Function optionsForServiceAccountScopes

internal/googleapi/client.go:173–208

(ctx context.Context, serviceLabel string, email string, scopes []string)

}

func optionsForServiceAccountScopes(ctx context.Context, serviceLabel string, email string, scopes []string) ([]option.ClientOption, error) {
	if dependencies, ok := authDependenciesFromContext(ctx); ok && dependencies.Mode == AuthModeADC {
		slog.Debug("using Application Default Credentials (GOG_AUTH_MODE=adc)", "serviceLabel", serviceLabel)

		ts, err := dependencies.adcTokenSource(ctx, scopes)
		if err != nil {
			return nil, err
		}

		return tokenSourceClientOptions(ctx, ts), nil
	}

	if accessToken := authclient.AccessTokenFromContext(ctx); accessToken != "" {
		slog.Debug("using direct access token", "serviceLabel", serviceLabel)

		return tokenSourceClientOptions(ctx, oauth2.StaticTokenSource(&oauth2.Token{AccessToken: accessToken})), nil
	}

	dependencies, err := requireAuthDependencies(ctx)
	if err != nil {
		return nil, err
	}

	ts, path, ok, err := tokenSourceForServiceAccountScopes(ctx, dependencies, serviceLabel, email, scopes)
	if err != nil {
		return nil, fmt.Errorf("service account token source: %w", err)
	}

	if !ok {
		return nil, &AuthRequiredError{Service: serviceLabel, Email: email}
	}

	slog.Debug("using required service account credentials", "email", email, "path", path)

	return tokenSourceClientOptions(ctx, ts), nil
}

func tokenSourceClientOptions(ctx context.Context, ts oauth2.TokenSource) []option.ClientOption {
	return []option.ClientOption{option.WithHTTPClient(&http.Client{