Support audience

[aviramha]

When invoking Cloud Run endpoints, token needs to have audience of the endpoint url.

[djc]

I'm happy to review a PR for this. Would this be applicable across authentication methods, or only for custom service accounts? If the latter, see discussion in #92.

[djc]

#106 should provide a clear pattern for this if you're still interested.

[dacozai]

Hi @djc,
I’d love to give it a try, but I want to clarify one thing:
Q: Should I modify only the custom service account?
Since Cloud Run uses a service account as suggested, does that mean I should modify it in custom_service_account.rs?

Design Review

If so, based on what you suggested #106, I will modify below

pub struct CustomServiceAccount {
    ...
    audience: Option<String>,
}

impl CustomServiceAccount {
    ...
    /// Set the `Audience` to impersonate a user
    pub fn with_audience(mut self, audience: String) -> Self {
        self.audience = Some(audience);
        self
    }

    fn new(credentials: ServiceAccountKey, client: HttpClient) -> Result<Self, Error> {
        debug!(project = ?credentials.project_id, email = credentials.client_email, "found credentials");
        Ok(Self {
            ...
            audience: None,
        })
    }

    async fn fetch_token(&self, scopes: &[&str]) -> Result<Arc<Token>, Error> {
        let jwt =
            Claims::new(&self.credentials, scopes, self.subject.as_deref(), self.audience.as_deref()).to_jwt(&self.signer)?;
        ...
    }
}

impl<'a> Claims<'a> {
    pub(crate) fn new(key: &'a ServiceAccountKey, scopes: &[&str], sub: Option<&'a str>, aud: Option<&'a str>) -> Self {
        ...
        let aud = if let Some(aud_str) = aud {
            aud_str
        } else {
            &key.token_uri
        };
        Claims {
            iss: &key.client_email,
            aud,
            exp: iat + 3600 - 5, // Max validity is 1h
            iat,
            sub,
            scope,
        }
    }

    ...
}

[djc]

I think doing CustomServiceAccount only is probably a good start if it fulfills your use case. Happy to review your PR!