External Account Credential Converter

A utility that converts OAuth 2.0 session data into external account authorized user credentials for accessing Google APIs.

Overview

Build a tool that takes OAuth 2.0 session information from a third-party identity provider and converts it into properly formatted external account authorized user credentials that can be used with Google's authentication library.

Requirements

The tool should:

1. Read OAuth 2.0 session data from a JSON file (containing token, client configuration, and scopes)
2. Detect if the session is configured for external account (3pi) usage
3. Convert the session data into external account authorized user credentials
4. Save the resulting credentials to an output JSON file
5. Display a summary of the created credentials

Input Format

The input JSON file contains OAuth session data with the following structure:

{
  "token": {
    "access_token": "...",
    "refresh_token": "...",
    "expires_at": 1234567890
  },
  "client_config": {
    "client_id": "...",
    "client_secret": "...",
    "auth_uri": "...",
    "token_uri": "...",
    "token_info_url": "..."
  },
  "scopes": ["scope1", "scope2"]
}

Command-Line Interface

python converter.py --input session.json --output credentials.json

Output Format

The tool should display:

Created external account credentials
Client ID: <client_id>
Scopes: <comma-separated-scopes>
Token URI: <token_uri>
Credentials saved to: credentials.json

The output JSON file should contain valid external account authorized user credentials.

Test Cases

• When given valid OAuth session data with a token_info_url field, the tool creates external account credentials and saves them to the output file. @test
• When the created credential file is loaded, it contains all required fields including client_id, token_uri, and refresh_token. @test
• When given session data without token_info_url (not a 3pi config), the tool exits with an error message indicating external account configuration is not detected. @test

Implementation

@generates

Dependencies { .dependencies }

google-auth-oauthlib { .dependency }

Provides OAuth 2.0 integration with Google authentication, including support for external account authorized user credentials.

@satisfied-by