auth: expose AccessToken expiration

Aperta
  • Qualcosa non va?
#7,410 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
48/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
rust
Ambito
authentication, backend-api-design

Direzione di ricerca

Start by reading src/auth/src/token.rs and src/auth/src/credentials.rs, especially the token expiry tracking and conversion linked in the issue. Review #7391 and the semver concern described here to understand the proposed API shape. Done means callers can obtain the token and its optional expiration without adding a breaking field to AccessToken; add or update focused auth tests for known and unknown expirations.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

auth priority: p3 type: feature request

Is your feature request related to a problem? Please describe.
I have a short-lived CLI that needs an access token on every run. It keeps the token in a private file between runs (much like gcloud's own token cache), so it needs to know when the token expires.

AccessToken only exposes token. The SDK tracks the expiry internally but drops it in the conversion, so the CLI can't get the lifetime from the SDK. Today it gets tokens from gcloud auth print-access-token and looks up the lifetime with the tokeninfo endpoint after each fetch.

Describe the solution you'd like
A way to get the expiration along with the token, or None when it isn't known. This was part of the original sketch in #2929, and #7391 implements it as a field. An Instant is fine for my use; I'd convert it to wall-clock time when saving.

One semver note: AccessToken has only public fields and isn't #[non_exhaustive], so adding any field, even a private one behind an accessor, breaks struct-literal construction (for example in mocks of AccessTokenCredentialsProvider). cargo-semver-checks reports that as major (constructible_struct_adds_private_field). A new method that returns a #[non_exhaustive] type with the token and its expiry would leave AccessToken unchanged.

The other Google auth libraries already expose this:

Describe alternatives you've considered

  • Looking up tokeninfo after each fetch (current workaround): an extra request per token.
  • Assuming a one-hour lifetime: unsafe, since lifetimes vary by credential type.
  • Fetching a fresh token in every process: works, but adds a token request to every run.

Additional context
On #7391 there was a question of whether this needs to be exposed at all. This is a case where the SDK's in-process cache can't help: the process exits before the token could be reused.

Lingua principale
Rust
Stelle
972
Fork
163
Merge medio
1g 13h
PR unite (30g)
202

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di googleapis/google-cloud-rust

Tutte le issue di googleapis/google-cloud-rust

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.