[I] feat(google): support trusted custom OAuth token endpoints [reqsign]

["Xuanwo (via GitHub)" <gi...@apache.org>]

Xuanwo opened a new issue, #897:
URL: https://github.com/apache/reqsign/issues/897

   ## Goal
   
   Allow a caller-selected, trusted OAuth token endpoint for both service-account JWT exchanges and authorized-user refresh-token exchanges.
   
   Lance's existing credential inputs accept `token_uri`, falling back to `https://oauth2.googleapis.com/token`. Its custom-endpoint tests exercise both flows. Migrating these paths currently requires retaining OAuth request code because reqsign cannot represent that endpoint selection.
   
   ## Current behavior
   
   Confirmed in v0.20.7 and current main:
   
   - [`ServiceAccountTokenCredentialProvider`](https://github.com/apache/reqsign/blob/d53cc934c78c770dc894ba0a5087ad0d3693f339/services/google/src/provide_credential/service_account_token.rs) hardcodes both the request URL and JWT `aud` to the canonical token endpoint.
   - [`AuthorizedUserCredentialProvider`](https://github.com/apache/reqsign/blob/d53cc934c78c770dc894ba0a5087ad0d3693f339/services/google/src/provide_credential/authorized_user.rs) hardcodes the refresh request URL.
   - Parsed [`ServiceAccount` and `OAuth2Credentials`](https://github.com/apache/reqsign/blob/d53cc934c78c770dc894ba0a5087ad0d3693f339/services/google/src/credential.rs) do not retain `token_uri`, and neither provider exposes an endpoint override.
   
   This is a follow-up to #859, not another request for a service-account token provider.
   
   ## Requested behavior
   
   - Provide an explicit endpoint configuration path for both providers, retaining the canonical default.
   - Define how trusted credential-file `token_uri` is retained/selected, or how an adapter can pass it explicitly without implementing OAuth itself. Document precedence if both mechanisms exist.
   - For the service-account flow, use the selected token URI consistently for the HTTP request and JWT audience. Merely rewriting the HTTP URL in `HttpSend` does not preserve that contract.
   - Preserve the provider's scope, signer identity, token expiration, and refresh behavior.
   - Validate endpoint inputs and document the trust boundary: these requests carry a signed assertion or refresh token/client secret. Do not add implicit endpoint discovery or silently fall back to another endpoint after failure.
   
   The adapter may own trusted input selection; reqsign should own JWT construction, OAuth request encoding, and token response parsing. This does not require a generic endpoint-override framework across every service.
   
   ## Acceptance tests
   
   Use synthetic credentials and mock HTTP to verify canonical defaults, explicit custom endpoints for both flows, configured-URI JWT audience, credential-file/configuration precedence, malformed endpoints, and redacted failures. Demonstrate that a custom-endpoint source token can still be composed with the existing granting APIs without caller-side OAuth protocol code.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@reqsign.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@reqsign.apache.org
For additional commands, e-mail: commits-help@reqsign.apache.org

Re: [I] feat(google): support trusted custom OAuth token endpoints [reqsign]

["Xuanwo (via GitHub)" <gi...@apache.org>]

Xuanwo closed issue #897: feat(google): support trusted custom OAuth token endpoints
URL: https://github.com/apache/reqsign/issues/897


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@reqsign.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@reqsign.apache.org
For additional commands, e-mail: commits-help@reqsign.apache.org