This is my fault. I should have documented it better.
I intend to put these comments between my 'if credentials:' and 'if
credentials.cre...' lines:

    # If credentials were passed in, we could have two cases:
    # 1. the scopes have been specified, in which case the given credentials
    #    are used for authorizing the http;
    # 2. the scopes were not provided (meaning the Default Credentials are
    #    to be used). In this case, the Default Credentials are built and
    #    used instead of the original credentials. If there are no scopes
    #    found (meaning the given service requires no authentication),
there is
    #    no authorization of the http.

Does it make it clearer now?

Note that if the scopes were provided inside the given credentials (ie,
credentials.create_scoped_required() returns false) we still want to
authorize the http, regardless of whether scopes are found or not on the
service. Since the user passed in a proper credentials (ie, specified the
scopes), we just use her credentials (vs attempting to use the Default
Credentials).


On Thu, May 29, 2014 at 9:41 AM, Craig Citro <notifications@github.com>
wrote:

> In googleapiclient/discovery.py:
>
> > @@ -249,6 +255,21 @@ def build_from_document(
> >    base = urlparse.urljoin(service['rootUrl'], service['servicePath'])
> >    schema = Schemas(service)
> >
> > +  if credentials:
> > +    should_authorize = True
> > +    if credentials.create_scoped_required():
> > +      if ('auth' in service and
> > +          'oauth2' in service['auth'] and
> > +          'scopes' in service['auth']['oauth2']):
> > +        credentials = credentials.create_scoped(
> > +            service['auth']['oauth2']['scopes'].keys())
> > +      else:
> > +        # No need to authorize the http object
> > +        # if the service does not require authentication.
> > +        should_authorize = False
> > +    if should_authorize:
> > +      http = credentials.authorize(http)
>
> Ahh, I had misunderstood the logic here. I'm still a little confused; in
> my mind, it should be:
>
> if credentials:
>   scopes = service.get('auth', {}).get('oauth2', {}).get('scopes', {}).keys()
>   if scopes:
>     if credentials.create_scoped_required():
>       credentials = credentials.create_scoped()
>     http = credentials.authorize(http)
>
> Note that there's one subtle difference here: if credentials is provided,
> we call .authorize independent of create_scoped_required.
>
> Relatedly, there's something that confuses me -- user passes in
> credentials, and in some cases we create a new credentials. Now the user
> no longer has their hands on the credentials we're using for the http,
> which seems like it could cause confusion.
>
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/google/google-api-python-client/pull/4/files#r13190270>
> .
>



-- 
Orest Bolohan

Software Engineer
Cloud/TI Identity and Access Management Services
Google Inc.
Mountain View, CA

(650) 214 3458
orest@google.com