fix(auth): restore accidentally removed helper and fix flakiness in system tests

Author: macastelaz

packages/google-auth/google/auth/_helpers.py

@@ -21,6 +21,7 @@
 import hashlib
 import json
 import logging
+import os
 import sys
 from typing import Any, Dict, Mapping, Optional, Union
 import urllib
@@ -307,6 +308,46 @@ def unpadded_urlsafe_b64encode(value):
     return base64.urlsafe_b64encode(value).rstrip(b"=")
 
 
+def get_bool_from_env(variable_name, default=False):
+    """Gets a boolean value from an environment variable.
+
+    The environment variable is interpreted as a boolean with the following
+    (case-insensitive) rules:
+    - "true", "1" are considered true.
+    - "false", "0" are considered false.
+    Any other values will raise an exception.
+
+    Args:
+        variable_name (str): The name of the environment variable.
+        default (bool): The default value if the environment variable is not
+            set.
+
+    Returns:
+        bool: The boolean value of the environment variable.
+
+    Raises:
+        google.auth.exceptions.InvalidValue: If the environment variable is
+            set to a value that can not be interpreted as a boolean.
+    """
+    value = os.environ.get(variable_name)
+
+    if value is None:
+        return default
+
+    value = value.lower()
+
+    if value in ("true", "1"):
+        return True
+    elif value in ("false", "0"):
+        return False
+    else:
+        raise exceptions.InvalidValue(
+            'Environment variable "{}" must be one of "true", "false", "1", or "0".'.format(
+                variable_name
+            )
+        )
+
+
 def is_python_3():
     """Check if the Python interpreter is Python 2 or 3.
 

packages/google-auth/system_tests/system_tests_sync/test_external_accounts.py

@@ -216,8 +216,10 @@ def check_impersonation_expiration():
 
         credentials.refresh(http_request)
 
-        utcmax = _helpers.utcnow() + datetime.timedelta(seconds=TOKEN_LIFETIME_SECONDS)
-        utcmin = utcmax - datetime.timedelta(seconds=BUFFER_SECONDS)
+        now = _helpers.utcnow()
+        # Allow for some clock skew between the test runner and the IAM server.
+        utcmax = now + datetime.timedelta(seconds=TOKEN_LIFETIME_SECONDS + 10)
+        utcmin = now + datetime.timedelta(seconds=TOKEN_LIFETIME_SECONDS - BUFFER_SECONDS)
         assert utcmin < credentials._impersonated_credentials.expiry <= utcmax
 
         return True