chore(migration): Migrate code from googleapis/google-auth-library-python into packages/google-auth

[parthea]

See #14908.

This PR should be merged with a merge-commit, not a squash-commit, in order to preserve the git history.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request focuses on migrating the google-auth library's codebase from its original repository into a new package structure. It includes significant additions to the project's configuration, testing, and continuous integration infrastructure, particularly with Kokoro. The goal is to reorganize the codebase and set up a robust automated testing environment.

Highlights

• Code Migration: Migrated code from the googleapis/google-auth-library-python repository into the packages/google-auth directory.
• New Files: Added several new configuration files, including .coveragerc, .flake8, .github/CODEOWNERS, .github/CONTRIBUTING.md, and various .kokoro/ and .github/workflows/ files.
• Testing Infrastructure: Introduced a unittest workflow and various scripts for building and testing the library, particularly focusing on system tests and samples.
• Kokoro Integration: Added Kokoro build configurations and scripts to automate testing and deployment processes.

Changelog

• packages/google-auth/.coveragerc
  • Added coverage configuration file.
• packages/google-auth/.flake8
  • Added flake8 configuration file.
• packages/google-auth/.github/CODEOWNERS
  • Added code owners file to define team responsibilities.
• packages/google-auth/.github/CONTRIBUTING.md
  • Added contributing guidelines.
• packages/google-auth/.github/ISSUE_TEMPLATE/bug_report.md
  • Added bug report issue template.
• packages/google-auth/.github/ISSUE_TEMPLATE/feature_request.md
  • Added feature request issue template.
• packages/google-auth/.github/ISSUE_TEMPLATE/support_request.md
  • Added support request issue template.
• packages/google-auth/.github/workflows/unittest.yml
  • Added unittest workflow configuration for GitHub Actions.
• packages/google-auth/.gitignore
  • Added git ignore file.
• packages/google-auth/.kokoro/*
  • Added Kokoro build and test configurations.
• packages/google-auth/.librarian/state.yaml
  • Added librarian state file.
• packages/google-auth/.readthedocs.yaml
  • Added readthedocs configuration file.
• packages/google-auth/.repo-metadata.json
  • Added repository metadata file.
• packages/google-auth/.trampolinerc
  • Added trampoline configuration file.
• packages/google-auth/CODE_OF_CONDUCT.md
  • Added code of conduct file.
• packages/google-auth/CONTRIBUTING.rst
  • Added contributing instructions.
• packages/google-auth/CONTRIBUTORS.md
  • Added contributors list.
• packages/google-auth/LICENSE
  • Added license file.
• packages/google-auth/MANIFEST.in
  • Added manifest file.
• packages/google-auth/README.rst
  • Added readme file.
• packages/google-auth/SECURITY.md
  • Added security policy file.
• packages/google-auth/docs/*
  • Added documentation files.
• packages/google-auth/google/auth/*
  • Added google auth package files.

Activity

• The pull request migrates code from googleapis/google-auth-library-python into packages/google-auth.
• The pull request includes a merge-commit to preserve git history.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This PR migrates the google-auth-library-python into this repository. The changes are extensive, consisting of adding many new files. My review focused on configuration files and core authentication logic. I've identified a few areas for improvement, including a redundant configuration in Kokoro files, some leftover code from previous versions, and potential issues in the asynchronous credential handling logic.

Specifically, I've noted a discrepancy in feature support between the synchronous and asynchronous default() credential loaders in google.auth._default.py and google.auth._default_async.py respectively. The async version appears to support fewer credential types from files. Also, there are potential bugs in how async credential refreshes are handled in google.auth.aio.transport.sessions.py and google.auth.transport._aiohttp_requests.py. Please see my detailed comments for more information.

I am having trouble creating individual review comments. Click here to see my feedback.

packages/google-auth/google/auth/transport/_aiohttp_requests.py (379-381)

self._loop.run_in_executor is used to call self.credentials.refresh. This is correct for synchronous refresh methods, but it will fail if refresh is an async coroutine function. The credentials object can have either a sync or async refresh method. You should check if self.credentials.refresh is a coroutine and await it directly if it is, similar to the logic in google.auth._credentials_async.Credentials.before_request.

packages/google-auth/google/auth/aio/transport/sessions.py (298-299)

The retry loop in AsyncAuthorizedSession.request only considers DEFAULT_RETRYABLE_STATUS_CODES, which typically includes server errors (5xx) but not authentication errors like 401 Unauthorized. The synchronous requests.AuthorizedSession and the older async version in _aiohttp_requests.py include logic to refresh credentials upon receiving a 401 status and retry the request. This implementation seems to be missing that crucial feature, which could lead to authentication failures when an access token expires during the session's lifetime.

packages/google-auth/.kokoro/samples/lint/common.cfg (31-34)

The environment variable TRAMPOLINE_BUILD_FILE is defined twice in this file. The second definition on line 36 overrides this one, making it redundant. You can remove this block. This pattern is repeated in several other Kokoro configuration files in this pull request.

packages/google-auth/google/auth/init.py (35-41)

The Python37DeprecationWarning class is defined but never used. The code warns for Python 3.8 and 3.9, but not 3.7. Since Python 3.7 is no longer supported (as stated in README.rst), this class appears to be a leftover and can be removed to improve code clarity.

packages/google-auth/google/auth/identity_pool.py (179-181)

The error message "The leaf certificate must be at the top of the trust chain file" could be more precise. The logic allows the leaf certificate to be absent from the trust chain file. The error is raised only if the leaf certificate is present but not at the beginning of the file. Consider clarifying the error message, for example: "The leaf certificate, if present in the trust chain file, must be the first certificate."

                raise exceptions.RefreshError(
                    "The leaf certificate, if present in the trust chain file, must be the first certificate."
                )

[parthea]

Current failure

nox > pytest --junitxml=system_service_account_sync-3.10_sponge_log.xml system_tests_sync/test_service_account.py
INTERNALERROR> Traceback (most recent call last):
INTERNALERROR>   File "/tmpfs/src/github/google-cloud-python/packages/google-auth/system_tests/.nox/service_account_sync-3-10/lib/python3.10/site-packages/_pytest/main.py", line 314, in wrap_session
INTERNALERROR>     config._do_configure()
INTERNALERROR>   File "/tmpfs/src/github/google-cloud-python/packages/google-auth/system_tests/.nox/service_account_sync-3-10/lib/python3.10/site-packages/_pytest/config/__init__.py", line 1159, in _do_configure
INTERNALERROR>     self.hook.pytest_configure.call_historic(kwargs=dict(config=self))
INTERNALERROR>   File "/tmpfs/src/github/google-cloud-python/packages/google-auth/system_tests/.nox/service_account_sync-3-10/lib/python3.10/site-packages/pluggy/_hooks.py", line 534, in call_historic
INTERNALERROR>     res = self._hookexec(self.name, self._hookimpls.copy(), kwargs, False)
INTERNALERROR>   File "/tmpfs/src/github/google-cloud-python/packages/google-auth/system_tests/.nox/service_account_sync-3-10/lib/python3.10/site-packages/pluggy/_manager.py", line 120, in _hookexec
INTERNALERROR>     return self._inner_hookexec(hook_name, methods, kwargs, firstresult)
INTERNALERROR>   File "/tmpfs/src/github/google-cloud-python/packages/google-auth/system_tests/.nox/service_account_sync-3-10/lib/python3.10/site-packages/pluggy/_callers.py", line 167, in _multicall
INTERNALERROR>     raise exception
INTERNALERROR>   File "/tmpfs/src/github/google-cloud-python/packages/google-auth/system_tests/.nox/service_account_sync-3-10/lib/python3.10/site-packages/pluggy/_callers.py", line 121, in _multicall
INTERNALERROR>     res = hook_impl.function(*args)
INTERNALERROR>   File "/tmpfs/src/github/google-cloud-python/packages/google-auth/system_tests/system_tests_sync/conftest.py", line 141, in pytest_configure
INTERNALERROR>     verify_environment()
INTERNALERROR>   File "/tmpfs/src/github/google-cloud-python/packages/google-auth/system_tests/system_tests_sync/conftest.py", line 133, in verify_environment
INTERNALERROR>     raise EnvironmentError(
INTERNALERROR> OSError: In order to run system tests, test data must exist in system_tests/data. See CONTRIBUTING.rst for details.