module Google::Auth::ExternalAccount::BaseCredentials

def base_setup options
  self.default_connection = options[:connection]
  @audience = options[:audience]
  @scope = options[:scope] || IAM_SCOPE
  @subject_token_type = options[:subject_token_type]
  @token_url = options[:token_url]
  @token_info_url = options[:token_info_url]
  @service_account_impersonation_url = options[:service_account_impersonation_url]
  @service_account_impersonation_options = options[:service_account_impersonation_options] || {}
  @client_id = options[:client_id]
  @client_secret = options[:client_secret]
  @quota_project_id = options[:quota_project_id]
  @project_id = nil
  @workforce_pool_user_project = options[:workforce_pool_user_project]
  @expires_at = nil
  @access_token = nil
  @sts_client = Google::Auth::OAuth2::STSClient.new(
    token_exchange_endpoint: @token_url,
    connection: default_connection
  )
  return unless @workforce_pool_user_project && !is_workforce_pool?
  raise "workforce_pool_user_project should not be set for non-workforce pool credentials."
end

def exchange_token
  additional_options = nil
  if @client_id.nil? && @workforce_pool_user_project
    additional_options = { userProject: @workforce_pool_user_project }
  end
  @sts_client.exchange_token(
    audience: @audience,
    grant_type: STS_GRANT_TYPE,
    subject_token: retrieve_subject_token!,
    subject_token_type: @subject_token_type,
    scopes: @service_account_impersonation_url ? IAM_SCOPE : @scope,
    requested_token_type: STS_REQUESTED_TOKEN_TYPE,
    additional_options: additional_options
  )
end

def expires_at= new_expires_at
  @expires_at = normalize_timestamp new_expires_at
end

def expires_within? seconds
  # This method is needed for BaseClient
  @expires_at && @expires_at - Time.now.utc < seconds
end

def fetch_access_token! _options = {}
  # This method is needed for BaseClient
  response = exchange_token
  if @service_account_impersonation_url
    impersonated_response = get_impersonated_access_token response["access_token"]
    self.expires_at = impersonated_response["expireTime"]
    self.access_token = impersonated_response["accessToken"]
  else
    # Extract the expiration time in seconds from the response and calculate the actual expiration time
    # and then save that to the expiry variable.
    self.expires_at = Time.now.utc + response["expires_in"].to_i
    self.access_token = response["access_token"]
  end
  notify_refresh_listeners
end

def get_impersonated_access_token token, _options = {}
  response = connection.post @service_account_impersonation_url do |req|
    req.headers["Authorization"] = "Bearer #{token}"
    req.headers["Content-Type"] = "application/json"
    req.body = MultiJson.dump({ scope: @scope })
  end
  if response.status != 200
    raise "Service account impersonation failed with status #{response.status}"
  end
  MultiJson.load response.body
end

def is_workforce_pool?
  pattern = "//iam\.googleapis\.com/locations/[^/]+/workforcePools/"
  /#{pattern}/.match?(@audience || "")
end

def retrieve_subject_token!
  raise NotImplementedError
end

def token_type
  # This method is needed for BaseClient
  :access_token
end