[Question]: account impersonation auth flow

[ken-scarf]

How do I use this library to make impersonated requests? Here's an example of what I want to do

gcloud storage ls gs://[BUCKET_NAME] --impersonate-service-account=[SERVICE_ACCOUNT_EMAIL]

From what I've gathered so far I need to generate a token with Gogol.IAMCredentials.Projects.ServiceAccounts.GenerateAccessToken.newIAMCredentialsProjectsServiceAccountsGenerateAccessToken. I assume I need to construct a Credential using the access token I got. I tried constructing it authToAuthorizedUser but it fails because it requires a refresh token. Any help would be appreciated

[ken-scarf]

This is the modification I did to my fork to bypass a token refresh and use the impersonated access token

diff --git a/lib/gogol/src/Gogol/Auth.hs b/lib/gogol/src/Gogol/Auth.hs
index bbe4e40b8..054e019f5 100644
--- a/lib/gogol/src/Gogol/Auth.hs
+++ b/lib/gogol/src/Gogol/Auth.hs
@@ -183,6 +183,13 @@ exchange c l = fmap (Auth c) . action l
       FromClient x n -> exchangeCode x n
       FromUser u -> authorizedUserToken u Nothing
       FromTokenFile f -> \_l _m -> readTokenFile f
+      FromAccountImpersonation accessToken tokenExpiry ->
+        \_logger _manager ->
+          pure $ OAuthToken
+            { _tokenAccess = accessToken,
+              _tokenRefresh = Nothing,
+              _tokenExpiry = tokenExpiry
+            }

 -- | Refresh an existing 'OAuthToken'.
 refresh ::
@@ -200,6 +207,13 @@ refresh (Auth c t) l = fmap (Auth c) . action l
       FromClient x _ -> refreshToken x t
       FromUser u -> authorizedUserToken u (_tokenRefresh t)
       FromTokenFile f -> \_l _m -> readTokenFile f
+      FromAccountImpersonation accessToken tokenExpiry ->
+        \_logger _manager ->
+          pure $ OAuthToken
+            { _tokenAccess = accessToken,
+              _tokenRefresh = Nothing,
+              _tokenExpiry = tokenExpiry
+            }

 -- | Apply the (by way of possible token refresh) a bearer token to the
 -- authentication header of a request.
diff --git a/lib/gogol/src/Gogol/Internal/Auth.hs b/lib/gogol/src/Gogol/Internal/Auth.hs
index 9eaba956e..2a246f75b 100644
--- a/lib/gogol/src/Gogol/Internal/Auth.hs
+++ b/lib/gogol/src/Gogol/Internal/Auth.hs
@@ -71,6 +71,7 @@ data Credentials (s :: [Symbol])
     -- of the Google CloudSDK Tools.
     FromUser !AuthorizedUser
   | FromTokenFile !FilePath
+  | FromAccountImpersonation !AccessToken !UTCTime

 -- | Service Account credentials which are typically generated/download
 -- from the Google Developer console of the following form: