gcp

Documentation

Overview

Package gcp is the Google Cloud credential provider: service account keys, the application default credentials of a signed-in user, the OAuth access and refresh tokens they produce, and API keys.

A service account key is a JSON document, wherever it is embedded, and its own fields say whose it is; patty names it after the service account and the key id and keeps the private key apart. The bare tokens carry no checksum and no owner: an access token is a `ya29.` prefix and an undocumented body, a refresh token starts with `1//0`, an API key with `AIza`. Verification is one request each: a signed JWT to the token endpoint for a service account key, one tokeninfo call for an access token, one refresh for a refresh token that came with its client, one discovery call for an API key. Only OAuth tokens can be revoked by their holder, through Google's revoke endpoint, which takes the whole grant with them; a service account key and an API key are deleted by their owner in the Console.

Index

• Constants
• type Provider
  • func New() *Provider
  • func (p *Provider) DryRunRevoke(ctx context.Context, tok detect.Token) error
  • func (*Provider) Find(content []byte) []detect.Token
  • func (*Provider) Kinds() []detect.KindInfo
  • func (*Provider) LocalSources() detect.LocalSources
  • func (*Provider) Name() string
  • func (p *Provider) Revoke(ctx context.Context, tokens []detect.Token) error
  • func (p *Provider) Verify(ctx context.Context, tok detect.Token) detect.Verification

Constants

const (

	// AccessTokenEnv is the variable gcloud reads an access token from
	// instead of signing in.
	AccessTokenEnv = "CLOUDSDK_AUTH_ACCESS_TOKEN"
	// CredentialsFileEnv names the file every Google SDK reads its
	// credentials from: a service account key or the ADC of a user.
	CredentialsFileEnv = "GOOGLE_APPLICATION_CREDENTIALS"
)

const (
	// KindServiceAccountKey is the JSON key of a service account; its name
	// is `client_email/private_key_id`, the private key travels apart.
	KindServiceAccountKey detect.Kind = "gcp-service-account-key"
	// KindUserCredentials is the `authorized_user` JSON gcloud writes as
	// application default credentials: a refresh token with the OAuth
	// client it was issued to. Its name is the refresh token.
	KindUserCredentials detect.Kind = "gcp-oauth-user-credentials"
	// KindAccessToken is a bare OAuth 2.0 access token (ya29.).
	KindAccessToken detect.Kind = "gcp-oauth-access-token"
	// KindRefreshToken is a bare OAuth 2.0 refresh token (1//0) found
	// without the client it belongs to.
	KindRefreshToken detect.Kind = "gcp-oauth-refresh-token"
	// KindAPIKey is an API key (AIza).
	KindAPIKey detect.Kind = "gcp-api-key"
)

Types

type Provider

type Provider struct {
	// TokenURL is the OAuth 2.0 token endpoint, https://oauth2.googleapis.com/token
	// by default; a service account key that names its own token_uri is
	// verified against that instead.
	TokenURL string
	// TokenInfoURL reports what an access token is, https://oauth2.googleapis.com/tokeninfo.
	TokenInfoURL string
	// RevokeURL revokes an OAuth grant, https://oauth2.googleapis.com/revoke.
	RevokeURL string
	// DiscoveryURL lists the Google APIs and accepts an API key,
	// https://www.googleapis.com/discovery/v1/apis.
	DiscoveryURL string
	Client       *http.Client
	// contains filtered or unexported fields
}

Provider implements detect.Provider for Google Cloud.

func New

func New() *Provider

New returns a Provider against the public Google endpoints.

func (*Provider) DryRunRevoke

func (p *Provider) DryRunRevoke(ctx context.Context, tok detect.Token) error

DryRunRevoke implements detect.DryRunRevoker: the revoke endpoint has no rehearsal, so the token is checked the way Verify does, tokeninfo for an access token, and the answer says whether there is a grant to revoke.

func (*Provider) Find

func (*Provider) Find(content []byte) []detect.Token

Find implements detect.Provider: the credential documents first, found by their `type` field and parsed as JSON wherever they are embedded, then the bare token shapes. A refresh token that is the one an authorized_user document carries is that document's finding, not a bare token too.

func (*Provider) Kinds

func (*Provider) Kinds() []detect.KindInfo

Kinds implements detect.Provider. The OAuth families are revocable by whoever holds them; a service account key and an API key only by their owner.

func (*Provider) LocalSources

func (*Provider) LocalSources() detect.LocalSources

LocalSources implements detect.Provider: the file every SDK reads credentials from, gcloud's access token override, and the credential files gcloud writes after `gcloud auth login` and `gcloud auth application-default login`. gcloud also keeps tokens in a sqlite database, credentials.db, which is not opened.

func (*Provider) Name

func (*Provider) Name() string

Name implements detect.Provider.

func (*Provider) Revoke

func (p *Provider) Revoke(ctx context.Context, tokens []detect.Token) error

Revoke implements detect.Provider through Google's revoke endpoint, which accepts an access or a refresh token from whoever holds it and revokes the grant both belong to; no client secret is needed. A token Google already rejects counts as done, Verify confirms it afterwards. Service account keys and API keys are only deleted by their owner.

func (*Provider) Verify

func (p *Provider) Verify(ctx context.Context, tok detect.Token) detect.Verification

Verify implements detect.Provider with one request per credential: a signed assertion to the token endpoint for a service account key, one tokeninfo call for an access token, one refresh for a refresh token that came with its OAuth client, one discovery call for an API key. Only Google's explicit invalid-credential answers count as revoked.