feat: update to allow for 3PI credentials

google_auth_oauthlib/helpers.py

@@ -24,6 +24,7 @@
 import datetime
 import json
 
+from google.auth import external_account_authorized_user
 import google.oauth2.credentials
 import requests_oauthlib
 
@@ -125,14 +126,23 @@ def credentials_from_session(session, client_config=None):
             "There is no access token for this session, did you call " "fetch_token?"
         )
 
-    credentials = google.oauth2.credentials.Credentials(
-        session.token["access_token"],
-        refresh_token=session.token.get("refresh_token"),
-        id_token=session.token.get("id_token"),
-        token_uri=client_config.get("token_uri"),
-        client_id=client_config.get("client_id"),
-        client_secret=client_config.get("client_secret"),
-        scopes=session.scope,
-    )
+    if "3pi" in client_config:
+        credentials = external_account_authorized_user.Credentials(
+            token=session.token["access_token"],
+            refresh_token=session.token.get("refresh_token"),
+            token_url=client_config.get("token_uri"),
+            client_id=client_config.get("client_id"),
+            client_secret=client_config.get("client_secret"),
+        )
+    else:
+        credentials = google.oauth2.credentials.Credentials(
+            session.token["access_token"],
+            refresh_token=session.token.get("refresh_token"),
+            id_token=session.token.get("id_token"),
+            token_uri=client_config.get("token_uri"),
+            client_id=client_config.get("client_id"),
+            client_secret=client_config.get("client_secret"),
+            scopes=session.scope,
+        )
     credentials.expiry = datetime.datetime.utcfromtimestamp(session.token["expires_at"])
     return credentials

testing/constraints-3.6.txt

@@ -5,6 +5,6 @@
 #
 # e.g., if setup.py has "foo >= 1.14.0, < 2.0.0dev",
 # Then this file should have foo==1.14.0
-google-auth==1.0.0
+google-auth==2.13.0
 requests-oauthlib==0.7.0
-click==6.0.0
+click==6.0.0

testing/constraints-3.7.txt

@@ -5,6 +5,6 @@
 #
 # e.g., if setup.py has "foo >= 1.14.0, < 2.0.0dev",
 # Then this file should have foo==1.14.0
-google-auth==1.0.0
+google-auth==2.13.0
 requests-oauthlib==0.7.0
-click==6.0.0
+click==6.0.0

tests/unit/test_helpers.py

@@ -19,6 +19,8 @@
 import mock
 import pytest
 
+from google.auth import external_account_authorized_user
+import google.oauth2.credentials
 from google_auth_oauthlib import helpers
 
 DATA_DIR = os.path.join(os.path.dirname(__file__), "data")
@@ -85,6 +87,7 @@ def test_credentials_from_session(session):
 
     credentials = helpers.credentials_from_session(session, CLIENT_SECRETS_INFO["web"])
 
+    assert isinstance(credentials, google.oauth2.credentials.Credentials)
     assert credentials.token == mock.sentinel.access_token
     assert credentials.expiry == datetime.datetime(1990, 5, 29, 8, 20, 0)
     assert credentials._refresh_token == mock.sentinel.refresh_token
@@ -94,6 +97,27 @@ def test_credentials_from_session(session):
     assert credentials._token_uri == CLIENT_SECRETS_INFO["web"]["token_uri"]
 
 
+def test_credentials_from_session_3pi(session):
+    session.token = {
+        "access_token": mock.sentinel.access_token,
+        "refresh_token": mock.sentinel.refresh_token,
+        "id_token": mock.sentinel.id_token,
+        "expires_at": 643969200.0,
+    }
+
+    client_secrets_info = CLIENT_SECRETS_INFO["web"].copy()
+    client_secrets_info["3pi"] = True
+    credentials = helpers.credentials_from_session(session, client_secrets_info)
+
+    assert isinstance(credentials, external_account_authorized_user.Credentials)
+    assert credentials.token == mock.sentinel.access_token
+    assert credentials.expiry == datetime.datetime(1990, 5, 29, 8, 20, 0)
+    assert credentials._refresh_token == mock.sentinel.refresh_token
+    assert credentials._client_id == CLIENT_SECRETS_INFO["web"]["client_id"]
+    assert credentials._client_secret == CLIENT_SECRETS_INFO["web"]["client_secret"]
+    assert credentials._token_url == CLIENT_SECRETS_INFO["web"]["token_uri"]
+
+
 def test_bad_credentials(session):
     with pytest.raises(ValueError):
         helpers.credentials_from_session(session)