infrastructure-google-auth

Google service-account auth — RS256 JWT to OAuth2 access token (server-to-server flow)

What it is for

Google API authentication — two headless server-side flows.

• Service account (Client::new) — an RS256-signed JWT

exchanged at the token endpoint for an access token (the two-legged / JWT-bearer flow).

• OAuth 2.0 refresh token (Client::new_oauth) — a long-lived

refresh token, obtained once via an interactive consent, exchanged for access tokens. For reaching an API as a consenting user.

No PKCE and no browser redirect at runtime. Reusable by any Google-API client library crate.

# Example

use infrastructure_google_auth::{Client, ServiceAccountKey};

let key = ServiceAccountKey::from_file("/path/to/service-account.json")?;
let mut auth = Client::new(
key,
&"https://www.googleapis.com/auth/webmasters.readonly",
);
let bearer = auth.token().await?;
# Ok::<(), infrastructure_google_auth::GoogleAuthError>(())

Capabilities

No public items.

How to use it

From this crate's own rustdoc:

use infrastructure_google_auth::{Client, ServiceAccountKey};

let key = ServiceAccountKey::from_file("/path/to/service-account.json")?;
let mut auth = Client::new(
    key,
    &["https://www.googleapis.com/auth/webmasters.readonly"],
);
let bearer = auth.token().await?;
# Ok::<(), infrastructure_google_auth::GoogleAuthError>(())

Module structure

No public modules: the crate root is its whole surface.

Public surface

No public items.

Re-exports. Exported here, defined elsewhere.

Boundary

Depends on no other workspace tier.

Shares tier infrastructure with 82 other crates: infrastructure-acquire, infrastructure-adapters-google-calendar, infrastructure-adapters-google-gmail, infrastructure-adapters-google-places, infrastructure-adapters-google-trends, infrastructure-adapters-shodan, infrastructure-adapters-yelp, infrastructure-agent, … (82 total).

_What this crate deliberately does NOT own is a judgment. No committed registry records one for it, so none is stated here._

Where it sits

Dependencies

Runtime, in this workspace.

Runtime, from outside the workspace.

Development, from outside the workspace.

Build. None.

Depended on by. 2 workspace crates.

Signal flow — what reaches this crate, and what it reaches.

flowchart LR
  n_application_google_auth["application-google-auth"] -->|uses| SELF
  n_infrastructure_search_console["infrastructure-search-console"] -->|uses| SELF
  SELF["infrastructure-google-auth"]
  SELF -->|runtime| n_infrastructure_fetcher["infrastructure-fetcher"]
  classDef self fill:#1f883d,stroke:#1f883d,color:#fff;
  class SELF self;

Feature flags

No Cargo features are defined: every capability is unconditional, so no consumer can receive a half-wired crate.

Targets

Error model

No public error type was detected: no public item declares a type named *Error, and no public signature returns one.

Operational characteristics

No unsafe block, unsafe fn, unsafe impl or unsafe trait was found by the parser anywhere in this crate's source.

Configuration

No environment variable is read with a literal name anywhere in this crate. A variable whose key is computed at run time cannot be listed here, and is not claimed to be absent.

Related capabilities

2 workspace crates depend on this one: application-google-auth, infrastructure-search-console.

Verification

What the tests establish, by name:

• build_assertion_produces_a_verifiable_rs256_jwt — tests/google_auth.rs
• client_caches_the_token_for_its_lifetime — tests/google_auth.rs
• client_refreshes_a_stale_token — tests/google_auth.rs
• fetch_oauth_token_refreshes — tests/google_auth.rs
• fetch_oauth_token_surfaces_endpoint_errors — tests/google_auth.rs
• fetch_token_caps_an_oversized_response_body — tests/google_auth.rs
• fetch_token_exchanges_the_assertion — tests/google_auth.rs
• fetch_token_surfaces_endpoint_errors — tests/google_auth.rs
• from_json_parses_a_valid_key_and_defaults_the_token_uri — tests/google_auth.rs
• from_json_rejects_malformed_keys — tests/google_auth.rs
• hardened_client_refuses_a_loopback_resolving_host — tests/google_auth.rs
• oauth_client_caches_the_token — tests/google_auth.rs
• oauth_credentials_from_json_parses_and_validates — tests/google_auth.rs
• debug_does_not_leak_private_key — src/key.rs
• debug_does_not_leak_oauth_secrets — src/oauth.rs
• debug_does_not_leak_token_response_access_token — src/oauth.rs
• debug_does_not_leak_access_token_value — src/token.rs
• debug_does_not_leak_token_response_access_token — src/token.rs

Documentation coverage

Metrics

pie showData
    title Rust source composition
    "Code" : 449
    "Blank or comment" : 318

Generation

Rendered by tools-corpus corpus readme from repository evidence alone, renderer schema 2, lexicon current. No model, network service or database was consulted. Regenerate with tools-corpus corpus readme --write; verify with --check.