code: func (a *Authenticator) getBaseTokenLocked(ctx context.Context, lifetime time.Duration) (*internal.Token, error) {
  	if !a.isActing() {
  		panic("impossible")
  	}
  
  	// Already have a good token?
  	if lifetime > 0 && !internal.TokenExpiresInRnd(ctx, a.baseToken.token, lifetime) {
  		return a.baseToken.token, nil
  	}
  
  	// Need to make one.
  	return a.baseToken.compareAndRefresh(ctx, compareAndRefreshOp{
  		lock:     nil, // already holding the lock
  		prev:     a.baseToken.token,
  		lifetime: lifetime,
  		refreshCb: func(ctx context.Context, prev *internal.Token) (*internal.Token, error) {
  			return a.baseToken.renewToken(ctx, prev, nil)
  		},
  	})
  }
docs: // getBaseTokenLocked is used to get an IAM-scoped token when running in
  // actor mode.
  //
  // Passing negative lifetime causes a forced refresh.
  //
  // It is called with a.lock locked.