snapshot of https://github.com/grpc/grpc-go.git (master, 2026-09-15; blobs > 131072B omitted)

internal/xds/bootstrap/jwtcreds/call_creds.go

@@ -0,0 +1,54 @@
+/*
+ *
+ * Copyright 2025 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package jwtcreds implements JWT CallCredentials for XDS, configured via xDS
+// Bootstrap File. For more details, see gRFC A97:
+// https://github.com/grpc/proposal/blob/master/A97-xds-jwt-call-creds.md
+package jwtcreds
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/credentials/jwt"
+)
+
+// NewCallCredentials returns a new JWT token based call credentials. The input
+// config must match the structure specified in gRFC A97.
+//
+// The caller is expected to invoke the cancel function when they are done using
+// the returned call creds. This cancel function is idempotent.
+func NewCallCredentials(configJSON json.RawMessage) (c credentials.PerRPCCredentials, cancel func(), err error) {
+	var cfg struct {
+		JWTTokenFile string `json:"jwt_token_file"`
+	}
+	emptyFn := func() {}
+
+	if err := json.Unmarshal(configJSON, &cfg); err != nil {
+		return nil, emptyFn, fmt.Errorf("failed to unmarshal JWT call credentials config: %v", err)
+	}
+	if cfg.JWTTokenFile == "" {
+		return nil, emptyFn, fmt.Errorf("jwt_token_file is required in JWT call credentials config")
+	}
+	callCreds, err := jwt.NewTokenFileCallCredentials(cfg.JWTTokenFile)
+	if err != nil {
+		return nil, emptyFn, fmt.Errorf("failed to create JWT call credentials: %v", err)
+	}
+	return callCreds, emptyFn, nil
+}

internal/xds/bootstrap/jwtcreds/call_creds_test.go

@@ -0,0 +1,168 @@
+/*
+ *
+ * Copyright 2025 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package jwtcreds
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/internal/grpctest"
+)
+
+type s struct {
+	grpctest.Tester
+}
+
+func Test(t *testing.T) {
+	grpctest.RunSubTests(t, s{})
+}
+
+func (s) TestNewCallCredentialsWithInvalidConfig(t *testing.T) {
+	tests := []struct {
+		name   string
+		config string
+	}{
+		{
+			name:   "empty_file",
+			config: `""`,
+		},
+		{
+			name:   "empty_config",
+			config: `{}`,
+		},
+		{
+			name:   "empty_path",
+			config: `{"jwt_token_file": ""}`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			callCreds, cleanup, err := NewCallCredentials(json.RawMessage(tt.config))
+			if err == nil {
+				t.Fatalf("NewCallCredentials(%s): got nil, want error", tt.config)
+			}
+			if callCreds != nil {
+				t.Errorf("NewCallCredentials(%s): returned non-nil call credentials", tt.config)
+			}
+			if cleanup == nil {
+				t.Errorf("NewCallCredentials(%s): returned nil cleanup function", tt.config)
+			}
+		})
+	}
+}
+
+func (s) TestNewCallCredentialsWithValidConfig(t *testing.T) {
+	token := createTestJWT(t)
+	tokenFile := writeTempFile(t, token)
+	config := `{"jwt_token_file": "` + tokenFile + `"}`
+
+	callCreds, cleanup, err := NewCallCredentials(json.RawMessage(config))
+	if err != nil {
+		t.Fatalf("NewCallCredentials(%s) failed: %v", config, err)
+	}
+	if callCreds == nil {
+		t.Fatalf("NewCallCredentials(%s): returned nil credentials", config)
+	}
+	if cleanup == nil {
+		t.Errorf("NewCallCredentials(%s): returned nil cleanup function", config)
+	} else {
+		defer cleanup()
+	}
+
+	// Test that call credentials get used.
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	ctx = credentials.NewContextWithRequestInfo(ctx, credentials.RequestInfo{
+		AuthInfo: &testAuthInfo{secLevel: credentials.PrivacyAndIntegrity},
+	})
+	metadata, err := callCreds.GetRequestMetadata(ctx)
+	if err != nil {
+		t.Fatalf("GetRequestMetadata failed: %v", err)
+	}
+	if len(metadata) == 0 {
+		t.Fatal("GetRequestMetadata: returned empty metadata")
+	}
+	authHeader, ok := metadata["authorization"]
+	if !ok {
+		t.Fatal("GetRequestMetadata: returned empty authorization header in metadata")
+	}
+	if !strings.HasPrefix(authHeader, "Bearer ") {
+		t.Errorf("GetRequestMetadata: Authorization header should start with 'Bearer ', got %q", authHeader)
+	}
+}
+
+func (s) TestCallCredentials_Cleanup(t *testing.T) {
+	token := createTestJWT(t)
+	tokenFile := writeTempFile(t, token)
+	config := `{"jwt_token_file": "` + tokenFile + `"}`
+	_, cleanup, err := NewCallCredentials(json.RawMessage(config))
+	if err != nil {
+		t.Fatalf("NewCallCredentials(%s) failed: %v", config, err)
+	}
+	if cleanup == nil {
+		t.Errorf("NewCallCredentials(%s): returned nil cleanup function", config)
+	}
+
+	// Cleanup should not panic. Multiple cleanup calls should be safe
+	cleanup()
+	cleanup()
+}
+
+// testAuthInfo implements credentials.AuthInfo for testing.
+type testAuthInfo struct {
+	secLevel credentials.SecurityLevel
+}
+
+func (t *testAuthInfo) AuthType() string {
+	return "test"
+}
+
+func (t *testAuthInfo) GetCommonAuthInfo() credentials.CommonAuthInfo {
+	return credentials.CommonAuthInfo{SecurityLevel: t.secLevel}
+}
+
+// createTestJWT creates a test JWT token for testing.
+func createTestJWT(t *testing.T) string {
+	t.Helper()
+
+	// Header: {"typ":"JWT","alg":"HS256"}
+	header := "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9"
+	// Claims: {"aud":"https://example.com","exp":future_timestamp}
+	claims := "eyJhdWQiOiJodHRwczovL2V4YW1wbGUuY29tIiwiZXhwIjoyMDAwMDAwMDAwfQ"
+	signature := "fake_signature_for_testing"
+
+	return header + "." + claims + "." + signature
+}
+
+func writeTempFile(t *testing.T, content string) string {
+	t.Helper()
+	tempDir := t.TempDir()
+	filePath := filepath.Join(tempDir, "jwt_token")
+	if err := os.WriteFile(filePath, []byte(content), 0600); err != nil {
+		t.Fatalf("Failed to write temp file: %v", err)
+	}
+	return filePath
+}