Wala shell

Advanced PHP File Manager

Server IP: 127.0.0.1 | PHP Version: 8.3.30 | Domains Hosted: 54

Name	Size	Last Modified	Actions
📁 ..	-	2025-05-25 12:27
📄 appengine.go // Copyright 2014 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package google import ( "context" "log" "sync" "golang.org/x/oauth2" ) var logOnce sync.Once // only spam about deprecation once // AppEngineTokenSource returns a token source that fetches tokens from either // the current application's service account or from the metadata server, // depending on the App Engine environment. See below for environment-specific // details. If you are implementing a 3-legged OAuth 2.0 flow on App Engine that // involves user accounts, see oauth2.Config instead. // // The current version of this library requires at least Go 1.17 to build, // so first generation App Engine runtimes (<= Go 1.9) are unsupported. // Previously, on first generation App Engine runtimes, AppEngineTokenSource // returned a token source that fetches tokens issued to the // current App Engine application's service account. The provided context must have // come from appengine.NewContext. // // Second generation App Engine runtimes (>= Go 1.11) and App Engine flexible: // AppEngineTokenSource is DEPRECATED on second generation runtimes and on the // flexible environment. It delegates to ComputeTokenSource, and the provided // context and scopes are not used. Please use DefaultTokenSource (or ComputeTokenSource, // which DefaultTokenSource will use in this case) instead. func AppEngineTokenSource(ctx context.Context, scope ...string) oauth2.TokenSource { logOnce.Do(func() { log.Print("google: AppEngineTokenSource is deprecated on App Engine standard second generation runtimes (>= Go 1.11) and App Engine flexible. Please use DefaultTokenSource or ComputeTokenSource.") }) return ComputeTokenSource("") }	1.76 KB	2025-05-25 12:27
📄 default.go // Copyright 2015 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package google import ( "context" "encoding/json" "fmt" "net/http" "os" "path/filepath" "runtime" "sync" "time" "cloud.google.com/go/compute/metadata" "golang.org/x/oauth2" "golang.org/x/oauth2/authhandler" ) const ( adcSetupURL = "https://cloud.google.com/docs/authentication/external/set-up-adc" defaultUniverseDomain = "googleapis.com" ) // Credentials holds Google credentials, including "Application Default Credentials". // For more details, see: // https://developers.google.com/accounts/docs/application-default-credentials // Credentials from external accounts (workload identity federation) are used to // identify a particular application from an on-prem or non-Google Cloud platform // including Amazon Web Services (AWS), Microsoft Azure or any identity provider // that supports OpenID Connect (OIDC). type Credentials struct { ProjectID string // may be empty TokenSource oauth2.TokenSource // JSON contains the raw bytes from a JSON credentials file. // This field may be nil if authentication is provided by the // environment and not with a credentials file, e.g. when code is // running on Google Cloud Platform. JSON []byte // UniverseDomainProvider returns the default service domain for a given // Cloud universe. Optional. // // On GCE, UniverseDomainProvider should return the universe domain value // from Google Compute Engine (GCE)'s metadata server. See also [The attached service // account](https://cloud.google.com/docs/authentication/application-default-credentials#attached-sa). // If the GCE metadata server returns a 404 error, the default universe // domain value should be returned. If the GCE metadata server returns an // error other than 404, the error should be returned. UniverseDomainProvider func() (string, error) udMu sync.Mutex // guards universeDomain // universeDomain is the default service domain for a given Cloud universe. universeDomain string } // UniverseDomain returns the default service domain for a given Cloud universe. // // The default value is "googleapis.com". // // Deprecated: Use instead (Credentials).GetUniverseDomain(), which supports // obtaining the universe domain when authenticating via the GCE metadata server. // Unlike GetUniverseDomain, this method, UniverseDomain, will always return the // default value when authenticating via the GCE metadata server. // See also [The attached service account](https://cloud.google.com/docs/authentication/application-default-credentials#attached-sa). func (c Credentials) UniverseDomain() string { if c.universeDomain == "" { return defaultUniverseDomain } return c.universeDomain } // GetUniverseDomain returns the default service domain for a given Cloud // universe. If present, UniverseDomainProvider will be invoked and its return // value will be cached. // // The default value is "googleapis.com". func (c Credentials) GetUniverseDomain() (string, error) { c.udMu.Lock() defer c.udMu.Unlock() if c.universeDomain == "" && c.UniverseDomainProvider != nil { // On Google Compute Engine, an App Engine standard second generation // runtime, or App Engine flexible, use an externally provided function // to request the universe domain from the metadata server. ud, err := c.UniverseDomainProvider() if err != nil { return "", err } c.universeDomain = ud } // If no UniverseDomainProvider (meaning not on Google Compute Engine), or // in case of any (non-error) empty return value from // UniverseDomainProvider, set the default universe domain. if c.universeDomain == "" { c.universeDomain = defaultUniverseDomain } return c.universeDomain, nil } // DefaultCredentials is the old name of Credentials. // // Deprecated: use Credentials instead. type DefaultCredentials = Credentials // CredentialsParams holds user supplied parameters that are used together // with a credentials file for building a Credentials object. type CredentialsParams struct { // Scopes is the list OAuth scopes. Required. // Example: https://www.googleapis.com/auth/cloud-platform Scopes []string // Subject is the user email used for domain wide delegation (see // https://developers.google.com/identity/protocols/oauth2/service-account#delegatingauthority). // Optional. Subject string // AuthHandler is the AuthorizationHandler used for 3-legged OAuth flow. Required for 3LO flow. AuthHandler authhandler.AuthorizationHandler // State is a unique string used with AuthHandler. Required for 3LO flow. State string // PKCE is used to support PKCE flow. Optional for 3LO flow. PKCE authhandler.PKCEParams // The OAuth2 TokenURL default override. This value overrides the default TokenURL, // unless explicitly specified by the credentials config file. Optional. TokenURL string // EarlyTokenRefresh is the amount of time before a token expires that a new // token will be preemptively fetched. If unset the default value is 10 // seconds. // // Note: This option is currently only respected when using credentials // fetched from the GCE metadata server. EarlyTokenRefresh time.Duration // UniverseDomain is the default service domain for a given Cloud universe. // Only supported in authentication flows that support universe domains. // This value takes precedence over a universe domain explicitly specified // in a credentials config file or by the GCE metadata server. Optional. UniverseDomain string } func (params CredentialsParams) deepCopy() CredentialsParams { paramsCopy := params paramsCopy.Scopes = make([]string, len(params.Scopes)) copy(paramsCopy.Scopes, params.Scopes) return paramsCopy } // DefaultClient returns an HTTP Client that uses the // DefaultTokenSource to obtain authentication credentials. func DefaultClient(ctx context.Context, scope ...string) (http.Client, error) { ts, err := DefaultTokenSource(ctx, scope...) if err != nil { return nil, err } return oauth2.NewClient(ctx, ts), nil } // DefaultTokenSource returns the token source for // "Application Default Credentials". // It is a shortcut for FindDefaultCredentials(ctx, scope).TokenSource. func DefaultTokenSource(ctx context.Context, scope ...string) (oauth2.TokenSource, error) { creds, err := FindDefaultCredentials(ctx, scope...) if err != nil { return nil, err } return creds.TokenSource, nil } // FindDefaultCredentialsWithParams searches for "Application Default Credentials". // // It looks for credentials in the following places, // preferring the first location found: // // 1. A JSON file whose path is specified by the // GOOGLE_APPLICATION_CREDENTIALS environment variable. // For workload identity federation, refer to // https://cloud.google.com/iam/docs/how-to#using-workload-identity-federation on // how to generate the JSON configuration file for on-prem/non-Google cloud // platforms. // 2. A JSON file in a location known to the gcloud command-line tool. // On Windows, this is %APPDATA%/gcloud/application_default_credentials.json. // On other systems, $HOME/.config/gcloud/application_default_credentials.json. // 3. On Google Compute Engine, Google App Engine standard second generation runtimes // (>= Go 1.11), and Google App Engine flexible environment, it fetches // credentials from the metadata server. func FindDefaultCredentialsWithParams(ctx context.Context, params CredentialsParams) (Credentials, error) { // Make defensive copy of the slices in params. params = params.deepCopy() // First, try the environment variable. const envVar = "GOOGLE_APPLICATION_CREDENTIALS" if filename := os.Getenv(envVar); filename != "" { creds, err := readCredentialsFile(ctx, filename, params) if err != nil { return nil, fmt.Errorf("google: error getting credentials using %v environment variable: %v", envVar, err) } return creds, nil } // Second, try a well-known file. filename := wellKnownFile() if b, err := os.ReadFile(filename); err == nil { return CredentialsFromJSONWithParams(ctx, b, params) } // Third, if we're on Google Compute Engine, an App Engine standard second generation runtime, // or App Engine flexible, use the metadata server. if metadata.OnGCE() { id, _ := metadata.ProjectID() universeDomainProvider := func() (string, error) { universeDomain, err := metadata.Get("universe/universe_domain") if err != nil { if _, ok := err.(metadata.NotDefinedError); ok { // http.StatusNotFound (404) return defaultUniverseDomain, nil } else { return "", err } } return universeDomain, nil } return &Credentials{ ProjectID: id, TokenSource: computeTokenSource("", params.EarlyTokenRefresh, params.Scopes...), UniverseDomainProvider: universeDomainProvider, universeDomain: params.UniverseDomain, }, nil } // None are found; return helpful error. return nil, fmt.Errorf("google: could not find default credentials. See %v for more information", adcSetupURL) } // FindDefaultCredentials invokes FindDefaultCredentialsWithParams with the specified scopes. func FindDefaultCredentials(ctx context.Context, scopes ...string) (Credentials, error) { var params CredentialsParams params.Scopes = scopes return FindDefaultCredentialsWithParams(ctx, params) } // CredentialsFromJSONWithParams obtains Google credentials from a JSON value. The JSON can // represent either a Google Developers Console client_credentials.json file (as in ConfigFromJSON), // a Google Developers service account key file, a gcloud user credentials file (a.k.a. refresh // token JSON), or the JSON configuration file for workload identity federation in non-Google cloud // platforms (see https://cloud.google.com/iam/docs/how-to#using-workload-identity-federation). func CredentialsFromJSONWithParams(ctx context.Context, jsonData []byte, params CredentialsParams) (Credentials, error) { // Make defensive copy of the slices in params. params = params.deepCopy() // First, attempt to parse jsonData as a Google Developers Console client_credentials.json. config, _ := ConfigFromJSON(jsonData, params.Scopes...) if config != nil { return &Credentials{ ProjectID: "", TokenSource: authhandler.TokenSourceWithPKCE(ctx, config, params.State, params.AuthHandler, params.PKCE), JSON: jsonData, }, nil } // Otherwise, parse jsonData as one of the other supported credentials files. var f credentialsFile if err := json.Unmarshal(jsonData, &f); err != nil { return nil, err } universeDomain := f.UniverseDomain if params.UniverseDomain != "" { universeDomain = params.UniverseDomain } // Authorized user credentials are only supported in the googleapis.com universe. if f.Type == userCredentialsKey { universeDomain = defaultUniverseDomain } ts, err := f.tokenSource(ctx, params) if err != nil { return nil, err } ts = newErrWrappingTokenSource(ts) return &Credentials{ ProjectID: f.ProjectID, TokenSource: ts, JSON: jsonData, universeDomain: universeDomain, }, nil } // CredentialsFromJSON invokes CredentialsFromJSONWithParams with the specified scopes. func CredentialsFromJSON(ctx context.Context, jsonData []byte, scopes ...string) (Credentials, error) { var params CredentialsParams params.Scopes = scopes return CredentialsFromJSONWithParams(ctx, jsonData, params) } func wellKnownFile() string { const f = "application_default_credentials.json" if runtime.GOOS == "windows" { return filepath.Join(os.Getenv("APPDATA"), "gcloud", f) } return filepath.Join(guessUnixHomeDir(), ".config", "gcloud", f) } func readCredentialsFile(ctx context.Context, filename string, params CredentialsParams) (Credentials, error) { b, err := os.ReadFile(filename) if err != nil { return nil, err } return CredentialsFromJSONWithParams(ctx, b, params) }	11.73 KB	2025-05-25 12:27
📄 default_test.go // Copyright 2023 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package google import ( "context" "net/http" "net/http/httptest" "strings" "testing" "cloud.google.com/go/compute/metadata" ) var saJSONJWT = []byte(`{ "type": "service_account", "project_id": "fake_project", "private_key_id": "268f54e43a1af97cfc71731688434f45aca15c8b", "private_key": "super secret key", "client_email": "gopher@developer.gserviceaccount.com", "client_id": "gopher.apps.googleusercontent.com", "auth_uri": "https://accounts.google.com/o/oauth2/auth", "token_uri": "https://oauth2.googleapis.com/token", "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs", "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/gopher%40fake_project.iam.gserviceaccount.com" }`) var saJSONJWTUniverseDomain = []byte(`{ "type": "service_account", "project_id": "fake_project", "universe_domain": "example.com", "private_key_id": "268f54e43a1af97cfc71731688434f45aca15c8b", "private_key": "super secret key", "client_email": "gopher@developer.gserviceaccount.com", "client_id": "gopher.apps.googleusercontent.com", "auth_uri": "https://accounts.google.com/o/oauth2/auth", "token_uri": "https://oauth2.googleapis.com/token", "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs", "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/gopher%40fake_project.iam.gserviceaccount.com" }`) var userJSON = []byte(`{ "client_id": "abc123.apps.googleusercontent.com", "client_secret": "shh", "refresh_token": "refreshing", "type": "authorized_user", "quota_project_id": "fake_project2" }`) var userJSONUniverseDomain = []byte(`{ "client_id": "abc123.apps.googleusercontent.com", "client_secret": "shh", "refresh_token": "refreshing", "type": "authorized_user", "quota_project_id": "fake_project2", "universe_domain": "example.com" }`) var universeDomain = "example.com" var universeDomain2 = "apis-tpclp.goog" func TestCredentialsFromJSONWithParams_SA(t testing.T) { ctx := context.Background() scope := "https://www.googleapis.com/auth/cloud-platform" params := CredentialsParams{ Scopes: []string{scope}, } creds, err := CredentialsFromJSONWithParams(ctx, saJSONJWT, params) if err != nil { t.Fatal(err) } if want := "fake_project"; creds.ProjectID != want { t.Fatalf("got %q, want %q", creds.ProjectID, want) } if want := "googleapis.com"; creds.UniverseDomain() != want { t.Fatalf("got %q, want %q", creds.UniverseDomain(), want) } if want := "googleapis.com"; creds.UniverseDomain() != want { t.Fatalf("got %q, want %q", creds.UniverseDomain(), want) } } func TestCredentialsFromJSONWithParams_SA_Params_UniverseDomain(t testing.T) { ctx := context.Background() scope := "https://www.googleapis.com/auth/cloud-platform" params := CredentialsParams{ Scopes: []string{scope}, UniverseDomain: universeDomain2, } creds, err := CredentialsFromJSONWithParams(ctx, saJSONJWT, params) if err != nil { t.Fatal(err) } if want := "fake_project"; creds.ProjectID != want { t.Fatalf("got %q, want %q", creds.ProjectID, want) } if creds.UniverseDomain() != universeDomain2 { t.Fatalf("got %q, want %q", creds.UniverseDomain(), universeDomain2) } if creds.UniverseDomain() != universeDomain2 { t.Fatalf("got %q, want %q", creds.UniverseDomain(), universeDomain2) } } func TestCredentialsFromJSONWithParams_SA_UniverseDomain(t testing.T) { ctx := context.Background() scope := "https://www.googleapis.com/auth/cloud-platform" params := CredentialsParams{ Scopes: []string{scope}, } creds, err := CredentialsFromJSONWithParams(ctx, saJSONJWTUniverseDomain, params) if err != nil { t.Fatal(err) } if want := "fake_project"; creds.ProjectID != want { t.Fatalf("got %q, want %q", creds.ProjectID, want) } if creds.UniverseDomain() != universeDomain { t.Fatalf("got %q, want %q", creds.UniverseDomain(), universeDomain) } got, err := creds.GetUniverseDomain() if err != nil { t.Fatal(err) } if got != universeDomain { t.Fatalf("got %q, want %q", got, universeDomain) } } func TestCredentialsFromJSONWithParams_SA_UniverseDomain_Params_UniverseDomain(t testing.T) { ctx := context.Background() scope := "https://www.googleapis.com/auth/cloud-platform" params := CredentialsParams{ Scopes: []string{scope}, UniverseDomain: universeDomain2, } creds, err := CredentialsFromJSONWithParams(ctx, saJSONJWTUniverseDomain, params) if err != nil { t.Fatal(err) } if want := "fake_project"; creds.ProjectID != want { t.Fatalf("got %q, want %q", creds.ProjectID, want) } if creds.UniverseDomain() != universeDomain2 { t.Fatalf("got %q, want %q", creds.UniverseDomain(), universeDomain2) } got, err := creds.GetUniverseDomain() if err != nil { t.Fatal(err) } if got != universeDomain2 { t.Fatalf("got %q, want %q", got, universeDomain2) } } func TestCredentialsFromJSONWithParams_User(t testing.T) { ctx := context.Background() scope := "https://www.googleapis.com/auth/cloud-platform" params := CredentialsParams{ Scopes: []string{scope}, } creds, err := CredentialsFromJSONWithParams(ctx, userJSON, params) if err != nil { t.Fatal(err) } if want := "googleapis.com"; creds.UniverseDomain() != want { t.Fatalf("got %q, want %q", creds.UniverseDomain(), want) } got, err := creds.GetUniverseDomain() if err != nil { t.Fatal(err) } if want := "googleapis.com"; got != want { t.Fatalf("got %q, want %q", got, want) } } func TestCredentialsFromJSONWithParams_User_Params_UniverseDomain(t testing.T) { ctx := context.Background() scope := "https://www.googleapis.com/auth/cloud-platform" params := CredentialsParams{ Scopes: []string{scope}, UniverseDomain: universeDomain2, } creds, err := CredentialsFromJSONWithParams(ctx, userJSON, params) if err != nil { t.Fatal(err) } if want := "googleapis.com"; creds.UniverseDomain() != want { t.Fatalf("got %q, want %q", creds.UniverseDomain(), want) } got, err := creds.GetUniverseDomain() if err != nil { t.Fatal(err) } if want := "googleapis.com"; got != want { t.Fatalf("got %q, want %q", got, want) } } func TestCredentialsFromJSONWithParams_User_UniverseDomain(t testing.T) { ctx := context.Background() scope := "https://www.googleapis.com/auth/cloud-platform" params := CredentialsParams{ Scopes: []string{scope}, } creds, err := CredentialsFromJSONWithParams(ctx, userJSONUniverseDomain, params) if err != nil { t.Fatal(err) } if want := "googleapis.com"; creds.UniverseDomain() != want { t.Fatalf("got %q, want %q", creds.UniverseDomain(), want) } got, err := creds.GetUniverseDomain() if err != nil { t.Fatal(err) } if want := "googleapis.com"; got != want { t.Fatalf("got %q, want %q", got, want) } } func TestCredentialsFromJSONWithParams_User_UniverseDomain_Params_UniverseDomain(t testing.T) { ctx := context.Background() scope := "https://www.googleapis.com/auth/cloud-platform" params := CredentialsParams{ Scopes: []string{scope}, UniverseDomain: universeDomain2, } creds, err := CredentialsFromJSONWithParams(ctx, userJSONUniverseDomain, params) if err != nil { t.Fatal(err) } if want := "googleapis.com"; creds.UniverseDomain() != want { t.Fatalf("got %q, want %q", creds.UniverseDomain(), want) } got, err := creds.GetUniverseDomain() if err != nil { t.Fatal(err) } if want := "googleapis.com"; got != want { t.Fatalf("got %q, want %q", got, want) } } func TestComputeUniverseDomain(t testing.T) { universeDomainPath := "/computeMetadata/v1/universe/universe_domain" universeDomainResponseBody := "example.com" var requests int s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { requests++ if r.URL.Path != universeDomainPath { t.Errorf("bad path, got %s, want %s", r.URL.Path, universeDomainPath) } if requests > 1 { t.Errorf("too many requests, got %d, want 1", requests) } w.Write([]byte(universeDomainResponseBody)) })) defer s.Close() t.Setenv("GCE_METADATA_HOST", strings.TrimPrefix(s.URL, "http://")) scope := "https://www.googleapis.com/auth/cloud-platform" params := CredentialsParams{ Scopes: []string{scope}, } universeDomainProvider := func() (string, error) { universeDomain, err := metadata.Get("universe/universe_domain") if err != nil { return "", err } return universeDomain, nil } // Copied from FindDefaultCredentialsWithParams, metadata.OnGCE() = true block creds := &Credentials{ ProjectID: "fake_project", TokenSource: computeTokenSource("", params.EarlyTokenRefresh, params.Scopes...), UniverseDomainProvider: universeDomainProvider, universeDomain: params.UniverseDomain, // empty } c := make(chan bool) go func() { got, err := creds.GetUniverseDomain() // First conflicting access. if err != nil { t.Error(err) } if want := universeDomainResponseBody; got != want { t.Errorf("got %q, want %q", got, want) } c <- true }() got, err := creds.GetUniverseDomain() // Second conflicting (and potentially uncached) access. <-c if err != nil { t.Error(err) } if want := universeDomainResponseBody; got != want { t.Errorf("got %q, want %q", got, want) } }	9.22 KB	2025-05-25 12:27
📄 doc.go // Copyright 2018 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. // Package google provides support for making OAuth2 authorized and authenticated // HTTP requests to Google APIs. It supports the Web server flow, client-side // credentials, service accounts, Google Compute Engine service accounts, // Google App Engine service accounts and workload identity federation // from non-Google cloud platforms. // // A brief overview of the package follows. For more information, please read // https://developers.google.com/accounts/docs/OAuth2 // and // https://developers.google.com/accounts/docs/application-default-credentials. // For more information on using workload identity federation, refer to // https://cloud.google.com/iam/docs/how-to#using-workload-identity-federation. // // # OAuth2 Configs // // Two functions in this package return golang.org/x/oauth2.Config values from Google credential // data. Google supports two JSON formats for OAuth2 credentials: one is handled by ConfigFromJSON, // the other by JWTConfigFromJSON. The returned Config can be used to obtain a TokenSource or // create an http.Client. // // # Workload and Workforce Identity Federation // // For information on how to use Workload and Workforce Identity Federation, see [golang.org/x/oauth2/google/externalaccount]. // // # Credentials // // The Credentials type represents Google credentials, including Application Default // Credentials. // // Use FindDefaultCredentials to obtain Application Default Credentials. // FindDefaultCredentials looks in some well-known places for a credentials file, and // will call AppEngineTokenSource or ComputeTokenSource as needed. // // Application Default Credentials also support workload identity federation to // access Google Cloud resources from non-Google Cloud platforms including Amazon // Web Services (AWS), Microsoft Azure or any identity provider that supports // OpenID Connect (OIDC). Workload identity federation is recommended for // non-Google Cloud environments as it avoids the need to download, manage and // store service account private keys locally. // // DefaultClient and DefaultTokenSource are convenience methods. They first call FindDefaultCredentials, // then use the credentials to construct an http.Client or an oauth2.TokenSource. // // Use CredentialsFromJSON to obtain credentials from either of the two JSON formats // described in OAuth2 Configs, above. The TokenSource in the returned value is the // same as the one obtained from the oauth2.Config returned from ConfigFromJSON or // JWTConfigFromJSON, but the Credentials may contain additional information // that is useful is some circumstances. package google // import "golang.org/x/oauth2/google"	2.75 KB	2025-05-25 12:27
📁 downscope	-	2025-05-25 12:27
📄 error.go // Copyright 2022 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package google import ( "errors" "golang.org/x/oauth2" ) // AuthenticationError indicates there was an error in the authentication flow. // // Use (AuthenticationError).Temporary to check if the error can be retried. type AuthenticationError struct { err oauth2.RetrieveError } func newAuthenticationError(err error) error { re := &oauth2.RetrieveError{} if !errors.As(err, &re) { return err } return &AuthenticationError{ err: re, } } // Temporary indicates that the network error has one of the following status codes and may be retried: 500, 503, 408, or 429. func (e AuthenticationError) Temporary() bool { if e.err.Response == nil { return false } sc := e.err.Response.StatusCode return sc == 500 \|\| sc == 503 \|\| sc == 408 \|\| sc == 429 } func (e AuthenticationError) Error() string { return e.err.Error() } func (e AuthenticationError) Unwrap() error { return e.err } type errWrappingTokenSource struct { src oauth2.TokenSource } func newErrWrappingTokenSource(ts oauth2.TokenSource) oauth2.TokenSource { return &errWrappingTokenSource{src: ts} } // Token returns the current token if it's still valid, else will // refresh the current token (using r.Context for HTTP client // information) and return the new one. func (s errWrappingTokenSource) Token() (*oauth2.Token, error) { t, err := s.src.Token() if err != nil { return nil, newAuthenticationError(err) } return t, nil }	1.55 KB	2025-05-25 12:27
📄 error_test.go // Copyright 2022 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package google import ( "net/http" "testing" "golang.org/x/oauth2" ) func TestAuthenticationError_Temporary(t testing.T) { tests := []struct { name string code int want bool }{ { name: "temporary with 500", code: 500, want: true, }, { name: "temporary with 503", code: 503, want: true, }, { name: "temporary with 408", code: 408, want: true, }, { name: "temporary with 429", code: 429, want: true, }, { name: "temporary with 418", code: 418, want: false, }, } for _, tt := range tests { t.Run(tt.name, func(t testing.T) { ae := &AuthenticationError{ err: &oauth2.RetrieveError{ Response: &http.Response{ StatusCode: tt.code, }, }, } if got := ae.Temporary(); got != tt.want { t.Errorf("Temporary() = %v; want %v", got, tt.want) } }) } } func TestErrWrappingTokenSource_Token(t testing.T) { tok := oauth2.Token{AccessToken: "MyAccessToken"} ts := errWrappingTokenSource{ src: oauth2.StaticTokenSource(&tok), } got, err := ts.Token() if got != tok { t.Errorf("Token() = %v; want %v", got, tok) } if err != nil { t.Error(err) } } type errTokenSource struct { err error } func (s errTokenSource) Token() (oauth2.Token, error) { return nil, s.err } func TestErrWrappingTokenSource_TokenError(t testing.T) { re := &oauth2.RetrieveError{ Response: &http.Response{ StatusCode: 500, }, } ts := errWrappingTokenSource{ src: &errTokenSource{ err: re, }, } _, err := ts.Token() if err == nil { t.Fatalf("errWrappingTokenSource.Token() err = nil, want AuthenticationError") } ae, ok := err.(AuthenticationError) if !ok { t.Fatalf("errWrappingTokenSource.Token() err = %T, want AuthenticationError", err) } wrappedErr := ae.Unwrap() if wrappedErr == nil { t.Fatalf("AuthenticationError.Unwrap() err = nil, want oauth2.RetrieveError") } _, ok = wrappedErr.(oauth2.RetrieveError) if !ok { t.Errorf("AuthenticationError.Unwrap() err = %T, want *oauth2.RetrieveError", err) } }	2.16 KB	2025-05-25 12:27
📄 example_test.go // Copyright 2014 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package google_test import ( "context" "fmt" "io/ioutil" "log" "net/http" "golang.org/x/oauth2" "golang.org/x/oauth2/google" "golang.org/x/oauth2/jwt" ) func ExampleDefaultClient() { client, err := google.DefaultClient(oauth2.NoContext, "https://www.googleapis.com/auth/devstorage.full_control") if err != nil { log.Fatal(err) } client.Get("...") } func Example_webServer() { // Your credentials should be obtained from the Google // Developer Console (https://console.developers.google.com). conf := &oauth2.Config{ ClientID: "YOUR_CLIENT_ID", ClientSecret: "YOUR_CLIENT_SECRET", RedirectURL: "YOUR_REDIRECT_URL", Scopes: []string{ "https://www.googleapis.com/auth/bigquery", "https://www.googleapis.com/auth/blogger", }, Endpoint: google.Endpoint, } // Redirect user to Google's consent page to ask for permission // for the scopes specified above. url := conf.AuthCodeURL("state") fmt.Printf("Visit the URL for the auth dialog: %v", url) // Handle the exchange code to initiate a transport. tok, err := conf.Exchange(oauth2.NoContext, "authorization-code") if err != nil { log.Fatal(err) } client := conf.Client(oauth2.NoContext, tok) client.Get("...") } func ExampleJWTConfigFromJSON() { // Your credentials should be obtained from the Google // Developer Console (https://console.developers.google.com). // Navigate to your project, then see the "Credentials" page // under "APIs & Auth". // To create a service account client, click "Create new Client ID", // select "Service Account", and click "Create Client ID". A JSON // key file will then be downloaded to your computer. data, err := ioutil.ReadFile("/path/to/your-project-key.json") if err != nil { log.Fatal(err) } conf, err := google.JWTConfigFromJSON(data, "https://www.googleapis.com/auth/bigquery") if err != nil { log.Fatal(err) } // Initiate an http.Client. The following GET request will be // authorized and authenticated on the behalf of // your service account. client := conf.Client(oauth2.NoContext) client.Get("...") } func ExampleSDKConfig() { // The credentials will be obtained from the first account that // has been authorized with `gcloud auth login`. conf, err := google.NewSDKConfig("") if err != nil { log.Fatal(err) } // Initiate an http.Client. The following GET request will be // authorized and authenticated on the behalf of the SDK user. client := conf.Client(oauth2.NoContext) client.Get("...") } func Example_serviceAccount() { // Your credentials should be obtained from the Google // Developer Console (https://console.developers.google.com). conf := &jwt.Config{ Email: "xxx@developer.gserviceaccount.com", // The contents of your RSA private key or your PEM file // that contains a private key. // If you have a p12 file instead, you // can use `openssl` to export the private key into a pem file. // // $ openssl pkcs12 -in key.p12 -passin pass:notasecret -out key.pem -nodes // // The field only supports PEM containers with no passphrase. // The openssl command will convert p12 keys to passphrase-less PEM containers. PrivateKey: []byte("-----BEGIN RSA PRIVATE KEY-----..."), Scopes: []string{ "https://www.googleapis.com/auth/bigquery", "https://www.googleapis.com/auth/blogger", }, TokenURL: google.JWTTokenURL, // If you would like to impersonate a user, you can // create a transport with a subject. The following GET // request will be made on the behalf of user@example.com. // Optional. Subject: "user@example.com", } // Initiate an http.Client, the following GET request will be // authorized and authenticated on the behalf of user@example.com. client := conf.Client(oauth2.NoContext) client.Get("...") } func ExampleComputeTokenSource() { client := &http.Client{ Transport: &oauth2.Transport{ // Fetch from Google Compute Engine's metadata server to retrieve // an access token for the provided account. // If no account is specified, "default" is used. // If no scopes are specified, a set of default scopes // are automatically granted. Source: google.ComputeTokenSource("", "https://www.googleapis.com/auth/bigquery"), }, } client.Get("...") } func ExampleCredentialsFromJSON() { ctx := context.Background() data, err := ioutil.ReadFile("/path/to/key-file.json") if err != nil { log.Fatal(err) } creds, err := google.CredentialsFromJSON(ctx, data, "https://www.googleapis.com/auth/bigquery") if err != nil { log.Fatal(err) } _ = creds // TODO: Use creds. }	4.61 KB	2025-05-25 12:27
📁 externalaccount	-	2025-05-25 12:27
📄 google.go // Copyright 2014 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package google import ( "context" "encoding/json" "errors" "fmt" "net/url" "strings" "time" "cloud.google.com/go/compute/metadata" "golang.org/x/oauth2" "golang.org/x/oauth2/google/externalaccount" "golang.org/x/oauth2/google/internal/externalaccountauthorizeduser" "golang.org/x/oauth2/google/internal/impersonate" "golang.org/x/oauth2/jwt" ) // Endpoint is Google's OAuth 2.0 default endpoint. var Endpoint = oauth2.Endpoint{ AuthURL: "https://accounts.google.com/o/oauth2/auth", TokenURL: "https://oauth2.googleapis.com/token", DeviceAuthURL: "https://oauth2.googleapis.com/device/code", AuthStyle: oauth2.AuthStyleInParams, } // MTLSTokenURL is Google's OAuth 2.0 default mTLS endpoint. const MTLSTokenURL = "https://oauth2.mtls.googleapis.com/token" // JWTTokenURL is Google's OAuth 2.0 token URL to use with the JWT flow. const JWTTokenURL = "https://oauth2.googleapis.com/token" // ConfigFromJSON uses a Google Developers Console client_credentials.json // file to construct a config. // client_credentials.json can be downloaded from // https://console.developers.google.com, under "Credentials". Download the Web // application credentials in the JSON format and provide the contents of the // file as jsonKey. func ConfigFromJSON(jsonKey []byte, scope ...string) (oauth2.Config, error) { type cred struct { ClientID string `json:"client_id"` ClientSecret string `json:"client_secret"` RedirectURIs []string `json:"redirect_uris"` AuthURI string `json:"auth_uri"` TokenURI string `json:"token_uri"` } var j struct { Web cred `json:"web"` Installed cred `json:"installed"` } if err := json.Unmarshal(jsonKey, &j); err != nil { return nil, err } var c cred switch { case j.Web != nil: c = j.Web case j.Installed != nil: c = j.Installed default: return nil, fmt.Errorf("oauth2/google: no credentials found") } if len(c.RedirectURIs) < 1 { return nil, errors.New("oauth2/google: missing redirect URL in the client_credentials.json") } return &oauth2.Config{ ClientID: c.ClientID, ClientSecret: c.ClientSecret, RedirectURL: c.RedirectURIs[0], Scopes: scope, Endpoint: oauth2.Endpoint{ AuthURL: c.AuthURI, TokenURL: c.TokenURI, }, }, nil } // JWTConfigFromJSON uses a Google Developers service account JSON key file to read // the credentials that authorize and authenticate the requests. // Create a service account on "Credentials" for your project at // https://console.developers.google.com to download a JSON key file. func JWTConfigFromJSON(jsonKey []byte, scope ...string) (jwt.Config, error) { var f credentialsFile if err := json.Unmarshal(jsonKey, &f); err != nil { return nil, err } if f.Type != serviceAccountKey { return nil, fmt.Errorf("google: read JWT from JSON credentials: 'type' field is %q (expected %q)", f.Type, serviceAccountKey) } scope = append([]string(nil), scope...) // copy return f.jwtConfig(scope, ""), nil } // JSON key file types. const ( serviceAccountKey = "service_account" userCredentialsKey = "authorized_user" externalAccountKey = "external_account" externalAccountAuthorizedUserKey = "external_account_authorized_user" impersonatedServiceAccount = "impersonated_service_account" ) // credentialsFile is the unmarshalled representation of a credentials file. type credentialsFile struct { Type string `json:"type"` // Service Account fields ClientEmail string `json:"client_email"` PrivateKeyID string `json:"private_key_id"` PrivateKey string `json:"private_key"` AuthURL string `json:"auth_uri"` TokenURL string `json:"token_uri"` ProjectID string `json:"project_id"` UniverseDomain string `json:"universe_domain"` // User Credential fields // (These typically come from gcloud auth.) ClientSecret string `json:"client_secret"` ClientID string `json:"client_id"` RefreshToken string `json:"refresh_token"` // External Account fields Audience string `json:"audience"` SubjectTokenType string `json:"subject_token_type"` TokenURLExternal string `json:"token_url"` TokenInfoURL string `json:"token_info_url"` ServiceAccountImpersonationURL string `json:"service_account_impersonation_url"` ServiceAccountImpersonation serviceAccountImpersonationInfo `json:"service_account_impersonation"` Delegates []string `json:"delegates"` CredentialSource externalaccount.CredentialSource `json:"credential_source"` QuotaProjectID string `json:"quota_project_id"` WorkforcePoolUserProject string `json:"workforce_pool_user_project"` // External Account Authorized User fields RevokeURL string `json:"revoke_url"` // Service account impersonation SourceCredentials credentialsFile `json:"source_credentials"` } type serviceAccountImpersonationInfo struct { TokenLifetimeSeconds int `json:"token_lifetime_seconds"` } func (f credentialsFile) jwtConfig(scopes []string, subject string) jwt.Config { cfg := &jwt.Config{ Email: f.ClientEmail, PrivateKey: []byte(f.PrivateKey), PrivateKeyID: f.PrivateKeyID, Scopes: scopes, TokenURL: f.TokenURL, Subject: subject, // This is the user email to impersonate Audience: f.Audience, } if cfg.TokenURL == "" { cfg.TokenURL = JWTTokenURL } return cfg } func (f credentialsFile) tokenSource(ctx context.Context, params CredentialsParams) (oauth2.TokenSource, error) { switch f.Type { case serviceAccountKey: cfg := f.jwtConfig(params.Scopes, params.Subject) return cfg.TokenSource(ctx), nil case userCredentialsKey: cfg := &oauth2.Config{ ClientID: f.ClientID, ClientSecret: f.ClientSecret, Scopes: params.Scopes, Endpoint: oauth2.Endpoint{ AuthURL: f.AuthURL, TokenURL: f.TokenURL, AuthStyle: oauth2.AuthStyleInParams, }, } if cfg.Endpoint.AuthURL == "" { cfg.Endpoint.AuthURL = Endpoint.AuthURL } if cfg.Endpoint.TokenURL == "" { if params.TokenURL != "" { cfg.Endpoint.TokenURL = params.TokenURL } else { cfg.Endpoint.TokenURL = Endpoint.TokenURL } } tok := &oauth2.Token{RefreshToken: f.RefreshToken} return cfg.TokenSource(ctx, tok), nil case externalAccountKey: cfg := &externalaccount.Config{ Audience: f.Audience, SubjectTokenType: f.SubjectTokenType, TokenURL: f.TokenURLExternal, TokenInfoURL: f.TokenInfoURL, ServiceAccountImpersonationURL: f.ServiceAccountImpersonationURL, ServiceAccountImpersonationLifetimeSeconds: f.ServiceAccountImpersonation.TokenLifetimeSeconds, ClientSecret: f.ClientSecret, ClientID: f.ClientID, CredentialSource: &f.CredentialSource, QuotaProjectID: f.QuotaProjectID, Scopes: params.Scopes, WorkforcePoolUserProject: f.WorkforcePoolUserProject, } return externalaccount.NewTokenSource(ctx, cfg) case externalAccountAuthorizedUserKey: cfg := &externalaccountauthorizeduser.Config{ Audience: f.Audience, RefreshToken: f.RefreshToken, TokenURL: f.TokenURLExternal, TokenInfoURL: f.TokenInfoURL, ClientID: f.ClientID, ClientSecret: f.ClientSecret, RevokeURL: f.RevokeURL, QuotaProjectID: f.QuotaProjectID, Scopes: params.Scopes, } return cfg.TokenSource(ctx) case impersonatedServiceAccount: if f.ServiceAccountImpersonationURL == "" \|\| f.SourceCredentials == nil { return nil, errors.New("missing 'source_credentials' field or 'service_account_impersonation_url' in credentials") } ts, err := f.SourceCredentials.tokenSource(ctx, params) if err != nil { return nil, err } imp := impersonate.ImpersonateTokenSource{ Ctx: ctx, URL: f.ServiceAccountImpersonationURL, Scopes: params.Scopes, Ts: ts, Delegates: f.Delegates, } return oauth2.ReuseTokenSource(nil, imp), nil case "": return nil, errors.New("missing 'type' field in credentials") default: return nil, fmt.Errorf("unknown credential type: %q", f.Type) } } // ComputeTokenSource returns a token source that fetches access tokens // from Google Compute Engine (GCE)'s metadata server. It's only valid to use // this token source if your program is running on a GCE instance. // If no account is specified, "default" is used. // If no scopes are specified, a set of default scopes are automatically granted. // Further information about retrieving access tokens from the GCE metadata // server can be found at https://cloud.google.com/compute/docs/authentication. func ComputeTokenSource(account string, scope ...string) oauth2.TokenSource { // refresh 3 minutes and 45 seconds early. The shortest MDS cache is currently 4 minutes, so any // refreshes earlier are a waste of compute. earlyExpirySecs := 225 * time.Second return computeTokenSource(account, earlyExpirySecs, scope...) } func computeTokenSource(account string, earlyExpiry time.Duration, scope ...string) oauth2.TokenSource { return oauth2.ReuseTokenSourceWithExpiry(nil, computeSource{account: account, scopes: scope}, earlyExpiry) } type computeSource struct { account string scopes []string } func (cs computeSource) Token() (oauth2.Token, error) { if !metadata.OnGCE() { return nil, errors.New("oauth2/google: can't get a token from the metadata service; not running on GCE") } acct := cs.account if acct == "" { acct = "default" } tokenURI := "instance/service-accounts/" + acct + "/token" if len(cs.scopes) > 0 { v := url.Values{} v.Set("scopes", strings.Join(cs.scopes, ",")) tokenURI = tokenURI + "?" + v.Encode() } tokenJSON, err := metadata.Get(tokenURI) if err != nil { return nil, err } var res struct { AccessToken string `json:"access_token"` ExpiresInSec int `json:"expires_in"` TokenType string `json:"token_type"` } err = json.NewDecoder(strings.NewReader(tokenJSON)).Decode(&res) if err != nil { return nil, fmt.Errorf("oauth2/google: invalid token JSON from metadata: %v", err) } if res.ExpiresInSec == 0 \|\| res.AccessToken == "" { return nil, fmt.Errorf("oauth2/google: incomplete token received from metadata") } tok := &oauth2.Token{ AccessToken: res.AccessToken, TokenType: res.TokenType, Expiry: time.Now().Add(time.Duration(res.ExpiresInSec) time.Second), } // NOTE(cbro): add hidden metadata about where the token is from. // This is needed for detection by client libraries to know that credentials come from the metadata server. // This may be removed in a future version of this library. return tok.WithExtra(map[string]interface{}{ "oauth2.google.tokenSource": "compute-metadata", "oauth2.google.serviceAccount": acct, }), nil }	11.03 KB	2025-05-25 12:27
📄 google_test.go // Copyright 2015 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package google import ( "net/http" "net/http/httptest" "strings" "testing" ) var webJSONKey = []byte(` { "web": { "auth_uri": "https://google.com/o/oauth2/auth", "client_secret": "3Oknc4jS_wA2r9i", "token_uri": "https://google.com/o/oauth2/token", "client_email": "222-nprqovg5k43uum874cs9osjt2koe97g8@developer.gserviceaccount.com", "redirect_uris": ["https://www.example.com/oauth2callback"], "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/222-nprqovg5k43uum874cs9osjt2koe97g8@developer.gserviceaccount.com", "client_id": "222-nprqovg5k43uum874cs9osjt2koe97g8.apps.googleusercontent.com", "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs", "javascript_origins": ["https://www.example.com"] } }`) var installedJSONKey = []byte(`{ "installed": { "client_id": "222-installed.apps.googleusercontent.com", "redirect_uris": ["https://www.example.com/oauth2callback"] } }`) var jwtJSONKey = []byte(`{ "private_key_id": "268f54e43a1af97cfc71731688434f45aca15c8b", "private_key": "super secret key", "client_email": "gopher@developer.gserviceaccount.com", "client_id": "gopher.apps.googleusercontent.com", "token_uri": "https://accounts.google.com/o/gophers/token", "type": "service_account", "audience": "https://testservice.googleapis.com/" }`) var jwtJSONKeyNoTokenURL = []byte(`{ "private_key_id": "268f54e43a1af97cfc71731688434f45aca15c8b", "private_key": "super secret key", "client_email": "gopher@developer.gserviceaccount.com", "client_id": "gopher.apps.googleusercontent.com", "type": "service_account" }`) var jwtJSONKeyNoAudience = []byte(`{ "private_key_id": "268f54e43a1af97cfc71731688434f45aca15c8b", "private_key": "super secret key", "client_email": "gopher@developer.gserviceaccount.com", "client_id": "gopher.apps.googleusercontent.com", "token_uri": "https://accounts.google.com/o/gophers/token", "type": "service_account" }`) func TestConfigFromJSON(t testing.T) { conf, err := ConfigFromJSON(webJSONKey, "scope1", "scope2") if err != nil { t.Error(err) } if got, want := conf.ClientID, "222-nprqovg5k43uum874cs9osjt2koe97g8.apps.googleusercontent.com"; got != want { t.Errorf("ClientID = %q; want %q", got, want) } if got, want := conf.ClientSecret, "3Oknc4jS_wA2r9i"; got != want { t.Errorf("ClientSecret = %q; want %q", got, want) } if got, want := conf.RedirectURL, "https://www.example.com/oauth2callback"; got != want { t.Errorf("RedictURL = %q; want %q", got, want) } if got, want := strings.Join(conf.Scopes, ","), "scope1,scope2"; got != want { t.Errorf("Scopes = %q; want %q", got, want) } if got, want := conf.Endpoint.AuthURL, "https://google.com/o/oauth2/auth"; got != want { t.Errorf("AuthURL = %q; want %q", got, want) } if got, want := conf.Endpoint.TokenURL, "https://google.com/o/oauth2/token"; got != want { t.Errorf("TokenURL = %q; want %q", got, want) } } func TestConfigFromJSON_Installed(t testing.T) { conf, err := ConfigFromJSON(installedJSONKey) if err != nil { t.Error(err) } if got, want := conf.ClientID, "222-installed.apps.googleusercontent.com"; got != want { t.Errorf("ClientID = %q; want %q", got, want) } } func TestJWTConfigFromJSON(t testing.T) { conf, err := JWTConfigFromJSON(jwtJSONKey, "scope1", "scope2") if err != nil { t.Fatal(err) } if got, want := conf.Email, "gopher@developer.gserviceaccount.com"; got != want { t.Errorf("Email = %q, want %q", got, want) } if got, want := string(conf.PrivateKey), "super secret key"; got != want { t.Errorf("PrivateKey = %q, want %q", got, want) } if got, want := conf.PrivateKeyID, "268f54e43a1af97cfc71731688434f45aca15c8b"; got != want { t.Errorf("PrivateKeyID = %q, want %q", got, want) } if got, want := strings.Join(conf.Scopes, ","), "scope1,scope2"; got != want { t.Errorf("Scopes = %q; want %q", got, want) } if got, want := conf.TokenURL, "https://accounts.google.com/o/gophers/token"; got != want { t.Errorf("TokenURL = %q; want %q", got, want) } if got, want := conf.Audience, "https://testservice.googleapis.com/"; got != want { t.Errorf("Audience = %q; want %q", got, want) } } func TestJWTConfigFromJSONNoTokenURL(t testing.T) { conf, err := JWTConfigFromJSON(jwtJSONKeyNoTokenURL, "scope1", "scope2") if err != nil { t.Fatal(err) } if got, want := conf.TokenURL, "https://oauth2.googleapis.com/token"; got != want { t.Errorf("TokenURL = %q; want %q", got, want) } } func TestJWTConfigFromJSONNoAudience(t testing.T) { conf, err := JWTConfigFromJSON(jwtJSONKeyNoAudience, "scope1", "scope2") if err != nil { t.Fatal(err) } if got, want := conf.Audience, ""; got != want { t.Errorf("Audience = %q; want %q", got, want) } } func TestComputeTokenSource(t testing.T) { tokenPath := "/computeMetadata/v1/instance/service-accounts/default/token" tokenResponseBody := `{"access_token":"Sample.Access.Token","token_type":"Bearer","expires_in":3600}` s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { if r.URL.Path != tokenPath { t.Errorf("got %s, want %s", r.URL.Path, tokenPath) } w.Write([]byte(tokenResponseBody)) })) defer s.Close() t.Setenv("GCE_METADATA_HOST", strings.TrimPrefix(s.URL, "http://")) ts := ComputeTokenSource("") _, err := ts.Token() if err != nil { t.Errorf("ts.Token() = %v", err) } }	5.49 KB	2025-05-25 12:27
📁 internal	-	2025-05-25 12:27
📄 jwt.go // Copyright 2015 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package google import ( "crypto/rsa" "fmt" "strings" "time" "golang.org/x/oauth2" "golang.org/x/oauth2/internal" "golang.org/x/oauth2/jws" ) // JWTAccessTokenSourceFromJSON uses a Google Developers service account JSON // key file to read the credentials that authorize and authenticate the // requests, and returns a TokenSource that does not use any OAuth2 flow but // instead creates a JWT and sends that as the access token. // The audience is typically a URL that specifies the scope of the credentials. // // Note that this is not a standard OAuth flow, but rather an // optimization supported by a few Google services. // Unless you know otherwise, you should use JWTConfigFromJSON instead. func JWTAccessTokenSourceFromJSON(jsonKey []byte, audience string) (oauth2.TokenSource, error) { return newJWTSource(jsonKey, audience, nil) } // JWTAccessTokenSourceWithScope uses a Google Developers service account JSON // key file to read the credentials that authorize and authenticate the // requests, and returns a TokenSource that does not use any OAuth2 flow but // instead creates a JWT and sends that as the access token. // The scope is typically a list of URLs that specifies the scope of the // credentials. // // Note that this is not a standard OAuth flow, but rather an // optimization supported by a few Google services. // Unless you know otherwise, you should use JWTConfigFromJSON instead. func JWTAccessTokenSourceWithScope(jsonKey []byte, scope ...string) (oauth2.TokenSource, error) { return newJWTSource(jsonKey, "", scope) } func newJWTSource(jsonKey []byte, audience string, scopes []string) (oauth2.TokenSource, error) { if len(scopes) == 0 && audience == "" { return nil, fmt.Errorf("google: missing scope/audience for JWT access token") } cfg, err := JWTConfigFromJSON(jsonKey) if err != nil { return nil, fmt.Errorf("google: could not parse JSON key: %v", err) } pk, err := internal.ParseKey(cfg.PrivateKey) if err != nil { return nil, fmt.Errorf("google: could not parse key: %v", err) } ts := &jwtAccessTokenSource{ email: cfg.Email, audience: audience, scopes: scopes, pk: pk, pkID: cfg.PrivateKeyID, } tok, err := ts.Token() if err != nil { return nil, err } rts := newErrWrappingTokenSource(oauth2.ReuseTokenSource(tok, ts)) return rts, nil } type jwtAccessTokenSource struct { email, audience string scopes []string pk rsa.PrivateKey pkID string } func (ts jwtAccessTokenSource) Token() (*oauth2.Token, error) { iat := time.Now() exp := iat.Add(time.Hour) scope := strings.Join(ts.scopes, " ") cs := &jws.ClaimSet{ Iss: ts.email, Sub: ts.email, Aud: ts.audience, Scope: scope, Iat: iat.Unix(), Exp: exp.Unix(), } hdr := &jws.Header{ Algorithm: "RS256", Typ: "JWT", KeyID: string(ts.pkID), } msg, err := jws.Encode(hdr, cs, ts.pk) if err != nil { return nil, fmt.Errorf("google: could not encode JWT: %v", err) } return &oauth2.Token{AccessToken: msg, TokenType: "Bearer", Expiry: exp}, nil }	3.17 KB	2025-05-25 12:27
📄 jwt_test.go // Copyright 2016 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package google import ( "bytes" "crypto/rand" "crypto/rsa" "crypto/x509" "encoding/base64" "encoding/json" "encoding/pem" "strings" "sync" "testing" "time" "golang.org/x/oauth2/jws" ) var ( privateKey rsa.PrivateKey jsonKey []byte once sync.Once ) func TestJWTAccessTokenSourceFromJSON(t testing.T) { setupDummyKey(t) ts, err := JWTAccessTokenSourceFromJSON(jsonKey, "audience") if err != nil { t.Fatalf("JWTAccessTokenSourceFromJSON: %v\nJSON: %s", err, string(jsonKey)) } tok, err := ts.Token() if err != nil { t.Fatalf("Token: %v", err) } if got, want := tok.TokenType, "Bearer"; got != want { t.Errorf("TokenType = %q, want %q", got, want) } if got := tok.Expiry; tok.Expiry.Before(time.Now()) { t.Errorf("Expiry = %v, should not be expired", got) } err = jws.Verify(tok.AccessToken, &privateKey.PublicKey) if err != nil { t.Errorf("jws.Verify on AccessToken: %v", err) } claim, err := jws.Decode(tok.AccessToken) if err != nil { t.Fatalf("jws.Decode on AccessToken: %v", err) } if got, want := claim.Iss, "gopher@developer.gserviceaccount.com"; got != want { t.Errorf("Iss = %q, want %q", got, want) } if got, want := claim.Sub, "gopher@developer.gserviceaccount.com"; got != want { t.Errorf("Sub = %q, want %q", got, want) } if got, want := claim.Aud, "audience"; got != want { t.Errorf("Aud = %q, want %q", got, want) } // Finally, check the header private key. parts := strings.Split(tok.AccessToken, ".") hdrJSON, err := base64.RawURLEncoding.DecodeString(parts[0]) if err != nil { t.Fatalf("base64 DecodeString: %v\nString: %q", err, parts[0]) } var hdr jws.Header if err := json.Unmarshal(hdrJSON, &hdr); err != nil { t.Fatalf("json.Unmarshal: %v (%q)", err, hdrJSON) } if got, want := hdr.KeyID, "268f54e43a1af97cfc71731688434f45aca15c8b"; got != want { t.Errorf("Header KeyID = %q, want %q", got, want) } } func TestJWTAccessTokenSourceWithScope(t testing.T) { setupDummyKey(t) ts, err := JWTAccessTokenSourceWithScope(jsonKey, "scope1", "scope2") if err != nil { t.Fatalf("JWTAccessTokenSourceWithScope: %v\nJSON: %s", err, string(jsonKey)) } tok, err := ts.Token() if err != nil { t.Fatalf("Token: %v", err) } if got, want := tok.TokenType, "Bearer"; got != want { t.Errorf("TokenType = %q, want %q", got, want) } if got := tok.Expiry; tok.Expiry.Before(time.Now()) { t.Errorf("Expiry = %v, should not be expired", got) } err = jws.Verify(tok.AccessToken, &privateKey.PublicKey) if err != nil { t.Errorf("jws.Verify on AccessToken: %v", err) } claim, err := jws.Decode(tok.AccessToken) if err != nil { t.Fatalf("jws.Decode on AccessToken: %v", err) } if got, want := claim.Iss, "gopher@developer.gserviceaccount.com"; got != want { t.Errorf("Iss = %q, want %q", got, want) } if got, want := claim.Sub, "gopher@developer.gserviceaccount.com"; got != want { t.Errorf("Sub = %q, want %q", got, want) } if got, want := claim.Scope, "scope1 scope2"; got != want { t.Errorf("Aud = %q, want %q", got, want) } // Finally, check the header private key. parts := strings.Split(tok.AccessToken, ".") hdrJSON, err := base64.RawURLEncoding.DecodeString(parts[0]) if err != nil { t.Fatalf("base64 DecodeString: %v\nString: %q", err, parts[0]) } var hdr jws.Header if err := json.Unmarshal(hdrJSON, &hdr); err != nil { t.Fatalf("json.Unmarshal: %v (%q)", err, hdrJSON) } if got, want := hdr.KeyID, "268f54e43a1af97cfc71731688434f45aca15c8b"; got != want { t.Errorf("Header KeyID = %q, want %q", got, want) } } func setupDummyKey(t testing.T) { once.Do(func() { // Generate a key we can use in the test data. pk, err := rsa.GenerateKey(rand.Reader, 2048) if err != nil { t.Fatal(err) } privateKey = pk // Encode the key and substitute into our example JSON. enc := pem.EncodeToMemory(&pem.Block{ Type: "PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(privateKey), }) enc, err = json.Marshal(string(enc)) if err != nil { t.Fatalf("json.Marshal: %v", err) } jsonKey = bytes.Replace(jwtJSONKey, []byte(`"super secret key"`), enc, 1) }) }	4.2 KB	2025-05-25 12:27
📄 sdk.go // Copyright 2015 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package google import ( "bufio" "context" "encoding/json" "errors" "fmt" "io" "net/http" "os" "os/user" "path/filepath" "runtime" "strings" "time" "golang.org/x/oauth2" ) type sdkCredentials struct { Data []struct { Credential struct { ClientID string `json:"client_id"` ClientSecret string `json:"client_secret"` AccessToken string `json:"access_token"` RefreshToken string `json:"refresh_token"` TokenExpiry time.Time `json:"token_expiry"` } `json:"credential"` Key struct { Account string `json:"account"` Scope string `json:"scope"` } `json:"key"` } } // An SDKConfig provides access to tokens from an account already // authorized via the Google Cloud SDK. type SDKConfig struct { conf oauth2.Config initialToken oauth2.Token } // NewSDKConfig creates an SDKConfig for the given Google Cloud SDK // account. If account is empty, the account currently active in // Google Cloud SDK properties is used. // Google Cloud SDK credentials must be created by running `gcloud auth` // before using this function. // The Google Cloud SDK is available at https://cloud.google.com/sdk/. func NewSDKConfig(account string) (SDKConfig, error) { configPath, err := sdkConfigPath() if err != nil { return nil, fmt.Errorf("oauth2/google: error getting SDK config path: %v", err) } credentialsPath := filepath.Join(configPath, "credentials") f, err := os.Open(credentialsPath) if err != nil { return nil, fmt.Errorf("oauth2/google: failed to load SDK credentials: %v", err) } defer f.Close() var c sdkCredentials if err := json.NewDecoder(f).Decode(&c); err != nil { return nil, fmt.Errorf("oauth2/google: failed to decode SDK credentials from %q: %v", credentialsPath, err) } if len(c.Data) == 0 { return nil, fmt.Errorf("oauth2/google: no credentials found in %q, run `gcloud auth login` to create one", credentialsPath) } if account == "" { propertiesPath := filepath.Join(configPath, "properties") f, err := os.Open(propertiesPath) if err != nil { return nil, fmt.Errorf("oauth2/google: failed to load SDK properties: %v", err) } defer f.Close() ini, err := parseINI(f) if err != nil { return nil, fmt.Errorf("oauth2/google: failed to parse SDK properties %q: %v", propertiesPath, err) } core, ok := ini["core"] if !ok { return nil, fmt.Errorf("oauth2/google: failed to find [core] section in %v", ini) } active, ok := core["account"] if !ok { return nil, fmt.Errorf("oauth2/google: failed to find %q attribute in %v", "account", core) } account = active } for _, d := range c.Data { if account == "" \|\| d.Key.Account == account { if d.Credential.AccessToken == "" && d.Credential.RefreshToken == "" { return nil, fmt.Errorf("oauth2/google: no token available for account %q", account) } var expiry time.Time if d.Credential.TokenExpiry != nil { expiry = d.Credential.TokenExpiry } return &SDKConfig{ conf: oauth2.Config{ ClientID: d.Credential.ClientID, ClientSecret: d.Credential.ClientSecret, Scopes: strings.Split(d.Key.Scope, " "), Endpoint: Endpoint, RedirectURL: "oob", }, initialToken: &oauth2.Token{ AccessToken: d.Credential.AccessToken, RefreshToken: d.Credential.RefreshToken, Expiry: expiry, }, }, nil } } return nil, fmt.Errorf("oauth2/google: no such credentials for account %q", account) } // Client returns an HTTP client using Google Cloud SDK credentials to // authorize requests. The token will auto-refresh as necessary. The // underlying http.RoundTripper will be obtained using the provided // context. The returned client and its Transport should not be // modified. func (c SDKConfig) Client(ctx context.Context) http.Client { return &http.Client{ Transport: &oauth2.Transport{ Source: c.TokenSource(ctx), }, } } // TokenSource returns an oauth2.TokenSource that retrieve tokens from // Google Cloud SDK credentials using the provided context. // It will returns the current access token stored in the credentials, // and refresh it when it expires, but it won't update the credentials // with the new access token. func (c SDKConfig) TokenSource(ctx context.Context) oauth2.TokenSource { return c.conf.TokenSource(ctx, c.initialToken) } // Scopes are the OAuth 2.0 scopes the current account is authorized for. func (c SDKConfig) Scopes() []string { return c.conf.Scopes } func parseINI(ini io.Reader) (map[string]map[string]string, error) { result := map[string]map[string]string{ "": {}, // root section } scanner := bufio.NewScanner(ini) currentSection := "" for scanner.Scan() { line := strings.TrimSpace(scanner.Text()) if strings.HasPrefix(line, ";") { // comment. continue } if strings.HasPrefix(line, "[") && strings.HasSuffix(line, "]") { currentSection = strings.TrimSpace(line[1 : len(line)-1]) result[currentSection] = map[string]string{} continue } parts := strings.SplitN(line, "=", 2) if len(parts) == 2 && parts[0] != "" { result[currentSection][strings.TrimSpace(parts[0])] = strings.TrimSpace(parts[1]) } } if err := scanner.Err(); err != nil { return nil, fmt.Errorf("error scanning ini: %v", err) } return result, nil } // sdkConfigPath tries to guess where the gcloud config is located. // It can be overridden during tests. var sdkConfigPath = func() (string, error) { if runtime.GOOS == "windows" { return filepath.Join(os.Getenv("APPDATA"), "gcloud"), nil } homeDir := guessUnixHomeDir() if homeDir == "" { return "", errors.New("unable to get current user home directory: os/user lookup failed; $HOME is empty") } return filepath.Join(homeDir, ".config", "gcloud"), nil } func guessUnixHomeDir() string { // Prefer $HOME over user.Current due to glibc bug: golang.org/issue/13470 if v := os.Getenv("HOME"); v != "" { return v } // Else, fall back to user.Current: if u, err := user.Current(); err == nil { return u.HomeDir } return "" }	6.05 KB	2025-05-25 12:27
📄 sdk_test.go // Copyright 2015 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package google import ( "reflect" "strings" "testing" ) func TestSDKConfig(t testing.T) { sdkConfigPath = func() (string, error) { return "testdata/gcloud", nil } tests := []struct { account string accessToken string err bool }{ {"", "bar_access_token", false}, {"foo@example.com", "foo_access_token", false}, {"bar@example.com", "bar_access_token", false}, {"baz@serviceaccount.example.com", "", true}, } for _, tt := range tests { c, err := NewSDKConfig(tt.account) if got, want := err != nil, tt.err; got != want { if !tt.err { t.Errorf("got %v, want nil", err) } else { t.Errorf("got nil, want error") } continue } if err != nil { continue } tok := c.initialToken if tok == nil { t.Errorf("got nil, want %q", tt.accessToken) continue } if tok.AccessToken != tt.accessToken { t.Errorf("got %q, want %q", tok.AccessToken, tt.accessToken) } } } func TestParseINI(t testing.T) { tests := []struct { ini string want map[string]map[string]string }{ { `root = toor [foo] bar = hop ini = nin `, map[string]map[string]string{ "": {"root": "toor"}, "foo": {"bar": "hop", "ini": "nin"}, }, }, { "\t extra \t = whitespace \t\r\n \t [everywhere] \t \r\n here \t = \t there \t \r\n", map[string]map[string]string{ "": {"extra": "whitespace"}, "everywhere": {"here": "there"}, }, }, { `[empty] [section] empty= `, map[string]map[string]string{ "": {}, "empty": {}, "section": {"empty": ""}, }, }, { `ignore [invalid =stuff ;comment=true `, map[string]map[string]string{ "": {}, }, }, } for _, tt := range tests { result, err := parseINI(strings.NewReader(tt.ini)) if err != nil { t.Errorf("parseINI(%q) error %v, want: no error", tt.ini, err) continue } if !reflect.DeepEqual(result, tt.want) { t.Errorf("parseINI(%q) = %#v, want: %#v", tt.ini, result, tt.want) } } }	2.1 KB	2025-05-25 12:27
📁 testdata	-	2025-05-25 12:27

Terminal