Revanth14 opened a new issue, #2428: URL: https://github.com/apache/iceberg-go/issues/2428
### Problem Google's BigLake Iceberg REST catalog needs a Google OAuth2 access token (Application Default Credentials, a service-account file, or workload identity). iceberg-go has no way to supply one cleanly. `WithOAuthToken` is static and expires after about an hour. `WithCredential` uses the client-credentials flow against `/oauth/tokens`, which Google doesn't support. `WithAuthManager` works only if every caller writes their own manager. `Oauth2AuthManager` in `catalog/rest/auth.go` already does what's needed over any `oauth2.TokenSource`: singleflight refresh, context-aware waiting (#2265), `tok.Type()` in the header, and `RetrieveError` → `ErrOAuthError` mapping. But its fields are unexported and it has no constructor, so callers can't reuse it and have to rebuild all of that themselves. Google's public-dataset docs ([docs](https://docs.cloud.google.com/lakehouse/docs/public-datasets), [blog](https://opensource.googleblog.com/2026/09/new-public-datasets-available-in-google-cloud-lakehouse.html)) enable auth with a single config key in Java (`rest.auth.type=google`, `GoogleAuthManager`) and PyIceberg (`"auth": {"type": "google"}`). Everything else they configure already works in iceberg-go (`header.x-goog-user-project` since #921, the access-delegation header, and GCS FileIO). ### Proposal 1. Export a cloud-neutral constructor: ```go func NewOauth2AuthManager(ts oauth2.TokenSource) *Oauth2AuthManager ``` BigLake usage then becomes `rest.WithAuthManager(rest.NewOauth2AuthManager(google.DefaultTokenSource(ctx, scope)))`. This adds no new dependencies. The doc comment would note that an external source's refresh is bounded by the HTTP client on its context, not by `defaultOAuthTimeout`. 2. Possible follow-up, for maintainers to weigh in on: a `GoogleAuthManager` using Java's `gcp.auth.credentials-path` / `credentials-json` / `scopes` properties (ADC by default), selected by a `rest.auth.type` property so Google's documented config works unchanged. iceberg-go has no `rest.auth.type` today, so that's a larger API decision. `golang.org/x/oauth2/google` is already a dependency via the GCS FileIO, so this would add no modules either. ### Context #703 proposed a `GoogleAuthManager`; its author closed it without review. Related: #532, #921. Found while connecting iceberg-go to BigLake's public Lakehouse catalog (`gs://lakehouse-public-data`), which currently needs a hand-written auth manager of about 40 lines. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
