fix(auth): disable automatic universe domain check for MDS

auth/auth.go

@@ -101,6 +101,20 @@ func (t *Token) IsValid() bool {
 	return t.isValidWithEarlyExpiry(defaultExpiryDelta)
 }
 
+// MetadataString is a convenience method for accessing string values in the
+// token's metadata. Returns an empty string if the metadata is nil or the value
+// for the given key cannot be cast to a string.
+func (t *Token) MetadataString(k string) string {
+	if t.Metadata == nil {
+		return ""
+	}
+	s, ok := t.Metadata[k].(string)
+	if !ok {
+		return ""
+	}
+	return s
+}
+
 func (t *Token) isValidWithEarlyExpiry(earlyExpiry time.Duration) bool {
 	if t.isEmpty() {
 		return false

auth/auth_test.go

@@ -103,6 +103,39 @@ func TestError_Temporary(t *testing.T) {
 	}
 }
 
+func TestToken_MetadataString(t *testing.T) {
+	cases := []struct {
+		name     string
+		metadata map[string]interface{}
+		want     string
+	}{
+		{
+			name:  "nil metadata",
+			want:  "",
+		},
+		{
+			name:  "not string",
+			metadata: map[string]interface{}{
+				"my.key": 123,
+			},
+			want:  "",
+		},
+		{
+			name:  "string",
+			metadata: map[string]interface{}{
+				"my.key": "my.value",
+			},
+			want:  "my.value",
+		},
+	}
+	for _, tc := range cases {
+		tok := &Token{Metadata: tc.metadata}
+		if got, want := tok.MetadataString("my.key"), tc.want; got != want {
+			t.Errorf("got %q, want %q", got, want)
+		}
+	}
+}
+
 func TestToken_isValidWithEarlyExpiry(t *testing.T) {
 	now := time.Now()
 	timeNow = func() time.Time { return now }

auth/credentials/compute_test.go

@@ -53,11 +53,7 @@ func TestComputeTokenProvider(t *testing.T) {
 	if want := "bearer"; tok.Type != want {
 		t.Errorf("got %q, want %q", tok.Type, want)
 	}
-	source, ok := tok.Metadata["auth.google.tokenSource"].(string)
-	if !ok {
-		t.Errorf("got %t, want true", ok)
-	}
-	if want := "compute-metadata"; source != want {
-		t.Errorf("got %q, want %q", source, want)
+	if got, want := tok.MetadataString("auth.google.tokenSource"), "compute-metadata"; got != want {
+		t.Errorf("got %q, want %q", got, want)
 	}
 }

auth/grpctransport/directpath.go

@@ -66,10 +66,10 @@ func isTokenProviderDirectPathCompatible(tp auth.TokenProvider, _ *Options) bool
 	if tok == nil {
 		return false
 	}
-	if source, _ := tok.Metadata["auth.google.tokenSource"].(string); source != "compute-metadata" {
+	if tok.MetadataString("auth.google.tokenSource") != "compute-metadata" {
 		return false
 	}
-	if acct, _ := tok.Metadata["auth.google.serviceAccount"].(string); acct != "default" {
+	if tok.MetadataString("auth.google.serviceAccount") != "default" {
 		return false
 	}
 	return true

auth/grpctransport/grpctransport.go

@@ -341,7 +341,7 @@ func (c *grpcCredentialsProvider) GetRequestMetadata(ctx context.Context, uri ..
 	if err != nil {
 		return nil, err
 	}
-	if source, _ := token.Metadata["auth.google.tokenSource"].(string); source != "compute-metadata" {
+	if token.MetadataString("auth.google.tokenSource") != "compute-metadata" {
 		credentialsUniverseDomain, err := c.creds.UniverseDomain(ctx)
 		if err != nil {
 			return nil, err

auth/httptransport/transport.go

@@ -197,7 +197,7 @@ func (t *authTransport) RoundTrip(req *http.Request) (*http.Response, error) {
 	if err != nil {
 		return nil, err
 	}
-	if source, _ := token.Metadata["auth.google.tokenSource"].(string); source != "compute-metadata" {
+	if token.MetadataString("auth.google.tokenSource") != "compute-metadata" {
 		credentialsUniverseDomain, err := t.creds.UniverseDomain(req.Context())
 		if err != nil {
 			return nil, err