fix: restore auth_token initialization for secret and parameter manager clients

Merge #5371

**Please ensure you have read the [contribution guide](https://github.com/google/adk-python/blob/main/CONTRIBUTING.md) before creating a pull request.**

### Link to Issue or Description of Change

**1. Link to an existing issue (if applicable):**

- Closes: #5370

**2. Or, if no issue exists, describe the change:**

**Problem:**
Both `SecretManagerClient` and `ParameterManagerClient` advertise an `auth_token` constructor path, but the implementation instantiates `google.auth.credentials.Credentials(...)` directly. That base class is abstract, so callers hit a `TypeError` before the underlying Google Cloud client is constructed.

`SecretManagerClient` also documents that `service_account_json` and `auth_token` are mutually exclusive, but the current implementation silently accepts both inputs and ignores the token.

**Solution:**
- Switch both helpers to `google.oauth2.credentials.Credentials(token=auth_token)` for the `auth_token` path.
- Keep the change narrow to the validated runtime regression and its adjacent contract mismatch.
- Replace the mocked-constructor token-path tests with regression coverage that exercises the real credentials constructor path.
- Add a `SecretManagerClient` test that confirms conflicting credential inputs raise `ValueError`.

### Testing Plan

**Unit Tests:**

- [x] I have added or updated unit tests for my change.
- [x] All unit tests pass locally.

Passed locally:

```text
.venv/bin/pytest tests/unittests/integrations/secret_manager/test_secret_client.py tests/unittests/integrations/parameter_manager/test_parameter_client.py -q
17 passed, 1 warning in 24.43s
```

**Manual End-to-End (E2E) Tests:**

I also re-ran the original local reproductions with patched cloud clients to confirm the behavior change:

```python
from unittest.mock import MagicMock, patch
from google.adk.integrations.secret_manager.secret_client import SecretManagerClient
from google.adk.integrations.parameter_manager.parameter_client import ParameterManagerClient

with patch("google.cloud.secretmanager.SecretManagerServiceClient", return_value=MagicMock()):
    client = SecretManagerClient(auth_token="test-token")
    assert client._credentials.token == "test-token"

with patch("google.cloud.parametermanager_v1.ParameterManagerClient", return_value=MagicMock()):
    client = ParameterManagerClient(auth_token="test-token")
    assert client._credentials.token == "test-token"
```

And for the conflicting-input case:

```python
import json
from google.adk.integrations.secret_manager.secret_client import SecretManagerClient

try:
    SecretManagerClient(
        service_account_json=json.dumps({"type": "service_account"}),
        auth_token="test-token",
    )
except ValueError:
    pass
else:
    raise AssertionError("Expected conflicting credentials to raise ValueError")
```

### Checklist

- [x] I have read the [CONTRIBUTING.md](https://github.com/google/adk-python/blob/main/CONTRIBUTING.md) document.
- [x] I have performed a self-review of my own code.
- [x] I have commented my code, particularly in hard-to-understand areas.
- [x] I have added tests that prove my fix is effective or that my feature works.
- [x] New and existing unit tests pass locally with my changes.
- [x] I have manually tested my changes end-to-end.
- [x] Any dependent changes have been merged and published in downstream modules.

### Additional context

I intentionally kept this PR focused on the reproducible auth helper regressions that are still present in the latest stable release and current `main`.

Co-authored-by: Haran Rajkumar <haranrk@google.com>
COPYBARA_INTEGRATE_REVIEW=#5371 from shaun0927:fix/token-credentials-for-integrations 3567a25
PiperOrigin-RevId: 939989046

Author: 2 people

src/google/adk/integrations/parameter_manager/parameter_client.py

@@ -19,10 +19,9 @@
 from typing import Optional
 
 from google.api_core.gapic_v1 import client_info
-import google.auth
 from google.auth import default as default_service_credential
-import google.auth.transport.requests
 from google.cloud import parametermanager_v1
+from google.oauth2 import credentials as user_credentials
 from google.oauth2 import service_account
 
 from ... import version
@@ -89,15 +88,7 @@ def __init__(
       except json.JSONDecodeError as e:
         raise ValueError(f"Invalid service account JSON: {e}") from e
     elif auth_token:
-      credentials = google.auth.credentials.Credentials(
-          token=auth_token,
-          refresh_token=None,
-          token_uri=None,
-          client_id=None,
-          client_secret=None,
-      )
-      request = google.auth.transport.requests.Request()
-      credentials.refresh(request)
+      credentials = user_credentials.Credentials(token=auth_token)
     else:
       try:
         credentials, _ = default_service_credential(

src/google/adk/integrations/secret_manager/secret_client.py

@@ -19,10 +19,9 @@
 from typing import Optional
 
 from google.api_core.gapic_v1 import client_info
-import google.auth
 from google.auth import default as default_service_credential
-import google.auth.transport.requests
 from google.cloud import secretmanager
+from google.oauth2 import credentials as user_credentials
 from google.oauth2 import service_account
 
 from ... import version
@@ -42,8 +41,9 @@ class SecretManagerClient:
   """A client for interacting with Google Cloud Secret Manager.
 
   This class provides a simplified interface for retrieving secrets from
-  Secret Manager, handling authentication using either a service account
-  JSON keyfile (passed as a string) or a preexisting authorization token.
+  Secret Manager, handling authentication using a service account JSON
+  keyfile (passed as a string) or a preexisting authorization token. If
+  neither is provided, it falls back to Application Default Credentials.
 
   Attributes:
       _credentials:  Google Cloud credentials object (ServiceAccountCredentials
@@ -59,6 +59,10 @@ def __init__(
   ):
     """Initializes the SecretManagerClient.
 
+    Credentials are resolved in priority order: `service_account_json`, then
+    `auth_token`, then Application Default Credentials when neither is
+    provided.
+
     Args:
         service_account_json:  The content of a service account JSON keyfile (as
           a string), not the file path.  Must be valid JSON.
@@ -67,12 +71,18 @@ def __init__(
           Manager service. If not provided, the global endpoint is used.
 
     Raises:
-        ValueError: If neither `service_account_json` nor `auth_token` is
-        provided,
-            or if both are provided.  Also raised if the service_account_json
-            is not valid JSON.
+        ValueError: If both `service_account_json` and `auth_token` are
+            provided, if `service_account_json` is not valid JSON, or if
+            neither is provided and Application Default Credentials cannot be
+            resolved.
         google.auth.exceptions.GoogleAuthError: If authentication fails.
     """
+    if service_account_json and auth_token:
+      raise ValueError(
+          "Must provide either 'service_account_json' or 'auth_token', not"
+          " both."
+      )
+
     if service_account_json:
       try:
         credentials = service_account.Credentials.from_service_account_info(
@@ -81,15 +91,7 @@ def __init__(
       except json.JSONDecodeError as e:
         raise ValueError(f"Invalid service account JSON: {e}") from e
     elif auth_token:
-      credentials = google.auth.credentials.Credentials(
-          token=auth_token,
-          refresh_token=None,
-          token_uri=None,
-          client_id=None,
-          client_secret=None,
-      )
-      request = google.auth.transport.requests.Request()
-      credentials.refresh(request)
+      credentials = user_credentials.Credentials(token=auth_token)
     else:
       try:
         credentials, _ = default_service_credential(

tests/unittests/integrations/parameter_manager/test_parameter_client.py

@@ -19,6 +19,7 @@
 from unittest.mock import patch
 
 from google.api_core.gapic_v1 import client_info
+from google.oauth2.credentials import Credentials
 import pytest
 
 pytest.importorskip("google.cloud.parametermanager_v1")
@@ -95,28 +96,19 @@ def test_init_with_service_account_json(
   @patch("google.cloud.parametermanager_v1.ParameterManagerClient")
   def test_init_with_auth_token(self, mock_pm_client_class):
     """Test initialization with auth token."""
-    # Setup
     auth_token = "test-token"
-    mock_credentials = MagicMock()
-
-    with (
-        patch("google.auth.credentials.Credentials") as mock_credentials_class,
-        patch("google.auth.transport.requests.Request") as mock_request,
-    ):
-      mock_credentials_class.return_value = mock_credentials
 
-      # Execute
-      client = ParameterManagerClient(auth_token=auth_token)
+    client = ParameterManagerClient(auth_token=auth_token)
 
-      # Verify
-      mock_credentials.refresh.assert_called_once()
-      mock_pm_client_class.assert_called_once()
-      call_kwargs = mock_pm_client_class.call_args.kwargs
-      assert call_kwargs["credentials"] == mock_credentials
-      assert call_kwargs["client_options"] is None
-      assert call_kwargs["client_info"].user_agent == USER_AGENT
-      assert client._credentials == mock_credentials
-      assert client._client == mock_pm_client_class.return_value
+    mock_pm_client_class.assert_called_once()
+    call_kwargs = mock_pm_client_class.call_args.kwargs
+    assert isinstance(call_kwargs["credentials"], Credentials)
+    assert call_kwargs["credentials"].token == auth_token
+    assert call_kwargs["client_options"] is None
+    assert call_kwargs["client_info"].user_agent == USER_AGENT
+    assert isinstance(client._credentials, Credentials)
+    assert client._credentials.token == auth_token
+    assert client._client == mock_pm_client_class.return_value
 
   @patch("google.cloud.parametermanager_v1.ParameterManagerClient")
   @patch(
@@ -181,6 +173,20 @@ def test_init_with_invalid_service_account_json(self):
     with pytest.raises(ValueError, match="Invalid service account JSON"):
       ParameterManagerClient(service_account_json="invalid-json")
 
+  def test_init_with_both_service_account_json_and_auth_token(self):
+    """Test initialization rejects conflicting credential inputs."""
+    with pytest.raises(
+        ValueError,
+        match=(
+            "Must provide either 'service_account_json' or 'auth_token', not"
+            " both."
+        ),
+    ):
+      ParameterManagerClient(
+          service_account_json=json.dumps({"type": "service_account"}),
+          auth_token="test-token",
+      )
+
   @patch("google.cloud.parametermanager_v1.ParameterManagerClient")
   @patch(
       "google.adk.integrations.parameter_manager.parameter_client.default_service_credential"

tests/unittests/integrations/secret_manager/test_secret_client.py

@@ -21,6 +21,7 @@
 from google.adk.integrations.secret_manager.secret_client import SecretManagerClient
 from google.adk.integrations.secret_manager.secret_client import USER_AGENT
 from google.api_core.gapic_v1 import client_info
+from google.oauth2.credentials import Credentials
 import pytest
 
 import google
@@ -94,30 +95,19 @@ def test_init_with_service_account_json(
   @patch("google.cloud.secretmanager.SecretManagerServiceClient")
   def test_init_with_auth_token(self, mock_secret_manager_client):
     """Test initialization with auth token."""
-    # Setup
     auth_token = "test-token"
-    mock_credentials = MagicMock()
 
-    # Mock the entire credentials creation process
-    with (
-        patch("google.auth.credentials.Credentials") as mock_credentials_class,
-        patch("google.auth.transport.requests.Request") as mock_request,
-    ):
-      # Configure the mock to return our mock_credentials when instantiated
-      mock_credentials_class.return_value = mock_credentials
-
-      # Execute
-      client = SecretManagerClient(auth_token=auth_token)
-
-      # Verify
-      mock_credentials.refresh.assert_called_once()
-      mock_secret_manager_client.assert_called_once()
-      call_kwargs = mock_secret_manager_client.call_args.kwargs
-      assert call_kwargs["credentials"] == mock_credentials
-      assert call_kwargs["client_options"] is None
-      assert call_kwargs["client_info"].user_agent == USER_AGENT
-      assert client._credentials == mock_credentials
-      assert client._client == mock_secret_manager_client.return_value
+    client = SecretManagerClient(auth_token=auth_token)
+
+    mock_secret_manager_client.assert_called_once()
+    call_kwargs = mock_secret_manager_client.call_args.kwargs
+    assert isinstance(call_kwargs["credentials"], Credentials)
+    assert call_kwargs["credentials"].token == auth_token
+    assert call_kwargs["client_options"] is None
+    assert call_kwargs["client_info"].user_agent == USER_AGENT
+    assert isinstance(client._credentials, Credentials)
+    assert client._credentials.token == auth_token
+    assert client._client == mock_secret_manager_client.return_value
 
   @patch("google.cloud.secretmanager.SecretManagerServiceClient")
   @patch(
@@ -182,6 +172,20 @@ def test_init_with_invalid_service_account_json(self):
     with pytest.raises(ValueError, match="Invalid service account JSON"):
       SecretManagerClient(service_account_json="invalid-json")
 
+  def test_init_with_both_service_account_json_and_auth_token(self):
+    """Test initialization rejects conflicting credential inputs."""
+    with pytest.raises(
+        ValueError,
+        match=(
+            "Must provide either 'service_account_json' or 'auth_token', not"
+            " both."
+        ),
+    ):
+      SecretManagerClient(
+          service_account_json=json.dumps({"type": "service_account"}),
+          auth_token="test-token",
+      )
+
   @patch("google.cloud.secretmanager.SecretManagerServiceClient")
   @patch(
       "google.adk.integrations.secret_manager.secret_client.default_service_credential"