feat(auth): add UniverseDomain to DetectOptions

auth/detect/compute.go

@@ -19,6 +19,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"net/http"
 	"net/url"
 	"strings"
 	"time"
@@ -82,4 +83,23 @@ func (cs computeProvider) Token(ctx context.Context) (*auth.Token, error) {
 		Metadata: computeTokenMetadata,
 	}, nil
 
+} // computeProvider fetches tokens from the google cloud metadata service.
+type computeUniverseDomainProvider struct {
+	// TODO(chridsmith): memoize universe domain (with mutex)
+}
+
+func (cudp computeUniverseDomainProvider) UniverseDomain(ctx context.Context) (string, error) {
+	var err error
+	c := metadata.NewClient(&http.Client{Timeout: time.Second})
+	// TODO(chridsmith): set ctx on request
+	ud, err := c.Get("universe/universe_domain")
+	if err == nil {
+		return ud, nil
+	}
+	if _, ok := err.(metadata.NotDefinedError); ok {
+		// http.StatusNotFound (404)
+		return defaultUniverseDomain, nil
+	} else {
+		return "", err
+	}
 }

auth/detect/detect.go

@@ -15,6 +15,7 @@
 package detect
 
 import (
+	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -54,11 +55,30 @@ type Credentials struct {
 	projectID      string
 	quotaProjectID string
 	// universeDomain is the default service domain for a given Cloud universe.
+	// The source may be from user configuration (Options.UniverseDomain) or
+	// from a credentials file. User configuration takes precedence. See
+	// fileCredentials. Not set from file in the case of compute (GCE),
+	// therefore udp (below) is typically used instead. Optional.
 	universeDomain string
+	// udp, if provided, can fetch a universe domain value if universeDomain
+	// (above) is blank, which is typically the case for compute (GCE)
+	// credentials. Optional.
+	udp universeDomainProvider
 
 	auth.TokenProvider
 }
 
+// universeDomainProvider fetches a universe domain value. Typically used with
+// compute (GCE) credentials. Think of it as a promise for resolving the
+// universe domain.
+type universeDomainProvider interface {
+	// UniverseDomain returns a universe domain or an error. It does not return
+	// an empty string. It may return the default value "googleapis.com".
+	// The context provided must be sent along to any requests that are made in
+	// the implementing code.
+	UniverseDomain(context.Context) (string, error)
+}
+
 func newCredentials(tokenProvider auth.TokenProvider, json []byte, projectID string, quotaProjectID string, universeDomain string) *Credentials {
 	return &Credentials{
 		json:           json,
@@ -96,6 +116,30 @@ func (c *Credentials) UniverseDomain() string {
 	return c.universeDomain
 }
 
+// ValidateUniverseDomain verifies TODO(chridsmith): doc
+func (c *Credentials) ValidateUniverseDomain(ctx context.Context, clientUniverseDomain string) error {
+	ud := defaultUniverseDomain
+	if c.universeDomain != "" {
+		ud = c.universeDomain
+	}
+	if c.udp != nil {
+		var err error
+		ud, err = c.udp.UniverseDomain(ctx)
+		if err != nil {
+			return err
+		}
+	}
+	if clientUniverseDomain != ud {
+		return fmt.Errorf(
+			"the configured universe domain (%q) does not match the universe "+
+				"domain found in the credentials (%q). If you haven't configured "+
+				"WithUniverseDomain explicitly, \"googleapis.com\" is the default",
+			clientUniverseDomain,
+			ud)
+	}
+	return nil
+}
+
 // OnGCE reports whether this process is running in Google Cloud.
 func OnGCE() bool {
 	// TODO(codyoss): once all libs use this auth lib move metadata check here
@@ -139,7 +183,9 @@ func DefaultCredentials(opts *Options) (*Credentials, error) {
 
 	if OnGCE() {
 		id, _ := metadata.ProjectID()
-		return newCredentials(computeTokenProvider(opts.EarlyTokenRefresh, opts.Scopes...), nil, id, "", opts.UniverseDomain), nil
+		creds := newCredentials(computeTokenProvider(opts.EarlyTokenRefresh, opts.Scopes...), nil, id, "", opts.UniverseDomain)
+		creds.udp = &computeUniverseDomainProvider{}
+		return creds, nil
 	}
 
 	return nil, fmt.Errorf("detect: could not find default credentials. See %v for more information", adcSetupURL)

auth/grpctransport/directpath.go

@@ -22,6 +22,7 @@ import (
 	"strings"
 
 	"cloud.google.com/go/auth"
+	"cloud.google.com/go/auth/detect"
 	"cloud.google.com/go/compute/metadata"
 	"google.golang.org/grpc"
 	grpcgoogle "google.golang.org/grpc/credentials/google"
@@ -90,11 +91,11 @@ func isDirectPathXdsUsed(o *Options) bool {
 // configureDirectPath returns some dial options and an endpoint to use if the
 // configuration allows the use of direct path. If it does not the provided
 // grpcOpts and endpoint are returned.
-func configureDirectPath(grpcOpts []grpc.DialOption, opts *Options, endpoint string, creds auth.TokenProvider) ([]grpc.DialOption, string) {
+func configureDirectPath(grpcOpts []grpc.DialOption, opts *Options, endpoint string, creds *detect.Credentials) ([]grpc.DialOption, string) {
 	if isDirectPathEnabled(endpoint, opts) && metadata.OnGCE() && isTokenProviderDirectPathCompatible(creds, opts) {
 		// Overwrite all of the previously specific DialOptions, DirectPath uses its own set of credentials and certificates.
 		grpcOpts = []grpc.DialOption{
-			grpc.WithCredentialsBundle(grpcgoogle.NewDefaultCredentialsWithOptions(grpcgoogle.DefaultCredentialsOptions{PerRPCCreds: &grpcTokenProvider{TokenProvider: creds}}))}
+			grpc.WithCredentialsBundle(grpcgoogle.NewDefaultCredentialsWithOptions(grpcgoogle.DefaultCredentialsOptions{PerRPCCreds: &grpcTokenProvider{creds: creds}}))}
 		if timeoutDialerOption != nil {
 			grpcOpts = append(grpcOpts, timeoutDialerOption)
 		}

auth/grpctransport/grpctransport.go

@@ -71,6 +71,10 @@ type Options struct {
 	// DetectOpts configures settings for detect Application Default
 	// Credentials.
 	DetectOpts *detect.Options
+	// UniverseDomain is the default service domain for a given Cloud universe.
+	// The default value is "googleapis.com". This is the universe domain
+	// provided via client options.
+	UniverseDomain string
 
 	// InternalOptions are NOT meant to be set directly by consumers of this
 	// package, they should only be set by generated client code.
@@ -204,9 +208,8 @@ func dial(ctx context.Context, secure bool, opts *Options) (*grpc.ClientConn, er
 		if err != nil {
 			return nil, err
 		}
-		var tp auth.TokenProvider = creds
 		if opts.TokenProvider != nil {
-			tp = opts.TokenProvider
+			creds.TokenProvider = opts.TokenProvider // TODO(chrisdsmith): Is this OK? Are creds non-nil and suitable for WithTokenProvider? Or is new Credentials needed?
 		}
 
 		qp := creds.QuotaProjectID()
@@ -219,8 +222,9 @@ func dial(ctx context.Context, secure bool, opts *Options) (*grpc.ClientConn, er
 
 		grpcOpts = append(grpcOpts,
 			grpc.WithPerRPCCredentials(&grpcTokenProvider{
-				TokenProvider: tp,
-				metadata:      metadata,
+				creds:                creds,
+				metadata:             metadata,
+				clientUniverseDomain: opts.UniverseDomain,
 			}),
 		)
 
@@ -239,16 +243,20 @@ func dial(ctx context.Context, secure bool, opts *Options) (*grpc.ClientConn, er
 
 // grpcTokenProvider satisfies https://pkg.go.dev/google.golang.org/grpc/credentials#PerRPCCredentials.
 type grpcTokenProvider struct {
-	auth.TokenProvider
+	creds *detect.Credentials // TODO(chrisdsmith): convert usages of TokenProvider to creds
 
 	secure bool
 
 	// Additional metadata attached as headers.
-	metadata map[string]string
+	metadata             map[string]string
+	clientUniverseDomain string
 }
 
 func (tp *grpcTokenProvider) GetRequestMetadata(ctx context.Context, uri ...string) (map[string]string, error) {
-	token, err := tp.Token(ctx)
+	if err := tp.creds.ValidateUniverseDomain(ctx, tp.clientUniverseDomain); err != nil {
+		return nil, err
+	}
+	token, err := tp.creds.Token(ctx)
 	if err != nil {
 		return nil, err
 	}

auth/httptransport/httptransport.go

@@ -59,6 +59,10 @@ type Options struct {
 	// DetectOpts configures settings for detect Application Default
 	// Credentials.
 	DetectOpts *detect.Options
+	// UniverseDomain is the default service domain for a given Cloud universe.
+	// The default value is "googleapis.com". This is the universe domain
+	// provided via client options.
+	UniverseDomain string
 
 	// InternalOptions are NOT meant to be set directly by consumers of this
 	// package, they should only be set by generated client code.
@@ -140,7 +144,7 @@ func AddAuthorizationMiddleware(client *http.Client, tp auth.TokenProvider) erro
 		base = http.DefaultTransport.(*http.Transport).Clone()
 	}
 	client.Transport = &authTransport{
-		provider: auth.NewCachedTokenProvider(tp, nil),
+		creds: auth.NewCachedTokenProvider(tp, nil),
 		base:     base,
 	}
 	return nil

auth/httptransport/transport.go

@@ -69,13 +69,14 @@ func newTransport(base http.RoundTripper, opts *Options) (http.RoundTripper, err
 			headers.Set(quotaProjectHeaderKey, qp)
 		}
 
-		var tp auth.TokenProvider = creds
 		if opts.TokenProvider != nil {
-			tp = opts.TokenProvider
+			creds.TokenProvider = opts.TokenProvider
 		}
+		creds.TokenProvider = auth.NewCachedTokenProvider(creds.TokenProvider, nil)
 		trans = &authTransport{
-			base:     trans,
-			provider: auth.NewCachedTokenProvider(tp, nil),
+			base:                 trans,
+			creds:                creds,
+			clientUniverseDomain: opts.UniverseDomain,
 		}
 	}
 	return trans, nil
@@ -159,8 +160,9 @@ func addOCTransport(trans http.RoundTripper, opts *Options) http.RoundTripper {
 }
 
 type authTransport struct {
-	provider auth.TokenProvider
-	base     http.RoundTripper
+	creds                *detect.Credentials // TODO(chrisdsmith): convert usages of TokenProvider to creds
+	base                 http.RoundTripper
+	clientUniverseDomain string
 }
 
 // RoundTrip authorizes and authenticates the request with an
@@ -176,7 +178,10 @@ func (t *authTransport) RoundTrip(req *http.Request) (*http.Response, error) {
 			}
 		}()
 	}
-	token, err := t.provider.Token(req.Context())
+	if err := t.creds.ValidateUniverseDomain(req.Context(), t.clientUniverseDomain); err != nil {
+		return nil, err
+	}
+	token, err := t.creds.Token(req.Context())
 	if err != nil {
 		return nil, err
 	}