text: // Copyright 2015 The Go Authors. All rights reserved.
  // Use of this source code is governed by a BSD-style
  // license that can be found in the LICENSE file.
  
  package google
  
  import (
  	"crypto/rsa"
  	"fmt"
  	"time"
  
  	"golang.org/x/oauth2"
  	"golang.org/x/oauth2/internal"
  	"golang.org/x/oauth2/jws"
  )
  
  // JWTAccessTokenSourceFromJSON uses a Google Developers service account JSON
  // key file to read the credentials that authorize and authenticate the
  // requests, and returns a TokenSource that does not use any OAuth2 flow but
  // instead creates a JWT and sends that as the access token.
  // The audience is typically a URL that specifies the scope of the credentials.
  //
  // Note that this is not a standard OAuth flow, but rather an
  // optimization supported by a few Google services.
  // Unless you know otherwise, you should use JWTConfigFromJSON instead.
  func JWTAccessTokenSourceFromJSON(jsonKey []byte, audience string) (oauth2.TokenSource, error) {
  	cfg, err := JWTConfigFromJSON(jsonKey)
  	if err != nil {
  		return nil, fmt.Errorf("google: could not parse JSON key: %v", err)
  	}
  	pk, err := internal.ParseKey(cfg.PrivateKey)
  	if err != nil {
  		return nil, fmt.Errorf("google: could not parse key: %v", err)
  	}
  	ts := &jwtAccessTokenSource{
  		email:    cfg.Email,
  		audience: audience,
  		pk:       pk,
  		pkID:     cfg.PrivateKeyID,
  	}
  	tok, err := ts.Token()
  	if err != nil {
  		return nil, err
  	}
  	return oauth2.ReuseTokenSource(tok, ts), nil
  }
  
  type jwtAccessTokenSource struct {
  	email, audience string
  	pk              *rsa.PrivateKey
  	pkID            string
  }
  
  func (ts *jwtAccessTokenSource) Token() (*oauth2.Token, error) {
  	iat := time.Now()
  	exp := iat.Add(time.Hour)
  	cs := &jws.ClaimSet{
  		Iss: ts.email,
  		Sub: ts.email,
  		Aud: ts.audience,
  		Iat: iat.Unix(),
  		Exp: exp.Unix(),
  	}
  	hdr := &jws.Header{
  		Algorithm: "RS256",
  		Typ:       "JWT",
  		KeyID:     string(ts.pkID),
  	}
  	msg, err := jws.Encode(hdr, cs, ts.pk)
  	if err != nil {
  		return nil, fmt.Errorf("google: could not encode JWT: %v", err)
  	}
  	return &oauth2.Token{AccessToken: msg, TokenType: "Bearer", Expiry: exp}, nil
  }
  