fix(internaloption): AuthCreds should honor WithoutAuthentication (#3166)

codyoss · web-flow · commit d117646289fa · 2025-05-28T15:00:40.000Z
In this case the function will return a nil error and a nil credential. This API is currently only used by storage, whom have asked for this usage change. Also, fixed godoc that was not rendering properly before.

Internal Bug: 419426629
diff --git a/internal/creds.go b/internal/creds.go
@@ -47,7 +47,13 @@ func Creds(ctx context.Context, ds *DialSettings) (*google.Credentials, error) {
 // options provided via [option.ClientOption], including legacy oauth2/google
 // options. If there are no applicable options, then it returns the result of
 // [cloud.google.com/go/auth/credentials.DetectDefault].
+// Note: If NoAuth is true, when [google.golang.org/api/option.WithoutAuthentication]
+// is passed, then no authentication will be performed and this function will
+// return nil, nil.
 func AuthCreds(ctx context.Context, settings *DialSettings) (*auth.Credentials, error) {
+	if settings.NoAuth {
+		return nil, nil
+	}
 	if settings.AuthCredentials != nil {
 		return settings.AuthCredentials, nil
 	}
diff --git a/internal/creds_test.go b/internal/creds_test.go
@@ -645,3 +645,17 @@ func TestIsSelfSignedJWTFlow(t *testing.T) {
 		}
 	}
 }
+
+func TestNewAuth_NoAuth(t *testing.T) {
+	ctx := context.Background()
+	ds := &DialSettings{
+		NoAuth: true,
+	}
+	creds, err := AuthCreds(ctx, ds)
+	if err != nil {
+		t.Fatalf("got %v, want nil error", err)
+	}
+	if creds != nil {
+		t.Fatalf("got %v, want nil creds", creds)
+	}
+}
diff --git a/option/internaloption/internaloption.go b/option/internaloption/internaloption.go
@@ -289,21 +289,22 @@ func GetLogger(opts []option.ClientOption) *slog.Logger {
 // options provided via [option.ClientOption], including legacy oauth2/google
 // options, in this order:
 //
-// * [option.WithAuthCredentials]
-// * [option/internaloption.WithCredentials] (internal use only)
-// * [option.WithCredentials]
-// * [option.WithTokenSource]
+//   - [option.WithoutAuthentication]
+//   - [option.WithAuthCredentials]
+//   - [WithCredentials] (internal use only)
+//   - [option.WithCredentials]
+//   - [option.WithTokenSource]
 //
 // If there are no applicable credentials options, then it passes the
 // following options to [cloud.google.com/go/auth/credentials.DetectDefault] and
 // returns the result:
 //
-// * [option.WithAudiences]
-// * [option.WithCredentialsFile]
-// * [option.WithCredentialsJSON]
-// * [option.WithScopes]
-// * [option/internaloption.WithDefaultScopes] (internal use only)
-// * [option/internaloption.EnableJwtWithScope] (internal use only)
+//   - [option.WithAudiences]
+//   - [option.WithCredentialsFile]
+//   - [option.WithCredentialsJSON]
+//   - [option.WithScopes]
+//   - [WithDefaultScopes] (internal use only)
+//   - [EnableJwtWithScope] (internal use only)
 //
 // This function should only be used internally by generated clients. This is an
 // EXPERIMENTAL API and may be changed or removed in the future.

Original file line number	Diff line number	Diff line change
`@@ -645,3 +645,17 @@ func TestIsSelfSignedJWTFlow(t *testing.T) {`
`645`	`645`	`}`
`646`	`646`	`}`
`647`	`647`	`}`
	`648`	`+`
	`649`	`+func TestNewAuth_NoAuth(t *testing.T) {`
	`650`	`+ ctx := context.Background()`
	`651`	`+ ds := &DialSettings{`
	`652`	`+ NoAuth: true,`
	`653`	`+ }`
	`654`	`+ creds, err := AuthCreds(ctx, ds)`
	`655`	`+ if err != nil {`
	`656`	`+ t.Fatalf("got %v, want nil error", err)`
	`657`	`+ }`
	`658`	`+ if creds != nil {`
	`659`	`+ t.Fatalf("got %v, want nil creds", creds)`
	`660`	`+ }`
	`661`	`+}`