MCP Terminal Server
by dillip285
/**
* Copyright 2024 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
import { logger } from 'genkit/logging';
import { auth, CredentialBody, GoogleAuth } from 'google-auth-library';
import { GcpPrincipal, GcpTelemetryConfig } from './types.js';
/**
* Allows Google Cloud credentials to be to passed in "raw" as an environment
* variable. This is helpful in environments where the developer has limited
* ability to configure their compute environment, but does have the ablilty to
* set environment variables.
*
* This is different from the GOOGLE_APPLICATION_CREDENTIALS used by ADC, which
* represents a path to a credential file on disk. In *most* cases, even for
* 3rd party cloud providers, developers *should* attempt to use ADC, which
* searches for credential files in standard locations, before using this
* method.
*
* See also: https://github.com/googleapis/google-auth-library-nodejs?tab=readme-ov-file#loading-credentials-from-environment-variables
*/
export async function credentialsFromEnvironment(): Promise<
Partial<GcpTelemetryConfig>
> {
let authClient: GoogleAuth;
let options: Partial<GcpTelemetryConfig> = {};
if (process.env.GCLOUD_SERVICE_ACCOUNT_CREDS) {
logger.debug('Retrieving credentials from GCLOUD_SERVICE_ACCOUNT_CREDS');
const serviceAccountCreds = JSON.parse(
process.env.GCLOUD_SERVICE_ACCOUNT_CREDS
);
const authOptions = { credentials: serviceAccountCreds };
authClient = new GoogleAuth(authOptions);
options.credentials = await authClient.getCredentials();
} else {
authClient = new GoogleAuth();
}
try {
const projectId = await authClient.getProjectId();
if (projectId && projectId.length > 0) {
options.projectId = projectId;
}
} catch (error) {
logger.warn(error);
}
return options;
}
/**
* Resolve the currently configured principal, either from the Genkit specific
* GCLOUD_SERVICE_ACCOUNT_CREDS environment variable, or from ADC.
*
* Since the Google Cloud Telemetry Exporter will discover credentials on its
* own, we don't immediately have access to the current principal. This method
* can be handy to get access to the current credential for logging debugging
* information or other purposes.
**/
export async function resolveCurrentPrincipal(): Promise<GcpPrincipal> {
const envCredentials = await credentialsFromEnvironment();
let adcCredentials = {} as CredentialBody;
try {
adcCredentials = await auth.getCredentials();
} catch (e) {
logger.debug('Could not retrieve client_email from ADC.');
}
// TODO(michaeldoyle): How to look up if the user provided credentials in the
// plugin config (i.e. GcpTelemetryOptions)
let serviceAccountEmail =
envCredentials.credentials?.client_email ?? adcCredentials.client_email;
return {
projectId: envCredentials.projectId,
serviceAccountEmail,
};
}