@webpieces/gcp-identity 0.4.861 → 0.4.862
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +20 -4
- package/package.json +3 -3
package/README.md
CHANGED
|
@@ -9,11 +9,27 @@ tests) every call falls back to a deterministic localhost value so no GCP is nee
|
|
|
9
9
|
- `getSelfCloudRunUrl()` — this service's own base URL
|
|
10
10
|
- `gcpCloudRunDeriver()` — the GCP half of URL resolution: `svcName` → `https://<svc>-<projectNumber>.<region>.run.app`. Install it once at startup with `ClientRegistry.setDeriver(gcpCloudRunDeriver())` and every same-project/same-region peer resolves with no URL table. Off GCP (a CLI, CI) pass the values instead: `gcpCloudRunDeriver(new GcpCloudRunTarget(projectNumber, region))`
|
|
11
11
|
- `getRuntimeServiceAccountEmail()` — the SA this process runs as
|
|
12
|
-
- `mintIdToken(audience)` — Google-signed OIDC ID token (a `dev-oidc.*` token off-GCP)
|
|
13
|
-
- `
|
|
12
|
+
- `GcpOidc.mintIdToken(audience)` — Google-signed OIDC ID token (a `dev-oidc.*` token off-GCP)
|
|
13
|
+
- `GcpOidc.verifyFromCallers(idToken, callers)` — verify + allow-list the caller SA
|
|
14
14
|
|
|
15
|
-
Underpins the `@WpAuthOidc` service-to-service
|
|
16
|
-
|
|
15
|
+
Underpins the `@WpAuthOidc` service-to-service credential contract used by
|
|
16
|
+
`@webpieces/http-client-node` (RPC) and `@webpieces/cloudtasks-client`, with supplementary
|
|
17
|
+
server checks dispatched by `AuthFilter`.
|
|
18
|
+
|
|
19
|
+
## Private Cloud Run: Google enforces invocation access
|
|
20
|
+
|
|
21
|
+
The protected Cloud Run edge verifies the invocation ID token and enforces `roles/run.invoker`
|
|
22
|
+
before the container receives it. The annotation primarily tells clients to generate the
|
|
23
|
+
correct destination-audience token. A bare `@WpAuthOidc()` delegates caller authorization to
|
|
24
|
+
that edge; explicit callers add an application allow-list. Real tokens are also checked by the
|
|
25
|
+
application verifier, without its own audience constraint.
|
|
26
|
+
|
|
27
|
+
Synthetic `dev-oidc.*` tokens support local/in-process tests and are unsigned. The current
|
|
28
|
+
application decoder accepts that prefix without checking the runtime; the protected Cloud Run
|
|
29
|
+
edge rejects it as an invocation credential. A direct verifier call does not test ingress IAM,
|
|
30
|
+
and this verifier must not be treated as standalone protection for public/direct ingress.
|
|
31
|
+
See [the Cloud Run OIDC guide](../../../docs/architecture/cloud-run-oidc.md) for deployment
|
|
32
|
+
assumptions, the advisory public-posture check, and separate-header handling.
|
|
17
33
|
|
|
18
34
|
**There is exactly ONE service name.** The Cloud Run service name is what you report, what peers
|
|
19
35
|
call you by, and what goes in every URL — yours and theirs. Nothing strips or adds a prefix: deploy
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@webpieces/gcp-identity",
|
|
3
|
-
"version": "0.4.
|
|
3
|
+
"version": "0.4.862",
|
|
4
4
|
"description": "GCP runtime identity: project/region metadata, Cloud Run URLs, OIDC mint/verify",
|
|
5
5
|
"type": "commonjs",
|
|
6
6
|
"main": "./src/index.js",
|
|
@@ -23,8 +23,8 @@
|
|
|
23
23
|
"access": "public"
|
|
24
24
|
},
|
|
25
25
|
"dependencies": {
|
|
26
|
-
"@webpieces/core-context": "0.4.
|
|
27
|
-
"@webpieces/core-util": "0.4.
|
|
26
|
+
"@webpieces/core-context": "0.4.862",
|
|
27
|
+
"@webpieces/core-util": "0.4.862",
|
|
28
28
|
"google-auth-library": "9.15.1",
|
|
29
29
|
"gcp-metadata": "6.1.1",
|
|
30
30
|
"inversify": "7.10.4",
|