get-gcp-jwt: correct scope, clean up call
It turns out 'devstorage.read_write' also gives us an access token
instead of a JWT, and is probably more the thing that we want.
Took the opportunity to make scope a macro to clean up the make-jwt call
site.
;< =key:rsa bind:m read-private-key
;< kid=@t bind:m (read-setting %private-key-id)
;< aud=@t bind:m (read-setting %token-uri)
+=* scope 'https://www.googleapis.com/auth/devstorage.read_write'
=/ jot=@t
- %: make-jwt
- key kid iss
- 'https://www.googleapis.com/auth/cloud-platform'
- aud now.bowl
- ==
+ (make-jwt key kid iss scope aud now.bowl)
;< p=[access-token=@t expires-at=@da] bind:m
(get-access-token jot aud now.bowl)
(pure:m !>(p))
