stephenplusplus / google-auto-auth

Making it as easy as possible to authenticate a Google API request
MIT License
34 stars 9 forks source link

`keyFilename` has to be .json to be read as json #15

Closed SimenB closed 7 years ago

SimenB commented 7 years ago

We currently mount the keyfile into the k8s pod as a secret. We couldn't understand why we kept getting email is required. It took way too much time to figure out that this library expects a json keyfile to be named json (https://github.com/stephenplusplus/google-auto-auth/blob/b87976f5726f7642ccaff70042b179311ac9b65b/index.js#L54-L61). Secrets in k8s are typically just a filename without the extension, so this lib apparently thought we passed a path to a pem file, and gave us odd stacktraces with JWT stuff.

Our diff to fix it, for posterity:

iff --git a/apps/asset-server/server.js b/apps/asset-server/server.js
index 646f74a..bbc99ba 100644
--- a/apps/asset-server/server.js
+++ b/apps/asset-server/server.js
@@ -1,6 +1,7 @@
 'use strict';

 const { join } = require('path');
+const { readFileSync } = require('fs');
 const express = require('express');
 const brakes = require('brakes');
 const AssetServer = require('asset-pipe-build-server');
@@ -38,7 +39,7 @@ if (config.ASSETS_SINK === 'fs') {
 } else if (config.ASSETS_SINK === 'gcs') {
     sink = new AssetSinkGCS({
         projectId: config.GCS_PROJECT_ID,
-        keyFilename: config.GCS_KEYFILE_LOCATION,
+        credentials: JSON.parse(readFileSync(config.GCS_KEYFILE_LOCATION, 'utf8')),
     }, 'podium-assets');
 } else {
     logger.error('Asset-pipe sink is not defined');

The point of this issue: Could either the docs be clarified about this implementation detail, or separate options for json keyfile and pem files be added?

As a bonus: if keyFilename points to a non-existent path, the same error (email is required) is thrown at the time of trying to talk to the API. IMO, an error saying that the file doesn't exist should be thrown during initialization 😄