auth: expose AccessToken expiration

オープン
  • 何か問題がありますか？
#7,410 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
48/100
issue の種類
機能追加
明瞭さ
おおむね明確
活発さ
活発
技術スタック
rust
領域
authentication, backend-api-design

調査の方向性

Start by reading src/auth/src/token.rs and src/auth/src/credentials.rs, especially the token expiry tracking and conversion linked in the issue. Review #7391 and the semver concern described here to understand the proposed API shape. Done means callers can obtain the token and its optional expiration without adding a breaking field to AccessToken; add or update focused auth tests for known and unknown expirations.

索引モデルが issue の本文から書いたものです。

説明

auth priority: p3 type: feature request

Is your feature request related to a problem? Please describe.
I have a short-lived CLI that needs an access token on every run. It keeps the token in a private file between runs (much like gcloud's own token cache), so it needs to know when the token expires.

AccessToken only exposes token. The SDK tracks the expiry internally but drops it in the conversion, so the CLI can't get the lifetime from the SDK. Today it gets tokens from gcloud auth print-access-token and looks up the lifetime with the tokeninfo endpoint after each fetch.

Describe the solution you'd like
A way to get the expiration along with the token, or None when it isn't known. This was part of the original sketch in #2929, and #7391 implements it as a field. An Instant is fine for my use; I'd convert it to wall-clock time when saving.

One semver note: AccessToken has only public fields and isn't #[non_exhaustive], so adding any field, even a private one behind an accessor, breaks struct-literal construction (for example in mocks of AccessTokenCredentialsProvider). cargo-semver-checks reports that as major (constructible_struct_adds_private_field). A new method that returns a #[non_exhaustive] type with the token and its expiry would leave AccessToken unchanged.

The other Google auth libraries already expose this:

Describe alternatives you've considered

  • Looking up tokeninfo after each fetch (current workaround): an extra request per token.
  • Assuming a one-hour lifetime: unsafe, since lifetimes vary by credential type.
  • Fetching a fresh token in every process: works, but adds a token request to every run.

Additional context
On #7391 there was a question of whether this needs to be exposed at all. This is a case where the SDK's in-process cache can't help: the process exits before the token could be reused.

主要言語
Rust
スター
972
フォーク
163
平均マージ
1日 13時間
マージ済み PR（30日）
202

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

googleapis/google-cloud-rust のほかの issue

googleapis/google-cloud-rust の issue をすべて見る

似ている issue

Rust の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。