feat: add 'py.typed' declaration (#919)

Test types under CI using new 'mypy' nox session.

Co-authored-by: arithmetic1728 <58957152+arithmetic1728@users.noreply.github.com>

google/__init__.py

@@ -21,4 +21,4 @@
 except ImportError:
     import pkgutil
 
-    __path__ = pkgutil.extend_path(__path__, __name__)
+    __path__ = pkgutil.extend_path(__path__, __name__)  # type: ignore

google/auth/_jwt_async.py

@@ -43,7 +43,7 @@
 change in minor releases.
 """
 
-import google.auth
+from google.auth import _credentials_async
 from google.auth import jwt
 
 
@@ -91,9 +91,7 @@ def decode(token, certs=None, verify=True, audience=None):
 
 
 class Credentials(
-    jwt.Credentials,
-    google.auth._credentials_async.Signing,
-    google.auth._credentials_async.Credentials,
+    jwt.Credentials, _credentials_async.Signing, _credentials_async.Credentials
 ):
     """Credentials that use a JWT as the bearer token.
 
@@ -146,9 +144,7 @@ class Credentials(
 
 
 class OnDemandCredentials(
-    jwt.OnDemandCredentials,
-    google.auth._credentials_async.Signing,
-    google.auth._credentials_async.Credentials,
+    jwt.OnDemandCredentials, _credentials_async.Signing, _credentials_async.Credentials
 ):
     """On-demand JWT credentials.
 

google/auth/_oauth2client.py

@@ -30,14 +30,14 @@
 import google.oauth2.service_account
 
 try:
-    import oauth2client.client
-    import oauth2client.contrib.gce
-    import oauth2client.service_account
+    import oauth2client.client  # type: ignore
+    import oauth2client.contrib.gce  # type: ignore
+    import oauth2client.service_account  # type: ignore
 except ImportError as caught_exc:
     six.raise_from(ImportError("oauth2client is not installed."), caught_exc)
 
 try:
-    import oauth2client.contrib.appengine  # pytype: disable=import-error
+    import oauth2client.contrib.appengine  # type: ignore
 
     _HAS_APPENGINE = True
 except ImportError:

google/auth/app_engine.py

@@ -30,9 +30,9 @@
 
 # pytype: disable=import-error
 try:
-    from google.appengine.api import app_identity
+    from google.appengine.api import app_identity  # type: ignore
 except ImportError:
-    app_identity = None
+    app_identity = None  # type: ignore
 # pytype: enable=import-error
 
 
@@ -168,12 +168,12 @@ def with_quota_project(self, quota_project_id):
     def sign_bytes(self, message):
         return self._signer.sign(message)
 
-    @property
+    @property  # type: ignore
     @_helpers.copy_docstring(credentials.Signing)
     def signer_email(self):
         return self.service_account_email
 
-    @property
+    @property  # type: ignore
     @_helpers.copy_docstring(credentials.Signing)
     def signer(self):
         return self._signer

google/auth/aws.py

@@ -45,14 +45,9 @@
 import posixpath
 import re
 
-try:
-    from urllib.parse import urljoin
-# Python 2.7 compatibility
-except ImportError:  # pragma: NO COVER
-    from urlparse import urljoin
-
 from six.moves import http_client
 from six.moves import urllib
+from six.moves.urllib.parse import urljoin
 
 from google.auth import _helpers
 from google.auth import environment_vars

google/auth/compute_engine/credentials.py

@@ -379,7 +379,7 @@ def refresh(self, request):
             self.token = access_token
             self.expiry = expiry
 
-    @property
+    @property  # type: ignore
     @_helpers.copy_docstring(credentials.Signing)
     def signer(self):
         return self._signer

google/auth/crypt/__init__.py

@@ -45,7 +45,7 @@
 try:
     from google.auth.crypt import es256
 except ImportError:  # pragma: NO COVER
-    es256 = None
+    es256 = None  # type: ignore
 
 if es256 is not None:  # pragma: NO COVER
     __all__ = [

google/auth/crypt/_cryptography_rsa.py

@@ -101,7 +101,7 @@ def __init__(self, private_key, key_id=None):
         self._key = private_key
         self._key_id = key_id
 
-    @property
+    @property  # type: ignore
     @_helpers.copy_docstring(base.Signer)
     def key_id(self):
         return self._key_id

google/auth/crypt/_python_rsa.py

@@ -21,11 +21,11 @@
 
 from __future__ import absolute_import
 
-from pyasn1.codec.der import decoder
-from pyasn1_modules import pem
-from pyasn1_modules.rfc2459 import Certificate
-from pyasn1_modules.rfc5208 import PrivateKeyInfo
-import rsa
+from pyasn1.codec.der import decoder  # type: ignore
+from pyasn1_modules import pem  # type: ignore
+from pyasn1_modules.rfc2459 import Certificate  # type: ignore
+from pyasn1_modules.rfc5208 import PrivateKeyInfo  # type: ignore
+import rsa  # type: ignore
 import six
 
 from google.auth import _helpers
@@ -125,7 +125,7 @@ def __init__(self, private_key, key_id=None):
         self._key = private_key
         self._key_id = key_id
 
-    @property
+    @property  # type: ignore
     @_helpers.copy_docstring(base.Signer)
     def key_id(self):
         return self._key_id

google/auth/crypt/es256.py

@@ -15,7 +15,7 @@
 """ECDSA (ES256) verifier and signer that use the ``cryptography`` library.
 """
 
-from cryptography import utils
+from cryptography import utils  # type: ignore
 import cryptography.exceptions
 from cryptography.hazmat import backends
 from cryptography.hazmat.primitives import hashes
@@ -117,7 +117,7 @@ def __init__(self, private_key, key_id=None):
         self._key = private_key
         self._key_id = key_id
 
-    @property
+    @property  # type: ignore
     @_helpers.copy_docstring(base.Signer)
     def key_id(self):
         return self._key_id

google/auth/crypt/rsa.py

@@ -26,5 +26,5 @@
     # unavailable.
     from google.auth.crypt import _python_rsa
 
-    RSASigner = _python_rsa.RSASigner
-    RSAVerifier = _python_rsa.RSAVerifier
+    RSASigner = _python_rsa.RSASigner  # type: ignore
+    RSAVerifier = _python_rsa.RSAVerifier  # type: ignore

google/auth/jwt.py

@@ -44,7 +44,7 @@
     from collections.abc import Mapping
 # Python 2.7 compatibility
 except ImportError:  # pragma: NO COVER
-    from collections import Mapping
+    from collections import Mapping  # type: ignore
 import copy
 import datetime
 import json
@@ -62,15 +62,15 @@
 try:
     from google.auth.crypt import es256
 except ImportError:  # pragma: NO COVER
-    es256 = None
+    es256 = None  # type: ignore
 
 _DEFAULT_TOKEN_LIFETIME_SECS = 3600  # 1 hour in seconds
 _DEFAULT_MAX_CACHE_SIZE = 10
 _ALGORITHM_TO_VERIFIER_CLASS = {"RS256": crypt.RSAVerifier}
 _CRYPTOGRAPHY_BASED_ALGORITHMS = frozenset(["ES256"])
 
 if es256 is not None:  # pragma: NO COVER
-    _ALGORITHM_TO_VERIFIER_CLASS["ES256"] = es256.ES256Verifier
+    _ALGORITHM_TO_VERIFIER_CLASS["ES256"] = es256.ES256Verifier  # type: ignore
 
 
 def encode(signer, payload, header=None, key_id=None):
@@ -557,12 +557,12 @@ def refresh(self, request):
     def sign_bytes(self, message):
         return self._signer.sign(message)
 
-    @property
+    @property  # type: ignore
     @_helpers.copy_docstring(google.auth.credentials.Signing)
     def signer_email(self):
         return self._issuer
 
-    @property
+    @property  # type: ignore
     @_helpers.copy_docstring(google.auth.credentials.Signing)
     def signer(self):
         return self._signer
@@ -846,12 +846,12 @@ def before_request(self, request, method, url, headers):
     def sign_bytes(self, message):
         return self._signer.sign(message)
 
-    @property
+    @property  # type: ignore
     @_helpers.copy_docstring(google.auth.credentials.Signing)
     def signer_email(self):
         return self._issuer
 
-    @property
+    @property  # type: ignore
     @_helpers.copy_docstring(google.auth.credentials.Signing)
     def signer(self):
         return self._signer

google/auth/py.typed

@@ -0,0 +1,2 @@
+# Marker file for PEP 561.
+# The google-auth package uses inline types.

google/auth/transport/_aiohttp_requests.py

@@ -23,9 +23,9 @@
 import asyncio
 import functools
 
-import aiohttp
+import aiohttp  # type: ignore
 import six
-import urllib3
+import urllib3  # type: ignore
 
 from google.auth import exceptions
 from google.auth import transport

google/auth/transport/grpc.py

@@ -27,7 +27,7 @@
 from google.oauth2 import service_account
 
 try:
-    import grpc
+    import grpc  # type: ignore
 except ImportError as caught_exc:  # pragma: NO COVER
     six.raise_from(
         ImportError(

google/auth/transport/requests.py

@@ -205,7 +205,7 @@ class _MutualTlsAdapter(requests.adapters.HTTPAdapter):
     def __init__(self, cert, key):
         import certifi
         from OpenSSL import crypto
-        import urllib3.contrib.pyopenssl
+        import urllib3.contrib.pyopenssl  # type: ignore
 
         urllib3.contrib.pyopenssl.inject_into_urllib3()
 

google/auth/transport/urllib3.py

@@ -29,22 +29,21 @@
 try:
     import certifi
 except ImportError:  # pragma: NO COVER
-    certifi = None
+    certifi = None  # type: ignore
+
+import six
 
 try:
-    import urllib3
+    import urllib3  # type: ignore
+    import urllib3.exceptions  # type: ignore
 except ImportError as caught_exc:  # pragma: NO COVER
-    import six
-
     six.raise_from(
         ImportError(
             "The urllib3 library is not installed, please install the "
             "urllib3 package to use the urllib3 transport."
         ),
         caught_exc,
     )
-import six
-import urllib3.exceptions  # pylint: disable=ungrouped-imports
 
 from google.auth import environment_vars
 from google.auth import exceptions
@@ -169,7 +168,7 @@ def _make_mutual_tls_http(cert, key):
     """
     import certifi
     from OpenSSL import crypto
-    import urllib3.contrib.pyopenssl
+    import urllib3.contrib.pyopenssl  # type: ignore
 
     urllib3.contrib.pyopenssl.inject_into_urllib3()
     ctx = urllib3.util.ssl_.create_urllib3_context()

google/oauth2/challenges.py

@@ -114,9 +114,9 @@ def is_locally_eligible(self):
     @_helpers.copy_docstring(ReauthChallenge)
     def obtain_challenge_input(self, metadata):
         try:
-            import pyu2f.convenience.authenticator
-            import pyu2f.errors
-            import pyu2f.model
+            import pyu2f.convenience.authenticator  # type: ignore
+            import pyu2f.errors  # type: ignore
+            import pyu2f.model  # type: ignore
         except ImportError:
             raise exceptions.ReauthFailError(
                 "pyu2f dependency is required to use Security key reauth feature. "

google/oauth2/py.typed

@@ -0,0 +1,2 @@
+# Marker file for PEP 561.
+# The google-oauth2 package uses inline types.

google/oauth2/service_account.py

@@ -444,12 +444,12 @@ def _create_self_signed_jwt(self, audience):
     def sign_bytes(self, message):
         return self._signer.sign(message)
 
-    @property
+    @property  # type: ignore
     @_helpers.copy_docstring(credentials.Signing)
     def signer(self):
         return self._signer
 
-    @property
+    @property  # type: ignore
     @_helpers.copy_docstring(credentials.Signing)
     def signer_email(self):
         return self._service_account_email
@@ -676,12 +676,12 @@ def service_account_email(self):
     def sign_bytes(self, message):
         return self._signer.sign(message)
 
-    @property
+    @property  # type: ignore
     @_helpers.copy_docstring(credentials.Signing)
     def signer(self):
         return self._signer
 
-    @property
+    @property  # type: ignore
     @_helpers.copy_docstring(credentials.Signing)
     def signer_email(self):
         return self._service_account_email

mypy.ini

@@ -0,0 +1,3 @@
+[mypy]
+python_version = 3.6
+namespace_packages = True

noxfile.py

@@ -62,6 +62,24 @@ def blacken(session):
     session.run("black", *BLACK_PATHS)
 
 
+@nox.session(python="3.6")
+def mypy(session):
+    """Verify type hints are mypy compatible."""
+    session.install("-e", ".")
+    session.install(
+        "mypy",
+        "types-cachetools",
+        "types-certifi",
+        "types-freezegun",
+        "types-pyOpenSSL",
+        "types-requests",
+        "types-setuptools",
+        "types-six",
+        "types-mock",
+    )
+    session.run("mypy", "google/", "tests/", "tests_async/")
+
+
 @nox.session(python=["3.6", "3.7", "3.8", "3.9", "3.10"])
 def unit(session):
     constraints_path = str(

tests/compute_engine/test__metadata.py

@@ -17,7 +17,7 @@
 import os
 
 import mock
-import pytest
+import pytest  # type: ignore
 from six.moves import http_client
 from six.moves import reload_module
 

tests/compute_engine/test_credentials.py

@@ -15,8 +15,8 @@
 import datetime
 
 import mock
-import pytest
-import responses
+import pytest  # type: ignore
+import responses  # type: ignore
 
 from google.auth import _helpers
 from google.auth import exceptions