1b4dd47 · gogol · git.iko.soy

gogol/src/Network/Google/Auth.hs+13

compare with develop

unifiedsplit

@@ -25,6 +25,9 @@ module Network.Google.Auth

25 , saveAuthorizedUserToWellKnownPath

26 , saveAuthorizedUser

27

28+ -- ** Service account user impersonation

29+ , serviceAccountUser

30+

28 -- ** Installed Application Credentials

31 -- ** Installed Application Credentials

29 , installedApplication

32 , installedApplication

30 , formURL

33 , formURL

@@ -198,3 +201,13 @@ authorize rq s l m = bearer <$> getToken s l m

198 , "Bearer " <> toHeader (_tokenAccess t)

201 , "Bearer " <> toHeader (_tokenAccess t)

199 ) : Client.requestHeaders rq

202 ) : Client.requestHeaders rq

200 }

203 }

204+

205+-- | Set the user to be impersonated for a service account with domain

206+-- wide delegation. See

207+-- https://developers.google.com/identity/protocols/OAuth2ServiceAccount

208+serviceAccountUser :: forall s. (AllowScopes s)

209+ => Maybe Text

210+ -> Credentials s

211+ -> Credentials s

212+serviceAccountUser u (FromAccount s) = FromAccount $ s { _serviceAccountUser = u }

213+serviceAccountUser _ c = c

gogol/src/Network/Google/Auth/ServiceAccount.hs+2−2

@@ -125,10 +125,10 @@ encodeBearerJWT s p = liftIO $ do

125 , "kid" .= _serviceKeyId s

126 ]

127

128− payload = base64Encode

128+ payload = base64Encode $

129 [ "aud" .= tokenURL

130 , "scope" .= concatScopes (allowScopes p)

131 , "iat" .= n

132 , "exp" .= (n + seconds maxTokenLifetime)

133 , "iss" .= _serviceEmail s

134− ]

134+ ] <> maybe [] (\sub -> ["sub" .= sub]) (_serviceAccountUser s)

gogol/src/Network/Google/Internal/Auth.hs+6−4

@@ -91,10 +91,11 @@ specifying which 'Scope's the resulting 'OAuthToken' is authorized to access.

91/See:/ <https://developers.google.com/identity/protocols/OAuth2ServiceAccount#delegatingauthority Delegating authority to your service account>.

92-}

93data ServiceAccount = ServiceAccount

94− { _serviceId :: !ClientId

94+ { _serviceId :: !ClientId

95− , _serviceEmail :: !Text

95+ , _serviceEmail :: !Text

96− , _serviceKeyId :: !Text

96+ , _serviceKeyId :: !Text

97− , _servicePrivateKey :: !PrivateKey

97+ , _servicePrivateKey :: !PrivateKey

98+ , _serviceAccountUser :: !(Maybe Text)

98 } deriving (Eq, Show)

99 } deriving (Eq, Show)

99

100

100instance FromJSON ServiceAccount where

101instance FromJSON ServiceAccount where

@@ -109,6 +110,7 @@ instance FromJSON ServiceAccount where

109 <*> o .: "client_email"

110 <*> o .: "client_email"

110 <*> o .: "private_key_id"

111 <*> o .: "private_key_id"

111 <*> pure k

112 <*> pure k

113+ <*> pure Nothing

112

114

113{-| Authorized User credentials which are typically generated by the Cloud SDK

115{-| Authorized User credentials which are typically generated by the Cloud SDK

114Tools such as @gcloud init@, of the following form:

116Tools such as @gcloud init@, of the following form: