feat: add exp field to JWT if expires_in is set

[ericnorris]

This commit adds the ability to add an exp field to the signed JWT. While Terraform has some time-related functions (e.g. timestamp and formatdate), there does not appear to be a Terraform-native way of generating a unix timestamp for the current time. Without this feature it would be impossible for a user to set exp to a meaningful value themselves.

If this PR is for Terraform, I acknowledge that I have:

• Searched through the issue tracker for an open issue that this either resolves or contributes to, commented on it to claim it, and written "fixes {url}" or "part of {url}" in this PR description. If there were no relevant open issues, I opened one and commented that I would like to work on it (not necessary for very small changes).
• Generated Terraform, and ran make test and make lint to ensure it passes unit and linter tests.
• Ensured that all new fields I added that can be set by a user appear in at least one example (for generated resources) or third_party test (for handwritten resources or update tests).
• Ran relevant acceptance tests (If the acceptance tests do not yet pass or you are unable to run them, please let your reviewer know).
• Read the Release Notes Guide before writing my release note below.

Release Note Template for Downstream PRs (will be copied)

google_service_account_jwt: added `expires_in` attribute for generating `exp` claim.

[modular-magician]

Hello! I am a robot who works on Magic Modules PRs.

I've detected that you're a community contributor. @c2thorn, a repository maintainer, has been assigned to assist you and help review your changes.

❓ First time contributing? Click here for more details

---

Your assigned reviewer will help review your code by:

• Ensuring it's backwards compatible, covers common error cases, etc.
• Summarizing the change into a user-facing changelog note.
• Passes tests, either our "VCR" suite, a set of presubmit tests, or with manual test runs.

You can help make sure that review is quick by running local tests and ensuring they're passing in between each push you make to your PR's branch. Also, try to leave a comment with each push you make, as pushes generally don't generate emails.

If your reviewer doesn't get back to you within a week after your most recent change, please feel free to leave a comment on the issue asking them to take a look! In the absence of a dedicated review dashboard most maintainers manage their pending reviews through email, and those will sometimes get lost in their inbox.

---

[modular-magician]

Hi! I'm the modular magician. Your PR generated some diffs in downstreams - here they are.

Diff report:

Terraform GA: Diff ( 3 files changed, 55 insertions(+), 2 deletions(-))
Terraform Beta: Diff ( 3 files changed, 55 insertions(+), 2 deletions(-))
TF Validator: Diff ( 2 files changed, 3 insertions(+), 3 deletions(-))

[modular-magician]

Tests analytics

Total tests: 2136
Passed tests 1898
Skipped tests: 228
Failed tests: 10

Action taken

Triggering VCR tests in RECORDING mode for the tests that failed during VCR. Click here to see the failed tests

TestAccSqlDatabaseInstance_withPrivateNetwork_withAllocatedIpRange|TestAccSqlDatabaseInstance_SqlServerAuditConfig|TestAccComputeInstance_soleTenantNodeAffinities|TestAccComputeInstance_networkPerformanceConfig|TestAccComputeGlobalForwardingRule_internalLoadBalancing|TestAccCloudfunctions2function_cloudfunctions2BasicGcsExample|TestAccCloudFunctions2Function_fullUpdate|TestAccCloudfunctions2function_cloudfunctions2BasicAuditlogsExample|TestAccCloudRunService_cloudRunServiceStaticOutboundExample|TestAccPrivatecaCertificateAuthority_privatecaCertificateAuthoritySubordinateExample

[modular-magician]

Tests passed during RECORDING mode:
TestAccCloudfunctions2function_cloudfunctions2BasicGcsExample[view]
TestAccCloudFunctions2Function_fullUpdate[view]
TestAccCloudfunctions2function_cloudfunctions2BasicAuditlogsExample[view]
TestAccPrivatecaCertificateAuthority_privatecaCertificateAuthoritySubordinateExample[view]

Tests failed during RECORDING mode:
TestAccSqlDatabaseInstance_withPrivateNetwork_withAllocatedIpRange[view]
TestAccSqlDatabaseInstance_withPrivateNetwork_withAllocatedIpRangeClone[view]
TestAccSqlDatabaseInstance_withPrivateNetwork_withAllocatedIpRangeReplica[view]
TestAccSqlDatabaseInstance_SqlServerAuditConfig[view]
TestAccComputeInstance_soleTenantNodeAffinities[view]
TestAccComputeInstance_networkPerformanceConfig[view]
TestAccComputeGlobalForwardingRule_internalLoadBalancing[view]
TestAccCloudRunService_cloudRunServiceStaticOutboundExample[view]

Please fix these to complete your PR
View the build log or the debug log for each test

[ericnorris]

I don't believe the VCR test failures are related to my change, so I've marked this as ready for review.

[c2thorn]

Thanks for the contribution @ericnorris! Just stating here that this is on my TODO, just have been running a bit behind on reviews. I'm not as familiar with the resource so I need to gain context first. Thanks for your patience.

[c2thorn]

Hi @ericnorris, apologies for the delay. I spoke with my team, and there are concerns about this field playing well with Terraform's plan time validation of datasources. TF assumes that old Datasource values are valid at plan time. This field would add volatility that leave us unsure with the edge cases of.

It would be more comfortable if this was modeled as part of a resource instead, as it has more flexibility. The resource would be extremely similar in structure, but this is fairly common for other resources/datasource pairs.

[ericnorris]

Hey @c2thorn, no worries. I'm not sure this would make sense as a resource, as it would need to get destroyed and recreated on essentially every run, or else its output would be invalid.

That is, if the generated JWT resource had an expires_in set to 60 seconds, it would create a resource who's output was only valid for 60 seconds, and you'd need to do something to taint the resource in order for it to make a valid one later. This wouldn't work for the use case I'd like to use it for, because I want it to always output a valid JWT.

I'll add that I don't think this would cause a problem with terraform at plan time, and in fact there are some time-based data sources in the provider already, see:

magic-modules/mmv1/third_party/terraform/data_sources/data_source_storage_object_signed_url.go

Line 116 in ac62831

expires := time.Now().Unix() + int64(duration.Seconds())

The data source generates a signed URL that will expire in some amount of time, just like my proposed change to the JWT data source, making it equally as "unstable".

[c2thorn]

I'll add that I don't think this would cause a problem with terraform at plan time, and in fact there are some time-based data sources in the provider already, see:

magic-modules/mmv1/third_party/terraform/data_sources/data_source_storage_object_signed_url.go

Line 116 in ac62831

expires := time.Now().Unix() + int64(duration.Seconds())

The data source generates a signed URL that will expire in some amount of time, just like my proposed change to the JWT data source, making it equally as "unstable".

Thanks for pointing this out, I was not aware of this. That is very similar to this case and is working. I'll move forward with this PR

[c2thorn]

I think testing a scenario where the expires_in is updated would help me feel like we aren't missing some edge case. Would you mind adding another step in this existing test?

[modular-magician]

Hi! I'm the modular magician. Your PR generated some diffs in downstreams - here they are.

Diff report:

Terraform GA: Diff ( 3 files changed, 65 insertions(+), 2 deletions(-))
Terraform Beta: Diff ( 3 files changed, 65 insertions(+), 2 deletions(-))
TF Validator: Diff ( 2 files changed, 3 insertions(+), 3 deletions(-))

[modular-magician]

Tests analytics

Total tests: 2170
Passed tests 1927
Skipped tests: 236
Failed tests: 7

Action taken

Triggering VCR tests in RECORDING mode for the tests that failed during VCR. Click here to see the failed tests

TestAccPrivatecaCertificateAuthority_privatecaCertificateAuthoritySubordinateExample|TestAccFirebaserulesRelease_BasicRelease|TestAccComputeInstance_soleTenantNodeAffinities|TestAccCloudfunctions2function_cloudfunctions2BasicAuditlogsExample|TestAccCloudfunctions2function_cloudfunctions2BasicGcsExample|TestAccCloudFunctions2Function_fullUpdate|TestAccCGCSnippet_eventarcWorkflowsExample

[modular-magician]

Tests passed during RECORDING mode:
TestAccPrivatecaCertificateAuthority_privatecaCertificateAuthoritySubordinateExample[Debug log]
TestAccFirebaserulesRelease_BasicRelease[Debug log]
TestAccCloudfunctions2function_cloudfunctions2BasicAuditlogsExample[Debug log]
TestAccCloudfunctions2function_cloudfunctions2BasicGcsExample[Debug log]
TestAccCloudFunctions2Function_fullUpdate[Debug log]
TestAccCGCSnippet_eventarcWorkflowsExample[Debug log]

Tests failed during RECORDING mode:
TestAccComputeInstance_soleTenantNodeAffinities[Error message] [Debug log]

Please fix these to complete your PR
View the build log or the debug log for each test

[c2thorn]

updated test passed. Thank you for your effort and patience here @ericnorris