Signed URL v2 returning error when using service account

[jmalovera10]

Signed URL v2 returning error when using service account

Description

I am trying to generate a signed url using waffle with waffle_gcs. I configured my project according to the goth migration guide, and enabled the signed parameter in my config. The credentials are being set by using a JSON key, associated to a :service_account. However, when I call the url/1 function from my uploader I get the following error:

** (MatchError) no match of right hand side value: :error
    (waffle_gcs 0.2.0) lib/waffle/storage/google/url_v2.ex:82: Waffle.Storage.Google.UrlV2.build_signed_url/3
    (fliipa 0.1.0) lib/fliipa/uploaders/report_uploader.ex:6: Fliipa.Uploaders.ReportUploader.url/3
    iex:6: (file)

It seems that the client_email and private_key are not being set on the Goth.Config. I managed to make a workaround by explicitly setting the parameters in the Application module by using:

Goth.Config.set(:client_email, credentials["client_email"])
Goth.Config.set(:private_key, credentials["private_key"])

However, I don't know if this is an intended behavior or is a library failure.

Environment

• Elixir 1.16.2 / OTP 25.3.2.10
• goth 1.4.3
• waffle 1.1.8 / waffle_gcs 0.2.0

[dgross881]

Since this is still open and Goth seems to be moving more towards maintaining token generation instead of storing credentials Deprecations . Does it make more sense to make waffle_gcs more flexible on this and add configs internally so changes with Goth don't break waffle_gcs ?

client_email = Application.fetch_env!(:waffle, :client_email)
private_key = Application.fetch_env!(:waffle, :private_key)

[petermueller]

Sorry for missing this when it originally was submitted @jmalovera10, I'll take a look. It's been a bit since we've come back to this as we were reviewing a migration guide for v0.3

@dgross881 Along those lines, I have been thinking that as part of URL signing for v4 that we need to just have a general GCP signing implementation separate from Goth, as you can't really get away from needing a key if you're doing resource/uri signing, and not all Goth implementations will be configured with one.

I need to dig into the GCP v4 signing docs again and compare them to the AWS signing implementation. Theoretically, they're supposed to be compatible w/ AWS but I'd need to double check. It would be nice to be able to do something simple that works for AWS and GCP, where the only difference is the header names.

[astjohn]

I ran into this. I like @dgross881 suggestion, but would prefer to have it more explicit as Goth does allow for multiple service accounts and authentication schemes.

What if we enforce access functions in the TokenFetcher module that already acts as the accessor to Goth?

For example, a TokenFetcher could resemble something like this:

defmodule Radar.Uploaders.WaffleTokenFetcher do
  @moduledoc """
  Necessary for fetching goth tokens for waffle library to use
  during file uploads to GCS.
  """
  @behaviour Waffle.Storage.Google.Token.Fetcher

  @impl true
  # def get_token(_scope) when is_binary(_scope) do
  def get_token(_scope) do
    Goth.fetch!(Radar.GothStorage).token
  end

  @impl true
  def get_email() do
    google_credentials()["client_email"]
  end

  @impl true
  def get_private_key() do
    google_credentials()["private_key"]
  end

  defp google_credentials() do
    System.get_env("GOOGLE_CLOUD_SECRETS_JSON")
    |> Jason.decode!()
  end
end

@petermueller - this would require some changes such as those I made here
(note my other changes to fix file naming are there as well.)

I have no idea about the v4 stuff and how it compares to AWS requirements...