feat: Change getCacheKey implementation for more unique keys

src/Credentials/ExternalAccountCredentials.php

@@ -54,6 +54,13 @@ class ExternalAccountCredentials implements
     private ?string $projectId;
     private string $universeDomain;
 
+    /**
+     * Used to calculate the Cache Key for caching
+     *
+     * @var array<mixed>
+     */
+    private array $jsonKey;
+
     /**
      * @param string|string[] $scope   The scope of the access request, expressed either as an array
      *                                 or as a space-delimited string.
@@ -122,6 +129,8 @@ public function __construct(
                 'workforce_pool_user_project should not be set for non-workforce pool credentials.'
             );
         }
+
+        $this->jsonKey = $jsonKey;
     }
 
     /**
@@ -278,7 +287,7 @@ public function fetchAuthToken(callable $httpHandler = null)
 
     public function getCacheKey()
     {
-        return $this->auth->getCacheKey();
+        return implode(':', $this->flattenJsonKey($this->jsonKey)) . ':' . $this->auth->getFormattedScopeOrAudience();
     }
 
     public function getLastReceivedToken()
@@ -359,4 +368,26 @@ private function isWorkforcePool(): bool
         $regex = '#//iam\.googleapis\.com/locations/[^/]+/workforcePools/#';
         return preg_match($regex, $this->auth->getAudience()) === 1;
     }
+
+    /**
+     * @param array<mixed> $arr
+     *
+     * @return array<string>
+     */
+    private function flattenJsonKey(array $arr): array
+    {
+        $result = [];
+
+        foreach($arr as $key => $val) {
+            if (is_array($val)) {
+                $result = array_merge($result, $this->flattenJsonKey($val));
+            } elseif ($val === '') {
+                continue;
+            } else {
+                array_push($result, $val);
+            }
+        }
+
+        return $result;
+    }
 }

src/Credentials/GCECredentials.php

@@ -493,7 +493,7 @@ public function fetchAuthToken(callable $httpHandler = null)
      */
     public function getCacheKey()
     {
-        return self::cacheKey;
+        return $this->tokenUri;
     }
 
     /**

src/Credentials/ServiceAccountCredentials.php

@@ -223,7 +223,8 @@ public function fetchAuthToken(callable $httpHandler = null)
      */
     public function getCacheKey()
     {
-        $key = $this->auth->getIssuer() . ':' . $this->auth->getCacheKey();
+        $key = $this->auth->getIssuer() . ':' . $this->auth->getFormattedScopeOrAudience();
+
         if ($sub = $this->auth->getSub()) {
             $key .= ':' . $sub;
         }

src/Credentials/ServiceAccountJwtAccessCredentials.php

@@ -170,7 +170,7 @@ public function fetchAuthToken(callable $httpHandler = null)
      */
     public function getCacheKey()
     {
-        return $this->auth->getCacheKey();
+        return $this->auth->getIssuer() . ':' . $this->auth->getFormattedScopeOrAudience();
     }
 
     /**

src/Credentials/UserRefreshCredentials.php

@@ -134,7 +134,7 @@ public function fetchAuthToken(callable $httpHandler = null, array $metricsHeade
      */
     public function getCacheKey()
     {
-        return $this->auth->getClientId() . ':' . $this->auth->getCacheKey();
+        return $this->auth->getClientId() . ':' . $this->auth->getFormattedScopeOrAudience();
     }
 
     /**

src/OAuth2.php

@@ -703,6 +703,26 @@ public function getCacheKey()
         return null;
     }
 
+    /**
+     * Obtains the scope or the Audience and formats it for external classes to use
+     * in generating a cache key.
+     *
+     * @return ?string a key that may be used to cache the auth token.
+     */
+    public function getFormattedScopeOrAudience()
+    {
+        if (is_array($this->scope)) {
+            return implode(':', $this->scope);
+        }
+
+        if ($this->audience) {
+            return $this->audience;
+        }
+
+        // If scope has not set, return null to indicate no caching.
+        return null;
+    }
+
     /**
      * Parses the fetched tokens.
      *

tests/Credentials/ExternalAccountCredentialsTest.php

@@ -521,6 +521,18 @@ public function testFetchAuthTokenWithWorkforcePoolCredentials()
         $this->assertEquals(strtotime($expiry), $authToken['expires_at']);
     }
 
+    public function testCacheKeyFormat()
+    {
+        $credentials = new ExternalAccountCredentials('scope1', $this->baseCreds);
+        $cacheKey = $credentials->getCacheKey();
+
+        // I decided to hand craft this manually to avoid reusing the flattenJsonKey method
+        // inside the ExternalAccountCredentials class and make
+        // sure the flat function works properly
+        $expectedKey = 'external_account:token-url.com:sts-url.com:scope1';
+        $this->assertEquals($expectedKey, $cacheKey);
+    }
+
     /**
      * @runInSeparateProcess
      */

tests/Credentials/ServiceAccountJwtAccessCredentialsTest.php

@@ -480,8 +480,10 @@ public function testShouldBeTheSameAsOAuth2WithTheSameScope()
     {
         $testJson = $this->createTestJson();
         $scope = ['scope/1', 'scope/2'];
-        $sa = new ServiceAccountJwtAccessCredentials($testJson);
-        $this->assertNull($sa->getCacheKey());
+        $sa = new ServiceAccountJwtAccessCredentials($testJson, $scope);
+
+        $expectedKey = $testJson['client_email'] . ':' . implode(':', $scope);
+        $this->assertEquals($expectedKey, $sa->getCacheKey());
     }
 
     public function testReturnsClientEmail()