fix: 토큰 assertion audience 인코딩 정정 - #123
Merged
Merged
Conversation
The service-account assertion built its aud claim with audience().add(), which serialises even a single audience as a JSON array. Google's token endpoint requires the string form and answers the array with invalid_grant, "Failed audience check. The right audience is <uri>" — naming the value it was already sent, so the message reads as though the value were wrong. It was not; the key file's token_uri is exactly that. Nothing in this path has ever authenticated. The startup line that reports the provider as configured says the settings are present, not that a call succeeds, and the first call is a reconcile that logs and moves on. The test could not see it. It parsed the assertion back and asserted the audience value, and a parser reads a string and a one-element array alike, so it passed either way — the only thing that distinguishes them is the endpoint. The assertion now reads the raw payload of the token this code actually produced, which is the one property a round trip through our own parser cannot check.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📝 작업내용
aud를 배열이 아닌 문자열로 인코딩.audience().add()는 값이 하나여도 JSON 배열을 내고 Google 토큰 엔드포인트는 문자열을 요구invalid_grant에 "Failed audience check. The right audience is "이고 이미 보낸 값을 되읊어 주므로 값 오류로 오독됨. 키 파일의token_uri는 정상⭐️ 검증
💬 리뷰 포인트