cloud.google.com/go/auth v0.18.2: Options2LO

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify cloud.google.com/go/auth.Options2LO in pkg:golang/cloud.google.com/go/auth@v0.18.2
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/cloud.google.com/go/auth@v0.18.2
Demonstrate these symbols/APIs:
  - cloud.google.com/go/auth.Options2LO

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:8bfbbe31dae299e08b1087de4efd826fb4561ae6e4b2789f38d8a21282c4a8ba","contract":["Options2LO validation fails when options pointer is nil","Options2LO validation fails when Email is missing","Options2LO validation fails when PrivateKey is missing","Options2LO validation fails when TokenURL is missing","Options2LO creates a TokenProvider when required fields are provided","Options2LO exchanges signed JWT assertion for access token","Options2LO with UseIDToken returns id_token as token value","Options2LO with malformed PrivateKey fails during token retrieval"],"goal":"verify cloud.google.com/go/auth.Options2LO in pkg:golang/cloud.google.com/go/auth@v0.18.2","kind":"HOW","packages":["pkg:golang/cloud.google.com/go/auth@v0.18.2"],"schemaVersion":1,"symbols":["cloud.google.com/go/auth.Options2LO"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/cloud.google.com/go/auth@v0.18.2"],"schemaVersion":1,"subject":"pkg:golang/cloud.google.com/go/auth@v0.18.2","symbols":["cloud.google.com/go/auth.Options2LO"],"verifierAdapter":"golang@1"}

module sample

go 1.26.6

require cloud.google.com/go/auth v0.18.2

require (
	cloud.google.com/go/compute/metadata v0.9.0 // indirect
	github.com/googleapis/gax-go/v2 v2.17.0 // indirect
	golang.org/x/sys v0.40.0 // indirect
)

cloud.google.com/go/auth v0.18.2 h1:+Nbt5Ev0xEqxlNjd6c+yYUeosQ5TtEUaNcN/3FozlaM=
cloud.google.com/go/auth v0.18.2/go.mod h1:xD+oY7gcahcu7G2SG2DsBerfFxgPAJz17zz2joOFF3M=
cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
github.com/googleapis/enterprise-certificate-proxy v0.3.11 h1:vAe81Msw+8tKUxi2Dqh/NZMz7475yUvmRIkXr4oN2ao=
github.com/googleapis/enterprise-certificate-proxy v0.3.11/go.mod h1:RFV7MUdlb7AgEq2v7FmMCfeSMCllAzWxFgRdusoGks8=
github.com/googleapis/gax-go/v2 v2.17.0 h1:RksgfBpxqff0EZkDWYuz9q/uWsTVz+kf43LsZ1J6SMc=
github.com/googleapis/gax-go/v2 v2.17.0/go.mod h1:mzaqghpQp4JDh3HvADwrat+6M3MOIDp5YKHhb9PAgDY=
go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus=
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q=
go.opentelemetry.io/otel v1.39.0 h1:8yPrr/S0ND9QEfTfdP9V+SiwT4E0G7Y5MO7p85nis48=
go.opentelemetry.io/otel v1.39.0/go.mod h1:kLlFTywNWrFyEdH0oj2xK0bFYZtHRYUdv1NklR/tgc8=
go.opentelemetry.io/otel/metric v1.39.0 h1:d1UzonvEZriVfpNKEVmHXbdf909uGTOQjA0HF0Ls5Q0=
go.opentelemetry.io/otel/metric v1.39.0/go.mod h1:jrZSWL33sD7bBxg1xjrqyDjnuzTUB0x1nBERXd7Ftcs=
go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6/qCJI=
go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA=
golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8=
golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A=
golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE=
golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8=
google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 h1:VQZ/yAbAtjkHgH80teYd2em3xtIkkHd7ZhqfH2N9CsM=
google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 h1:H86B94AW+VfJWDqFeEbBPhEtHzJwJfTbgE2lZa54ZAQ=
google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ=
google.golang.org/grpc v1.78.0 h1:K1XZG/yGDJnzMdd/uZHAkVqJE+xIDOcmdSFZkBUicNc=
google.golang.org/grpc v1.78.0/go.mod h1:I47qjTo4OKbMkjA/aOOwxDIiPSBofUtQUI5EfpWvW7U=
google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=

package main

import (
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"encoding/pem"
	"fmt"
	"log"

	"cloud.google.com/go/auth"
)

func main() {
	key, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		log.Fatalf("generate key: %v", err)
	}
	keyPEM := pem.EncodeToMemory(&pem.Block{
		Type:  "RSA PRIVATE KEY",
		Bytes: x509.MarshalPKCS1PrivateKey(key),
	})

	opts := &auth.Options2LO{
		Email:      "service-account@example.com",
		PrivateKey: keyPEM,
		TokenURL:   "https://example.com/oauth2/token",
		Scopes:     []string{"https://example.com/auth/read"},
	}

	tp, err := auth.New2LOTokenProvider(opts)
	if err != nil {
		log.Fatalf("new token provider: %v", err)
	}
	fmt.Printf("Initialized 2LO token provider: %T\n", tp)
}

{
  "schemaVersion": 1,
  "goal": "verify cloud.google.com/go/auth.Options2LO in pkg:golang/cloud.google.com/go/auth@v0.18.2",
  "kind": "HOW",
  "packages": [
    "pkg:golang/cloud.google.com/go/auth@v0.18.2"
  ],
  "symbols": [
    "cloud.google.com/go/auth.Options2LO"
  ]
}

package main

import (
	"context"
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"encoding/base64"
	"encoding/pem"
	"fmt"
	"io"
	"net/http"
	"net/url"
	"os"
	"strings"
	"time"

	"cloud.google.com/go/auth"
)

type roundTripFunc func(req *http.Request) (*http.Response, error)

func (f roundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
	return f(req)
}

func generateRSAPrivateKeyPEM() ([]byte, error) {
	key, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return nil, fmt.Errorf("failed to generate rsa key: %w", err)
	}
	return pem.EncodeToMemory(&pem.Block{
		Type:  "RSA PRIVATE KEY",
		Bytes: x509.MarshalPKCS1PrivateKey(key),
	}), nil
}

func main() {
	if err := runTests(); err != nil {
		fmt.Fprintf(os.Stderr, "Contract test failed: %v\n", err)
		os.Exit(1)
	}
	fmt.Println("All contract tests passed successfully.")
}

func runTests() error {
	validKeyPEM, err := generateRSAPrivateKeyPEM()
	if err != nil {
		return err
	}

	// 1. Options2LO validation fails when options pointer is nil
	{
		_, err := auth.New2LOTokenProvider(nil)
		if err == nil || !strings.Contains(err.Error(), "options must be provided") {
			return fmt.Errorf("test 1: expected options must be provided error, got: %v", err)
		}
	}

	// 2. Options2LO validation fails when Email is missing
	{
		opts := &auth.Options2LO{
			PrivateKey: validKeyPEM,
			TokenURL:   "http://localhost/token",
		}
		_, err := auth.New2LOTokenProvider(opts)
		if err == nil || !strings.Contains(err.Error(), "email must be provided") {
			return fmt.Errorf("test 2: expected email must be provided error, got: %v", err)
		}
	}

	// 3. Options2LO validation fails when PrivateKey is missing
	{
		opts := &auth.Options2LO{
			Email:    "service-account@example.com",
			TokenURL: "http://localhost/token",
		}
		_, err := auth.New2LOTokenProvider(opts)
		if err == nil || !strings.Contains(err.Error(), "private key must be provided") {
			return fmt.Errorf("test 3: expected private key must be provided error, got: %v", err)
		}
	}

	// 4. Options2LO validation fails when TokenURL is missing
	{
		opts := &auth.Options2LO{
			Email:      "service-account@example.com",
			PrivateKey: validKeyPEM,
		}
		_, err := auth.New2LOTokenProvider(opts)
		if err == nil || !strings.Contains(err.Error(), "token URL must be provided") {
			return fmt.Errorf("test 4: expected token URL must be provided error, got: %v", err)
		}
	}

	// 5. Options2LO creates a TokenProvider when required fields are provided
	{
		opts := &auth.Options2LO{
			Email:        "service-account@example.com",
			PrivateKey:   validKeyPEM,
			TokenURL:     "http://localhost/token",
			PrivateKeyID: "key-123",
			Scopes:       []string{"https://example.com/auth/read"},
			Subject:      "user@example.com",
			Audience:     "https://example.com/audience",
			Expires:      time.Hour,
		}
		tp, err := auth.New2LOTokenProvider(opts)
		if err != nil {
			return fmt.Errorf("test 5: unexpected error creating provider: %w", err)
		}
		if tp == nil {
			return fmt.Errorf("test 5: expected non-nil provider")
		}
	}

	// 6. Options2LO exchanges signed JWT assertion for access token
	{
		var interceptedBody []byte
		client := &http.Client{
			Transport: roundTripFunc(func(req *http.Request) (*http.Response, error) {
				var rErr error
				interceptedBody, rErr = io.ReadAll(req.Body)
				if rErr != nil {
					return nil, rErr
				}
				resBody := `{"access_token":"mock-access-token-123","token_type":"Bearer","expires_in":3600}`
				return &http.Response{
					StatusCode: http.StatusOK,
					Status:     "200 OK",
					Header:     http.Header{"Content-Type": []string{"application/json"}},
					Body:       io.NopCloser(strings.NewReader(resBody)),
				}, nil
			}),
		}

		opts := &auth.Options2LO{
			Email:        "service-account@example.com",
			PrivateKey:   validKeyPEM,
			TokenURL:     "http://localhost/token",
			PrivateKeyID: "key-123",
			Scopes:       []string{"https://example.com/auth/read"},
			Client:       client,
		}
		tp, err := auth.New2LOTokenProvider(opts)
		if err != nil {
			return fmt.Errorf("test 6: unexpected error creating provider: %w", err)
		}

		token, err := tp.Token(context.Background())
		if err != nil {
			return fmt.Errorf("test 6: unexpected error fetching token: %w", err)
		}
		if token.Value != "mock-access-token-123" {
			return fmt.Errorf("test 6: expected token value 'mock-access-token-123', got %q", token.Value)
		}
		if token.Type != "Bearer" {
			return fmt.Errorf("test 6: expected token type 'Bearer', got %q", token.Type)
		}

		values, err := url.ParseQuery(string(interceptedBody))
		if err != nil {
			return fmt.Errorf("test 6: failed to parse form values: %w", err)
		}
		if values.Get("grant_type") != "urn:ietf:params:oauth:grant-type:jwt-bearer" {
			return fmt.Errorf("test 6: expected jwt-bearer grant_type, got %q", values.Get("grant_type"))
		}
		if values.Get("assertion") == "" {
			return fmt.Errorf("test 6: assertion parameter was empty")
		}
	}

	// 7. Options2LO with UseIDToken returns id_token as token value
	{
		idTokenPayload := base64.RawURLEncoding.EncodeToString([]byte(fmt.Sprintf(`{"exp":%d,"sub":"user@example.com"}`, time.Now().Add(time.Hour).Unix())))
		fakeIDToken := fmt.Sprintf("eyJhbGciOiJSUzI1NiJ9.%s.dummy-signature", idTokenPayload)

		client := &http.Client{
			Transport: roundTripFunc(func(req *http.Request) (*http.Response, error) {
				resBody := fmt.Sprintf(`{"access_token":"dummy","id_token":"%s","token_type":"Bearer","expires_in":3600}`, fakeIDToken)
				return &http.Response{
					StatusCode: http.StatusOK,
					Status:     "200 OK",
					Header:     http.Header{"Content-Type": []string{"application/json"}},
					Body:       io.NopCloser(strings.NewReader(resBody)),
				}, nil
			}),
		}

		opts := &auth.Options2LO{
			Email:      "service-account@example.com",
			PrivateKey: validKeyPEM,
			TokenURL:   "http://localhost/token",
			UseIDToken: true,
			Client:     client,
		}
		tp, err := auth.New2LOTokenProvider(opts)
		if err != nil {
			return fmt.Errorf("test 7: unexpected error creating provider: %w", err)
		}

		token, err := tp.Token(context.Background())
		if err != nil {
			return fmt.Errorf("test 7: unexpected error fetching ID token: %w", err)
		}
		if token.Value != fakeIDToken {
			return fmt.Errorf("test 7: expected ID token %q, got %q", fakeIDToken, token.Value)
		}
	}

	// 8. Options2LO with malformed PrivateKey fails during token retrieval
	{
		opts := &auth.Options2LO{
			Email:      "service-account@example.com",
			PrivateKey: []byte("malformed-private-key"),
			TokenURL:   "http://localhost/token",
		}
		tp, err := auth.New2LOTokenProvider(opts)
		if err != nil {
			return fmt.Errorf("test 8: unexpected error creating provider: %w", err)
		}
		_, err = tp.Token(context.Background())
		if err == nil {
			return fmt.Errorf("test 8: expected error parsing malformed private key, got nil")
		}
	}

	return nil
}