Add TokenProvider.auto for ADC-style provider selection - #24
Merged
Conversation
Pull the refresh-token exchange + JWT-decode principal lookup out of `userIdentity(httpClient)` into a new public `userIdentity(clientId, clientSecret, refreshToken, httpClient)` overload, mirroring the existing `userAccount` shape. The single-arg variant now just dispatches via the ADC `CredentialsFile` AST and delegates to the triple-overload, keeping the parsing path in one place.
Three overloads picking the right factory using Google's standard "Application Default Credentials" precedence: - `auto(client)` and `auto(scopes, client)` resolve access-token providers — service-account JSON or authorized-user JSON when an ADC file is present (auto-detected from contents), or the GCE metadata server's workload identity when no file is configured. - `auto(client, audience)` resolves identity-token providers, dispatching `userIdentity` vs `identity(client, audience)` by ADC file presence. Uses `Parser.onDefaultCredentialsFile` for the dispatch and reuses the `UnableToGetClientData` failure mode to distinguish SA from authorized-user JSON without a separate parse pass.
github-actions
Bot
added
🚀 feature
When `GCP_AUTH_DISABLE=true` (env var) or `gcp.auth.disable=true` (JVM system property) is set, every `TokenProvider.auto` overload short-circuits to `TokenProvider.const(AccessToken.noop)` — no filesystem reads, no metadata-server probes. Intended for acceptance tests that need to silence credential resolution without plumbing a separate `TokenType` through the application config. A stray production setting will silently produce a no-op provider instead of a loud "credentials not found" error. The Scaladoc and README call out this trade-off and recommend `gcp-auth-pureconfig`'s `TokenType.NoOp` as the safer alternative when the configuration channel can be controlled per environment.
Oliver-Taylor
approved these changes
Jun 1, 2026
Oliver-Taylor
left a comment
Oliver-Taylor
left a comment
There was a problem hiding this comment.
Nice! This should make configuration most simpler
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
💻 How to review this PR?
This PR was created with the idea of being reviewed commit by commit. Each commit contains an incremental change that makes it easier to review. Also some of the commits contain additional information in their description to help understand why the change was made.
I also recommend checking "Hide whitespace" when reviewing this PR!
🚀 What's included in this PR?
Adds
TokenProvider.auto— picks the right token provider using Google's standard ADC precedence, dispatching on the credentials file's"type"field:service_accountJSON →serviceAccount(email, key, scopes, httpClient)authorized_userJSON →userAccount(clientId, clientSecret, refreshToken, httpClient)serviceAccount(httpClient)for access tokens,identity(httpClient, audience)for identity tokens)"type"→ raisesUnsupportedCredentialsType(e.g.external_account,impersonated_service_account,gdch_service_account).Useful when the same binary runs locally (user account), in CI (service-account JSON via
GOOGLE_APPLICATION_CREDENTIALS), and in production (workload identity on GCE/GKE).Also includes:
userIdentity(clientId, clientSecret, refreshToken, httpClient)overload mirroring the existinguserAccounttriple-overload — extracted so the principal-resolution / token-fetch logic lives in one place.TokenProvider.autooverloads that allocate a defaultJdkHttpClientinternally and return aResource[F, TokenProvider[F]].