stripe-workload-identity 0.1.0.pre.alpha.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: e861b3191d91a27674bb89a68eef14ac6f238af2955425f7233238eba273863c
+  data.tar.gz: df4d3bcf853b77ae86211e5da138d5a90e3e51c7d4b6e79505b6d0426d6c4d43
+SHA512:
+  metadata.gz: ff16051d75e82024d90e39ef56144035d539516867d36e573ea4d7fe0b98ee078d277e91c778b590841a5ed8488bb4eb0bc8b1f196309a88139e45eefb1aa684
+  data.tar.gz: cf1f77b9948928da907663af187010e966fec25c51dff598a89e6017222595d4aa822c50162e5f4981b3f3fe3150c8d5c7238509c6abdc01ca0b978b790ac663

data/lib/stripe/workload_identity/version.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module Stripe
+  module WorkloadIdentity
+    VERSION = "0.1.0-alpha.1"
+  end
+end

data/lib/stripe/workload_identity.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require "googleauth"
+
+require "stripe/workload_identity/version"
+
+module Stripe
+  module WorkloadIdentity
+    # The fixed audience that Stripe expects for workload identity
+    AUDIENCE = "https://access.stripe.com/wif"
+
+    # Error is raised when a Google-signed identity assertion can't be
+    # obtained. The original exception, if any, is available via `#cause`.
+    class Error < StandardError
+    end
+
+    # Implements the workload identity provider, matching the
+    # type expected by `Stripe::StripeClient.for_workload_identity`
+    class GcpWorkloadIdentity
+      def provider
+        "gcp"
+      end
+
+      def identity_assertion
+        credentials = Google::Auth::GCECredentials.new(token_type: :id_token, target_audience: AUDIENCE)
+
+        begin
+          credentials.fetch_access_token!
+        rescue StandardError => e
+          raise Error, "Unable to obtain a GCP workload identity assertion: #{e.message}. Check that this " \
+                       "process is running in a GCP environment that exposes the metadata identity-token " \
+                       "endpoint, that its workload identity is allowed to request an identity token, and " \
+                       "that it can reach the metadata server. For local development, tests, and CI, use " \
+                       "a Stripe API key with Stripe::StripeClient.new(...) instead."
+        end
+
+        token = credentials.id_token
+        raise Error, "The GCP metadata server returned no identity token." if token.nil? || token.empty?
+
+        token
+      end
+    end
+  end
+end

data/rbi/stripe/workload_identity.rbi

@@ -0,0 +1,20 @@
+# typed: strong
+
+module Stripe
+  module WorkloadIdentity
+    VERSION = T.let(T.unsafe(nil), String)
+    AUDIENCE = T.let(T.unsafe(nil), String)
+
+    class Error < StandardError; end
+
+    class GcpWorkloadIdentity
+      include ::Stripe::WorkloadIdentity::Provider
+
+      sig { override.returns(String) }
+      def provider; end
+
+      sig { override.returns(String) }
+      def identity_assertion; end
+    end
+  end
+end

metadata

@@ -0,0 +1,68 @@
+--- !ruby/object:Gem::Specification
+name: stripe-workload-identity
+version: !ruby/object:Gem::Version
+  version: 0.1.0.pre.alpha.1
+platform: ruby
+authors:
+- Stripe
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2026-10-21 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: googleauth
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.8'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.8'
+description: Lets Stripe::StripeClient.for_workload_identity authenticate on Google
+  Cloud environments with a compatible metadata identity-token endpoint, using a Google-signed
+  identity token instead of a long-lived API key. Does not depend on the `stripe`
+  gem.
+email: support@stripe.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- lib/stripe/workload_identity.rb
+- lib/stripe/workload_identity/version.rb
+- rbi/stripe/workload_identity.rbi
+homepage: https://stripe.com/docs/api?lang=ruby
+licenses:
+- MIT
+metadata:
+  bug_tracker_uri: https://github.com/stripe/stripe-ruby/issues
+  documentation_uri: https://stripe.com/docs/api?lang=ruby
+  github_repo: ssh://github.com/stripe/stripe-ruby
+  homepage_uri: https://stripe.com/docs/api?lang=ruby
+  source_code_uri: https://github.com/stripe/stripe-ruby
+  rubygems_mfa_required: 'false'
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 3.0.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.5.22
+signing_key:
+specification_version: 4
+summary: GCP workload identity provider for the Stripe Ruby bindings
+test_files: []