auth: expose AccessToken expiration

Abierto
  • ¿Algo no está bien?
#7,410 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
48/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
rust
Área
authentication, backend-api-design

Línea de trabajo

Start by reading src/auth/src/token.rs and src/auth/src/credentials.rs, especially the token expiry tracking and conversion linked in the issue. Review #7391 and the semver concern described here to understand the proposed API shape. Done means callers can obtain the token and its optional expiration without adding a breaking field to AccessToken; add or update focused auth tests for known and unknown expirations.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

auth priority: p3 type: feature request

Is your feature request related to a problem? Please describe.
I have a short-lived CLI that needs an access token on every run. It keeps the token in a private file between runs (much like gcloud's own token cache), so it needs to know when the token expires.

AccessToken only exposes token. The SDK tracks the expiry internally but drops it in the conversion, so the CLI can't get the lifetime from the SDK. Today it gets tokens from gcloud auth print-access-token and looks up the lifetime with the tokeninfo endpoint after each fetch.

Describe the solution you'd like
A way to get the expiration along with the token, or None when it isn't known. This was part of the original sketch in #2929, and #7391 implements it as a field. An Instant is fine for my use; I'd convert it to wall-clock time when saving.

One semver note: AccessToken has only public fields and isn't #[non_exhaustive], so adding any field, even a private one behind an accessor, breaks struct-literal construction (for example in mocks of AccessTokenCredentialsProvider). cargo-semver-checks reports that as major (constructible_struct_adds_private_field). A new method that returns a #[non_exhaustive] type with the token and its expiry would leave AccessToken unchanged.

The other Google auth libraries already expose this:

Describe alternatives you've considered

  • Looking up tokeninfo after each fetch (current workaround): an extra request per token.
  • Assuming a one-hour lifetime: unsafe, since lifetimes vary by credential type.
  • Fetching a fresh token in every process: works, but adds a token request to every run.

Additional context
On #7391 there was a question of whether this needs to be exposed at all. This is a case where the SDK's in-process cache can't help: the process exits before the token could be reused.

Lenguaje dominante
Rust
Estrellas
972
Forks
163
Merge medio
1 d 13 h
PR fusionados (30 d)
202

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de googleapis/google-cloud-rust

Todos los issues de googleapis/google-cloud-rust

Issues similares

Más issues de Rust

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.