google: add some metadata to GCE tokens to identify the token's source

This is required for the direct path feature, which only works with this token source. It's not currently possible to determine the token source type from the return value of FindDefaultCredentials. Another option is to add another field to the Credentials struct, which we could still do later, but direct path is currently pretty experimental and whitelisted/opt-in, so I don't want to add to the public API surface unnecessarily. This CL functionally blocks https://code-review.googlesource.com/c/google-api-go-client/+/40950 Change-Id: Ifb5fe9c6e5c6b33eebb87b45d3c70eebfca691b3 Reviewed-on: https://go-review.googlesource.com/c/oauth2/+/175877 Reviewed-by: Chris Broadfoot <cbro@golang.org>

Author: broady

google/google.go

@@ -194,9 +194,16 @@ func (cs computeSource) Token() (*oauth2.Token, error) {
 if res.ExpiresInSec == 0 || res.AccessToken == "" {
 return nil, fmt.Errorf("oauth2/google: incomplete token received from metadata")
 }
-return &oauth2.Token{
+tok := &oauth2.Token{
 AccessToken: res.AccessToken,
 TokenType: res.TokenType,
 Expiry: time.Now().Add(time.Duration(res.ExpiresInSec) * time.Second),
-}, nil
+}
+// NOTE(cbro): add hidden metadata about where the token is from.
+// This is needed for detection by client libraries to know that credentials come from the metadata server.
+// This may be removed in a future version of this library.
+return tok.WithExtra(map[string]interface{}{
+"oauth2.google.tokenSource": "compute-metadata",
+"oauth2.google.serviceAccount": acct,
+}), nil
 }