feat: add support for bucket ip filter (#731)

ddelgrosso1 · web-flow · commit be54cc2e1708 · 2025-07-02T10:11:19.000-04:00
* feat: add support for bucket ip filter

* lint
diff --git a/bidi-api-updates.patch b/bidi-api-updates.patch
diff --git a/gcs/bucket.py b/gcs/bucket.py
@@ -48,6 +48,7 @@ class Bucket:
         "location_type",
         "iam_config",
         "rpo",
+        "ip_filter",
     }
 
     def __init__(self, metadata, notifications, iam_policy):
@@ -210,6 +211,49 @@ def __preprocess_rest_soft_delete_policy(cls, rp):
             },
         )
 
+    @classmethod
+    def __preprocess_rest_ip_filter(cls, ipf):
+        if ipf.get("vpcNetworkSources") is not None:
+            sources = []
+            for source in ipf.get("vpcNetworkSources"):
+                sources.append(
+                    testbench.common.rest_adjust(
+                        source,
+                        {
+                            "network": lambda x: ("network", x),
+                            "allowedIpCidrRanges": lambda x: (
+                                "allowed_ip_cidr_ranges",
+                                x,
+                            ),
+                        },
+                    )
+                )
+            ipf["vpcNetworkSources"] = sources
+        return testbench.common.rest_adjust(
+            ipf,
+            {
+                "mode": lambda x: ("mode", x),
+                "publicNetworkSource": lambda x: (
+                    "public_network_source",
+                    testbench.common.rest_adjust(
+                        x,
+                        {
+                            "allowedIpCidrRanges": lambda x: (
+                                "allowed_ip_cidr_ranges",
+                                x,
+                            )
+                        },
+                    ),
+                ),
+                "vpcNetworkSources": lambda x: ("vpc_network_sources", x),
+                "allowCrossOrgVpcs": lambda x: ("allow_cross_org_vpcs", x),
+                "allowAllServiceAgentAccess": lambda x: (
+                    "allow_all_service_agent_access",
+                    x,
+                ),
+            },
+        )
+
     @classmethod
     def __preprocess_rest(cls, rest):
         rest = testbench.common.rest_adjust(
@@ -242,6 +286,10 @@ def __preprocess_rest(cls, rest):
                     "softDeletePolicy",
                     Bucket.__preprocess_rest_soft_delete_policy(x),
                 ),
+                "ipFilter": lambda x: (
+                    "ipFilter",
+                    Bucket.__preprocess_rest_ip_filter(x),
+                ),
             },
         )
         if rest.get("acl", None) is not None:
diff --git a/google/iam/v1/iam_policy_pb2.py b/google/iam/v1/iam_policy_pb2.py
@@ -16,7 +16,7 @@
 # Generated by the protocol buffer compiler.  DO NOT EDIT!
 # NO CHECKED-IN PROTOBUF GENCODE
 # source: google/iam/v1/iam_policy.proto
-# Protobuf Python Version: 5.27.2
+# Protobuf Python Version: 5.29.0
 """Generated protocol buffer code."""
 from google.protobuf import descriptor as _descriptor
 from google.protobuf import descriptor_pool as _descriptor_pool
@@ -26,8 +26,8 @@
 _runtime_version.ValidateProtobufRuntimeVersion(
     _runtime_version.Domain.PUBLIC,
     5,
-    27,
-    2,
+    29,
+    0,
     '',
     'google/iam/v1/iam_policy.proto'
 )
diff --git a/google/iam/v1/iam_policy_pb2_grpc.py b/google/iam/v1/iam_policy_pb2_grpc.py
@@ -20,7 +20,7 @@
 from google.iam.v1 import iam_policy_pb2 as google_dot_iam_dot_v1_dot_iam__policy__pb2
 from google.iam.v1 import policy_pb2 as google_dot_iam_dot_v1_dot_policy__pb2
 
-GRPC_GENERATED_VERSION = '1.67.0'
+GRPC_GENERATED_VERSION = '1.70.0'
 GRPC_VERSION = grpc.__version__
 _version_not_supported = False
 
diff --git a/google/iam/v1/options_pb2.py b/google/iam/v1/options_pb2.py
@@ -16,7 +16,7 @@
 # Generated by the protocol buffer compiler.  DO NOT EDIT!
 # NO CHECKED-IN PROTOBUF GENCODE
 # source: google/iam/v1/options.proto
-# Protobuf Python Version: 5.27.2
+# Protobuf Python Version: 5.29.0
 """Generated protocol buffer code."""
 from google.protobuf import descriptor as _descriptor
 from google.protobuf import descriptor_pool as _descriptor_pool
@@ -26,8 +26,8 @@
 _runtime_version.ValidateProtobufRuntimeVersion(
     _runtime_version.Domain.PUBLIC,
     5,
-    27,
-    2,
+    29,
+    0,
     '',
     'google/iam/v1/options.proto'
 )
diff --git a/google/iam/v1/options_pb2_grpc.py b/google/iam/v1/options_pb2_grpc.py
@@ -18,7 +18,7 @@
 import warnings
 
 
-GRPC_GENERATED_VERSION = '1.67.0'
+GRPC_GENERATED_VERSION = '1.70.0'
 GRPC_VERSION = grpc.__version__
 _version_not_supported = False
 
diff --git a/google/iam/v1/policy_pb2.py b/google/iam/v1/policy_pb2.py
@@ -16,7 +16,7 @@
 # Generated by the protocol buffer compiler.  DO NOT EDIT!
 # NO CHECKED-IN PROTOBUF GENCODE
 # source: google/iam/v1/policy.proto
-# Protobuf Python Version: 5.27.2
+# Protobuf Python Version: 5.29.0
 """Generated protocol buffer code."""
 from google.protobuf import descriptor as _descriptor
 from google.protobuf import descriptor_pool as _descriptor_pool
@@ -26,8 +26,8 @@
 _runtime_version.ValidateProtobufRuntimeVersion(
     _runtime_version.Domain.PUBLIC,
     5,
-    27,
-    2,
+    29,
+    0,
     '',
     'google/iam/v1/policy.proto'
 )
diff --git a/google/iam/v1/policy_pb2_grpc.py b/google/iam/v1/policy_pb2_grpc.py
@@ -18,7 +18,7 @@
 import warnings
 
 
-GRPC_GENERATED_VERSION = '1.67.0'
+GRPC_GENERATED_VERSION = '1.70.0'
 GRPC_VERSION = grpc.__version__
 _version_not_supported = False
 
diff --git a/google/storage/v2/storage_pb2.py b/google/storage/v2/storage_pb2.py
diff --git a/google/storage/v2/storage_pb2_grpc.py b/google/storage/v2/storage_pb2_grpc.py
@@ -22,7 +22,7 @@
 from google.protobuf import empty_pb2 as google_dot_protobuf_dot_empty__pb2
 from google.storage.v2 import storage_pb2 as google_dot_storage_dot_v2_dot_storage__pb2
 
-GRPC_GENERATED_VERSION = '1.67.0'
+GRPC_GENERATED_VERSION = '1.70.0'
 GRPC_VERSION = grpc.__version__
 _version_not_supported = False
 
@@ -256,7 +256,9 @@ def LockBucketRetentionPolicy(self, request, context):
     def GetIamPolicy(self, request, context):
         """Gets the IAM policy for a specified bucket.
         The `resource` field in the request should be
-        `projects/_/buckets/{bucket}`.
+        `projects/_/buckets/{bucket}` for a bucket, or
+        `projects/_/buckets/{bucket}/managedFolders/{managedFolder}`
+        for a managed folder.
         """
         context.set_code(grpc.StatusCode.UNIMPLEMENTED)
         context.set_details('Method not implemented!')
@@ -265,7 +267,9 @@ def GetIamPolicy(self, request, context):
     def SetIamPolicy(self, request, context):
         """Updates an IAM policy for the specified bucket.
         The `resource` field in the request should be
-        `projects/_/buckets/{bucket}`.
+        `projects/_/buckets/{bucket}` for a bucket, or
+        `projects/_/buckets/{bucket}/managedFolders/{managedFolder}`
+        for a managed folder.
         """
         context.set_code(grpc.StatusCode.UNIMPLEMENTED)
         context.set_details('Method not implemented!')
@@ -374,7 +378,26 @@ def ReadObject(self, request, context):
         raise NotImplementedError('Method not implemented!')
 
     def BidiReadObject(self, request_iterator, context):
-        """Missing associated documentation comment in .proto file."""
+        """Reads an object's data.
+
+        This is a bi-directional API with the added support for reading multiple
+        ranges within one stream both within and across multiple messages.
+        If the server encountered an error for any of the inputs, the stream will
+        be closed with the relevant error code.
+        Because the API allows for multiple outstanding requests, when the stream
+        is closed the error response will contain a BidiReadObjectRangesError proto
+        in the error extension describing the error for each outstanding read_id.
+
+        **IAM Permissions**:
+
+        Requires `storage.objects.get`
+
+        [IAM permission](https://cloud.google.com/iam/docs/overview#permissions) on
+        the bucket.
+
+        This API is currently in preview and is not yet available for general
+        use.
+        """
         context.set_code(grpc.StatusCode.UNIMPLEMENTED)
         context.set_details('Method not implemented!')
         raise NotImplementedError('Method not implemented!')
diff --git a/testbench/proto2rest.py b/testbench/proto2rest.py
@@ -170,6 +170,47 @@ def __postprocess_rest_soft_delete_policy(data):
     )
 
 
+def __postprocess_rest_ip_filter(data):
+    if data.get("vpcNetworkSources") is not None:
+        sources = []
+        for source in data.get("vpcNetworkSources"):
+            sources.append(
+                testbench.common.rest_adjust(
+                    source,
+                    {
+                        "allowed_ip_cidr_ranges": lambda x: (
+                            "allowedIpCidrRanges",
+                            x,
+                        )
+                    },
+                )
+            )
+        data["vpcNetworkSources"] = sources
+    return testbench.common.rest_adjust(
+        data,
+        {
+            "public_network_source": lambda x: (
+                "publicNetworkSource",
+                testbench.common.rest_adjust(
+                    x,
+                    {
+                        "allowed_ip_cidr_ranges": lambda x: (
+                            "allowedIpCidrRanges",
+                            x,
+                        )
+                    },
+                ),
+            ),
+            "vpc_network_sources": lambda x: ("vpcNetworkSources", x),
+            "allow_cross_org_vpcs": lambda x: ("allowCrossOrgVpcs", x),
+            "allow_all_service_agent_access": lambda x: (
+                "allowAllServiceAgentAccess",
+                x,
+            ),
+        },
+    )
+
+
 def __postprocess_bucket_rest(data):
     bucket_id = testbench.common.bucket_name_from_proto(data["name"])
     data = testbench.common.rest_adjust(
@@ -208,6 +249,7 @@ def __postprocess_bucket_rest(data):
                 "softDeletePolicy",
                 __postprocess_rest_soft_delete_policy(x),
             ),
+            "ipFilter": lambda x: ("ipFilter", __postprocess_rest_ip_filter(x)),
         },
     )
     data["kind"] = "storage#bucket"
diff --git a/tests/test_bucket.py b/tests/test_bucket.py
@@ -720,6 +720,45 @@ def test_cdr(self):
         bucket, _ = gcs.bucket.Bucket.init(request, None)
         self.assertEqual(bucket.metadata.location, "US-EAST1+US-WEST1")
 
+    def test_ip_filter(self):
+        request = testbench.common.FakeRequest(
+            args={},
+            data=json.dumps(
+                {
+                    "name": "bucket",
+                    "ipFilter": {
+                        "mode": "mode",
+                        "publicNetworkSource": {
+                            "allowedIpCidrRanges": ["213.207.0.0/17"]
+                        },
+                        "vpcNetworkSources": [
+                            {
+                                "network": "network",
+                                "allowedIpCidrRanges": ["192.168.0.0/24"],
+                            }
+                        ],
+                        "allowCrossOrgVpcs": True,
+                        "allowAllServiceAgentAccess": True,
+                    },
+                }
+            ),
+        )
+        bucket, _ = gcs.bucket.Bucket.init(request, None)
+        self.assertEqual(bucket.metadata.ip_filter.mode, "mode")
+        self.assertEqual(
+            bucket.metadata.ip_filter.public_network_source.allowed_ip_cidr_ranges,
+            ["213.207.0.0/17"],
+        )
+        self.assertEqual(
+            bucket.metadata.ip_filter.vpc_network_sources[0].allowed_ip_cidr_ranges,
+            ["192.168.0.0/24"],
+        )
+        self.assertEqual(
+            bucket.metadata.ip_filter.vpc_network_sources[0].network, "network"
+        )
+        self.assertEqual(bucket.metadata.ip_filter.allow_cross_org_vpcs, True)
+        self.assertEqual(bucket.metadata.ip_filter.allow_all_service_agent_access, True)
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/tests/test_bucket_grpc.py b/tests/test_bucket_grpc.py
@@ -255,6 +255,27 @@ def test_init_grpc_soft_delete_policy_nanos_are_invalid(self):
             grpc.StatusCode.INVALID_ARGUMENT, unittest.mock.ANY
         )
 
+    def test_init_grpc_ip_filter(self):
+        policy = storage_pb2.Bucket.IpFilter()
+        policy.mode = "mode"
+        policy.public_network_source.allowed_ip_cidr_ranges.append("213.207.0.0/17")
+        vpcs = policy.vpc_network_sources.add()
+        vpcs.network = "network"
+        vpcs.allowed_ip_cidr_ranges.append("192.168.0.0/24")
+        policy.allow_cross_org_vpcs = True
+        policy.allow_all_service_agent_access = True
+        request = storage_pb2.CreateBucketRequest(
+            parent="projects/_",
+            bucket_id="test-bucket-name",
+            bucket=storage_pb2.Bucket(
+                project="project/test-project",
+                ip_filter=policy,
+            ),
+        )
+        context = unittest.mock.Mock()
+        bucket, _ = gcs.bucket.Bucket.init_grpc(request, context)
+        self.assertEqual(bucket.metadata.ip_filter, policy)
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/update-protos.sh b/update-protos.sh
@@ -42,9 +42,6 @@ else
   git -C "${GOOGLEAPIS_ROOT}" checkout master
   git -C "${GOOGLEAPIS_ROOT}" pull
 fi
-for f in "${PWD}"/*.patch ; do
-  env -C "${GOOGLEAPIS_ROOT}" patch -p1 <$PWD/*.patch
-done
 
 for input in "${INPUTS[@]}"; do
   python -m grpc_tools.protoc -I"${GOOGLEAPIS_ROOT}" \
