Raise ValueError if credentials are not from google-auth

Author: Jon Wayne Parrott

core/google/cloud/client.py

@@ -14,6 +14,7 @@
 
 """Base classes for client used to interact with Google Cloud APIs."""
 
+import google.auth.credentials
 from google.oauth2 import service_account
 import six
 
@@ -22,6 +23,13 @@
 from google.cloud.credentials import get_credentials
 
 
+_GOOGLE_AUTH_CREDENTIALS_HELP = (
+    'This library only supports credentials from google-auth-library-python. '
+    'See https://google-cloud-python.readthedocs.io/en/latest/'
+    'google-cloud-auth.html for help on authentication with this library.'
+)
+
+
 class _ClientFactoryMixin(object):
     """Mixin to allow factories that create credentials.
 
@@ -83,6 +91,10 @@ class Client(_ClientFactoryMixin):
     _connection_class = Connection
 
     def __init__(self, credentials=None, http=None):
+        if (credentials is not None and
+                not isinstance(
+                    credentials, google.auth.credentials.Credentials)):
+            raise ValueError(_GOOGLE_AUTH_CREDENTIALS_HELP)
         if credentials is None and http is None:
             credentials = get_credentials()
         self._connection = self._connection_class(

core/unit_tests/test_client.py

@@ -17,6 +17,11 @@
 import mock
 
 
+def _make_credentials():
+    import google.auth.credentials
+    return mock.Mock(spec=google.auth.credentials.Credentials)
+
+
 class Test_ClientFactoryMixin(unittest.TestCase):
 
     @staticmethod
@@ -52,7 +57,7 @@ def test_ctor_defaults(self):
         from google.cloud._testing import _Monkey
         from google.cloud import client
 
-        CREDENTIALS = object()
+        CREDENTIALS = _make_credentials()
         FUNC_CALLS = []
 
         def mock_get_credentials():
@@ -67,20 +72,27 @@ def mock_get_credentials():
         self.assertEqual(FUNC_CALLS, ['get_credentials'])
 
     def test_ctor_explicit(self):
-        CREDENTIALS = object()
+        CREDENTIALS = _make_credentials()
         HTTP = object()
         client_obj = self._make_one(credentials=CREDENTIALS, http=HTTP)
 
         self.assertIsInstance(client_obj._connection, _MockConnection)
         self.assertIs(client_obj._connection.credentials, CREDENTIALS)
         self.assertIs(client_obj._connection.http, HTTP)
 
+    def test_ctor_bad_credentials(self):
+        CREDENTIALS = object()
+
+        with self.assertRaises(ValueError):
+            self._make_one(credentials=CREDENTIALS)
+
     def test_from_service_account_json(self):
         KLASS = self._get_target_class()
 
         constructor_patch = mock.patch(
             'google.oauth2.service_account.Credentials.'
-            'from_service_account_file')
+            'from_service_account_file',
+            return_value=_make_credentials())
 
         with constructor_patch as constructor:
             client_obj = KLASS.from_service_account_json(
@@ -122,7 +134,7 @@ def test_ctor_defaults(self):
         from google.cloud import client
 
         PROJECT = 'PROJECT'
-        CREDENTIALS = object()
+        CREDENTIALS = _make_credentials()
         FUNC_CALLS = []
 
         def mock_determine_proj(project):
@@ -160,7 +172,7 @@ def mock_determine_proj(project):
         self.assertEqual(FUNC_CALLS, [(None, '_determine_default_project')])
 
     def test_ctor_w_invalid_project(self):
-        CREDENTIALS = object()
+        CREDENTIALS = _make_credentials()
         HTTP = object()
         with self.assertRaises(ValueError):
             self._make_one(project=object(), credentials=CREDENTIALS,
@@ -169,7 +181,7 @@ def test_ctor_w_invalid_project(self):
     def _explicit_ctor_helper(self, project):
         import six
 
-        CREDENTIALS = object()
+        CREDENTIALS = _make_credentials()
         HTTP = object()
 
         client_obj = self._make_one(project=project, credentials=CREDENTIALS,