search

google / webrisk

Apache License 2.0
67 stars 34 forks source link

Replace common *http.Client with Google API transport #52

Closed ErikBooijMB closed 1 year ago

ErikBooijMB commented 1 year ago

Currently the Webrisk client requires authentication with an API key, which can be inconvenient or even impossible in certain circumstances/environments. In our case we need to authenticate through our application default credentials, and this change aims to make that possible.

By substituting the raw *http.Client for the client provided by Google's own API Client package, this becomes possible with no change required for consumers of the client.

For users authenticating with an API key, that continues to function as-is, for users starting to use this client, they can choose between API key or ADC.

I think it would also resolve this issue: https://github.com/google/webrisk/issues/24

rvilgalys commented 1 year ago

Hi @ErikBooijMB! Thanks for sending this. We also heard about this issue from a couple of our CEs who passed along the other correspondence.

Unfortunately I can't merge this directly as this Repo is now maintained and published from google's internal source control, so we'll have to make the changes internally along with adding more tests to confirm the new auth is working. We might also look into using the option package wrapping the transport package that you're using here as that offers other ways of auth as well.

Since I don't want to hold you up waiting for me here, I'd suggest using a fork with this change until we can get it released. Will update #24 with this info and also when we have anything more to share on this.

ErikBooijMB commented 1 year ago

Hi @rvilgalys, thanks for the explanation, appreciate the insight, and it makes total sense. We'll work with a fork a for the time being 👌 Would you happen to have a rough estimation on a timeline? Not gonna hold you to it 😉, but just trying to get a sense of whether we're looking at weeks/months/a year, so we can take that into account when expanding our WebRisk coverage into more of our projects.

And on another note, does the fact that the repo is now maintained within Google's internal source control mean it won't be open to public contributions in the future, or just that those should be created elsewhere?

Thanks!