From a3f3b994ab2180af573f8b3680d4da0840e200ee Mon Sep 17 00:00:00 2001
From: Daniel Azuma <dazuma@google.com>
Date: Tue, 16 Jun 2020 13:35:39 -0700
Subject: [PATCH] fix: Service account credentials properly apply ID tokens

---
 lib/googleauth/service_account.rb      |  2 +-
 spec/googleauth/apply_auth_examples.rb | 12 ++++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/lib/googleauth/service_account.rb b/lib/googleauth/service_account.rb
index b56bdff..d722518 100644
--- a/lib/googleauth/service_account.rb
+++ b/lib/googleauth/service_account.rb
@@ -104,7 +104,7 @@ module Google
       # authenticate instead.
       def apply! a_hash, opts = {}
         # Use the base implementation if scopes are set
-        unless scope.nil?
+        unless scope.nil? && target_audience.nil?
           super
           return
         end
diff --git a/spec/googleauth/apply_auth_examples.rb b/spec/googleauth/apply_auth_examples.rb
index cdbdbbc..ffada9e 100644
--- a/spec/googleauth/apply_auth_examples.rb
+++ b/spec/googleauth/apply_auth_examples.rb
@@ -90,6 +90,18 @@ shared_examples "apply/apply! are OK" do
       expect(md).to eq(want)
       expect(stub).to have_been_requested
     end
+
+    it "should update the target hash with fetched ID token" do
+      skip unless @id_client
+      token = "1/abcdef1234567890"
+      stub = make_auth_stubs id_token: token
+
+      md = { foo: "bar" }
+      @id_client.apply! md
+      want = { :foo => "bar", auth_key => "Bearer #{token}" }
+      expect(md).to eq(want)
+      expect(stub).to have_been_requested
+    end
   end
 
   describe "updater_proc" do