fix: revert "feat: add api key support (#826)" (#964)

This reverts commit 3b15092.

Co-authored-by: Anthonios Partheniou <[email protected]>

google/auth/_default.py

@@ -345,24 +345,6 @@ def _get_external_account_credentials(
     return credentials, credentials.get_project_id(request=request)
 
 
-def _get_api_key_credentials(quota_project_id=None):
-    """Gets API key credentials and project ID."""
-    from google.auth import api_key
-
-    api_key_value = os.environ.get(environment_vars.API_KEY)
-    if api_key_value:
-        return api_key.Credentials(api_key_value), quota_project_id
-    else:
-        return None, None
-
-
-def get_api_key_credentials(api_key_value):
-    """Gets API key credentials using the given api key value."""
-    from google.auth import api_key
-
-    return api_key.Credentials(api_key_value)
-
-
 def _get_authorized_user_credentials(filename, info, scopes=None):
     from google.oauth2 import credentials
 
@@ -458,14 +440,7 @@ def default(scopes=None, request=None, quota_project_id=None, default_scopes=Non
     This function acquires credentials from the environment in the following
     order:
 
-    1. If both ``GOOGLE_API_KEY`` and ``GOOGLE_APPLICATION_CREDENTIALS``
-       environment variables are set, throw an exception.
-
-       If ``GOOGLE_API_KEY`` is set, an `API Key`_ credentials will be returned.
-       The project ID returned is the one defined by ``GOOGLE_CLOUD_PROJECT`` or
-       ``GCLOUD_PROJECT`` environment variables.
-
-       If the environment variable ``GOOGLE_APPLICATION_CREDENTIALS`` is set
+    1. If the environment variable ``GOOGLE_APPLICATION_CREDENTIALS`` is set
        to the path of a valid service account JSON private key file, then it is
        loaded and returned. The project ID returned is the project ID defined
        in the service account file if available (some older files do not
@@ -513,7 +488,6 @@ def default(scopes=None, request=None, quota_project_id=None, default_scopes=Non
     .. _Metadata Service: https://cloud.google.com/compute/docs\
             /storing-retrieving-metadata
     .. _Cloud Run: https://cloud.google.com/run
-    .. _API Key: https://cloud.google.com/docs/authentication/api-keys
 
     Example::
 
@@ -555,19 +529,11 @@ def default(scopes=None, request=None, quota_project_id=None, default_scopes=Non
         environment_vars.PROJECT, os.environ.get(environment_vars.LEGACY_PROJECT)
     )
 
-    if os.environ.get(environment_vars.API_KEY) and os.environ.get(
-        environment_vars.CREDENTIALS
-    ):
-        raise exceptions.DefaultCredentialsError(
-            "Environment variables GOOGLE_API_KEY and GOOGLE_APPLICATION_CREDENTIALS are mutually exclusive"
-        )
-
     checkers = (
         # Avoid passing scopes here to prevent passing scopes to user credentials.
         # with_scopes_if_required() below will ensure scopes/default scopes are
         # safely set on the returned credentials since requires_scopes will
         # guard against setting scopes on user credentials.
-        lambda: _get_api_key_credentials(quota_project_id=quota_project_id),
         lambda: _get_explicit_environ_credentials(quota_project_id=quota_project_id),
         lambda: _get_gcloud_sdk_credentials(quota_project_id=quota_project_id),
         _get_gae_credentials,

google/auth/_default_async.py

@@ -161,24 +161,6 @@ def _get_gae_credentials():
     return _default._get_gae_credentials()
 
 
-def _get_api_key_credentials(quota_project_id=None):
-    """Gets API key credentials and project ID."""
-    from google.auth import api_key
-
-    api_key_value = os.environ.get(environment_vars.API_KEY)
-    if api_key_value:
-        return api_key.Credentials(api_key_value), quota_project_id
-    else:
-        return None, None
-
-
-def get_api_key_credentials(api_key_value):
-    """Gets API key credentials using the given api key value."""
-    from google.auth import api_key
-
-    return api_key.Credentials(api_key_value)
-
-
 def _get_gce_credentials(request=None):
     """Gets credentials and project ID from the GCE Metadata Service."""
     # Ping requires a transport, but we want application default credentials
@@ -200,14 +182,7 @@ def default_async(scopes=None, request=None, quota_project_id=None):
     This function acquires credentials from the environment in the following
     order:
 
-    1. If both ``GOOGLE_API_KEY`` and ``GOOGLE_APPLICATION_CREDENTIALS``
-       environment variables are set, throw an exception.
-
-       If ``GOOGLE_API_KEY`` is set, an `API Key`_ credentials will be returned.
-       The project ID returned is the one defined by ``GOOGLE_CLOUD_PROJECT`` or
-       ``GCLOUD_PROJECT`` environment variables.
-
-       If the environment variable ``GOOGLE_APPLICATION_CREDENTIALS`` is set
+    1. If the environment variable ``GOOGLE_APPLICATION_CREDENTIALS`` is set
        to the path of a valid service account JSON private key file, then it is
        loaded and returned. The project ID returned is the project ID defined
        in the service account file if available (some older files do not
@@ -246,7 +221,6 @@ def default_async(scopes=None, request=None, quota_project_id=None):
     .. _Metadata Service: https://cloud.google.com/compute/docs\
             /storing-retrieving-metadata
     .. _Cloud Run: https://cloud.google.com/run
-    .. _API Key: https://cloud.google.com/docs/authentication/api-keys
 
     Example::
 
@@ -282,15 +256,7 @@ def default_async(scopes=None, request=None, quota_project_id=None):
         environment_vars.PROJECT, os.environ.get(environment_vars.LEGACY_PROJECT)
     )
 
-    if os.environ.get(environment_vars.API_KEY) and os.environ.get(
-        environment_vars.CREDENTIALS
-    ):
-        raise exceptions.DefaultCredentialsError(
-            "GOOGLE_API_KEY and GOOGLE_APPLICATION_CREDENTIALS are mutually exclusive"
-        )
-
     checkers = (
-        lambda: _get_api_key_credentials(quota_project_id=quota_project_id),
         lambda: _get_explicit_environ_credentials(quota_project_id=quota_project_id),
         lambda: _get_gcloud_sdk_credentials(quota_project_id=quota_project_id),
         _get_gae_credentials,

google/auth/environment_vars.py

@@ -33,9 +33,6 @@
 """Environment variable defining the location of Google application default
 credentials."""
 
-API_KEY = "GOOGLE_API_KEY"
-"""Environment variable defining the API key value."""
-
 # The environment variable name which can replace ~/.config if set.
 CLOUD_SDK_CONFIG_DIR = "CLOUDSDK_CONFIG"
 """Environment variable defines the location of Google Cloud SDK's config

tests/test__default.py

@@ -19,7 +19,6 @@
 import pytest  # type: ignore
 
 from google.auth import _default
-from google.auth import api_key
 from google.auth import app_engine
 from google.auth import aws
 from google.auth import compute_engine
@@ -1141,46 +1140,3 @@ def test_default_impersonated_service_account_set_both_scopes_and_default_scopes
 
     credentials, _ = _default.default(scopes=scopes, default_scopes=default_scopes)
     assert credentials._target_scopes == scopes
-
-
-def test__get_api_key_credentials_no_env_var():
-    cred, project_id = _default._get_api_key_credentials(quota_project_id="project-foo")
-    assert cred is None
-    assert project_id is None
-
-
-def test__get_api_key_credentials_from_env_var():
-    with mock.patch.dict(os.environ, {environment_vars.API_KEY: "api-key"}):
-        cred, project_id = _default._get_api_key_credentials(
-            quota_project_id="project-foo"
-        )
-        assert isinstance(cred, api_key.Credentials)
-        assert cred.token == "api-key"
-        assert project_id == "project-foo"
-
-
-def test_exception_with_api_key_and_adc_env_var():
-    with mock.patch.dict(os.environ, {environment_vars.API_KEY: "api-key"}):
-        with mock.patch.dict(
-            os.environ, {environment_vars.CREDENTIALS: "/path/to/json"}
-        ):
-            with pytest.raises(exceptions.DefaultCredentialsError) as excinfo:
-                _default.default()
-
-            assert excinfo.match(
-                r"GOOGLE_API_KEY and GOOGLE_APPLICATION_CREDENTIALS are mutually exclusive"
-            )
-
-
-def test_default_api_key_from_env_var():
-    with mock.patch.dict(os.environ, {environment_vars.API_KEY: "api-key"}):
-        cred, project_id = _default.default()
-        assert isinstance(cred, api_key.Credentials)
-        assert cred.token == "api-key"
-        assert project_id is None
-
-
-def test_get_api_key_credentials():
-    cred = _default.get_api_key_credentials("api-key")
-    assert isinstance(cred, api_key.Credentials)
-    assert cred.token == "api-key"

tests_async/test__default_async.py

@@ -20,7 +20,6 @@
 
 from google.auth import _credentials_async as credentials
 from google.auth import _default_async as _default
-from google.auth import api_key
 from google.auth import app_engine
 from google.auth import compute_engine
 from google.auth import environment_vars
@@ -562,46 +561,3 @@ def test_default_no_warning_with_quota_project_id_for_user_creds(get_adc_path):
     get_adc_path.return_value = test_default.AUTHORIZED_USER_CLOUD_SDK_FILE
 
     credentials, project_id = _default.default_async(quota_project_id="project-foo")
-
-
-def test__get_api_key_credentials_no_env_var():
-    cred, project_id = _default._get_api_key_credentials(quota_project_id="project-foo")
-    assert cred is None
-    assert project_id is None
-
-
-def test__get_api_key_credentials_from_env_var():
-    with mock.patch.dict(os.environ, {environment_vars.API_KEY: "api-key"}):
-        cred, project_id = _default._get_api_key_credentials(
-            quota_project_id="project-foo"
-        )
-        assert isinstance(cred, api_key.Credentials)
-        assert cred.token == "api-key"
-        assert project_id == "project-foo"
-
-
-def test_exception_with_api_key_and_adc_env_var():
-    with mock.patch.dict(os.environ, {environment_vars.API_KEY: "api-key"}):
-        with mock.patch.dict(
-            os.environ, {environment_vars.CREDENTIALS: "/path/to/json"}
-        ):
-            with pytest.raises(exceptions.DefaultCredentialsError) as excinfo:
-                _default.default_async()
-
-            assert excinfo.match(
-                r"GOOGLE_API_KEY and GOOGLE_APPLICATION_CREDENTIALS are mutually exclusive"
-            )
-
-
-def test_default_api_key_from_env_var():
-    with mock.patch.dict(os.environ, {environment_vars.API_KEY: "api-key"}):
-        cred, project_id = _default.default_async()
-        assert isinstance(cred, api_key.Credentials)
-        assert cred.token == "api-key"
-        assert project_id is None
-
-
-def test_get_api_key_credentials():
-    cred = _default.get_api_key_credentials("api-key")
-    assert isinstance(cred, api_key.Credentials)
-    assert cred.token == "api-key"