support id tokens for gcp external creds

[havetisyan]

Description

zts externalcreds api was only supporting getting access tokens from gcp. it has been extended to support getting either access or id tokens.

Contribution Checklist:

• The pull request does not introduce any breaking changes
• I have read the contribution guidelines.
• Create an issue and link to the pull request.

Attach Screenshots (Optional)

[gemini-code-assist]

Summary of Changes

Hello @havetisyan, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the ZTS external credentials API by introducing comprehensive support for GCP ID tokens. Previously limited to access tokens, the system can now generate both access and ID tokens, offering greater versatility for services integrating with Google Cloud Platform. The changes involve refactoring the GCP token provider, introducing new data models for ID token requests and responses, and updating authorization mechanisms to accommodate the new token type.

Highlights

• GCP ID Token Support: The ZTS external credentials API has been extended to support generating GCP ID tokens in addition to the existing access token functionality. This provides more flexibility for integrations requiring ID tokens.
• Refactored GCP Token Provider: The GcpAccessTokenProvider class has been refactored and renamed to GcpTokenProvider to serve as a unified provider for both access and ID tokens. This includes new internal methods (getAccessToken, getIdToken) and constants to manage different token types and their specific request parameters.
• New GCP Token Request/Response Models: New classes GcpIdTokenRequest, GcpIdTokenResponse, and a base GcpTokenRequest have been introduced to handle the specific parameters and responses for GCP ID token generation. The GcpAccessTokenRequest now extends GcpTokenRequest.
• Enhanced Authorization Checks: Authorization logic has been updated to include checks for gcp.audience_access when requesting ID tokens, ensuring that principals are authorized for the specified audience.
• Updated Unit Tests: Existing unit tests have been updated to reflect the refactored GcpTokenProvider and new test cases have been added to cover the generation of GCP ID tokens and various failure scenarios.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request effectively extends the GCP external credentials provider to support ID tokens alongside access tokens. The refactoring of GcpAccessTokenProvider into a more generic GcpTokenProvider is well-executed, improving the structure and maintainability of the code. The addition of new request/response classes and comprehensive test coverage for the new functionality is commendable. I have a few suggestions to enhance consistency and debuggability, focusing on adhering to JavaBean conventions, using appropriate HTTP status codes, and improving exception handling. Overall, this is a solid contribution.