fix: allow bigframes.options.bigquery.credentials to be None (#2092)

* fix: allow bigframes.options.bigquery.credentials to be `None` This is a partial revert of "perf: avoid re-authenticating if credentials have already been fetched (#2058)", commit 913de1b. * add unit test

Author: tswast

bigframes/_config/bigquery_options.py

@@ -22,7 +22,6 @@
 import google.auth.credentials
 import requests.adapters
 
-import bigframes._config.auth
 import bigframes._importing
 import bigframes.enums
 import bigframes.exceptions as bfe
@@ -38,7 +37,6 @@
 
 def _get_validated_location(value: Optional[str]) -> Optional[str]:
  import bigframes._tools.strings
- import bigframes.constants
 
  if value is None or value in bigframes.constants.ALL_BIGQUERY_LOCATIONS:
  return value
@@ -143,52 +141,20 @@ def application_name(self, value: Optional[str]):
  )
  self._application_name = value
 
- def _try_set_default_credentials_and_project(
- self,
- ) -> tuple[google.auth.credentials.Credentials, Optional[str]]:
- # Don't fetch credentials or project if credentials is already set.
- # If it's set, we've already authenticated, so if the user wants to
- # re-auth, they should explicitly reset the credentials.
- if self._credentials is not None:
- return self._credentials, self._project
-
- (
- credentials,
- credentials_project,
- ) = bigframes._config.auth.get_default_credentials_with_project()
- self._credentials = credentials
-
- # Avoid overriding an explicitly set project with a default value.
- if self._project is None:
- self._project = credentials_project
-
- return credentials, self._project
-
  @property
- def credentials(self) -> google.auth.credentials.Credentials:
+ def credentials(self) -> Optional[google.auth.credentials.Credentials]:
  """The OAuth2 credentials to use for this client.
 
- Set to None to force re-authentication.
-
  Returns:
  None or google.auth.credentials.Credentials:
  google.auth.credentials.Credentials if exists; otherwise None.
  """
- if self._credentials:
- return self._credentials
-
- credentials, _ = self._try_set_default_credentials_and_project()
- return credentials
+ return self._credentials
 
  @credentials.setter
  def credentials(self, value: Optional[google.auth.credentials.Credentials]):
  if self._session_started and self._credentials is not value:
  raise ValueError(SESSION_STARTED_MESSAGE.format(attribute="credentials"))
-
- if value is None:
- # The user has _explicitly_ asked that we re-authenticate.
- bigframes._config.auth.reset_default_credentials_and_project()
-
  self._credentials = value
 
  @property
@@ -217,11 +183,7 @@ def project(self) -> Optional[str]:
  None or str:
  Google Cloud project ID as a string; otherwise None.
  """
- if self._project:
- return self._project
-
- _, project = self._try_set_default_credentials_and_project()
- return project
+ return self._project
 
  @project.setter
  def project(self, value: Optional[str]):

bigframes/session/clients.py

@@ -32,7 +32,7 @@
 import google.cloud.storage # type: ignore
 import requests
 
-import bigframes._config
+import bigframes._config.auth
 import bigframes.constants
 import bigframes.version
 
@@ -50,6 +50,10 @@
 _BIGQUERYSTORAGE_REGIONAL_ENDPOINT = "bigquerystorage.{location}.rep.googleapis.com"
 
 
+def _get_default_credentials_with_project():
+ return bigframes._config.auth.get_default_credentials_with_project()
+
+
 def _get_application_names():
  apps = [_APPLICATION_NAME]
 
@@ -84,8 +88,7 @@ def __init__(
  ):
  credentials_project = None
  if credentials is None:
- credentials = bigframes._config.options.bigquery.credentials
- credentials_project = bigframes._config.options.bigquery.project
+ credentials, credentials_project = _get_default_credentials_with_project()
 
  # Prefer the project in this order:
  # 1. Project explicitly specified by the user

tests/unit/_config/test_bigquery_options.py

@@ -203,3 +203,8 @@ def test_default_options():
 
  assert options.allow_large_results is False
  assert options.ordering_mode == "strict"
+
+ # We should default to None as an indicator that the user hasn't set these
+ # explicitly. See internal issue b/445731915.
+ assert options.credentials is None
+ assert options.project is None

tests/unit/pandas/io/test_api.py

@@ -17,6 +17,7 @@
 import google.cloud.bigquery
 import pytest
 
+import bigframes._config.auth
 import bigframes.dataframe
 import bigframes.pandas
 import bigframes.pandas.io.api as bf_io_api
@@ -50,7 +51,7 @@ def test_read_gbq_colab_dry_run_doesnt_call_set_location(
  mock_set_location.assert_not_called()
 
 
-@mock.patch("bigframes._config.auth.get_default_credentials_with_project")
+@mock.patch("bigframes._config.auth.pydata_google_auth.default")
 @mock.patch("bigframes.core.global_session.with_default_session")
 def test_read_gbq_colab_dry_run_doesnt_authenticate_multiple_times(
  mock_with_default_session, mock_get_credentials, monkeypatch
@@ -77,12 +78,14 @@ def test_read_gbq_colab_dry_run_doesnt_authenticate_multiple_times(
  mock_df = mock.create_autospec(bigframes.dataframe.DataFrame)
  mock_with_default_session.return_value = mock_df
 
+ bigframes._config.auth._cached_credentials = None
  query_or_table = "SELECT {param1} AS param1"
  sample_pyformat_args = {"param1": "value1"}
  bf_io_api._read_gbq_colab(
  query_or_table, pyformat_args=sample_pyformat_args, dry_run=True
  )
 
+ mock_get_credentials.assert_called()
  mock_with_default_session.assert_not_called()
  mock_get_credentials.reset_mock()