fix: ensure credentials can be of type FetchAuthTokenInterface (#2684)

bshaffer · web-flow · commit ed70802cc488 · 2025-09-29T09:20:16.000-07:00
diff --git a/src/AuthHandler/Guzzle6AuthHandler.php b/src/AuthHandler/Guzzle6AuthHandler.php
@@ -2,8 +2,8 @@
 
 namespace Google\AuthHandler;
 
-use Google\Auth\CredentialsLoader;
 use Google\Auth\FetchAuthTokenCache;
+use Google\Auth\FetchAuthTokenInterface;
 use Google\Auth\HttpHandler\HttpHandlerFactory;
 use Google\Auth\Middleware\AuthTokenMiddleware;
 use Google\Auth\Middleware\ScopedAccessTokenMiddleware;
@@ -28,7 +28,7 @@ public function __construct(?CacheItemPoolInterface $cache = null, array $cacheC
 
     public function attachCredentials(
         ClientInterface $http,
-        CredentialsLoader $credentials,
+        FetchAuthTokenInterface $credentials,
         ?callable $tokenCallback = null
     ) {
         // use the provided cache
@@ -40,13 +40,21 @@ public function attachCredentials(
             );
         }
 
-        return $this->attachCredentialsCache($http, $credentials, $tokenCallback);
+        return $this->attachToHttp($http, $credentials, $tokenCallback);
     }
 
     public function attachCredentialsCache(
         ClientInterface $http,
         FetchAuthTokenCache $credentials,
         ?callable $tokenCallback = null
+    ) {
+        return $this->attachToHttp($http, $credentials, $tokenCallback);
+    }
+
+    private function attachToHttp(
+        ClientInterface $http,
+        FetchAuthTokenInterface $credentials,
+        ?callable $tokenCallback = null
     ) {
         // if we end up needing to make an HTTP request to retrieve credentials, we
         // can use our existing one, but we need to throw exceptions so the error
@@ -63,9 +71,7 @@ public function attachCredentialsCache(
         $config['handler']->remove('google_auth');
         $config['handler']->push($middleware, 'google_auth');
         $config['auth'] = 'google_auth';
-        $http = new Client($config);
-
-        return $http;
+        return new Client($config);
     }
 
     public function attachToken(ClientInterface $http, array $token, array $scopes)
diff --git a/src/Client.php b/src/Client.php
@@ -27,6 +27,7 @@
 use Google\Auth\Credentials\UserRefreshCredentials;
 use Google\Auth\CredentialsLoader;
 use Google\Auth\FetchAuthTokenCache;
+use Google\Auth\FetchAuthTokenInterface;
 use Google\Auth\GetUniverseDomainInterface;
 use Google\Auth\HttpHandler\HttpHandlerFactory;
 use Google\Auth\OAuth2;
@@ -90,7 +91,7 @@ class Client
     private $logger;
 
     /**
-     * @var ?CredentialsLoader $credentials
+     * @var ?FetchAuthTokenInterface $credentials
      */
     private $credentials;
 
@@ -118,10 +119,10 @@ class Client
      *           Your Google Cloud client ID found in https://developers.google.com/console
      *     @type string $client_secret
      *           Your Google Cloud client secret found in https://developers.google.com/console
-     *     @type string|array|CredentialsLoader $credentials
+     *     @type string|array|FetchAuthTokenInterface $credentials
      *           Can be a path to JSON credentials or an array representing those
      *           credentials (@see Google\Client::setAuthConfig), or an instance of
-     *           {@see CredentialsLoader}.
+     *           {@see FetchAuthTokenInterface}.
      *     @type string|array $scopes
      *           {@see Google\Client::setScopes}
      *     @type string $quota_project
@@ -213,7 +214,7 @@ public function __construct(array $config = [])
         ], $config);
 
         if (!is_null($this->config['credentials'])) {
-            if ($this->config['credentials'] instanceof CredentialsLoader) {
+            if ($this->config['credentials'] instanceof FetchAuthTokenInterface) {
                 $this->credentials = $this->config['credentials'];
             } else {
                 $this->setAuthConfig($this->config['credentials']);
@@ -460,7 +461,8 @@ public function authorize(?ClientInterface $http = null)
         $authHandler = $this->getAuthHandler();
 
         // These conditionals represent the decision tree for authentication
-        //   1.  Check if a Google\Auth\CredentialsLoader instance has been supplied via the "credentials" option
+        //   1.  Check if an instance of Google\Auth\FetchAuthTokenInterface has
+        //       been supplied via the "credentials" option
         //   2.  Check for Application Default Credentials
         //   3a. Check for an Access Token
         //   3b. If access token exists but is expired, try to refresh it
diff --git a/tests/Google/ClientTest.php b/tests/Google/ClientTest.php
@@ -24,7 +24,7 @@
 use Google\Service\Drive;
 use Google\AuthHandler\AuthHandlerFactory;
 use Google\Auth\FetchAuthTokenCache;
-use Google\Auth\CredentialsLoader;
+use Google\Auth\FetchAuthTokenInterface;
 use Google\Auth\GCECache;
 use Google\Auth\Credentials\GCECredentials;
 use GuzzleHttp\Client as GuzzleClient;
@@ -40,6 +40,8 @@
 use InvalidArgumentException;
 use Exception;
 use DomainException;
+use Google\Auth\GetUniverseDomainInterface;
+use Google\Auth\UpdateMetadataInterface;
 
 class ClientTest extends BaseTest
 {
@@ -868,10 +870,12 @@ public function testClientOptions()
         $this->assertEquals('some-quota-project', $credentials->getQuotaProject());
     }
 
-    public function testCredentialsOptionWithCredentialsLoader()
+    public function testCredentialsOptionWithFetchAuthTokenInterface()
     {
         $request = null;
-        $credentials = $this->prophesize('Google\Auth\CredentialsLoader');
+        $credentials = $this->prophesize(FetchAuthTokenInterface::class)
+            ->willImplement(GetUniverseDomainInterface::class)
+            ->willImplement(UpdateMetadataInterface::class);
         $credentials->getCacheKey()
             ->willReturn('cache-key');
         $credentials->getUniverseDomain()
@@ -947,7 +951,8 @@ public function testUniverseDomainMismatch()
             'The configured universe domain (example.com) does not match the credential universe domain (foo.com)'
         );
 
-        $credentials = $this->prophesize(CredentialsLoader::class);
+        $credentials = $this->prophesize(FetchAuthTokenInterface::class)
+            ->willImplement(GetUniverseDomainInterface::class);
         $credentials->getUniverseDomain()
             ->shouldBeCalledOnce()
             ->willReturn('foo.com');
