Arke.Utils.Gcp.Auth (Arke v0.9.0-rc.3)

Copy Markdown View Source

Google credentials for Arke.Utils.Gcp.

Resolves application default credentials, then either mints an OAuth access token (token/0) or signs a payload (sign/2).

Credentials are resolved on every call, first hit wins:

  1. config :arke, :gcp_credentials — a JSON string, {:system, "VAR"}, or a decoded map
  2. GOOGLE_APPLICATION_CREDENTIALS — path to the key file
  3. GOOGLE_APPLICATION_CREDENTIALS_JSON — inline JSON
  4. application_default_credentials.json in the gcloud config dir ($CLOUDSDK_CONFIG, defaulting to ~/.config/gcloud) — gcloud ADC
  5. the GCE metadata server

Signing takes whichever of those is resolved. Sources 1-3 normally carry a private key and sign locally; the metadata server has none, so signing goes through the IAM Credentials API, which needs the account to hold roles/iam.serviceAccountTokenCreator on itself. gcloud ADC can sign the same way but cannot name the account it would sign as, so it additionally needs:

config :arke, storage_signer_account: "signer@project.iam.gserviceaccount.com"

and the developer to hold roles/iam.serviceAccountTokenCreator on it.

Summary

Functions

sign(payload, email)

Signs payload as email, returning the raw signature bytes — callers encode them as their url scheme requires.

signer_email()

The account signatures will be attributed to.

token()

An OAuth access token for the resolved credentials.

Functions

sign(payload, email)

Signs payload as email, returning the raw signature bytes — callers encode them as their url scheme requires.

V4 signing embeds the signer in the payload, so the caller resolves it with signer_email/0 and passes it back here: resolving it twice risks signing as one account under a url that names another.

Service account credentials sign locally. Under Workload Identity there is no private key, so the IAM Credentials API signs on our behalf. gcloud user credentials can do the same, but cannot name the account they would be signing as, so they need config :arke, :storage_signer_account.

signer_email()

The account signatures will be attributed to.

V4 signing puts the signer inside the payload, so callers need it before they have anything to sign.

token()

An OAuth access token for the resolved credentials.