use strict;
use warnings;

my $mode = $ENV{PRUVA_TRIGGER_MODE} // 'google_auth_default';

my $creds;
if ( $mode eq 'google_auth_default' ) {
    require Google::Auth;
    $creds = Google::Auth->default(['https://www.googleapis.com/auth/cloud-platform']);
}
else {
    require Google::Auth::DefaultCredentials;
    my $dc = Google::Auth::DefaultCredentials->new();
    $creds = $dc->from_env(['https://www.googleapis.com/auth/cloud-platform']);
}

if ( !$creds ) {
    print "RESULT: no credentials resolved from environment\n";
    exit 3;
}
print "RESULT: credentials class = " . ref($creds) . "\n";

# The application now uses the credentials: fetching an access token makes the
# Pluggable subclass execute credential_source.executable.command via
# single-argument system() (full /bin/sh -c interpretation).
my $err;
eval { $creds->fetch_access_token( max_retries => 1 ); 1 } or do { $err = $@ || 'unknown'; };
$err //= '';
print "RESULT: fetch_access_token error: $err\n" if length $err;
print "RESULT: fetch_access_token completed without error\n" unless length $err;
exit 0;