googleauth 1.17.1 → 1.17.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 65760a71937d92e7ac7645084b04fa503e9e824ce4cdde626013e1e5b218d1ff
-  data.tar.gz: 735c54698d8ac9f2419b4b2b5d0525d079d799fb06cdcef10ea8a7bb76f7e5a9
+  metadata.gz: 7c73c744b267dbdafe6b4b3366fe629ca7f86774c6c56726b108f38ac3593ee7
+  data.tar.gz: 2b5b379d5e8bc653a52d6dccb56b500904368a09955a3fe914efad7cf18147ce
 SHA512:
-  metadata.gz: 58a86a3662c68bdabfbb96f12066c6d24ecc8aa1a4927e9be89578269001d5d64010340bb98285e5e6717c30b0d7b118d3b07dd631581db6b668934f6074117f
-  data.tar.gz: 41e44fdbe1863fe39bed931e07948ddbeaa6c627a7f7d28a4f43591e6b281898d7bf6afdeb76d06ad4668297028a374ba936d29785c0c544ba853fbadc8aaf2c
+  metadata.gz: 378ad3d1c7acb1118491dc2896f9983119197f888a8cf610998734cb48495dc2651d4cbb217eee46b10958cc9417cb06db790ca3a8ff52b5dcf9b6ba99fc24ce
+  data.tar.gz: a7461765f075d468e2cc4cd8b237c82c3a0a140739bcec81ca452b9d5c633af4c8e7bf21acd099a4d713a20afbaf4ca7468868a16ca1d167939054b903ceca9b

data/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Release History
 
+### 1.17.3 (2026-07-27)
+
+#### Bug Fixes
+
+* Add option validation and error handling to ServiceAccountCredentials.make_creds ([#588](https://github.com/googleapis/google-auth-library-ruby/issues/588)) ([3da9927](https://github.com/googleapis/google-auth-library-ruby/commit/3da9927091e3ffc4f2d062a404d837de962a6f97)), refs [#482](https://github.com/googleapis/google-auth-library-ruby/issues/482) [#544](https://github.com/googleapis/google-auth-library-ruby/issues/544)
+
+### 1.17.2 (2026-07-23)
+
+#### Bug Fixes
+
+* return auth header from source_credentials in ImpersonatedServiceAccountCredentials ([#586](https://github.com/googleapis/google-auth-library-ruby/issues/586)) 
+
 ### 1.17.1 (2026-06-08)
 
 #### Bug Fixes

data/README.md

@@ -265,7 +265,7 @@ Custom storage implementations can also be used. See
 
 ## Supported Ruby Versions
 
-This library is supported on Ruby 3.0+.
+This library is supported on Ruby 3.2+.
 
 Google provides official support for Ruby versions that are actively supported
 by Ruby Core—that is, Ruby versions that are either in normal maintenance or

data/lib/googleauth/id_tokens/key_sources.rb

@@ -135,13 +135,13 @@ module Google
             rsa_key.public_key
           end
 
-          # @private
           CURVE_NAME_MAP = {
             "P-256"     => "prime256v1",
             "P-384"     => "secp384r1",
             "P-521"     => "secp521r1",
             "secp256k1" => "secp256k1"
           }.freeze
+          private_constant :CURVE_NAME_MAP
 
           def extract_ec_key jwk
             begin

data/lib/googleauth/id_tokens/verifier.rb

@@ -109,13 +109,13 @@ module Google
           payload["azp"] ||= payload["cid"] if payload.key? "cid"
 
           # Payload content validation
-          if aud && (Array(aud) & Array(payload["aud"])).empty?
+          if aud && !Array(aud).intersect?(Array(payload["aud"]))
             raise AudienceMismatchError, "Token aud mismatch: #{payload['aud']}"
           end
-          if azp && (Array(azp) & Array(payload["azp"])).empty?
+          if azp && !Array(azp).intersect?(Array(payload["azp"]))
             raise AuthorizedPartyMismatchError, "Token azp mismatch: #{payload['azp']}"
           end
-          if iss && (Array(iss) & Array(payload["iss"])).empty?
+          if iss && !Array(iss).intersect?(Array(payload["iss"]))
             raise IssuerMismatchError, "Token iss mismatch: #{payload['iss']}"
           end
 

data/lib/googleauth/impersonated_service_account.rb

@@ -297,9 +297,9 @@ module Google
       # @private
       # @return [Hash] The authorization header with the source credentials' token
       def prepare_auth_header
-        auth_header = {}
-        @source_credentials.updater_proc.call auth_header
-        auth_header
+        # updater_proc returns a new hash containing authorization headers
+        # rather than mutating the passed hash in place.
+        @source_credentials.updater_proc.call({})
       end
 
       # Makes the HTTP request to the impersonation endpoint.

data/lib/googleauth/service_account.rb

@@ -45,6 +45,19 @@ module Google
       # @type [::String] The type name for this credential.
       CREDENTIAL_TYPE_NAME = "service_account".freeze
 
+      # @private
+      # @type [Array<Symbol>] Allowed option keys for make_creds.
+      VALID_MAKE_CREDS_OPTIONS = [
+        :json_key_io,
+        :scope,
+        :enable_self_signed_jwt,
+        :target_audience,
+        :audience,
+        :token_credential_uri,
+        :default_connection,
+        :connection_builder
+      ].freeze
+
       def enable_self_signed_jwt?
         # Use a self-singed JWT if there's no information that can be used to
         # obtain an OAuth token, OR if there are scopes but also an assertion
@@ -55,10 +68,20 @@ module Google
 
       # Creates a ServiceAccountCredentials.
       #
-      # @param json_key_io [IO] An IO object containing the JSON key
-      # @param scope [string|array|nil] the scope(s) to access
+      # @param json_key_io [IO, nil] Optional. An IO object containing the JSON key
+      # @param scope [String, Array<String>, nil] Optional. The scope(s) to access
+      # @param enable_self_signed_jwt [Boolean, nil] Optional. Whether to use self-signed JWTs
+      # @param target_audience [String, nil] Optional. The target audience for ID token requests
+      # @param audience [String, nil] Optional. Custom token endpoint audience URI
+      # @param token_credential_uri [String, nil] Optional. Custom token credential URI
+      # @param default_connection [Faraday::Connection, nil] Optional. The connection object to use
+      # @param connection_builder [Proc, nil] Optional. A Proc that returns a Faraday connection
       # @raise [ArgumentError] If both scope and target_audience are specified
+      # @raise [InitializationError] If json_key_io is not an IO object, or
+      #   if required credential fields (private_key or client_email) are missing
       def self.make_creds options = {} # rubocop:disable Metrics/MethodLength
+        validate_make_creds_options options
+
         json_key_io, scope, enable_self_signed_jwt, target_audience, audience, token_credential_uri =
           options.values_at :json_key_io, :scope, :enable_self_signed_jwt, :target_audience,
                             :audience, :token_credential_uri
@@ -66,6 +89,9 @@ module Google
 
         private_key, client_email, project_id, quota_project_id, universe_domain =
           if json_key_io
+            unless json_key_io.respond_to? :read
+              raise InitializationError, "Expected an IO object for json_key_io"
+            end
             json_key = JSON.parse json_key_io.read
             if json_key.key? "type"
               json_key_io.rewind
@@ -78,6 +104,10 @@ module Google
           else
             creds_from_env
           end
+
+        raise InitializationError, "Missing required field: private_key" unless private_key
+        raise InitializationError, "Missing required field: client_email" unless client_email
+
         project_id ||= CredentialsLoader.load_gcloud_project_id
 
         new(token_credential_uri:   token_credential_uri || TOKEN_CRED_URI,
@@ -122,8 +152,9 @@ module Google
       # enclosing quotes.
       #
       # @param str [String] The string to unescape
-      # @return [String] The unescaped string
+      # @return [String, nil] The unescaped string, or nil if input is nil
       def self.unescape str
+        return nil unless str
         str = str.gsub '\n', "\n"
         str = str[1..-2] if str.start_with?('"') && str.end_with?('"')
         str
@@ -212,7 +243,20 @@ module Google
         [private_key, client_email, project_id, nil, nil]
       end
 
-      private_class_method :creds_from_env
+      # @private
+      # Validates options passed to make_creds and emits a warning for unrecognized keys.
+      #
+      # @param options [Hash] The options hash to validate.
+      def self.validate_make_creds_options options
+        return unless options.is_a? Hash
+
+        unknown_keys = options.keys - VALID_MAKE_CREDS_OPTIONS
+        return if unknown_keys.empty?
+
+        warn "Unrecognized option(s) for ServiceAccountCredentials.make_creds: #{unknown_keys.map(&:inspect).join ', '}"
+      end
+
+      private_class_method :creds_from_env, :validate_make_creds_options
     end
   end
 end

data/lib/googleauth/version.rb

@@ -16,6 +16,6 @@ module Google
   # Module Auth provides classes that provide Google-specific authorization
   # used to access Google APIs.
   module Auth
-    VERSION = "1.17.1".freeze
+    VERSION = "1.17.3".freeze
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: googleauth
 version: !ruby/object:Gem::Version
-  version: 1.17.1
+  version: 1.17.3
 platform: ruby
 authors:
 - Google LLC
@@ -198,7 +198,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '3.0'
+      version: '3.2'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="