Discussion

• See auth.verify_id_token fails with 'Token used too early' #624 and Added option clockSkewInSeconds to allow setting clock_skew_in_seconds parameter for token verification #625
• Implements the feedback in Added option clockSkewInSeconds to allow setting clock_skew_in_seconds parameter for token verification #625 (comment) - with the suggested API and additional unit/integration tests

Testing

• All unit tests pass with pytest.
• Lint passes.
• Integration tests are pretty annoying. Not sure how to create an expired token to use, and the session cookies have a minimum expiry time of 300 seconds - the naive sleep 300 means that tests take 5 min to run. Happy to take guidance on improving that.

API Changes

• The API changes here were suggested/approved in the linked discussion.

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

Thanks @stillmatic for your contribution and getting this feature moving again.

This looks great! I have attached a few comments to be addressed to fully match the approved internal API proposal so please take a look.

Additionally, we would like to add validation on the clock_skew_seconds to limit it to between 0 and 60 seconds and throw a Value Error otherwise. Could you add that here with supporting test cases? Thank you!

I've addressed the feedback in the code change and rebased off main

Note: this dependency uses clock_skew_in_seconds https://.com/googleapis/google-auth-library-python/blob/7039beb63b8644be748cfc2fc79a2b8b643cda9f/google/oauth2/id_token.py#L112C5-L112C26, So if that gets updated, then this should also be updated. I'm going to assume that moving forward clock_skew_seconds is preferred and that you'll handle the discrepancy there.

A few small questions but otherwise it looks good!
@lahirumaramba do you have anything to add that we might have missed

Thanks for your concern around the discrepancy. We are aware of the convention there but preferred to default to being more in line with our other Firebase SDKs

LGTM! Thank you! Please take a look at the failing lint tests

cool - I removed that test and the lint is passing locally now

LGTM! Thank you for your contribution.

thanks for the help reviewing! I've rebased on upstream main and everything should be green.

LG with tiny nit, thanks!