impl(oauth2): add GDCH service account credentials#16126
Conversation
There was a problem hiding this comment.
Code Review
This pull request introduces GDCH (Google Distributed Cloud Hosted) service account credentials for REST clients, including parsing JSON key files, creating self-signed JWT assertions, and exchanging them for access tokens. It also updates the OpenSSL signing utility to support raw ECDSA signatures (RFC-7515) alongside the default DER format. The review feedback highlights several important robustness and safety improvements: validating that the parsed token JSON is an object with correct field types to prevent runtime exceptions, adding a separator to a concatenated error message, binding a temporary string to a local variable to avoid fragile lifetime issues with absl::Span, and removing a redundant namespace prefix for consistency.
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #16126 +/- ##
========================================
Coverage 92.71% 92.71%
========================================
Files 2353 2356 +3
Lines 219451 219858 +407
========================================
+ Hits 203461 203845 +384
- Misses 15990 16013 +23 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
This PR adds a new credential type for supporting Google Cloud Distributed Hosting (GDCH) service accounts. More detailed information describing this workflow can be found at: https://docs.cloud.google.com/distributed-cloud/hosted/docs/latest/gdcag/platform/pa-user/service-identity