Skip to content

Commit 353e887

Browse files
aeitzmanaeitzman
committed
Respond to comments
1 parent 80c14f3 commit 353e887

File tree

7 files changed

+63
-61
lines changed

7 files changed

+63
-61
lines changed

‎google/externalaccount/aws.go

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -425,7 +425,7 @@ func (cs *awsCredentialSource) getAWSSessionToken() (string, error) {
425425
}
426426

427427
if resp.StatusCode != 200 {
428-
return "", fmt.Errorf("oauth2/google: unable to retrieve AWS session token - %s", string(respBody))
428+
return "", fmt.Errorf("oauth2/google/externalaccount: unable to retrieve AWS session token - %s", string(respBody))
429429
}
430430

431431
return string(respBody), nil
@@ -444,7 +444,7 @@ func (cs *awsCredentialSource) getRegion(headers map[string]string) (string, err
444444
}
445445

446446
if cs.regionURL == "" {
447-
return "", errors.New("oauth2/google: unable to determine AWS region")
447+
return "", errors.New("oauth2/google/externalaccount: unable to determine AWS region")
448448
}
449449

450450
req, err := http.NewRequest("GET", cs.regionURL, nil)
@@ -468,7 +468,7 @@ func (cs *awsCredentialSource) getRegion(headers map[string]string) (string, err
468468
}
469469

470470
if resp.StatusCode != 200 {
471-
return "", fmt.Errorf("oauth2/google: unable to retrieve AWS region - %s", string(respBody))
471+
return "", fmt.Errorf("oauth2/google/externalaccount: unable to retrieve AWS region - %s", string(respBody))
472472
}
473473

474474
// This endpoint will return the region in format: us-east-2b.
@@ -503,11 +503,11 @@ func (cs *awsCredentialSource) getSecurityCredentials(headers map[string]string)
503503
}
504504

505505
if credentials.AccessKeyID == "" {
506-
return result, errors.New("oauth2/google: missing AccessKeyId credential")
506+
return result, errors.New("oauth2/google/externalaccount: missing AccessKeyId credential")
507507
}
508508

509509
if credentials.SecretAccessKey == "" {
510-
return result, errors.New("oauth2/google: missing SecretAccessKey credential")
510+
return result, errors.New("oauth2/google/externalaccount: missing SecretAccessKey credential")
511511
}
512512

513513
return &credentials, nil
@@ -538,7 +538,7 @@ func (cs *awsCredentialSource) getMetadataSecurityCredentials(roleName string, h
538538
}
539539

540540
if resp.StatusCode != 200 {
541-
return result, fmt.Errorf("oauth2/google: unable to retrieve AWS security credentials - %s", string(respBody))
541+
return result, fmt.Errorf("oauth2/google/externalaccount: unable to retrieve AWS security credentials - %s", string(respBody))
542542
}
543543

544544
err = json.Unmarshal(respBody, &result)
@@ -547,7 +547,7 @@ func (cs *awsCredentialSource) getMetadataSecurityCredentials(roleName string, h
547547

548548
func (cs *awsCredentialSource) getMetadataRoleName(headers map[string]string) (string, error) {
549549
if cs.credVerificationURL == "" {
550-
return "", errors.New("oauth2/google: unable to determine the AWS metadata server security credentials endpoint")
550+
return "", errors.New("oauth2/google/externalaccount: unable to determine the AWS metadata server security credentials endpoint")
551551
}
552552

553553
req, err := http.NewRequest("GET", cs.credVerificationURL, nil)
@@ -571,7 +571,7 @@ func (cs *awsCredentialSource) getMetadataRoleName(headers map[string]string) (s
571571
}
572572

573573
if resp.StatusCode != 200 {
574-
return "", fmt.Errorf("oauth2/google: unable to retrieve AWS role name - %s", string(respBody))
574+
return "", fmt.Errorf("oauth2/google/externalaccount: unable to retrieve AWS role name - %s", string(respBody))
575575
}
576576

577577
return string(respBody), nil

‎google/externalaccount/aws_test.go

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -846,7 +846,7 @@ func TestAWSCredential_RequestWithBadVersion(t *testing.T) {
846846
if err == nil {
847847
t.Fatalf("parse() should have failed")
848848
}
849-
if got, want := err.Error(), "oauth2/google: aws version '3' is not supported in the current build"; !reflect.DeepEqual(got, want) {
849+
if got, want := err.Error(), "oauth2/google/externalaccount: aws version '3' is not supported in the current build"; !reflect.DeepEqual(got, want) {
850850
t.Errorf("subjectToken = %q, want %q", got, want)
851851
}
852852
}
@@ -875,7 +875,7 @@ func TestAWSCredential_RequestWithNoRegionURL(t *testing.T) {
875875
t.Fatalf("retrieveSubjectToken() should have failed")
876876
}
877877

878-
if got, want := err.Error(), "oauth2/google: unable to determine AWS region"; !reflect.DeepEqual(got, want) {
878+
if got, want := err.Error(), "oauth2/google/externalaccount: unable to determine AWS region"; !reflect.DeepEqual(got, want) {
879879
t.Errorf("subjectToken = %q, want %q", got, want)
880880
}
881881
}
@@ -905,7 +905,7 @@ func TestAWSCredential_RequestWithBadRegionURL(t *testing.T) {
905905
t.Fatalf("retrieveSubjectToken() should have failed")
906906
}
907907

908-
if got, want := err.Error(), "oauth2/google: unable to retrieve AWS region - Not Found"; !reflect.DeepEqual(got, want) {
908+
if got, want := err.Error(), "oauth2/google/externalaccount: unable to retrieve AWS region - Not Found"; !reflect.DeepEqual(got, want) {
909909
t.Errorf("subjectToken = %q, want %q", got, want)
910910
}
911911
}
@@ -937,7 +937,7 @@ func TestAWSCredential_RequestWithMissingCredential(t *testing.T) {
937937
t.Fatalf("retrieveSubjectToken() should have failed")
938938
}
939939

940-
if got, want := err.Error(), "oauth2/google: missing AccessKeyId credential"; !reflect.DeepEqual(got, want) {
940+
if got, want := err.Error(), "oauth2/google/externalaccount: missing AccessKeyId credential"; !reflect.DeepEqual(got, want) {
941941
t.Errorf("subjectToken = %q, want %q", got, want)
942942
}
943943
}
@@ -969,7 +969,7 @@ func TestAWSCredential_RequestWithIncompleteCredential(t *testing.T) {
969969
t.Fatalf("retrieveSubjectToken() should have failed")
970970
}
971971

972-
if got, want := err.Error(), "oauth2/google: missing SecretAccessKey credential"; !reflect.DeepEqual(got, want) {
972+
if got, want := err.Error(), "oauth2/google/externalaccount: missing SecretAccessKey credential"; !reflect.DeepEqual(got, want) {
973973
t.Errorf("subjectToken = %q, want %q", got, want)
974974
}
975975
}
@@ -998,7 +998,7 @@ func TestAWSCredential_RequestWithNoCredentialURL(t *testing.T) {
998998
t.Fatalf("retrieveSubjectToken() should have failed")
999999
}
10001000

1001-
if got, want := err.Error(), "oauth2/google: unable to determine the AWS metadata server security credentials endpoint"; !reflect.DeepEqual(got, want) {
1001+
if got, want := err.Error(), "oauth2/google/externalaccount: unable to determine the AWS metadata server security credentials endpoint"; !reflect.DeepEqual(got, want) {
10021002
t.Errorf("subjectToken = %q, want %q", got, want)
10031003
}
10041004
}
@@ -1027,7 +1027,7 @@ func TestAWSCredential_RequestWithBadCredentialURL(t *testing.T) {
10271027
t.Fatalf("retrieveSubjectToken() should have failed")
10281028
}
10291029

1030-
if got, want := err.Error(), "oauth2/google: unable to retrieve AWS role name - Not Found"; !reflect.DeepEqual(got, want) {
1030+
if got, want := err.Error(), "oauth2/google/externalaccount: unable to retrieve AWS role name - Not Found"; !reflect.DeepEqual(got, want) {
10311031
t.Errorf("subjectToken = %q, want %q", got, want)
10321032
}
10331033
}
@@ -1056,7 +1056,7 @@ func TestAWSCredential_RequestWithBadFinalCredentialURL(t *testing.T) {
10561056
t.Fatalf("retrieveSubjectToken() should have failed")
10571057
}
10581058

1059-
if got, want := err.Error(), "oauth2/google: unable to retrieve AWS security credentials - Not Found"; !reflect.DeepEqual(got, want) {
1059+
if got, want := err.Error(), "oauth2/google/externalaccount: unable to retrieve AWS security credentials - Not Found"; !reflect.DeepEqual(got, want) {
10601060
t.Errorf("subjectToken = %q, want %q", got, want)
10611061
}
10621062
}

‎google/externalaccount/basecredentials.go

Lines changed: 20 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ https://cloud.google.com/iam/docs/workload-identity-federation-with-other-provid
4646
To use a custom function to supply the token, define a struct that implements the [SubjectTokenSupplier] interface for OIDC/SAML providers,
4747
or one that implements [AwsSecurityCredentialsSupplier] for AWS providers. This can then be used when building a [Config].
4848
The [golang.org/x/oauth2.TokenSource] created from the config using [NewTokenSource] can then be used access Google
49-
Cloud resources. For instance, you can create a NewClient from thes
49+
Cloud resources. For instance, you can create a new client from the
5050
[cloud.google.com/go/storage] package and pass in option.WithTokenSource(yourTokenSource))
5151
5252
Note that this library does not perform any validation on the token_url, token_info_url,
@@ -153,7 +153,7 @@ type Config struct {
153153
ServiceAccountImpersonationLifetimeSeconds int
154154
// ClientSecret is currently only required if token_info endpoint also
155155
// needs to be called with the generated GCP access token. When provided, STS will be
156-
// called with additional basic authentication using client_id as username and client_secret as password. Optional.
156+
// called with additional basic authentication using ClientId as username and ClientSecret as password. Optional.
157157
ClientSecret string
158158
// ClientID is only required in conjunction with ClientSecret, as described above. Optional.
159159
ClientID string
@@ -162,7 +162,7 @@ type Config struct {
162162
// CredentialSource must be provided. Optional.
163163
CredentialSource *CredentialSource
164164
// QuotaProjectID is injected by gCloud. If the value is non-empty, the Auth libraries
165-
// will set the x-goog-user-project which overrides the project associated with the credentials. Optional.
165+
// will set the x-goog-user-project header which overrides the project associated with the credentials. Optional.
166166
QuotaProjectID string
167167
// Scopes contains the desired scopes for the returned access token. Optional.
168168
Scopes []string
@@ -190,15 +190,15 @@ func validateWorkforceAudience(input string) bool {
190190
// NewTokenSource Returns an external account TokenSource using the provided external account config.
191191
func NewTokenSource(ctx context.Context, conf Config) (oauth2.TokenSource, error) {
192192
if conf.Audience == "" {
193-
return nil, fmt.Errorf("oauth2/google: Audience must be set")
193+
return nil, fmt.Errorf("oauth2/google/externalaccount: Audience must be set")
194194
}
195195
if conf.SubjectTokenType == "" {
196-
return nil, fmt.Errorf("oauth2/google: Subject token type must be set")
196+
return nil, fmt.Errorf("oauth2/google/externalaccount: Subject token type must be set")
197197
}
198198
if conf.WorkforcePoolUserProject != "" {
199199
valid := validateWorkforceAudience(conf.Audience)
200200
if !valid {
201-
return nil, fmt.Errorf("oauth2/google: Workforce pool user project should not be set for non-workforce pool credentials")
201+
return nil, fmt.Errorf("oauth2/google/externalaccount: Workforce pool user project should not be set for non-workforce pool credentials")
202202
}
203203
}
204204
count := 0
@@ -212,10 +212,10 @@ func NewTokenSource(ctx context.Context, conf Config) (oauth2.TokenSource, error
212212
count++
213213
}
214214
if count == 0 {
215-
return nil, fmt.Errorf("oauth2/google: One of CredentialSource, SubjectTokenSupplier, or AwsSecurityCredentialsSupplier must be set")
215+
return nil, fmt.Errorf("oauth2/google/externalaccount: One of CredentialSource, SubjectTokenSupplier, or AwsSecurityCredentialsSupplier must be set")
216216
}
217217
if count > 1 {
218-
return nil, fmt.Errorf("oauth2/google: Only one of CredentialSource, SubjectTokenSupplier, or AwsSecurityCredentialsSupplier must be set")
218+
return nil, fmt.Errorf("oauth2/google/externalaccount: Only one of CredentialSource, SubjectTokenSupplier, or AwsSecurityCredentialsSupplier must be set")
219219
}
220220
return conf.tokenSource(ctx, "https")
221221
}
@@ -263,21 +263,23 @@ type Format struct {
263263
}
264264

265265
// CredentialSource stores the information necessary to retrieve the credentials for the STS exchange.
266-
// One field amongst File, URL, Executable, or EnvironmentID should be provided, depending on the kind of credential in question.
267-
// The EnvironmentID should start with AWS if being used for an AWS credential.
268266
type CredentialSource struct {
269267
// File is the location for file sourced credentials.
268+
// One field amongst File, URL, Executable, or EnvironmentID should be provided, depending on the kind of credential in question.
270269
File string `json:"file"`
271270

272271
// Url is the URL to call for URL sourced credentials.
272+
// One field amongst File, URL, Executable, or EnvironmentID should be provided, depending on the kind of credential in question.
273273
URL string `json:"url"`
274-
// Headers are the Headers to attach to the request for URL sourced credentials.
274+
// Headers are the headers to attach to the request for URL sourced credentials.
275275
Headers map[string]string `json:"headers"`
276276

277277
// Executable is the configuration object for executable sourced credentials.
278+
// One field amongst File, URL, Executable, or EnvironmentID should be provided, depending on the kind of credential in question.
278279
Executable *ExecutableConfig `json:"executable"`
279280

280-
// EnvironmentID is the EnvironmentID used for AWS sourced credentials.
281+
// EnvironmentID is the EnvironmentID used for AWS sourced credentials. This should start with "AWS".
282+
// One field amongst File, URL, Executable, or EnvironmentID should be provided, depending on the kind of credential in question.
281283
EnvironmentID string `json:"environment_id"`
282284
// RegionURL is the metadata URL to retrieve the region from for EC2 AWS credentials.
283285
RegionURL string `json:"region_url"`
@@ -295,7 +297,7 @@ type ExecutableConfig struct {
295297
// Command is the the full command to run to retrieve the subject token.
296298
// This can include arguments. Must be an absolute path for the program. Required.
297299
Command string `json:"command"`
298-
// TimeoutMillis is the timeout duration, in milliseconds. Defaults to 30 seconds when not provided. Optional.
300+
// TimeoutMillis is the timeout duration, in milliseconds. Defaults to 30000 milliseconds when not provided. Optional.
299301
TimeoutMillis *int `json:"timeout_millis"`
300302
// OutputFile is the absolute path to the output file where the executable will cache the response.
301303
// If specified the auth libraries will first check this location before running the executable. Optional.
@@ -310,7 +312,7 @@ type SubjectTokenSupplier interface {
310312
SubjectToken(ctx context.Context, options SupplierOptions) (string, error)
311313
}
312314

313-
// AWSSecurityCredentialsSupplier can be used to supply AwsSecurityCredentials and an Aws Region to
315+
// AWSSecurityCredentialsSupplier can be used to supply AwsSecurityCredentials and an AWS Region to
314316
// exchange for a GCP access token.
315317
type AwsSecurityCredentialsSupplier interface {
316318
// AwsRegion should return the AWS region or an error.
@@ -321,7 +323,7 @@ type AwsSecurityCredentialsSupplier interface {
321323
AwsSecurityCredentials(ctx context.Context, options SupplierOptions) (*AwsSecurityCredentials, error)
322324
}
323325

324-
// SupplierOptions contains information about the requested subject token or Aws credentials from the
326+
// SupplierOptions contains information about the requested subject token or AWS security credentials from the
325327
// Google external account credential.
326328
type SupplierOptions struct {
327329
// Audience is the requested audience for the external account credential.
@@ -355,7 +357,7 @@ func (c *Config) parse(ctx context.Context) (baseCredentialSource, error) {
355357
} else if len(c.CredentialSource.EnvironmentID) > 3 && c.CredentialSource.EnvironmentID[:3] == "aws" {
356358
if awsVersion, err := strconv.Atoi(c.CredentialSource.EnvironmentID[3:]); err == nil {
357359
if awsVersion != 1 {
358-
return nil, fmt.Errorf("oauth2/google: aws version '%d' is not supported in the current build", awsVersion)
360+
return nil, fmt.Errorf("oauth2/google/externalaccount: aws version '%d' is not supported in the current build", awsVersion)
359361
}
360362

361363
awsCredSource := awsCredentialSource{
@@ -379,7 +381,7 @@ func (c *Config) parse(ctx context.Context) (baseCredentialSource, error) {
379381
} else if c.CredentialSource.Executable != nil {
380382
return createExecutableCredential(ctx, c.CredentialSource.Executable, c)
381383
}
382-
return nil, fmt.Errorf("oauth2/google: unable to parse credential source")
384+
return nil, fmt.Errorf("oauth2/google/externalaccount: unable to parse credential source")
383385
}
384386

385387
type baseCredentialSource interface {
@@ -449,7 +451,7 @@ func (ts tokenSource) Token() (*oauth2.Token, error) {
449451
TokenType: stsResp.TokenType,
450452
}
451453
if stsResp.ExpiresIn < 0 {
452-
return nil, fmt.Errorf("oauth2/google: got invalid expiry from security token service")
454+
return nil, fmt.Errorf("oauth2/google/externalaccount: got invalid expiry from security token service")
453455
} else if stsResp.ExpiresIn >= 0 {
454456
accessToken.Expiry = now().Add(time.Duration(stsResp.ExpiresIn) * time.Second)
455457
}

‎google/externalaccount/basecredentials_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -271,7 +271,7 @@ func TestNonworkforceWithWorkforcePoolUserProject(t *testing.T) {
271271
if err == nil {
272272
t.Fatalf("Expected error but found none")
273273
}
274-
if got, want := err.Error(), "oauth2/google: Workforce pool user project should not be set for non-workforce pool credentials"; got != want {
274+
if got, want := err.Error(), "oauth2/google/externalaccount: Workforce pool user project should not be set for non-workforce pool credentials"; got != want {
275275
t.Errorf("Incorrect error received.\nExpected: %s\nRecieved: %s", want, got)
276276
}
277277
}

‎google/externalaccount/executablecredsource.go

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -39,51 +39,51 @@ func (nce nonCacheableError) Error() string {
3939
}
4040

4141
func missingFieldError(source, field string) error {
42-
return fmt.Errorf("oauth2/google: %v missing `%q` field", source, field)
42+
return fmt.Errorf("oauth2/google/externalaccount: %v missing `%q` field", source, field)
4343
}
4444

4545
func jsonParsingError(source, data string) error {
46-
return fmt.Errorf("oauth2/google: unable to parse %v\nResponse: %v", source, data)
46+
return fmt.Errorf("oauth2/google/externalaccount: unable to parse %v\nResponse: %v", source, data)
4747
}
4848

4949
func malformedFailureError() error {
50-
return nonCacheableError{"oauth2/google: response must include `error` and `message` fields when unsuccessful"}
50+
return nonCacheableError{"oauth2/google/externalaccount: response must include `error` and `message` fields when unsuccessful"}
5151
}
5252

5353
func userDefinedError(code, message string) error {
54-
return nonCacheableError{fmt.Sprintf("oauth2/google: response contains unsuccessful response: (%v) %v", code, message)}
54+
return nonCacheableError{fmt.Sprintf("oauth2/google/externalaccount: response contains unsuccessful response: (%v) %v", code, message)}
5555
}
5656

5757
func unsupportedVersionError(source string, version int) error {
58-
return fmt.Errorf("oauth2/google: %v contains unsupported version: %v", source, version)
58+
return fmt.Errorf("oauth2/google/externalaccount: %v contains unsupported version: %v", source, version)
5959
}
6060

6161
func tokenExpiredError() error {
62-
return nonCacheableError{"oauth2/google: the token returned by the executable is expired"}
62+
return nonCacheableError{"oauth2/google/externalaccount: the token returned by the executable is expired"}
6363
}
6464

6565
func tokenTypeError(source string) error {
66-
return fmt.Errorf("oauth2/google: %v contains unsupported token type", source)
66+
return fmt.Errorf("oauth2/google/externalaccount: %v contains unsupported token type", source)
6767
}
6868

6969
func exitCodeError(exitCode int) error {
70-
return fmt.Errorf("oauth2/google: executable command failed with exit code %v", exitCode)
70+
return fmt.Errorf("oauth2/google/externalaccount: executable command failed with exit code %v", exitCode)
7171
}
7272

7373
func executableError(err error) error {
74-
return fmt.Errorf("oauth2/google: executable command failed: %v", err)
74+
return fmt.Errorf("oauth2/google/externalaccount: executable command failed: %v", err)
7575
}
7676

7777
func executablesDisallowedError() error {
78-
return errors.New("oauth2/google: executables need to be explicitly allowed (set GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES to '1') to run")
78+
return errors.New("oauth2/google/externalaccount: executables need to be explicitly allowed (set GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES to '1') to run")
7979
}
8080

8181
func timeoutRangeError() error {
82-
return errors.New("oauth2/google: invalid `timeout_millis` field — executable timeout must be between 5 and 120 seconds")
82+
return errors.New("oauth2/google/externalaccount: invalid `timeout_millis` field — executable timeout must be between 5 and 120 seconds")
8383
}
8484

8585
func commandMissingError() error {
86-
return errors.New("oauth2/google: missing `command` field — executable command must be provided")
86+
return errors.New("oauth2/google/externalaccount: missing `command` field — executable command must be provided")
8787
}
8888

8989
type environment interface {

0 commit comments

Comments
 (0)