{{ message }}
Repository navigation
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request updates the TokenHandler to ensure that tokenOptions.iss is correctly set using the client email from credentials when available, and adds corresponding unit tests to verify this behavior. The feedback suggests wrapping the temporary directory cleanup in a try...finally block in the new JWT test to prevent directory leaks in case of test failures.
GoogleToken copies `email` into `iss` in its constructor, before the key file is read. TokenHandler then set `email` from the file but not `iss`, so a JWT client given only a keyFile signed its assertion without `iss` and Google answered "invalid_grant: account not found" (10.6.1 onwards). Restores gtoken's `iss = clientEmail || iss`. Also adds the license header to gtoken/tokenHandler.ts, which the header check flags. Fixes googleapis#9469
Marinski
force-pushed
the
fix-auth-keyfile-iss
branch
from
September 30, 2026 05:28
b1697cd to
47dcde1
Compare
Author
|
I updated the code based on the bot feedback. |
Author
|
Any updates on this? |
Author
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #9469
Description
Since 10.6.1, a
JWTclient given only a JSONkeyFilesigns its token assertion withoutiss, and Google rejects it withinvalid_grant: account not found.GoogleTokencopiesemailintoissin its constructor, before the key file has been read.TokenHandler.processCredentials()then setsemailfrom the file, but notiss, which is the claim that gets signed. This change restores the standalone gtoken behaviour:iss = clientEmail || iss. Anisspassed in explicitly is kept when the key file has no email, for example a PEM file.Changelist
src/gtoken/tokenHandler.ts: settokenOptions.issfrom the key file'sclient_email.test/gtoken/test.tokenHandler.ts: assert thatissis set from the key file, and that a givenissis kept when the file has no email.test/test.jwt.ts: end to end, a JSONkeyFilewith noemailoption signsiss = client_email. Every existingkeyFiletest also passedemail, which is why this wasn't caught.Both new assertions fail without the fix and pass with it. The gtoken and jwt suites pass: 131 tests.
🤖 Generated with Claude Code