fix: do not use the GAE APIs on gen2+ runtimes (#807)
* fix: do not use the GAE APIs on gen2+ runtimes
Currently, this library uses the App Engine API in all environments if
it can be imported successfully. This assumption made sense when the API
was only available on gen1, but this is no longer the case.
See https://github.com/GoogleCloudPlatform/appengine-python-standard
In order to comply with AIP-4115, we must treat GAE gen2+ as a "compute
engine equivalent environment" even if the GAE APIs are importable.
In other words, google.auth.default() must never return an
app_engine.Credental on GAE gen2+.Currently, this library uses the App Engine API in all environments if
it can be imported successfully. This assumption made sense when the API
was only available on gen1, but this is no longer the case.
See https://github.com/GoogleCloudPlatform/appengine-python-standard
In order to comply with AIP-4115, we must treat GAE gen2+ as a "compute
engine equivalent environment" even if the GAE APIs are importable.
In other words, google.auth.default() should not return an
app_engine.Credental on GAE gen2+.
* blacken
Co-authored-by: arithmetic1728 <58957152+arithmetic1728@users.noreply.github.com>
diff --git a/tests/test_app_engine.py b/tests/test_app_engine.py
index e335ff7..6a788b9 100644
--- a/tests/test_app_engine.py
+++ b/tests/test_app_engine.py
@@ -52,6 +52,7 @@
assert app_engine.get_project_id() == mock.sentinel.project
+@mock.patch.object(app_engine, "app_identity", new=None)
def test_get_project_id_missing_apis():
with pytest.raises(EnvironmentError) as excinfo:
assert app_engine.get_project_id()
@@ -86,6 +87,7 @@
class TestCredentials(object):
+ @mock.patch.object(app_engine, "app_identity", new=None)
def test_missing_apis(self):
with pytest.raises(EnvironmentError) as excinfo:
app_engine.Credentials()