googleauth 1.17.1 → 1.17.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 65760a71937d92e7ac7645084b04fa503e9e824ce4cdde626013e1e5b218d1ff
-  data.tar.gz: 735c54698d8ac9f2419b4b2b5d0525d079d799fb06cdcef10ea8a7bb76f7e5a9
+  metadata.gz: 2623eeee7a1c3caa15a693a2324cb3af0680e2e96a5c7ebb8e886b0f575f4b46
+  data.tar.gz: 6e0dea85174b34430c4c4088cef587d898adb4784d32dcdade282f8013266296
 SHA512:
-  metadata.gz: 58a86a3662c68bdabfbb96f12066c6d24ecc8aa1a4927e9be89578269001d5d64010340bb98285e5e6717c30b0d7b118d3b07dd631581db6b668934f6074117f
-  data.tar.gz: 41e44fdbe1863fe39bed931e07948ddbeaa6c627a7f7d28a4f43591e6b281898d7bf6afdeb76d06ad4668297028a374ba936d29785c0c544ba853fbadc8aaf2c
+  metadata.gz: 8bac89770eb6e181368150fcaac143ec95cb4f6e1a30fd69b44fef705fae56c50fa25c9db39098dd1c3321b47159bea3ddd26aa459505f4456db9e0006c03a69
+  data.tar.gz: 8924b3cebc81d2808f7de234299251bbba82d10db48eb84d0a29f7bf7ca8467705bdecf8f849e4d41b2b4d12343ee19669947d75d76cc78551aeb1ed1cc96387

data/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Release History
 
+### 1.17.5 (2026-10-13)
+
+#### Documentation
+
+* trigger a release to verify the new publishing pipeline ([#601](https://github.com/googleapis/google-auth-library-ruby/issues/601)) 
+
+### 1.17.4 (2026-08-13)
+
+#### Documentation
+
+* Update CLI/installed app example to use loopback IP redirect ([#589](https://github.com/googleapis/google-auth-library-ruby/issues/589)) 
+
+### 1.17.3 (2026-07-27)
+
+#### Bug Fixes
+
+* Add option validation and error handling to ServiceAccountCredentials.make_creds ([#588](https://github.com/googleapis/google-auth-library-ruby/issues/588)) ([3da9927](https://github.com/googleapis/google-auth-library-ruby/commit/3da9927091e3ffc4f2d062a404d837de962a6f97)), refs [#482](https://github.com/googleapis/google-auth-library-ruby/issues/482) [#544](https://github.com/googleapis/google-auth-library-ruby/issues/544)
+
+### 1.17.2 (2026-07-23)
+
+#### Bug Fixes
+
+* return auth header from source_credentials in ImpersonatedServiceAccountCredentials ([#586](https://github.com/googleapis/google-auth-library-ruby/issues/586)) 
+
 ### 1.17.1 (2026-06-08)
 
 #### Bug Fixes

data/README.md

@@ -145,30 +145,32 @@ get('/oauth2callback') do
 end
 ```
 
-### Example (Command Line) [Deprecated]
+### Example (Command Line / Installed App)
 
-The Google Auth OOB flow has been discontiued on January 31, 2023. The OOB flow is a legacy flow that is no longer considered secure. To continue using Google Auth, please migrate your applications to a more secure flow. For more information on how to do this, please refer to this [OOB Migration](https://developers.google.com/identity/protocols/oauth2/resources/oob-migration) guide.
+Command line and desktop applications should use the Loopback IP redirect flow (`http://localhost`) as recommended in the [OOB Migration Guide](https://developers.google.com/identity/protocols/oauth2/resources/oob-migration).
 
 ```ruby
-require 'googleauth'
-require 'googleauth/stores/file_token_store'
+require "googleauth"
+require "googleauth/stores/file_token_store"
 
-OOB_URI = 'urn:ietf:wg:oauth:2.0:oob'
+LOOPBACK_URI = "http://localhost"
 
-scope = 'https://www.googleapis.com/auth/drive'
-client_id = Google::Auth::ClientId.from_file('/path/to/client_secrets.json')
-token_store = Google::Auth::Stores::FileTokenStore.new(
-  :file => '/path/to/tokens.yaml')
-authorizer = Google::Auth::UserAuthorizer.new(client_id, scope, token_store)
+scope = "https://www.googleapis.com/auth/drive"
+client_id = Google::Auth::ClientId.from_file "/path/to/client_secrets.json"
+token_store = Google::Auth::Stores::FileTokenStore.new file: "/path/to/tokens.yaml"
+authorizer = Google::Auth::UserAuthorizer.new client_id, scope, token_store
 
-user_id = ENV['USER']
-credentials = authorizer.get_credentials(user_id)
+user_id = ENV["USER"]
+credentials = authorizer.get_credentials user_id
 if credentials.nil?
-  url = authorizer.get_authorization_url(base_url: OOB_URI )
-  puts "Open #{url} in your browser and enter the resulting code:"
+  url = authorizer.get_authorization_url base_url: LOOPBACK_URI
+  puts "Open the following URL in your browser: #{url}"
+  puts "After authorizing, your browser will redirect to localhost with an authorization code."
+  puts "Enter the authorization code:"
   code = gets
   credentials = authorizer.get_and_store_credentials_from_code(
-    user_id: user_id, code: code, base_url: OOB_URI)
+    user_id: user_id, code: code, base_url: LOOPBACK_URI
+  )
 end
 
 # OK to use credentials
@@ -265,7 +267,7 @@ Custom storage implementations can also be used. See
 
 ## Supported Ruby Versions
 
-This library is supported on Ruby 3.0+.
+This library is supported on Ruby 3.2+.
 
 Google provides official support for Ruby versions that are actively supported
 by Ruby Core—that is, Ruby versions that are either in normal maintenance or
@@ -293,3 +295,4 @@ about the client or APIs on [StackOverflow](http://stackoverflow.com).
 
 [application default credentials]: https://cloud.google.com/docs/authentication/provide-credentials-adc
 [license]: https://github.com/googleapis/google-auth-library-ruby/tree/main/LICENSE
+

data/lib/googleauth/id_tokens/key_sources.rb

@@ -135,13 +135,13 @@ module Google
             rsa_key.public_key
           end
 
-          # @private
           CURVE_NAME_MAP = {
             "P-256"     => "prime256v1",
             "P-384"     => "secp384r1",
             "P-521"     => "secp521r1",
             "secp256k1" => "secp256k1"
           }.freeze
+          private_constant :CURVE_NAME_MAP
 
           def extract_ec_key jwk
             begin

data/lib/googleauth/id_tokens/verifier.rb

@@ -109,13 +109,13 @@ module Google
           payload["azp"] ||= payload["cid"] if payload.key? "cid"
 
           # Payload content validation
-          if aud && (Array(aud) & Array(payload["aud"])).empty?
+          if aud && !Array(aud).intersect?(Array(payload["aud"]))
             raise AudienceMismatchError, "Token aud mismatch: #{payload['aud']}"
           end
-          if azp && (Array(azp) & Array(payload["azp"])).empty?
+          if azp && !Array(azp).intersect?(Array(payload["azp"]))
             raise AuthorizedPartyMismatchError, "Token azp mismatch: #{payload['azp']}"
           end
-          if iss && (Array(iss) & Array(payload["iss"])).empty?
+          if iss && !Array(iss).intersect?(Array(payload["iss"]))
             raise IssuerMismatchError, "Token iss mismatch: #{payload['iss']}"
           end
 

data/lib/googleauth/impersonated_service_account.rb

@@ -297,9 +297,9 @@ module Google
       # @private
       # @return [Hash] The authorization header with the source credentials' token
       def prepare_auth_header
-        auth_header = {}
-        @source_credentials.updater_proc.call auth_header
-        auth_header
+        # updater_proc returns a new hash containing authorization headers
+        # rather than mutating the passed hash in place.
+        @source_credentials.updater_proc.call({})
       end
 
       # Makes the HTTP request to the impersonation endpoint.

data/lib/googleauth/service_account.rb

@@ -45,6 +45,19 @@ module Google
       # @type [::String] The type name for this credential.
       CREDENTIAL_TYPE_NAME = "service_account".freeze
 
+      # @private
+      # @type [Array<Symbol>] Allowed option keys for make_creds.
+      VALID_MAKE_CREDS_OPTIONS = [
+        :json_key_io,
+        :scope,
+        :enable_self_signed_jwt,
+        :target_audience,
+        :audience,
+        :token_credential_uri,
+        :default_connection,
+        :connection_builder
+      ].freeze
+
       def enable_self_signed_jwt?
         # Use a self-singed JWT if there's no information that can be used to
         # obtain an OAuth token, OR if there are scopes but also an assertion
@@ -55,10 +68,20 @@ module Google
 
       # Creates a ServiceAccountCredentials.
       #
-      # @param json_key_io [IO] An IO object containing the JSON key
-      # @param scope [string|array|nil] the scope(s) to access
+      # @param json_key_io [IO, nil] Optional. An IO object containing the JSON key
+      # @param scope [String, Array<String>, nil] Optional. The scope(s) to access
+      # @param enable_self_signed_jwt [Boolean, nil] Optional. Whether to use self-signed JWTs
+      # @param target_audience [String, nil] Optional. The target audience for ID token requests
+      # @param audience [String, nil] Optional. Custom token endpoint audience URI
+      # @param token_credential_uri [String, nil] Optional. Custom token credential URI
+      # @param default_connection [Faraday::Connection, nil] Optional. The connection object to use
+      # @param connection_builder [Proc, nil] Optional. A Proc that returns a Faraday connection
       # @raise [ArgumentError] If both scope and target_audience are specified
+      # @raise [InitializationError] If json_key_io is not an IO object, or
+      #   if required credential fields (private_key or client_email) are missing
       def self.make_creds options = {} # rubocop:disable Metrics/MethodLength
+        validate_make_creds_options options
+
         json_key_io, scope, enable_self_signed_jwt, target_audience, audience, token_credential_uri =
           options.values_at :json_key_io, :scope, :enable_self_signed_jwt, :target_audience,
                             :audience, :token_credential_uri
@@ -66,6 +89,9 @@ module Google
 
         private_key, client_email, project_id, quota_project_id, universe_domain =
           if json_key_io
+            unless json_key_io.respond_to? :read
+              raise InitializationError, "Expected an IO object for json_key_io"
+            end
             json_key = JSON.parse json_key_io.read
             if json_key.key? "type"
               json_key_io.rewind
@@ -78,6 +104,10 @@ module Google
           else
             creds_from_env
           end
+
+        raise InitializationError, "Missing required field: private_key" unless private_key
+        raise InitializationError, "Missing required field: client_email" unless client_email
+
         project_id ||= CredentialsLoader.load_gcloud_project_id
 
         new(token_credential_uri:   token_credential_uri || TOKEN_CRED_URI,
@@ -122,8 +152,9 @@ module Google
       # enclosing quotes.
       #
       # @param str [String] The string to unescape
-      # @return [String] The unescaped string
+      # @return [String, nil] The unescaped string, or nil if input is nil
       def self.unescape str
+        return nil unless str
         str = str.gsub '\n', "\n"
         str = str[1..-2] if str.start_with?('"') && str.end_with?('"')
         str
@@ -212,7 +243,20 @@ module Google
         [private_key, client_email, project_id, nil, nil]
       end
 
-      private_class_method :creds_from_env
+      # @private
+      # Validates options passed to make_creds and emits a warning for unrecognized keys.
+      #
+      # @param options [Hash] The options hash to validate.
+      def self.validate_make_creds_options options
+        return unless options.is_a? Hash
+
+        unknown_keys = options.keys - VALID_MAKE_CREDS_OPTIONS
+        return if unknown_keys.empty?
+
+        warn "Unrecognized option(s) for ServiceAccountCredentials.make_creds: #{unknown_keys.map(&:inspect).join ', '}"
+      end
+
+      private_class_method :creds_from_env, :validate_make_creds_options
     end
   end
 end

data/lib/googleauth/version.rb

@@ -16,6 +16,6 @@ module Google
   # Module Auth provides classes that provide Google-specific authorization
   # used to access Google APIs.
   module Auth
-    VERSION = "1.17.1".freeze
+    VERSION = "1.17.5".freeze
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: googleauth
 version: !ruby/object:Gem::Version
-  version: 1.17.1
+  version: 1.17.5
 platform: ruby
 authors:
 - Google LLC
@@ -198,7 +198,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '3.0'
+      version: '3.2'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="