Function read_gcloud_adc

crates/openshell-cli/src/run.rs:4342–4423

Read gcloud Application Default Credentials from disk. Returns `(client_id, client_secret, refresh_token)`. Checks `GOOGLE_APPLICATION_CREDENTIALS` first; falls back to `$CLOUDSDK_CONFIG/application_default_credentials.json` when set, then to `~/.config/gcloud/application_default_credentials.json`.

()

/// `$CLOUDSDK_CONFIG/application_default_credentials.json` when set, then to
/// `~/.config/gcloud/application_default_credentials.json`.
fn read_gcloud_adc() -> Result<(String, String, String)> {
    let path = if let Some(env_path) = std::env::var("GOOGLE_APPLICATION_CREDENTIALS")
        .ok()
        .filter(|v| !v.is_empty())
    {
        PathBuf::from(env_path)
    } else if let Some(config_dir) = std::env::var("CLOUDSDK_CONFIG")
        .ok()
        .filter(|v| !v.is_empty())
    {
        PathBuf::from(config_dir).join("application_default_credentials.json")
    } else {
        let home = std::env::var("HOME")
            .map_err(|_| miette::miette!("HOME is not set; cannot locate gcloud ADC file"))?;
        PathBuf::from(home)
            .join(".config")
            .join("gcloud")
            .join("application_default_credentials.json")
    };

    let content = std::fs::read_to_string(&path).map_err(|err| {
        miette::miette!(
            "failed to read gcloud ADC file at {}: {}. \
             Run: gcloud auth application-default login",
            path.display(),
            err
        )
    })?;

    let json: serde_json::Value = serde_json::from_str(&content)
        .map_err(|err| miette::miette!("failed to parse gcloud ADC file: {err}"))?;

    let cred_type = json.get("type").and_then(|v| v.as_str());
    match cred_type {
        Some("service_account") => {
            return Err(miette::miette!(
                "Application Default Credentials are a service account key, not user credentials. \
                 To use a service account, create the provider with the service account JSON key \
                 and configure gateway-managed refresh for 'GOOGLE_VERTEX_AI_SERVICE_ACCOUNT_TOKEN'. \
                 See: openshell provider create --help"
            ));
        }
        Some("authorized_user") => {}
        Some(other) => {
            return Err(miette::miette!(
                "Application Default Credentials have unsupported type '{other}' \
                 (expected 'authorized_user'). \
                 Run: gcloud auth application-default login"
            ));
        }
        None => {
            return Err(miette::miette!(
                "gcloud ADC file is missing the 'type' field. \
                 The file may be malformed. \
                 Run: gcloud auth application-default login"
            ));
        }
    }