Conversation
…actor _FlowClient Features: - Add support for `impersonated_service_account` type in Application Default Credentials (ADC). - Propagate `quota_project_id` for Service Account credentials in ADC. - Add `ImpersonatedAuthClient` and `clientViaServiceAccountImpersonation` which accept an optional baseClient. Tests: - Add `adc_impersonation_test.dart` to verify full impersonation flow.
…dentity Federation Features: - Add support for `external_account` type in Application Default Credentials (ADC). - Add `StsAuthClient` and `clientViaStsTokenExchange` to handle token exchange with Google SecurityToken Service. - Implement file-sourced and url-sourced credentials for STS exchange. Tests: - Add `sts_auth_client_test.dart` to verify token exchange functionality. - Update `adc_test.dart` to verify `external_account` flow.
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly extends the 'googleapis_auth' library's Application Default Credentials (ADC) functionality. It introduces robust support for 'impersonated_service_account' credentials and 'external_account' credentials, which are crucial for Workload Identity Federation (WIF). These additions enable more flexible and secure authentication patterns, particularly for environments where external identities need to access Google Cloud resources or where one service account needs to act as another. The changes also ensure proper propagation of 'quota_project_id' for service account-based authentication. Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
PR HealthBreaking changes ✔️
This check can be disabled by tagging the PR with Unused Dependencies ✔️
For details on how to fix these, see dependency_validator. This check can be disabled by tagging the PR with Changelog Entry ✔️
Changes to files need to be accounted for in their respective changelogs. This check can be disabled by tagging the PR with License Headers ✔️
All source files should start with a license header. This check can be disabled by tagging the PR with API leaks ✔️The following packages contain symbols visible in the public API, but not exported by the library. Export these symbols or remove them from your publicly visible API.
This check can be disabled by tagging the PR with |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds support for external_account credentials to enable Workload Identity Federation. This is a significant feature addition, including a new StsAuthClient for handling Security Token Service exchanges, and updates to Application Default Credentials logic to use it. The changes are well-structured and include corresponding tests. I've found a potential issue with error handling and a small opportunity for code simplification in the new StsAuthClient.
kevmoo
changed the title
|
take a look @demolaf |
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request introduces support for external_account credentials, enabling Workload Identity Federation. The implementation includes a new StsAuthClient for handling token exchange with the Security Token Service, and updates to Application Default Credentials logic to integrate this new flow. The changes are well-structured, leverage modern Dart features for clarity, and are accompanied by thorough tests. I have one suggestion to improve error handling consistency in the new StsAuthClient.
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request adds support for external_account credentials, enabling Workload Identity Federation. The changes include a new StsAuthClient for handling token exchange with the Google Security Token Service, and updates to Application Default Credentials (ADC) logic to use this new client. The implementation correctly handles both file-sourced and URL-sourced subject tokens, as well as optional service account impersonation. The code is well-structured and includes comprehensive tests for the new functionality. My feedback includes a minor suggestion to improve an error message for better clarity.
1 participant
Features:
external_accounttype in Application Default Credentials (ADC).StsAuthClientandclientViaStsTokenExchangeto handle token exchange with Google SecurityToken Service.Tests:
sts_auth_client_test.dartto verify token exchange functionality.adc_test.dartto verifyexternal_accountflow.