Mint an OAuth2 access token from a GCP service-account key (JWT bearer flow).
(service_account: dict)
| 42 | |
| 43 | |
| 44 | def mint_gcp_access_token(service_account: dict) -> str: |
| 45 | """Mint an OAuth2 access token from a GCP service-account key (JWT bearer flow).""" |
| 46 | now = int(time.time()) |
| 47 | assertion = jwt.encode( |
| 48 | { |
| 49 | "iss": service_account["client_email"], |
| 50 | "scope": GCP_SCOPE, |
| 51 | "aud": "https://oauth2.googleapis.com/token", |
| 52 | "iat": now, |
| 53 | "exp": now + 3600, |
| 54 | }, |
| 55 | service_account["private_key"], |
| 56 | algorithm="RS256", |
| 57 | ) |
| 58 | body = urllib.parse.urlencode( |
| 59 | { |
| 60 | "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer", |
| 61 | "assertion": assertion, |
| 62 | } |
| 63 | ).encode() |
| 64 | req = urllib.request.Request( |
| 65 | "https://oauth2.googleapis.com/token", |
| 66 | data=body, |
| 67 | headers={"Content-Type": "application/x-www-form-urlencoded"}, |
| 68 | ) |
| 69 | with urllib.request.urlopen(req) as resp: |
| 70 | return json.loads(resp.read())["access_token"] |
| 71 | |
| 72 | |
| 73 | def biglake_request( |
no test coverage detected