python-gae-api-oauth-no-servie-account

readme.md

Running Google API locally

For some functions (for now, copying files in GCS), we use Google API client library https://developers.google.com/api-client-library/python/.

For API authorization, we use the simplest way - Application Default Credentials

** See https://developers.google.com/identity/protocols/application-default-credentials to get full info about Application Default Credentials**.

In 2 words:

On App Engine API is authorized automatically.

To run API from local machine, install gcloud tool (https://cloud.google.com/sdk), open Google Cloud SDK shell and run

gcloud beta auth application-default login

Or you can download JSON file with service account keys at https://console.developers.google.com/project/_/apis/credentials and set a path to this file to environment variable GOOGLE_APPLICATION_CREDENTIALS like (Windows example):

set "GOOGLE_APPLICATION_CREDENTIALS=C:\path\to\key-file.json"

api.py

'''
code is taken from
https://github.com/GoogleCloudPlatform/storage-file-transfer-json-python
'''
from server.settings import current_environment as env
from server.errors import InternalError

import httplib2
from apiclient.discovery import build as discovery_build
from oauth2client.file import Storage as CredentialStorage


__all__ = ['copy_file']



def get_client():
    credential_storage = CredentialStorage(env.OAUTH_CREDENTIALS_FILE)
    credentials = credential_storage.get()
    if credentials is None or credentials.invalid:
        raise InternalError('Oauth credentials file is lost or broken')
    http = credentials.authorize(httplib2.Http())
    return discovery_build('storage', 'v1', http=http)


def copy_file(src_filename, dest_filename):
    '''
    API from https://cloud.google.com/storage/docs/json_api/v1/objects/copy
    '''
    req = get_client().objects().copy(
            sourceBucket=env.GCS_BUCKET,
            sourceObject=src_filename,
            destinationBucket=env.GCS_BUCKET,
            destinationObject=dest_filename,
            body={})
    return req.execute()

client_secrets_dev.json

{
  "installed": {
    "client_id": "<ID>",
    "client_secret": "<SECRET>",
    "redirect_uris": [],
    "auth_uri": "https://accounts.google.com/o/oauth2/auth",
    "token_uri": "https://accounts.google.com/o/oauth2/token"
  }
}

generate-oauth-credentials-from-client-secret.py

''' this file is used for generating oauth-credentials.json
    from OAUTH client ID and secret
    Note: this function is only for one-time dev use!

    See https://github.com/GoogleCloudPlatform/storage-file-transfer-json-python

    Run file with python interpreter: python generate-credentials.py
'''
import os

from oauth2client.file import Storage as CredentialStorage
from oauth2client.client import flow_from_clientsecrets
from oauth2client.tools import run_flow as run_oauth2

# JSON containing OAuth client ID and secret
# ID and secret can be get from cloud console -> API credentials manager
CLIENT_SECRETS_FILE = os.path.realpath(os.path.join(os.path.dirname(__file__), 'client_secrets_dev.json'))
SCOPE = 'https://www.googleapis.com/auth/devstorage.read_write'

OUTPUT_OAUTH_CREDENTIALS_FILE = os.path.realpath(os.path.join(os.path.dirname(__file__), 'oauth-credentials.json'))

def main():
    credential_storage = CredentialStorage(OUTPUT_OAUTH_CREDENTIALS_FILE)
    flow = flow_from_clientsecrets(CLIENT_SECRETS_FILE, scope=SCOPE)
    run_oauth2(flow, credential_storage)
    print 'Generated credentials file ' + OUTPUT_OAUTH_CREDENTIALS_FILE

if __name__ == '__main__':
    main()