googleauth-extras 0.4.0 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 29ad90b986d4915e183e4592f58eedff84badd6ee70900337981d3173f0c64b2
-  data.tar.gz: 0c69256ea700526a9891d9434338954fec778d99b6f3c927654739dd690f03dd
+  metadata.gz: 29022ef0b3431bad2d9e5833e3af8a5333307a60610b176d92e571d5aee59aeb
+  data.tar.gz: ce7ee1a8121b2b6781879bef17908190575fb3f3d0ce7e7eda8023d3a29a3463
 SHA512:
-  metadata.gz: 9b3de1122f1a208f337134b30023fef63eb171c5ad3c888a8cc0cb81bc72aa5ae0d476f1c22ff659d4ce4637795ffff5ae1a5e07eee64dd68f9a5f887e9f02bb
-  data.tar.gz: 7eb79ba62b30a7b7a5cc2bab1d00f1079d19f57fd99df98ad52fec2d46d5e77eae781ddb50960c1832e77462e6b2e9d4c729e860db25610b2014432df6505f0d
+  metadata.gz: 3cc8272a821cd99f51d2cc4de7f9979c42078aad8ddcaeafbec4523987aeebacd77947c86758851b6e1cfb18b13c6393cdffefe27dd629ae7c587c993f22e8cb
+  data.tar.gz: 3c6a26d85df2064d473f8ec8847f638a669ece26aeff38d7ad6f5ee918b5746da7882afd3331f3bb4686cafc88c3b2d5f38742008caa3df7c40992b9cc133b20

data/.github/workflows/ci.yml

@@ -14,10 +14,10 @@ jobs:
       fail-fast: false
       matrix:
         ruby:
-          - '2.7'
-          - '3.0'
           - '3.1'
           - '3.2'
+          - '3.3'
+          - '3.4'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3

data/.rubocop.yml

@@ -25,6 +25,9 @@ Metrics/CyclomaticComplexity:
 Metrics/MethodLength:
   Max: 30
 
+Metrics/ModuleLength:
+  Max: 125
+
 Metrics/ParameterLists:
   Enabled: false
 

data/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Release History
 
+0.6.0
+----------
+
+- Support setting the universe domain (defaults to googleapis.com) so gRPC google-cloud clients don't raise Gapic::UniverseDomainMismatch.
+- drop `addressable` as a transitive dependency, replace with stdlib `uri`.
+- drop `faraday` as a transitive dependency, replace with stdlib `net-http`.
+- Bump minimum supported `googleauth` version which allows removing the identity credentials refresh patch (which has been fixed upstream).
+- Clamp supported `signet` to `< 1` instead (no API regressions expected).
+
+0.5.0
+----------
+
+- Support signed JWT credentials. ([#14](https://github.com/persona-id/googleauth-extras/pull/14))
+
+- Drop support for Ruby 2.7 & 3.0, update test dependencies. ([#15](https://github.com/persona-id/googleauth-extras/pull/15))
+
 0.4.0
 ----------
 

data/Gemfile

@@ -5,12 +5,12 @@ source 'https://rubygems.org'
 # Specify your gem's dependencies in googleauth-extras.gemspec
 gemspec
 
-gem 'google-cloud-storage', '~> 1.44'
+gem 'google-cloud-storage', '~> 1.55'
 
-gem 'pry-byebug', '~> 3.10'
-gem 'rake', '~> 12.0'
-gem 'rspec', '~> 3.0'
-gem 'rubocop', '~> 1.45'
-gem 'rubocop-rspec', '~> 2.18'
-gem 'timecop', '~> 0.9.6'
-gem 'webmock', '~> 3.18'
+gem 'pry-byebug', '~> 3.11'
+gem 'rake', '~> 13.2'
+gem 'rspec', '~> 3.13'
+gem 'rubocop', '~> 1.75'
+gem 'rubocop-rspec', '~> 3.5'
+gem 'timecop', '~> 0.9.10'
+gem 'webmock', '~> 3.25'

data/googleauth-extras.gemspec

@@ -12,7 +12,7 @@ Gem::Specification.new do |spec|
   spec.homepage      = 'https://github.com/persona-id/googleauth-extras'
   spec.license       = 'MIT'
 
-  spec.required_ruby_version = Gem::Requirement.new('>= 2.7.0')
+  spec.required_ruby_version = Gem::Requirement.new('>= 3.1.0')
 
   spec.metadata['allowed_push_host']     = 'https://rubygems.org'
   spec.metadata['rubygems_mfa_required'] = 'true'
@@ -30,9 +30,7 @@ Gem::Specification.new do |spec|
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ['lib']
 
-  spec.add_dependency 'addressable', '~> 2.8'
-  spec.add_dependency 'faraday', '>= 1.0', '< 3.0'
   spec.add_dependency 'google-apis-iamcredentials_v1'
-  spec.add_dependency 'googleauth', '~> 1.3'
-  spec.add_dependency 'signet', '>= 0.17.0', '< 0.19.0'
+  spec.add_dependency 'googleauth', '~> 1.11', '>= 1.11.1'
+  spec.add_dependency 'signet', '>= 0.17.0', '< 1'
 end

data/lib/google/auth/extras/impersonated_credential.rb

@@ -5,8 +5,6 @@ module Google
     module Extras
       # This credential impersonates a service account.
       class ImpersonatedCredential < Signet::OAuth2::Client
-        include IdentityCredentialRefreshPatch
-
         attr_reader :quota_project_id
 
         # A credential that impersonates a service account.
@@ -49,6 +47,10 @@ module Google
         # @param target_audience [String]
         #   The audience for the token, such as the API or account that this token grants access to.
         #
+        # @param universe_domain [String]
+        #   The universe domain of the credential, reported to gRPC google-cloud clients so they
+        #   don't raise Gapic::UniverseDomainMismatch. Defaults to googleapis.com.
+        #
         # @see https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/generateAccessToken
         # @see https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/generateIdToken
         # @see https://cloud.google.com/iam/docs/create-short-lived-credentials-delegated#sa-credentials-permissions
@@ -62,9 +64,15 @@ module Google
           lifetime: nil,
           quota_project_id: nil,
           scope: nil,
-          target_audience: nil
+          target_audience: nil,
+          universe_domain: 'googleapis.com'
         )
-          super(client_id: target_audience, scope: scope, target_audience: target_audience)
+          super(
+            client_id: target_audience,
+            scope: scope,
+            target_audience: target_audience,
+            universe_domain: base_credentials&.universe_domain || universe_domain,
+          )
 
           if self.target_audience.nil? || self.target_audience.empty?
             raise(ArgumentError, 'Must provide scope or target_audience') if self.scope.nil? || self.scope.empty?

data/lib/google/auth/extras/service_account_jwt_credential.rb

@@ -0,0 +1,117 @@
+# frozen_string_literal: true
+
+module Google
+  module Auth
+    module Extras
+      # This credential issues JWTs signed a service account.
+      class ServiceAccountJWTCredential < Signet::OAuth2::Client
+        # A credential that obtains a signed JWT from Google for a service account.
+        #
+        # @param base_credentials [Hash, String, Signet::OAuth2::Client]
+        #   Credentials to use to sign the JWTs.
+        #
+        # @param delegate_email_addresses [String, Array<String>]
+        #   The email addresses (if any) of intermediate service accounts to reach
+        #   the +email_address+ from +base_credentials+.
+        #
+        # @param email_address [String]
+        #   Email of the service account to sign the JWT.
+        #
+        # @param issuer [String]
+        #   The desired value of the iss field on the issued JWT. Defaults to the email_address.
+        #
+        # @param lifetime [Integers]
+        #   The desired lifetime (in seconds) of the JWT before needing to be refreshed.
+        #   Defaults to 3600 (1h), adjust as needed given a refresh is automatically
+        #   performed when the token less than 60s of remaining life and refresh requires
+        #   an additional API call.
+        #
+        # @param subject [String]
+        #   The desired value of the sub field on the issued JWT. Defaults to the email_address.
+        #
+        # @param target_audience [String]
+        #   The audience for the token, such as the API or account that this token grants access to.
+        #
+        # @param universe_domain [String]
+        #   The universe domain of the credential, reported to gRPC google-cloud clients so they
+        #   don't raise Gapic::UniverseDomainMismatch. Defaults to googleapis.com.
+        #
+        # @see https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/signJwt
+        # @see https://cloud.google.com/iam/docs/create-short-lived-credentials-delegated#sa-credentials-permissions
+        #
+        def initialize(
+          email_address:,
+          target_audience:,
+          base_credentials: nil,
+          delegate_email_addresses: nil,
+          issuer: nil,
+          lifetime: 3600,
+          subject: nil,
+          universe_domain: 'googleapis.com'
+        )
+          super(
+            client_id: target_audience,
+            target_audience: target_audience,
+            universe_domain: base_credentials&.universe_domain || universe_domain,
+          )
+
+          @iam_credentials_service = Google::Apis::IamcredentialsV1::IAMCredentialsService.new.tap do |ics|
+            ics.authorization = base_credentials if base_credentials
+          end
+
+          @jwt_issuer = issuer || email_address
+          @jwt_lifetime = lifetime
+          @jwt_subject = subject || email_address
+
+          @sa_delegates = Array(delegate_email_addresses).map do |email|
+            transform_email_to_name(email)
+          end
+
+          @sa_name = transform_email_to_name(email_address)
+        end
+
+        def fetch_access_token(*)
+          now = Time.now.to_i
+
+          request = Google::Apis::IamcredentialsV1::SignJwtRequest.new(
+            payload: JSON.dump(
+              aud: target_audience,
+              exp: now + @jwt_lifetime,
+              iat: now,
+              iss: @jwt_issuer,
+              sub: @jwt_subject,
+            ),
+          )
+
+          # The Google SDK doesn't like nil repeated values, but be careful with others as well.
+          request.delegates = @sa_delegates unless @sa_delegates.empty?
+
+          response = @iam_credentials_service.sign_service_account_jwt(@sa_name, request)
+
+          {
+            id_token: response.signed_jwt,
+          }
+        end
+
+        def inspect
+          "#<#{self.class.name}" \
+            " @expires_at=#{expires_at.inspect}" \
+            " @id_token=#{@id_token ? '[REDACTED]' : 'nil'}" \
+            " @jwt_issuer=#{@jwt_issuer.inspect}" \
+            " @jwt_lifetime=#{@jwt_lifetime.inspect}" \
+            " @jwt_subject=#{@jwt_subject.inspect}" \
+            " @sa_delegates=#{@sa_delegates.inspect}" \
+            " @sa_name=#{@sa_name.inspect}" \
+            " @target_audience=#{@target_audience.inspect}" \
+            '>'
+        end
+
+        private
+
+        def transform_email_to_name(email)
+          "projects/-/serviceAccounts/#{email}"
+        end
+      end
+    end
+  end
+end

data/lib/google/auth/extras/static_credential.rb

@@ -18,11 +18,16 @@ module Google
         #   The project ID used for quota and billing. This project may be different from
         #   the project used to create the credentials.
         #
-        def initialize(access_token:, quota_project_id: nil)
+        # @param universe_domain [String]
+        #   The universe domain of the credential, reported to gRPC google-cloud clients so they
+        #   don't raise Gapic::UniverseDomainMismatch. Defaults to googleapis.com.
+        #
+        def initialize(access_token:, quota_project_id: nil, universe_domain: 'googleapis.com')
           super(
             access_token: access_token,
             expires_at: TokenInfo.lookup_access_token(access_token).fetch('exp'),
             issued_at: nil,
+            universe_domain: universe_domain,
           )
 
           @quota_project_id = quota_project_id

data/lib/google/auth/extras/token_info.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'uri'
+
 module Google
   module Auth
     module Extras
@@ -11,7 +13,7 @@ module Google
         class LookupFailed < StandardError; end
         class LookupMalformed < LookupFailed; end
 
-        TOKEN_INFO_URI = 'https://oauth2.googleapis.com/tokeninfo'
+        TOKEN_INFO_URI = URI('https://oauth2.googleapis.com/tokeninfo')
         private_constant :TOKEN_INFO_URI
 
         # Lookup the details for a valid access token, including it's expiration.
@@ -30,14 +32,14 @@ module Google
         private
 
         def lookup(query)
-          url = Addressable::URI.parse(TOKEN_INFO_URI)
-          url.query_values = query
+          query_string = URI.encode_www_form(query)
+          uri = TOKEN_INFO_URI.merge("?#{query_string}")
 
-          response = Faraday.default_connection.get(url.normalize.to_s)
+          response = Net::HTTP.get_response(uri)
 
-          raise LookupFailed, response.body.to_s unless response.status == 200
+          raise LookupFailed, response.body unless response.is_a?(Net::HTTPSuccess)
 
-          credentials = Signet::OAuth2.parse_credentials(response.body, response.headers['Content-Type'])
+          credentials = Signet::OAuth2.parse_credentials(response.body, response['Content-Type'])
 
           raise LookupMalformed, 'Missing token expiry' unless credentials['exp']
 

data/lib/google/auth/extras/version.rb

@@ -3,7 +3,7 @@
 module Google
   module Auth
     module Extras
-      VERSION = '0.4.0'
+      VERSION = '0.6.0'
     end
   end
 end

data/lib/google/auth/extras.rb

@@ -4,8 +4,8 @@ require 'date'
 require 'google/apis/iamcredentials_v1'
 require 'signet/oauth_2/client'
 
-require 'google/auth/extras/identity_credential_refresh_patch'
 require 'google/auth/extras/impersonated_credential'
+require 'google/auth/extras/service_account_jwt_credential'
 require 'google/auth/extras/static_credential'
 require 'google/auth/extras/token_info'
 require 'google/auth/extras/version'
@@ -58,6 +58,10 @@ module Google
       #   The OAuth 2 scopes to request. Can either be formatted as a comma seperated string or array.
       #   Only supported when not using a target_audience.
       #
+      # @param universe_domain [String]
+      #   The universe domain of the credential, reported to gRPC google-cloud clients so they
+      #   don't raise Gapic::UniverseDomainMismatch. Defaults to googleapis.com.
+      #
       # @return [Google::Auth::Extras::ImpersonatedCredential]
       #
       # @see https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/generateAccessToken
@@ -73,7 +77,8 @@ module Google
         lifetime: nil,
         quota_project_id: nil,
         scope: nil,
-        target_audience: nil
+        target_audience: nil,
+        universe_domain: 'googleapis.com'
       )
         ImpersonatedCredential.new(
           base_credentials: base_credentials,
@@ -84,6 +89,7 @@ module Google
           quota_project_id: quota_project_id,
           scope: scope,
           target_audience: target_audience,
+          universe_domain: universe_domain,
         )
       end
 
@@ -120,6 +126,10 @@ module Google
       #   The OAuth 2 scopes to request. Can either be formatted as a comma seperated string or array.
       #   Only supported when not using a target_audience.
       #
+      # @param universe_domain [String]
+      #   The universe domain of the credential, reported to gRPC google-cloud clients so they
+      #   don't raise Gapic::UniverseDomainMismatch. Defaults to googleapis.com.
+      #
       # @return [Google::Auth::Credential<Google::Auth::Extras::ImpersonatedCredential>]
       #
       # @see https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/generateAccessToken
@@ -135,7 +145,8 @@ module Google
         lifetime: nil,
         quota_project_id: nil,
         scope: nil,
-        target_audience: nil
+        target_audience: nil,
+        universe_domain: 'googleapis.com'
       )
         wrap_authorization(
           impersonated_authorization(
@@ -147,6 +158,129 @@ module Google
             quota_project_id: quota_project_id,
             scope: scope,
             target_audience: target_audience,
+            universe_domain: universe_domain,
+          ),
+        )
+      end
+
+      # A credential that obtains a signed JWT from Google for a service account.
+      # For usage with the older style GCP Ruby SDKs from the google-apis-* gems.
+      # Also useful for calling IAP-protected endpoints using the Google-managed
+      # OAuth client.
+      #
+      # @param base_credentials [Hash, String, Signet::OAuth2::Client]
+      #   Credentials to use to sign the JWTs.
+      #
+      # @param delegate_email_addresses [String, Array<String>]
+      #   The email addresses (if any) of intermediate service accounts to reach
+      #   the +email_address+ from +base_credentials+.
+      #
+      # @param email_address [String]
+      #   Email of the service account to sign the JWT.
+      #
+      # @param issuer [String]
+      #   The desired value of the iss field on the issued JWT. Defaults to the email_address.
+      #
+      # @param lifetime [Integers]
+      #   The desired lifetime (in seconds) of the JWT before needing to be refreshed.
+      #   Defaults to 3600 (1h), adjust as needed given a refresh is automatically
+      #   performed when the token less than 60s of remaining life and refresh requires
+      #   an additional API call.
+      #
+      # @param subject [String]
+      #   The desired value of the sub field on the issued JWT. Defaults to the email_address.
+      #
+      # @param target_audience [String]
+      #   The audience for the token, such as the API or account that this token grants access to.
+      #
+      # @param universe_domain [String]
+      #   The universe domain of the credential, reported to gRPC google-cloud clients so they
+      #   don't raise Gapic::UniverseDomainMismatch. Defaults to googleapis.com.
+      #
+      # @return [Google::Auth::Extras::ServiceAccountJWTCredential]
+      #
+      # @see https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/signJwt
+      # @see https://cloud.google.com/iam/docs/create-short-lived-credentials-delegated#sa-credentials-permissions
+      #
+      def service_account_jwt_authorization(
+        email_address:,
+        target_audience:,
+        base_credentials: nil,
+        delegate_email_addresses: nil,
+        issuer: nil,
+        lifetime: 3600,
+        subject: nil,
+        universe_domain: 'googleapis.com'
+      )
+        ServiceAccountJWTCredential.new(
+          base_credentials: base_credentials,
+          delegate_email_addresses: delegate_email_addresses,
+          email_address: email_address,
+          issuer: issuer,
+          lifetime: lifetime,
+          subject: subject,
+          target_audience: target_audience,
+          universe_domain: universe_domain,
+        )
+      end
+
+      # A credential that obtains a signed JWT from Google for a service account.
+      # For usage with the newer style GCP Ruby SDKs from the google-cloud-* gems.
+      #
+      # @param base_credentials [Hash, String, Signet::OAuth2::Client]
+      #   Credentials to use to sign the JWTs.
+      #
+      # @param delegate_email_addresses [String, Array<String>]
+      #   The email addresses (if any) of intermediate service accounts to reach
+      #   the +email_address+ from +base_credentials+.
+      #
+      # @param email_address [String]
+      #   Email of the service account to sign the JWT.
+      #
+      # @param issuer [String]
+      #   The desired value of the iss field on the issued JWT. Defaults to the email_address.
+      #
+      # @param lifetime [Integers]
+      #   The desired lifetime (in seconds) of the JWT before needing to be refreshed.
+      #   Defaults to 3600 (1h), adjust as needed given a refresh is automatically
+      #   performed when the token less than 60s of remaining life and refresh requires
+      #   an additional API call.
+      #
+      # @param subject [String]
+      #   The desired value of the sub field on the issued JWT. Defaults to the email_address.
+      #
+      # @param target_audience [String]
+      #   The audience for the token, such as the API or account that this token grants access to.
+      #
+      # @param universe_domain [String]
+      #   The universe domain of the credential, reported to gRPC google-cloud clients so they
+      #   don't raise Gapic::UniverseDomainMismatch. Defaults to googleapis.com.
+      #
+      # @return [Google::Auth::Extras::ServiceAccountJWTCredential]
+      #
+      # @see https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/signJwt
+      # @see https://cloud.google.com/iam/docs/create-short-lived-credentials-delegated#sa-credentials-permissions
+      #
+      def service_account_jwt_credential(
+        email_address:,
+        target_audience:,
+        base_credentials: nil,
+        delegate_email_addresses: nil,
+        issuer: nil,
+        lifetime: 3600,
+        subject: nil,
+        universe_domain: 'googleapis.com'
+      )
+        wrap_authorization(
+          service_account_jwt_authorization(
+            base_credentials: base_credentials,
+            delegate_email_addresses: delegate_email_addresses,
+            email_address: email_address,
+            issuer: issuer,
+            lifetime: lifetime,
+            subject: subject,
+            target_audience: target_audience,
+            universe_domain: universe_domain,
           ),
         )
       end
@@ -161,11 +295,14 @@ module Google
       #   The project ID used for quota and billing. This project may be different from
       #   the project used to create the credentials.
       #
+      # @param universe_domain [String]
+      #   The universe domain of the credential, reported to gRPC google-cloud clients so they
+      #   don't raise Gapic::UniverseDomainMismatch. Defaults to googleapis.com.
       #
       # @return [Google::Auth::Extras::StaticCredential]
       #
-      def static_authorization(token, quota_project_id: nil)
-        StaticCredential.new(access_token: token, quota_project_id: quota_project_id)
+      def static_authorization(token, quota_project_id: nil, universe_domain: 'googleapis.com')
+        StaticCredential.new(access_token: token, quota_project_id: quota_project_id, universe_domain: universe_domain)
       end
 
       # A credential using a static access token. For usage with the newer
@@ -178,17 +315,25 @@ module Google
       #   The project ID used for quota and billing. This project may be different from
       #   the project used to create the credentials.
       #
+      # @param universe_domain [String]
+      #   The universe domain of the credential, reported to gRPC google-cloud clients so they
+      #   don't raise Gapic::UniverseDomainMismatch. Defaults to googleapis.com.
+      #
       # @return [Google::Auth::Credential<Google::Auth::Extras::StaticCredential>]
       #
-      def static_credential(token, quota_project_id: nil)
-        wrap_authorization(static_authorization(token, quota_project_id: quota_project_id))
+      def static_credential(token, quota_project_id: nil, universe_domain: 'googleapis.com')
+        wrap_authorization(
+          static_authorization(token, quota_project_id: quota_project_id, universe_domain: universe_domain),
+        )
       end
 
       # Take an authorization and turn it into a credential, primarily used
       # for setting up both the old and new style SDKs.
       #
       # @param client [Signet::OAuth2::Client]
-      #   Authorization credential to wrap.
+      #   Authorization credential to wrap. The universe domain reported to gRPC google-cloud
+      #   clients (so they don't raise Gapic::UniverseDomainMismatch) is taken from the client
+      #   as-is; set it on the client before wrapping if needed.
       #
       # @return [Google::Auth::Credential]
       #

metadata

@@ -1,49 +1,15 @@
 --- !ruby/object:Gem::Specification
 name: googleauth-extras
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.6.0
 platform: ruby
 authors:
 - Persona Identities
-autorequire: 
+autorequire:
 bindir: exe
 cert_chain: []
-date: 2024-08-06 00:00:00.000000000 Z
+date: 2026-07-23 00:00:00.000000000 Z
 dependencies:
-- !ruby/object:Gem::Dependency
-  name: addressable
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.8'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.8'
-- !ruby/object:Gem::Dependency
-  name: faraday
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '1.0'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '3.0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '1.0'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '3.0'
 - !ruby/object:Gem::Dependency
   name: google-apis-iamcredentials_v1
   requirement: !ruby/object:Gem::Requirement
@@ -64,14 +30,20 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.3'
+        version: '1.11'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.11.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.3'
+        version: '1.11'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.11.1
 - !ruby/object:Gem::Dependency
   name: signet
   requirement: !ruby/object:Gem::Requirement
@@ -81,7 +53,7 @@ dependencies:
         version: 0.17.0
     - - "<"
       - !ruby/object:Gem::Version
-        version: 0.19.0
+        version: '1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -91,8 +63,8 @@ dependencies:
         version: 0.17.0
     - - "<"
       - !ruby/object:Gem::Version
-        version: 0.19.0
-description: 
+        version: '1'
+description:
 email:
 - alex.coomans@withpersona.com
 executables: []
@@ -113,8 +85,8 @@ files:
 - bin/setup
 - googleauth-extras.gemspec
 - lib/google/auth/extras.rb
-- lib/google/auth/extras/identity_credential_refresh_patch.rb
 - lib/google/auth/extras/impersonated_credential.rb
+- lib/google/auth/extras/service_account_jwt_credential.rb
 - lib/google/auth/extras/static_credential.rb
 - lib/google/auth/extras/token_info.rb
 - lib/google/auth/extras/version.rb
@@ -128,7 +100,7 @@ metadata:
   homepage_uri: https://github.com/persona-id/googleauth-extras
   source_code_uri: https://github.com/persona-id/googleauth-extras
   changelog_uri: https://github.com/persona-id/googleauth-extras/blob/main/CHANGELOG.md
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -136,15 +108,15 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.7.0
+      version: 3.1.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.10
-signing_key: 
+rubygems_version: 3.3.27
+signing_key:
 specification_version: 4
 summary: Additions to the googleauth gem for unsupported authentication schemes.
 test_files: []

data/lib/google/auth/extras/identity_credential_refresh_patch.rb

@@ -1,17 +0,0 @@
-# frozen_string_literal: true
-
-module Google
-  module Auth
-    module Extras
-      # This module fixes an issue with ID tokens not automatically refreshing
-      # because their expiration is encoded in the JWT.
-      module IdentityCredentialRefreshPatch
-        def update_token!(*)
-          super.tap do
-            self.expires_at = decoded_id_token['exp'] if id_token
-          end
-        end
-      end
-    end
-  end
-end