Documentation
¶
Overview ¶
Package gauth obtains Google-signed OIDC ID tokens for authenticating to the tfstackplan control plane, replacing the shared-secret HS256 scheme. Two Application Default Credential shapes are supported:
- service accounts (Cloud Build / GCE metadata server, SA keys, impersonation): idtoken.NewTokenSource mints tokens for the requested audience — the serve URL;
- user credentials (`gcloud auth application-default login`), which cannot mint custom-audience tokens: the id_token riding the OAuth refresh response is used instead. Its audience is the gcloud ADC client id, so the server must list it in api_auth.extra_audiences.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type TokenFunc ¶
TokenFunc returns a currently-valid bearer token. Implementations cache and refresh internally; callers invoke it per request.
func Source ¶
Source builds a TokenFunc yielding Google OIDC ID tokens for audience from Application Default Credentials. Errors when no ADC is available at all.
func SourceTimeout ¶
SourceTimeout builds Source but bounds credential discovery — which may include an eager network token fetch (idtoken.NewTokenSource fetches once at construction) — by timeout. The source itself is deliberately built on a background context: the oauth2 machinery binds the construction context into every future refresh, so cancelling it would poison the returned TokenFunc. On timeout the discovery goroutine is abandoned.
type VerifyFunc ¶
VerifyFunc verifies a Google-signed OIDC bearer token and returns its verified email claim. This is the server-side counterpart of TokenFunc.
func Verifier ¶
func Verifier(ctx context.Context, audiences []string, opts ...option.ClientOption) (VerifyFunc, error)
Verifier builds a VerifyFunc accepting tokens for any of audiences. Used for Pub/Sub push auth (single audience) and /api/* auth (audience allowlist). The audience is checked here rather than inside idtoken's validation so callers can accept multiple audiences — e.g. user-ADC tokens carrying the fixed gcloud client id alongside service-account tokens minted for the serve URL. opts configure the validator's key-fetching HTTP client; tests inject one serving their own JWKS.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package gauthtest provides a fake Google OIDC issuer for offline tests of the gauth mint/verify paths — no network, no credentials, no test users.
|
Package gauthtest provides a fake Google OIDC issuer for offline tests of the gauth mint/verify paths — no network, no credentials, no test users. |