fix: add back python 2.7 for gcloud usage only (#892)

* fix: add back python 2.7 for gcloud

* fix: fix setup and tests

* fix: add enum34 for python 2.7

* fix: add app engine app and fix noxfile

* fix: move test_app_engine.py

* fix: fix downscoped

* fix: fix downscoped

* fix: remove py2 from classifiers
diff --git a/google/oauth2/_client.py b/google/oauth2/_client.py
index f819371..2f4e847 100644
--- a/google/oauth2/_client.py
+++ b/google/oauth2/_client.py
@@ -24,9 +24,11 @@
 """
 
 import datetime
-import http.client
 import json
-import urllib
+
+import six
+from six.moves import http_client
+from six.moves import urllib
 
 from google.auth import _helpers
 from google.auth import exceptions
@@ -118,7 +120,7 @@
         )
         response_data = json.loads(response_body)
 
-        if response.status == http.client.OK:
+        if response.status == http_client.OK:
             break
         else:
             error_desc = response_data.get("error_description") or ""
@@ -129,9 +131,9 @@
             ):
                 retry += 1
                 continue
-            return response.status == http.client.OK, response_data
+            return response.status == http_client.OK, response_data
 
-    return response.status == http.client.OK, response_data
+    return response.status == http_client.OK, response_data
 
 
 def _token_endpoint_request(
@@ -194,7 +196,7 @@
         access_token = response_data["access_token"]
     except KeyError as caught_exc:
         new_exc = exceptions.RefreshError("No access token in response.", response_data)
-        raise new_exc from caught_exc
+        six.raise_from(new_exc, caught_exc)
 
     expiry = _parse_expiry(response_data)
 
@@ -234,7 +236,7 @@
         id_token = response_data["id_token"]
     except KeyError as caught_exc:
         new_exc = exceptions.RefreshError("No ID token in response.", response_data)
-        raise new_exc from caught_exc
+        six.raise_from(new_exc, caught_exc)
 
     payload = jwt.decode(id_token, verify=False)
     expiry = datetime.datetime.utcfromtimestamp(payload["exp"])
@@ -263,7 +265,7 @@
         access_token = response_data["access_token"]
     except KeyError as caught_exc:
         new_exc = exceptions.RefreshError("No access token in response.", response_data)
-        raise new_exc from caught_exc
+        six.raise_from(new_exc, caught_exc)
 
     refresh_token = response_data.get("refresh_token", refresh_token)
     expiry = _parse_expiry(response_data)
diff --git a/google/oauth2/_client_async.py b/google/oauth2/_client_async.py
index 8849023..cf51211 100644
--- a/google/oauth2/_client_async.py
+++ b/google/oauth2/_client_async.py
@@ -24,9 +24,11 @@
 """
 
 import datetime
-import http.client
 import json
-import urllib
+
+import six
+from six.moves import http_client
+from six.moves import urllib
 
 from google.auth import exceptions
 from google.auth import jwt
@@ -83,7 +85,7 @@
 
         response_data = json.loads(response_body)
 
-        if response.status == http.client.OK:
+        if response.status == http_client.OK:
             break
         else:
             error_desc = response_data.get("error_description") or ""
@@ -94,9 +96,9 @@
             ):
                 retry += 1
                 continue
-            return response.status == http.client.OK, response_data
+            return response.status == http_client.OK, response_data
 
-    return response.status == http.client.OK, response_data
+    return response.status == http_client.OK, response_data
 
 
 async def _token_endpoint_request(
@@ -159,7 +161,7 @@
         access_token = response_data["access_token"]
     except KeyError as caught_exc:
         new_exc = exceptions.RefreshError("No access token in response.", response_data)
-        raise new_exc from caught_exc
+        six.raise_from(new_exc, caught_exc)
 
     expiry = client._parse_expiry(response_data)
 
@@ -199,7 +201,7 @@
         id_token = response_data["id_token"]
     except KeyError as caught_exc:
         new_exc = exceptions.RefreshError("No ID token in response.", response_data)
-        raise new_exc from caught_exc
+        six.raise_from(new_exc, caught_exc)
 
     payload = jwt.decode(id_token, verify=False)
     expiry = datetime.datetime.utcfromtimestamp(payload["exp"])
diff --git a/google/oauth2/_id_token_async.py b/google/oauth2/_id_token_async.py
index a4a526d..31fcbc6 100644
--- a/google/oauth2/_id_token_async.py
+++ b/google/oauth2/_id_token_async.py
@@ -58,10 +58,12 @@
 .. _CacheControl: https://cachecontrol.readthedocs.io
 """
 
-import http.client
 import json
 import os
 
+import six
+from six.moves import http_client
+
 from google.auth import environment_vars
 from google.auth import exceptions
 from google.auth import jwt
@@ -86,7 +88,7 @@
     """
     response = await request(certs_url, method="GET")
 
-    if response.status != http.client.OK:
+    if response.status != http_client.OK:
         raise exceptions.TransportError(
             "Could not fetch certificates at {}".format(certs_url)
         )
@@ -241,7 +243,7 @@
                 "GOOGLE_APPLICATION_CREDENTIALS is not valid service account credentials.",
                 caught_exc,
             )
-            raise new_exc from caught_exc
+            six.raise_from(new_exc, caught_exc)
 
     # 2. Try to fetch ID token from metada server if it exists. The code works
     # for GAE and Cloud Run metadata server as well.
diff --git a/google/oauth2/_reauth_async.py b/google/oauth2/_reauth_async.py
index f74f50b..0276ddd 100644
--- a/google/oauth2/_reauth_async.py
+++ b/google/oauth2/_reauth_async.py
@@ -34,6 +34,8 @@
 
 import sys
 
+from six.moves import range
+
 from google.auth import exceptions
 from google.oauth2 import _client
 from google.oauth2 import _client_async
diff --git a/google/oauth2/challenges.py b/google/oauth2/challenges.py
index 0baff62..95e76cb 100644
--- a/google/oauth2/challenges.py
+++ b/google/oauth2/challenges.py
@@ -20,6 +20,8 @@
 import getpass
 import sys
 
+import six
+
 from google.auth import _helpers
 from google.auth import exceptions
 
@@ -45,7 +47,8 @@
     return getpass.getpass(text)
 
 
-class ReauthChallenge(object, metaclass=abc.ABCMeta):
+@six.add_metaclass(abc.ABCMeta)
+class ReauthChallenge(object):
     """Base class for reauth challenges."""
 
     @property
diff --git a/google/oauth2/credentials.py b/google/oauth2/credentials.py
index 6d34edf..9b59f8c 100644
--- a/google/oauth2/credentials.py
+++ b/google/oauth2/credentials.py
@@ -35,6 +35,8 @@
 import io
 import json
 
+import six
+
 from google.auth import _cloud_sdk
 from google.auth import _helpers
 from google.auth import credentials
@@ -262,7 +264,7 @@
         if self._refresh_token is None and self.refresh_handler:
             token, expiry = self.refresh_handler(request, scopes=scopes)
             # Validate returned data.
-            if not isinstance(token, str):
+            if not isinstance(token, six.string_types):
                 raise exceptions.RefreshError(
                     "The refresh_handler returned token is not a string."
                 )
@@ -344,7 +346,7 @@
             ValueError: If the info is not in the expected format.
         """
         keys_needed = set(("refresh_token", "client_id", "client_secret"))
-        missing = keys_needed.difference(info)
+        missing = keys_needed.difference(six.iterkeys(info))
 
         if missing:
             raise ValueError(
@@ -364,7 +366,7 @@
         # process scopes, which needs to be a seq
         if scopes is None and "scopes" in info:
             scopes = info.get("scopes")
-            if isinstance(scopes, str):
+            if isinstance(scopes, six.string_types):
                 scopes = scopes.split(" ")
 
         return cls(
diff --git a/google/oauth2/id_token.py b/google/oauth2/id_token.py
index 25492ca..8d0f85a 100644
--- a/google/oauth2/id_token.py
+++ b/google/oauth2/id_token.py
@@ -55,10 +55,12 @@
 .. _CacheControl: https://cachecontrol.readthedocs.io
 """
 
-import http.client
 import json
 import os
 
+import six
+from six.moves import http_client
+
 from google.auth import environment_vars
 from google.auth import exceptions
 from google.auth import jwt
@@ -95,7 +97,7 @@
     """
     response = request(certs_url, method="GET")
 
-    if response.status != http.client.OK:
+    if response.status != http_client.OK:
         raise exceptions.TransportError(
             "Could not fetch certificates at {}".format(certs_url)
         )
@@ -240,7 +242,7 @@
                 "GOOGLE_APPLICATION_CREDENTIALS is not valid service account credentials.",
                 caught_exc,
             )
-            raise new_exc from caught_exc
+            six.raise_from(new_exc, caught_exc)
 
     # 2. Try to fetch ID token from metada server if it exists. The code
     # works for GAE and Cloud Run metadata server as well.
diff --git a/google/oauth2/reauth.py b/google/oauth2/reauth.py
index 1e496d1..cbf1d7f 100644
--- a/google/oauth2/reauth.py
+++ b/google/oauth2/reauth.py
@@ -34,6 +34,8 @@
 
 import sys
 
+from six.moves import range
+
 from google.auth import exceptions
 from google.oauth2 import _client
 from google.oauth2 import challenges
diff --git a/google/oauth2/sts.py b/google/oauth2/sts.py
index 9f2d68a..ae3c014 100644
--- a/google/oauth2/sts.py
+++ b/google/oauth2/sts.py
@@ -31,9 +31,10 @@
 .. _rfc8693 section 2.2.1: https://tools.ietf.org/html/rfc8693#section-2.2.1
 """
 
-import http.client
 import json
-import urllib
+
+from six.moves import http_client
+from six.moves import urllib
 
 from google.oauth2 import utils
 
@@ -145,7 +146,7 @@
         )
 
         # If non-200 response received, translate to OAuthError exception.
-        if response.status != http.client.OK:
+        if response.status != http_client.OK:
             utils.handle_error_response(response_body)
 
         response_data = json.loads(response_body)
diff --git a/google/oauth2/utils.py b/google/oauth2/utils.py
index c57833d..593f032 100644
--- a/google/oauth2/utils.py
+++ b/google/oauth2/utils.py
@@ -45,6 +45,8 @@
 import enum
 import json
 
+import six
+
 from google.auth import exceptions
 
 
@@ -75,7 +77,8 @@
         self.client_secret = client_secret
 
 
-class OAuthClientAuthHandler(object, metaclass=abc.ABCMeta):
+@six.add_metaclass(abc.ABCMeta)
+class OAuthClientAuthHandler(object):
     """Abstract class for handling client authentication in OAuth-based
     operations.
     """