cloud.google.com/go/auth v0.24.1

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:golang/cloud.google.com/go/auth@v0.24.1
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/cloud.google.com/go/auth@v0.24.1

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:f8d8e791a492e5da00ecea2f757468dc4bd7debba5c44347cedda74609648700","contract":["StyleInHeader constant is a valid Style distinct from StyleUnknown and StyleInParams","Options3LO with StyleInHeader satisfies authentication style validation","New3LOTokenProvider with StyleInHeader sends client credentials in HTTP Basic Authorization header","New3LOTokenProvider with StyleInHeader omits client credentials from the request body","Token provider configured with StyleInHeader successfully exchanges refresh token for a valid Token"],"goal":"verify pkg:golang/cloud.google.com/go/auth@v0.24.1","kind":"HOW","packages":["pkg:golang/cloud.google.com/go/auth@v0.24.1"],"schemaVersion":1},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/cloud.google.com/go/auth@v0.24.1"],"schemaVersion":1,"subject":"pkg:golang/cloud.google.com/go/auth@v0.24.1","verifierAdapter":"golang@1"}

module sample

go 1.26.6

require cloud.google.com/go/auth v0.24.1

require (
	cloud.google.com/go/compute/metadata v0.9.0 // indirect
	github.com/googleapis/gax-go/v2 v2.26.2 // indirect
	golang.org/x/sys v0.47.0 // indirect
)

cloud.google.com/go/auth v0.24.1 h1:NTmd2iJb4DsGIav0KiqFMYI88nMshA2wnFMBatRmoCs=
cloud.google.com/go/auth v0.24.1/go.mod h1:1dmBXa9xfBvBr39ZnDUDkaaA91ccq9CcqENDgJA4d7c=
cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
github.com/googleapis/enterprise-certificate-proxy v0.3.17 h1:73NfMHdiqo9JFU9+7a5ExpVa10/R29pXfZIaW559nrg=
github.com/googleapis/enterprise-certificate-proxy v0.3.17/go.mod h1:rSEsBUemEBZEexP2y6jPp16LUmUbjmSbcPMQizR0o4k=
github.com/googleapis/gax-go/v2 v2.26.2 h1:ydkmNXxj7bEmmeK5AihkKnWxyOyBR9TDebvp5L5izk8=
github.com/googleapis/gax-go/v2 v2.26.2/go.mod h1:sMKqnMesnKH+3wiRJROcttA+cJoZoGbZl1vDQ8XYtGk=
go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o=
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0/go.mod h1:C2NGBr+kAB4bk3xtMXfZ94gqFDtg/GkI7e9zqGh5Beg=
go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU=
go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ=
go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M=
go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s=
go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag=
go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc=
golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
google.golang.org/api v0.288.0 h1:glhO/J88obKP5I269W3hB73dvBKrjU56ZfmNlNXpgTU=
google.golang.org/api v0.288.0/go.mod h1:lM2kYRzYUCBY91P9h6VF1PYmvhxii3O5hji37qRvIcY=
google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d h1:C9v1o0/4quuhOAfmRXA2j+we0PqZIp8traLdeogF3Ms=
google.golang.org/genproto/googleapis/rpc v0.0.0-20260715232425-e75dac1f907d h1:Jkpk39hlTZOIp3RbfvNX9R8Hv+Sw0X89nlU/xFOErsc=
google.golang.org/genproto/googleapis/rpc v0.0.0-20260715232425-e75dac1f907d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=
google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8=
google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=

package main

import (
	"context"
	"encoding/base64"
	"encoding/json"
	"fmt"
	"net/http"
	"net/http/httptest"
	"strings"

	"cloud.google.com/go/auth"
)

func main() {
	// Demonstrating cloud.google.com/go/auth.StyleInHeader and New3LOTokenProvider
	fmt.Printf("StyleInHeader constant value: %d\n", auth.StyleInHeader)

	// Set up a mock OAuth2 token endpoint that validates HTTP Basic Auth
	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		authHeader := r.Header.Get("Authorization")
		if !strings.HasPrefix(authHeader, "Basic ") {
			http.Error(w, "missing Basic Authorization header", http.StatusUnauthorized)
			return
		}

		payload, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(authHeader, "Basic "))
		if err != nil || string(payload) != "sample-client-id:sample-client-secret" {
			http.Error(w, "invalid client credentials in header", http.StatusUnauthorized)
			return
		}

		w.Header().Set("Content-Type", "application/json")
		_ = json.NewEncoder(w).Encode(map[string]any{
			"access_token":  "mock-access-token-via-header",
			"token_type":    "Bearer",
			"expires_in":    3600,
			"refresh_token": "mock-refresh-token",
		})
	}))
	defer server.Close()

	// Configure 3LO options using auth.StyleInHeader
	opts := &auth.Options3LO{
		ClientID:     "sample-client-id",
		ClientSecret: "sample-client-secret",
		AuthURL:      server.URL + "/auth",
		TokenURL:     server.URL + "/token",
		AuthStyle:    auth.StyleInHeader,
		RefreshToken: "initial-refresh-token",
		Client:       server.Client(),
	}

	tp, err := auth.New3LOTokenProvider(opts)
	if err != nil {
		fmt.Printf("Failed to create TokenProvider: %v\n", err)
		return
	}

	ctx := context.Background()
	tok, err := tp.Token(ctx)
	if err != nil {
		fmt.Printf("Failed to obtain token: %v\n", err)
		return
	}

	fmt.Printf("Successfully obtained token: %s (valid: %t)\n", tok.Value, tok.IsValid())
}

{
  "schemaVersion": 1,
  "goal": "verify pkg:golang/cloud.google.com/go/auth@v0.24.1",
  "kind": "HOW",
  "packages": [
    "pkg:golang/cloud.google.com/go/auth@v0.24.1"
  ]
}

package main

import (
	"context"
	"encoding/base64"
	"encoding/json"
	"fmt"
	"net/http"
	"net/http/httptest"
	"net/url"
	"os"
	"strings"

	"cloud.google.com/go/auth"
)

func main() {
	if err := runContractTests(); err != nil {
		fmt.Fprintf(os.Stderr, "Contract test failed: %v\n", err)
		os.Exit(1)
	}
	fmt.Println("All contract tests passed successfully.")
}

func runContractTests() error {
	ctx := context.Background()

	// 1. StyleInHeader constant is a valid Style distinct from StyleUnknown and StyleInParams
	{
		if auth.StyleInHeader == auth.StyleUnknown {
			return fmt.Errorf("assertion 1 failed: StyleInHeader must not equal StyleUnknown")
		}
		if auth.StyleInHeader == auth.StyleInParams {
			return fmt.Errorf("assertion 1 failed: StyleInHeader must not equal StyleInParams")
		}
		if auth.StyleInHeader != auth.Style(2) {
			return fmt.Errorf("assertion 1 failed: expected StyleInHeader to have int value 2, got %d", int(auth.StyleInHeader))
		}
	}

	// 2. Options3LO with StyleInHeader satisfies authentication style validation
	{
		optsUnknown := &auth.Options3LO{
			ClientID:     "test-client-id",
			ClientSecret: "test-client-secret",
			AuthURL:      "http://localhost/auth",
			TokenURL:     "http://localhost/token",
			AuthStyle:    auth.StyleUnknown,
			RefreshToken: "test-refresh-token",
		}
		if _, err := auth.New3LOTokenProvider(optsUnknown); err == nil || !strings.Contains(err.Error(), "auth style must be provided") {
			return fmt.Errorf("assertion 2 failed: expected 'auth style must be provided' error with StyleUnknown, got: %v", err)
		}

		optsHeader := &auth.Options3LO{
			ClientID:     "test-client-id",
			ClientSecret: "test-client-secret",
			AuthURL:      "http://localhost/auth",
			TokenURL:     "http://localhost/token",
			AuthStyle:    auth.StyleInHeader,
			RefreshToken: "test-refresh-token",
		}
		if _, err := auth.New3LOTokenProvider(optsHeader); err != nil {
			return fmt.Errorf("assertion 2 failed: expected StyleInHeader to pass validation, got: %v", err)
		}
	}

	// 3. New3LOTokenProvider with StyleInHeader sends client credentials in HTTP Basic Authorization header
	// 4. New3LOTokenProvider with StyleInHeader omits client credentials from the request body
	// 5. Token provider configured with StyleInHeader successfully exchanges refresh token for a valid Token
	{
		var receivedAuthHeader string
		var receivedBodyForm url.Values

		expectedClientID := "client-app-123"
		expectedClientSecret := "secret-xyz-456"

		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			receivedAuthHeader = r.Header.Get("Authorization")
			_ = r.ParseForm()
			receivedBodyForm = r.Form

			w.Header().Set("Content-Type", "application/json")
			_ = json.NewEncoder(w).Encode(map[string]any{
				"access_token":  "mock-token-from-header-auth",
				"token_type":    "Bearer",
				"expires_in":    7200,
				"refresh_token": "next-refresh-token",
			})
		}))
		defer server.Close()

		opts := &auth.Options3LO{
			ClientID:     expectedClientID,
			ClientSecret: expectedClientSecret,
			AuthURL:      server.URL + "/auth",
			TokenURL:     server.URL + "/token",
			AuthStyle:    auth.StyleInHeader,
			RefreshToken: "valid-initial-refresh-token",
			Client:       server.Client(),
		}

		tp, err := auth.New3LOTokenProvider(opts)
		if err != nil {
			return fmt.Errorf("failed to create 3LO token provider: %w", err)
		}

		tok, err := tp.Token(ctx)
		if err != nil {
			return fmt.Errorf("failed to retrieve token: %w", err)
		}

		// Check Assertion 3: HTTP Basic Authorization header
		if !strings.HasPrefix(receivedAuthHeader, "Basic ") {
			return fmt.Errorf("assertion 3 failed: expected Basic auth header, got %q", receivedAuthHeader)
		}
		rawCreds, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(receivedAuthHeader, "Basic "))
		if err != nil {
			return fmt.Errorf("assertion 3 failed: failed to decode Basic auth credentials: %w", err)
		}
		expectedCreds := url.QueryEscape(expectedClientID) + ":" + url.QueryEscape(expectedClientSecret)
		if string(rawCreds) != expectedCreds {
			return fmt.Errorf("assertion 3 failed: expected basic auth %q, got %q", expectedCreds, string(rawCreds))
		}

		// Check Assertion 4: client credentials omitted from request body
		if receivedBodyForm.Get("client_id") != "" {
			return fmt.Errorf("assertion 4 failed: client_id must not be sent in request body with StyleInHeader, got %q", receivedBodyForm.Get("client_id"))
		}
		if receivedBodyForm.Get("client_secret") != "" {
			return fmt.Errorf("assertion 4 failed: client_secret must not be sent in request body with StyleInHeader, got %q", receivedBodyForm.Get("client_secret"))
		}
		if receivedBodyForm.Get("grant_type") != "refresh_token" {
			return fmt.Errorf("assertion 4 failed: expected grant_type=refresh_token in body, got %q", receivedBodyForm.Get("grant_type"))
		}

		// Check Assertion 5: successful token exchange
		if tok == nil {
			return fmt.Errorf("assertion 5 failed: expected non-nil token")
		}
		if tok.Value != "mock-token-from-header-auth" {
			return fmt.Errorf("assertion 5 failed: expected token value 'mock-token-from-header-auth', got %q", tok.Value)
		}
		if tok.Type != "Bearer" && tok.Type != "bearer" {
			return fmt.Errorf("assertion 5 failed: expected token type Bearer, got %q", tok.Type)
		}
		if !tok.IsValid() {
			return fmt.Errorf("assertion 5 failed: expected token to be valid")
		}
	}

	return nil
}