production 푸시 초안

scripts/backup/upload_cloud.sh

@@ -17,6 +17,7 @@ if [[ -f "$repo_root/.env" ]]; then
     WORKS_DRIVE_ACCESS_TOKEN
     WORKS_DRIVE_ACCESS_TOKEN_FILE
     WORKS_DRIVE_ACCESS_TOKEN_CMD
+    WORKS_DRIVE_AUTH_MODE
     WORKS_DRIVE_OAUTH_SCOPE
     WORKS_DRIVE_SPLIT_SIZE
     WORKS_DRIVE_MAX_SINGLE_FILE_BYTES
@@ -43,7 +44,7 @@ if [[ -f "$repo_root/.env" ]]; then
   declare -A env_override_values=()
   env_override_set=()
   for env_key in "${env_override_keys[@]}"; do
-    if [[ -v "$env_key" ]]; then
+    if [[ -n "${!env_key:-}" ]]; then
       env_override_set+=("$env_key")
       env_override_values["$env_key"]="${!env_key}"
     fi
@@ -69,6 +70,7 @@ WORKS_DRIVE_PARENT_FILE_ID="${WORKS_DRIVE_PARENT_FILE_ID:-${WORKS_DRIVE_SHAREDRI
 
 dry_run="${WORKS_DRIVE_DRY_RUN:-false}"
 target="${WORKS_DRIVE_TARGET:-sharedrive}"
+auth_mode="${WORKS_DRIVE_AUTH_MODE:-auto}"
 api_base_url="${WORKS_ADMIN_API_BASE_URL:-https://www.worksapis.com}"
 curl_bin="${WORKS_DRIVE_CURL_BIN:-curl}"
 archive_dir="${WORKS_DRIVE_ARCHIVE_DIR:-/tmp/baron-sso-backup-upload}"
@@ -81,6 +83,11 @@ upload_reports="${WORKS_DRIVE_UPLOAD_REPORTS:-true}"
 report_folder_name="${WORKS_DRIVE_REPORT_FOLDER_NAME:-reports}"
 report_dir="$backup_path/reports"
 
+case "$auth_mode" in
+  auto | service-account | refresh-token) ;;
+  *) backup_die "unknown WORKS_DRIVE_AUTH_MODE: $auth_mode. Expected auto, service-account, or refresh-token." ;;
+esac
+
 if [[ -f "$backup_path" ]]; then
   report_dir="$(dirname "$backup_path")"
 fi
@@ -330,6 +337,13 @@ request_refresh_access_token() {
   jq -er '.access_token' <<<"$response_body"
 }
 
+service_account_credentials_configured() {
+  [[ -n "${WORKS_DRIVE_OAUTH_CLIENT_ID:-}" ]] \
+    && [[ -n "${WORKS_DRIVE_OAUTH_CLIENT_SECRET:-}" ]] \
+    && [[ -n "${WORKS_DRIVE_OAUTH_CLIENT_SERVICE_ACCOUNT:-}" ]] \
+    && { [[ -n "${WORKS_DRIVE_OAUTH_CLIENT_PRIVATE_KEY:-}" ]] || [[ -n "${WORKS_DRIVE_OAUTH_CLIENT_PRIVATE_KEY_FILE:-}" ]]; }
+}
+
 resolve_access_token() {
   if [[ -n "${WORKS_DRIVE_ACCESS_TOKEN:-}" ]]; then
     printf '%s\n' "$WORKS_DRIVE_ACCESS_TOKEN"
@@ -347,12 +361,27 @@ resolve_access_token() {
     return
   fi
 
-  if [[ -n "${WORKS_DRIVE_OAUTH_REFRESH_TOKEN:-}" ]]; then
-    request_refresh_access_token
-    return
-  fi
+  case "$auth_mode" in
+    service-account)
+      request_service_account_token
+      ;;
+    refresh-token)
+      request_refresh_access_token
+      ;;
+    auto)
+      if service_account_credentials_configured; then
+        request_service_account_token
+        return
+      fi
 
-  request_service_account_token
+      if [[ -n "${WORKS_DRIVE_OAUTH_REFRESH_TOKEN:-}" ]]; then
+        request_refresh_access_token
+        return
+      fi
+
+      request_service_account_token
+      ;;
+  esac
 }
 
 package_backup_path() {