Adds funcs for json key from environment defaults

- adds support for path specified by an ENV var
- adds support for loading from a default path

lib/googleauth/service_account.rb

@@ -28,8 +28,10 @@
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 require 'googleauth/signet'
+require 'memoist'
 require 'multi_json'
 require 'openssl'
+require 'rbconfig'
 
 # Reads the private key and client email fields from service account JSON key.
 def read_json_key(json_key_io)
@@ -45,14 +47,56 @@ module Google
   module Auth
     # Authenticates requests using Google's Service Account credentials.
     #
-    # This class provides a simpler surface to the behavior in
+    # This class allows authorizing requests for service accounts directly
-    # Signet::OAuth2::Client.  It allows authorizing requests directly using
+    # from credentials from a json key file downloaded from the developer
-    # credentials from a json key file downloaded from the developer console
+    # console (via 'Generate new Json Key').
-    # (via 'Generate new Json Key').
     #
     # cf [Application Default Credentials](http://goo.gl/mkAHpZ)
     class ServiceAccountCredentials < Signet::OAuth2::Client
+      ENV_VAR = 'GOOGLE_APPLICATION_CREDENTIALS'
+      NOT_FOUND_PREFIX =
+        "Unable to read the credential file specified by #{ENV_VAR}"
       TOKEN_CRED_URI = 'https://www.googleapis.com/oauth2/v3/token'
+      WELL_KNOWN_PATH = 'gcloud/application_default_credentials.json'
+      WELL_KNOWN_PREFIX = 'Unable to read the default credential file'
+
+      class << self
+        extend Memoist
+
+        # determines if the current OS is windows
+        def windows?
+          RbConfig::CONFIG['host_os'] =~ /Windows|mswin/
+        end
+        memoize :windows?
+
+        # Creates an instance from the path specified in an environment
+        # variable.
+        #
+        # @param scope [string|array] the scope(s) to access
+        def from_env(scope)
+          return nil unless ENV.key?(ENV_VAR)
+          path = ENV[ENV_VAR]
+          fail 'file #{path} does not exist' unless File.exist?(path)
+          return new(scope, File.open(path))
+        rescue StandardError => e
+          raise "#{NOT_FOUND_PREFIX}: #{e}"
+        end
+
+        # Creates an instance from a well known path.
+        #
+        # @param scope [string|array] the scope(s) to access
+        def from_well_known_path(scope)
+          home_var = windows? ? 'APPDATA' : 'HOME'
+          root = ENV[home_var].nil? ? '' : ENV[home_var]
+          base = WELL_KNOWN_PATH
+          base = File.join('.config', base) unless windows?
+          path = File.join(root, base)
+          return nil unless File.exist?(path)
+          return new(scope, File.open(path))
+        rescue StandardError => e
+          raise "#{WELL_KNOWN_PREFIX}: #{e}"
+        end
+      end
 
       # Initializes a ServiceAccountCredentials.
       #

spec/googleauth/service_account_spec.rb

@@ -32,24 +32,20 @@ $LOAD_PATH.unshift(spec_dir)
 $LOAD_PATH.uniq!
 
 require 'apply_auth_examples'
+require 'fileutils'
 require 'googleauth/service_account'
 require 'jwt'
 require 'multi_json'
 require 'openssl'
 require 'spec_helper'
+require 'tmpdir'
 
 describe Google::Auth::ServiceAccountCredentials do
+  ServiceAccountCredentials = Google::Auth::ServiceAccountCredentials
+
   before(:example) do
     @key = OpenSSL::PKey::RSA.new(2048)
-    cred_json = {
+    @client = ServiceAccountCredentials.new(
-      private_key_id: 'a_private_key_id',
-      private_key: @key.to_pem,
-      client_email: 'app@developer.gserviceaccount.com',
-      client_id: 'app.apps.googleusercontent.com',
-      type: 'service_account'
-    }
-    cred_json_text = MultiJson.dump(cred_json)
-    @client = Google::Auth::ServiceAccountCredentials.new(
         'https://www.googleapis.com/auth/userinfo.profile',
         StringIO.new(cred_json_text))
   end
@@ -67,5 +63,81 @@ describe Google::Auth::ServiceAccountCredentials do
     end
   end
 
-  it_behaves_like 'apply/apply! are OK'
+  def cred_json_text
+    cred_json = {
+      private_key_id: 'a_private_key_id',
+      private_key: @key.to_pem,
+      client_email: 'app@developer.gserviceaccount.com',
+      client_id: 'app.apps.googleusercontent.com',
+      type: 'service_account'
+    }
+    MultiJson.dump(cred_json)
+  end
+
+  it_behaves_like 'apply/apply! are OK'
+
+  describe '#from_env' do
+    before(:example) do
+      @var_name = ServiceAccountCredentials::ENV_VAR
+      @orig = ENV[@var_name]
+      @scope = 'https://www.googleapis.com/auth/userinfo.profile'
+    end
+
+    after(:example) do
+      ENV[@var_name] = @orig unless @orig.nil?
+    end
+
+    it 'returns nil if the GOOGLE_APPLICATION_CREDENTIALS is unset' do
+      ENV.delete(@var_name) unless ENV[@var_name].nil?
+      expect(ServiceAccountCredentials.from_env(@scope)).to be_nil
+    end
+
+    it 'fails if the GOOGLE_APPLICATION_CREDENTIALS path does not exist' do
+      ENV.delete(@var_name) unless ENV[@var_name].nil?
+      expect(ServiceAccountCredentials.from_env(@scope)).to be_nil
+      Dir.mktmpdir do |dir|
+        key_path = File.join(dir, 'does-not-exist')
+        ENV[@var_name] = key_path
+        expect { sac.from_env(@scope) }.to raise_error
+      end
+    end
+
+    it 'succeeds when the GOOGLE_APPLICATION_CREDENTIALS file is valid' do
+      sac = ServiceAccountCredentials  # shortens name
+      Dir.mktmpdir do |dir|
+        key_path = File.join(dir, 'my_cert_file')
+        FileUtils.mkdir_p(File.dirname(key_path))
+        File.write(key_path, cred_json_text)
+        ENV[@var_name] = key_path
+        expect(sac.from_env(@scope)).to_not be_nil
+      end
+    end
+  end
+
+  describe '#from_well_known_path' do
+    before(:example) do
+      @home = ENV['HOME']
+      @scope = 'https://www.googleapis.com/auth/userinfo.profile'
+    end
+
+    after(:example) do
+      ENV['HOME'] = @home unless @home == ENV['HOME']
+    end
+
+    it 'is nil if no file exists' do
+      ENV['HOME'] = File.dirname(__FILE__)
+      expect(ServiceAccountCredentials.from_well_known_path(@scope)).to be_nil
+    end
+
+    it 'successfully loads the file when it is present' do
+      sac = ServiceAccountCredentials  # shortens name
+      Dir.mktmpdir do |dir|
+        key_path = File.join(dir, '.config', sac::WELL_KNOWN_PATH)
+        FileUtils.mkdir_p(File.dirname(key_path))
+        File.write(key_path, cred_json_text)
+        ENV['HOME'] = dir
+        expect(sac.from_well_known_path(@scope)).to_not be_nil
+      end
+    end
+  end
 end