CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

credential broker: Play tokens from POST /api/google/token (cached, single flight, local key fallback), grants and APIs per package in validate, Play write preflight, apps check and the desktop Accounts view; Google 403 names the API or grant, no retry

Browse source
This commit is contained in:
CRTkafa 2026-10-25 22:50:52 +07:00
parent 304407e523
commit 2c5e30090f
27 changed files with 1145 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

9
cli/api/client.ts
View file

@ -354,13 +354,12 @@ export async function authFor(store: Store, root: string): Promise<Auth> {
const { jwt } = ascJwt(root);
return () => 'Bearer ' + jwt();
}
const { playServiceAccount } = await import('../lib/credentials');
const { tokenSource } = await import('../lib/google-auth');
const sa = playServiceAccount(root);
const sources = new Map<string, () => Promise<string>>();
const { PLAY_SCOPE, playToken } = await import('../lib/google-auth');
// the credential broker when it has the scope, else the local key; throws now when neither is there
const sources = new Map<string, () => Promise<string>>([[PLAY_SCOPE, playToken(root, PLAY_SCOPE)]]);
return async req => {
const scope = PLAY_APIS[req.op.api as keyof typeof PLAY_APIS].scope;
if (!sources.has(scope)) sources.set(scope, tokenSource(sa, scope));
if (!sources.has(scope)) sources.set(scope, playToken(root, scope));
return 'Bearer ' + (await sources.get(scope)!());
};
}