code: func NewRigidGenerator(ctx context.Context, authenticator *auth.Authenticator) (TokenGenerator, error) {
  	// Bail early if we detect there are no cached refresh token for the requested
  	// combination of scopes.
  	if err := authenticator.CheckLoginRequired(); err != nil {
  		return nil, err
  	}
  	return rigidGenerator{authenticator}, nil
  }
docs: // NewRigidGenerator constructs TokenGenerator that always uses given
  // authenticator to generate tokens, regardless of requested scopes.
  //
  // It is suitable for auth methods that rely on existing pre-configured
  // credentials or state to generate tokens with some predefined set of scopes.
  //
  // For example, this is the case for UserCredentialsMethod (where the user has
  // to go through a login flow to get a refresh token) or for GCEMetadataMethod
  // (where GCE instance has to be launched with predefined list of scopes).
  //
  // The token generator will return the access token with scopes it can give,
  // regardless of requested scopes. Also this token will always have all scopes
  // given to it by Authenticator.
  //
  // Note that we can't even compare the requested scopes to the scopes provided
  // by the authenticator, because some Google scopes are aliases for a large set
  // of scopes. For example, a token with 'cloud-platform' scope can be used in
  // APIs that expect 'iam' scope. So the generator will just give the token it
  // has, hoping for the best. If the token is not sufficient, callers will get
  // HTTP 403 or HTTP 401 errors when using it.