Re: [PR] feat(catalog): refresh oauth tokens [iceberg-go]

["rockwotj (via GitHub)" <gi...@apache.org>]

rockwotj commented on code in PR #793:
URL: https://github.com/apache/iceberg-go/pull/793#discussion_r2954965361


##########
catalog/rest/rest.go:
##########
@@ -490,19 +502,53 @@ func NewCatalog(ctx context.Context, name, uri string, opts ...Option) (*Catalog
 }
 
 // setupOAuthManager creates an Oauth2AuthManager based on the provided options.
-// The allows users to set their token, credential, or just get the defaults if no auth manager is set.
-func setupOAuthManager(r *Catalog, cl *http.Client, opts *options) *Oauth2AuthManager {
-	authURI := opts.authUri
-	if authURI == nil {
-		authURI = r.baseURI.JoinPath("oauth/tokens")
+// It uses golang.org/x/oauth2 for token management, caching, and thread-safe refresh.
+func setupOAuthManager(r *Catalog, cl *http.Client, opts *options) AuthManager {
+	// If a static token is provided, use it directly.
+	if opts.oauthToken != "" {
+		return &Oauth2AuthManager{
+			tokenSource: oauth2.StaticTokenSource(&oauth2.Token{
+				AccessToken: opts.oauthToken,
+				TokenType:   "Bearer",
+			}),
+		}
+	}
+
+	// If no credential, no auth needed.
+	if opts.credential == "" {
+		return nil
+	}
+
+	authURL := opts.authUri
+	if authURL == nil {
+		authURL = r.baseURI.JoinPath("oauth/tokens")
+	}
+
+	clientID, clientSecret, found := strings.Cut(opts.credential, ":")
+	if !found {
+		clientID = ""
+		clientSecret = opts.credential
+	}
+
+	cfg := &clientcredentials.Config{
+		ClientID:     clientID,
+		ClientSecret: clientSecret,
+		TokenURL:     authURL.String(),
+		AuthStyle:    oauth2.AuthStyleInParams,
 	}
 
+	scope := "catalog"
+	if opts.scope != "" {
+		scope = opts.scope
+	}
+	cfg.Scopes = []string{scope}

Review Comment:
   https://iceberg.apache.org/docs/nightly/configuration/?h=scope#oauth2-auth-properties
   <img width="686" height="56" alt="Screenshot 2026-03-18 at 12 07 56 PM" src="https://github.com/user-attachments/assets/84d1e309-6dfb-4afe-b4db-7796c1a4dce5" />
   



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org