google.golang.org/genproto/googleapis/rpc v0.0.0-20260825221802-da73d73af1c5: attribute_context.AttributeContext_Auth

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify google.golang.org/genproto/googleapis/rpc/context/attribute_context.AttributeContext_Auth in pkg:golang/google.golang.org/genproto/googleapis/rpc@v0.0.0-20260825221802-da73d73af1c5
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/google.golang.org/genproto/googleapis/rpc@v0.0.0-20260825221802-da73d73af1c5
Demonstrate these symbols/APIs:
  - google.golang.org/genproto/googleapis/rpc/context/attribute_context.AttributeContext_Auth

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:0d1affe3484cd57ac273ea25aa10cd56e56b5f58b416371edb43627c76fc38da","contract":["AttributeContext_Auth initializes with principal, audiences, presenter, claims, and access levels","AttributeContext_Auth getters return expected principal, audiences, and presenter values","AttributeContext_Auth GetClaims returns structured claims and nil when unset","AttributeContext_Auth GetAccessLevels returns configured access level resource names","AttributeContext_Auth Reset clears all fields to zero values"],"goal":"verify google.golang.org/genproto/googleapis/rpc/context/attribute_context.AttributeContext_Auth in pkg:golang/google.golang.org/genproto/googleapis/rpc@v0.0.0-20260825221802-da73d73af1c5","kind":"HOW","packages":["pkg:golang/google.golang.org/genproto/googleapis/rpc@v0.0.0-20260825221802-da73d73af1c5"],"schemaVersion":1,"symbols":["google.golang.org/genproto/googleapis/rpc/context/attribute_context.AttributeContext_Auth"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","language":"go","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/google.golang.org/genproto/googleapis/rpc@v0.0.0-20260825221802-da73d73af1c5"],"schemaVersion":1,"subject":"pkg:golang/google.golang.org/genproto/googleapis/rpc@v0.0.0-20260825221802-da73d73af1c5","symbols":["google.golang.org/genproto/googleapis/rpc/context/attribute_context.AttributeContext_Auth"],"verifierAdapter":"golang@1"}

module sample

go 1.26.6

require (
	google.golang.org/genproto/googleapis/rpc v0.0.0-20260825221802-da73d73af1c5
	google.golang.org/protobuf v1.36.12
)

github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
google.golang.org/genproto/googleapis/rpc v0.0.0-20260825221802-da73d73af1c5 h1:1VUiZAXyC+zmiFYi+WLtBzr68Cj8wOofHjjrA/kkizc=
google.golang.org/genproto/googleapis/rpc v0.0.0-20260825221802-da73d73af1c5/go.mod h1:DjtHYE8FKJLivXcBEjGwndXfIC23G0VpXiXKqG179uA=
google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=

package sample

import (
	"errors"
	"fmt"

	"google.golang.org/genproto/googleapis/rpc/context/attribute_context"
	"google.golang.org/protobuf/types/known/structpb"
)

// NewAuthContext creates a new AttributeContext_Auth message with the specified fields.
func NewAuthContext(principal string, presenter string, audiences []string, accessLevels []string, claims map[string]any) (*attribute_context.AttributeContext_Auth, error) {
	if principal == "" {
		return nil, errors.New("principal must not be empty")
	}

	auth := &attribute_context.AttributeContext_Auth{
		Principal:    principal,
		Presenter:    presenter,
		Audiences:    audiences,
		AccessLevels: accessLevels,
	}

	if claims != nil {
		structClaims, err := structpb.NewStruct(claims)
		if err != nil {
			return nil, fmt.Errorf("failed to construct claims: %w", err)
		}
		auth.Claims = structClaims
	}

	return auth, nil
}

// ValidateAuthContext verifies that the authentication context satisfies minimal requirements.
func ValidateAuthContext(auth *attribute_context.AttributeContext_Auth) error {
	if auth == nil {
		return errors.New("auth context is nil")
	}
	if auth.GetPrincipal() == "" {
		return errors.New("missing principal in auth context")
	}
	return nil
}

// HasAudience checks whether the auth context contains the specified audience.
func HasAudience(auth *attribute_context.AttributeContext_Auth, target string) bool {
	if auth == nil {
		return false
	}
	for _, aud := range auth.GetAudiences() {
		if aud == target {
			return true
		}
	}
	return false
}

// HasAccessLevel checks whether the auth context contains the specified access level.
func HasAccessLevel(auth *attribute_context.AttributeContext_Auth, target string) bool {
	if auth == nil {
		return false
	}
	for _, level := range auth.GetAccessLevels() {
		if level == target {
			return true
		}
	}
	return false
}

{
  "schemaVersion": 1,
  "goal": "verify google.golang.org/genproto/googleapis/rpc/context/attribute_context.AttributeContext_Auth in pkg:golang/google.golang.org/genproto/googleapis/rpc@v0.0.0-20260825221802-da73d73af1c5",
  "kind": "HOW",
  "packages": [
    "pkg:golang/google.golang.org/genproto/googleapis/rpc@v0.0.0-20260825221802-da73d73af1c5"
  ],
  "symbols": [
    "google.golang.org/genproto/googleapis/rpc/context/attribute_context.AttributeContext_Auth"
  ]
}

package main

import (
	"fmt"
	"os"

	"google.golang.org/genproto/googleapis/rpc/context/attribute_context"
	"sample"
)

func main() {
	if err := runTests(); err != nil {
		fmt.Fprintf(os.Stderr, "Contract test failed: %v\n", err)
		os.Exit(1)
	}
	fmt.Println("All AttributeContext_Auth contract tests passed successfully.")
}

func runTests() error {
	principal := "https://accounts.example.com/user123"
	presenter := "client-app-123.apps.example.com"
	audiences := []string{"https://api.example.com/service-a", "https://api.example.com/service-b"}
	accessLevels := []string{"//accesscontextmanager.googleapis.com/accessPolicies/1/accessLevels/level-basic"}
	claimsData := map[string]any{
		"iss": "https://accounts.example.com",
		"sub": "user123",
	}

	// 1. AttributeContext_Auth initializes with principal, audiences, presenter, claims, and access levels
	auth, err := sample.NewAuthContext(principal, presenter, audiences, accessLevels, claimsData)
	if err != nil {
		return fmt.Errorf("failed to create auth context: %w", err)
	}
	if auth == nil {
		return fmt.Errorf("expected non-nil AttributeContext_Auth")
	}

	// 2. AttributeContext_Auth getters return expected principal, audiences, and presenter values
	if got := auth.GetPrincipal(); got != principal {
		return fmt.Errorf("expected principal %q, got %q", principal, got)
	}
	if got := auth.GetPresenter(); got != presenter {
		return fmt.Errorf("expected presenter %q, got %q", presenter, got)
	}
	if auds := auth.GetAudiences(); len(auds) != 2 || auds[0] != audiences[0] || auds[1] != audiences[1] {
		return fmt.Errorf("unexpected audiences: %v", auds)
	}
	if !sample.HasAudience(auth, "https://api.example.com/service-a") {
		return fmt.Errorf("expected audience https://api.example.com/service-a to be present")
	}
	if sample.HasAudience(auth, "https://api.example.com/service-c") {
		return fmt.Errorf("did not expect audience https://api.example.com/service-c to be present")
	}

	// 3. AttributeContext_Auth GetClaims returns structured claims and nil when unset
	claims := auth.GetClaims()
	if claims == nil {
		return fmt.Errorf("expected non-nil claims")
	}
	fields := claims.GetFields()
	if fields["sub"] == nil || fields["sub"].GetStringValue() != "user123" {
		return fmt.Errorf("expected claim sub='user123', got %v", fields["sub"])
	}

	var unsetAuth *attribute_context.AttributeContext_Auth
	if unsetAuth.GetClaims() != nil {
		return fmt.Errorf("expected nil claims on nil AttributeContext_Auth")
	}
	emptyAuth := &attribute_context.AttributeContext_Auth{}
	if emptyAuth.GetClaims() != nil {
		return fmt.Errorf("expected nil claims on empty AttributeContext_Auth")
	}

	// 4. AttributeContext_Auth GetAccessLevels returns configured access level resource names
	levels := auth.GetAccessLevels()
	if len(levels) != 1 || levels[0] != accessLevels[0] {
		return fmt.Errorf("unexpected access levels: %v", levels)
	}
	if !sample.HasAccessLevel(auth, accessLevels[0]) {
		return fmt.Errorf("expected access level to be present")
	}

	// Validation checks
	if err := sample.ValidateAuthContext(auth); err != nil {
		return fmt.Errorf("validation failed: %w", err)
	}
	if err := sample.ValidateAuthContext(emptyAuth); err == nil {
		return fmt.Errorf("expected validation failure for empty auth context")
	}

	// 5. AttributeContext_Auth Reset clears all fields to zero values
	auth.Reset()
	if auth.GetPrincipal() != "" {
		return fmt.Errorf("expected empty principal after Reset")
	}
	if len(auth.GetAudiences()) != 0 {
		return fmt.Errorf("expected empty audiences after Reset")
	}
	if auth.GetPresenter() != "" {
		return fmt.Errorf("expected empty presenter after Reset")
	}
	if auth.GetClaims() != nil {
		return fmt.Errorf("expected nil claims after Reset")
	}
	if len(auth.GetAccessLevels()) != 0 {
		return fmt.Errorf("expected empty access levels after Reset")
	}

	return nil
}