feat: sign() on AuthClient

[demolaf]

Adds a sign() extension method to AuthClient that enables cryptographic signing of data, matching the Node.js Firebase Admin SDK's GoogleAuth.sign() behavior. The implementation automatically uses local signing when service account credentials with private keys are available, falling back to IAM API signing otherwise.

New sign() Extension Method

final credential = GoogleCredential.fromServiceAccount(file);
final client = await createAuthClient(credential, scopes);

// Sign data - automatically uses local signing if available
final signature = await client.sign('data to sign');

// Sign with custom IAM endpoint (e.g., for different universe domains)
final signature = await client.sign('data', endpoint:
'https://iamcredentials.example.com');

Signing behavior:

• Service account credentials with private key: Signs locally using RSA-SHA256 (fast, no API calls)
• Impersonated credentials: Uses IAM signBlob API with target principal
• Other credentials: Uses IAM signBlob API with default service account
• Custom endpoints: Supports different IAM Credentials API endpoints for universe domain support

Implementation

Expando-based credential association:

• Uses Expando to associate credentials with AuthClient instances
• No wrapper classes needed - returns standard AuthClient
• Credential association is maintained throughout the client lifecycle

Integration with Firebase Admin SDK:

• firebase_app.dart now uses createAuthClient()
• Auth clients automatically support sign() operations
• Local signing enabled by default when service account keys available

Testing

• ✅ Local signing with service account credentials
• ✅ IAM API signing fallback
• ✅ Impersonated credentials support
• ✅ Custom endpoint support

[github-actions]

Coverage Report

✅ Coverage 57.12% meets 40% threshold

Coverage: 57.12%
Lines Covered: 2563/4487

Minimum threshold: 40%

[Ehesp]

Can this technically not use the googleapis identidy provider api?

[demolaf]

yes and now that you mention it, seems the IAMCredentialsApi supports a different rootUrl, https://pub.dev/documentation/googleapis/latest/iamcredentials_v1/IAMCredentialsApi-class.html which I would refactor _signBlobWithEndpoint to use instead.

[demolaf]

so the nullable endpoint here allows projects to specify a different domain other than the default googleapis.com but I can't seem to find comprehensive docs on this except from here and then used like this to override service endpoints e.g. https://iamcredentials.googleapis.com -> https://iamcredentials.custom-universe-domain-here.com.

Also see how it's used in googleauth.ts