blob: 5146b0317c164ba4c97611a534d1a33a5b3f90f4 [file] [log] [blame]
# Copyright 2017 The Chromium Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
"""**[DEPRECATED]** API for generating OAuth2 access tokens from service account
keys predeployed to Chrome Ops bots via Puppet.
Depends on 'luci-auth' being in PATH.
This module exists only to support Buildbot code. On LUCI use default account
exposed through 'recipe_engine/service_account' module.
from recipe_engine import recipe_api
class PuppetServiceAccountApi(recipe_api.RecipeApi):
def keys_path(self):
"""Path to a directory where ChromeOps Puppet drops service account keys."""
if self.m.platform.is_win:
return 'C:\\creds\\service_accounts'
return '/creds/service_accounts'
def get(self, account):
"""Returns a recipe_module.service_account.ServiceAccount for the account.
Assumes a service account key for the given account is available at
account: a name of the service account, as defined in Puppet config.
A recipe_module.service_account.ServiceAccount instance.
return self.m.service_account.from_credentials_json(
def get_key_path(self, account):
"""Path to a particular JSON key (as str)."""
return self.m.path.join(self.keys_path, 'service-account-%s.json' % account)
def get_access_token(self, account, scopes=None):
"""Returns an access token for a service account.
Token's lifetime is guaranteed to be at least 3 minutes and at most 45.
account: a name of the service account, as defined in Puppet config.
scopes: list of OAuth scopes for new token, default is [].
return self.m.service_account.from_credentials_json(