Implementing Python 3 Support (#7)

* Implementing Python3 compatibility; Added Python3 config for Tox; Implemented AppDefault credential support in initialize_app()

* Declared six dependency explicitly (also included transitively via oauth2client)

* Fixing a buggy test case; Updates to documentation

Author: hiranya911

.github/CONTRIBUTING.md

@@ -136,18 +136,33 @@ to learn how to run a subset of all test cases.
 
 ### Testing in Different Environments
 
-Sometimes we may want to run unit tests in multiple environments (e.g. different
-Python versions), and ensure that the SDK works as expected in each of them.
-We use [tox](https://tox.readthedocs.io/en/latest/) for this purpose.
-You can execute the following command from the root of the repository to
-launch tox:
+Sometimes we want to run unit tests in multiple environments (e.g. different Python versions), and
+ensure that the SDK works as expected in each of them. We use 
+[tox](https://tox.readthedocs.io/en/latest/) for this purpose. 
+
+But before you can invoke tox, you must set up all the necessary target environments on your
+workstation. The easiest and cleanest way to achieve this is by using a tool like
+[pyenv](https://github.com/pyenv/pyenv). Refer to the 
+[pyenv documentation](https://github.com/pyenv/pyenv#installation) for instructions on how to
+install it. This generally involves installing some binaries as well as modifying a system level
+configuration file such as `.bash_profile`. Once pyenv is installed, you can install multiple
+versions of Python as follows:
+
+```
+pyenv install 2.7.6  # install Python 2.7.6
+pyenv install 3.3.0  # install Python 3.3.0
+```
+
+Refer to the [`tox.ini`](../tox.ini) file for a list of target environments that we usually test.
+Use pyenv to install all the required Python versions on your workstation. When your system is
+fully set up, you can execute the following command from the root of the repository to launch tox:
 
 ```
 tox
 ```
 
-This command will read a list of target environments from the [`tox.ini`](../tox.ini)
-file in the Git repository, and execute test cases in each of those environments.
+This command will read the list of target environments from `tox.ini`, and execute tests in each of
+those environments.
 
 ### Repo Organization
 

firebase_admin/__init__.py

@@ -1,6 +1,8 @@
 """Firebase Admin SDK for Python."""
 import threading
 
+import six
+
 from firebase_admin import credentials
 
 
@@ -32,6 +34,8 @@ def initialize_app(credential=None, options=None, name=_DEFAULT_APP_NAME):
       ValueError: If the app name is already in use, or any of the
       provided arguments are invalid.
     """
+    if credential is None:
+        credential = credentials.ApplicationDefault()
     app = App(name, credential, options)
     with _apps_lock:
         if app.name not in _apps:
@@ -63,7 +67,7 @@ def delete_app(name):
     Raises:
       ValueError: If the name is not a string.
     """
-    if not isinstance(name, basestring):
+    if not isinstance(name, six.string_types):
         raise ValueError('Illegal app name argument type: "{}". App name '
                          'must be a string.'.format(type(name)))
     with _apps_lock:
@@ -94,7 +98,7 @@ def get_app(name=_DEFAULT_APP_NAME):
       ValueError: If the specified name is not a string, or if the specified
       app does not exist.
     """
-    if not isinstance(name, basestring):
+    if not isinstance(name, six.string_types):
         raise ValueError('Illegal app name argument type: "{}". App name '
                          'must be a string.'.format(type(name)))
     with _apps_lock:
@@ -142,7 +146,7 @@ def __init__(self, name, credential, options):
         Raises:
           ValueError: If an argument is None or invalid.
         """
-        if not name or not isinstance(name, basestring):
+        if not name or not isinstance(name, six.string_types):
             raise ValueError('Illegal Firebase app name "{0}" provided. App name must be a '
                              'non-empty string.'.format(name))
         self._name = name

firebase_admin/auth.py

@@ -9,6 +9,7 @@
 import time
 
 from oauth2client import crypt
+import six
 
 import firebase_admin
 from firebase_admin import credentials
@@ -166,9 +167,8 @@ def create_custom_token(self, uid, developer_claims=None):
                                          ', '.join(disallowed_keys)))
                 raise ValueError(error_message)
 
-        if not uid or not isinstance(uid, basestring) or len(uid) > 128:
-            raise ValueError(
-                'uid must be a string between 1 and 128 characters.')
+        if not uid or not isinstance(uid, six.string_types) or len(uid) > 128:
+            raise ValueError('uid must be a string between 1 and 128 characters.')
 
         now = int(time.time())
         payload = {
@@ -202,9 +202,15 @@ def verify_id_token(self, id_token):
           AppIdenityError: The JWT was found to be invalid, the message will
           contain details.
         """
-        if not id_token or not isinstance(id_token, basestring):
-            raise ValueError('Illegal ID token provided: {0}. ID token '
-                             'must be a non-empty string.'.format(id_token))
+        if not id_token:
+            raise ValueError('Illegal ID token provided: {0}. ID token must be a non-empty '
+                             'string.'.format(id_token))
+
+        if isinstance(id_token, six.text_type):
+            id_token = id_token.encode('ascii')
+        if not isinstance(id_token, six.binary_type):
+            raise ValueError('Illegal ID token provided: {0}. ID token must be a non-empty '
+                             'string.'.format(id_token))
 
         try:
             project_id = self._app.credential.project_id
@@ -256,7 +262,7 @@ def verify_id_token(self, id_token):
                              .format(expected_issuer, issuer,
                                      project_id_match_msg,
                                      verify_id_token_msg))
-        elif subject is None or not isinstance(subject, basestring):
+        elif subject is None or not isinstance(subject, six.string_types):
             error_message = ('Firebase ID token has no "sub" (subject) '
                              'claim. ') + verify_id_token_msg
         elif not subject:

firebase_admin/jwt.py

@@ -15,15 +15,10 @@
 
 from oauth2client import client
 from oauth2client import crypt
+from oauth2client import transport
 
-try:
-    # Newer versions of oauth2client (> v1.4)
-    # pylint: disable=g-import-not-at-top
-    from oauth2client import transport
-    _cached_http = httplib2.Http(transport.MemoryCache())
-except ImportError:
-    # Older versions of oauth2client (<= v1.4)
-    _cached_http = httplib2.Http(client.MemoryCache())
+
+_cached_http = httplib2.Http(transport.MemoryCache())
 
 
 def _to_bytes(value, encoding='ascii'):
@@ -139,8 +134,9 @@ def verify_id_token(id_token, cert_uri, audience=None, kid=None, http=None):
         raise client.VerifyJwtTokenError(
             ('Failed to load public key certificates from URL "{0}". Received '
              'HTTP status code {1}.').format(cert_uri, resp.status))
-    certs = json.loads(content.decode('utf-8'))
-    if kid and not certs.has_key(kid):
+    str_content = content.decode('utf-8') if isinstance(content, six.binary_type) else content
+    certs = json.loads(str_content)
+    if kid and kid not in certs:
         raise client.VerifyJwtTokenError(
             'Firebase ID token has "kid" claim which does'
             ' not correspond to a known public key. Most'

requirements.txt

@@ -3,3 +3,4 @@ pytest >= 3.0.6
 tox >= 2.6.0
 
 oauth2client >= 4.0.0
+six >= 1.6.1

setup.py

@@ -54,7 +54,10 @@
     # your project is installed. For an analysis of "install_requires" vs pip's
     # requirements files see:
     # https://packaging.python.org/en/latest/requirements.html
-    install_requires=['oauth2client'],
+    install_requires=[
+        'oauth2client>=4.0.0',
+        'six>=1.6.1'
+    ],
 
     # List additional groups of dependencies here (e.g. development
     # dependencies). You can install these using the following syntax,

tests/test_app.py

@@ -1,4 +1,6 @@
 """Tests for firebase_admin.App."""
+import os
+
 import pytest
 
 import firebase_admin
@@ -9,6 +11,57 @@
 CREDENTIAL = credentials.Certificate(
     testutils.resource_filename('service_account.json'))
 
+class CredentialProvider(object):
+    def init(self):
+        pass
+
+    def get(self):
+        pass
+
+    def cleanup(self):
+        pass
+
+
+class Cert(CredentialProvider):
+    def get(self):
+        return CREDENTIAL
+
+
+class RefreshToken(CredentialProvider):
+    def get(self):
+        return credentials.RefreshToken(testutils.resource_filename('refresh_token.json'))
+
+
+class ExplicitAppDefault(CredentialProvider):
+    VAR_NAME = 'GOOGLE_APPLICATION_CREDENTIALS'
+
+    def init(self):
+        self.file_path = os.environ.get(self.VAR_NAME)
+        os.environ[self.VAR_NAME] = testutils.resource_filename('service_account.json')
+
+    def get(self):
+        return credentials.ApplicationDefault()
+
+    def cleanup(self):
+        if self.file_path:
+            os.environ[self.VAR_NAME] = self.file_path
+        else:
+            del os.environ[self.VAR_NAME]
+
+
+class ImplicitAppDefault(ExplicitAppDefault):
+    def get(self):
+        return None
+
+
+@pytest.fixture(params=[Cert(), RefreshToken(), ExplicitAppDefault(), ImplicitAppDefault()],
+                ids=['cert', 'refreshtoken', 'explicit-appdefault', 'implicit-appdefault'])
+def app_credential(request):
+    provider = request.param
+    provider.init()
+    yield provider.get()
+    provider.cleanup()
+
 
 class TestFirebaseApp(object):
     """Test cases for App initialization and life cycle."""
@@ -20,19 +73,25 @@ class TestFirebaseApp(object):
     def teardown_method(self):
         testutils.cleanup_apps()
 
-    def test_default_app_init(self):
-        app = firebase_admin.initialize_app(CREDENTIAL)
+    def test_default_app_init(self, app_credential):
+        app = firebase_admin.initialize_app(app_credential)
         assert firebase_admin._DEFAULT_APP_NAME == app.name
-        assert CREDENTIAL is app.credential
+        if app_credential:
+            assert app_credential is app.credential
+        else:
+            assert isinstance(app.credential, credentials.ApplicationDefault)
         with pytest.raises(ValueError):
-            firebase_admin.initialize_app(CREDENTIAL)
+            firebase_admin.initialize_app(app_credential)
 
-    def test_non_default_app_init(self):
-        app = firebase_admin.initialize_app(CREDENTIAL, name='myApp')
+    def test_non_default_app_init(self, app_credential):
+        app = firebase_admin.initialize_app(app_credential, name='myApp')
         assert app.name == 'myApp'
-        assert CREDENTIAL is app.credential
+        if app_credential:
+            assert app_credential is app.credential
+        else:
+            assert isinstance(app.credential, credentials.ApplicationDefault)
         with pytest.raises(ValueError):
-            firebase_admin.initialize_app(CREDENTIAL, name='myApp')
+            firebase_admin.initialize_app(app_credential, name='myApp')
 
     @pytest.mark.parametrize('cred', invalid_credentials)
     def test_app_init_with_invalid_credential(self, cred):

tests/test_auth.py

@@ -5,6 +5,7 @@
 from oauth2client import client
 from oauth2client import crypt
 import pytest
+import six
 
 import firebase_admin
 from firebase_admin import auth
@@ -75,7 +76,7 @@ def non_cert_app():
     firebase_admin.delete_app(app.name)
 
 def verify_custom_token(custom_token, expected_claims):
-    assert isinstance(custom_token, basestring)
+    assert isinstance(custom_token, six.binary_type)
     token = client.verify_id_token(
         custom_token,
         FIREBASE_AUDIENCE,
@@ -117,6 +118,9 @@ def get_id_token(payload_overrides=None, header_overrides=None):
     return jwt.encode(payload, signer, headers=headers)
 
 
+TEST_ID_TOKEN = get_id_token()
+
+
 class TestCreateCustomToken(object):
 
     valid_args = {
@@ -143,12 +147,12 @@ class TestCreateCustomToken(object):
     }
 
     @pytest.mark.parametrize('user,claims', valid_args.values(),
-                             ids=valid_args.keys())
+                             ids=list(valid_args))
     def test_valid_params(self, authtest, user, claims):
         verify_custom_token(authtest.create_custom_token(user, claims), claims)
 
     @pytest.mark.parametrize('user,claims,error', invalid_args.values(),
-                             ids=invalid_args.keys())
+                             ids=list(invalid_args))
     def test_invalid_params(self, authtest, user, claims, error):
         with pytest.raises(error):
             authtest.create_custom_token(user, claims)
@@ -160,6 +164,11 @@ def test_noncert_credential(self, non_cert_app):
 
 class TestVerifyIdToken(object):
 
+    valid_tokens = {
+        'BinaryToken': TEST_ID_TOKEN,
+        'TextToken': TEST_ID_TOKEN.decode('utf-8'),
+    }
+
     invalid_tokens = {
         'NoKid': (get_id_token(header_overrides={'kid': None}),
                   crypt.AppIdentityError),
@@ -197,23 +206,22 @@ class TestVerifyIdToken(object):
     def setup_method(self):
         auth._http = testutils.HttpMock(200, MOCK_PUBLIC_CERTS)
 
-    def test_valid_token(self, authtest):
-        id_token = get_id_token()
+    @pytest.mark.parametrize('id_token', valid_tokens.values(), ids=list(valid_tokens))
+    def test_valid_token(self, authtest, id_token):
         claims = authtest.verify_id_token(id_token)
         assert claims['admin'] is True
 
     @pytest.mark.parametrize('id_token,error', invalid_tokens.values(),
-                             ids=invalid_tokens.keys())
+                             ids=list(invalid_tokens))
     def test_invalid_token(self, authtest, id_token, error):
         with pytest.raises(error):
             authtest.verify_id_token(id_token)
 
     def test_project_id_env_var(self, non_cert_app):
-        id_token = get_id_token()
         gcloud_project = os.environ.get(auth.GCLOUD_PROJECT_ENV_VAR)
         try:
             os.environ[auth.GCLOUD_PROJECT_ENV_VAR] = MOCK_CREDENTIAL.project_id
-            claims = auth.verify_id_token(id_token, non_cert_app)
+            claims = auth.verify_id_token(TEST_ID_TOKEN, non_cert_app)
             assert claims['admin'] is True
         finally:
             if gcloud_project:
@@ -222,13 +230,12 @@ def test_project_id_env_var(self, non_cert_app):
                 del os.environ[auth.GCLOUD_PROJECT_ENV_VAR]
 
     def test_no_project_id(self, non_cert_app):
-        id_token = get_id_token()
         gcloud_project = os.environ.get(auth.GCLOUD_PROJECT_ENV_VAR)
         if gcloud_project:
             del os.environ[auth.GCLOUD_PROJECT_ENV_VAR]
         try:
             with pytest.raises(ValueError):
-                auth.verify_id_token(id_token, non_cert_app)
+                auth.verify_id_token(TEST_ID_TOKEN, non_cert_app)
         finally:
             if gcloud_project:
                 os.environ[auth.GCLOUD_PROJECT_ENV_VAR] = gcloud_project
@@ -239,7 +246,6 @@ def test_custom_token(self, authtest):
             authtest.verify_id_token(id_token)
 
     def test_certificate_request_failure(self, authtest):
-        id_token = get_id_token()
         auth._http = testutils.HttpMock(404, 'not found')
         with pytest.raises(client.VerifyJwtTokenError):
-            authtest.verify_id_token(id_token)
+            authtest.verify_id_token(TEST_ID_TOKEN)