Implementing Authentication

type tokenAuth struct{ token string }
func (t tokenAuth) GetRequestMetadata(ctx context.Context, _ ...string) (map[string]string, error) {
    return map[string]string{"authorization": "Bearer " + t.token}, nil
}
func (tokenAuth) RequireTransportSecurity() bool { return true }

conn, _ := grpc.NewClient(addr,
    grpc.WithTransportCredentials(credentials.NewTLS(cfg)),
    grpc.WithPerRPCCredentials(tokenAuth{tok}),
)

func authInterceptor(jwks jwt.Keyfunc) grpc.UnaryServerInterceptor {
    return func(ctx context.Context, req any, info *grpc.UnaryServerInfo,
        h grpc.UnaryHandler) (any, error) {
        md, _ := metadata.FromIncomingContext(ctx)
        raw := strings.TrimPrefix(first(md, "authorization"), "Bearer ")
        tok, err := jwt.Parse(raw, jwks)
        if err != nil || !tok.Valid {
            return nil, status.Error(codes.Unauthenticated, "invalid token")
        }
        ctx = context.WithValue(ctx, claimsKey{}, tok.Claims)
        return h(ctx, req)
    }
}

import "google.golang.org/grpc/credentials/insecure"
conn, _ := grpc.NewClient("localhost:50051", grpc.WithTransportCredentials(insecure.NewCredentials()))

import (
    "golang.org/x/oauth2/google"
    "google.golang.org/grpc/credentials/oauth"
)
ts, _ := google.DefaultTokenSource(ctx, "https://www.googleapis.com/auth/cloud-platform")
conn, _ := grpc.NewClient(addr,
    grpc.WithTransportCredentials(credentials.NewTLS(cfg)),
    grpc.WithPerRPCCredentials(oauth.TokenSource{TokenSource: ts}),
)

p, _ := peer.FromContext(ctx)
fmt.Println("client addr", p.Addr)
if t, ok := p.AuthInfo.(credentials.TLSInfo); ok {
    if len(t.State.VerifiedChains) > 0 {
        fmt.Println("subject", t.State.VerifiedChains[0][0].Subject)
    }
}