@VisibleForTesting
  String getAuthRequestParameters(
      @Nullable Credential credential, Map<String, String> repositoryScopes) {
    String serviceScope = getServiceScopeRequestParameters(repositoryScopes);
    return isOAuth2Auth(credential)
        ? serviceScope
            // https://github.com/GoogleContainerTools/jib/pull/1545
            + "&client_id=jib.da031fe481a93ac107a95a96462358f9"
            + "&grant_type=refresh_token&refresh_token="
            // If OAuth2, credential.getPassword() is a refresh token.
            + Verify.verifyNotNull(credential).getPassword()
        : serviceScope;
  }
Authenticates permission to pull and push.

@param credential the credential used to authenticate
@return an {@code Authorization} authenticating the push
@throws RegistryAuthenticationFailedException if authentication fails
@throws RegistryCredentialsNotSentException if authentication failed and credentials were not
    sent over plain HTTP
jib-core/src/main/java/com/google/cloud/tools/jib/registry/RegistryAuthenticator.java