Struct ServiceAccountImpersonationGranter 

pub struct ServiceAccountImpersonationGranter { /* private fields */ }

Exchanges a token-only Google credential through IAM Credentials generateAccessToken.

The source must contain an OAuth access token with a known absolute expiration and no service-account private key. The source must remain valid long enough for the IAM request. The returned credential is token-only, carries Google’s authoritative expireTime, preserves the target signer identity for query signing, and is directly consumable by Google request signers and Credential Access Boundary granters.

None as the requested lifetime omits the lifetime field and lets Google apply its one-hour default. Explicit lifetimes must leave enough time for a Google operation and not exceed 12 hours. Google requires an organization policy to allow lifetimes above one hour.

Every call performs a new IAM Credentials exchange. Granted outputs are not cached by this service granter.

Example

use std::time::Duration;

use reqsign_core::{Context, Granter, time::Timestamp};
use reqsign_google::{
    ServiceAccountImpersonationGrant, ServiceAccountImpersonationGranter,
    TokenCredentialProvider,
};

let source = TokenCredentialProvider::new("source-oauth-token")
    .with_expires_at(Timestamp::now() + Duration::from_secs(3600));
let grant = ServiceAccountImpersonationGrant::new(
    "target@example.iam.gserviceaccount.com",
    ["https://www.googleapis.com/auth/cloud-platform"],
);
// Supply a Context configured with an HttpSend implementation.
let context = Context::new();
let credential = Granter::new(
    context,
    source,
    ServiceAccountImpersonationGranter::new(grant),
)
.grant(Some(Duration::from_secs(3600)))
.await?;

Implementations

impl ServiceAccountImpersonationGranter

pub fn new(grant: ServiceAccountImpersonationGrant) -> Self

Create a granter for a bound service-account impersonation grant.

pub fn with_grant(self, grant: ServiceAccountImpersonationGrant) -> Self

Replace the bound target, scopes, and delegates.

Trait Implementations

impl Clone for ServiceAccountImpersonationGranter

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ServiceAccountImpersonationGranter

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl GrantCredential for ServiceAccountImpersonationGranter

type Credential = Credential

Credential used as the source and returned as the granted result.

fn required_valid_until( &self, _credential: &Self::Credential, _expires_in: Option<Duration>, ) -> Timestamp

Return the timestamp through which the source credential must remain usable.

async fn grant_credential( &self, ctx: &Context, credential: &Self::Credential, expires_in: Option<Duration>, ) -> Result<Self::Credential>

Grant a bounded, expiring credential from an existing service credential.