Refresh Google ADC credentials (if needed)

refresh-adc.sh

#!/bin/bash

# `gcloud auth application-default print-access-token` can also serve as a check
# but takes a few seconds to run. POSTing directly to Google's oauth endpoint is
# much faster.
function check_adc {
    ADC_FILE="$HOME/.config/gcloud/application_default_credentials.json"

    [ ! -f "$ADC_FILE" ] && return 1

    CLIENT_ID=$(jq -r .client_id "$ADC_FILE")
    CLIENT_SECRET=$(jq -r .client_secret "$ADC_FILE")
    REFRESH_TOKEN=$(jq -r .refresh_token "$ADC_FILE")

    RESPONSE=$(curl -s -X POST https://oauth2.googleapis.com/token \
                    -d client_id="$CLIENT_ID" \
                    -d client_secret="$CLIENT_SECRET" \
                    -d refresh_token="$REFRESH_TOKEN" \
                    -d grant_type=refresh_token)

    [[ "$RESPONSE" != *"access_token"* ]] && return 1

    return 0
}

check_adc || gcloud auth application-default login 2>/dev/null