Fix clock skew calculations (#158)
Previously, the clock skew adjusted in the wrong direction. It would cause us to consider credentials whose expiration time had already pass according to the system clock to still be sent to the server. This is the opposite of what we wanted to happen. This fixes it so that we report that credentials are expired slightly before the system clock thinks they've expired.
diff --git a/google/auth/credentials.py b/google/auth/credentials.py
index 6fb89d8..74d6788 100644
--- a/google/auth/credentials.py
+++ b/google/auth/credentials.py
@@ -56,10 +56,13 @@
Note that credentials can be invalid but not expired becaue Credentials
with :attr:`expiry` set to None is considered to never expire.
"""
- # Err on the side of reporting expiration early so that we avoid
- # the 403-refresh-retry loop.
- adjusted_now = _helpers.utcnow() - _helpers.CLOCK_SKEW
- return self.expiry is not None and self.expiry <= adjusted_now
+ if not self.expiry:
+ return False
+
+ # Remove 5 minutes from expiry to err on the side of reporting
+ # expiration early so that we avoid the 401-refresh-retry loop.
+ skewed_expiry = self.expiry - _helpers.CLOCK_SKEW
+ return _helpers.utcnow() >= skewed_expiry
@property
def valid(self):