Package google.registry.config

Class CredentialModule

java.lang.Object

google.registry.config.CredentialModule

@Module
public abstract class CredentialModule
extends Object

Dagger module that provides all GoogleCredentials used in the application.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static @interface	CredentialModule.AdcDelegatedCredential	Dagger qualifier for a credential with delegated admin access for a dasher domain (for Google Workspace) backed by the application default credential (ADC).
static @interface	CredentialModule.ApplicationDefaultCredential	Dagger qualifier for the scope-less Application Default Credential.
static @interface	CredentialModule.GmailDelegatedCredential	Dagger qualifier for a credential with delegated Email-sending permission for a dasher domain (for Google Workspace) backed by the application default credential (ADC).
static @interface	CredentialModule.GoogleWorkspaceCredential	Dagger qualifier for the credential for Google Workspace APIs.
static @interface	CredentialModule.LocalCredential	Dagger qualifier for the local credential used in the nomulus tool.
static @interface	CredentialModule.LocalCredentialJson	Dagger qualifier for the JSON string used to create the local credential.

Constructor Summary

Constructors

Constructor	Description
CredentialModule()

Method Summary

Modifier and Type	Method	Description
static GoogleCredentialsBundle	createSelfSignedDelegatedCredential(com.google.common.collect.ImmutableList<String> defaultScopes, com.google.common.collect.ImmutableList<String> delegationScopes, GoogleCredentialsBundle credentialsBundle, String gSuiteUserEmailAddress, Duration tokenRefreshDelay, Clock clock)
static GoogleCredentialsBundle	provideApplicationDefaultCredential()	Provides a GoogleCredentialsBundle backed by the application default credential from the Google Cloud Runtime.
static GoogleCredentialsBundle	provideGSuiteDriveCredential(GoogleCredentialsBundle applicationDefaultCredential, com.google.common.collect.ImmutableList<String> requiredScopes)	Provides a GoogleCredentialsBundle for accessing Google Workspace APIs, such as Drive and Sheets.
static GoogleCredentialsBundle	provideSelfSignedAdminDelegatedCredential(com.google.common.collect.ImmutableList<String> defaultScopes, com.google.common.collect.ImmutableList<String> delegationScopes, GoogleCredentialsBundle credentialsBundle, String gSuiteAdminAccountEmailAddress, Duration tokenRefreshDelay, Clock clock)	Provides a GoogleCredentialsBundle with delegated access to Google Workspace APIs for the application default credential user.
static GoogleCredentialsBundle	provideSelfSignedGmailDelegatedCredential(com.google.common.collect.ImmutableList<String> defaultScopes, com.google.common.collect.ImmutableList<String> delegationScopes, GoogleCredentialsBundle credentialsBundle, String gSuiteOutgoingEmailAddress, Duration tokenRefreshDelay, Clock clock)	Provides a GoogleCredentialsBundle for sending emails through Google Workspace.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

CredentialModule

public CredentialModule()

Method Details

provideApplicationDefaultCredential

@ApplicationDefaultCredential
@Provides
@Singleton
public static GoogleCredentialsBundle provideApplicationDefaultCredential()

Provides a GoogleCredentialsBundle backed by the application default credential from the Google Cloud Runtime. This credential may be used to access GCP APIs that are NOT part of the Google Workspace.

The credential returned by the Cloud Runtime depends on the runtime environment:

• On App Engine, returns a scope-less ComputeEngineCredentials for PROJECT_ID@appspot.gserviceaccount.com
• On Compute Engine, returns a scope-less ComputeEngineCredentials for PROJECT_NUMBER-compute@developer.gserviceaccount.com
• On end user host, this returns the credential downloaded by gcloud. Please refer to Cloud SDK documentation for details.

provideGSuiteDriveCredential

@GoogleWorkspaceCredential
@Provides
@Singleton
public static GoogleCredentialsBundle provideGSuiteDriveCredential(@ApplicationDefaultCredential
 GoogleCredentialsBundle applicationDefaultCredential,
 @Config("defaultCredentialOauthScopes")
 com.google.common.collect.ImmutableList<String> requiredScopes)

Provides a GoogleCredentialsBundle for accessing Google Workspace APIs, such as Drive and Sheets.

provideSelfSignedAdminDelegatedCredential

@AdcDelegatedCredential
@Provides
@Singleton
public static GoogleCredentialsBundle provideSelfSignedAdminDelegatedCredential(@Config("defaultCredentialOauthScopes")
 com.google.common.collect.ImmutableList<String> defaultScopes,
 @Config("delegatedCredentialOauthScopes")
 com.google.common.collect.ImmutableList<String> delegationScopes,
 @ApplicationDefaultCredential
 GoogleCredentialsBundle credentialsBundle,
 @Config("gSuiteAdminAccountEmailAddress")
 String gSuiteAdminAccountEmailAddress,
 @Config("tokenRefreshDelay")
 Duration tokenRefreshDelay,
 Clock clock)

Provides a GoogleCredentialsBundle with delegated access to Google Workspace APIs for the application default credential user.

The Workspace domain must grant delegated admin access to the default service account user (project-id@appspot.gserviceaccount.com on AppEngine) with all scopes in defaultScopes and delegationScopes.

provideSelfSignedGmailDelegatedCredential

@GmailDelegatedCredential
@Provides
@Singleton
public static GoogleCredentialsBundle provideSelfSignedGmailDelegatedCredential(@Config("defaultCredentialOauthScopes")
 com.google.common.collect.ImmutableList<String> defaultScopes,
 @Config("delegatedCredentialOauthScopes")
 com.google.common.collect.ImmutableList<String> delegationScopes,
 @ApplicationDefaultCredential
 GoogleCredentialsBundle credentialsBundle,
 @Config("gSuiteNewOutgoingEmailAddress")
 String gSuiteOutgoingEmailAddress,
 @Config("tokenRefreshDelay")
 Duration tokenRefreshDelay,
 Clock clock)

Provides a GoogleCredentialsBundle for sending emails through Google Workspace.

The Workspace domain must grant delegated admin access to the default service account user (project-id@appspot.gserviceaccount.com on AppEngine) with all scopes in defaultScopes and delegationScopes. In addition, the user gSuiteOutgoingEmailAddress must have the permission to send emails.

createSelfSignedDelegatedCredential

public static GoogleCredentialsBundle createSelfSignedDelegatedCredential(com.google.common.collect.ImmutableList<String> defaultScopes,
 com.google.common.collect.ImmutableList<String> delegationScopes,
 GoogleCredentialsBundle credentialsBundle,
 String gSuiteUserEmailAddress,
 Duration tokenRefreshDelay,
 Clock clock)