Respect disableGoogleAuth when initializing Google HTTP client in scalibr.

PiperOrigin-RevId: 950637626

Author: another-rex

clients/datasource/maven_registry.go

@@ -84,7 +84,7 @@ func NewMavenRegistryAPIClient(
 	ctx context.Context,
 	registry MavenRegistry,
 	localRegistry string,
-	disableGoogleClient bool,
+	disableGoogleAuth bool,
 	httpClient *http.Client,
 	googleClient *http.Client,
 ) (*MavenRegistryAPIClient, error) {
@@ -120,7 +120,7 @@ func NewMavenRegistryAPIClient(
 		mu:                &sync.Mutex{},
 		responses:         NewRequestCache[string, response](),
 		registryAuths:     MakeMavenAuth(globalSettings, userSettings),
-		disableGoogleAuth: disableGoogleClient,
+		disableGoogleAuth: disableGoogleAuth,
 		httpClient:        httpClient,
 		googleClient:      googleClient,
 	}
@@ -362,7 +362,7 @@ func (m *MavenRegistryAPIClient) get(ctx context.Context, auth *HTTPAuthenticati
 	if isArtifactRegistry {
 		requestURL.Scheme = "https"
 		// For Artifact Registry, use google.DefaultClient for ADC if available.
-		if m.googleClient != nil {
+		if m.googleClient != nil && !m.disableGoogleAuth {
 			httpClient = m.googleClient
 		}
 	}

clients/datasource/maven_registry_test.go

@@ -16,10 +16,12 @@ package datasource_test
 
 import (
 	"bytes"
+	"io"
 	"net/http"
 	"os"
 	"path/filepath"
 	"reflect"
+	"sync"
 	"testing"
 
 	"deps.dev/util/maven"
@@ -278,3 +280,90 @@ func TestMavenLocalRegistry(t *testing.T) {
 		t.Errorf("unexpected file content: got %s, want %s", string(content), string(resp))
 	}
 }
+
+type trackingTransport struct {
+	mu     sync.Mutex
+	called bool
+}
+
+func (t *trackingTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	t.mu.Lock()
+	t.called = true
+	t.mu.Unlock()
+	return &http.Response{
+		StatusCode: http.StatusOK,
+		Body:       io.NopCloser(bytes.NewReader([]byte("<project><groupId>g</groupId><artifactId>a</artifactId><version>v</version></project>"))),
+	}, nil
+}
+
+func (t *trackingTransport) wasCalled() bool {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	return t.called
+}
+
+// TestDisableGoogleAuthRespected tests that setting disableGoogleAuth = true in
+// NewMavenRegistryAPIClient prevents the Google client from being used for
+// Artifact Registry requests, falling back to the standard HTTP client.
+func TestDisableGoogleAuthRespected(t *testing.T) {
+	standardTransport := &trackingTransport{}
+	googleTransport := &trackingTransport{}
+
+	standardClient := &http.Client{Transport: standardTransport}
+	googleClient := &http.Client{Transport: googleTransport}
+
+	client, err := datasource.NewMavenRegistryAPIClient(
+		t.Context(),
+		datasource.MavenRegistry{URL: "artifactregistry://example.com", ReleasesEnabled: true},
+		"",   // localRegistry
+		true, // disableGoogleAuth
+		standardClient,
+		googleClient,
+	)
+	if err != nil {
+		t.Fatalf("NewMavenRegistryAPIClient failed: %v", err)
+	}
+
+	_, _ = client.GetProject(t.Context(), "g", "a", "v")
+
+	if googleTransport.wasCalled() {
+		t.Errorf("Google client was called when disableGoogleAuth is true")
+	}
+	if !standardTransport.wasCalled() {
+		t.Errorf("Standard client was not called")
+	}
+}
+
+// TestDisableGoogleAuthMethodRespected tests that dynamically calling
+// DisableGoogleAuth() post-construction prevents the Google client from being
+// used for Artifact Registry requests.
+func TestDisableGoogleAuthMethodRespected(t *testing.T) {
+	standardTransport := &trackingTransport{}
+	googleTransport := &trackingTransport{}
+
+	standardClient := &http.Client{Transport: standardTransport}
+	googleClient := &http.Client{Transport: googleTransport}
+
+	client, err := datasource.NewMavenRegistryAPIClient(
+		t.Context(),
+		datasource.MavenRegistry{URL: "artifactregistry://example.com", ReleasesEnabled: true},
+		"",    // localRegistry
+		false, // disableGoogleAuth
+		standardClient,
+		googleClient,
+	)
+	if err != nil {
+		t.Fatalf("NewMavenRegistryAPIClient failed: %v", err)
+	}
+
+	client.DisableGoogleAuth()
+
+	_, _ = client.GetProject(t.Context(), "g", "a", "v")
+
+	if googleTransport.wasCalled() {
+		t.Errorf("Google client was called after DisableGoogleAuth()")
+	}
+	if !standardTransport.wasCalled() {
+		t.Errorf("Standard client was not called")
+	}
+}

enricher/transitivedependency/pomxml/pomxml.go

@@ -20,6 +20,7 @@ import (
 	"errors"
 	"fmt"
 	"maps"
+	"net/http"
 	"slices"
 	"strings"
 
@@ -110,9 +111,13 @@ func New(cfg *config.PluginConfig) (enricher.Enricher, error) {
 	}
 
 	httpClient := cfg.ClientFactories.HTTPClient()
-	googleClient, err := cfg.ClientFactories.GoogleHTTPClient(context.Background(), "https://www.googleapis.com/auth/cloud-platform")
-	if err != nil {
-		log.Warnf("Google default client unavailable, Artifact Registry will not be readable: %v", err)
+	var googleClient *http.Client
+	var err error
+	if !disableGoogleAuth {
+		googleClient, err = cfg.ClientFactories.GoogleHTTPClient(context.Background(), "https://www.googleapis.com/auth/cloud-platform")
+		if err != nil {
+			log.Warnf("Google default client unavailable, Artifact Registry will not be readable: %v", err)
+		}
 	}
 
 	mavenClient, err := datasource.NewMavenRegistryAPIClient(

enricher/transitivedependency/pomxml/pomxml_test.go

@@ -963,7 +963,6 @@ func TestEnricher_Enrich_LocalModules(t *testing.T) {
 	sort.Slice(wantInventory.Packages, func(i, j int) bool {
 		return wantInventory.Packages[i].Name < wantInventory.Packages[j].Name
 	})
-
 	if diff := cmp.Diff(wantInventory, inv); diff != "" {
 		t.Errorf("%s.Enrich() diff (-want +got):\n%s", enrichy.Name(), diff)
 	}