Struct ServiceAccountTokenCredentialProvider 

pub struct ServiceAccountTokenCredentialProvider { /* private fields */ }

Exchanges a service-account credential for an OAuth access token.

The provider returns a token-only Credential with a non-optional absolute expiration and preserves the source service account email as signer identity. This makes service-account JSON loaded by providers such as super::FileCredentialProvider usable as the source of a Google credential granter without requiring the host application to implement the JWT bearer exchange.

The provider performs an OAuth exchange on every call. Cache and refresh behavior remains owned by the outer reqsign_core::Signer or reqsign_core::Granter. It is not inserted into the default credential provider chain.

Example

use reqsign_core::{Context, Granter};
use reqsign_google::{
    CredentialAccessBoundaryGrant, CredentialAccessBoundaryPermissions,
    FileCredentialProvider, ServerSideCredentialAccessBoundaryGranter,
    ServiceAccountTokenCredentialProvider,
};

let source = ServiceAccountTokenCredentialProvider::from_provider(
    FileCredentialProvider::new("/path/to/service-account.json"),
);
let grant = CredentialAccessBoundaryGrant::for_object_prefix(
    "example-bucket",
    "customer-a/",
    CredentialAccessBoundaryPermissions::OBJECT_VIEWER,
);
let credential = Granter::new(
    context,
    source,
    ServerSideCredentialAccessBoundaryGranter::new(grant),
)
.grant(None)
.await?;

Implementations

impl ServiceAccountTokenCredentialProvider

pub fn new(service_account: ServiceAccount) -> Self

Create a provider bound to one service account.

pub fn from_provider( provider: impl ProvideCredential<Credential = Credential> + 'static, ) -> Self

Create a provider that loads its service account from another provider.

None from the source provider is preserved. A returned credential must contain a valid service account; other credential variants are rejected before the OAuth request is sent.

pub fn with_scope(self, scope: impl Into<String>) -> Self

Set the OAuth scope.

This value takes precedence over GOOGLE_SCOPE. When neither is set, the Google Cloud platform scope is used.

Trait Implementations

impl Debug for ServiceAccountTokenCredentialProvider

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl ProvideCredential for ServiceAccountTokenCredentialProvider

type Credential = Credential

Credential returned by this loader.

async fn provide_credential( &self, ctx: &Context, ) -> Result<Option<Self::Credential>>

Load signing credential from current env.