feat(pubsub): authenticated push requests

appengine/pubsub/README.md

@@ -9,14 +9,16 @@ and [flexible environment](https://cloud.google.com/appengine/docs/flexible/node
 Before you can run or deploy the sample, you will need to do the following:
 
 1. Enable the Cloud Pub/Sub API in the [Google Developers Console](https://console.developers.google.com/project/_/apiui/apiview/pubsub/overview).
-1. Create a topic and subscription.
+1. Create a topic and subscription. The push auth service account must have Service Account Token Creator Role assigned, which can be done in the Cloud Console [IAM & admin](https://console.cloud.google.com/iam-admin/iam) UI. `--push-auth-token-audience` is optional. If set, remember to modify the audience field check in `app.js` (line 112).
 
         gcloud beta pubsub topics create <your-topic-name>
         gcloud beta pubsub subscriptions create <your-subscription-name> \
           --topic <your-topic-name> \
           --push-endpoint \
             https://<your-project-id>.appspot.com/pubsub/push?token=<your-verification-token> \
-          --ack-deadline 30
+          --ack-deadline 30 \
+          --push-auth-service-account=[your-service-account-email] \
+          --push-auth-token-audience=example.com
 
 1. Update the environment variables in `app.standard.yaml` or `app.flexible.yaml`
 (depending on your App Engine environment).
@@ -61,3 +63,19 @@ Response:
 
 After the request completes, you can refresh `localhost:8080` and see the
 message in the list of received messages.
+
+### Authenticated push notifications
+
+Simulating authenticated push requests will fail because requests need to contain a Cloud Pub/Sub-generated JWT in the "Authorization" header.
+
+    http POST ":8080/pubsub/authenticated-push?token=<your-verification-token>" < sample_message.json
+
+Response:
+
+    HTTP/1.1 400 Bad Request
+    Connection: keep-alive
+    Date: Thu, 25 Apr 2019 17:47:36 GMT
+    Transfer-Encoding: chunked
+    X-Powered-By: Express
+
+    Invalid token