MediaMetz/gemini-cli
1
0
Fork 0
mirror of https://github.com/google-gemini/gemini-cli.git synced 2026-03-27 14:30:44 -07:00
Code Issues Packages Projects Releases Wiki Activity

feat(auth): Add option for metadata server application default credentials without project override (#12948)

Browse Source
This commit is contained in:
Caroline Rose
2025-11-14 11:39:11 -05:00
committed by GitHub
parent 016b5b42e2
commit 9d74b7c0e8
14 changed files with 113 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
packages/core/src/code_assist/codeAssist.test.ts
View File

@@ -68,18 +68,18 @@ describe('codeAssist', () => {
expect(generator).toBeInstanceOf(MockedCodeAssistServer);
});
it('should create a server for CLOUD_SHELL', async () => {
it('should create a server for COMPUTE_ADC', async () => {
mockedGetOauthClient.mockResolvedValue(mockAuthClient as never);
mockedSetupUser.mockResolvedValue(mockUserData);
const generator = await createCodeAssistContentGenerator(
httpOptions,
AuthType.CLOUD_SHELL,
AuthType.COMPUTE_ADC,
mockConfig,
);
expect(getOauthClient).toHaveBeenCalledWith(
AuthType.CLOUD_SHELL,
AuthType.COMPUTE_ADC,
mockConfig,
);
expect(setupUser).toHaveBeenCalledWith(mockAuthClient);

2
packages/core/src/code_assist/codeAssist.ts
View File

@@ -21,7 +21,7 @@ export async function createCodeAssistContentGenerator(
): Promise<ContentGenerator> {
if (
authType === AuthType.LOGIN_WITH_GOOGLE ||
authType === AuthType.CLOUD_SHELL
authType === AuthType.COMPUTE_ADC
) {
const authClient = await getOauthClient(authType, config);
const userData = await setupUser(authClient);

10
packages/core/src/code_assist/oauth2.test.ts
View File

@@ -318,7 +318,7 @@ describe('oauth2', () => {
});
it('should use Compute to get a client if no cached credentials exist', async () => {
await getOauthClient(AuthType.CLOUD_SHELL, mockConfig);
await getOauthClient(AuthType.COMPUTE_ADC, mockConfig);
expect(Compute).toHaveBeenCalledWith({});
expect(mockGetAccessToken).toHaveBeenCalled();
@@ -329,7 +329,7 @@ describe('oauth2', () => {
mockComputeClient.credentials = newCredentials;
mockGetAccessToken.mockResolvedValue({ token: 'new-adc-token' });
await getOauthClient(AuthType.CLOUD_SHELL, mockConfig);
await getOauthClient(AuthType.COMPUTE_ADC, mockConfig);
const credsPath = path.join(
tempHomeDir,
@@ -340,7 +340,7 @@ describe('oauth2', () => {
});
it('should return the Compute client on successful ADC authentication', async () => {
const client = await getOauthClient(AuthType.CLOUD_SHELL, mockConfig);
const client = await getOauthClient(AuthType.COMPUTE_ADC, mockConfig);
expect(client).toBe(mockComputeClient);
});
@@ -349,9 +349,9 @@ describe('oauth2', () => {
mockGetAccessToken.mockRejectedValue(testError);
await expect(
getOauthClient(AuthType.CLOUD_SHELL, mockConfig),
getOauthClient(AuthType.COMPUTE_ADC, mockConfig),
).rejects.toThrow(
'Could not authenticate using Cloud Shell credentials. Please select a different authentication method or ensure you are in a properly configured environment. Error: ADC Failed',
'Could not authenticate using metadata server application default credentials. Please select a different authentication method or ensure you are in a properly configured environment. Error: ADC Failed',
);
});
});

15
packages/core/src/code_assist/oauth2.ts
View File

@@ -155,12 +155,15 @@ async function initOauthClient(
}
}
// In Google Cloud Shell, we can use Application Default Credentials (ADC)
// provided via its metadata server to authenticate non-interactively using
// the identity of the user logged into Cloud Shell.
if (authType === AuthType.CLOUD_SHELL) {
// In Google Compute Engine based environments (including Cloud Shell), we can
// use Application Default Credentials (ADC) provided via its metadata server
// to authenticate non-interactively using the identity of the logged-in user.
if (authType === AuthType.COMPUTE_ADC) {
try {
debugLogger.log("Attempting to authenticate via Cloud Shell VM's ADC.");
debugLogger.log(
'Attempting to authenticate via metadata server application default credentials.',
);
const computeClient = new Compute({
// We can leave this empty, since the metadata server will provide
// the service account email.
@@ -172,7 +175,7 @@ async function initOauthClient(
return computeClient;
} catch (e) {
throw new Error(
`Could not authenticate using Cloud Shell credentials. Please select a different authentication method or ensure you are in a properly configured environment. Error: ${getErrorMessage(
`Could not authenticate using metadata server application default credentials. Please select a different authentication method or ensure you are in a properly configured environment. Error: ${getErrorMessage(
e,
)}`,
);