googleauth 1.17.2 → 1.17.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bc45e207ab32f63ca0badeb96e1706bc80d38931ff0b69caa0a9a111163aa340
-  data.tar.gz: 8de82f27d3a8df7a71d0d11ebae8e814a60a3fc963f26825e1c4d420c910dc44
+  metadata.gz: 7c73c744b267dbdafe6b4b3366fe629ca7f86774c6c56726b108f38ac3593ee7
+  data.tar.gz: 2b5b379d5e8bc653a52d6dccb56b500904368a09955a3fe914efad7cf18147ce
 SHA512:
-  metadata.gz: e3d50e8368efa58acb323b0fde998d3006a00ca4f044f72f5cb04f2313c3340a7f7577710b3b3a034f9d58699583952bdb60e9eb4d5ecbef3319f01d6e4bf713
-  data.tar.gz: ebb4d26b60a9f6d2744cd184dce52c13551773d706319bb53c6566001b39312d87f6c7c98f0ee5b15bda856447a2516f8f2336e6eb7437db8898776e1ac6dc9d
+  metadata.gz: 378ad3d1c7acb1118491dc2896f9983119197f888a8cf610998734cb48495dc2651d4cbb217eee46b10958cc9417cb06db790ca3a8ff52b5dcf9b6ba99fc24ce
+  data.tar.gz: a7461765f075d468e2cc4cd8b237c82c3a0a140739bcec81ca452b9d5c633af4c8e7bf21acd099a4d713a20afbaf4ca7468868a16ca1d167939054b903ceca9b

data/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Release History
 
+### 1.17.3 (2026-07-27)
+
+#### Bug Fixes
+
+* Add option validation and error handling to ServiceAccountCredentials.make_creds ([#588](https://github.com/googleapis/google-auth-library-ruby/issues/588)) ([3da9927](https://github.com/googleapis/google-auth-library-ruby/commit/3da9927091e3ffc4f2d062a404d837de962a6f97)), refs [#482](https://github.com/googleapis/google-auth-library-ruby/issues/482) [#544](https://github.com/googleapis/google-auth-library-ruby/issues/544)
+
 ### 1.17.2 (2026-07-23)
 
 #### Bug Fixes

data/lib/googleauth/service_account.rb

@@ -45,6 +45,19 @@ module Google
       # @type [::String] The type name for this credential.
       CREDENTIAL_TYPE_NAME = "service_account".freeze
 
+      # @private
+      # @type [Array<Symbol>] Allowed option keys for make_creds.
+      VALID_MAKE_CREDS_OPTIONS = [
+        :json_key_io,
+        :scope,
+        :enable_self_signed_jwt,
+        :target_audience,
+        :audience,
+        :token_credential_uri,
+        :default_connection,
+        :connection_builder
+      ].freeze
+
       def enable_self_signed_jwt?
         # Use a self-singed JWT if there's no information that can be used to
         # obtain an OAuth token, OR if there are scopes but also an assertion
@@ -55,10 +68,20 @@ module Google
 
       # Creates a ServiceAccountCredentials.
       #
-      # @param json_key_io [IO] An IO object containing the JSON key
-      # @param scope [string|array|nil] the scope(s) to access
+      # @param json_key_io [IO, nil] Optional. An IO object containing the JSON key
+      # @param scope [String, Array<String>, nil] Optional. The scope(s) to access
+      # @param enable_self_signed_jwt [Boolean, nil] Optional. Whether to use self-signed JWTs
+      # @param target_audience [String, nil] Optional. The target audience for ID token requests
+      # @param audience [String, nil] Optional. Custom token endpoint audience URI
+      # @param token_credential_uri [String, nil] Optional. Custom token credential URI
+      # @param default_connection [Faraday::Connection, nil] Optional. The connection object to use
+      # @param connection_builder [Proc, nil] Optional. A Proc that returns a Faraday connection
       # @raise [ArgumentError] If both scope and target_audience are specified
+      # @raise [InitializationError] If json_key_io is not an IO object, or
+      #   if required credential fields (private_key or client_email) are missing
       def self.make_creds options = {} # rubocop:disable Metrics/MethodLength
+        validate_make_creds_options options
+
         json_key_io, scope, enable_self_signed_jwt, target_audience, audience, token_credential_uri =
           options.values_at :json_key_io, :scope, :enable_self_signed_jwt, :target_audience,
                             :audience, :token_credential_uri
@@ -66,6 +89,9 @@ module Google
 
         private_key, client_email, project_id, quota_project_id, universe_domain =
           if json_key_io
+            unless json_key_io.respond_to? :read
+              raise InitializationError, "Expected an IO object for json_key_io"
+            end
             json_key = JSON.parse json_key_io.read
             if json_key.key? "type"
               json_key_io.rewind
@@ -78,6 +104,10 @@ module Google
           else
             creds_from_env
           end
+
+        raise InitializationError, "Missing required field: private_key" unless private_key
+        raise InitializationError, "Missing required field: client_email" unless client_email
+
         project_id ||= CredentialsLoader.load_gcloud_project_id
 
         new(token_credential_uri:   token_credential_uri || TOKEN_CRED_URI,
@@ -122,8 +152,9 @@ module Google
       # enclosing quotes.
       #
       # @param str [String] The string to unescape
-      # @return [String] The unescaped string
+      # @return [String, nil] The unescaped string, or nil if input is nil
       def self.unescape str
+        return nil unless str
         str = str.gsub '\n', "\n"
         str = str[1..-2] if str.start_with?('"') && str.end_with?('"')
         str
@@ -212,7 +243,20 @@ module Google
         [private_key, client_email, project_id, nil, nil]
       end
 
-      private_class_method :creds_from_env
+      # @private
+      # Validates options passed to make_creds and emits a warning for unrecognized keys.
+      #
+      # @param options [Hash] The options hash to validate.
+      def self.validate_make_creds_options options
+        return unless options.is_a? Hash
+
+        unknown_keys = options.keys - VALID_MAKE_CREDS_OPTIONS
+        return if unknown_keys.empty?
+
+        warn "Unrecognized option(s) for ServiceAccountCredentials.make_creds: #{unknown_keys.map(&:inspect).join ', '}"
+      end
+
+      private_class_method :creds_from_env, :validate_make_creds_options
     end
   end
 end

data/lib/googleauth/version.rb

@@ -16,6 +16,6 @@ module Google
   # Module Auth provides classes that provide Google-specific authorization
   # used to access Google APIs.
   module Auth
-    VERSION = "1.17.2".freeze
+    VERSION = "1.17.3".freeze
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: googleauth
 version: !ruby/object:Gem::Version
-  version: 1.17.2
+  version: 1.17.3
 platform: ruby
 authors:
 - Google LLC