fix(cloudrun): fix 'cloudrun_service_to_service_receive' sample #13372

eapl-gemugami · 2025-05-16T22:41:42Z

Description

Fixes Internal: b/405225642

Fix the sample to make it work as a Cloud Run Service.
Add an audience based on the Run Service URI.
Start to migrate the samples to app.py as it's required to show the whole Flask app, instead of only the function validating the Bearer Token that was in another file.

Samples:

cloudrun_service_to_service_receive
auth_validate_and_decode_bearer_token_on_flask

Checklist

I have followed Sample Guidelines from AUTHORING_GUIDE.MD
README is updated to include all relevant information
Tests pass: nox -s py-3.9 (see Test Environment Setup)
Lint pass: nox -s lint (see Test Environment Setup)
Please merge this PR for me once it is approved

Implement a Flask app which receives ID tokens, and returns an HTTP response based on the validation of the token.

gemini-code-assist

Hello @eapl-gemugami, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

Summary of Changes

Hello! Gemini here, providing a summary of this pull request. This PR aims to fix the cloudrun_service_to_service_receive sample and the related auth_validate_and_decode_bearer_token_on_flask sample. The core issue addressed is b/405225642. To resolve this and better demonstrate the full Flask application context required for the sample, the authentication validation logic previously in receive.py has been migrated directly into app.py. The PR also updates the associated test suite to reflect these changes, particularly how the ID token is fetched and how anonymous requests are handled (now correctly returning Unauthorized). Dependencies have also been updated.

Highlights

Authentication Logic Update: The app.py now includes code to fetch service metadata (name, project ID, region, service URI) to correctly determine the audience for ID token validation. The main route explicitly checks for an Authorization header and validates the Bearer token, returning HTTPStatus.UNAUTHORIZED if missing or invalid.
Test Suite Updates: The test suite (receive_auth_requests_test.py) has been updated to align with the changes. It now uses google.oauth2.id_token.fetch_id_token to obtain a token with the correct audience (the service URL). Tests for anonymous requests now correctly assert for HTTPStatus.UNAUTHORIZED.
Dependency Updates: Required dependencies have been updated, including google-auth, adding google-cloud-run, and adding backoff for test retries.

Changelog

Click here to see the changelog

run/service-auth/app.py
- Migrated parse_auth_header function from receive.py.
- Added logic to fetch Cloud Run service metadata (name, project ID, region, URI) to use as the token audience.
- Updated the main route (/) to directly call parse_auth_header and enforce authentication, returning HTTPStatus.UNAUTHORIZED with a WWW-Authenticate header for unauthenticated requests.
- Added [START] and [END] markers for the samples.
run/service-auth/receive.py
- Added a comment indicating the sample will be migrated to app.py.
- The original receive_request_and_parse_auth_header function is effectively removed as its logic is moved to app.py.
run/service-auth/receive_auth_requests_test.py
- Updated imports to include backoff, google.auth.transport.requests, and google.oauth2.id_token.
- Removed imports for urllib.error and urllib.request.
- Modified the service_name fixture to include -python in the generated name.
- Updated the token fixture to use google.oauth2.id_token.fetch_id_token with the service endpoint URL as the audience, replacing the gcloud auth print-identity-token subprocess call.
- Removed the initial request check from the client fixture.
- Renamed test functions for clarity (e.g., test_authentication_on_cloud_run to test_authentication_on_cloud_run_service).
- Added @backoff.on_exception decorator to test_authentication_on_cloud_run_service.
- Updated test_anonymous_request_on_cloud_run_service to assert for HTTPStatus.UNAUTHORIZED instead of HTTPStatus.OK and removed assertions about response content.
- Removed the assertion assert "anonymous" not in response_content from test_authentication_on_cloud_run_service.
run/service-auth/requirements-test.txt
- Added backoff==2.2.1.
run/service-auth/requirements.txt
- Updated google-auth to 2.40.1.
- Added google-cloud-run==0.10.18.
- Removed Werkzeug==3.1.3.
run/service-auth/text.py
- Added a new file containing a small script using google-cloud-run to fetch a service URI. (Note: This appears to be a temporary development script and may not be intended as part of the final sample).

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Code moves and shifts,
From receive to app it drifts.
Tests now check auth,
On the secure Cloud Run path.
Fixing samples, a gift.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

The pull request successfully migrates the authentication logic for the cloudrun_service_to_service_receive and auth_validate_and_decode_bearer_token_on_flask samples into app.py, as intended. The updated test suite in receive_auth_requests_test.py correctly reflects the new behavior of the application, requiring authentication and validating the token. The use of backoff in the test is a good addition for robustness. However, there are a few areas related to error handling and file management that could be improved.

Summary of Findings

Inclusion of temporary file: The file run/service-auth/text.py appears to be a temporary scratchpad and should be removed.
Error Handling in app.py: There are several areas in app.py where error handling could be improved for robustness, including fetching metadata/service URI, parsing the Authorization header, and handling exceptions in the main route.
Logging vs. Print: Using print statements for logging in parse_auth_header is less ideal than using Python's built-in logging module for better control over log levels and output.
Test File Cleanup: There is a commented-out line in receive_auth_requests_test.py that should be removed.

Merge Readiness

The pull request implements the core functionality correctly and updates the tests appropriately. However, there is a high-severity issue (inclusion of a temporary file) and several medium-severity issues related to error handling that should be addressed before merging. I am unable to approve this pull request; please have other reviewers approve it once the requested changes are made.

run/service-auth/text.py

run/service-auth/app.py

snippet-bot · 2025-05-16T22:44:46Z

Here is the summary of changes.

You are about to add 2 region tags.

run/service-auth/app.py:15, tag auth_validate_and_decode_bearer_token_on_flask
run/service-auth/app.py:16, tag cloudrun_service_to_service_receive

This comment is generated by snippet-bot.
If you find problems with this result, please file an issue at:
https://github.com/googleapis/repo-automation-bots/issues.
To update this comment, add snippet-bot:force-run label or use the checkbox below:

Refresh this comment

- Add a try-except block to handle potential ValueError.

run/service-auth/app.py

eapl-gemugami added 3 commits April 21, 2025 14:10

fix(cloudrun): Proof of Concept - Service to Service.

c7c5225

Implement a Flask app which receives ID tokens, and returns an HTTP response based on the validation of the token.

fix(cloudrun): Proof of Concept - fix sample to pass Unit Tests

13e85ff

fix(cloudrun): fixes to pass unit tests

84d28ed

product-auto-label bot added samples Issues that are directly related to samples. api: run Issues related to the Cloud Run API. labels May 16, 2025

gemini-code-assist bot reviewed May 16, 2025

View reviewed changes

gemini-code-assist bot suggested changes May 16, 2025

View reviewed changes

run/service-auth/text.py Outdated Show resolved Hide resolved

run/service-auth/app.py Show resolved Hide resolved

run/service-auth/app.py Outdated Show resolved Hide resolved

run/service-auth/app.py Show resolved Hide resolved

fix(cloudrun): delete draft

3b22aaa

eapl-gemugami requested a review from OremGLG May 16, 2025 22:44

eapl-gemugami added the snippet-bot:force-run Force snippet-bot runs its logic label May 16, 2025

snippet-bot bot removed the snippet-bot:force-run Force snippet-bot runs its logic label May 16, 2025

eapl-gemugami added 2 commits May 16, 2025 16:49

fix(cloudrun): add feedback from code-assist

e545d67

- Add a try-except block to handle potential ValueError.

fix(cloudrun): delete placeholder variable

adaf034

eapl-gemugami marked this pull request as ready for review May 16, 2025 23:07

eapl-gemugami requested review from a team as code owners May 16, 2025 23:07

blunderbuss-gcf bot assigned nicain May 16, 2025

eapl-gemugami commented May 16, 2025

View reviewed changes

run/service-auth/app.py Outdated Show resolved Hide resolved

fix(cloudrun): fix typo

48023d8

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(cloudrun): fix 'cloudrun_service_to_service_receive' sample #13372

fix(cloudrun): fix 'cloudrun_service_to_service_receive' sample #13372

eapl-gemugami commented May 16, 2025 •

edited

Loading

gemini-code-assist bot left a comment

gemini-code-assist bot left a comment

snippet-bot bot commented May 16, 2025 •

edited

Loading

fix(cloudrun): fix 'cloudrun_service_to_service_receive' sample #13372

Are you sure you want to change the base?

fix(cloudrun): fix 'cloudrun_service_to_service_receive' sample #13372

Conversation

eapl-gemugami commented May 16, 2025 • edited Loading

Description

Checklist

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Summary of Changes

Highlights

Changelog

Footnotes

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Summary of Findings

Merge Readiness

snippet-bot bot commented May 16, 2025 • edited Loading

eapl-gemugami commented May 16, 2025 •

edited

Loading

snippet-bot bot commented May 16, 2025 •

edited

Loading