fix: make vertex work in vscode playground again (#1645)

For some reason, when we do the gcp oauth exchange, we were asking for
access tokens that would be valid for 60h. GCP probably at some recent
point started denying these requests (because access tokens should not
live for 60h, that's absurd), so we trim the expiration time down to 1h,
which appears to fix things.

(We request a new oauth token for every single request in wasm, so the
lifetime of the token could literally be measured in seconds + clock
skew.)

<img width="521" alt="image"
src="https://github.com/user-attachments/assets/9bfde855-3c08-4928-8ef4-d77e3b5d1095"
/>

<img width="1092" alt="image"
src="https://github.com/user-attachments/assets/629cb64c-f0c9-46f3-b9a4-562e9f503a27"
/>

Also improve the error message when this does fail:

<img width="571" alt="image"
src="https://github.com/user-attachments/assets/122a25c0-040c-4509-8619-ec28e2b3cdd3"
/>

Author: sxlijin

engine/baml-runtime/src/internal/llm_client/primitive/vertex/wasm_auth.rs

@@ -19,20 +19,25 @@ impl VertexAuth {
     pub async fn new(auth_strategy: &ResolvedGcpAuthStrategy) -> Result<VertexAuth> {
         Ok(match auth_strategy {
             ResolvedGcpAuthStrategy::FilePath(path) => {
-                anyhow::bail!("Failed to auth - cannot load credentials from files in WASM")
+                anyhow::bail!(
+                    "Failed to auth - cannot load credentials from a file in WASM (path='{}...', path.len={})",
+                    path.chars().take(5).collect::<String>(),
+                    path.len()
+                )
             }
             ResolvedGcpAuthStrategy::JsonString(json) => {
                 log::debug!("Attempting to auth using JsonString strategy");
                 Self(serde_json::from_str(&json).context("Failed to parse service account credentials as GCP service account creds (are you using JSON format creds?)")?)
             }
             ResolvedGcpAuthStrategy::JsonObject(json) => {
+                // NB: this should never happen in WASM, there's no way to pass a JSON object in
                 log::debug!("Attempting to auth using JsonObject strategy");
                 Self(serde_json::from_value(
                     serde_json::to_value(&json).context("Failed to parse service account credentials as GCP service account creds (issue during serialization)")?).context("Failed to parse service account credentials as GCP service account creds (are you using JSON format creds?)")?)
             }
             ResolvedGcpAuthStrategy::SystemDefault => {
                 anyhow::bail!(
-                    "Failed to auth - cannot load GCP application default credentials in WASM"
+                    "Failed to auth - failed to load default credentials in WASM (please set env.GOOGLE_APPLICATION_CREDENTIALS, see https://docs.boundaryml.com/ref/llm-client-providers/google-vertex#using-a-vertex-ai-client-in-the-playground)"
                 )
             }
         })
@@ -95,7 +100,7 @@ impl Claims {
             iss: service_account.client_email.clone(),
             scope: DEFAULT_SCOPE.to_string(),
             aud: service_account.token_uri.clone(),
-            exp: (now + chrono::Duration::hours(60)).timestamp(),
+            exp: (now + chrono::Duration::hours(1)).timestamp(),
             iat: now.timestamp(),
         }
     }
@@ -108,35 +113,3 @@ pub struct ServiceAccount {
     pub client_email: String,
     pub private_key: String,
 }
-
-async fn get_access_token(service_account: &ServiceAccount) -> Result<String> {
-    // Create the JWT
-    let claims = Claims::from_service_account(service_account);
-
-    let jwt = encode_jwt(&serde_json::to_value(claims)?, &service_account.private_key)
-        .await
-        .map_err(|e| anyhow::anyhow!(format!("{e:?}")))?;
-
-    // Make the token request
-    let client = reqwest::Client::new();
-    let params = [
-        ("grant_type", "urn:ietf:params:oauth:grant-type:jwt-bearer"),
-        ("assertion", &jwt),
-    ];
-    let res: serde_json::Value = client
-        .post(&service_account.token_uri)
-        .form(&params)
-        .send()
-        .await?
-        .json()
-        .await?;
-
-    Ok(res
-        .as_object()
-        .context("Token exchange did not return a JSON object")?
-        .get("access_token")
-        .context("Access token not found in response")?
-        .as_str()
-        .context("Access token is not a string")?
-        .to_string())
-}