fix: Raise a clear actionable error when CustomAuthScheme lacks a registered AuthProvider

PiperOrigin-RevId: 911115744

Author: google-genai-bot

src/google/adk/auth/credential_manager.py

@@ -183,26 +183,34 @@ async def get_auth_credential(
   ) -> Optional[AuthCredential]:
     """Load and prepare authentication credential through a structured workflow."""
 
-    # Pydantic may have deserialized an unknown scheme into a generic
-    # CustomAuthScheme. If so, rehydrate it first into a specific subclass.
-    # Note: Custom authentication scheme classes must have been imported into
-    # the Python runtime before get_auth_credential is called for their
-    # subclasses to be registered. This is fine as developer will anyway import
-    # them while registering the auth providers.
-    # Note: `__subclasses__()` only returns immediate subclasses, if there is a
-    # subclass of a subclass of CustomAuthScheme then it will not be returned.
-    # pylint: disable=unidiomatic-typecheck Needs exact class matching.
-    if type(self._auth_config.auth_scheme) is CustomAuthScheme:
-      self._auth_config.auth_scheme = _rehydrate_custom_scheme(
-          self._auth_config.auth_scheme,
-          CustomAuthScheme.__subclasses__(),
+    # Step 0: Handle CustomAuthScheme if present
+    if isinstance(self._auth_config.auth_scheme, CustomAuthScheme):
+      # Pydantic may have deserialized an unknown scheme into a generic
+      # CustomAuthScheme. If so, rehydrate it first into a specific subclass.
+      # Note: Custom authentication scheme classes must have been imported into
+      # the Python runtime before get_auth_credential is called for their
+      # subclasses to be registered. This is fine as developer will anyway
+      # import them while registering the auth providers.
+      # Note: `__subclasses__()` only returns immediate subclasses, if there is
+      # a subclass of a subclass of CustomAuthScheme then it will not be
+      # returned.
+      # pylint: disable=unidiomatic-typecheck Needs exact class matching.
+      if type(self._auth_config.auth_scheme) is CustomAuthScheme:
+        self._auth_config.auth_scheme = _rehydrate_custom_scheme(
+            self._auth_config.auth_scheme,
+            CustomAuthScheme.__subclasses__(),
+        )
+
+      provider = self._auth_provider_registry.get_provider(
+          self._auth_config.auth_scheme
       )
-    # First, check if a registered auth provider is available before attempting
-    # to retrieve tokens natively.
-    provider = self._auth_provider_registry.get_provider(
-        self._auth_config.auth_scheme
-    )
-    if provider:
+      if provider is None:
+        raise ValueError(
+            "No auth provider registered for custom auth scheme "
+            f"{self._auth_config.auth_scheme.type_!r}. "
+            "Register it using `CredentialManager.register_auth_provider("
+            "<YourAuthProviderInstance>)`."
+        )
       provided_credential = await provider.get_auth_credential(
           self._auth_config, context
       )

tests/unittests/auth/test_credential_manager.py

@@ -48,7 +48,7 @@
 from .. import testing_utils
 
 
-class DummyAuthScheme(SecurityBase):
+class DummyAuthScheme(CustomAuthScheme):
   """A custom auth scheme for testing pluggable auth providers."""
 
   type_: str = "dummy_auth_scheme"
@@ -1122,3 +1122,29 @@ def test_rehydrate_custom_scheme_failure(self):
       _rehydrate_custom_scheme(
           scheme=custom_scheme, supported_schemes=[DummyAuthScheme]
       )
+
+  @pytest.mark.asyncio
+  async def test_get_auth_credential_raises_error_when_no_provider_registered(
+      self, mocker
+  ):
+    """Test that a ValueError is raised when no provider is registered for a CustomAuthScheme."""
+
+    class DummyCustomScheme(CustomAuthScheme):
+      type_: str = "dummy_custom_auth_scheme"
+
+    auth_config = mocker.Mock(spec=AuthConfig, instance=True)
+    auth_config.auth_scheme = DummyCustomScheme()
+
+    manager = CredentialManager(auth_config)
+
+    with pytest.raises(
+        ValueError,
+        match=(
+            r"No auth provider registered for custom auth scheme "
+            r"'dummy_custom_auth_scheme'\. "
+            r"Register it using `CredentialManager\.register_auth_provider\("
+        ),
+    ):
+      await manager.get_auth_credential(
+          mocker.Mock(spec=CallbackContext, instance=True)
+      )