feat(storage): migrate to Service Account Credentials API (#189)

google/cloud/storage/_signing.py

@@ -660,14 +660,14 @@ def _sign_message(message, access_token, service_account_email):
     message = _helpers._to_bytes(message)
 
     method = "POST"
-    url = "https://iam.googleapis.com/v1/projects/-/serviceAccounts/{}:signBlob?alt=json".format(
+    url = "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/{}:signBlob?alt=json".format(
         service_account_email
     )
     headers = {
         "Authorization": "Bearer " + access_token,
         "Content-type": "application/json",
     }
-    body = json.dumps({"bytesToSign": base64.b64encode(message).decode("utf-8")})
+    body = json.dumps({"payload": base64.b64encode(message).decode("utf-8")})
 
     request = requests.Request()
     response = request(url=url, method=method, body=body, headers=headers)
@@ -678,7 +678,7 @@ def _sign_message(message, access_token, service_account_email):
         )
 
     data = json.loads(response.data.decode("utf-8"))
-    return data["signature"]
+    return data["signedBlob"]
 
 
 def _url_encode(query_params):

tests/unit/test__signing.py

@@ -678,7 +678,7 @@ def _call_fut(*args, **kwargs):
 
     def test_sign_bytes(self):
         signature = "DEADBEEF"
-        data = {"signature": signature}
+        data = {"signedBlob": signature}
         request = make_request(200, data)
         with mock.patch("google.auth.transport.requests.Request", return_value=request):
             returned_signature = self._call_fut(