RefreshTokenProvider extends AbstractUserProvider { @Override public AccessToken getAccessToken(String googleIdentity, List<String> scopes) { RefreshToken refreshToken = null; try { refreshToken = (RefreshToken) AbstractDatabaseBackend.getInstance().get(RefreshToken.class, googleIdentity); } catch (DatabaseObjectNotFound e) { throw Status.PERMISSION_DENIED.withDescription(String.format(AUTHZ_ERROR_MESSAGE, googleIdentity)).asRuntimeException(); } byte[] encryptedValue = refreshToken.getValue(); String decryptedValue = new String(AbstractEncryptionBackend.getInstance().decrypt(encryptedValue)); GoogleClientSecrets clientSecrets = OauthClientSecretsLoader.getSecrets(); TokenResponse response = null; try { response = new GoogleRefreshTokenRequest( new NetHttpTransport(), new JacksonFactory(), decryptedValue, clientSecrets.getDetails().getClientId(), clientSecrets.getDetails().getClientSecret() ).setScopes(scopes).execute(); } catch (IOException e) { throw Status.PERMISSION_DENIED.withDescription(String.format(AUTHZ_ERROR_MESSAGE, googleIdentity)).asRuntimeException(); } return new AccessToken( response.getAccessToken(), TimeUtils.currentTimeMillis() + response.getExpiresInSeconds() * 1000); }  @Override AccessToken getAccessToken(String googleIdentity, List<String> scopes);  }
@Test public void testUnauthorized() { RefreshTokenProvider provider = new RefreshTokenProvider(); try { provider.getAccessToken("bob@example.com", SCOPES); fail("StatusRuntimeException not thrown"); } catch (StatusRuntimeException e) { assertEquals(Status.PERMISSION_DENIED.getCode(), e.getStatus().getCode()); assertEquals( "GCP Token Broker authorization is invalid or has expired for identity: bob@example.com", e.getStatus().getDescription()); } }