Skip to content

fix(batch-permit-job): use runtime auth for storage - #1768

Open
Jacky-Pham wants to merge 1 commit into
mainfrom
Jacky/remove-batch-permit-gcp-auth-key
Open

fix(batch-permit-job): use runtime auth for storage#1768
Jacky-Pham wants to merge 1 commit into
mainfrom
Jacky/remove-batch-permit-gcp-auth-key

Conversation

@Jacky-Pham

@Jacky-Pham Jacky-Pham commented Jul 14, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • remove the batch permit validator job's deployed GCP_AUTH_KEY mapping so it uses the Cloud Run runtime identity
  • support keyless signed URL generation by passing refreshed ADC access token and service account email to GCS
  • add focused unit coverage for the keyless signed URL path

@sonarqubecloud

Copy link
Copy Markdown

"""Build and return an authenticated GCS storage client."""
project_id = current_app.config.get("GCP_CS_PROJECT_ID")
credentials = None
if auth_key := current_app.config.get("GCP_AUTH_KEY"):

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the auth key is being used here but removed above. this will result in job failures

"""Gets the presigned url for a file."""
bucket = cls.get_bucket(bucket_id)
storage_client = cls._create_storage_client()
bucket = storage_client.bucket(bucket_id)

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

get_bucket method already exists above


credentials = storage_client._credentials # pylint: disable=protected-access
if credentials and not isinstance(credentials, service_account.Credentials):
credentials.refresh(Request())

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

do we really need to refresh the credentials. wont google manage that automatically since the job is running on GCP Cloud Run?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants