code: func (db *SnapshotDB) IsAllowedOAuthClientID(c context.Context, email, clientID string) (bool, error) {
  	// No need to whitelist client IDs for service accounts, since email address
  	// uniquely identifies credentials used. Note: this is Google specific.
  	if strings.HasSuffix(email, ".gserviceaccount.com") {
  		return true, nil
  	}
  
  	// clientID must be set for non service accounts.
  	if clientID == "" {
  		return false, nil
  	}
  
  	_, ok := db.clientIDs[clientID]
  	return ok, nil
  }
docs: // IsAllowedOAuthClientID returns true if given OAuth2 client_id can be used
  // to authenticate access for given email.