Skip to content

Commit be148ec

Browse files
mtravermtraver
committed
Add a new AppEngineTokenSource impl for 2nd gen App Engine runtimes
Go 1.11 on App Engine standard is a "second generation" runtime, and second generation runtimes do not set the appengine build tag. appengine_hook.go was behind the appengine build tag, meaning that AppEngineTokenSource panicked on the go111 runtime, saying, "AppEngineTokenSource can only be used on App Engine." The second gen runtimes should use ComputeTokenSource, which is also what flex does [1]. This commit does two things to remedy the situation: 1. Put the pre-existing implementation of AppEngineTokenSource behind the appengine build tag since it only works on first gen App Engine runtimes. This leaves first gen behavior unchanged. 2. Add a new implementation of AppEngineTokenSource and tag it !appengine. This implementation will therefore be used by second gen App Engine standard runtimes and App Engine flexible. It delegates to ComputeTokenSource. The new AppEngineTokenSource implementation emits a log message informing the user that AppEngineTokenSource is deprecated for second gen runtimes and flex, instructing them to use DefaultTokenSource or ComputeTokenSource instead. The documentation is updated to say the same. In this way users will not break when upgrading from Go 1.9 to Go 1.11 on App Engine but they will be nudged toward the world where App Engine runtimes have less special behavior. findDefaultCredentials still calls AppEngineTokenSource for first gen runtimes and ComputeTokenSource for flex. Fixes #334 Test: I deployed an app that uses AppEngineTokenSource to Go 1.9 and Go 1.11 on App Engine standard and to Go 1.11 on App Engine flexible and it worked in all cases. Also verified that the log message is present on go111 and flex. [1] DefaultTokenSource did use ComputeTokenSource for flex but AppEngineTokenSource did not. AppEngineTokenSource is supported on flex, in the sense that it doesn't panic when used on flex in the way it does when used outside App Engine. However, AppEngineTokenSource makes an API call internally that isn't supported by default on flex, which emits a log instructing the user to enable the compat runtime. The compat runtimes are deprecated and deploys are blocked. This is a bad experience. This commit has the side effect of fixing this.
1 parent 9dcd33a commit be148ec

File tree

8 files changed

+141
-106
lines changed

8 files changed

+141
-106
lines changed

‎google/appengine.go

Lines changed: 2 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -5,85 +5,13 @@
55
package google
66

77
import (
8-
"sort"
9-
"strings"
10-
"sync"
118
"time"
129

1310
"golang.org/x/net/context"
14-
"golang.org/x/oauth2"
1511
)
1612

17-
// appengineFlex is set at init time by appengineflex_hook.go. If true, we are on App Engine Flex.
18-
var appengineFlex bool
19-
20-
// Set at init time by appengine_hook.go. If nil, we're not on App Engine.
13+
// Set at init time by appengine_gen1.go. If nil, we're not on App Engine standard first generation (<= Go 1.9) or App Engine flexible.
2114
var appengineTokenFunc func(c context.Context, scopes ...string) (token string, expiry time.Time, err error)
2215

23-
// Set at init time by appengine_hook.go. If nil, we're not on App Engine.
16+
// Set at init time by appengine_gen1.go. If nil, we're not on App Engine standard first generation (<= Go 1.9) or App Engine flexible.
2417
var appengineAppIDFunc func(c context.Context) string
25-
26-
// AppEngineTokenSource returns a token source that fetches tokens
27-
// issued to the current App Engine application's service account.
28-
// If you are implementing a 3-legged OAuth 2.0 flow on App Engine
29-
// that involves user accounts, see oauth2.Config instead.
30-
//
31-
// The provided context must have come from appengine.NewContext.
32-
func AppEngineTokenSource(ctx context.Context, scope ...string) oauth2.TokenSource {
33-
if appengineTokenFunc == nil {
34-
panic("google: AppEngineTokenSource can only be used on App Engine.")
35-
}
36-
scopes := append([]string{}, scope...)
37-
sort.Strings(scopes)
38-
return &appEngineTokenSource{
39-
ctx: ctx,
40-
scopes: scopes,
41-
key: strings.Join(scopes, " "),
42-
}
43-
}
44-
45-
// aeTokens helps the fetched tokens to be reused until their expiration.
46-
var (
47-
aeTokensMu sync.Mutex
48-
aeTokens = make(map[string]*tokenLock) // key is space-separated scopes
49-
)
50-
51-
type tokenLock struct {
52-
mu sync.Mutex // guards t; held while fetching or updating t
53-
t *oauth2.Token
54-
}
55-
56-
type appEngineTokenSource struct {
57-
ctx context.Context
58-
scopes []string
59-
key string // to aeTokens map; space-separated scopes
60-
}
61-
62-
func (ts *appEngineTokenSource) Token() (*oauth2.Token, error) {
63-
if appengineTokenFunc == nil {
64-
panic("google: AppEngineTokenSource can only be used on App Engine.")
65-
}
66-
67-
aeTokensMu.Lock()
68-
tok, ok := aeTokens[ts.key]
69-
if !ok {
70-
tok = &tokenLock{}
71-
aeTokens[ts.key] = tok
72-
}
73-
aeTokensMu.Unlock()
74-
75-
tok.mu.Lock()
76-
defer tok.mu.Unlock()
77-
if tok.t.Valid() {
78-
return tok.t, nil
79-
}
80-
access, exp, err := appengineTokenFunc(ts.ctx, ts.scopes...)
81-
if err != nil {
82-
return nil, err
83-
}
84-
tok.t = &oauth2.Token{
85-
AccessToken: access,
86-
Expiry: exp,
87-
}
88-
return tok.t, nil
89-
}

‎google/appengine_gen1.go

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
// Copyright 2018 The Go Authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style
3+
// license that can be found in the LICENSE file.
4+
5+
// +build appengine
6+
7+
package google
8+
9+
import (
10+
"sort"
11+
"strings"
12+
"sync"
13+
14+
"golang.org/x/net/context"
15+
"golang.org/x/oauth2"
16+
"google.golang.org/appengine"
17+
)
18+
19+
func init() {
20+
appengineTokenFunc = appengine.AccessToken
21+
appengineAppIDFunc = appengine.AppID
22+
}
23+
24+
// AppEngineTokenSource returns a token source that fetches tokens from either
25+
// the current application's service account or from the metadata server,
26+
// depending on the App Engine environment. See below for environment-specific
27+
// details. If you are implementing a 3-legged OAuth 2.0 flow on App Engine that
28+
// involves user accounts, see oauth2.Config instead.
29+
//
30+
// First generation App Engine runtimes (<= Go 1.9):
31+
// AppEngineTokenSource returns a token source that fetches tokens issued to the
32+
// current App Engine application's service account. The provided context must have
33+
// come from appengine.NewContext.
34+
//
35+
// Second generation App Engine runtimes (>= Go 1.11) and App Engine flexible:
36+
// AppEngineTokenSource is DEPRECATED on second generation runtimes and on the
37+
// flexible environment. It delegates to ComputeTokenSource, and the provided
38+
// context and scopes are not used. Please use DefaultTokenSource (or ComputeTokenSource,
39+
// which DefaultTokenSource will use in this case) instead.
40+
func AppEngineTokenSource(ctx context.Context, scope ...string) oauth2.TokenSource {
41+
scopes := append([]string{}, scope...)
42+
sort.Strings(scopes)
43+
return &appEngineTokenSource{
44+
ctx: ctx,
45+
scopes: scopes,
46+
key: strings.Join(scopes, " "),
47+
}
48+
}
49+
50+
// aeTokens helps the fetched tokens to be reused until their expiration.
51+
var (
52+
aeTokensMu sync.Mutex
53+
aeTokens = make(map[string]*tokenLock) // key is space-separated scopes
54+
)
55+
56+
type tokenLock struct {
57+
mu sync.Mutex // guards t; held while fetching or updating t
58+
t *oauth2.Token
59+
}
60+
61+
type appEngineTokenSource struct {
62+
ctx context.Context
63+
scopes []string
64+
key string // to aeTokens map; space-separated scopes
65+
}
66+
67+
func (ts *appEngineTokenSource) Token() (*oauth2.Token, error) {
68+
aeTokensMu.Lock()
69+
tok, ok := aeTokens[ts.key]
70+
if !ok {
71+
tok = &tokenLock{}
72+
aeTokens[ts.key] = tok
73+
}
74+
aeTokensMu.Unlock()
75+
76+
tok.mu.Lock()
77+
defer tok.mu.Unlock()
78+
if tok.t.Valid() {
79+
return tok.t, nil
80+
}
81+
access, exp, err := appengineTokenFunc(ts.ctx, ts.scopes...)
82+
if err != nil {
83+
return nil, err
84+
}
85+
tok.t = &oauth2.Token{
86+
AccessToken: access,
87+
Expiry: exp,
88+
}
89+
return tok.t, nil
90+
}

‎google/appengine_gen2_flex.go

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
// Copyright 2018 The Go Authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style
3+
// license that can be found in the LICENSE file.
4+
5+
// +build !appengine
6+
7+
package google
8+
9+
import (
10+
"log"
11+
12+
"golang.org/x/net/context"
13+
"golang.org/x/oauth2"
14+
)
15+
16+
// AppEngineTokenSource returns a token source that fetches tokens from either
17+
// the current application's service account or from the metadata server,
18+
// depending on the App Engine environment. See below for environment-specific
19+
// details. If you are implementing a 3-legged OAuth 2.0 flow on App Engine that
20+
// involves user accounts, see oauth2.Config instead.
21+
//
22+
// First generation App Engine runtimes (<= Go 1.9):
23+
// AppEngineTokenSource returns a token source that fetches tokens issued to the
24+
// current App Engine application's service account. The provided context must have
25+
// come from appengine.NewContext.
26+
//
27+
// Second generation App Engine runtimes (>= Go 1.11) and App Engine flexible:
28+
// AppEngineTokenSource is DEPRECATED on second generation runtimes and on the
29+
// flexible environment. It delegates to ComputeTokenSource, and the provided
30+
// context and scopes are not used. Please use DefaultTokenSource (or ComputeTokenSource,
31+
// which DefaultTokenSource will use in this case) instead.
32+
func AppEngineTokenSource(ctx context.Context, scope ...string) oauth2.TokenSource {
33+
log.Print("google: AppEngineTokenSource is deprecated on App Engine standard second generation runtimes (>= Go 1.11) and App Engine flexible. Please use DefaultTokenSource or ComputeTokenSource.")
34+
return ComputeTokenSource("")
35+
}

‎google/appengine_hook.go

Lines changed: 0 additions & 14 deletions
This file was deleted.

‎google/appengineflex_hook.go

Lines changed: 0 additions & 11 deletions
This file was deleted.

‎google/default.go

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -59,15 +59,18 @@ func findDefaultCredentials(ctx context.Context, scopes []string) (*DefaultCrede
5959
return nil, fmt.Errorf("google: error getting credentials using well-known file (%v): %v", filename, err)
6060
}
6161

62-
// Third, if we're on Google App Engine use those credentials.
63-
if appengineTokenFunc != nil && !appengineFlex {
62+
// Third, if we're on a Google App Engine standard first generation runtime (<= Go 1.9)
63+
// use those credentials. App Engine standard second generation runtimes (>= Go 1.11)
64+
// and App Engine flexible use ComputeTokenSource and the metadata server.
65+
if appengineTokenFunc != nil {
6466
return &DefaultCredentials{
6567
ProjectID: appengineAppIDFunc(ctx),
6668
TokenSource: AppEngineTokenSource(ctx, scopes...),
6769
}, nil
6870
}
6971

70-
// Fourth, if we're on Google Compute Engine use the metadata server.
72+
// Fourth, if we're on Google Compute Engine, an App Engine standard second generation runtime,
73+
// or App Engine flexible, use the metadata server.
7174
if metadata.OnGCE() {
7275
id, _ := metadata.ProjectID()
7376
return &DefaultCredentials{

‎google/go19.go

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,10 @@ type DefaultCredentials = Credentials
4040
// 2. A JSON file in a location known to the gcloud command-line tool.
4141
// On Windows, this is %APPDATA%/gcloud/application_default_credentials.json.
4242
// On other systems, $HOME/.config/gcloud/application_default_credentials.json.
43-
// 3. On Google App Engine it uses the appengine.AccessToken function.
44-
// 4. On Google Compute Engine and Google App Engine Managed VMs, it fetches
43+
// 3. On Google App Engine standard first generation runtimes (<= Go 1.9) it uses
44+
// the appengine.AccessToken function.
45+
// 4. On Google Compute Engine, Google App Engine standard second generation runtimes
46+
// (>= Go 1.11), and Google App Engine flexible environment, it fetches
4547
// credentials from the metadata server.
4648
// (In this final case any provided scopes are ignored.)
4749
func FindDefaultCredentials(ctx context.Context, scopes ...string) (*Credentials, error) {

‎google/not_go19.go

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,8 +35,10 @@ type DefaultCredentials struct {
3535
// 2. A JSON file in a location known to the gcloud command-line tool.
3636
// On Windows, this is %APPDATA%/gcloud/application_default_credentials.json.
3737
// On other systems, $HOME/.config/gcloud/application_default_credentials.json.
38-
// 3. On Google App Engine it uses the appengine.AccessToken function.
39-
// 4. On Google Compute Engine and Google App Engine Managed VMs, it fetches
38+
// 3. On Google App Engine standard first generation runtimes (<= Go 1.9) it uses
39+
// the appengine.AccessToken function.
40+
// 4. On Google Compute Engine, Google App Engine standard second generation runtimes
41+
// (>= Go 1.11), and Google App Engine flexible environment, it fetches
4042
// credentials from the metadata server.
4143
// (In this final case any provided scopes are ignored.)
4244
func FindDefaultCredentials(ctx context.Context, scopes ...string) (*DefaultCredentials, error) {

0 commit comments

Comments
 (0)