feat: support google idtoken authentication in iam http client

Author: Chief-Rishab

plugins/identities/http.go

@@ -1,6 +1,7 @@
 package identities
 
 import (
+	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -10,14 +11,16 @@ import (
 	"github.com/go-playground/validator/v10"
 	"github.com/mcuadros/go-defaults"
 	"github.com/raystack/guardian/domain"
+	"golang.org/x/oauth2"
+	"google.golang.org/api/idtoken"
 )
 
 var ErrFailedRequest = errors.New("request failed")
 
 const UserIDWildcard = "{user_id}"
 
 type HTTPAuthConfig struct {
-	Type string `mapstructure:"type" json:"type" yaml:"type" validate:"required,oneof=basic api_key bearer"`
+	Type string `mapstructure:"type" json:"type" yaml:"type" validate:"required,oneof=basic api_key bearer google_idtoken"`
 
 	// basic auth
 	Username string `mapstructure:"username,omitempty" json:"username,omitempty" yaml:"username,omitempty" validate:"required_if=Type basic"`
@@ -30,6 +33,11 @@ type HTTPAuthConfig struct {
 
 	// bearer
 	Token string `mapstructure:"token,omitempty" json:"token,omitempty" yaml:"token,omitempty" validate:"required_if=Type bearer"`
+
+	// google_idtoken
+	Audience string `mapstructure:"audience,omitempty" json:"audience,omitempty" yaml:"audience,omitempty" validate:"required_if=Type google_idtoken"`
+	// TODO: allow base64 encoded credentials
+	CredentialsJSON string `mapstructure:"credentials_json,omitempty" json:"credentials_json,omitempty" yaml:"credentials_json,omitempty" validate:"required_if=Type google_idtoken"`
 }
 
 // HTTPClientConfig is the configuration required by iam.Client
@@ -72,6 +80,14 @@ func (c *HTTPClientConfig) Encrypt() error {
 			}
 			c.Auth.Token = encryptedValue
 		}
+
+		if c.Auth.CredentialsJSON != "" {
+			encryptedValue, err := c.crypto.Encrypt(c.Auth.CredentialsJSON)
+			if err != nil {
+				return err
+			}
+			c.Auth.CredentialsJSON = encryptedValue
+		}
 	}
 
 	return nil
@@ -102,6 +118,14 @@ func (c *HTTPClientConfig) Decrypt() error {
 			}
 			c.Auth.Token = decryptedValue
 		}
+
+		if c.Auth.CredentialsJSON != "" {
+			decryptedValue, err := c.crypto.Decrypt(c.Auth.CredentialsJSON)
+			if err != nil {
+				return err
+			}
+			c.Auth.CredentialsJSON = decryptedValue
+		}
 	}
 
 	return nil
@@ -126,6 +150,15 @@ func NewHTTPClient(config *HTTPClientConfig) (*HTTPClient, error) {
 		httpClient = http.DefaultClient
 	}
 
+	if config.Auth.Type == "google_idtoken" {
+		ctx := context.Background()
+		ts, err := idtoken.NewTokenSource(ctx, config.Auth.Audience, idtoken.WithCredentialsJSON([]byte(config.Auth.CredentialsJSON)))
+		if err != nil {
+			return nil, err
+		}
+		httpClient = oauth2.NewClient(ctx, ts)
+	}
+
 	return &HTTPClient{
 		httpClient: httpClient,
 		config:     config,