googleauth-extras 0.5.0 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5ef5e7a09636bad627874135bfa0c1f020eace2016a31aaf8952a70b01465593
-  data.tar.gz: 77d1fd18df712dbf3dd6620c4d3e2dfdcd0ced4872e6ebea6f05340cc8bf28f3
+  metadata.gz: 29022ef0b3431bad2d9e5833e3af8a5333307a60610b176d92e571d5aee59aeb
+  data.tar.gz: ce7ee1a8121b2b6781879bef17908190575fb3f3d0ce7e7eda8023d3a29a3463
 SHA512:
-  metadata.gz: 9dbab8990a50ddcea8df7e25aa651c294005bf9827c2b3729d77dc07df601384ece65af0acec8eeda7337a9c0fc358f8b9540e3fdde074cd718a496994bd26b9
-  data.tar.gz: 0e7aed934ce2b0e42f7e96e48ceca7866c81216e67a97b3e59f4027c298040c603e2c3a01e601914e8b33a97fb7c7457d52b70412a66f0bb2446b8a390cb8607
+  metadata.gz: 3cc8272a821cd99f51d2cc4de7f9979c42078aad8ddcaeafbec4523987aeebacd77947c86758851b6e1cfb18b13c6393cdffefe27dd629ae7c587c993f22e8cb
+  data.tar.gz: 3c6a26d85df2064d473f8ec8847f638a669ece26aeff38d7ad6f5ee918b5746da7882afd3331f3bb4686cafc88c3b2d5f38742008caa3df7c40992b9cc133b20

data/.rubocop.yml

@@ -25,6 +25,9 @@ Metrics/CyclomaticComplexity:
 Metrics/MethodLength:
   Max: 30
 
+Metrics/ModuleLength:
+  Max: 125
+
 Metrics/ParameterLists:
   Enabled: false
 

data/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Release History
 
+0.6.0
+----------
+
+- Support setting the universe domain (defaults to googleapis.com) so gRPC google-cloud clients don't raise Gapic::UniverseDomainMismatch.
+- drop `addressable` as a transitive dependency, replace with stdlib `uri`.
+- drop `faraday` as a transitive dependency, replace with stdlib `net-http`.
+- Bump minimum supported `googleauth` version which allows removing the identity credentials refresh patch (which has been fixed upstream).
+- Clamp supported `signet` to `< 1` instead (no API regressions expected).
+
 0.5.0
 ----------
 

data/googleauth-extras.gemspec

@@ -30,9 +30,7 @@ Gem::Specification.new do |spec|
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ['lib']
 
-  spec.add_dependency 'addressable', '~> 2.8'
-  spec.add_dependency 'faraday', '>= 1.0', '< 3.0'
   spec.add_dependency 'google-apis-iamcredentials_v1'
-  spec.add_dependency 'googleauth', '~> 1.3'
-  spec.add_dependency 'signet', '>= 0.17.0', '< 0.19.0'
+  spec.add_dependency 'googleauth', '~> 1.11', '>= 1.11.1'
+  spec.add_dependency 'signet', '>= 0.17.0', '< 1'
 end

data/lib/google/auth/extras/impersonated_credential.rb

@@ -5,8 +5,6 @@ module Google
     module Extras
       # This credential impersonates a service account.
       class ImpersonatedCredential < Signet::OAuth2::Client
-        include IdentityCredentialRefreshPatch
-
         attr_reader :quota_project_id
 
         # A credential that impersonates a service account.
@@ -49,6 +47,10 @@ module Google
         # @param target_audience [String]
         #   The audience for the token, such as the API or account that this token grants access to.
         #
+        # @param universe_domain [String]
+        #   The universe domain of the credential, reported to gRPC google-cloud clients so they
+        #   don't raise Gapic::UniverseDomainMismatch. Defaults to googleapis.com.
+        #
         # @see https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/generateAccessToken
         # @see https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/generateIdToken
         # @see https://cloud.google.com/iam/docs/create-short-lived-credentials-delegated#sa-credentials-permissions
@@ -62,9 +64,15 @@ module Google
           lifetime: nil,
           quota_project_id: nil,
           scope: nil,
-          target_audience: nil
+          target_audience: nil,
+          universe_domain: 'googleapis.com'
         )
-          super(client_id: target_audience, scope: scope, target_audience: target_audience)
+          super(
+            client_id: target_audience,
+            scope: scope,
+            target_audience: target_audience,
+            universe_domain: base_credentials&.universe_domain || universe_domain,
+          )
 
           if self.target_audience.nil? || self.target_audience.empty?
             raise(ArgumentError, 'Must provide scope or target_audience') if self.scope.nil? || self.scope.empty?

data/lib/google/auth/extras/service_account_jwt_credential.rb

@@ -5,8 +5,6 @@ module Google
     module Extras
       # This credential issues JWTs signed a service account.
       class ServiceAccountJWTCredential < Signet::OAuth2::Client
-        include IdentityCredentialRefreshPatch
-
         # A credential that obtains a signed JWT from Google for a service account.
         #
         # @param base_credentials [Hash, String, Signet::OAuth2::Client]
@@ -34,6 +32,10 @@ module Google
         # @param target_audience [String]
         #   The audience for the token, such as the API or account that this token grants access to.
         #
+        # @param universe_domain [String]
+        #   The universe domain of the credential, reported to gRPC google-cloud clients so they
+        #   don't raise Gapic::UniverseDomainMismatch. Defaults to googleapis.com.
+        #
         # @see https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/signJwt
         # @see https://cloud.google.com/iam/docs/create-short-lived-credentials-delegated#sa-credentials-permissions
         #
@@ -44,9 +46,14 @@ module Google
           delegate_email_addresses: nil,
           issuer: nil,
           lifetime: 3600,
-          subject: nil
+          subject: nil,
+          universe_domain: 'googleapis.com'
         )
-          super(client_id: target_audience, target_audience: target_audience)
+          super(
+            client_id: target_audience,
+            target_audience: target_audience,
+            universe_domain: base_credentials&.universe_domain || universe_domain,
+          )
 
           @iam_credentials_service = Google::Apis::IamcredentialsV1::IAMCredentialsService.new.tap do |ics|
             ics.authorization = base_credentials if base_credentials

data/lib/google/auth/extras/static_credential.rb

@@ -18,11 +18,16 @@ module Google
         #   The project ID used for quota and billing. This project may be different from
         #   the project used to create the credentials.
         #
-        def initialize(access_token:, quota_project_id: nil)
+        # @param universe_domain [String]
+        #   The universe domain of the credential, reported to gRPC google-cloud clients so they
+        #   don't raise Gapic::UniverseDomainMismatch. Defaults to googleapis.com.
+        #
+        def initialize(access_token:, quota_project_id: nil, universe_domain: 'googleapis.com')
           super(
             access_token: access_token,
             expires_at: TokenInfo.lookup_access_token(access_token).fetch('exp'),
             issued_at: nil,
+            universe_domain: universe_domain,
           )
 
           @quota_project_id = quota_project_id

data/lib/google/auth/extras/token_info.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'uri'
+
 module Google
   module Auth
     module Extras
@@ -11,7 +13,7 @@ module Google
         class LookupFailed < StandardError; end
         class LookupMalformed < LookupFailed; end
 
-        TOKEN_INFO_URI = 'https://oauth2.googleapis.com/tokeninfo'
+        TOKEN_INFO_URI = URI('https://oauth2.googleapis.com/tokeninfo')
         private_constant :TOKEN_INFO_URI
 
         # Lookup the details for a valid access token, including it's expiration.
@@ -30,14 +32,14 @@ module Google
         private
 
         def lookup(query)
-          url = Addressable::URI.parse(TOKEN_INFO_URI)
-          url.query_values = query
+          query_string = URI.encode_www_form(query)
+          uri = TOKEN_INFO_URI.merge("?#{query_string}")
 
-          response = Faraday.default_connection.get(url.normalize.to_s)
+          response = Net::HTTP.get_response(uri)
 
-          raise LookupFailed, response.body.to_s unless response.status == 200
+          raise LookupFailed, response.body unless response.is_a?(Net::HTTPSuccess)
 
-          credentials = Signet::OAuth2.parse_credentials(response.body, response.headers['Content-Type'])
+          credentials = Signet::OAuth2.parse_credentials(response.body, response['Content-Type'])
 
           raise LookupMalformed, 'Missing token expiry' unless credentials['exp']
 

data/lib/google/auth/extras/version.rb

@@ -3,7 +3,7 @@
 module Google
   module Auth
     module Extras
-      VERSION = '0.5.0'
+      VERSION = '0.6.0'
     end
   end
 end

data/lib/google/auth/extras.rb

@@ -4,7 +4,6 @@ require 'date'
 require 'google/apis/iamcredentials_v1'
 require 'signet/oauth_2/client'
 
-require 'google/auth/extras/identity_credential_refresh_patch'
 require 'google/auth/extras/impersonated_credential'
 require 'google/auth/extras/service_account_jwt_credential'
 require 'google/auth/extras/static_credential'
@@ -59,6 +58,10 @@ module Google
       #   The OAuth 2 scopes to request. Can either be formatted as a comma seperated string or array.
       #   Only supported when not using a target_audience.
       #
+      # @param universe_domain [String]
+      #   The universe domain of the credential, reported to gRPC google-cloud clients so they
+      #   don't raise Gapic::UniverseDomainMismatch. Defaults to googleapis.com.
+      #
       # @return [Google::Auth::Extras::ImpersonatedCredential]
       #
       # @see https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/generateAccessToken
@@ -74,7 +77,8 @@ module Google
         lifetime: nil,
         quota_project_id: nil,
         scope: nil,
-        target_audience: nil
+        target_audience: nil,
+        universe_domain: 'googleapis.com'
       )
         ImpersonatedCredential.new(
           base_credentials: base_credentials,
@@ -85,6 +89,7 @@ module Google
           quota_project_id: quota_project_id,
           scope: scope,
           target_audience: target_audience,
+          universe_domain: universe_domain,
         )
       end
 
@@ -121,6 +126,10 @@ module Google
       #   The OAuth 2 scopes to request. Can either be formatted as a comma seperated string or array.
       #   Only supported when not using a target_audience.
       #
+      # @param universe_domain [String]
+      #   The universe domain of the credential, reported to gRPC google-cloud clients so they
+      #   don't raise Gapic::UniverseDomainMismatch. Defaults to googleapis.com.
+      #
       # @return [Google::Auth::Credential<Google::Auth::Extras::ImpersonatedCredential>]
       #
       # @see https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/generateAccessToken
@@ -136,7 +145,8 @@ module Google
         lifetime: nil,
         quota_project_id: nil,
         scope: nil,
-        target_audience: nil
+        target_audience: nil,
+        universe_domain: 'googleapis.com'
       )
         wrap_authorization(
           impersonated_authorization(
@@ -148,6 +158,7 @@ module Google
             quota_project_id: quota_project_id,
             scope: scope,
             target_audience: target_audience,
+            universe_domain: universe_domain,
           ),
         )
       end
@@ -182,6 +193,10 @@ module Google
       # @param target_audience [String]
       #   The audience for the token, such as the API or account that this token grants access to.
       #
+      # @param universe_domain [String]
+      #   The universe domain of the credential, reported to gRPC google-cloud clients so they
+      #   don't raise Gapic::UniverseDomainMismatch. Defaults to googleapis.com.
+      #
       # @return [Google::Auth::Extras::ServiceAccountJWTCredential]
       #
       # @see https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/signJwt
@@ -194,7 +209,8 @@ module Google
         delegate_email_addresses: nil,
         issuer: nil,
         lifetime: 3600,
-        subject: nil
+        subject: nil,
+        universe_domain: 'googleapis.com'
       )
         ServiceAccountJWTCredential.new(
           base_credentials: base_credentials,
@@ -204,6 +220,7 @@ module Google
           lifetime: lifetime,
           subject: subject,
           target_audience: target_audience,
+          universe_domain: universe_domain,
         )
       end
 
@@ -235,6 +252,10 @@ module Google
       # @param target_audience [String]
       #   The audience for the token, such as the API or account that this token grants access to.
       #
+      # @param universe_domain [String]
+      #   The universe domain of the credential, reported to gRPC google-cloud clients so they
+      #   don't raise Gapic::UniverseDomainMismatch. Defaults to googleapis.com.
+      #
       # @return [Google::Auth::Extras::ServiceAccountJWTCredential]
       #
       # @see https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/signJwt
@@ -247,7 +268,8 @@ module Google
         delegate_email_addresses: nil,
         issuer: nil,
         lifetime: 3600,
-        subject: nil
+        subject: nil,
+        universe_domain: 'googleapis.com'
       )
         wrap_authorization(
           service_account_jwt_authorization(
@@ -258,6 +280,7 @@ module Google
             lifetime: lifetime,
             subject: subject,
             target_audience: target_audience,
+            universe_domain: universe_domain,
           ),
         )
       end
@@ -272,11 +295,14 @@ module Google
       #   The project ID used for quota and billing. This project may be different from
       #   the project used to create the credentials.
       #
+      # @param universe_domain [String]
+      #   The universe domain of the credential, reported to gRPC google-cloud clients so they
+      #   don't raise Gapic::UniverseDomainMismatch. Defaults to googleapis.com.
       #
       # @return [Google::Auth::Extras::StaticCredential]
       #
-      def static_authorization(token, quota_project_id: nil)
-        StaticCredential.new(access_token: token, quota_project_id: quota_project_id)
+      def static_authorization(token, quota_project_id: nil, universe_domain: 'googleapis.com')
+        StaticCredential.new(access_token: token, quota_project_id: quota_project_id, universe_domain: universe_domain)
       end
 
       # A credential using a static access token. For usage with the newer
@@ -289,17 +315,25 @@ module Google
       #   The project ID used for quota and billing. This project may be different from
       #   the project used to create the credentials.
       #
+      # @param universe_domain [String]
+      #   The universe domain of the credential, reported to gRPC google-cloud clients so they
+      #   don't raise Gapic::UniverseDomainMismatch. Defaults to googleapis.com.
+      #
       # @return [Google::Auth::Credential<Google::Auth::Extras::StaticCredential>]
       #
-      def static_credential(token, quota_project_id: nil)
-        wrap_authorization(static_authorization(token, quota_project_id: quota_project_id))
+      def static_credential(token, quota_project_id: nil, universe_domain: 'googleapis.com')
+        wrap_authorization(
+          static_authorization(token, quota_project_id: quota_project_id, universe_domain: universe_domain),
+        )
       end
 
       # Take an authorization and turn it into a credential, primarily used
       # for setting up both the old and new style SDKs.
       #
       # @param client [Signet::OAuth2::Client]
-      #   Authorization credential to wrap.
+      #   Authorization credential to wrap. The universe domain reported to gRPC google-cloud
+      #   clients (so they don't raise Gapic::UniverseDomainMismatch) is taken from the client
+      #   as-is; set it on the client before wrapping if needed.
       #
       # @return [Google::Auth::Credential]
       #

metadata

@@ -1,49 +1,15 @@
 --- !ruby/object:Gem::Specification
 name: googleauth-extras
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.6.0
 platform: ruby
 authors:
 - Persona Identities
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-04-16 00:00:00.000000000 Z
+date: 2026-07-23 00:00:00.000000000 Z
 dependencies:
-- !ruby/object:Gem::Dependency
-  name: addressable
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.8'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.8'
-- !ruby/object:Gem::Dependency
-  name: faraday
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '1.0'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '3.0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '1.0'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '3.0'
 - !ruby/object:Gem::Dependency
   name: google-apis-iamcredentials_v1
   requirement: !ruby/object:Gem::Requirement
@@ -64,14 +30,20 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.3'
+        version: '1.11'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.11.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.3'
+        version: '1.11'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.11.1
 - !ruby/object:Gem::Dependency
   name: signet
   requirement: !ruby/object:Gem::Requirement
@@ -81,7 +53,7 @@ dependencies:
         version: 0.17.0
     - - "<"
       - !ruby/object:Gem::Version
-        version: 0.19.0
+        version: '1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -91,7 +63,7 @@ dependencies:
         version: 0.17.0
     - - "<"
       - !ruby/object:Gem::Version
-        version: 0.19.0
+        version: '1'
 description:
 email:
 - alex.coomans@withpersona.com
@@ -113,7 +85,6 @@ files:
 - bin/setup
 - googleauth-extras.gemspec
 - lib/google/auth/extras.rb
-- lib/google/auth/extras/identity_credential_refresh_patch.rb
 - lib/google/auth/extras/impersonated_credential.rb
 - lib/google/auth/extras/service_account_jwt_credential.rb
 - lib/google/auth/extras/static_credential.rb

data/lib/google/auth/extras/identity_credential_refresh_patch.rb

@@ -1,17 +0,0 @@
-# frozen_string_literal: true
-
-module Google
-  module Auth
-    module Extras
-      # This module fixes an issue with ID tokens not automatically refreshing
-      # because their expiration is encoded in the JWT.
-      module IdentityCredentialRefreshPatch
-        def update_token!(*)
-          super.tap do
-            self.expires_at = decoded_id_token['exp'] if id_token
-          end
-        end
-      end
-    end
-  end
-end