feat: adds ability to provide redirect uri (googleapis#595)

* feat: adds ability to provide redirect uri

* renames redirect_uri variable

* adds js folder to sphinx and auth_redirect_uri

* feat: adds javascript functionality related to oauth

* feat: adds javascript functionality related to oauth

* feat: adds sample authcodescript

* feat: adds ability to host oauth page with the documentation

* adds clarity to the user interface messaging

* updates linting, toctree

* updates minimum version of pydata-google-auth

* Update docs/_static/js/authcodescripts.js

* adds check to avoid override of user given clientid, clientsecret

* adds parameters to the func to_gbq

* adds docstrings related to three new parameters

* Apply suggestions from code review

* fix rst formatting

* 🦉 Updates from OwlBot post-processor

See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md

Co-authored-by: Tim Swast <swast@google.com>
Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com>

Author: 3 people

docs/_static/js/authcodescripts.js

@@ -0,0 +1,37 @@
+
+
+// Copyright (c) 2023 pandas-gbq Authors All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+
+function onloadoauthcode() {
+    const PARAMS = new Proxy(new URLSearchParams(window.location.search), {
+        get: (searchParams, prop) => searchParams.get(prop),
+    });
+    const AUTH_CODE = PARAMS.code;
+
+    document.querySelector('.auth-code').textContent = AUTH_CODE;
+
+    setupCopyButton(document.querySelector('.copy'), AUTH_CODE);
+}
+
+function setupCopyButton(button, text) {
+    button.addEventListener('click', () => {
+        navigator.clipboard.writeText(text);
+        button.textContent = "Verification Code Copied";
+        setTimeout(() => {
+            // Remove the aria-live label so that when the
+            // button text changes back to "Copy", it is
+            // not read out.
+            button.removeAttribute("aria-live");
+            button.textContent = "Copy";
+        }, 1000);
+
+        // Re-Add the aria-live attribute to enable speech for
+        // when button text changes next time.
+        setTimeout(() => {
+            button.setAttribute("aria-live", "assertive");
+        }, 2000);
+    });
+}

docs/index.rst

@@ -41,6 +41,7 @@ Contents:
    contributing.rst
    changelog.md
    privacy.rst
+   oauth.rst
 
 
 Indices and tables

docs/oauth.rst

@@ -0,0 +1,39 @@
+.. image:: https://lh3.googleusercontent.com/KaU6SyiIpDKe4tyGPgt7yzGVTsfMqBvP9bL24o_4M58puYDO-nY8-BazrNk3RyhRFJA
+   :alt: gcloud CLI logo
+   :class: logo
+
+Sign in to BigQuery
+===================
+
+You are seeing this page because you are attempting to access BigQuery via one 
+of several possible methods, including: 
+  
+  * the ``pandas_gbq`` library (https://github.com/googleapis/python-bigquery-pandas)
+
+  OR a ``pandas`` library helper function such as:
+  
+  * ``pandas.DataFrame.to_gbq()``
+  * ``pandas.read_gbq()``
+
+from this or another machine. If this is not the case, close this tab.
+
+Enter the following verification code in the CommandLine Interface (CLI) on the
+machine you want to log into. This is a credential **similar to your password**
+and should not be shared with others.
+
+
+.. raw:: html
+
+   <script type="text/javascript">
+     window.addEventListener( "load", onloadoauthcode )
+   </script>
+
+   <div>
+      <code class="auth-code"></code>
+   </div>
+   <br>
+   <button class="copy" aria-live="assertive">Copy</button>
+
+.. hint::
+
+   You can close this tab when you’re done.

pandas_gbq/auth.py

@@ -28,7 +28,13 @@
 
 
 def get_credentials(
-    private_key=None, project_id=None, reauth=False, auth_local_webserver=True
+    private_key=None,
+    project_id=None,
+    reauth=False,
+    auth_local_webserver=True,
+    auth_redirect_uri=None,
+    client_id=None,
+    client_secret=None,
 ):
     import pydata_google_auth
 
@@ -41,12 +47,19 @@ def get_credentials(
 method from the google-auth package."""
         )
 
+    if client_id is None:
+        client_id = CLIENT_ID
+
+    if client_secret is None:
+        client_secret = CLIENT_SECRET
+
     credentials, default_project_id = pydata_google_auth.default(
         SCOPES,
-        client_id=CLIENT_ID,
-        client_secret=CLIENT_SECRET,
+        client_id=client_id,
+        client_secret=client_secret,
         credentials_cache=get_credentials_cache(reauth),
         auth_local_webserver=auth_local_webserver,
+        redirect_uri=auth_redirect_uri,
     )
 
     project_id = project_id or default_project_id

pandas_gbq/gbq.py

@@ -280,6 +280,9 @@ def __init__(
         location=None,
         credentials=None,
         use_bqstorage_api=False,
+        auth_redirect_uri=None,
+        client_id=None,
+        client_secret=None,
     ):
         global context
         from google.api_core.exceptions import GoogleAPIError
@@ -294,6 +297,10 @@ def __init__(
         self.auth_local_webserver = auth_local_webserver
         self.dialect = dialect
         self.credentials = credentials
+        self.auth_redirect_uri = auth_redirect_uri
+        self.client_id = client_id
+        self.client_secret = client_secret
+
         default_project = None
 
         # Service account credentials have a project associated with them.
@@ -313,6 +320,9 @@ def __init__(
                 project_id=project_id,
                 reauth=reauth,
                 auth_local_webserver=auth_local_webserver,
+                auth_redirect_uri=auth_redirect_uri,
+                client_id=client_id,
+                client_secret=client_secret,
             )
 
         if self.project_id is None:
@@ -735,6 +745,9 @@ def read_gbq(
     private_key=None,
     progress_bar_type="tqdm",
     dtypes=None,
+    auth_redirect_uri=None,
+    client_id=None,
+    client_secret=None,
 ):
     r"""Load data from Google BigQuery using google-cloud-python
 
@@ -864,6 +877,15 @@ def read_gbq(
         or
         :func:`google.oauth2.service_account.Credentials.from_service_account_file`
         instead.
+    auth_redirect_uri : str
+        Path to the authentication page for organization-specific authentication
+        workflows. Used when ``auth_local_webserver=False``.
+    client_id : str
+        The Client ID for the Google Cloud Project the user is attempting to
+        connect to.
+    client_secret : str
+        The Client Secret associated with the Client ID for the Google Cloud Project
+        the user is attempting to connect to.
 
     Returns
     -------
@@ -912,6 +934,9 @@ def read_gbq(
         credentials=credentials,
         private_key=private_key,
         use_bqstorage_api=use_bqstorage_api,
+        auth_redirect_uri=auth_redirect_uri,
+        client_id=client_id,
+        client_secret=client_secret,
     )
 
     if _is_query(query_or_table):
@@ -969,6 +994,9 @@ def to_gbq(
     api_method: str = "default",
     verbose=None,
     private_key=None,
+    auth_redirect_uri=None,
+    client_id=None,
+    client_secret=None,
 ):
     """Write a DataFrame to a Google BigQuery table.
 
@@ -1071,6 +1099,15 @@ def to_gbq(
         or
         :func:`google.oauth2.service_account.Credentials.from_service_account_file`
         instead.
+    auth_redirect_uri : str
+        Path to the authentication page for organization-specific authentication
+        workflows. Used when ``auth_local_webserver=False``.
+    client_id : str
+        The Client ID for the Google Cloud Project the user is attempting to
+        connect to.
+    client_secret : str
+        The Client Secret associated with the Client ID for the Google Cloud Project
+        the user is attempting to connect to.
     """
 
     _test_google_api_imports()
@@ -1131,6 +1168,9 @@ def to_gbq(
         location=location,
         credentials=credentials,
         private_key=private_key,
+        auth_redirect_uri=auth_redirect_uri,
+        client_id=client_id,
+        client_secret=client_secret,
     )
     bqclient = connector.client
 

setup.py

@@ -27,7 +27,7 @@
     "numpy >=1.16.6",
     "pandas >=1.1.4",
     "pyarrow >=3.0.0",
-    "pydata-google-auth >=1.4.0",
+    "pydata-google-auth >=1.5.0",
     # Note: google-api-core and google-auth are also included via transitive
     # dependency on google-cloud-bigquery, but this library also uses them
     # directly.

testing/constraints-3.7.txt

@@ -14,6 +14,6 @@ google-cloud-bigquery-storage==2.16.2
 numpy==1.16.6
 pandas==1.1.4
 pyarrow==3.0.0
-pydata-google-auth==1.4.0
+pydata-google-auth==1.5.0
 tqdm==4.23.0
 protobuf==3.19.5