', - used=True, - tpm_nonce='tpm_nonce_value', - )) - response = await client.create_challenge(request) - - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) - _, args, _ = call.mock_calls[0] - request = service.CreateChallengeRequest() - assert args[0] == request - - # Establish that the response is the type that we expect. - assert isinstance(response, service.Challenge) - assert response.name == 'name_value' - assert response.used is True - assert response.tpm_nonce == 'tpm_nonce_value' - - -@pytest.mark.asyncio -async def test_create_challenge_async_from_dict(): - await test_create_challenge_async(request_type=dict) - -def test_create_challenge_field_headers(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - ) - - # Any value that is part of the HTTP/1.1 URI should be sent as - # a field header. Set these to a non-empty value. - request = service.CreateChallengeRequest() - - request.parent = 'parent_value' - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.create_challenge), - '__call__') as call: - call.return_value = service.Challenge() - client.create_challenge(request) - - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - assert args[0] == request - - # Establish that the field header was sent. - _, _, kw = call.mock_calls[0] - assert ( - 'x-goog-request-params', - 'parent=parent_value', - ) in kw['metadata'] - - -@pytest.mark.asyncio -async def test_create_challenge_field_headers_async(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - ) - - # Any value that is part of the HTTP/1.1 URI should be sent as - # a field header. Set these to a non-empty value. - request = service.CreateChallengeRequest() - - request.parent = 'parent_value' - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.create_challenge), - '__call__') as call: - call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.Challenge()) - await client.create_challenge(request) - - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) - _, args, _ = call.mock_calls[0] - assert args[0] == request - - # Establish that the field header was sent. - _, _, kw = call.mock_calls[0] - assert ( - 'x-goog-request-params', - 'parent=parent_value', - ) in kw['metadata'] - - -def test_create_challenge_flattened(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - ) - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.create_challenge), - '__call__') as call: - # Designate an appropriate return value for the call. - call.return_value = service.Challenge() - # Call the method with a truthy value for each flattened field, - # using the keyword arguments to the method. - client.create_challenge( - parent='parent_value', - challenge=service.Challenge(name='name_value'), - ) - - # Establish that the underlying call was made with the expected - # request object values. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - arg = args[0].parent - mock_val = 'parent_value' - assert arg == mock_val - arg = args[0].challenge - mock_val = service.Challenge(name='name_value') - assert arg == mock_val - - -def test_create_challenge_flattened_error(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - ) - - # Attempting to call a method with both a request object and flattened - # fields is an error. - with pytest.raises(ValueError): - client.create_challenge( - service.CreateChallengeRequest(), - parent='parent_value', - challenge=service.Challenge(name='name_value'), - ) - -@pytest.mark.asyncio -async def test_create_challenge_flattened_async(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - ) - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.create_challenge), - '__call__') as call: - # Designate an appropriate return value for the call. - call.return_value = service.Challenge() - - call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.Challenge()) - # Call the method with a truthy value for each flattened field, - # using the keyword arguments to the method. - response = await client.create_challenge( - parent='parent_value', - challenge=service.Challenge(name='name_value'), - ) - - # Establish that the underlying call was made with the expected - # request object values. - assert len(call.mock_calls) - _, args, _ = call.mock_calls[0] - arg = args[0].parent - mock_val = 'parent_value' - assert arg == mock_val - arg = args[0].challenge - mock_val = service.Challenge(name='name_value') - assert arg == mock_val - -@pytest.mark.asyncio -async def test_create_challenge_flattened_error_async(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - ) - - # Attempting to call a method with both a request object and flattened - # fields is an error. - with pytest.raises(ValueError): - await client.create_challenge( - service.CreateChallengeRequest(), - parent='parent_value', - challenge=service.Challenge(name='name_value'), - ) - - -@pytest.mark.parametrize("request_type", [ - service.VerifyAttestationRequest, - dict, -]) -def test_verify_attestation(request_type, transport: str = 'grpc'): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport=transport, - ) - - # Everything is optional in proto3 as far as the runtime is concerned, - # and we are mocking out the actual API, so just send an empty request. - request = request_type() - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.verify_attestation), - '__call__') as call: - # Designate an appropriate return value for the call. - call.return_value = service.VerifyAttestationResponse( - oidc_claims_token='oidc_claims_token_value', - ) - response = client.verify_attestation(request) - - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - request = service.VerifyAttestationRequest() - assert args[0] == request - - # Establish that the response is the type that we expect. - assert isinstance(response, service.VerifyAttestationResponse) - assert response.oidc_claims_token == 'oidc_claims_token_value' - - -def test_verify_attestation_non_empty_request_with_auto_populated_field(): - # This test is a coverage failsafe to make sure that UUID4 fields are - # automatically populated, according to AIP-4235, with non-empty requests. - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport='grpc', - ) - - # Populate all string fields in the request which are not UUID4 - # since we want to check that UUID4 are populated automatically - # if they meet the requirements of AIP 4235. - request = service.VerifyAttestationRequest( - challenge='challenge_value', - attester='attester_value', - ) - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.verify_attestation), - '__call__') as call: - call.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. - client.verify_attestation(request=request) - call.assert_called() - _, args, _ = call.mock_calls[0] - assert args[0] == service.VerifyAttestationRequest( - challenge='challenge_value', - attester='attester_value', - ) - -def test_verify_attestation_use_cached_wrapped_rpc(): - # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, - # instead of constructing them on each call - with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="grpc", - ) - - # Should wrap all calls on client creation - assert wrapper_fn.call_count > 0 - wrapper_fn.reset_mock() - - # Ensure method has been cached - assert client._transport.verify_attestation in client._transport._wrapped_methods - - # Replace cached wrapped function with mock - mock_rpc = mock.Mock() - mock_rpc.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. - client._transport._wrapped_methods[client._transport.verify_attestation] = mock_rpc - request = {} - client.verify_attestation(request) - - # Establish that the underlying gRPC stub method was called. - assert mock_rpc.call_count == 1 - - client.verify_attestation(request) - - # Establish that a new wrapper was not created for this call - assert wrapper_fn.call_count == 0 - assert mock_rpc.call_count == 2 - -@pytest.mark.asyncio -async def test_verify_attestation_async_use_cached_wrapped_rpc(transport: str = "grpc_asyncio"): - # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, - # instead of constructing them on each call - with mock.patch("google.api_core.gapic_v1.method_async.wrap_method") as wrapper_fn: - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - transport=transport, - ) - - # Should wrap all calls on client creation - assert wrapper_fn.call_count > 0 - wrapper_fn.reset_mock() - - # Ensure method has been cached - assert client._client._transport.verify_attestation in client._client._transport._wrapped_methods - - # Replace cached wrapped function with mock - mock_rpc = mock.AsyncMock() - mock_rpc.return_value = mock.Mock() - client._client._transport._wrapped_methods[client._client._transport.verify_attestation] = mock_rpc - - request = {} - await client.verify_attestation(request) - - # Establish that the underlying gRPC stub method was called. - assert mock_rpc.call_count == 1 - - await client.verify_attestation(request) - - # Establish that a new wrapper was not created for this call - assert wrapper_fn.call_count == 0 - assert mock_rpc.call_count == 2 - -@pytest.mark.asyncio -async def test_verify_attestation_async(transport: str = 'grpc_asyncio', request_type=service.VerifyAttestationRequest): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - transport=transport, - ) - - # Everything is optional in proto3 as far as the runtime is concerned, - # and we are mocking out the actual API, so just send an empty request. - request = request_type() - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.verify_attestation), - '__call__') as call: - # Designate an appropriate return value for the call. - call.return_value =grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyAttestationResponse( - oidc_claims_token='oidc_claims_token_value', - )) - response = await client.verify_attestation(request) - - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) - _, args, _ = call.mock_calls[0] - request = service.VerifyAttestationRequest() - assert args[0] == request - - # Establish that the response is the type that we expect. - assert isinstance(response, service.VerifyAttestationResponse) - assert response.oidc_claims_token == 'oidc_claims_token_value' - - -@pytest.mark.asyncio -async def test_verify_attestation_async_from_dict(): - await test_verify_attestation_async(request_type=dict) - -def test_verify_attestation_field_headers(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - ) - - # Any value that is part of the HTTP/1.1 URI should be sent as - # a field header. Set these to a non-empty value. - request = service.VerifyAttestationRequest() - - request.challenge = 'challenge_value' - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.verify_attestation), - '__call__') as call: - call.return_value = service.VerifyAttestationResponse() - client.verify_attestation(request) - - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - assert args[0] == request - - # Establish that the field header was sent. - _, _, kw = call.mock_calls[0] - assert ( - 'x-goog-request-params', - 'challenge=challenge_value', - ) in kw['metadata'] - - -@pytest.mark.asyncio -async def test_verify_attestation_field_headers_async(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - ) - - # Any value that is part of the HTTP/1.1 URI should be sent as - # a field header. Set these to a non-empty value. - request = service.VerifyAttestationRequest() - - request.challenge = 'challenge_value' - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.verify_attestation), - '__call__') as call: - call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyAttestationResponse()) - await client.verify_attestation(request) - - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) - _, args, _ = call.mock_calls[0] - assert args[0] == request - - # Establish that the field header was sent. - _, _, kw = call.mock_calls[0] - assert ( - 'x-goog-request-params', - 'challenge=challenge_value', - ) in kw['metadata'] - - -@pytest.mark.parametrize("request_type", [ - service.VerifyConfidentialSpaceRequest, - dict, -]) -def test_verify_confidential_space(request_type, transport: str = 'grpc'): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport=transport, - ) - - # Everything is optional in proto3 as far as the runtime is concerned, - # and we are mocking out the actual API, so just send an empty request. - request = request_type() - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.verify_confidential_space), - '__call__') as call: - # Designate an appropriate return value for the call. - call.return_value = service.VerifyConfidentialSpaceResponse( - attestation_token='attestation_token_value', - ) - response = client.verify_confidential_space(request) - - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - request = service.VerifyConfidentialSpaceRequest() - assert args[0] == request - - # Establish that the response is the type that we expect. - assert isinstance(response, service.VerifyConfidentialSpaceResponse) - assert response.attestation_token == 'attestation_token_value' - - -def test_verify_confidential_space_non_empty_request_with_auto_populated_field(): - # This test is a coverage failsafe to make sure that UUID4 fields are - # automatically populated, according to AIP-4235, with non-empty requests. - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport='grpc', - ) - - # Populate all string fields in the request which are not UUID4 - # since we want to check that UUID4 are populated automatically - # if they meet the requirements of AIP 4235. - request = service.VerifyConfidentialSpaceRequest( - challenge='challenge_value', - ) - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.verify_confidential_space), - '__call__') as call: - call.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. - client.verify_confidential_space(request=request) - call.assert_called() - _, args, _ = call.mock_calls[0] - assert args[0] == service.VerifyConfidentialSpaceRequest( - challenge='challenge_value', - ) - -def test_verify_confidential_space_use_cached_wrapped_rpc(): - # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, - # instead of constructing them on each call - with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="grpc", - ) - - # Should wrap all calls on client creation - assert wrapper_fn.call_count > 0 - wrapper_fn.reset_mock() - - # Ensure method has been cached - assert client._transport.verify_confidential_space in client._transport._wrapped_methods - - # Replace cached wrapped function with mock - mock_rpc = mock.Mock() - mock_rpc.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. - client._transport._wrapped_methods[client._transport.verify_confidential_space] = mock_rpc - request = {} - client.verify_confidential_space(request) - - # Establish that the underlying gRPC stub method was called. - assert mock_rpc.call_count == 1 - - client.verify_confidential_space(request) - - # Establish that a new wrapper was not created for this call - assert wrapper_fn.call_count == 0 - assert mock_rpc.call_count == 2 - -@pytest.mark.asyncio -async def test_verify_confidential_space_async_use_cached_wrapped_rpc(transport: str = "grpc_asyncio"): - # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, - # instead of constructing them on each call - with mock.patch("google.api_core.gapic_v1.method_async.wrap_method") as wrapper_fn: - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - transport=transport, - ) - - # Should wrap all calls on client creation - assert wrapper_fn.call_count > 0 - wrapper_fn.reset_mock() - - # Ensure method has been cached - assert client._client._transport.verify_confidential_space in client._client._transport._wrapped_methods - - # Replace cached wrapped function with mock - mock_rpc = mock.AsyncMock() - mock_rpc.return_value = mock.Mock() - client._client._transport._wrapped_methods[client._client._transport.verify_confidential_space] = mock_rpc - - request = {} - await client.verify_confidential_space(request) - - # Establish that the underlying gRPC stub method was called. - assert mock_rpc.call_count == 1 - - await client.verify_confidential_space(request) - - # Establish that a new wrapper was not created for this call - assert wrapper_fn.call_count == 0 - assert mock_rpc.call_count == 2 - -@pytest.mark.asyncio -async def test_verify_confidential_space_async(transport: str = 'grpc_asyncio', request_type=service.VerifyConfidentialSpaceRequest): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - transport=transport, - ) - - # Everything is optional in proto3 as far as the runtime is concerned, - # and we are mocking out the actual API, so just send an empty request. - request = request_type() - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.verify_confidential_space), - '__call__') as call: - # Designate an appropriate return value for the call. - call.return_value =grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyConfidentialSpaceResponse( - attestation_token='attestation_token_value', - )) - response = await client.verify_confidential_space(request) - - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) - _, args, _ = call.mock_calls[0] - request = service.VerifyConfidentialSpaceRequest() - assert args[0] == request - - # Establish that the response is the type that we expect. - assert isinstance(response, service.VerifyConfidentialSpaceResponse) - assert response.attestation_token == 'attestation_token_value' - - -@pytest.mark.asyncio -async def test_verify_confidential_space_async_from_dict(): - await test_verify_confidential_space_async(request_type=dict) - -def test_verify_confidential_space_field_headers(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - ) - - # Any value that is part of the HTTP/1.1 URI should be sent as - # a field header. Set these to a non-empty value. - request = service.VerifyConfidentialSpaceRequest() - - request.challenge = 'challenge_value' - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.verify_confidential_space), - '__call__') as call: - call.return_value = service.VerifyConfidentialSpaceResponse() - client.verify_confidential_space(request) - - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - assert args[0] == request - - # Establish that the field header was sent. - _, _, kw = call.mock_calls[0] - assert ( - 'x-goog-request-params', - 'challenge=challenge_value', - ) in kw['metadata'] - - -@pytest.mark.asyncio -async def test_verify_confidential_space_field_headers_async(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - ) - - # Any value that is part of the HTTP/1.1 URI should be sent as - # a field header. Set these to a non-empty value. - request = service.VerifyConfidentialSpaceRequest() - - request.challenge = 'challenge_value' - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.verify_confidential_space), - '__call__') as call: - call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyConfidentialSpaceResponse()) - await client.verify_confidential_space(request) - - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) - _, args, _ = call.mock_calls[0] - assert args[0] == request - - # Establish that the field header was sent. - _, _, kw = call.mock_calls[0] - assert ( - 'x-goog-request-params', - 'challenge=challenge_value', - ) in kw['metadata'] - - -@pytest.mark.parametrize("request_type", [ - service.VerifyConfidentialGkeRequest, - dict, -]) -def test_verify_confidential_gke(request_type, transport: str = 'grpc'): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport=transport, - ) - - # Everything is optional in proto3 as far as the runtime is concerned, - # and we are mocking out the actual API, so just send an empty request. - request = request_type() - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.verify_confidential_gke), - '__call__') as call: - # Designate an appropriate return value for the call. - call.return_value = service.VerifyConfidentialGkeResponse( - attestation_token='attestation_token_value', - ) - response = client.verify_confidential_gke(request) - - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - request = service.VerifyConfidentialGkeRequest() - assert args[0] == request - - # Establish that the response is the type that we expect. - assert isinstance(response, service.VerifyConfidentialGkeResponse) - assert response.attestation_token == 'attestation_token_value' - - -def test_verify_confidential_gke_non_empty_request_with_auto_populated_field(): - # This test is a coverage failsafe to make sure that UUID4 fields are - # automatically populated, according to AIP-4235, with non-empty requests. - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport='grpc', - ) - - # Populate all string fields in the request which are not UUID4 - # since we want to check that UUID4 are populated automatically - # if they meet the requirements of AIP 4235. - request = service.VerifyConfidentialGkeRequest( - challenge='challenge_value', - ) - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.verify_confidential_gke), - '__call__') as call: - call.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. - client.verify_confidential_gke(request=request) - call.assert_called() - _, args, _ = call.mock_calls[0] - assert args[0] == service.VerifyConfidentialGkeRequest( - challenge='challenge_value', - ) - -def test_verify_confidential_gke_use_cached_wrapped_rpc(): - # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, - # instead of constructing them on each call - with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="grpc", - ) - - # Should wrap all calls on client creation - assert wrapper_fn.call_count > 0 - wrapper_fn.reset_mock() - - # Ensure method has been cached - assert client._transport.verify_confidential_gke in client._transport._wrapped_methods - - # Replace cached wrapped function with mock - mock_rpc = mock.Mock() - mock_rpc.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. - client._transport._wrapped_methods[client._transport.verify_confidential_gke] = mock_rpc - request = {} - client.verify_confidential_gke(request) - - # Establish that the underlying gRPC stub method was called. - assert mock_rpc.call_count == 1 - - client.verify_confidential_gke(request) - - # Establish that a new wrapper was not created for this call - assert wrapper_fn.call_count == 0 - assert mock_rpc.call_count == 2 - -@pytest.mark.asyncio -async def test_verify_confidential_gke_async_use_cached_wrapped_rpc(transport: str = "grpc_asyncio"): - # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, - # instead of constructing them on each call - with mock.patch("google.api_core.gapic_v1.method_async.wrap_method") as wrapper_fn: - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - transport=transport, - ) - - # Should wrap all calls on client creation - assert wrapper_fn.call_count > 0 - wrapper_fn.reset_mock() - - # Ensure method has been cached - assert client._client._transport.verify_confidential_gke in client._client._transport._wrapped_methods - - # Replace cached wrapped function with mock - mock_rpc = mock.AsyncMock() - mock_rpc.return_value = mock.Mock() - client._client._transport._wrapped_methods[client._client._transport.verify_confidential_gke] = mock_rpc - - request = {} - await client.verify_confidential_gke(request) - - # Establish that the underlying gRPC stub method was called. - assert mock_rpc.call_count == 1 - - await client.verify_confidential_gke(request) - - # Establish that a new wrapper was not created for this call - assert wrapper_fn.call_count == 0 - assert mock_rpc.call_count == 2 - -@pytest.mark.asyncio -async def test_verify_confidential_gke_async(transport: str = 'grpc_asyncio', request_type=service.VerifyConfidentialGkeRequest): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - transport=transport, - ) - - # Everything is optional in proto3 as far as the runtime is concerned, - # and we are mocking out the actual API, so just send an empty request. - request = request_type() - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.verify_confidential_gke), - '__call__') as call: - # Designate an appropriate return value for the call. - call.return_value =grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyConfidentialGkeResponse( - attestation_token='attestation_token_value', - )) - response = await client.verify_confidential_gke(request) - - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) - _, args, _ = call.mock_calls[0] - request = service.VerifyConfidentialGkeRequest() - assert args[0] == request - - # Establish that the response is the type that we expect. - assert isinstance(response, service.VerifyConfidentialGkeResponse) - assert response.attestation_token == 'attestation_token_value' - - -@pytest.mark.asyncio -async def test_verify_confidential_gke_async_from_dict(): - await test_verify_confidential_gke_async(request_type=dict) - -def test_verify_confidential_gke_field_headers(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - ) - - # Any value that is part of the HTTP/1.1 URI should be sent as - # a field header. Set these to a non-empty value. - request = service.VerifyConfidentialGkeRequest() - - request.challenge = 'challenge_value' - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.verify_confidential_gke), - '__call__') as call: - call.return_value = service.VerifyConfidentialGkeResponse() - client.verify_confidential_gke(request) - - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - assert args[0] == request - - # Establish that the field header was sent. - _, _, kw = call.mock_calls[0] - assert ( - 'x-goog-request-params', - 'challenge=challenge_value', - ) in kw['metadata'] - - -@pytest.mark.asyncio -async def test_verify_confidential_gke_field_headers_async(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - ) - - # Any value that is part of the HTTP/1.1 URI should be sent as - # a field header. Set these to a non-empty value. - request = service.VerifyConfidentialGkeRequest() - - request.challenge = 'challenge_value' - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object( - type(client.transport.verify_confidential_gke), - '__call__') as call: - call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyConfidentialGkeResponse()) - await client.verify_confidential_gke(request) - - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) - _, args, _ = call.mock_calls[0] - assert args[0] == request - - # Establish that the field header was sent. - _, _, kw = call.mock_calls[0] - assert ( - 'x-goog-request-params', - 'challenge=challenge_value', - ) in kw['metadata'] - - -def test_create_challenge_rest_use_cached_wrapped_rpc(): - # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, - # instead of constructing them on each call - with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest", - ) - - # Should wrap all calls on client creation - assert wrapper_fn.call_count > 0 - wrapper_fn.reset_mock() - - # Ensure method has been cached - assert client._transport.create_challenge in client._transport._wrapped_methods - - # Replace cached wrapped function with mock - mock_rpc = mock.Mock() - mock_rpc.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. - client._transport._wrapped_methods[client._transport.create_challenge] = mock_rpc - - request = {} - client.create_challenge(request) - - # Establish that the underlying gRPC stub method was called. - assert mock_rpc.call_count == 1 - - client.create_challenge(request) - - # Establish that a new wrapper was not created for this call - assert wrapper_fn.call_count == 0 - assert mock_rpc.call_count == 2 - - -def test_create_challenge_rest_required_fields(request_type=service.CreateChallengeRequest): - transport_class = transports.ConfidentialComputingRestTransport - - request_init = {} - request_init["parent"] = "" - request = request_type(**request_init) - pb_request = request_type.pb(request) - jsonified_request = json.loads(json_format.MessageToJson( - pb_request, - use_integers_for_enums=False - )) - - # verify fields with default values are dropped - - unset_fields = transport_class(credentials=ga_credentials.AnonymousCredentials()).create_challenge._get_unset_required_fields(jsonified_request) - jsonified_request.update(unset_fields) - - # verify required fields with default values are now present - - jsonified_request["parent"] = 'parent_value' - - unset_fields = transport_class(credentials=ga_credentials.AnonymousCredentials()).create_challenge._get_unset_required_fields(jsonified_request) - jsonified_request.update(unset_fields) - - # verify required fields with non-default values are left alone - assert "parent" in jsonified_request - assert jsonified_request["parent"] == 'parent_value' - - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport='rest', - ) - request = request_type(**request_init) - - # Designate an appropriate value for the returned response. - return_value = service.Challenge() - # Mock the http request call within the method and fake a response. - with mock.patch.object(Session, 'request') as req: - # We need to mock transcode() because providing default values - # for required fields will fail the real version if the http_options - # expect actual values for those fields. - with mock.patch.object(path_template, 'transcode') as transcode: - # A uri without fields and an empty body will force all the - # request fields to show up in the query_params. - pb_request = request_type.pb(request) - transcode_result = { - 'uri': 'v1/sample_method', - 'method': "post", - 'query_params': pb_request, - } - transcode_result['body'] = pb_request - transcode.return_value = transcode_result - - response_value = Response() - response_value.status_code = 200 - - # Convert return value to protobuf type - return_value = service.Challenge.pb(return_value) - json_return_value = json_format.MessageToJson(return_value) - - response_value._content = json_return_value.encode('UTF-8') - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - - response = client.create_challenge(request) - - expected_params = [ - ('$alt', 'json;enum-encoding=int') - ] - actual_params = req.call_args.kwargs['params'] - assert expected_params == actual_params - - -def test_create_challenge_rest_unset_required_fields(): - transport = transports.ConfidentialComputingRestTransport(credentials=ga_credentials.AnonymousCredentials) - - unset_fields = transport.create_challenge._get_unset_required_fields({}) - assert set(unset_fields) == (set(()) & set(("parent", "challenge", ))) - - -def test_create_challenge_rest_flattened(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest", - ) - - # Mock the http request call within the method and fake a response. - with mock.patch.object(type(client.transport._session), 'request') as req: - # Designate an appropriate value for the returned response. - return_value = service.Challenge() - - # get arguments that satisfy an http rule for this method - sample_request = {'parent': 'projects/sample1/locations/sample2'} - - # get truthy value for each flattened field - mock_args = dict( - parent='parent_value', - challenge=service.Challenge(name='name_value'), - ) - mock_args.update(sample_request) - - # Wrap the value into a proper Response obj - response_value = Response() - response_value.status_code = 200 - # Convert return value to protobuf type - return_value = service.Challenge.pb(return_value) - json_return_value = json_format.MessageToJson(return_value) - response_value._content = json_return_value.encode('UTF-8') - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - - client.create_challenge(**mock_args) - - # Establish that the underlying call was made with the expected - # request object values. - assert len(req.mock_calls) == 1 - _, args, _ = req.mock_calls[0] - assert path_template.validate("%s/v1/{parent=projects/*/locations/*}/challenges" % client.transport._host, args[1]) - - -def test_create_challenge_rest_flattened_error(transport: str = 'rest'): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport=transport, - ) - - # Attempting to call a method with both a request object and flattened - # fields is an error. - with pytest.raises(ValueError): - client.create_challenge( - service.CreateChallengeRequest(), - parent='parent_value', - challenge=service.Challenge(name='name_value'), - ) - - -def test_verify_attestation_rest_use_cached_wrapped_rpc(): - # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, - # instead of constructing them on each call - with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest", - ) - - # Should wrap all calls on client creation - assert wrapper_fn.call_count > 0 - wrapper_fn.reset_mock() - - # Ensure method has been cached - assert client._transport.verify_attestation in client._transport._wrapped_methods - - # Replace cached wrapped function with mock - mock_rpc = mock.Mock() - mock_rpc.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. - client._transport._wrapped_methods[client._transport.verify_attestation] = mock_rpc - - request = {} - client.verify_attestation(request) - - # Establish that the underlying gRPC stub method was called. - assert mock_rpc.call_count == 1 - - client.verify_attestation(request) - - # Establish that a new wrapper was not created for this call - assert wrapper_fn.call_count == 0 - assert mock_rpc.call_count == 2 - - -def test_verify_attestation_rest_required_fields(request_type=service.VerifyAttestationRequest): - transport_class = transports.ConfidentialComputingRestTransport - - request_init = {} - request_init["challenge"] = "" - request = request_type(**request_init) - pb_request = request_type.pb(request) - jsonified_request = json.loads(json_format.MessageToJson( - pb_request, - use_integers_for_enums=False - )) - - # verify fields with default values are dropped - - unset_fields = transport_class(credentials=ga_credentials.AnonymousCredentials()).verify_attestation._get_unset_required_fields(jsonified_request) - jsonified_request.update(unset_fields) - - # verify required fields with default values are now present - - jsonified_request["challenge"] = 'challenge_value' - - unset_fields = transport_class(credentials=ga_credentials.AnonymousCredentials()).verify_attestation._get_unset_required_fields(jsonified_request) - jsonified_request.update(unset_fields) - - # verify required fields with non-default values are left alone - assert "challenge" in jsonified_request - assert jsonified_request["challenge"] == 'challenge_value' - - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport='rest', - ) - request = request_type(**request_init) - - # Designate an appropriate value for the returned response. - return_value = service.VerifyAttestationResponse() - # Mock the http request call within the method and fake a response. - with mock.patch.object(Session, 'request') as req: - # We need to mock transcode() because providing default values - # for required fields will fail the real version if the http_options - # expect actual values for those fields. - with mock.patch.object(path_template, 'transcode') as transcode: - # A uri without fields and an empty body will force all the - # request fields to show up in the query_params. - pb_request = request_type.pb(request) - transcode_result = { - 'uri': 'v1/sample_method', - 'method': "post", - 'query_params': pb_request, - } - transcode_result['body'] = pb_request - transcode.return_value = transcode_result - - response_value = Response() - response_value.status_code = 200 - - # Convert return value to protobuf type - return_value = service.VerifyAttestationResponse.pb(return_value) - json_return_value = json_format.MessageToJson(return_value) - - response_value._content = json_return_value.encode('UTF-8') - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - - response = client.verify_attestation(request) - - expected_params = [ - ('$alt', 'json;enum-encoding=int') - ] - actual_params = req.call_args.kwargs['params'] - assert expected_params == actual_params - - -def test_verify_attestation_rest_unset_required_fields(): - transport = transports.ConfidentialComputingRestTransport(credentials=ga_credentials.AnonymousCredentials) - - unset_fields = transport.verify_attestation._get_unset_required_fields({}) - assert set(unset_fields) == (set(()) & set(("challenge", "tpmAttestation", ))) - - -def test_verify_confidential_space_rest_use_cached_wrapped_rpc(): - # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, - # instead of constructing them on each call - with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest", - ) - - # Should wrap all calls on client creation - assert wrapper_fn.call_count > 0 - wrapper_fn.reset_mock() - - # Ensure method has been cached - assert client._transport.verify_confidential_space in client._transport._wrapped_methods - - # Replace cached wrapped function with mock - mock_rpc = mock.Mock() - mock_rpc.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. - client._transport._wrapped_methods[client._transport.verify_confidential_space] = mock_rpc - - request = {} - client.verify_confidential_space(request) - - # Establish that the underlying gRPC stub method was called. - assert mock_rpc.call_count == 1 - - client.verify_confidential_space(request) - - # Establish that a new wrapper was not created for this call - assert wrapper_fn.call_count == 0 - assert mock_rpc.call_count == 2 - - -def test_verify_confidential_space_rest_required_fields(request_type=service.VerifyConfidentialSpaceRequest): - transport_class = transports.ConfidentialComputingRestTransport - - request_init = {} - request_init["challenge"] = "" - request = request_type(**request_init) - pb_request = request_type.pb(request) - jsonified_request = json.loads(json_format.MessageToJson( - pb_request, - use_integers_for_enums=False - )) - - # verify fields with default values are dropped - - unset_fields = transport_class(credentials=ga_credentials.AnonymousCredentials()).verify_confidential_space._get_unset_required_fields(jsonified_request) - jsonified_request.update(unset_fields) - - # verify required fields with default values are now present - - jsonified_request["challenge"] = 'challenge_value' - - unset_fields = transport_class(credentials=ga_credentials.AnonymousCredentials()).verify_confidential_space._get_unset_required_fields(jsonified_request) - jsonified_request.update(unset_fields) - - # verify required fields with non-default values are left alone - assert "challenge" in jsonified_request - assert jsonified_request["challenge"] == 'challenge_value' - - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport='rest', - ) - request = request_type(**request_init) - - # Designate an appropriate value for the returned response. - return_value = service.VerifyConfidentialSpaceResponse() - # Mock the http request call within the method and fake a response. - with mock.patch.object(Session, 'request') as req: - # We need to mock transcode() because providing default values - # for required fields will fail the real version if the http_options - # expect actual values for those fields. - with mock.patch.object(path_template, 'transcode') as transcode: - # A uri without fields and an empty body will force all the - # request fields to show up in the query_params. - pb_request = request_type.pb(request) - transcode_result = { - 'uri': 'v1/sample_method', - 'method': "post", - 'query_params': pb_request, - } - transcode_result['body'] = pb_request - transcode.return_value = transcode_result - - response_value = Response() - response_value.status_code = 200 - - # Convert return value to protobuf type - return_value = service.VerifyConfidentialSpaceResponse.pb(return_value) - json_return_value = json_format.MessageToJson(return_value) - - response_value._content = json_return_value.encode('UTF-8') - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - - response = client.verify_confidential_space(request) - - expected_params = [ - ('$alt', 'json;enum-encoding=int') - ] - actual_params = req.call_args.kwargs['params'] - assert expected_params == actual_params - - -def test_verify_confidential_space_rest_unset_required_fields(): - transport = transports.ConfidentialComputingRestTransport(credentials=ga_credentials.AnonymousCredentials) - - unset_fields = transport.verify_confidential_space._get_unset_required_fields({}) - assert set(unset_fields) == (set(()) & set(("challenge", ))) - - -def test_verify_confidential_gke_rest_use_cached_wrapped_rpc(): - # Clients should use _prep_wrapped_messages to create cached wrapped rpcs, - # instead of constructing them on each call - with mock.patch("google.api_core.gapic_v1.method.wrap_method") as wrapper_fn: - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest", - ) - - # Should wrap all calls on client creation - assert wrapper_fn.call_count > 0 - wrapper_fn.reset_mock() - - # Ensure method has been cached - assert client._transport.verify_confidential_gke in client._transport._wrapped_methods - - # Replace cached wrapped function with mock - mock_rpc = mock.Mock() - mock_rpc.return_value.name = "foo" # operation_request.operation in compute client(s) expect a string. - client._transport._wrapped_methods[client._transport.verify_confidential_gke] = mock_rpc - - request = {} - client.verify_confidential_gke(request) - - # Establish that the underlying gRPC stub method was called. - assert mock_rpc.call_count == 1 - - client.verify_confidential_gke(request) - - # Establish that a new wrapper was not created for this call - assert wrapper_fn.call_count == 0 - assert mock_rpc.call_count == 2 - - -def test_verify_confidential_gke_rest_required_fields(request_type=service.VerifyConfidentialGkeRequest): - transport_class = transports.ConfidentialComputingRestTransport - - request_init = {} - request_init["challenge"] = "" - request = request_type(**request_init) - pb_request = request_type.pb(request) - jsonified_request = json.loads(json_format.MessageToJson( - pb_request, - use_integers_for_enums=False - )) - - # verify fields with default values are dropped - - unset_fields = transport_class(credentials=ga_credentials.AnonymousCredentials()).verify_confidential_gke._get_unset_required_fields(jsonified_request) - jsonified_request.update(unset_fields) - - # verify required fields with default values are now present - - jsonified_request["challenge"] = 'challenge_value' - - unset_fields = transport_class(credentials=ga_credentials.AnonymousCredentials()).verify_confidential_gke._get_unset_required_fields(jsonified_request) - jsonified_request.update(unset_fields) - - # verify required fields with non-default values are left alone - assert "challenge" in jsonified_request - assert jsonified_request["challenge"] == 'challenge_value' - - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport='rest', - ) - request = request_type(**request_init) - - # Designate an appropriate value for the returned response. - return_value = service.VerifyConfidentialGkeResponse() - # Mock the http request call within the method and fake a response. - with mock.patch.object(Session, 'request') as req: - # We need to mock transcode() because providing default values - # for required fields will fail the real version if the http_options - # expect actual values for those fields. - with mock.patch.object(path_template, 'transcode') as transcode: - # A uri without fields and an empty body will force all the - # request fields to show up in the query_params. - pb_request = request_type.pb(request) - transcode_result = { - 'uri': 'v1/sample_method', - 'method': "post", - 'query_params': pb_request, - } - transcode_result['body'] = pb_request - transcode.return_value = transcode_result - - response_value = Response() - response_value.status_code = 200 - - # Convert return value to protobuf type - return_value = service.VerifyConfidentialGkeResponse.pb(return_value) - json_return_value = json_format.MessageToJson(return_value) - - response_value._content = json_return_value.encode('UTF-8') - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - - response = client.verify_confidential_gke(request) - - expected_params = [ - ('$alt', 'json;enum-encoding=int') - ] - actual_params = req.call_args.kwargs['params'] - assert expected_params == actual_params - - -def test_verify_confidential_gke_rest_unset_required_fields(): - transport = transports.ConfidentialComputingRestTransport(credentials=ga_credentials.AnonymousCredentials) - - unset_fields = transport.verify_confidential_gke._get_unset_required_fields({}) - assert set(unset_fields) == (set(()) & set(("challenge", ))) - - -def test_credentials_transport_error(): - # It is an error to provide credentials and a transport instance. - transport = transports.ConfidentialComputingGrpcTransport( - credentials=ga_credentials.AnonymousCredentials(), - ) - with pytest.raises(ValueError): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport=transport, - ) - - # It is an error to provide a credentials file and a transport instance. - transport = transports.ConfidentialComputingGrpcTransport( - credentials=ga_credentials.AnonymousCredentials(), - ) - with pytest.raises(ValueError): - client = ConfidentialComputingClient( - client_options={"credentials_file": "credentials.json"}, - transport=transport, - ) - - # It is an error to provide an api_key and a transport instance. - transport = transports.ConfidentialComputingGrpcTransport( - credentials=ga_credentials.AnonymousCredentials(), - ) - options = client_options.ClientOptions() - options.api_key = "api_key" - with pytest.raises(ValueError): - client = ConfidentialComputingClient( - client_options=options, - transport=transport, - ) - - # It is an error to provide an api_key and a credential. - options = client_options.ClientOptions() - options.api_key = "api_key" - with pytest.raises(ValueError): - client = ConfidentialComputingClient( - client_options=options, - credentials=ga_credentials.AnonymousCredentials() - ) - - # It is an error to provide scopes and a transport instance. - transport = transports.ConfidentialComputingGrpcTransport( - credentials=ga_credentials.AnonymousCredentials(), - ) - with pytest.raises(ValueError): - client = ConfidentialComputingClient( - client_options={"scopes": ["1", "2"]}, - transport=transport, - ) - - -def test_transport_instance(): - # A client may be instantiated with a custom transport instance. - transport = transports.ConfidentialComputingGrpcTransport( - credentials=ga_credentials.AnonymousCredentials(), - ) - client = ConfidentialComputingClient(transport=transport) - assert client.transport is transport - -def test_transport_get_channel(): - # A client may be instantiated with a custom transport instance. - transport = transports.ConfidentialComputingGrpcTransport( - credentials=ga_credentials.AnonymousCredentials(), - ) - channel = transport.grpc_channel - assert channel - - transport = transports.ConfidentialComputingGrpcAsyncIOTransport( - credentials=ga_credentials.AnonymousCredentials(), - ) - channel = transport.grpc_channel - assert channel - -@pytest.mark.parametrize("transport_class", [ - transports.ConfidentialComputingGrpcTransport, - transports.ConfidentialComputingGrpcAsyncIOTransport, - transports.ConfidentialComputingRestTransport, -]) -def test_transport_adc(transport_class): - # Test default credentials are used if not provided. - with mock.patch.object(google.auth, 'default') as adc: - adc.return_value = (ga_credentials.AnonymousCredentials(), None) - transport_class() - adc.assert_called_once() - -def test_transport_kind_grpc(): - transport = ConfidentialComputingClient.get_transport_class("grpc")( - credentials=ga_credentials.AnonymousCredentials() - ) - assert transport.kind == "grpc" - - -def test_initialize_client_w_grpc(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="grpc" - ) - assert client is not None - - -# This test is a coverage failsafe to make sure that totally empty calls, -# i.e. request == None and no flattened fields passed, work. -def test_create_challenge_empty_call_grpc(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="grpc", - ) - - # Mock the actual call, and fake the request. - with mock.patch.object( - type(client.transport.create_challenge), - '__call__') as call: - call.return_value = service.Challenge() - client.create_challenge(request=None) - - # Establish that the underlying stub method was called. - call.assert_called() - _, args, _ = call.mock_calls[0] - request_msg = service.CreateChallengeRequest() - - assert args[0] == request_msg - - -# This test is a coverage failsafe to make sure that totally empty calls, -# i.e. request == None and no flattened fields passed, work. -def test_verify_attestation_empty_call_grpc(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="grpc", - ) - - # Mock the actual call, and fake the request. - with mock.patch.object( - type(client.transport.verify_attestation), - '__call__') as call: - call.return_value = service.VerifyAttestationResponse() - client.verify_attestation(request=None) - - # Establish that the underlying stub method was called. - call.assert_called() - _, args, _ = call.mock_calls[0] - request_msg = service.VerifyAttestationRequest() - - assert args[0] == request_msg - - -# This test is a coverage failsafe to make sure that totally empty calls, -# i.e. request == None and no flattened fields passed, work. -def test_verify_confidential_space_empty_call_grpc(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="grpc", - ) - - # Mock the actual call, and fake the request. - with mock.patch.object( - type(client.transport.verify_confidential_space), - '__call__') as call: - call.return_value = service.VerifyConfidentialSpaceResponse() - client.verify_confidential_space(request=None) - - # Establish that the underlying stub method was called. - call.assert_called() - _, args, _ = call.mock_calls[0] - request_msg = service.VerifyConfidentialSpaceRequest() - - assert args[0] == request_msg - - -# This test is a coverage failsafe to make sure that totally empty calls, -# i.e. request == None and no flattened fields passed, work. -def test_verify_confidential_gke_empty_call_grpc(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="grpc", - ) - - # Mock the actual call, and fake the request. - with mock.patch.object( - type(client.transport.verify_confidential_gke), - '__call__') as call: - call.return_value = service.VerifyConfidentialGkeResponse() - client.verify_confidential_gke(request=None) - - # Establish that the underlying stub method was called. - call.assert_called() - _, args, _ = call.mock_calls[0] - request_msg = service.VerifyConfidentialGkeRequest() - - assert args[0] == request_msg - - -def test_transport_kind_grpc_asyncio(): - transport = ConfidentialComputingAsyncClient.get_transport_class("grpc_asyncio")( - credentials=async_anonymous_credentials() - ) - assert transport.kind == "grpc_asyncio" - - -def test_initialize_client_w_grpc_asyncio(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - transport="grpc_asyncio" - ) - assert client is not None - - -# This test is a coverage failsafe to make sure that totally empty calls, -# i.e. request == None and no flattened fields passed, work. -@pytest.mark.asyncio -async def test_create_challenge_empty_call_grpc_asyncio(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - transport="grpc_asyncio", - ) - - # Mock the actual call, and fake the request. - with mock.patch.object( - type(client.transport.create_challenge), - '__call__') as call: - # Designate an appropriate return value for the call. - call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.Challenge( - name='name_value', - used=True, - tpm_nonce='tpm_nonce_value', - )) - await client.create_challenge(request=None) - - # Establish that the underlying stub method was called. - call.assert_called() - _, args, _ = call.mock_calls[0] - request_msg = service.CreateChallengeRequest() - - assert args[0] == request_msg - - -# This test is a coverage failsafe to make sure that totally empty calls, -# i.e. request == None and no flattened fields passed, work. -@pytest.mark.asyncio -async def test_verify_attestation_empty_call_grpc_asyncio(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - transport="grpc_asyncio", - ) - - # Mock the actual call, and fake the request. - with mock.patch.object( - type(client.transport.verify_attestation), - '__call__') as call: - # Designate an appropriate return value for the call. - call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyAttestationResponse( - oidc_claims_token='oidc_claims_token_value', - )) - await client.verify_attestation(request=None) - - # Establish that the underlying stub method was called. - call.assert_called() - _, args, _ = call.mock_calls[0] - request_msg = service.VerifyAttestationRequest() - - assert args[0] == request_msg - - -# This test is a coverage failsafe to make sure that totally empty calls, -# i.e. request == None and no flattened fields passed, work. -@pytest.mark.asyncio -async def test_verify_confidential_space_empty_call_grpc_asyncio(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - transport="grpc_asyncio", - ) - - # Mock the actual call, and fake the request. - with mock.patch.object( - type(client.transport.verify_confidential_space), - '__call__') as call: - # Designate an appropriate return value for the call. - call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyConfidentialSpaceResponse( - attestation_token='attestation_token_value', - )) - await client.verify_confidential_space(request=None) - - # Establish that the underlying stub method was called. - call.assert_called() - _, args, _ = call.mock_calls[0] - request_msg = service.VerifyConfidentialSpaceRequest() - - assert args[0] == request_msg - - -# This test is a coverage failsafe to make sure that totally empty calls, -# i.e. request == None and no flattened fields passed, work. -@pytest.mark.asyncio -async def test_verify_confidential_gke_empty_call_grpc_asyncio(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - transport="grpc_asyncio", - ) - - # Mock the actual call, and fake the request. - with mock.patch.object( - type(client.transport.verify_confidential_gke), - '__call__') as call: - # Designate an appropriate return value for the call. - call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.VerifyConfidentialGkeResponse( - attestation_token='attestation_token_value', - )) - await client.verify_confidential_gke(request=None) - - # Establish that the underlying stub method was called. - call.assert_called() - _, args, _ = call.mock_calls[0] - request_msg = service.VerifyConfidentialGkeRequest() - - assert args[0] == request_msg - - -def test_transport_kind_rest(): - transport = ConfidentialComputingClient.get_transport_class("rest")( - credentials=ga_credentials.AnonymousCredentials() - ) - assert transport.kind == "rest" - - -def test_create_challenge_rest_bad_request(request_type=service.CreateChallengeRequest): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest" - ) - # send a request that will satisfy transcoding - request_init = {'parent': 'projects/sample1/locations/sample2'} - request = request_type(**request_init) - - # Mock the http request call within the method and fake a BadRequest error. - with mock.patch.object(Session, 'request') as req, pytest.raises(core_exceptions.BadRequest): - # Wrap the value into a proper Response obj - response_value = mock.Mock() - json_return_value = '' - response_value.json = mock.Mock(return_value={}) - response_value.status_code = 400 - response_value.request = mock.Mock() - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - client.create_challenge(request) - - -@pytest.mark.parametrize("request_type", [ - service.CreateChallengeRequest, - dict, -]) -def test_create_challenge_rest_call_success(request_type): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest" - ) - - # send a request that will satisfy transcoding - request_init = {'parent': 'projects/sample1/locations/sample2'} - request_init["challenge"] = {'name': 'name_value', 'create_time': {'seconds': 751, 'nanos': 543}, 'expire_time': {}, 'used': True, 'tpm_nonce': 'tpm_nonce_value'} - # The version of a generated dependency at test runtime may differ from the version used during generation. - # Delete any fields which are not present in the current runtime dependency - # See https://github.com/googleapis/gapic-generator-python/issues/1748 - - # Determine if the message type is proto-plus or protobuf - test_field = service.CreateChallengeRequest.meta.fields["challenge"] - - def get_message_fields(field): - # Given a field which is a message (composite type), return a list with - # all the fields of the message. - # If the field is not a composite type, return an empty list. - message_fields = [] - - if hasattr(field, "message") and field.message: - is_field_type_proto_plus_type = not hasattr(field.message, "DESCRIPTOR") - - if is_field_type_proto_plus_type: - message_fields = field.message.meta.fields.values() - # Add `# pragma: NO COVER` because there may not be any `*_pb2` field types - else: # pragma: NO COVER - message_fields = field.message.DESCRIPTOR.fields - return message_fields - - runtime_nested_fields = [ - (field.name, nested_field.name) - for field in get_message_fields(test_field) - for nested_field in get_message_fields(field) - ] - - subfields_not_in_runtime = [] - - # For each item in the sample request, create a list of sub fields which are not present at runtime - # Add `# pragma: NO COVER` because this test code will not run if all subfields are present at runtime - for field, value in request_init["challenge"].items(): # pragma: NO COVER - result = None - is_repeated = False - # For repeated fields - if isinstance(value, list) and len(value): - is_repeated = True - result = value[0] - # For fields where the type is another message - if isinstance(value, dict): - result = value - - if result and hasattr(result, "keys"): - for subfield in result.keys(): - if (field, subfield) not in runtime_nested_fields: - subfields_not_in_runtime.append( - {"field": field, "subfield": subfield, "is_repeated": is_repeated} - ) - - # Remove fields from the sample request which are not present in the runtime version of the dependency - # Add `# pragma: NO COVER` because this test code will not run if all subfields are present at runtime - for subfield_to_delete in subfields_not_in_runtime: # pragma: NO COVER - field = subfield_to_delete.get("field") - field_repeated = subfield_to_delete.get("is_repeated") - subfield = subfield_to_delete.get("subfield") - if subfield: - if field_repeated: - for i in range(0, len(request_init["challenge"][field])): - del request_init["challenge"][field][i][subfield] - else: - del request_init["challenge"][field][subfield] - request = request_type(**request_init) - - # Mock the http request call within the method and fake a response. - with mock.patch.object(type(client.transport._session), 'request') as req: - # Designate an appropriate value for the returned response. - return_value = service.Challenge( - name='name_value', - used=True, - tpm_nonce='tpm_nonce_value', - ) - - # Wrap the value into a proper Response obj - response_value = mock.Mock() - response_value.status_code = 200 - - # Convert return value to protobuf type - return_value = service.Challenge.pb(return_value) - json_return_value = json_format.MessageToJson(return_value) - response_value.content = json_return_value.encode('UTF-8') - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - response = client.create_challenge(request) - - # Establish that the response is the type that we expect. - assert isinstance(response, service.Challenge) - assert response.name == 'name_value' - assert response.used is True - assert response.tpm_nonce == 'tpm_nonce_value' - - -@pytest.mark.parametrize("null_interceptor", [True, False]) -def test_create_challenge_rest_interceptors(null_interceptor): - transport = transports.ConfidentialComputingRestTransport( - credentials=ga_credentials.AnonymousCredentials(), - interceptor=None if null_interceptor else transports.ConfidentialComputingRestInterceptor(), - ) - client = ConfidentialComputingClient(transport=transport) - - with mock.patch.object(type(client.transport._session), "request") as req, \ - mock.patch.object(path_template, "transcode") as transcode, \ - mock.patch.object(transports.ConfidentialComputingRestInterceptor, "post_create_challenge") as post, \ - mock.patch.object(transports.ConfidentialComputingRestInterceptor, "post_create_challenge_with_metadata") as post_with_metadata, \ - mock.patch.object(transports.ConfidentialComputingRestInterceptor, "pre_create_challenge") as pre: - pre.assert_not_called() - post.assert_not_called() - post_with_metadata.assert_not_called() - pb_message = service.CreateChallengeRequest.pb(service.CreateChallengeRequest()) - transcode.return_value = { - "method": "post", - "uri": "my_uri", - "body": pb_message, - "query_params": pb_message, - } - - req.return_value = mock.Mock() - req.return_value.status_code = 200 - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - return_value = service.Challenge.to_json(service.Challenge()) - req.return_value.content = return_value - - request = service.CreateChallengeRequest() - metadata =[ - ("key", "val"), - ("cephalopod", "squid"), - ] - pre.return_value = request, metadata - post.return_value = service.Challenge() - post_with_metadata.return_value = service.Challenge(), metadata - - client.create_challenge(request, metadata=[("key", "val"), ("cephalopod", "squid"),]) - - pre.assert_called_once() - post.assert_called_once() - post_with_metadata.assert_called_once() - - -def test_verify_attestation_rest_bad_request(request_type=service.VerifyAttestationRequest): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest" - ) - # send a request that will satisfy transcoding - request_init = {'challenge': 'projects/sample1/locations/sample2/challenges/sample3'} - request = request_type(**request_init) - - # Mock the http request call within the method and fake a BadRequest error. - with mock.patch.object(Session, 'request') as req, pytest.raises(core_exceptions.BadRequest): - # Wrap the value into a proper Response obj - response_value = mock.Mock() - json_return_value = '' - response_value.json = mock.Mock(return_value={}) - response_value.status_code = 400 - response_value.request = mock.Mock() - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - client.verify_attestation(request) - - -@pytest.mark.parametrize("request_type", [ - service.VerifyAttestationRequest, - dict, -]) -def test_verify_attestation_rest_call_success(request_type): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest" - ) - - # send a request that will satisfy transcoding - request_init = {'challenge': 'projects/sample1/locations/sample2/challenges/sample3'} - request = request_type(**request_init) - - # Mock the http request call within the method and fake a response. - with mock.patch.object(type(client.transport._session), 'request') as req: - # Designate an appropriate value for the returned response. - return_value = service.VerifyAttestationResponse( - oidc_claims_token='oidc_claims_token_value', - ) - - # Wrap the value into a proper Response obj - response_value = mock.Mock() - response_value.status_code = 200 - - # Convert return value to protobuf type - return_value = service.VerifyAttestationResponse.pb(return_value) - json_return_value = json_format.MessageToJson(return_value) - response_value.content = json_return_value.encode('UTF-8') - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - response = client.verify_attestation(request) - - # Establish that the response is the type that we expect. - assert isinstance(response, service.VerifyAttestationResponse) - assert response.oidc_claims_token == 'oidc_claims_token_value' - - -@pytest.mark.parametrize("null_interceptor", [True, False]) -def test_verify_attestation_rest_interceptors(null_interceptor): - transport = transports.ConfidentialComputingRestTransport( - credentials=ga_credentials.AnonymousCredentials(), - interceptor=None if null_interceptor else transports.ConfidentialComputingRestInterceptor(), - ) - client = ConfidentialComputingClient(transport=transport) - - with mock.patch.object(type(client.transport._session), "request") as req, \ - mock.patch.object(path_template, "transcode") as transcode, \ - mock.patch.object(transports.ConfidentialComputingRestInterceptor, "post_verify_attestation") as post, \ - mock.patch.object(transports.ConfidentialComputingRestInterceptor, "post_verify_attestation_with_metadata") as post_with_metadata, \ - mock.patch.object(transports.ConfidentialComputingRestInterceptor, "pre_verify_attestation") as pre: - pre.assert_not_called() - post.assert_not_called() - post_with_metadata.assert_not_called() - pb_message = service.VerifyAttestationRequest.pb(service.VerifyAttestationRequest()) - transcode.return_value = { - "method": "post", - "uri": "my_uri", - "body": pb_message, - "query_params": pb_message, - } - - req.return_value = mock.Mock() - req.return_value.status_code = 200 - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - return_value = service.VerifyAttestationResponse.to_json(service.VerifyAttestationResponse()) - req.return_value.content = return_value - - request = service.VerifyAttestationRequest() - metadata =[ - ("key", "val"), - ("cephalopod", "squid"), - ] - pre.return_value = request, metadata - post.return_value = service.VerifyAttestationResponse() - post_with_metadata.return_value = service.VerifyAttestationResponse(), metadata - - client.verify_attestation(request, metadata=[("key", "val"), ("cephalopod", "squid"),]) - - pre.assert_called_once() - post.assert_called_once() - post_with_metadata.assert_called_once() - - -def test_verify_confidential_space_rest_bad_request(request_type=service.VerifyConfidentialSpaceRequest): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest" - ) - # send a request that will satisfy transcoding - request_init = {'challenge': 'projects/sample1/locations/sample2/challenges/sample3'} - request = request_type(**request_init) - - # Mock the http request call within the method and fake a BadRequest error. - with mock.patch.object(Session, 'request') as req, pytest.raises(core_exceptions.BadRequest): - # Wrap the value into a proper Response obj - response_value = mock.Mock() - json_return_value = '' - response_value.json = mock.Mock(return_value={}) - response_value.status_code = 400 - response_value.request = mock.Mock() - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - client.verify_confidential_space(request) - - -@pytest.mark.parametrize("request_type", [ - service.VerifyConfidentialSpaceRequest, - dict, -]) -def test_verify_confidential_space_rest_call_success(request_type): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest" - ) - - # send a request that will satisfy transcoding - request_init = {'challenge': 'projects/sample1/locations/sample2/challenges/sample3'} - request = request_type(**request_init) - - # Mock the http request call within the method and fake a response. - with mock.patch.object(type(client.transport._session), 'request') as req: - # Designate an appropriate value for the returned response. - return_value = service.VerifyConfidentialSpaceResponse( - attestation_token='attestation_token_value', - ) - - # Wrap the value into a proper Response obj - response_value = mock.Mock() - response_value.status_code = 200 - - # Convert return value to protobuf type - return_value = service.VerifyConfidentialSpaceResponse.pb(return_value) - json_return_value = json_format.MessageToJson(return_value) - response_value.content = json_return_value.encode('UTF-8') - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - response = client.verify_confidential_space(request) - - # Establish that the response is the type that we expect. - assert isinstance(response, service.VerifyConfidentialSpaceResponse) - assert response.attestation_token == 'attestation_token_value' - - -@pytest.mark.parametrize("null_interceptor", [True, False]) -def test_verify_confidential_space_rest_interceptors(null_interceptor): - transport = transports.ConfidentialComputingRestTransport( - credentials=ga_credentials.AnonymousCredentials(), - interceptor=None if null_interceptor else transports.ConfidentialComputingRestInterceptor(), - ) - client = ConfidentialComputingClient(transport=transport) - - with mock.patch.object(type(client.transport._session), "request") as req, \ - mock.patch.object(path_template, "transcode") as transcode, \ - mock.patch.object(transports.ConfidentialComputingRestInterceptor, "post_verify_confidential_space") as post, \ - mock.patch.object(transports.ConfidentialComputingRestInterceptor, "post_verify_confidential_space_with_metadata") as post_with_metadata, \ - mock.patch.object(transports.ConfidentialComputingRestInterceptor, "pre_verify_confidential_space") as pre: - pre.assert_not_called() - post.assert_not_called() - post_with_metadata.assert_not_called() - pb_message = service.VerifyConfidentialSpaceRequest.pb(service.VerifyConfidentialSpaceRequest()) - transcode.return_value = { - "method": "post", - "uri": "my_uri", - "body": pb_message, - "query_params": pb_message, - } - - req.return_value = mock.Mock() - req.return_value.status_code = 200 - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - return_value = service.VerifyConfidentialSpaceResponse.to_json(service.VerifyConfidentialSpaceResponse()) - req.return_value.content = return_value - - request = service.VerifyConfidentialSpaceRequest() - metadata =[ - ("key", "val"), - ("cephalopod", "squid"), - ] - pre.return_value = request, metadata - post.return_value = service.VerifyConfidentialSpaceResponse() - post_with_metadata.return_value = service.VerifyConfidentialSpaceResponse(), metadata - - client.verify_confidential_space(request, metadata=[("key", "val"), ("cephalopod", "squid"),]) - - pre.assert_called_once() - post.assert_called_once() - post_with_metadata.assert_called_once() - - -def test_verify_confidential_gke_rest_bad_request(request_type=service.VerifyConfidentialGkeRequest): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest" - ) - # send a request that will satisfy transcoding - request_init = {'challenge': 'projects/sample1/locations/sample2/challenges/sample3'} - request = request_type(**request_init) - - # Mock the http request call within the method and fake a BadRequest error. - with mock.patch.object(Session, 'request') as req, pytest.raises(core_exceptions.BadRequest): - # Wrap the value into a proper Response obj - response_value = mock.Mock() - json_return_value = '' - response_value.json = mock.Mock(return_value={}) - response_value.status_code = 400 - response_value.request = mock.Mock() - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - client.verify_confidential_gke(request) - - -@pytest.mark.parametrize("request_type", [ - service.VerifyConfidentialGkeRequest, - dict, -]) -def test_verify_confidential_gke_rest_call_success(request_type): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest" - ) - - # send a request that will satisfy transcoding - request_init = {'challenge': 'projects/sample1/locations/sample2/challenges/sample3'} - request = request_type(**request_init) - - # Mock the http request call within the method and fake a response. - with mock.patch.object(type(client.transport._session), 'request') as req: - # Designate an appropriate value for the returned response. - return_value = service.VerifyConfidentialGkeResponse( - attestation_token='attestation_token_value', - ) - - # Wrap the value into a proper Response obj - response_value = mock.Mock() - response_value.status_code = 200 - - # Convert return value to protobuf type - return_value = service.VerifyConfidentialGkeResponse.pb(return_value) - json_return_value = json_format.MessageToJson(return_value) - response_value.content = json_return_value.encode('UTF-8') - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - response = client.verify_confidential_gke(request) - - # Establish that the response is the type that we expect. - assert isinstance(response, service.VerifyConfidentialGkeResponse) - assert response.attestation_token == 'attestation_token_value' - - -@pytest.mark.parametrize("null_interceptor", [True, False]) -def test_verify_confidential_gke_rest_interceptors(null_interceptor): - transport = transports.ConfidentialComputingRestTransport( - credentials=ga_credentials.AnonymousCredentials(), - interceptor=None if null_interceptor else transports.ConfidentialComputingRestInterceptor(), - ) - client = ConfidentialComputingClient(transport=transport) - - with mock.patch.object(type(client.transport._session), "request") as req, \ - mock.patch.object(path_template, "transcode") as transcode, \ - mock.patch.object(transports.ConfidentialComputingRestInterceptor, "post_verify_confidential_gke") as post, \ - mock.patch.object(transports.ConfidentialComputingRestInterceptor, "post_verify_confidential_gke_with_metadata") as post_with_metadata, \ - mock.patch.object(transports.ConfidentialComputingRestInterceptor, "pre_verify_confidential_gke") as pre: - pre.assert_not_called() - post.assert_not_called() - post_with_metadata.assert_not_called() - pb_message = service.VerifyConfidentialGkeRequest.pb(service.VerifyConfidentialGkeRequest()) - transcode.return_value = { - "method": "post", - "uri": "my_uri", - "body": pb_message, - "query_params": pb_message, - } - - req.return_value = mock.Mock() - req.return_value.status_code = 200 - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - return_value = service.VerifyConfidentialGkeResponse.to_json(service.VerifyConfidentialGkeResponse()) - req.return_value.content = return_value - - request = service.VerifyConfidentialGkeRequest() - metadata =[ - ("key", "val"), - ("cephalopod", "squid"), - ] - pre.return_value = request, metadata - post.return_value = service.VerifyConfidentialGkeResponse() - post_with_metadata.return_value = service.VerifyConfidentialGkeResponse(), metadata - - client.verify_confidential_gke(request, metadata=[("key", "val"), ("cephalopod", "squid"),]) - - pre.assert_called_once() - post.assert_called_once() - post_with_metadata.assert_called_once() - - -def test_get_location_rest_bad_request(request_type=locations_pb2.GetLocationRequest): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest", - ) - request = request_type() - request = json_format.ParseDict({'name': 'projects/sample1/locations/sample2'}, request) - - # Mock the http request call within the method and fake a BadRequest error. - with mock.patch.object(Session, 'request') as req, pytest.raises(core_exceptions.BadRequest): - # Wrap the value into a proper Response obj - response_value = Response() - json_return_value = '' - response_value.json = mock.Mock(return_value={}) - response_value.status_code = 400 - response_value.request = Request() - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - client.get_location(request) - - -@pytest.mark.parametrize("request_type", [ - locations_pb2.GetLocationRequest, - dict, -]) -def test_get_location_rest(request_type): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest", - ) - - request_init = {'name': 'projects/sample1/locations/sample2'} - request = request_type(**request_init) - # Mock the http request call within the method and fake a response. - with mock.patch.object(Session, 'request') as req: - # Designate an appropriate value for the returned response. - return_value = locations_pb2.Location() - - # Wrap the value into a proper Response obj - response_value = mock.Mock() - response_value.status_code = 200 - json_return_value = json_format.MessageToJson(return_value) - response_value.content = json_return_value.encode('UTF-8') - - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - - response = client.get_location(request) - - # Establish that the response is the type that we expect. - assert isinstance(response, locations_pb2.Location) - - -def test_list_locations_rest_bad_request(request_type=locations_pb2.ListLocationsRequest): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest", - ) - request = request_type() - request = json_format.ParseDict({'name': 'projects/sample1'}, request) - - # Mock the http request call within the method and fake a BadRequest error. - with mock.patch.object(Session, 'request') as req, pytest.raises(core_exceptions.BadRequest): - # Wrap the value into a proper Response obj - response_value = Response() - json_return_value = '' - response_value.json = mock.Mock(return_value={}) - response_value.status_code = 400 - response_value.request = Request() - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - client.list_locations(request) - - -@pytest.mark.parametrize("request_type", [ - locations_pb2.ListLocationsRequest, - dict, -]) -def test_list_locations_rest(request_type): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest", - ) - - request_init = {'name': 'projects/sample1'} - request = request_type(**request_init) - # Mock the http request call within the method and fake a response. - with mock.patch.object(Session, 'request') as req: - # Designate an appropriate value for the returned response. - return_value = locations_pb2.ListLocationsResponse() - - # Wrap the value into a proper Response obj - response_value = mock.Mock() - response_value.status_code = 200 - json_return_value = json_format.MessageToJson(return_value) - response_value.content = json_return_value.encode('UTF-8') - - req.return_value = response_value - req.return_value.headers = {"header-1": "value-1", "header-2": "value-2"} - - response = client.list_locations(request) - - # Establish that the response is the type that we expect. - assert isinstance(response, locations_pb2.ListLocationsResponse) - -def test_initialize_client_w_rest(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest" - ) - assert client is not None - - -# This test is a coverage failsafe to make sure that totally empty calls, -# i.e. request == None and no flattened fields passed, work. -def test_create_challenge_empty_call_rest(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest", - ) - - # Mock the actual call, and fake the request. - with mock.patch.object( - type(client.transport.create_challenge), - '__call__') as call: - client.create_challenge(request=None) - - # Establish that the underlying stub method was called. - call.assert_called() - _, args, _ = call.mock_calls[0] - request_msg = service.CreateChallengeRequest() - - assert args[0] == request_msg - - -# This test is a coverage failsafe to make sure that totally empty calls, -# i.e. request == None and no flattened fields passed, work. -def test_verify_attestation_empty_call_rest(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest", - ) - - # Mock the actual call, and fake the request. - with mock.patch.object( - type(client.transport.verify_attestation), - '__call__') as call: - client.verify_attestation(request=None) - - # Establish that the underlying stub method was called. - call.assert_called() - _, args, _ = call.mock_calls[0] - request_msg = service.VerifyAttestationRequest() - - assert args[0] == request_msg - - -# This test is a coverage failsafe to make sure that totally empty calls, -# i.e. request == None and no flattened fields passed, work. -def test_verify_confidential_space_empty_call_rest(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest", - ) - - # Mock the actual call, and fake the request. - with mock.patch.object( - type(client.transport.verify_confidential_space), - '__call__') as call: - client.verify_confidential_space(request=None) - - # Establish that the underlying stub method was called. - call.assert_called() - _, args, _ = call.mock_calls[0] - request_msg = service.VerifyConfidentialSpaceRequest() - - assert args[0] == request_msg - - -# This test is a coverage failsafe to make sure that totally empty calls, -# i.e. request == None and no flattened fields passed, work. -def test_verify_confidential_gke_empty_call_rest(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest", - ) - - # Mock the actual call, and fake the request. - with mock.patch.object( - type(client.transport.verify_confidential_gke), - '__call__') as call: - client.verify_confidential_gke(request=None) - - # Establish that the underlying stub method was called. - call.assert_called() - _, args, _ = call.mock_calls[0] - request_msg = service.VerifyConfidentialGkeRequest() - - assert args[0] == request_msg - - -def test_transport_grpc_default(): - # A client should use the gRPC transport by default. - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - ) - assert isinstance( - client.transport, - transports.ConfidentialComputingGrpcTransport, - ) - -def test_confidential_computing_base_transport_error(): - # Passing both a credentials object and credentials_file should raise an error - with pytest.raises(core_exceptions.DuplicateCredentialArgs): - transport = transports.ConfidentialComputingTransport( - credentials=ga_credentials.AnonymousCredentials(), - credentials_file="credentials.json" - ) - - -def test_confidential_computing_base_transport(): - # Instantiate the base transport. - with mock.patch('google.cloud.confidentialcomputing_v1.services.confidential_computing.transports.ConfidentialComputingTransport.__init__') as Transport: - Transport.return_value = None - transport = transports.ConfidentialComputingTransport( - credentials=ga_credentials.AnonymousCredentials(), - ) - - # Every method on the transport should just blindly - # raise NotImplementedError. - methods = ( - 'create_challenge', - 'verify_attestation', - 'verify_confidential_space', - 'verify_confidential_gke', - 'get_location', - 'list_locations', - ) - for method in methods: - with pytest.raises(NotImplementedError): - getattr(transport, method)(request=object()) - - with pytest.raises(NotImplementedError): - transport.close() - - # Catch all for all remaining methods and properties - remainder = [ - 'kind', - ] - for r in remainder: - with pytest.raises(NotImplementedError): - getattr(transport, r)() - - -def test_confidential_computing_base_transport_with_credentials_file(): - # Instantiate the base transport with a credentials file - with mock.patch.object(google.auth, 'load_credentials_from_file', autospec=True) as load_creds, mock.patch('google.cloud.confidentialcomputing_v1.services.confidential_computing.transports.ConfidentialComputingTransport._prep_wrapped_messages') as Transport: - Transport.return_value = None - load_creds.return_value = (ga_credentials.AnonymousCredentials(), None) - transport = transports.ConfidentialComputingTransport( - credentials_file="credentials.json", - quota_project_id="octopus", - ) - load_creds.assert_called_once_with("credentials.json", - scopes=None, - default_scopes=( - 'https://www.googleapis.com/auth/cloud-platform', -), - quota_project_id="octopus", - ) - - -def test_confidential_computing_base_transport_with_adc(): - # Test the default credentials are used if credentials and credentials_file are None. - with mock.patch.object(google.auth, 'default', autospec=True) as adc, mock.patch('google.cloud.confidentialcomputing_v1.services.confidential_computing.transports.ConfidentialComputingTransport._prep_wrapped_messages') as Transport: - Transport.return_value = None - adc.return_value = (ga_credentials.AnonymousCredentials(), None) - transport = transports.ConfidentialComputingTransport() - adc.assert_called_once() - - -def test_confidential_computing_auth_adc(): - # If no credentials are provided, we should use ADC credentials. - with mock.patch.object(google.auth, 'default', autospec=True) as adc: - adc.return_value = (ga_credentials.AnonymousCredentials(), None) - ConfidentialComputingClient() - adc.assert_called_once_with( - scopes=None, - default_scopes=( - 'https://www.googleapis.com/auth/cloud-platform', -), - quota_project_id=None, - ) - - -@pytest.mark.parametrize( - "transport_class", - [ - transports.ConfidentialComputingGrpcTransport, - transports.ConfidentialComputingGrpcAsyncIOTransport, - ], -) -def test_confidential_computing_transport_auth_adc(transport_class): - # If credentials and host are not provided, the transport class should use - # ADC credentials. - with mock.patch.object(google.auth, 'default', autospec=True) as adc: - adc.return_value = (ga_credentials.AnonymousCredentials(), None) - transport_class(quota_project_id="octopus", scopes=["1", "2"]) - adc.assert_called_once_with( - scopes=["1", "2"], - default_scopes=( 'https://www.googleapis.com/auth/cloud-platform',), - quota_project_id="octopus", - ) - - -@pytest.mark.parametrize( - "transport_class", - [ - transports.ConfidentialComputingGrpcTransport, - transports.ConfidentialComputingGrpcAsyncIOTransport, - transports.ConfidentialComputingRestTransport, - ], -) -def test_confidential_computing_transport_auth_gdch_credentials(transport_class): - host = 'https://language.com' - api_audience_tests = [None, 'https://language2.com'] - api_audience_expect = [host, 'https://language2.com'] - for t, e in zip(api_audience_tests, api_audience_expect): - with mock.patch.object(google.auth, 'default', autospec=True) as adc: - gdch_mock = mock.MagicMock() - type(gdch_mock).with_gdch_audience = mock.PropertyMock(return_value=gdch_mock) - adc.return_value = (gdch_mock, None) - transport_class(host=host, api_audience=t) - gdch_mock.with_gdch_audience.assert_called_once_with( - e - ) - - -@pytest.mark.parametrize( - "transport_class,grpc_helpers", - [ - (transports.ConfidentialComputingGrpcTransport, grpc_helpers), - (transports.ConfidentialComputingGrpcAsyncIOTransport, grpc_helpers_async) - ], -) -def test_confidential_computing_transport_create_channel(transport_class, grpc_helpers): - # If credentials and host are not provided, the transport class should use - # ADC credentials. - with mock.patch.object(google.auth, "default", autospec=True) as adc, mock.patch.object( - grpc_helpers, "create_channel", autospec=True - ) as create_channel: - creds = ga_credentials.AnonymousCredentials() - adc.return_value = (creds, None) - transport_class( - quota_project_id="octopus", - scopes=["1", "2"] - ) - - create_channel.assert_called_with( - "confidentialcomputing.googleapis.com:443", - credentials=creds, - credentials_file=None, - quota_project_id="octopus", - default_scopes=( - 'https://www.googleapis.com/auth/cloud-platform', -), - scopes=["1", "2"], - default_host="confidentialcomputing.googleapis.com", - ssl_credentials=None, - options=[ - ("grpc.max_send_message_length", -1), - ("grpc.max_receive_message_length", -1), - ], - ) - - -@pytest.mark.parametrize("transport_class", [transports.ConfidentialComputingGrpcTransport, transports.ConfidentialComputingGrpcAsyncIOTransport]) -def test_confidential_computing_grpc_transport_client_cert_source_for_mtls( - transport_class -): - cred = ga_credentials.AnonymousCredentials() - - # Check ssl_channel_credentials is used if provided. - with mock.patch.object(transport_class, "create_channel") as mock_create_channel: - mock_ssl_channel_creds = mock.Mock() - transport_class( - host="squid.clam.whelk", - credentials=cred, - ssl_channel_credentials=mock_ssl_channel_creds - ) - mock_create_channel.assert_called_once_with( - "squid.clam.whelk:443", - credentials=cred, - credentials_file=None, - scopes=None, - ssl_credentials=mock_ssl_channel_creds, - quota_project_id=None, - options=[ - ("grpc.max_send_message_length", -1), - ("grpc.max_receive_message_length", -1), - ], - ) - - # Check if ssl_channel_credentials is not provided, then client_cert_source_for_mtls - # is used. - with mock.patch.object(transport_class, "create_channel", return_value=mock.Mock()): - with mock.patch("grpc.ssl_channel_credentials") as mock_ssl_cred: - transport_class( - credentials=cred, - client_cert_source_for_mtls=client_cert_source_callback - ) - expected_cert, expected_key = client_cert_source_callback() - mock_ssl_cred.assert_called_once_with( - certificate_chain=expected_cert, - private_key=expected_key - ) - -def test_confidential_computing_http_transport_client_cert_source_for_mtls(): - cred = ga_credentials.AnonymousCredentials() - with mock.patch("google.auth.transport.requests.AuthorizedSession.configure_mtls_channel") as mock_configure_mtls_channel: - transports.ConfidentialComputingRestTransport ( - credentials=cred, - client_cert_source_for_mtls=client_cert_source_callback - ) - mock_configure_mtls_channel.assert_called_once_with(client_cert_source_callback) - - -@pytest.mark.parametrize("transport_name", [ - "grpc", - "grpc_asyncio", - "rest", -]) -def test_confidential_computing_host_no_port(transport_name): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - client_options=client_options.ClientOptions(api_endpoint='confidentialcomputing.googleapis.com'), - transport=transport_name, - ) - assert client.transport._host == ( - 'confidentialcomputing.googleapis.com:443' - if transport_name in ['grpc', 'grpc_asyncio'] - else 'https://confidentialcomputing.googleapis.com' - ) - -@pytest.mark.parametrize("transport_name", [ - "grpc", - "grpc_asyncio", - "rest", -]) -def test_confidential_computing_host_with_port(transport_name): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - client_options=client_options.ClientOptions(api_endpoint='confidentialcomputing.googleapis.com:8000'), - transport=transport_name, - ) - assert client.transport._host == ( - 'confidentialcomputing.googleapis.com:8000' - if transport_name in ['grpc', 'grpc_asyncio'] - else 'https://confidentialcomputing.googleapis.com:8000' - ) - -@pytest.mark.parametrize("transport_name", [ - "rest", -]) -def test_confidential_computing_client_transport_session_collision(transport_name): - creds1 = ga_credentials.AnonymousCredentials() - creds2 = ga_credentials.AnonymousCredentials() - client1 = ConfidentialComputingClient( - credentials=creds1, - transport=transport_name, - ) - client2 = ConfidentialComputingClient( - credentials=creds2, - transport=transport_name, - ) - session1 = client1.transport.create_challenge._session - session2 = client2.transport.create_challenge._session - assert session1 != session2 - session1 = client1.transport.verify_attestation._session - session2 = client2.transport.verify_attestation._session - assert session1 != session2 - session1 = client1.transport.verify_confidential_space._session - session2 = client2.transport.verify_confidential_space._session - assert session1 != session2 - session1 = client1.transport.verify_confidential_gke._session - session2 = client2.transport.verify_confidential_gke._session - assert session1 != session2 -def test_confidential_computing_grpc_transport_channel(): - channel = grpc.secure_channel('http://localhost/', grpc.local_channel_credentials()) - - # Check that channel is used if provided. - transport = transports.ConfidentialComputingGrpcTransport( - host="squid.clam.whelk", - channel=channel, - ) - assert transport.grpc_channel == channel - assert transport._host == "squid.clam.whelk:443" - assert transport._ssl_channel_credentials == None - - -def test_confidential_computing_grpc_asyncio_transport_channel(): - channel = aio.secure_channel('http://localhost/', grpc.local_channel_credentials()) - - # Check that channel is used if provided. - transport = transports.ConfidentialComputingGrpcAsyncIOTransport( - host="squid.clam.whelk", - channel=channel, - ) - assert transport.grpc_channel == channel - assert transport._host == "squid.clam.whelk:443" - assert transport._ssl_channel_credentials == None - - -# Remove this test when deprecated arguments (api_mtls_endpoint, client_cert_source) are -# removed from grpc/grpc_asyncio transport constructor. -@pytest.mark.parametrize("transport_class", [transports.ConfidentialComputingGrpcTransport, transports.ConfidentialComputingGrpcAsyncIOTransport]) -def test_confidential_computing_transport_channel_mtls_with_client_cert_source( - transport_class -): - with mock.patch("grpc.ssl_channel_credentials", autospec=True) as grpc_ssl_channel_cred: - with mock.patch.object(transport_class, "create_channel") as grpc_create_channel: - mock_ssl_cred = mock.Mock() - grpc_ssl_channel_cred.return_value = mock_ssl_cred - - mock_grpc_channel = mock.Mock() - grpc_create_channel.return_value = mock_grpc_channel - - cred = ga_credentials.AnonymousCredentials() - with pytest.warns(DeprecationWarning): - with mock.patch.object(google.auth, 'default') as adc: - adc.return_value = (cred, None) - transport = transport_class( - host="squid.clam.whelk", - api_mtls_endpoint="mtls.squid.clam.whelk", - client_cert_source=client_cert_source_callback, - ) - adc.assert_called_once() - - grpc_ssl_channel_cred.assert_called_once_with( - certificate_chain=b"cert bytes", private_key=b"key bytes" - ) - grpc_create_channel.assert_called_once_with( - "mtls.squid.clam.whelk:443", - credentials=cred, - credentials_file=None, - scopes=None, - ssl_credentials=mock_ssl_cred, - quota_project_id=None, - options=[ - ("grpc.max_send_message_length", -1), - ("grpc.max_receive_message_length", -1), - ], - ) - assert transport.grpc_channel == mock_grpc_channel - assert transport._ssl_channel_credentials == mock_ssl_cred - - -# Remove this test when deprecated arguments (api_mtls_endpoint, client_cert_source) are -# removed from grpc/grpc_asyncio transport constructor. -@pytest.mark.parametrize("transport_class", [transports.ConfidentialComputingGrpcTransport, transports.ConfidentialComputingGrpcAsyncIOTransport]) -def test_confidential_computing_transport_channel_mtls_with_adc( - transport_class -): - mock_ssl_cred = mock.Mock() - with mock.patch.multiple( - "google.auth.transport.grpc.SslCredentials", - __init__=mock.Mock(return_value=None), - ssl_credentials=mock.PropertyMock(return_value=mock_ssl_cred), - ): - with mock.patch.object(transport_class, "create_channel") as grpc_create_channel: - mock_grpc_channel = mock.Mock() - grpc_create_channel.return_value = mock_grpc_channel - mock_cred = mock.Mock() - - with pytest.warns(DeprecationWarning): - transport = transport_class( - host="squid.clam.whelk", - credentials=mock_cred, - api_mtls_endpoint="mtls.squid.clam.whelk", - client_cert_source=None, - ) - - grpc_create_channel.assert_called_once_with( - "mtls.squid.clam.whelk:443", - credentials=mock_cred, - credentials_file=None, - scopes=None, - ssl_credentials=mock_ssl_cred, - quota_project_id=None, - options=[ - ("grpc.max_send_message_length", -1), - ("grpc.max_receive_message_length", -1), - ], - ) - assert transport.grpc_channel == mock_grpc_channel - - -def test_challenge_path(): - project = "squid" - location = "clam" - uuid = "whelk" - expected = "projects/{project}/locations/{location}/challenges/{uuid}".format(project=project, location=location, uuid=uuid, ) - actual = ConfidentialComputingClient.challenge_path(project, location, uuid) - assert expected == actual - - -def test_parse_challenge_path(): - expected = { - "project": "octopus", - "location": "oyster", - "uuid": "nudibranch", - } - path = ConfidentialComputingClient.challenge_path(**expected) - - # Check that the path construction is reversible. - actual = ConfidentialComputingClient.parse_challenge_path(path) - assert expected == actual - -def test_common_billing_account_path(): - billing_account = "cuttlefish" - expected = "billingAccounts/{billing_account}".format(billing_account=billing_account, ) - actual = ConfidentialComputingClient.common_billing_account_path(billing_account) - assert expected == actual - - -def test_parse_common_billing_account_path(): - expected = { - "billing_account": "mussel", - } - path = ConfidentialComputingClient.common_billing_account_path(**expected) - - # Check that the path construction is reversible. - actual = ConfidentialComputingClient.parse_common_billing_account_path(path) - assert expected == actual - -def test_common_folder_path(): - folder = "winkle" - expected = "folders/{folder}".format(folder=folder, ) - actual = ConfidentialComputingClient.common_folder_path(folder) - assert expected == actual - - -def test_parse_common_folder_path(): - expected = { - "folder": "nautilus", - } - path = ConfidentialComputingClient.common_folder_path(**expected) - - # Check that the path construction is reversible. - actual = ConfidentialComputingClient.parse_common_folder_path(path) - assert expected == actual - -def test_common_organization_path(): - organization = "scallop" - expected = "organizations/{organization}".format(organization=organization, ) - actual = ConfidentialComputingClient.common_organization_path(organization) - assert expected == actual - - -def test_parse_common_organization_path(): - expected = { - "organization": "abalone", - } - path = ConfidentialComputingClient.common_organization_path(**expected) - - # Check that the path construction is reversible. - actual = ConfidentialComputingClient.parse_common_organization_path(path) - assert expected == actual - -def test_common_project_path(): - project = "squid" - expected = "projects/{project}".format(project=project, ) - actual = ConfidentialComputingClient.common_project_path(project) - assert expected == actual - - -def test_parse_common_project_path(): - expected = { - "project": "clam", - } - path = ConfidentialComputingClient.common_project_path(**expected) - - # Check that the path construction is reversible. - actual = ConfidentialComputingClient.parse_common_project_path(path) - assert expected == actual - -def test_common_location_path(): - project = "whelk" - location = "octopus" - expected = "projects/{project}/locations/{location}".format(project=project, location=location, ) - actual = ConfidentialComputingClient.common_location_path(project, location) - assert expected == actual - - -def test_parse_common_location_path(): - expected = { - "project": "oyster", - "location": "nudibranch", - } - path = ConfidentialComputingClient.common_location_path(**expected) - - # Check that the path construction is reversible. - actual = ConfidentialComputingClient.parse_common_location_path(path) - assert expected == actual - - -def test_client_with_default_client_info(): - client_info = gapic_v1.client_info.ClientInfo() - - with mock.patch.object(transports.ConfidentialComputingTransport, '_prep_wrapped_messages') as prep: - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - client_info=client_info, - ) - prep.assert_called_once_with(client_info) - - with mock.patch.object(transports.ConfidentialComputingTransport, '_prep_wrapped_messages') as prep: - transport_class = ConfidentialComputingClient.get_transport_class() - transport = transport_class( - credentials=ga_credentials.AnonymousCredentials(), - client_info=client_info, - ) - prep.assert_called_once_with(client_info) - - -def test_list_locations(transport: str = "grpc"): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), transport=transport, - ) - - # Everything is optional in proto3 as far as the runtime is concerned, - # and we are mocking out the actual API, so just send an empty request. - request = locations_pb2.ListLocationsRequest() - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object(type(client.transport.list_locations), "__call__") as call: - # Designate an appropriate return value for the call. - call.return_value = locations_pb2.ListLocationsResponse() - response = client.list_locations(request) - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - assert args[0] == request - - # Establish that the response is the type that we expect. - assert isinstance(response, locations_pb2.ListLocationsResponse) -@pytest.mark.asyncio -async def test_list_locations_async(transport: str = "grpc_asyncio"): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), transport=transport, - ) - - # Everything is optional in proto3 as far as the runtime is concerned, - # and we are mocking out the actual API, so just send an empty request. - request = locations_pb2.ListLocationsRequest() - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object(type(client.transport.list_locations), "__call__") as call: - # Designate an appropriate return value for the call. - call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( - locations_pb2.ListLocationsResponse() - ) - response = await client.list_locations(request) - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - assert args[0] == request - - # Establish that the response is the type that we expect. - assert isinstance(response, locations_pb2.ListLocationsResponse) - -def test_list_locations_field_headers(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - ) - - # Any value that is part of the HTTP/1.1 URI should be sent as - # a field header. Set these to a non-empty value. - request = locations_pb2.ListLocationsRequest() - request.name = "locations" - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object(type(client.transport.list_locations), "__call__") as call: - call.return_value = locations_pb2.ListLocationsResponse() - - client.list_locations(request) - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - assert args[0] == request - - # Establish that the field header was sent. - _, _, kw = call.mock_calls[0] - assert ("x-goog-request-params", "name=locations",) in kw["metadata"] -@pytest.mark.asyncio -async def test_list_locations_field_headers_async(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - ) - - # Any value that is part of the HTTP/1.1 URI should be sent as - # a field header. Set these to a non-empty value. - request = locations_pb2.ListLocationsRequest() - request.name = "locations" - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object(type(client.transport.list_locations), "__call__") as call: - call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( - locations_pb2.ListLocationsResponse() - ) - await client.list_locations(request) - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - assert args[0] == request - - # Establish that the field header was sent. - _, _, kw = call.mock_calls[0] - assert ("x-goog-request-params", "name=locations",) in kw["metadata"] - -def test_list_locations_from_dict(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - ) - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object(type(client.transport.list_locations), "__call__") as call: - # Designate an appropriate return value for the call. - call.return_value = locations_pb2.ListLocationsResponse() - - response = client.list_locations( - request={ - "name": "locations", - } - ) - call.assert_called() -@pytest.mark.asyncio -async def test_list_locations_from_dict_async(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - ) - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object(type(client.transport.list_locations), "__call__") as call: - # Designate an appropriate return value for the call. - call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( - locations_pb2.ListLocationsResponse() - ) - response = await client.list_locations( - request={ - "name": "locations", - } - ) - call.assert_called() - - -def test_get_location(transport: str = "grpc"): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), transport=transport, - ) - - # Everything is optional in proto3 as far as the runtime is concerned, - # and we are mocking out the actual API, so just send an empty request. - request = locations_pb2.GetLocationRequest() - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object(type(client.transport.get_location), "__call__") as call: - # Designate an appropriate return value for the call. - call.return_value = locations_pb2.Location() - response = client.get_location(request) - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - assert args[0] == request - - # Establish that the response is the type that we expect. - assert isinstance(response, locations_pb2.Location) -@pytest.mark.asyncio -async def test_get_location_async(transport: str = "grpc_asyncio"): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), transport=transport, - ) - - # Everything is optional in proto3 as far as the runtime is concerned, - # and we are mocking out the actual API, so just send an empty request. - request = locations_pb2.GetLocationRequest() - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object(type(client.transport.get_location), "__call__") as call: - # Designate an appropriate return value for the call. - call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( - locations_pb2.Location() - ) - response = await client.get_location(request) - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - assert args[0] == request - - # Establish that the response is the type that we expect. - assert isinstance(response, locations_pb2.Location) - -def test_get_location_field_headers(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials()) - - # Any value that is part of the HTTP/1.1 URI should be sent as - # a field header. Set these to a non-empty value. - request = locations_pb2.GetLocationRequest() - request.name = "locations/abc" - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object(type(client.transport.get_location), "__call__") as call: - call.return_value = locations_pb2.Location() - - client.get_location(request) - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - assert args[0] == request - - # Establish that the field header was sent. - _, _, kw = call.mock_calls[0] - assert ("x-goog-request-params", "name=locations/abc",) in kw["metadata"] -@pytest.mark.asyncio -async def test_get_location_field_headers_async(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials() - ) - - # Any value that is part of the HTTP/1.1 URI should be sent as - # a field header. Set these to a non-empty value. - request = locations_pb2.GetLocationRequest() - request.name = "locations/abc" - - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object(type(client.transport.get_location), "__call__") as call: - call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( - locations_pb2.Location() - ) - await client.get_location(request) - # Establish that the underlying gRPC stub method was called. - assert len(call.mock_calls) == 1 - _, args, _ = call.mock_calls[0] - assert args[0] == request - - # Establish that the field header was sent. - _, _, kw = call.mock_calls[0] - assert ("x-goog-request-params", "name=locations/abc",) in kw["metadata"] - -def test_get_location_from_dict(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - ) - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object(type(client.transport.list_locations), "__call__") as call: - # Designate an appropriate return value for the call. - call.return_value = locations_pb2.Location() - - response = client.get_location( - request={ - "name": "locations/abc", - } - ) - call.assert_called() -@pytest.mark.asyncio -async def test_get_location_from_dict_async(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - ) - # Mock the actual call within the gRPC stub, and fake the request. - with mock.patch.object(type(client.transport.list_locations), "__call__") as call: - # Designate an appropriate return value for the call. - call.return_value = grpc_helpers_async.FakeUnaryUnaryCall( - locations_pb2.Location() - ) - response = await client.get_location( - request={ - "name": "locations", - } - ) - call.assert_called() - - -def test_transport_close_grpc(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="grpc" - ) - with mock.patch.object(type(getattr(client.transport, "_grpc_channel")), "close") as close: - with client: - close.assert_not_called() - close.assert_called_once() - - -@pytest.mark.asyncio -async def test_transport_close_grpc_asyncio(): - client = ConfidentialComputingAsyncClient( - credentials=async_anonymous_credentials(), - transport="grpc_asyncio" - ) - with mock.patch.object(type(getattr(client.transport, "_grpc_channel")), "close") as close: - async with client: - close.assert_not_called() - close.assert_called_once() - - -def test_transport_close_rest(): - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport="rest" - ) - with mock.patch.object(type(getattr(client.transport, "_session")), "close") as close: - with client: - close.assert_not_called() - close.assert_called_once() - - -def test_client_ctx(): - transports = [ - 'rest', - 'grpc', - ] - for transport in transports: - client = ConfidentialComputingClient( - credentials=ga_credentials.AnonymousCredentials(), - transport=transport - ) - # Test client calls underlying transport. - with mock.patch.object(type(client.transport), "close") as close: - close.assert_not_called() - with client: - pass - close.assert_called() - -@pytest.mark.parametrize("client_class,transport_class", [ - (ConfidentialComputingClient, transports.ConfidentialComputingGrpcTransport), - (ConfidentialComputingAsyncClient, transports.ConfidentialComputingGrpcAsyncIOTransport), -]) -def test_api_key_credentials(client_class, transport_class): - with mock.patch.object( - google.auth._default, "get_api_key_credentials", create=True - ) as get_api_key_credentials: - mock_cred = mock.Mock() - get_api_key_credentials.return_value = mock_cred - options = client_options.ClientOptions() - options.api_key = "api_key" - with mock.patch.object(transport_class, "__init__") as patched: - patched.return_value = None - client = client_class(client_options=options) - patched.assert_called_once_with( - credentials=mock_cred, - credentials_file=None, - host=client._DEFAULT_ENDPOINT_TEMPLATE.format(UNIVERSE_DOMAIN=client._DEFAULT_UNIVERSE), - scopes=None, - client_cert_source_for_mtls=None, - quota_project_id=None, - client_info=transports.base.DEFAULT_CLIENT_INFO, - always_use_jwt_access=True, - api_audience=None, - ) diff --git a/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/types/service.py b/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/types/service.py index 1a6ecaca8fe3..7193a179f4ec 100644 --- a/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/types/service.py +++ b/packages/google-cloud-confidentialcomputing/google/cloud/confidentialcomputing_v1/types/service.py @@ -877,8 +877,8 @@ class VerifyConfidentialGkeRequest(proto.Message): challenge (str): Required. The name of the Challenge whose nonce was used to generate the attestation, in the format - projects/\ */locations/*/challenges/*. The provided - Challenge will be consumed, and cannot be used again. + projects/*/locations/*/challenges/\*. The provided Challenge + will be consumed, and cannot be used again. """ tpm_attestation: "TpmAttestation" = proto.Field( diff --git a/packages/google-cloud-confidentialcomputing/noxfile.py b/packages/google-cloud-confidentialcomputing/noxfile.py index 7992e58a1ad0..357c2ed2ce63 100644 --- a/packages/google-cloud-confidentialcomputing/noxfile.py +++ b/packages/google-cloud-confidentialcomputing/noxfile.py @@ -365,9 +365,10 @@ def docs(session): "-T", # show full traceback on exception "-N", # no colors "-b", - "html", + "html", # builder "-d", - os.path.join("docs", "_build", "doctrees", ""), + os.path.join("docs", "_build", "doctrees", ""), # cache directory + # paths to build: os.path.join("docs", ""), os.path.join("docs", "_build", "html", ""), )