—

              
package WWW::Google::Cloud::Auth::ServiceAccount;
use Moose;
use MooseX::HasDefaults::RO;
use MooseX::StrictConstructor;
use namespace::autoclean;
use Carp;
use JSON;
use LWP::UserAgent;
use Crypt::JWT qw(encode_jwt);
our $VERSION = '1.000002';
has credentials_path => (
    isa      => 'Str',
    required => 1,
);
has auth_url => (
    isa => 'Str',
    default => 'https://www.googleapis.com/oauth2/v4/token',
);
has grant_type => (
    isa     => 'Str',
    default => 'urn:ietf:params:oauth:grant-type:jwt-bearer',
);
has scope => (
    isa     => 'Str',
    default =>  'https://www.googleapis.com/auth/cloud-platform',
);
# so that the token doesn't expire after checking it but before the request
# is processed on the other side.
has token_expiry_shift => (
    isa      => 'Str',
    required => 0,
    default  => 10,
);
has clock => (
    isa     => 'CodeRef',
    default => sub {sub {time}}
);
has ua_string => (
    isa     => 'Str',
    default => "WWW-Google-Cloud-Auth/$VERSION",
);
has _token => (
    is       => 'rw',
    isa      => 'Maybe[Str]',
    default  => undef,
    init_arg => undef,
);
has _token_expiry => (
    is       => 'rw',
    isa      => 'Int',
    default  => 0,
    init_arg => undef,
);
has _ua => (
    isa      => 'LWP::UserAgent',
    builder  => '_build_ua',
    lazy     => 1,
    init_arg => undef,
);
sub _build_ua {
    my $self = shift;
    my $ua = LWP::UserAgent->new(
        agent => $self->ua_string,
    );
    return $ua;
}
sub _generate_jwt {
    my $self = shift;
    open (my $fh, '<', $self->credentials_path) or die("Can't open credentials file: $!");
    my $creds_json = do {local $/; <$fh>};
    my $creds      = JSON::decode_json($creds_json);
    my $payload = {
        iss => $creds->{client_email},
        scope => $self->scope,
        aud => 'https://www.googleapis.com/oauth2/v4/token',
        exp => $self->clock->() + 600,
        iat => $self->clock->(),
    };
    my $key = $creds->{private_key};
    return encode_jwt(alg => 'RS256', payload => $payload, key => \$key);
}
sub get_token {
    my $self = shift;
    return $self->_token if($self->_token && $self->clock->() < $self->_token_expiry);
    my $jwt = $self->_generate_jwt();
    my $response = $self->_ua->post(
        $self->auth_url,
        {
            grant_type => $self->grant_type,
            assertion  => $jwt,
        }
    );
    if ($response->is_success) {
        my $r = decode_json($response->decoded_content);
        $self->_token($r->{access_token});
        $self->_token_expiry($self->clock->() + $r->{expires_in} - $self->token_expiry_shift);
        return $self->_token;
    } else {
        my @err = ($response->code, $response->message, $response->decoded_content);
        croak "@err";
    }
}
__PACKAGE__->meta->make_immutable;
1;
HideShow 95 lines of Pod
=pod
=encoding utf8
=head1 NAME
WWW::Google::Cloud::Auth::ServiceAccount - Service account based OAuth authentication for Google Cloud APIs
=head1 SYNOPSIS
    my $auth = WWW::Google::Cloud::Auth::ServiceAccount>new(
        credentials_path => '/home/myapp/priv/google_some_service.json',
    );
    my $response = $ua->post(
                 $some_google_cloud_api_endpoint,
                'Content-Type' => 'application/json; charset=utf-8',
                'Authorization' => 'Bearer ' . $auth->get_token,
                 Content => $arguments,
        );
=head1 DESCRIPTION
This is a library for service account based OAuth authentication with Google Cloud API endpoints for server to server applications.
See: L<https://developers.google.com/identity/protocols/OAuth2ServiceAccount>
=head1 FUNCTIONS
=head2 WWW::Google::Cloud::Auth::ServiceAccount->new(credentials_path => $credentials_path);
Instantiate a new WWW::Google::Cloud::Auth::ServiceAccount object.
Arguments:
=over 4
=item
credentials path [required]
The path to the JSON-encoded credentials file provided by Google.
=item
auth_url [optional]
The URL to get the OAuth token from. Defaults to https://www.googleapis.com/oauth2/v4/token. You probably don't need to change this.
=back
Returns:
=over 4
A new WWW::Google::Cloud::Auth::ServiceAccount instance.
=back
=head2 $auth->get_token()
Get a valid token to use for authorization. If there is a valid cached token return that.
Arguments:
=over 4
None
=back
Returns:
=over 4
The OAuth token
=back
=head1 AUTHOR
This module is written by Larion Garaczi <larion@cpan.org> (2019)
=head1 SOURCE CODE
The source code for this module is hosted on GitHub L<https://github.com/larion/www-google-cloud-auth-serviceaccount>.
Feel free to contribute :)
=head1 LICENSE AND COPYRIGHT
This module is free software and is published under the same
terms as Perl itself.
=cut