Warn when using cloud sdk credentials (#145)

* Issue warning when cloud sdk credentials are used.

spec/googleauth/client_id_spec.rb

@@ -48,7 +48,7 @@ describe Google::Auth::ClientId do
 
   shared_examples 'it can successfully load client_id' do
     context 'loaded from hash' do
-      let(:client_id) { Google::Auth::ClientId.from_hash(config) }
+      let(:client_id) { Google::Auth::ClientId.from_hash config }
 
       it_behaves_like 'it has a valid config'
     end
@@ -103,7 +103,7 @@ describe Google::Auth::ClientId do
     end
 
     it 'should raise error' do
-      expect { Google::Auth::ClientId.from_hash(config) }.to raise_error(
+      expect { Google::Auth::ClientId.from_hash config }.to raise_error(
         /Expected top level property/
       )
     end
@@ -119,7 +119,7 @@ describe Google::Auth::ClientId do
     end
 
     it 'should raise error' do
-      expect { Google::Auth::ClientId.from_hash(config) }.to raise_error(
+      expect { Google::Auth::ClientId.from_hash config }.to raise_error(
         /Client id can not be nil/
       )
     end
@@ -135,9 +135,26 @@ describe Google::Auth::ClientId do
     end
 
     it 'should raise error' do
-      expect { Google::Auth::ClientId.from_hash(config) }.to raise_error(
+      expect { Google::Auth::ClientId.from_hash config }.to raise_error(
         /Client secret can not be nil/
       )
     end
   end
+
+  context 'with cloud sdk credentials' do
+    let(:config) do
+      {
+        'web' => {
+          'client_id' => Google::Auth::CredentialsLoader::CLOUD_SDK_CLIENT_ID,
+          'client_secret' => 'notasecret'
+        }
+      }
+    end
+
+    it 'should raise warning' do
+      expect { Google::Auth::ClientId.from_hash config }.to output(
+        Google::Auth::CredentialsLoader::CLOUD_SDK_CREDENTIALS_WARNING + "\n"
+      ).to_stderr
+    end
+  end
 end

spec/googleauth/credentials_spec.rb

@@ -29,6 +29,7 @@
 
 require 'googleauth'
 
+
 # This test is testing the private class Google::Auth::Credentials. We want to
 # make sure that the passed in scope propogates to the Signet object. This means
 # testing the private API, which is generally frowned on.
@@ -46,6 +47,7 @@ describe Google::Auth::Credentials, :private do
   it 'uses a default scope' do
     mocked_signet = double('Signet::OAuth2::Client')
     allow(mocked_signet).to receive(:fetch_access_token!).and_return(true)
+    allow(mocked_signet).to receive(:client_id)
     allow(Signet::OAuth2::Client).to receive(:new) do |options|
       expect(options[:token_credential_uri]).to eq('https://accounts.google.com/o/oauth2/token')
       expect(options[:audience]).to eq('https://accounts.google.com/o/oauth2/token')
@@ -62,6 +64,7 @@ describe Google::Auth::Credentials, :private do
   it 'uses a custom scope' do
     mocked_signet = double('Signet::OAuth2::Client')
     allow(mocked_signet).to receive(:fetch_access_token!).and_return(true)
+    allow(mocked_signet).to receive(:client_id)
     allow(Signet::OAuth2::Client).to receive(:new) do |options|
       expect(options[:token_credential_uri]).to eq('https://accounts.google.com/o/oauth2/token')
       expect(options[:audience]).to eq('https://accounts.google.com/o/oauth2/token')
@@ -93,6 +96,7 @@ describe Google::Auth::Credentials, :private do
 
     mocked_signet = double('Signet::OAuth2::Client')
     allow(mocked_signet).to receive(:fetch_access_token!).and_return(true)
+    allow(mocked_signet).to receive(:client_id)
     allow(Signet::OAuth2::Client).to receive(:new) do |options|
       expect(options[:token_credential_uri]).to eq('https://accounts.google.com/o/oauth2/token')
       expect(options[:audience]).to eq('https://accounts.google.com/o/oauth2/token')
@@ -124,6 +128,7 @@ describe Google::Auth::Credentials, :private do
 
     mocked_signet = double('Signet::OAuth2::Client')
     allow(mocked_signet).to receive(:fetch_access_token!).and_return(true)
+    allow(mocked_signet).to receive(:client_id)
     allow(Signet::OAuth2::Client).to receive(:new) do |options|
       expect(options[:token_credential_uri]).to eq('https://accounts.google.com/o/oauth2/token')
       expect(options[:audience]).to eq('https://accounts.google.com/o/oauth2/token')
@@ -154,6 +159,7 @@ describe Google::Auth::Credentials, :private do
 
     mocked_signet = double('Signet::OAuth2::Client')
     allow(mocked_signet).to receive(:fetch_access_token!).and_return(true)
+    allow(mocked_signet).to receive(:client_id)
     allow(Signet::OAuth2::Client).to receive(:new) do |options|
       expect(options[:token_credential_uri]).to eq('https://accounts.google.com/o/oauth2/token')
       expect(options[:audience]).to eq('https://accounts.google.com/o/oauth2/token')
@@ -185,6 +191,7 @@ describe Google::Auth::Credentials, :private do
 
     mocked_signet = double('Signet::OAuth2::Client')
     allow(mocked_signet).to receive(:fetch_access_token!).and_return(true)
+    allow(mocked_signet).to receive(:client_id)
     allow(Signet::OAuth2::Client).to receive(:new) do |options|
       expect(options[:token_credential_uri]).to eq('https://accounts.google.com/o/oauth2/token')
       expect(options[:audience]).to eq('https://accounts.google.com/o/oauth2/token')
@@ -215,6 +222,7 @@ describe Google::Auth::Credentials, :private do
 
     mocked_signet = double('Signet::OAuth2::Client')
     allow(mocked_signet).to receive(:fetch_access_token!).and_return(true)
+    allow(mocked_signet).to receive(:client_id)
     allow(Google::Auth).to receive(:get_application_default) do |scope|
       expect(scope).to eq(TestCredentials::SCOPE)
 
@@ -236,4 +244,16 @@ describe Google::Auth::Credentials, :private do
     expect(creds).to be_a_kind_of(TestCredentials)
     expect(creds.client).to eq(mocked_signet)
   end
+
+  it 'warns when cloud sdk credentials are used' do
+    mocked_signet = double('Signet::OAuth2::Client')
+    allow(mocked_signet).to receive(:fetch_access_token!).and_return(true)
+    allow(Signet::OAuth2::Client).to receive(:new) do |options|
+      mocked_signet
+    end
+    allow(mocked_signet).to receive(:client_id).and_return(Google::Auth::CredentialsLoader::CLOUD_SDK_CLIENT_ID)
+    expect { Google::Auth::Credentials.new default_keyfile_hash }.to output(
+      Google::Auth::CredentialsLoader::CLOUD_SDK_CREDENTIALS_WARNING + "\n"
+    ).to_stderr
+  end
 end

spec/googleauth/get_application_default_spec.rb

@@ -63,7 +63,7 @@ describe '#get_application_default' do
       Dir.mktmpdir do |dir|
         key_path = File.join(dir, 'does-not-exist')
         ENV[@var_name] = key_path
-        expect { Google::Auth.get_application_default(@scope, options) }
+        expect { Google::Auth.get_application_default @scope, options }
           .to raise_error RuntimeError
       end
     end
@@ -76,7 +76,7 @@ describe '#get_application_default' do
         ENV.delete(@var_name) unless ENV[@var_name].nil? # no env var
         ENV['HOME'] = dir # no config present in this tmp dir
         expect do
-          Google::Auth.get_application_default(@scope, options)
+          Google::Auth.get_application_default @scope, options
         end.to raise_error RuntimeError
       end
       expect(stub).to have_been_requested
@@ -90,7 +90,7 @@ describe '#get_application_default' do
         FileUtils.mkdir_p(File.dirname(key_path))
         File.write(key_path, cred_json_text)
         ENV[@var_name] = key_path
-        expect(Google::Auth.get_application_default(@scope, options))
+        expect(Google::Auth.get_application_default @scope, options)
           .to_not be_nil
       end
     end
@@ -102,7 +102,7 @@ describe '#get_application_default' do
         FileUtils.mkdir_p(File.dirname(key_path))
         File.write(key_path, cred_json_text)
         ENV['HOME'] = dir
-        expect(Google::Auth.get_application_default(@scope, options))
+        expect(Google::Auth.get_application_default @scope, options)
           .to_not be_nil
       end
     end
@@ -114,7 +114,7 @@ describe '#get_application_default' do
         FileUtils.mkdir_p(File.dirname(key_path))
         File.write(key_path, cred_json_text)
         ENV['HOME'] = dir
-        expect(Google::Auth.get_application_default(nil, options)).to_not be_nil
+        expect(Google::Auth.get_application_default nil, options).to_not be_nil
       end
     end
 
@@ -125,7 +125,7 @@ describe '#get_application_default' do
       Dir.mktmpdir do |dir|
         ENV.delete(@var_name) unless ENV[@var_name].nil? # no env var
         ENV['HOME'] = dir # no config present in this tmp dir
-        creds = Google::Auth.get_application_default(@scope, options)
+        creds = Google::Auth.get_application_default @scope, options
         expect(creds).to_not be_nil
       end
       expect(stub).to have_been_requested
@@ -137,7 +137,7 @@ describe '#get_application_default' do
         key_path = File.join('/etc/google/auth/', CREDENTIALS_FILE_NAME)
         FileUtils.mkdir_p(File.dirname(key_path))
         File.write(key_path, cred_json_text)
-        expect(Google::Auth.get_application_default(@scope, options))
+        expect(Google::Auth.get_application_default @scope, options)
           .to_not be_nil
         File.delete(key_path)
       end
@@ -151,9 +151,22 @@ describe '#get_application_default' do
       ENV[CLIENT_SECRET_VAR] = cred_json[:client_secret]
       ENV[REFRESH_TOKEN_VAR] = cred_json[:refresh_token]
       ENV[ACCOUNT_TYPE_VAR] = cred_json[:type]
-      expect(Google::Auth.get_application_default(@scope, options))
+      expect(Google::Auth.get_application_default @scope, options)
         .to_not be_nil
     end
+
+    it 'warns when using cloud sdk credentials' do
+      ENV.delete(@var_name) unless ENV[@var_name].nil? # no env var
+      ENV[PRIVATE_KEY_VAR] = cred_json[:private_key]
+      ENV[CLIENT_EMAIL_VAR] = cred_json[:client_email]
+      ENV[CLIENT_ID_VAR] = Google::Auth::CredentialsLoader::CLOUD_SDK_CLIENT_ID
+      ENV[CLIENT_SECRET_VAR] = cred_json[:client_secret]
+      ENV[REFRESH_TOKEN_VAR] = cred_json[:refresh_token]
+      ENV[ACCOUNT_TYPE_VAR] = cred_json[:type]
+      expect { Google::Auth.get_application_default @scope, options }.to output(
+          Google::Auth::CredentialsLoader::CLOUD_SDK_CREDENTIALS_WARNING + "\n"
+      ).to_stderr
+    end
   end
 
   describe 'when credential type is service account' do
@@ -216,7 +229,7 @@ describe '#get_application_default' do
         File.write(key_path, cred_json_text)
         ENV[@var_name] = key_path
         expect do
-          Google::Auth.get_application_default(@scope, options)
+          Google::Auth.get_application_default @scope, options
         end.to raise_error RuntimeError
       end
     end
@@ -229,7 +242,7 @@ describe '#get_application_default' do
         File.write(key_path, cred_json_text)
         ENV['HOME'] = dir
         expect do
-          Google::Auth.get_application_default(@scope, options)
+          Google::Auth.get_application_default @scope, options
         end.to raise_error RuntimeError
       end
     end
@@ -238,7 +251,7 @@ describe '#get_application_default' do
       ENV[PRIVATE_KEY_VAR] = cred_json[:private_key]
       ENV[CLIENT_EMAIL_VAR] = cred_json[:client_email]
       expect do
-        Google::Auth.get_application_default(@scope, options)
+        Google::Auth.get_application_default @scope, options
       end.to raise_error RuntimeError
     end
   end

spec/googleauth/user_refresh_spec.rb

@@ -294,7 +294,7 @@ describe Google::Auth::UserRefreshCredentials do
     end
   end
 
-  describe 'when erros occurred with request' do
+  describe 'when errors occurred with request' do
     it 'should fail with Signet::AuthorizationError if request times out' do
       allow_any_instance_of(Faraday::Connection).to receive(:get)
         .and_raise(Faraday::TimeoutError)