Skip to content

Commit 69bab47

Browse files
yoshi-automationyoshi-automation
committed
docs: add warning about loading unvalidated credentials
1 parent 40e58e4 commit 69bab47

File tree

26 files changed

+385
-97
lines changed

26 files changed

+385
-97
lines changed

‎google-cloud-bigquery/AUTHENTICATION.md‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -67,12 +67,14 @@ The environment variables that BigQuery checks for credentials are configured on
6767
5. `GOOGLE_APPLICATION_CREDENTIALS` - Path to JSON file
6868

6969
```ruby
70+
require "googleauth"
7071
require "google/cloud/bigquery"
7172

72-
ENV["BIGQUERY_PROJECT"] = "my-project-id"
73-
ENV["BIGQUERY_CREDENTIALS"] = "path/to/keyfile.json"
73+
credentials = ::Google::Auth::ServiceAccountCredentials.make_creds(
74+
json_key_io: ::File.open("/path/to/keyfile.json")
75+
)
7476

75-
bigquery = Google::Cloud::Bigquery.new
77+
bigquery = Google::Cloud::Bigquery.new project_id: "my-project-id", credentials: credentials
7678
```
7779

7880
### Configuration
@@ -81,11 +83,16 @@ The **Project ID** and the path to the **Credentials JSON** file can be configur
8183
instead of placing them in environment variables or providing them as arguments.
8284

8385
```ruby
86+
require "googleauth"
8487
require "google/cloud/bigquery"
8588

89+
credentials = ::Google::Auth::ServiceAccountCredentials.make_creds(
90+
json_key_io: ::File.open("/path/to/keyfile.json")
91+
)
92+
8693
Google::Cloud::Bigquery.configure do |config|
8794
config.project_id = "my-project-id"
88-
config.credentials = "path/to/keyfile.json"
95+
config.credentials = credentials
8996
end
9097

9198
bigquery = Google::Cloud::Bigquery.new

‎google-cloud-bigquery/lib/google-cloud-bigquery.rb‎

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -87,9 +87,25 @@ def bigquery scope: nil, retries: nil, timeout: nil
8787
#
8888
# @param [String] project_id Identifier for a BigQuery project. If not
8989
# present, the default project for the credentials is used.
90-
# @param [String, Hash, Google::Auth::Credentials] credentials The path to
91-
# the keyfile as a String, the contents of the keyfile as a Hash, or a
92-
# Google::Auth::Credentials object. (See {Bigquery::Credentials})
90+
# @param [Google::Auth::Credentials] credentials A Google::Auth::Credentials
91+
# object. (See {Bigquery::Credentials})
92+
# @note Warning: Passing a `String` to a keyfile path or a `Hash` of credentials
93+
# is deprecated. Providing an unvalidated credential configuration to
94+
# Google APIs can compromise the security of your systems and data.
95+
#
96+
# @example
97+
#
98+
# # The recommended way to provide credentials is to use the `make_creds` method
99+
# # on the appropriate credentials class for your environment.
100+
#
101+
# require "googleauth"
102+
#
103+
# credentials = ::Google::Auth::ServiceAccountCredentials.make_creds(
104+
# json_key_io: ::File.open("/path/to/keyfile.json")
105+
# )
106+
#
107+
# client = ::Google::Cloud::Bigquery.new credentials: credentials
108+
#
93109
# @param [String, Array<String>] scope The OAuth 2.0 scopes controlling the
94110
# set of resources and operations that the connection can access. See
95111
# [Using OAuth 2.0 to Access Google

‎google-cloud-bigquery/lib/google/cloud/bigquery.rb‎

Lines changed: 25 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -37,9 +37,26 @@ module Bigquery
3737
#
3838
# @param [String] project_id Identifier for a BigQuery project. If not
3939
# present, the default project for the credentials is used.
40-
# @param [String, Hash, Google::Auth::Credentials] credentials The path to
41-
# the keyfile as a String, the contents of the keyfile as a Hash, or a
42-
# Google::Auth::Credentials object. (See {Bigquery::Credentials})
40+
# @param [Google::Auth::Credentials] credentials A Google::Auth::Credentials
41+
# object. (See {Bigquery::Credentials})
42+
# @note Warning: Passing a `String` to a keyfile path or a `Hash` of credentials
43+
# is deprecated. Providing an unvalidated credential configuration to
44+
# Google APIs can compromise the security of your systems and data.
45+
#
46+
# @example
47+
#
48+
# # The recommended way to provide credentials is to use the `make_creds` method
49+
# # on the appropriate credentials class for your environment.
50+
#
51+
# require "googleauth"
52+
#
53+
# credentials = ::Google::Auth::ServiceAccountCredentials.make_creds(
54+
# json_key_io: ::File.open("/path/to/keyfile.json")
55+
# )
56+
#
57+
# client = ::Google::Cloud::Bigquery.new do |config|
58+
# config.credentials = credentials
59+
# end
4360
# @param [String, Array<String>] scope The OAuth 2.0 scopes controlling
4461
# the set of resources and operations that the connection can access.
4562
# See # [Using OAuth 2.0 to Access Google #
@@ -98,12 +115,11 @@ def self.new project_id: nil, credentials: nil, scope: nil, retries: nil, timeou
98115
#
99116
# * `project_id` - (String) Identifier for a BigQuery project. (The
100117
# parameter `project` is considered deprecated, but may also be used.)
101-
# * `credentials` - (String, Hash, Google::Auth::Credentials) The path to
102-
# the keyfile as a String, the contents of the keyfile as a Hash, or a
103-
# Google::Auth::Credentials object. (See {Bigquery::Credentials}) (The
104-
# parameter `keyfile` is considered deprecated, but may also be used.)
105-
# * `endpoint` - (String) Override of the endpoint host name, or `nil`
106-
# to use the default endpoint.
118+
# * `credentials` - (Google::Auth::Credentials) A Google::Auth::Credentials
119+
# object. (See {Bigquery::Credentials})
120+
# @note Warning: Passing a `String` to a keyfile path or a `Hash` of credentials
121+
# is deprecated. Providing an unvalidated credential configuration to
122+
# Google APIs can compromise the security of your systems and data.
107123
# * `scope` - (String, Array<String>) The OAuth 2.0 scopes controlling
108124
# the set of resources and operations that the connection can access.
109125
# * `retries` - (Integer) Number of times to retry requests on server

‎google-cloud-bigtable/AUTHENTICATION.md‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -85,12 +85,14 @@ The environment variables that google-cloud-bigtable checks for credentials are
8585
5. `GOOGLE_APPLICATION_CREDENTIALS` - Path to JSON file
8686
8787
```ruby
88+
require "googleauth"
8889
require "google/cloud/bigtable"
8990
90-
ENV["BIGTABLE_PROJECT"] = "my-project-id"
91-
ENV["BIGTABLE_CREDENTIALS"] = "path/to/keyfile.json"
91+
credentials = ::Google::Auth::ServiceAccountCredentials.make_creds(
92+
json_key_io: ::File.open("/path/to/keyfile.json")
93+
)
9294
93-
client = Google::Cloud::Bigtable.new
95+
client = Google::Cloud::Bigtable.new project_id: "my-project-id", credentials: credentials
9496
```
9597
9698
### Configuration
@@ -99,11 +101,16 @@ The **Project ID** and the path to the **Credentials JSON** file can be configur
99101
instead of placing them in environment variables or providing them as arguments.
100102
101103
```ruby
104+
require "googleauth"
102105
require "google/cloud/bigtable"
103106
107+
credentials = ::Google::Auth::ServiceAccountCredentials.make_creds(
108+
json_key_io: ::File.open("/path/to/keyfile.json")
109+
)
110+
104111
Google::Cloud::Bigtable.configure do |config|
105112
config.project_id = "my-project-id"
106-
config.credentials = "path/to/keyfile.json"
113+
config.credentials = credentials
107114
end
108115
109116
client = Google::Cloud::Bigtable.new

‎google-cloud-bigtable/lib/google-cloud-bigtable.rb‎

Lines changed: 29 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -40,29 +40,31 @@ module Cloud
4040
# updater_proc is supplied.
4141
# @param timeout [Integer]
4242
# The default timeout, in seconds, for calls made through this client.
43-
# @param credentials [Google::Auth::Credentials, String, Hash, GRPC::Core::Channel,
43+
# @param credentials [Google::Auth::Credentials, GRPC::Core::Channel,
4444
# GRPC::Core::ChannelCredentials, Proc]
45-
# Provides the means for authenticating requests made by the client. This parameter can
45+
# The means for authenticating requests made by the client. This parameter can
4646
# be one of the following types.
4747
# `Google::Auth::Credentials` uses the properties of its represented keyfile for
4848
# authenticating requests made by this client.
49-
# `String` will be treated as the path to the keyfile to use to construct
50-
# credentials for this client.
51-
# `Hash` will be treated as the contents of a keyfile to use to construct
52-
# credentials for this client.
5349
# `GRPC::Core::Channel` will be used to make calls through.
5450
# `GRPC::Core::ChannelCredentials` will be used to set up the gRPC client. The channel credentials
5551
# should already be composed with a `GRPC::Core::CallCredentials` object.
5652
# `Proc` will be used as an updater_proc for the gRPC channel. The proc transforms the
5753
# metadata for requests, generally, to give OAuth credentials.
58-
# @return [Google::Cloud::Bigtable::Project]
54+
# @note Warning: Passing a `String` to a keyfile path or a `Hash` of credentials
55+
# is deprecated. Providing an unvalidated credential configuration to
56+
# Google APIs can compromise the security of your systems and data.
5957
#
60-
# @example
61-
# require "google/cloud/bigtable"
58+
# @example
59+
#
60+
# # The recommended way to provide credentials is to use the `make_creds` method
61+
# # on the appropriate credentials class for your environment.
6262
#
63-
# gcloud = Google::Cloud.new
63+
# credentials = ::Google::Auth::ServiceAccountCredentials.make_creds(
64+
# json_key_io: ::File.open("/path/to/keyfile.json")
65+
# )
6466
#
65-
# bigtable = gcloud.bigtable
67+
# client = Google::Cloud.bigtable credentials: credentials
6668
#
6769
def bigtable scope: nil, timeout: nil, credentials: nil
6870
credentials ||= @keyfile
@@ -83,21 +85,32 @@ def bigtable scope: nil, timeout: nil, credentials: nil
8385
# Project identifier for the Bigtable service you
8486
# are connecting to. If not present, the default project for the
8587
# credentials is used.
86-
# @param credentials [Google::Auth::Credentials, String, Hash, GRPC::Core::Channel,
88+
# @param credentials [Google::Auth::Credentials, GRPC::Core::Channel,
8789
# GRPC::Core::ChannelCredentials, Proc]
8890
# The means for authenticating requests made by the client. This parameter can
8991
# be one of the following types.
9092
# `Google::Auth::Credentials` uses the properties of its represented keyfile for
9193
# authenticating requests made by this client.
92-
# `String` will be treated as the path to the keyfile to use to construct
93-
# credentials for this client.
94-
# `Hash` will be treated as the contents of a keyfile to use to construct
95-
# credentials for this client.
9694
# `GRPC::Core::Channel` will be used to make calls through.
9795
# `GRPC::Core::ChannelCredentials` will be used to set up the gRPC client. The channel credentials
9896
# should already be composed with a `GRPC::Core::CallCredentials` object.
9997
# `Proc` will be used as an updater_proc for the gRPC channel. The proc transforms the
10098
# metadata for requests, generally, to give OAuth credentials.
99+
# @note Warning: Passing a `String` to a keyfile path or a `Hash` of credentials
100+
# is deprecated. Providing an unvalidated credential configuration to
101+
# Google APIs can compromise the security of your systems and data.
102+
#
103+
# @example
104+
#
105+
# # The recommended way to provide credentials is to use the `make_creds` method
106+
# # on the appropriate credentials class for your environment.
107+
#
108+
# credentials = ::Google::Auth::ServiceAccountCredentials.make_creds(
109+
# json_key_io: ::File.open("/path/to/keyfile.json")
110+
# )
111+
#
112+
# client = Google::Cloud.bigtable credentials: credentials
113+
#
101114
# @param scope [Array<String>]
102115
# The OAuth 2.0 scopes controlling the set of resources and operations
103116
# that the connection can access. See [Using OAuth 2.0 to Access Google

‎google-cloud-bigtable/lib/google/cloud/bigtable.rb‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -43,15 +43,14 @@ module Bigtable
4343
# be one of the following types:
4444
# `Google::Auth::Credentials` uses the properties of its represented keyfile for
4545
# authenticating requests made by this client.
46-
# `String` will be treated as the path to the keyfile to use to construct
47-
# credentials for this client.
48-
# `Hash` will be treated as the contents of a keyfile to use to construct
49-
# credentials for this client.
5046
# `GRPC::Core::Channel` will be used to make calls through.
5147
# `GRPC::Core::ChannelCredentials` for the setting up the gRPC client. The channel credentials
5248
# should already be composed with a `GRPC::Core::CallCredentials` object.
5349
# `Proc` will be used as an updater_proc for the gRPC channel. The proc transforms the
5450
# metadata for requests, generally, to give OAuth credentials.
51+
# @note Warning: Passing a `String` to a keyfile path or a `Hash` of credentials
52+
# is deprecated. Providing an unvalidated credential configuration to
53+
# Google APIs can compromise the security of your systems and data.
5554
# @param universe_domain [String] Override of the universe domain. Optional.
5655
# @param endpoint [String] Override of the endpoint host name. Optional.
5756
# If the param is nil, uses the default endpoint.

‎google-cloud-datastore/AUTHENTICATION.md‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -86,12 +86,14 @@ The environment variables that google-cloud-datastore checks for credentials are
8686
5. `GOOGLE_APPLICATION_CREDENTIALS` - Path to JSON file
8787
8888
```ruby
89+
require "googleauth"
8990
require "google/cloud/datastore"
9091
91-
ENV["DATASTORE_PROJECT"] = "my-project-id"
92-
ENV["DATASTORE_CREDENTIALS"] = "path/to/keyfile.json"
92+
credentials = ::Google::Auth::ServiceAccountCredentials.make_creds(
93+
json_key_io: ::File.open("/path/to/keyfile.json")
94+
)
9395
94-
client = Google::Cloud::Datastore.new
96+
client = Google::Cloud::Datastore.new project_id: "my-project-id", credentials: credentials
9597
```
9698
9799
### Configuration
@@ -100,11 +102,16 @@ The **Project ID** and the path to the **Credentials JSON** file can be configur
100102
instead of placing them in environment variables or providing them as arguments.
101103
102104
```ruby
105+
require "googleauth"
103106
require "google/cloud/datastore"
104107
108+
credentials = ::Google::Auth::ServiceAccountCredentials.make_creds(
109+
json_key_io: ::File.open("/path/to/keyfile.json")
110+
)
111+
105112
Google::Cloud::Datastore.configure do |config|
106113
config.project_id = "my-project-id"
107-
config.credentials = "path/to/keyfile.json"
114+
config.credentials = credentials
108115
end
109116
110117
client = Google::Cloud::Datastore.new

‎google-cloud-datastore/OVERVIEW.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,11 +14,16 @@ your code or via environment variables. Read more about the options for
1414
connecting in the [Authentication Guide](AUTHENTICATION.md).
1515

1616
```ruby
17+
require "googleauth"
1718
require "google/cloud/datastore"
1819

20+
credentials = ::Google::Auth::ServiceAccountCredentials.make_creds(
21+
json_key_io: ::File.open("/path/to/keyfile.json")
22+
)
23+
1924
datastore = Google::Cloud::Datastore.new(
2025
project_id: "my-todo-project",
21-
credentials: "/path/to/keyfile.json"
26+
credentials: credentials
2227
)
2328

2429
task = datastore.find "Task", "sampleTask"

‎google-cloud-datastore/README.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,11 +23,16 @@ Instructions and configuration options are covered in the [Authentication Guide]
2323
## Example
2424

2525
```ruby
26+
require "googleauth"
2627
require "google/cloud/datastore"
2728

29+
credentials = ::Google::Auth::ServiceAccountCredentials.make_creds(
30+
json_key_io: ::File.open("/path/to/keyfile.json")
31+
)
32+
2833
datastore = Google::Cloud::Datastore.new(
2934
project_id: "my-todo-project",
30-
credentials: "/path/to/keyfile.json"
35+
credentials: credentials
3136
)
3237

3338
# Create a new task to demo datastore

‎google-cloud-datastore/lib/google-cloud-datastore.rb‎

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -84,9 +84,25 @@ def datastore scope: nil, timeout: nil, database_id: nil
8484
#
8585
# @param [String] project_id Identifier for a Datastore project. If not
8686
# present, the default project for the credentials is used.
87-
# @param [String, Hash, Google::Auth::Credentials] credentials The path to
88-
# the keyfile as a String, the contents of the keyfile as a Hash, or a
89-
# Google::Auth::Credentials object. (See {Datastore::Credentials})
87+
# @param [Google::Auth::Credentials] credentials A Google::Auth::Credentials
88+
# object. (See {Datastore::Credentials})
89+
# @note Warning: Passing a `String` to a keyfile path or a `Hash` of credentials
90+
# is deprecated. Providing an unvalidated credential configuration to
91+
# Google APIs can compromise the security of your systems and data.
92+
#
93+
# @example
94+
#
95+
# # The recommended way to provide credentials is to use the `make_creds` method
96+
# # on the appropriate credentials class for your environment.
97+
#
98+
# credentials = ::Google::Auth::ServiceAccountCredentials.make_creds(
99+
# json_key_io: ::File.open("/path/to/keyfile.json")
100+
# )
101+
#
102+
# datastore = Google::Cloud::Datastore.new(
103+
# project_id: "my-project-id",
104+
# credentials: credentials
105+
# )
90106
# @param [String, Array<String>] scope The OAuth 2.0 scopes controlling the
91107
# set of resources and operations that the connection can access. See
92108
# [Using OAuth 2.0 to Access Google

0 commit comments

Comments
 (0)