Warn when using cloud sdk credentials (#145)

* Issue warning when cloud sdk credentials are used.

lib/googleauth/client_id.rb

@@ -28,6 +28,7 @@
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 require 'multi_json'
+require 'googleauth/credentials_loader'
 
 module Google
   module Auth
@@ -63,13 +64,14 @@ module Google
       #       & secrets in source. See {#from_file} to load from
       #       `client_secrets.json` files.
       def initialize(id, secret)
+        CredentialsLoader.warn_if_cloud_sdk_credentials id
         raise 'Client id can not be nil' if id.nil?
         raise 'Client secret can not be nil' if secret.nil?
         @id = id
         @secret = secret
       end
 
-      # Constructs a Client ID from a JSON file downloaed from the
+      # Constructs a Client ID from a JSON file downloaded from the
       # Google Developers Console.
       #
       # @param [String, File] file
@@ -79,7 +81,7 @@ module Google
         raise 'File can not be nil.' if file.nil?
         File.open(file.to_s) do |f|
           json = f.read
-          config = MultiJson.load(json)
+          config = MultiJson.load json
           from_hash(config)
         end
       end

lib/googleauth/credentials.rb

@@ -31,7 +31,7 @@ require 'forwardable'
 require 'json'
 require 'signet/oauth_2/client'
 
-require 'googleauth/default_credentials'
+require 'googleauth/credentials_loader'
 
 module Google
   module Auth
@@ -68,6 +68,7 @@ module Google
           json['scope'] ||= scope
           @client = init_client json
         end
+        CredentialsLoader.warn_if_cloud_sdk_credentials @client.client_id
         @client.fetch_access_token!
       end
 
@@ -78,16 +79,16 @@ module Google
       def self.default(options = {})
         scope = options[:scope]
         # First try to find keyfile file from environment variables.
-        client = from_path_vars(scope)
+        client = from_path_vars scope
 
         # Second try to find keyfile json from environment variables.
-        client ||= from_json_vars(scope)
+        client ||= from_json_vars scope
 
         # Third try to find keyfile file from known file paths.
-        client ||= from_default_paths(scope)
+        client ||= from_default_paths scope
 
         # Finally get instantiated client from Google::Auth
-        client ||= from_application_default(scope)
+        client ||= from_application_default scope
         client
       end
 

lib/googleauth/credentials_loader.rb

@@ -57,6 +57,17 @@ module Google
       SYSTEM_DEFAULT_ERROR =
         'Unable to read the system default credential file'.freeze
 
+      CLOUD_SDK_CLIENT_ID = '764086051850-6qr4p6gpi6hn506pt8ejuq83di341hur.app'\
+        's.googleusercontent.com'.freeze
+
+      CLOUD_SDK_CREDENTIALS_WARNING = 'Your application has authenticated '\
+        'using end user credentials from Google Cloud SDK. We recommend that '\
+        'most server applications use service accounts instead. If your '\
+        'application continues to use end user credentials from Cloud SDK, '\
+        'you might receive a "quota exceeded" or "API not enabled" error. For'\
+        ' more information about service accounts, see '\
+        'https://cloud.google.com/docs/authentication/.'.freeze
+
       # make_creds proxies the construction of a credentials instance
       #
       # By default, it calls #new on the current class, but this behaviour can
@@ -119,6 +130,11 @@ module Google
         raise "#{SYSTEM_DEFAULT_ERROR}: #{e}"
       end
 
+      # Issues warning if cloud sdk client id is used
+      def warn_if_cloud_sdk_credentials(client_id)
+        warn CLOUD_SDK_CREDENTIALS_WARNING if client_id == CLOUD_SDK_CLIENT_ID
+      end
+
       private
 
       def service_account_env_vars?

lib/googleauth/default_credentials.rb

@@ -49,9 +49,11 @@ module Google
         json_key_io, scope = options.values_at(:json_key_io, :scope)
         if json_key_io
           json_key, clz = determine_creds_class(json_key_io)
+          warn_if_cloud_sdk_credentials json_key['client_id']
           clz.make_creds(json_key_io: StringIO.new(MultiJson.dump(json_key)),
                          scope: scope)
         else
+          warn_if_cloud_sdk_credentials ENV[CLIENT_ID_VAR]
           clz = read_creds
           clz.make_creds(scope: scope)
         end
@@ -73,7 +75,7 @@ module Google
 
       # Reads the input json and determines which creds class to use.
       def self.determine_creds_class(json_key_io)
-        json_key = MultiJson.load(json_key_io.read)
+        json_key = MultiJson.load json_key_io.read
         key = 'type'
         raise "the json is missing the '#{key}' field" unless json_key.key?(key)
         type = json_key[key]