Google API authentication helpers: service accounts and local OAuth
claude: complete Err -> Error module rename across call sites
Follow up to the module rename: update the remaining callers that
still referenced [Err] (library [claude.ml{,i}], [client.ml], the test
driver [test.ml]), and fix one stray [^ e] string concatenation in
hermest's CLI that needed [Json.Error.to_string e] now that
[Json.of_string] yields a structured error.
+25
-21
+25
-20
lib/gauth.ml
+25
-20
lib/gauth.ml
···
12
12
let err_sa_expected_rsa () = err_msg "service-account key must be RSA"
13
13
let err_sa_wrong_type t = err_msg "expected type=service_account, got %S" t
14
14
let err_sa_pem m = err_msg "failed to decode private_key PEM: %s" m
15
-
let err_sa_json e = err_msg "service-account JSON parse: %s" e
15
+
16
+
let err_sa_json e =
17
+
err_msg "service-account JSON parse: %s" (Json.Error.to_string e)
18
+
16
19
let err_io e = err_msg "%s" (Printexc.to_string e)
17
20
let err_jwt_sign e = err_msg "JWT sign: %s" (Jwt.error_to_string e)
18
21
···
93
96
}
94
97
95
98
let raw_jsont =
96
-
Json.Object.map ~kind:"service_account"
99
+
Json.Codec.Object.map ~kind:"service_account"
97
100
(fun type_ client_email token_uri private_key private_key_id ->
98
101
{ type_; client_email; token_uri; private_key; private_key_id })
99
-
|> Json.Object.mem "type" Json.string ~enc:(fun k -> k.type_)
100
-
|> Json.Object.mem "client_email" Json.string ~enc:(fun k ->
102
+
|> Json.Codec.Object.mem "type" Json.Codec.string ~enc:(fun k -> k.type_)
103
+
|> Json.Codec.Object.mem "client_email" Json.Codec.string ~enc:(fun k ->
101
104
k.client_email)
102
-
|> Json.Object.opt_mem "token_uri" Json.string ~enc:(fun k -> k.token_uri)
103
-
|> Json.Object.mem "private_key" Json.string ~enc:(fun k -> k.private_key)
104
-
|> Json.Object.opt_mem "private_key_id" Json.string ~enc:(fun k ->
105
-
k.private_key_id)
106
-
|> Json.Object.skip_unknown |> Json.Object.finish
105
+
|> Json.Codec.Object.opt_mem "token_uri" Json.Codec.string ~enc:(fun k ->
106
+
k.token_uri)
107
+
|> Json.Codec.Object.mem "private_key" Json.Codec.string ~enc:(fun k ->
108
+
k.private_key)
109
+
|> Json.Codec.Object.opt_mem "private_key_id" Json.Codec.string
110
+
~enc:(fun k -> k.private_key_id)
111
+
|> Json.Codec.Object.skip_unknown |> Json.Codec.Object.finish
107
112
108
113
(* Convert X509 RSA private key to a Jwt.Jwk RSA private key.
109
114
JWK RFC 7518 §6.3 requires the RSA components as unsigned big-endian
···
141
146
| Ok _ -> err_sa_expected_rsa ()
142
147
143
148
let of_json s =
144
-
match Json_bytesrw.decode_string raw_jsont s with
149
+
match Json.of_string raw_jsont s with
145
150
| Error e -> err_sa_json e
146
151
| Ok r -> of_raw r
147
152
···
433
438
}
434
439
435
440
let snapshot_jsont =
436
-
Json.Object.map ~kind:"gauth_token"
441
+
Json.Codec.Object.map ~kind:"gauth_token"
437
442
(fun access_token refresh_token expires_at ->
438
443
{ access_token; refresh_token; expires_at })
439
-
|> Json.Object.mem "access_token" Json.string ~enc:(fun s -> s.access_token)
440
-
|> Json.Object.opt_mem "refresh_token" Json.string ~enc:(fun s ->
444
+
|> Json.Codec.Object.mem "access_token" Json.Codec.string ~enc:(fun s ->
445
+
s.access_token)
446
+
|> Json.Codec.Object.opt_mem "refresh_token" Json.Codec.string ~enc:(fun s ->
441
447
s.refresh_token)
442
-
|> Json.Object.opt_mem "expires_at" Json.number ~enc:(fun s -> s.expires_at)
443
-
|> Json.Object.skip_unknown |> Json.Object.finish
448
+
|> Json.Codec.Object.opt_mem "expires_at" Json.Codec.number ~enc:(fun s ->
449
+
s.expires_at)
450
+
|> Json.Codec.Object.skip_unknown |> Json.Codec.Object.finish
444
451
445
452
let snapshot_of_token = function
446
453
| Oauth_token t ->
···
458
465
459
466
let to_json t =
460
467
let s = snapshot_of_token t in
461
-
match Json_bytesrw.encode_string snapshot_jsont s with
462
-
| Ok s -> s
463
-
| Error e -> Fmt.failwith "Gauth.to_json: %s" e
468
+
Json.to_string snapshot_jsont s
464
469
465
470
let of_json http ~clock ~client_id ~client_secret body =
466
-
match Json_bytesrw.decode_string snapshot_jsont body with
467
-
| Error e -> Error (`Msg e)
471
+
match Json.of_string snapshot_jsont body with
472
+
| Error e -> Error (`Msg (Json.Error.to_string e))
468
473
| Ok s ->
469
474
let tok =
470
475
Oauth.Token.make http Oauth.Google ~client_id ~client_secret ~clock