cloud.google.com/go/auth v0.24.1: PKCEOptions

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify cloud.google.com/go/auth.PKCEOptions in pkg:golang/cloud.google.com/go/auth@v0.24.1
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/cloud.google.com/go/auth@v0.24.1
Demonstrate these symbols/APIs:
  - cloud.google.com/go/auth.PKCEOptions

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:559c395b22f1febde6eac4dd99ca41711fe44dcbf9e76e4e82e44dd0f5f65e4e","contract":["PKCEOptions initializes Challenge, ChallengeMethod, and Verifier fields","PKCEOptions with S256 challenge populates code_challenge and code_challenge_method in authorization URL","PKCEOptions with Verifier sends code_verifier in authorization code token exchange request body","PKCEOptions with Challenge and empty ChallengeMethod supplies code_challenge without code_challenge_method","Nil PKCEOptions in AuthorizationHandlerOptions produces authorization URL and token request without PKCE parameters"],"goal":"verify cloud.google.com/go/auth.PKCEOptions in pkg:golang/cloud.google.com/go/auth@v0.24.1","kind":"HOW","packages":["pkg:golang/cloud.google.com/go/auth@v0.24.1"],"schemaVersion":1,"symbols":["cloud.google.com/go/auth.PKCEOptions"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/cloud.google.com/go/auth@v0.24.1"],"schemaVersion":1,"subject":"pkg:golang/cloud.google.com/go/auth@v0.24.1","symbols":["cloud.google.com/go/auth.PKCEOptions"],"verifierAdapter":"golang@1"}

module sample

go 1.26.6

require cloud.google.com/go/auth v0.24.1

require (
	cloud.google.com/go/compute/metadata v0.9.0 // indirect
	github.com/googleapis/gax-go/v2 v2.26.2 // indirect
	golang.org/x/sys v0.47.0 // indirect
)

cloud.google.com/go/auth v0.24.1 h1:NTmd2iJb4DsGIav0KiqFMYI88nMshA2wnFMBatRmoCs=
cloud.google.com/go/auth v0.24.1/go.mod h1:1dmBXa9xfBvBr39ZnDUDkaaA91ccq9CcqENDgJA4d7c=
cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
github.com/googleapis/enterprise-certificate-proxy v0.3.17 h1:73NfMHdiqo9JFU9+7a5ExpVa10/R29pXfZIaW559nrg=
github.com/googleapis/enterprise-certificate-proxy v0.3.17/go.mod h1:rSEsBUemEBZEexP2y6jPp16LUmUbjmSbcPMQizR0o4k=
github.com/googleapis/gax-go/v2 v2.26.2 h1:ydkmNXxj7bEmmeK5AihkKnWxyOyBR9TDebvp5L5izk8=
github.com/googleapis/gax-go/v2 v2.26.2/go.mod h1:sMKqnMesnKH+3wiRJROcttA+cJoZoGbZl1vDQ8XYtGk=
go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o=
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0/go.mod h1:C2NGBr+kAB4bk3xtMXfZ94gqFDtg/GkI7e9zqGh5Beg=
go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU=
go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ=
go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M=
go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s=
go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag=
go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc=
golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
google.golang.org/api v0.288.0 h1:glhO/J88obKP5I269W3hB73dvBKrjU56ZfmNlNXpgTU=
google.golang.org/api v0.288.0/go.mod h1:lM2kYRzYUCBY91P9h6VF1PYmvhxii3O5hji37qRvIcY=
google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d h1:C9v1o0/4quuhOAfmRXA2j+we0PqZIp8traLdeogF3Ms=
google.golang.org/genproto/googleapis/rpc v0.0.0-20260715232425-e75dac1f907d h1:Jkpk39hlTZOIp3RbfvNX9R8Hv+Sw0X89nlU/xFOErsc=
google.golang.org/genproto/googleapis/rpc v0.0.0-20260715232425-e75dac1f907d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=
google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8=
google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=

package main

import (
	"context"
	"encoding/json"
	"fmt"
	"net/http"
	"net/http/httptest"
	"net/url"
	"time"

	"cloud.google.com/go/auth"
)

func main() {
	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		_ = r.ParseForm()
		w.Header().Set("Content-Type", "application/json")
		_ = json.NewEncoder(w).Encode(map[string]any{
			"access_token":  "mock-pkce-access-token",
			"token_type":    "Bearer",
			"refresh_token": "mock-pkce-refresh-token",
			"expires_in":    3600,
		})
	}))
	defer server.Close()

	pkce := &auth.PKCEOptions{
		Challenge:       "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM",
		ChallengeMethod: "S256",
		Verifier:        "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk",
	}

	opts := &auth.Options3LO{
		ClientID:  "pkce-sample-client",
		AuthURL:   server.URL + "/auth",
		TokenURL:  server.URL + "/token",
		AuthStyle: auth.StyleInParams,
		Client:    server.Client(),
		AuthHandlerOpts: &auth.AuthorizationHandlerOptions{
			State:    "sample-pkce-state",
			PKCEOpts: pkce,
			Handler: func(authCodeURL string) (string, string, error) {
				parsed, err := url.Parse(authCodeURL)
				if err != nil {
					return "", "", err
				}
				return "sample-auth-code", parsed.Query().Get("state"), nil
			},
		},
	}

	tp, err := auth.New3LOTokenProvider(opts)
	if err != nil {
		panic(err)
	}

	tok, err := tp.Token(context.Background())
	if err != nil {
		panic(err)
	}

	fmt.Printf("PKCE Token obtained: %s (type: %s, expiry: %s)\n", tok.Value, tok.Type, tok.Expiry.Format(time.RFC3339))
}

{
  "schemaVersion": 1,
  "goal": "verify cloud.google.com/go/auth.PKCEOptions in pkg:golang/cloud.google.com/go/auth@v0.24.1",
  "kind": "HOW",
  "packages": [
    "pkg:golang/cloud.google.com/go/auth@v0.24.1"
  ],
  "symbols": [
    "cloud.google.com/go/auth.PKCEOptions"
  ]
}

package main

import (
	"context"
	"encoding/json"
	"fmt"
	"net/http"
	"net/http/httptest"
	"net/url"
	"os"

	"cloud.google.com/go/auth"
)

func main() {
	if err := runContractTests(); err != nil {
		fmt.Fprintf(os.Stderr, "Contract test failed: %v\n", err)
		os.Exit(1)
	}
	fmt.Println("All contract tests passed successfully.")
}

func runContractTests() error {
	ctx := context.Background()

	// 1. PKCEOptions initializes Challenge, ChallengeMethod, and Verifier fields
	{
		opts := &auth.PKCEOptions{
			Challenge:       "test-challenge-str",
			ChallengeMethod: "S256",
			Verifier:        "test-verifier-str",
		}
		if opts.Challenge != "test-challenge-str" {
			return fmt.Errorf("test 1: expected Challenge 'test-challenge-str', got %q", opts.Challenge)
		}
		if opts.ChallengeMethod != "S256" {
			return fmt.Errorf("test 1: expected ChallengeMethod 'S256', got %q", opts.ChallengeMethod)
		}
		if opts.Verifier != "test-verifier-str" {
			return fmt.Errorf("test 1: expected Verifier 'test-verifier-str', got %q", opts.Verifier)
		}
	}

	// 2. PKCEOptions with S256 challenge populates code_challenge and code_challenge_method in authorization URL
	{
		var receivedChallenge string
		var receivedMethod string
		var receivedState string

		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			w.Header().Set("Content-Type", "application/json")
			_ = json.NewEncoder(w).Encode(map[string]any{
				"access_token": "token-test-2",
				"token_type":   "Bearer",
				"expires_in":   3600,
			})
		}))
		defer server.Close()

		opts := &auth.Options3LO{
			ClientID:  "client-test-2",
			AuthURL:   server.URL + "/auth",
			TokenURL:  server.URL + "/token",
			AuthStyle: auth.StyleInParams,
			Client:    server.Client(),
			AuthHandlerOpts: &auth.AuthorizationHandlerOptions{
				State: "state-test-2",
				PKCEOpts: &auth.PKCEOptions{
					Challenge:       "challenge-abc-123",
					ChallengeMethod: "S256",
					Verifier:        "verifier-abc-123",
				},
				Handler: func(authCodeURL string) (string, string, error) {
					u, err := url.Parse(authCodeURL)
					if err != nil {
						return "", "", err
					}
					receivedChallenge = u.Query().Get("code_challenge")
					receivedMethod = u.Query().Get("code_challenge_method")
					receivedState = u.Query().Get("state")
					return "code-test-2", receivedState, nil
				},
			},
		}

		tp, err := auth.New3LOTokenProvider(opts)
		if err != nil {
			return fmt.Errorf("test 2: New3LOTokenProvider error: %w", err)
		}
		_, err = tp.Token(ctx)
		if err != nil {
			return fmt.Errorf("test 2: Token() error: %w", err)
		}
		if receivedChallenge != "challenge-abc-123" {
			return fmt.Errorf("test 2: expected code_challenge 'challenge-abc-123', got %q", receivedChallenge)
		}
		if receivedMethod != "S256" {
			return fmt.Errorf("test 2: expected code_challenge_method 'S256', got %q", receivedMethod)
		}
	}

	// 3. PKCEOptions with Verifier sends code_verifier in authorization code token exchange request body
	{
		var receivedGrantType string
		var receivedVerifier string
		var receivedCode string

		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			_ = r.ParseForm()
			receivedGrantType = r.Form.Get("grant_type")
			receivedVerifier = r.Form.Get("code_verifier")
			receivedCode = r.Form.Get("code")

			w.Header().Set("Content-Type", "application/json")
			_ = json.NewEncoder(w).Encode(map[string]any{
				"access_token": "token-test-3",
				"token_type":   "Bearer",
				"expires_in":   3600,
			})
		}))
		defer server.Close()

		opts := &auth.Options3LO{
			ClientID:  "client-test-3",
			AuthURL:   server.URL + "/auth",
			TokenURL:  server.URL + "/token",
			AuthStyle: auth.StyleInParams,
			Client:    server.Client(),
			AuthHandlerOpts: &auth.AuthorizationHandlerOptions{
				State: "state-test-3",
				PKCEOpts: &auth.PKCEOptions{
					Challenge:       "challenge-xyz-789",
					ChallengeMethod: "S256",
					Verifier:        "verifier-secret-token-value",
				},
				Handler: func(authCodeURL string) (string, string, error) {
					return "auth-code-test-3", "state-test-3", nil
				},
			},
		}

		tp, err := auth.New3LOTokenProvider(opts)
		if err != nil {
			return fmt.Errorf("test 3: New3LOTokenProvider error: %w", err)
		}
		tok, err := tp.Token(ctx)
		if err != nil {
			return fmt.Errorf("test 3: Token() error: %w", err)
		}
		if tok.Value != "token-test-3" {
			return fmt.Errorf("test 3: unexpected token value %q", tok.Value)
		}
		if receivedGrantType != "authorization_code" {
			return fmt.Errorf("test 3: expected grant_type 'authorization_code', got %q", receivedGrantType)
		}
		if receivedCode != "auth-code-test-3" {
			return fmt.Errorf("test 3: expected code 'auth-code-test-3', got %q", receivedCode)
		}
		if receivedVerifier != "verifier-secret-token-value" {
			return fmt.Errorf("test 3: expected code_verifier 'verifier-secret-token-value', got %q", receivedVerifier)
		}
	}

	// 4. PKCEOptions with Challenge and empty ChallengeMethod supplies code_challenge without code_challenge_method
	{
		var receivedChallenge string
		var hasMethodParam bool

		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			w.Header().Set("Content-Type", "application/json")
			_ = json.NewEncoder(w).Encode(map[string]any{
				"access_token": "token-test-4",
				"token_type":   "Bearer",
				"expires_in":   3600,
			})
		}))
		defer server.Close()

		opts := &auth.Options3LO{
			ClientID:  "client-test-4",
			AuthURL:   server.URL + "/auth",
			TokenURL:  server.URL + "/token",
			AuthStyle: auth.StyleInParams,
			Client:    server.Client(),
			AuthHandlerOpts: &auth.AuthorizationHandlerOptions{
				State: "state-test-4",
				PKCEOpts: &auth.PKCEOptions{
					Challenge:       "plain-challenge-only",
					ChallengeMethod: "",
					Verifier:        "plain-verifier-only",
				},
				Handler: func(authCodeURL string) (string, string, error) {
					u, err := url.Parse(authCodeURL)
					if err != nil {
						return "", "", err
					}
					receivedChallenge = u.Query().Get("code_challenge")
					_, hasMethodParam = u.Query()["code_challenge_method"]
					return "code-test-4", "state-test-4", nil
				},
			},
		}

		tp, err := auth.New3LOTokenProvider(opts)
		if err != nil {
			return fmt.Errorf("test 4: New3LOTokenProvider error: %w", err)
		}
		_, err = tp.Token(ctx)
		if err != nil {
			return fmt.Errorf("test 4: Token() error: %w", err)
		}
		if receivedChallenge != "plain-challenge-only" {
			return fmt.Errorf("test 4: expected code_challenge 'plain-challenge-only', got %q", receivedChallenge)
		}
		if hasMethodParam {
			return fmt.Errorf("test 4: expected no code_challenge_method parameter in URL")
		}
	}

	// 5. Nil PKCEOptions in AuthorizationHandlerOptions produces authorization URL and token request without PKCE parameters
	{
		var hasChallengeParam bool
		var hasMethodParam bool
		var hasVerifierParam bool

		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			_ = r.ParseForm()
			_, hasVerifierParam = r.Form["code_verifier"]

			w.Header().Set("Content-Type", "application/json")
			_ = json.NewEncoder(w).Encode(map[string]any{
				"access_token": "token-test-5",
				"token_type":   "Bearer",
				"expires_in":   3600,
			})
		}))
		defer server.Close()

		opts := &auth.Options3LO{
			ClientID:  "client-test-5",
			AuthURL:   server.URL + "/auth",
			TokenURL:  server.URL + "/token",
			AuthStyle: auth.StyleInParams,
			Client:    server.Client(),
			AuthHandlerOpts: &auth.AuthorizationHandlerOptions{
				State:    "state-test-5",
				PKCEOpts: nil,
				Handler: func(authCodeURL string) (string, string, error) {
					u, err := url.Parse(authCodeURL)
					if err != nil {
						return "", "", err
					}
					_, hasChallengeParam = u.Query()["code_challenge"]
					_, hasMethodParam = u.Query()["code_challenge_method"]
					return "code-test-5", "state-test-5", nil
				},
			},
		}

		tp, err := auth.New3LOTokenProvider(opts)
		if err != nil {
			return fmt.Errorf("test 5: New3LOTokenProvider error: %w", err)
		}
		_, err = tp.Token(ctx)
		if err != nil {
			return fmt.Errorf("test 5: Token() error: %w", err)
		}
		if hasChallengeParam {
			return fmt.Errorf("test 5: unexpected code_challenge parameter in URL when PKCEOpts is nil")
		}
		if hasMethodParam {
			return fmt.Errorf("test 5: unexpected code_challenge_method parameter in URL when PKCEOpts is nil")
		}
		if hasVerifierParam {
			return fmt.Errorf("test 5: unexpected code_verifier parameter in token request when PKCEOpts is nil")
		}
	}

	return nil
}