class Google::Auth::ServiceAccountCredentials

cf [Application Default Credentials](cloud.google.com/docs/authentication/production)
console (via ‘Generate new Json Key’).
from credentials from a json key file downloaded from the developer
This class allows authorizing requests for service accounts directly
OAuth access token.
Authenticates requests using Google’s Service Account credentials via an

def self.make_creds options = {}

Parameters:
  • scope (string|array|nil) -- the scope(s) to access
  • json_key_io (IO) -- an IO from which the JSON key can be read 
def self.make_creds options = {}
  json_key_io, scope, enable_self_signed_jwt, target_audience, audience, token_credential_uri =
    options.values_at :json_key_io, :scope, :enable_self_signed_jwt, :target_audience,
                      :audience, :token_credential_uri
  raise ArgumentError, "Cannot specify both scope and target_audience" if scope && target_audience
  if json_key_io
    private_key, client_email, project_id, quota_project_id, universe_domain = read_json_key json_key_io
  else
    private_key = unescape ENV[CredentialsLoader::PRIVATE_KEY_VAR]
    client_email = ENV[CredentialsLoader::CLIENT_EMAIL_VAR]
    project_id = ENV[CredentialsLoader::PROJECT_ID_VAR]
    quota_project_id = nil
    universe_domain = nil
  end
  project_id ||= CredentialsLoader.load_gcloud_project_id
  new(token_credential_uri:   token_credential_uri || TOKEN_CRED_URI,
      audience:               audience || TOKEN_CRED_URI,
      scope:                  scope,
      enable_self_signed_jwt: enable_self_signed_jwt,
      target_audience:        target_audience,
      issuer:                 client_email,
      signing_key:            OpenSSL::PKey::RSA.new(private_key),
      project_id:             project_id,
      quota_project_id:       quota_project_id,
      universe_domain:        universe_domain || "googleapis.com")
    .configure_connection(options)
end

def self.unescape str

enclosing quotes.
Specifically, interprets the "\n" sequence for newline, and removes
Handles certain escape sequences that sometimes appear in input. 
def self.unescape str
  str = str.gsub '\n', "\n"
  str = str[1..-2] if str.start_with?('"') && str.end_with?('"')
  str
end

def apply! a_hash, opts = {}

ServiceAccountJwtHeaderCredentials for certain cases.
Extends the base class to use a transient 
def apply! a_hash, opts = {}
  if enable_self_signed_jwt?
    apply_self_signed_jwt! a_hash
  else
    super
  end
end

def apply_self_signed_jwt! a_hash 

def apply_self_signed_jwt! a_hash
  # Use the ServiceAccountJwtHeaderCredentials using the same cred values
  cred_json = {
    private_key: @signing_key.to_s,
    client_email: @issuer,
    project_id: @project_id,
    quota_project_id: @quota_project_id
  }
  key_io = StringIO.new MultiJson.dump(cred_json)
  alt = ServiceAccountJwtHeaderCredentials.make_creds json_key_io: key_io, scope: scope
  alt.logger = logger
  alt.apply! a_hash
end

def enable_self_signed_jwt? 

def enable_self_signed_jwt?
  # Use a self-singed JWT if there's no information that can be used to
  # obtain an OAuth token, OR if there are scopes but also an assertion
  # that they are default scopes that shouldn't be used to fetch a token,
  # OR we are not in the default universe and thus OAuth isn't supported.
  target_audience.nil? && (scope.nil? || @enable_self_signed_jwt || universe_domain != "googleapis.com")
end

def initialize options = {} 

def initialize options = {}
  @project_id = options[:project_id]
  @quota_project_id = options[:quota_project_id]
  @enable_self_signed_jwt = options[:enable_self_signed_jwt] ? true : false
  super options
end

def needs_access_token?

Modifies this logic so it also requires self-signed-jwt to be disabled 
def needs_access_token?
  super && !enable_self_signed_jwt?
end