class_docstr: Google authentication using OAuth2.
  
  In order to use, register your application with Google and copy the
  relevant parameters to your application settings.
  
  * Go to the Google Dev Console at http://console.developers.google.com
  * Select a project, or create a new one.
  * In the sidebar on the left, select APIs & Auth.
  * In the list of APIs, find the Google+ API service and set it to ON.
  * In the sidebar on the left, select Credentials.
  * In the OAuth section of the page, select Create New Client ID.
  * Set the Redirect URI to point to your auth handler
  * Copy the "Client secret" and "Client ID" to the application settings as
    {"google_oauth": {"key": CLIENT_ID, "secret": CLIENT_SECRET}}
  
  .. versionadded:: 3.2
class_docstr_tok: ["Google","authentication","using","OAuth2",".","In","order","to","use",",","register","your","application","with","Google","and","copy","the","relevant","parameters","to","your","application","settings",".","*","Go","to","the","Google","Dev","Console","at","http",":","\/\/console.developers.google.com","*","Select","a","project",",","or","create","a","new","one",".","*","In","the","sidebar","on","the","left",",","select","APIs","&","Auth",".","*","In","the","list","of","APIs",",","find","the","Google+","API","service","and","set","it","to","ON",".","*","In","the","sidebar","on","the","left",",","select","Credentials",".","*","In","the","OAuth","section","of","the","page",",","select","Create","New","Client","ID",".","*","Set","the","Redirect","URI","to","point","to","your","auth","handler","*","Copy","the","``","Client","secret","''","and","``","Client","ID","''","to","the","application","settings","as","{","``","google_oauth","''",":","{","``","key","''",":","CLIENT_ID",",","``","secret","''",":","CLIENT_SECRET","}","}","..","versionadded",":",":","3.2"]
docstr: Handles the login for the Google user, returning an access token.
  
  The result is a dictionary containing an ``access_token`` field
  ([among others](https://developers.google.com/identity/protocols/OAuth2WebServer#handlingtheresponse)).
  Unlike other ``get_authenticated_user`` methods in this package,
  this method does not return any additional information about the user.
  The returned access token can be used with `OAuth2Mixin.oauth2_request`
  to request additional information (perhaps from
  ``https://www.googleapis.com/oauth2/v2/userinfo``)
  
  Example usage:
  
  .. testcode::
  
      class GoogleOAuth2LoginHandler(tornado.web.RequestHandler,
                                     tornado.auth.GoogleOAuth2Mixin):
          @tornado.gen.coroutine
          def get(self):
              if self.get_argument('code', False):
                  access = yield self.get_authenticated_user(
                      redirect_uri='http://your.site.com/auth/google',
                      code=self.get_argument('code'))
                  user = yield self.oauth2_request(
                      "https://www.googleapis.com/oauth2/v1/userinfo",
                      access_token=access["access_token"])
                  # Save the user and access token with
                  # e.g. set_secure_cookie.
              else:
                  yield self.authorize_redirect(
                      redirect_uri='http://your.site.com/auth/google',
                      client_id=self.settings['google_oauth']['key'],
                      scope=['profile', 'email'],
                      response_type='code',
                      extra_params={'approval_prompt': 'auto'})
  
  .. testoutput::
     :hide:
docstr_tok: ["Handles","the","login","for","the","Google","user",",","returning","an","access","token",".","The","result","is","a","dictionary","containing","an","``","access_token","``","field","(","[","among","others","]","(","https",":","\/\/developers.google.com\/identity\/protocols\/OAuth2WebServer","#","handlingtheresponse",")",")",".","Unlike","other","``","get_authenticated_user","``","methods","in","this","package",",","this","method","does","not","return","any","additional","information","about","the","user",".","The","returned","access","token","can","be","used","with","`","OAuth2Mixin.oauth2_request","`","to","request","additional","information","(","perhaps","from","``","https",":","\/\/www.googleapis.com\/oauth2\/v2\/userinfo","``",")","Example","usage",":","..","testcode",":",":","class","GoogleOAuth2LoginHandler","(","tornado.web.RequestHandler",",","tornado.auth.GoogleOAuth2Mixin",")",":","@","tornado.gen.coroutine","def","get","(","self",")",":","if","self.get_argument","(","'code","'",",","False",")",":","access","=","yield","self.get_authenticated_user","(","redirect_uri='http",":","\/\/your.site.com\/auth\/google","'",",","code=self.get_argument","(","'code","'",")",")","user","=","yield","self.oauth2_request","(","``","https",":","\/\/www.googleapis.com\/oauth2\/v1\/userinfo","''",",","access_token=access","[","``","access_token","''","]",")","#","Save","the","user","and","access","token","with","#","e.g",".","set_secure_cookie",".","else",":","yield","self.authorize_redirect","(","redirect_uri='http",":","\/\/your.site.com\/auth\/google","'",",","client_id=self.settings","[","'google_oauth","'","]","[","'key","'","]",",","scope=","[","'profile","'",",","'email","'","]",",","response_type='code","'",",","extra_params=","{","'approval_prompt","'",":","'auto","'","}",")","..","testoutput",":",":",":","hide",":"]
code: def get_authenticated_user(self, redirect_uri, code, callback):
      """Handles the login for the Google user, returning an access token.
  
      The result is a dictionary containing an ``access_token`` field
      ([among others](https://developers.google.com/identity/protocols/OAuth2WebServer#handlingtheresponse)).
      Unlike other ``get_authenticated_user`` methods in this package,
      this method does not return any additional information about the user.
      The returned access token can be used with `OAuth2Mixin.oauth2_request`
      to request additional information (perhaps from
      ``https://www.googleapis.com/oauth2/v2/userinfo``)
  
      Example usage:
  
      .. testcode::
  
          class GoogleOAuth2LoginHandler(tornado.web.RequestHandler,
                                         tornado.auth.GoogleOAuth2Mixin):
              @tornado.gen.coroutine
              def get(self):
                  if self.get_argument('code', False):
                      access = yield self.get_authenticated_user(
                          redirect_uri='http://your.site.com/auth/google',
                          code=self.get_argument('code'))
                      user = yield self.oauth2_request(
                          "https://www.googleapis.com/oauth2/v1/userinfo",
                          access_token=access["access_token"])
                      # Save the user and access token with
                      # e.g. set_secure_cookie.
                  else:
                      yield self.authorize_redirect(
                          redirect_uri='http://your.site.com/auth/google',
                          client_id=self.settings['google_oauth']['key'],
                          scope=['profile', 'email'],
                          response_type='code',
                          extra_params={'approval_prompt': 'auto'})
  
      .. testoutput::
         :hide:
  
      """
      http = self.get_auth_http_client()
      body = urllib_parse.urlencode(
          {
              "redirect_uri": redirect_uri,
              "code": code,
              "client_id": self.settings[self._OAUTH_SETTINGS_KEY][
                  "key"
              ],
              "client_secret": self.settings[self._OAUTH_SETTINGS_KEY][
                  "secret"
              ],
              "grant_type": "authorization_code",
          }
      )
  
      http.fetch(
          self._OAUTH_ACCESS_TOKEN_URL,
          functools.partial(self._on_access_token, callback),
          method="POST",
          headers={"Content-Type": "application/x-www-form-urlencoded"},
          body=body,
      )
  
imports: from __future__ import absolute_import, division, print_function
  import base64
  import binascii
  import functools
  import hashlib
  import hmac
  import time
  import uuid
  from tornado.concurrent import TracebackFuture, return_future, chain_future
  from tornado import gen
  from tornado import httpclient
  from tornado import escape
  from tornado.httputil import url_concat
  from tornado.log import gen_log
  from tornado.stack_context import ExceptionStackContext
  from tornado.util import unicode_type, ArgReplacer, PY3
label_desc: Use image node_id 1 for calling the GoogleOAuth2Mixin obj's underlying member method code with example usage: obj.get_authenticated_user(redirect_uri, code, callback) without return types