// Path: src/main/java/com/google/fleetengine/auth/token/FleetEngineToken.java
// @AutoValue
// public abstract class FleetEngineToken {
//   /** Token creation timestamp. */
//   public abstract Date creationTimestamp();
// 
//   /** Token expiration timestamp. */
//   public abstract Date expirationTimestamp();
// 
//   /** Audience (aud claim) of the JWT. */
//   public abstract String audience();
// 
//   /** Signed and base64 encoded JWT. */
//   @Nullable
//   public abstract String jwt();
// 
//   /** Scope of the authorization token. */
//   public abstract FleetEngineTokenType tokenType();
// 
//   /** Custom authorization claims written to JWT. */
//   public abstract FleetEngineTokenClaims authorizationClaims();
// 
//   /** Provides a builder for {@link FleetEngineToken}. */
//   public static Builder builder() {
//     return new AutoValue_FleetEngineToken.Builder()
//         .setAudience(CommonConstants.DEFAULT_JWT_AUDIENCE);
//   }
// 
//   public abstract FleetEngineToken.Builder toBuilder();
// 
//   /** Builder class for FleetEngineToken. */
//   @AutoValue.Builder
//   public abstract static class Builder {
// 
//     /** Setter for token creation timestamp. */
//     public abstract Builder setCreationTimestamp(Date creationTimestamp);
// 
//     /** Setter for token expiration timestamp. */
//     public abstract Builder setExpirationTimestamp(Date expirationTimestamp);
// 
//     /** Setter for a signed JWT to be associated with the token object. */
//     public abstract Builder setJwt(String token);
// 
//     /** Setter for the token type defining the scope of the token. */
//     public abstract Builder setTokenType(FleetEngineTokenType type);
// 
//     /** Setter for token audience (aud claim). */
//     public abstract Builder setAudience(String audience);
// 
//     /** Sets custom authorization claims written to JWT. */
//     public abstract Builder setAuthorizationClaims(FleetEngineTokenClaims claims);
// 
//     /** Builds the token object. */
//     public abstract FleetEngineToken build();
//   }
// }
// 
// Path: src/main/java/com/google/fleetengine/auth/token/factory/signer/util/CommonConstants.java
// public final class CommonConstants {
//   /* JWT name of the authorization claim.  */
//   public static final String JWT_CLAIM_AUTHORIZATION_PROPERTY = "authorization";
// 
//   /* Default value of the JWT audience (aud claim). */
//   public static final String DEFAULT_JWT_AUDIENCE = "https://fleetengine.googleapis.com/";
// 
//   private CommonConstants() {}
// }


import com.auth0.jwt.JWT;
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.exceptions.SignatureVerificationException;
import com.auth0.jwt.interfaces.DecodedJWT;
import com.google.auth.oauth2.GoogleCredentials;
import com.google.auth.oauth2.ImpersonatedCredentials;
import com.google.common.annotations.VisibleForTesting;
import com.google.common.collect.ImmutableList;
import com.google.fleetengine.auth.token.FleetEngineToken;
import com.google.fleetengine.auth.token.factory.signer.util.CommonConstants;
import java.io.IOException;
import java.util.Arrays;
   */
  private static ImpersonatedCredentials.Builder createImpersonatedCredentials(
      String serviceAccount, GoogleCredentials defaultCredentials) {
    return ImpersonatedCredentials.newBuilder()
        .setSourceCredentials(defaultCredentials)
        // Sets the service account that the signer was created with.
        .setTargetPrincipal(serviceAccount)
        .setScopes(IAM_SCOPE);
  }

  /**
   * Signs a provided Fleet Engine token.
   *
   * <p>The impersonated service account should match the role according to the {@link
   * com.google.fleetengine.auth.token.FleetEngineTokenType} of the provided token.
   *
   * @param token Fleet Engine token to sign
   * @return same value as the {@code token} parameter except with the JWT property set to a valid
   *     JWT
   */
  @Override
  public FleetEngineToken sign(FleetEngineToken token) {
    String signedToken =
        JWT.create()
            .withIssuer(impersonatedCredentials.getAccount())
            .withSubject(impersonatedCredentials.getAccount())
            .withAudience(token.audience())
            .withExpiresAt(token.expirationTimestamp())
            .withIssuedAt(token.creationTimestamp())
            .withClaim(
// Path: src/main/java/com/google/fleetengine/auth/token/FleetEngineToken.java
// @AutoValue
// public abstract class FleetEngineToken {
//   /** Token creation timestamp. */
//   public abstract Date creationTimestamp();
// 
//   /** Token expiration timestamp. */
//   public abstract Date expirationTimestamp();
// 
//   /** Audience (aud claim) of the JWT. */
//   public abstract String audience();
// 
//   /** Signed and base64 encoded JWT. */
//   @Nullable
//   public abstract String jwt();
// 
//   /** Scope of the authorization token. */
//   public abstract FleetEngineTokenType tokenType();
// 
//   /** Custom authorization claims written to JWT. */
//   public abstract FleetEngineTokenClaims authorizationClaims();
// 
//   /** Provides a builder for {@link FleetEngineToken}. */
//   public static Builder builder() {
//     return new AutoValue_FleetEngineToken.Builder()
//         .setAudience(CommonConstants.DEFAULT_JWT_AUDIENCE);
//   }
// 
//   public abstract FleetEngineToken.Builder toBuilder();
// 
//   /** Builder class for FleetEngineToken. */
//   @AutoValue.Builder
//   public abstract static class Builder {
// 
//     /** Setter for token creation timestamp. */
//     public abstract Builder setCreationTimestamp(Date creationTimestamp);
// 
//     /** Setter for token expiration timestamp. */
//     public abstract Builder setExpirationTimestamp(Date expirationTimestamp);
// 
//     /** Setter for a signed JWT to be associated with the token object. */
//     public abstract Builder setJwt(String token);
// 
//     /** Setter for the token type defining the scope of the token. */
//     public abstract Builder setTokenType(FleetEngineTokenType type);
// 
//     /** Setter for token audience (aud claim). */
//     public abstract Builder setAudience(String audience);
// 
//     /** Sets custom authorization claims written to JWT. */
//     public abstract Builder setAuthorizationClaims(FleetEngineTokenClaims claims);
// 
//     /** Builds the token object. */
//     public abstract FleetEngineToken build();
//   }
// }
// 
// Path: src/main/java/com/google/fleetengine/auth/token/factory/signer/util/CommonConstants.java
// public final class CommonConstants {
//   /* JWT name of the authorization claim.  */
//   public static final String JWT_CLAIM_AUTHORIZATION_PROPERTY = "authorization";
// 
//   /* Default value of the JWT audience (aud claim). */
//   public static final String DEFAULT_JWT_AUDIENCE = "https://fleetengine.googleapis.com/";
// 
//   private CommonConstants() {}
// }


// Path: src/main/java/com/google/fleetengine/auth/token/factory/signer/ImpersonatedSigner.java
import com.auth0.jwt.JWT;
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.exceptions.SignatureVerificationException;
import com.auth0.jwt.interfaces.DecodedJWT;
import com.google.auth.oauth2.GoogleCredentials;
import com.google.auth.oauth2.ImpersonatedCredentials;
import com.google.common.annotations.VisibleForTesting;
import com.google.common.collect.ImmutableList;
import com.google.fleetengine.auth.token.FleetEngineToken;
import com.google.fleetengine.auth.token.factory.signer.util.CommonConstants;
import java.io.IOException;
import java.util.Arrays;

   */
  private static ImpersonatedCredentials.Builder createImpersonatedCredentials(
      String serviceAccount, GoogleCredentials defaultCredentials) {
    return ImpersonatedCredentials.newBuilder()
        .setSourceCredentials(defaultCredentials)
        // Sets the service account that the signer was created with.
        .setTargetPrincipal(serviceAccount)
        .setScopes(IAM_SCOPE);
  }

  /**
   * Signs a provided Fleet Engine token.
   *
   * <p>The impersonated service account should match the role according to the {@link
   * com.google.fleetengine.auth.token.FleetEngineTokenType} of the provided token.
   *
   * @param token Fleet Engine token to sign
   * @return same value as the {@code token} parameter except with the JWT property set to a valid
   *     JWT
   */
  @Override
  public FleetEngineToken sign(FleetEngineToken token) {
    String signedToken =
        JWT.create()
            .withIssuer(impersonatedCredentials.getAccount())
            .withSubject(impersonatedCredentials.getAccount())
            .withAudience(token.audience())
            .withExpiresAt(token.expirationTimestamp())
            .withIssuedAt(token.creationTimestamp())
            .withClaim(
                CommonConstants.JWT_CLAIM_AUTHORIZATION_PROPERTY,