feat: Support scopes from impersonated JSON (#2170)

Author: sai-sunder-s

src/auth/credentials.ts

@@ -84,6 +84,7 @@ export interface ImpersonatedJWTInput {
  source_credentials?: JWTInput;
  service_account_impersonation_url?: string;
  delegates?: string[];
+ scopes?: string[];
 }
 
 export interface CredentialBody {

src/auth/googleauth.ts

@@ -710,7 +710,8 @@ export class GoogleAuth<T extends AuthClient = AuthClient> {
  );
  }
 
- const targetScopes = this.getAnyScopes() ?? [];
+ const targetScopes =
+ (this.scopes || json.scopes || this.defaultScopes) ?? [];
 
  return new Impersonated({
  ...json,

test/fixtures/impersonated-with-scopes.json

@@ -0,0 +1,13 @@
+{
+ "type": "impersonated_service_account",
+ "source_credentials": {
+ "client_id": "oauth_client_id",
+ "client_secret": "oauth_client_secret",
+ "refresh_token": "user_refresh_token",
+ "type": "authorized_user"
+ },
+ "service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/service-account-email@project-name.iam.gserviceaccount.com:generateAccessToken",
+ "scopes": [
+ "https://www.googleapis.com/auth/drive"
+ ]
+}

test/test.googleauth.ts

@@ -2693,6 +2693,96 @@ describe('googleauth', () => {
  });
  });
 
+ describe('for impersonated_account types', () => {
+ const userScopes = ['https://www.googleapis.com/auth/user.scope'];
+ const defaultScopes = ['https://www.googleapis.com/auth/default.scope'];
+ const jsonScopes = ['https://www.googleapis.com/auth/drive'];
+
+ function mockGenerateAccessToken(
+ expectedScopes: string[],
+ serviceAccountEmail = 'service-account-email@project-name.iam.gserviceaccount.com',
+ ) {
+ nock('https://oauth2.googleapis.com').post('/token').reply(200, {
+ access_token: 'source-token',
+ });
+ const scope = nock('https://iamcredentials.googleapis.com')
+ .post(
+ `/v1/projects/-/serviceAccounts/${serviceAccountEmail}:generateAccessToken`,
+ (body: {scope: string[]}) => {
+ assert.deepStrictEqual(body.scope, expectedScopes);
+ return true;
+ },
+ )
+ .reply(200, {
+ accessToken: 'impersonated-token',
+ expireTime: new Date(Date.now() + 3600 * 1000).toISOString(),
+ });
+ return scope;
+ }
+
+ it('should load scopes from the JSON file', async () => {
+ const scope = mockGenerateAccessToken(jsonScopes);
+ const auth = new GoogleAuth({
+ keyFilename: './test/fixtures/impersonated-with-scopes.json',
+ });
+ const client = (await auth.getClient()) as Impersonated;
+ await client.getRequestHeaders();
+ scope.done();
+ });
+
+ it('should prefer user scopes over JSON scopes', async () => {
+ const scope = mockGenerateAccessToken(userScopes);
+ const auth = new GoogleAuth({
+ keyFilename: './test/fixtures/impersonated-with-scopes.json',
+ scopes: userScopes,
+ });
+ const client = (await auth.getClient()) as Impersonated;
+ await client.getRequestHeaders();
+ scope.done();
+ });
+
+ it('should prefer JSON scopes over default scopes', async () => {
+ const scope = mockGenerateAccessToken(jsonScopes);
+ const auth = new GoogleAuth({
+ keyFilename: './test/fixtures/impersonated-with-scopes.json',
+ });
+ auth.defaultScopes = defaultScopes;
+ const client = (await auth.getClient()) as Impersonated;
+ await client.getRequestHeaders();
+ scope.done();
+ });
+
+ it('should use user scopes when JSON has no scopes', async () => {
+ const scope = mockGenerateAccessToken(
+ userScopes,
+ 'target@project.iam.gserviceaccount.com',
+ );
+ const auth = new GoogleAuth({
+ keyFilename:
+ './test/fixtures/impersonated_application_default_credentials.json',
+ scopes: userScopes,
+ });
+ const client = (await auth.getClient()) as Impersonated;
+ await client.getRequestHeaders();
+ scope.done();
+ });
+
+ it('should fall back to default scopes when no other scopes are present', async () => {
+ const scope = mockGenerateAccessToken(
+ defaultScopes,
+ 'target@project.iam.gserviceaccount.com',
+ );
+ const auth = new GoogleAuth({
+ keyFilename:
+ './test/fixtures/impersonated_application_default_credentials.json',
+ });
+ auth.defaultScopes = defaultScopes;
+ const client = (await auth.getClient()) as Impersonated;
+ await client.getRequestHeaders();
+ scope.done();
+ });
+ });
+
  describe('for external_account_authorized_user types', () => {
  /**
  * @return A copy of the external account authorized user JSON auth object