fix(googleclientauth/idtoken): use metadata server when credential json is not available

[rinx]

googleclientauth extension with id_token mode works correctly when credential.json is specified.
However, the current implementation doesn't work correctly with the metadata server.

This PR fixes its behavior.
I confirmed that it works correctly on Cloud Run.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 62.88%. Comparing base (4caace7) to head (b492386).
Report is 24 commits behind head on main.

❗ Current head b492386 differs from pull request most recent head 70b42d3

Please upload reports for the commit 70b42d3 to get more accurate results.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #863      +/-   ##
==========================================
+ Coverage   61.03%   62.88%   +1.85%     
==========================================
  Files          56       57       +1     
  Lines        5903     4958     -945     
==========================================
- Hits         3603     3118     -485     
+ Misses       2143     1680     -463     
- Partials      157      160       +3     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[damemi]

Reading the code for NewTokenSource, it looks like idtoken.WithCredentialsJSON returns an option function that just copies the JSON (creds.json) to a field.

NewTokenSource then calls internal.Creds() which calls baseCreds() which reads from the JSON if it's not nil. Otherwise, newTokenSource() falls back to the metadata server by default.

I'm guessing that the bug here comes from the current line always setting idtoken.WithCredentialsJSON(creds.JSON) even if creds.JSON is empty.

My confusion though, is that I would expect the option function I linked above to make an empty array, but I guess that's different from a nil array? And that's the bug, because baseCreds() is checking for creds != nil when maybe it should be checking for len(creds) > 0.

Either way, @rinx is there any way we can add a test for this? Verifying manually is good but we should have something reproducible

[damemi]

/gcbrun

[rinx]

@damemi Your point is correct.
I've added several test cases to verify the changes are correct.

[damemi]

/gcbrun