feat(auth): add universe domain support to idtoken

auth/credentials/idtoken/iam.go

@@ -15,7 +15,6 @@
 package idtoken
 
 import (
-	"bytes"
 	"context"
 	"encoding/json"
 	"fmt"
@@ -62,26 +61,17 @@ func (i iamIDTokenProvider) Token(ctx context.Context) (*auth.Token, error) {
 		Audience:     i.audience,
 		IncludeEmail: true,
 	}
-	bodyBytes, err := json.Marshal(tokenReq)
-	if err != nil {
-		return nil, fmt.Errorf("idtoken: unable to marshal request: %w", err)
-	}
-
 	endpoint := strings.Replace(iamCredentialsUniverseDomainEndpoint, universeDomainPlaceholder, i.universeDomain, 1)
 	url := fmt.Sprintf("%s/v1/%s:generateIdToken", endpoint, internal.FormatIAMServiceAccountName(i.signerEmail))
-	req, err := http.NewRequestWithContext(ctx, "POST", url, bytes.NewReader(bodyBytes))
+
+	bodyBytes, err := json.Marshal(tokenReq)
 	if err != nil {
-		return nil, fmt.Errorf("idtoken: unable to create request: %w", err)
+		return nil, fmt.Errorf("idtoken: unable to marshal request: %w", err)
 	}
-	req.Header.Set("Content-Type", "application/json")
-	resp, body, err := internal.DoRequest(i.client, req)
+	body, err := internal.DoJSONRequest(ctx, i.client, url, bodyBytes, "idtoken")
 	if err != nil {
-		return nil, fmt.Errorf("idtoken: unable to generate ID token: %w", err)
+		return nil, err
 	}
-	if c := resp.StatusCode; c < 200 || c > 299 {
-		return nil, fmt.Errorf("idtoken: status code %d: %s", c, body)
-	}
-
 	var tokenResp generateIAMIDTokenResponse
 	if err := json.Unmarshal(body, &tokenResp); err != nil {
 		return nil, fmt.Errorf("idtoken: unable to parse response: %w", err)

auth/credentials/impersonate/idtoken.go

@@ -15,7 +15,6 @@
 package impersonate
 
 import (
-	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
@@ -159,29 +158,21 @@ func (i impersonatedIDTokenProvider) Token(ctx context.Context) (*auth.Token, er
 		IncludeEmail: i.includeEmail,
 		Delegates:    i.delegates,
 	}
-	bodyBytes, err := json.Marshal(genIDTokenReq)
-	if err != nil {
-		return nil, fmt.Errorf("impersonate: unable to marshal request: %w", err)
-	}
 	universeDomain, err := i.universeDomainProvider.GetProperty(ctx)
 	if err != nil {
 		return nil, err
 	}
 	endpoint := strings.Replace(iamCredentialsUniverseDomainEndpoint, universeDomainPlaceholder, universeDomain, 1)
 	url := fmt.Sprintf("%s/v1/%s:generateIdToken", endpoint, internal.FormatIAMServiceAccountName(i.targetPrincipal))
-	req, err := http.NewRequestWithContext(ctx, "POST", url, bytes.NewReader(bodyBytes))
+
+	bodyBytes, err := json.Marshal(genIDTokenReq)
 	if err != nil {
-		return nil, fmt.Errorf("impersonate: unable to create request: %w", err)
+		return nil, fmt.Errorf("impersonate: unable to marshal request: %w", err)
 	}
-	req.Header.Set("Content-Type", "application/json")
-	resp, body, err := internal.DoRequest(i.client, req)
+	body, err := internal.DoJSONRequest(ctx, i.client, url, bodyBytes, "impersonate")
 	if err != nil {
-		return nil, fmt.Errorf("impersonate: unable to generate ID token: %w", err)
-	}
-	if c := resp.StatusCode; c < 200 || c > 299 {
-		return nil, fmt.Errorf("impersonate: status code %d: %s", c, body)
+		return nil, err
 	}
-
 	var generateIDTokenResp generateIDTokenResponse
 	if err := json.Unmarshal(body, &generateIDTokenResp); err != nil {
 		return nil, fmt.Errorf("impersonate: unable to parse response: %w", err)

auth/internal/internal.go

@@ -15,6 +15,7 @@
 package internal
 
 import (
+	"bytes"
 	"context"
 	"crypto/rsa"
 	"crypto/x509"
@@ -141,6 +142,24 @@ func GetProjectID(b []byte, override string) string {
 	return v.Project
 }
 
+// DoJSONRequest sends the provided JSON bytes with the client. It reads the response
+// body, checks the status code for errors, and returns the body.
+func DoJSONRequest(ctx context.Context, c *http.Client, url string, bodyBytes []byte, pkg string) ([]byte, error) {
+	req, err := http.NewRequestWithContext(ctx, "POST", url, bytes.NewReader(bodyBytes))
+	if err != nil {
+		return nil, fmt.Errorf("%s: unable to create request: %w", pkg, err)
+	}
+	req.Header.Set("Content-Type", "application/json")
+	resp, body, err := DoRequest(c, req)
+	if err != nil {
+		return nil, fmt.Errorf("%s: request to %s failed: %w", pkg, url, err)
+	}
+	if c := resp.StatusCode; c < 200 || c > 299 {
+		return nil, fmt.Errorf("%s: status code %d: %s", pkg, c, body)
+	}
+	return body, nil
+}
+
 // DoRequest executes the provided req with the client. It reads the response
 // body, closes it, and returns it.
 func DoRequest(client *http.Client, req *http.Request) (*http.Response, []byte, error) {