fix(auth): prioritize local project configuration over global ADC for quota attribution

[shanehuntley]

This PR updates the project ID prioritization to ensure that the project configured during setup (or via environment variables) takes precedence over global Application Default Credentials (ADC) for quota attribution. This fixes the issue where requests were failing with 403 errors when the Drive API was not enabled in a project picked up from global gcloud settings.\n\nFixes #273

[changeset-bot]

🦋 Changeset detected

Latest commit: 0af9670

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@googleworkspace/cli	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses a critical issue where Google API requests were failing due to an incorrect project ID being used for quota attribution. It introduces a robust prioritization mechanism to ensure that the project ID explicitly configured by the user, either through environment variables or local setup, is honored over globally detected Application Default Credentials. This change prevents unexpected 403 errors and improves the reliability of API interactions.

Highlights

• Project ID Prioritization: Implemented a new priority order for determining the GCP project ID used for quota attribution: environment variable GOOGLE_WORKSPACE_PROJECT_ID takes precedence, followed by the project ID from the OAuth client configuration, and finally falling back to Application Default Credentials (ADC).
• Bug Fix: Resolved an issue where API requests could fail with 403 errors due to an incorrect project ID being used for quota attribution, especially when the Drive API was not enabled in a project picked up from global gcloud settings.
• Documentation Updates: Updated AGENTS.md, README.md, and the main.rs usage message to reflect the new role and priority of the GOOGLE_WORKSPACE_PROJECT_ID environment variable.
• New Unit Tests: Added comprehensive unit tests to src/auth.rs to verify the correct prioritization logic for fetching the quota project ID under various configurations.

Changelog

• AGENTS.md
  • Updated the description for GOOGLE_WORKSPACE_PROJECT_ID to clarify its role as an override for quota/billing and fallback for helper commands.
• README.md
  • Modified the description for GOOGLE_WORKSPACE_PROJECT_ID to emphasize its function as an override for quota/billing and fallback for helper commands.
• src/auth.rs
  • Refactored the get_quota_project function to implement a new priority order for project ID retrieval: environment variable, OAuth client configuration, then ADC.
  • Added new unit tests (test_get_quota_project_priority_env_var, test_get_quota_project_priority_config, test_get_quota_project_priority_adc_fallback) to validate the project ID prioritization logic.
  • Updated an existing test (test_get_quota_project_reads_adc) to ensure proper isolation from other environment variables during testing.
• src/main.rs
  • Updated the usage message for GOOGLE_WORKSPACE_PROJECT_ID to reflect its new role in overriding the GCP project ID for quota and billing.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Generative AI Prohibited Use Policy, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request correctly updates the project ID prioritization for quota attribution, ensuring that local or environment-specific configurations take precedence over global Application Default Credentials (ADC). The new logic is sound, follows a sensible priority order, and is accompanied by thorough unit tests that validate each level of the priority system. The associated documentation changes in README.md, AGENTS.md, and the command-line help text are accurate and clearly reflect the new behavior. Overall, this is a well-implemented fix that directly addresses the reported issue.

[googleworkspace-bot]

/gemini review

[gemini-code-assist]

Code Review

This pull request updates the project ID prioritization for quota attribution. The new logic in src/auth.rs checks for a project ID from the GOOGLE_WORKSPACE_PROJECT_ID environment variable, then from the local client configuration file, before falling back to the Application Default Credentials (ADC). This change is accompanied by new unit tests to verify the new priority order and updates to documentation files to reflect the new behavior. I have reviewed the changes and found no high or critical severity issues.