<?php

[0] Fix | Delete

/*

[1] Fix | Delete

* Copyright 2014 Google Inc.

[2] Fix | Delete

*

[3] Fix | Delete

* Licensed under the Apache License, Version 2.0 (the "License");

[4] Fix | Delete

* you may not use this file except in compliance with the License.

[5] Fix | Delete

* You may obtain a copy of the License at

[6] Fix | Delete

*

[7] Fix | Delete

* http://www.apache.org/licenses/LICENSE-2.0

[8] Fix | Delete

*

[9] Fix | Delete

* Unless required by applicable law or agreed to in writing, software

[10] Fix | Delete

* distributed under the License is distributed on an "AS IS" BASIS,

[11] Fix | Delete

* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

[12] Fix | Delete

* See the License for the specific language governing permissions and

[13] Fix | Delete

* limitations under the License.

[14] Fix | Delete

*/

[15] Fix | Delete

[16] Fix | Delete

if (!class_exists('UDP_Google_Client')) {

[17] Fix | Delete

require_once dirname(__FILE__) . '/../autoload.php';

[18] Fix | Delete

}

[19] Fix | Delete

[20] Fix | Delete

/**

[21] Fix | Delete

* Authentication via built-in Compute Engine service accounts.

[22] Fix | Delete

* The instance must be pre-configured with a service account

[23] Fix | Delete

* and the appropriate scopes.

[24] Fix | Delete

* @author Jonathan Parrott <jon.wayne.parrott@gmail.com>

[25] Fix | Delete

*/

[26] Fix | Delete

class Google_Auth_ComputeEngine extends Google_Auth_Abstract

[27] Fix | Delete

{

[28] Fix | Delete

const METADATA_AUTH_URL =

[29] Fix | Delete

'http://metadata/computeMetadata/v1/instance/service-accounts/default/token';

[30] Fix | Delete

private $client;

[31] Fix | Delete

private $token;

[32] Fix | Delete

[33] Fix | Delete

public function __construct(UDP_Google_Client $client, $config = null)

[34] Fix | Delete

{

[35] Fix | Delete

$this->client = $client;

[36] Fix | Delete

}

[37] Fix | Delete

[38] Fix | Delete

/**

[39] Fix | Delete

* Perform an authenticated / signed apiHttpRequest.

[40] Fix | Delete

* This function takes the apiHttpRequest, calls apiAuth->sign on it

[41] Fix | Delete

* (which can modify the request in what ever way fits the auth mechanism)

[42] Fix | Delete

* and then calls apiCurlIO::makeRequest on the signed request

[43] Fix | Delete

*

[44] Fix | Delete

* @param Google_Http_Request $request

[45] Fix | Delete

* @return Google_Http_Request The resulting HTTP response including the

[46] Fix | Delete

* responseHttpCode, responseHeaders and responseBody.

[47] Fix | Delete

*/

[48] Fix | Delete

public function authenticatedRequest(UDP_Google_Http_Request $request)

[49] Fix | Delete

{

[50] Fix | Delete

$request = $this->sign($request);

[51] Fix | Delete

return $this->client->getIo()->makeRequest($request);

[52] Fix | Delete

}

[53] Fix | Delete

[54] Fix | Delete

/**

[55] Fix | Delete

* @param string $token

[56] Fix | Delete

* @throws Google_Auth_Exception

[57] Fix | Delete

*/

[58] Fix | Delete

public function setAccessToken($token)

[59] Fix | Delete

{

[60] Fix | Delete

$token = json_decode($token, true);

[61] Fix | Delete

if ($token == null) {

[62] Fix | Delete

throw new Google_Auth_Exception('Could not json decode the token');

[63] Fix | Delete

}

[64] Fix | Delete

if (! isset($token['access_token'])) {

[65] Fix | Delete

throw new Google_Auth_Exception("Invalid token format");

[66] Fix | Delete

}

[67] Fix | Delete

$token['created'] = time();

[68] Fix | Delete

$this->token = $token;

[69] Fix | Delete

}

[70] Fix | Delete

[71] Fix | Delete

public function getAccessToken()

[72] Fix | Delete

{

[73] Fix | Delete

return json_encode($this->token);

[74] Fix | Delete

}

[75] Fix | Delete

[76] Fix | Delete

/**

[77] Fix | Delete

* Acquires a new access token from the compute engine metadata server.

[78] Fix | Delete

* @throws Google_Auth_Exception

[79] Fix | Delete

*/

[80] Fix | Delete

public function acquireAccessToken()

[81] Fix | Delete

{

[82] Fix | Delete

$request = new UDP_Google_Http_Request(

[83] Fix | Delete

self::METADATA_AUTH_URL,

[84] Fix | Delete

'GET',

[85] Fix | Delete

array(

[86] Fix | Delete

'Metadata-Flavor' => 'Google'

[87] Fix | Delete

)

[88] Fix | Delete

);

[89] Fix | Delete

$request->disableGzip();

[90] Fix | Delete

$response = $this->client->getIo()->makeRequest($request);

[91] Fix | Delete

[92] Fix | Delete

if ($response->getResponseHttpCode() == 200) {

[93] Fix | Delete

$this->setAccessToken($response->getResponseBody());

[94] Fix | Delete

$this->token['created'] = time();

[95] Fix | Delete

return $this->getAccessToken();

[96] Fix | Delete

} else {

[97] Fix | Delete

throw new Google_Auth_Exception(

[98] Fix | Delete

sprintf(

[99] Fix | Delete

"Error fetching service account access token, message: '%s'",

[100] Fix | Delete

$response->getResponseBody()

[101] Fix | Delete

),

[102] Fix | Delete

$response->getResponseHttpCode()

[103] Fix | Delete

);

[104] Fix | Delete

}

[105] Fix | Delete

}

[106] Fix | Delete

[107] Fix | Delete

/**

[108] Fix | Delete

* Include an accessToken in a given apiHttpRequest.

[109] Fix | Delete

* @param Google_Http_Request $request

[110] Fix | Delete

* @return Google_Http_Request

[111] Fix | Delete

* @throws Google_Auth_Exception

[112] Fix | Delete

*/

[113] Fix | Delete

public function sign(UDP_Google_Http_Request $request)

[114] Fix | Delete

{

[115] Fix | Delete

if ($this->isAccessTokenExpired()) {

[116] Fix | Delete

$this->acquireAccessToken();

[117] Fix | Delete

}

[118] Fix | Delete

[119] Fix | Delete

$this->client->getLogger()->debug('Compute engine service account authentication');

[120] Fix | Delete

[121] Fix | Delete

$request->setRequestHeaders(

[122] Fix | Delete

array('Authorization' => 'Bearer ' . $this->token['access_token'])

[123] Fix | Delete

);

[124] Fix | Delete

[125] Fix | Delete

return $request;

[126] Fix | Delete

}

[127] Fix | Delete

[128] Fix | Delete

/**

[129] Fix | Delete

* Returns if the access_token is expired.

[130] Fix | Delete

* @return bool Returns True if the access_token is expired.

[131] Fix | Delete

*/

[132] Fix | Delete

public function isAccessTokenExpired()

[133] Fix | Delete

{

[134] Fix | Delete

if (!$this->token || !isset($this->token['created'])) {

[135] Fix | Delete

return true;

[136] Fix | Delete

}

[137] Fix | Delete

[138] Fix | Delete

// If the token is set to expire in the next 30 seconds.

[139] Fix | Delete

$expired = ($this->token['created']

[140] Fix | Delete

+ ($this->token['expires_in'] - 30)) < time();

[141] Fix | Delete

[142] Fix | Delete

return $expired;

[143] Fix | Delete

}

[144] Fix | Delete

}

[145] Fix | Delete

[146] Fix | Delete