fix(option): remove option.WithAuthCredentials from validation (#3420)

quartzmo · web-flow · commit 2c337321d374 · 2025-12-23T13:52:12.000-07:00
Do not raise multiple credential options provided error when option.WithAuthCredentials is provided with other auth configuration options, as it is a special case used internally for oauth2 type converversions. refs: googleapis/google-cloud-go#13503
diff --git a/internal/settings.go b/internal/settings.go
@@ -165,6 +165,9 @@ func (ds *DialSettings) Validate() error {
 		return errors.New("options.WithoutAuthentication is incompatible with any option that provides credentials")
 	}
 	// Credentials should not appear with other options.
+	// AuthCredentials is a special case that may be present with
+	// with other options in order to facilitate automatic conversion of
+	// oauth2 types (old auth) to cloud.google.com/go/auth types (new auth).
 	// We currently allow TokenSource and CredentialsFile to coexist.
 	// TODO(jba): make TokenSource & CredentialsFile an error (breaking change).
 	nCreds := 0
@@ -174,9 +177,6 @@ func (ds *DialSettings) Validate() error {
 	if len(ds.CredentialsJSON) > 0 {
 		nCreds++
 	}
-	if ds.AuthCredentials != nil {
-		nCreds++
-	}
 	if len(ds.AuthCredentialsJSON) > 0 {
 		nCreds++
 	}
diff --git a/internal/settings_test.go b/internal/settings_test.go
@@ -29,7 +29,9 @@ func TestSettingsValidate(t *testing.T) {
 		{Scopes: []string{"s"}},
 		{CredentialsFile: "f"},
 		{TokenSource: dummyTS{}},
-		{CredentialsFile: "f", TokenSource: dummyTS{}}, // keep for backwards compatibility
+		{Credentials: &google.DefaultCredentials{}, AuthCredentials: &auth.Credentials{}}, // Support old auth to new auth automatic conversions
+		{CredentialsFile: "f", AuthCredentials: &auth.Credentials{}},                      // Support old auth to new auth automatic conversions
+		{CredentialsFile: "f", TokenSource: dummyTS{}},                                    // keep for backwards compatibility
 		{CredentialsJSON: []byte("json")},
 		{AuthCredentialsFile: "f"},
 		{AuthCredentialsJSON: []byte("json")},
@@ -56,6 +58,7 @@ func TestSettingsValidate(t *testing.T) {
 		{NoAuth: true, AuthCredentialsFile: "f"},
 		{NoAuth: true, TokenSource: dummyTS{}},
 		{NoAuth: true, Credentials: &google.DefaultCredentials{}},
+		{NoAuth: true, AuthCredentials: &auth.Credentials{}},
 		{NoAuth: true, AuthCredentialsJSON: []byte("json")},
 		{Credentials: &google.DefaultCredentials{}, CredentialsFile: "f"},
 		{Credentials: &google.DefaultCredentials{}, AuthCredentialsFile: "f"},

Original file line number	Diff line number	Diff line change
`@@ -165,6 +165,9 @@ func (ds *DialSettings) Validate() error {`
`165`	`165`	`return errors.New("options.WithoutAuthentication is incompatible with any option that provides credentials")`
`166`	`166`	`}`
`167`	`167`	`// Credentials should not appear with other options.`
	`168`	`+ // AuthCredentials is a special case that may be present with`
	`169`	`+ // with other options in order to facilitate automatic conversion of`
	`170`	`+ // oauth2 types (old auth) to cloud.google.com/go/auth types (new auth).`
`168`	`171`	`// We currently allow TokenSource and CredentialsFile to coexist.`
`169`	`172`	`// TODO(jba): make TokenSource & CredentialsFile an error (breaking change).`
`170`	`173`	`nCreds := 0`
`@@ -174,9 +177,6 @@ func (ds *DialSettings) Validate() error {`
`174`	`177`	`if len(ds.CredentialsJSON) > 0 {`
`175`	`178`	`nCreds++`
`176`	`179`	`}`
`177`		`- if ds.AuthCredentials != nil {`
`178`		`- nCreds++`
`179`		`- }`
`180`	`180`	`if len(ds.AuthCredentialsJSON) > 0 {`
`181`	`181`	`nCreds++`
`182`	`182`	`}`