fix: Make EUC request args JSON-serializable

Merge #6007

### Link to Issue or Description of Change

- Closes: #6006

**Problem:**

Two call sites dump `AuthToolArguments` with the default `mode="python"`, leaving the auth scheme's `type` field as a live `SecuritySchemeType` enum inside the `adk_request_credential` FunctionCall args:

- `build_auth_request_event` in `flows/llm_flows/functions.py` (the LLM-flow EUC path)
- `create_auth_request_event` in `workflow/utils/_workflow_hitl_utils.py` (the v2 workflow HITL path)

The in-memory `Event.content` is therefore not JSON-serializable: any consumer that `json.dumps` it before it round-trips the session DB raises `TypeError: Object of type SecuritySchemeType is not JSON serializable`. Memory ingestion (`VertexAiMemoryBankService`) is a concrete trigger. It stays hidden in most flows because the session DB launders enums to strings on write and the auth preprocessor re-validates from either form.

**Solution:**

Dump with `mode="json"` at both sites, which coerces the enum to its `"oauth2"` string while preserving `by_alias`/`exclude_none`. Parse-back is unaffected: pydantic validation already accepts the string form, exactly what DB-read events carry. Two one-line changes, each with a regression test.

### Testing Plan

**Unit Tests:**

- [x] I have added or updated unit tests for my change.
- [x] All unit tests pass locally.

Both tests build an EUC/auth request, assert the args are JSON-serializable, and assert the auth scheme type is the string `"oauth2"`. Each fails before its change and passes after.

- `test_function_request_euc_args_are_json_serializable` in `tests/unittests/flows/llm_flows/test_functions_request_euc.py` (LLM-flow path)
- `test_args_are_json_serializable` in `tests/unittests/workflow/utils/test_workflow_hitl_utils.py` (workflow HITL path)

```text
$ pytest tests/unittests/flows/llm_flows/test_functions_request_euc.py -q
4 passed, 24 warnings in 1.25s

$ pytest tests/unittests/workflow/utils/test_workflow_hitl_utils.py -q
12 passed, 5 warnings in 0.67s
```

**Manual End-to-End (E2E) Tests:**

The inline repro in the linked issue is the manual check: `json.dumps` on the args dict raises `TypeError` before the change and passes after. Verified against google-adk 2.2.0 (== current `main`).

### Checklist

- [x] I have read the CONTRIBUTING.md document.
- [x] I have performed a self-review of my own code.
- [x] I have commented my code, particularly in hard-to-understand areas.
- [x] I have added tests that prove my fix is effective or that my feature works.
- [x] New and existing unit tests pass locally with my changes.
- [x] I have manually tested my changes end-to-end.
- [ ] Any dependent changes have been merged and published in downstream modules.

### Additional context

The workflow HITL site was folded in per @surajksharma07's suggestion on the issue, so both auth-request builders are now covered. The remaining sibling `model_dump(exclude_none=True, by_alias=True)` call sites in `functions.py` (the tool-confirmation args near `:368`/`:371` and the event-actions dump near `:1241`) follow the same python-mode pattern and may carry the same hazard if their models contain enums, but they are a different feature path with no confirmed repro, so I left them out of scope. Happy to fold them in if you'd prefer consistency across the file.

Co-authored-by: George Weale <gweale@google.com>
COPYBARA_INTEGRATE_REVIEW=#6007 from doughayden:fix/euc-request-args-json-serializable 71f02d9
PiperOrigin-RevId: 933934084

Author: 2 people

src/google/adk/flows/llm_flows/functions.py

@@ -302,7 +302,7 @@ def build_auth_request_event(
         args=AuthToolArguments(
             function_call_id=function_call_id,
             auth_config=auth_config,
-        ).model_dump(exclude_none=True, by_alias=True),
+        ).model_dump(mode='json', exclude_none=True, by_alias=True),
     )
     long_running_tool_ids.add(request_euc_function_call.id)
     parts.append(types.Part(function_call=request_euc_function_call))

src/google/adk/workflow/utils/_workflow_hitl_utils.py

@@ -172,7 +172,7 @@ def create_auth_request_event(
   args = AuthToolArguments(
       function_call_id=interrupt_id,
       auth_config=auth_request,
-  ).model_dump(exclude_none=True, by_alias=True)
+  ).model_dump(mode='json', exclude_none=True, by_alias=True)
 
   # Add message so the UI / CLI knows what to display.
   args['message'] = _build_auth_message(auth_config)

tests/unittests/flows/llm_flows/test_functions_request_euc.py

@@ -12,6 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+import json
 from typing import Any
 from typing import Optional
 
@@ -155,6 +156,66 @@ def call_external_api2(tool_context: ToolContext) -> Optional[int]:
   assert len(mock_model.requests) == 1
 
 
+def test_function_request_euc_args_are_json_serializable():
+  responses = [
+      [
+          types.Part.from_function_call(name='call_external_api', args={}),
+      ],
+      [
+          types.Part.from_text(text='response1'),
+      ],
+  ]
+
+  auth_config = AuthConfig(
+      auth_scheme=OAuth2(
+          flows=OAuthFlows(
+              authorizationCode=OAuthFlowAuthorizationCode(
+                  authorizationUrl='https://accounts.google.com/o/oauth2/auth',
+                  tokenUrl='https://oauth2.googleapis.com/token',
+                  scopes={
+                      'https://www.googleapis.com/auth/calendar': (
+                          'See, edit, share, and permanently delete all the'
+                          ' calendars you can access using Google Calendar'
+                      )
+                  },
+              )
+          )
+      ),
+      raw_auth_credential=AuthCredential(
+          auth_type=AuthCredentialTypes.OAUTH2,
+          oauth2=OAuth2Auth(
+              client_id='oauth_client_id',
+              client_secret='oauth_client_secret',
+          ),
+      ),
+  )
+
+  mock_model = testing_utils.MockModel.create(responses=responses)
+
+  def call_external_api(tool_context: ToolContext) -> Optional[int]:
+    tool_context.request_credential(auth_config)
+
+  agent = Agent(
+      name='root_agent',
+      model=mock_model,
+      tools=[call_external_api],
+  )
+  runner = testing_utils.InMemoryRunner(agent)
+  events = runner.run('test')
+
+  request_euc_function_call = events[1].content.parts[0].function_call
+  assert (
+      request_euc_function_call.name == functions.REQUEST_EUC_FUNCTION_CALL_NAME
+  )
+
+  # python-mode dump leaves auth_scheme.type a live enum, breaking json.dumps
+  json.dumps(request_euc_function_call.args)
+  assert (
+      request_euc_function_call.args['authConfig']['authScheme']['type']
+      == 'oauth2'
+  )
+
+
 def test_function_get_auth_response():
   id_1 = 'id_1'
   id_2 = 'id_2'

tests/unittests/workflow/utils/test_workflow_hitl_utils.py

@@ -14,6 +14,8 @@
 
 from __future__ import annotations
 
+import json
+
 from google.adk.events.event import Event
 from google.adk.events.event import NodeInfo
 from google.adk.events.request_input import RequestInput
@@ -172,5 +174,46 @@ def test_creates_credential_request(self):
     assert fc.id == "auth-id-1"
     assert "authConfig" in fc.args
 
+  def test_args_are_json_serializable(self):
+    from fastapi.openapi.models import OAuth2
+    from fastapi.openapi.models import OAuthFlowAuthorizationCode
+    from fastapi.openapi.models import OAuthFlows
+    from google.adk.auth.auth_credential import AuthCredential
+    from google.adk.auth.auth_credential import AuthCredentialTypes
+    from google.adk.auth.auth_credential import OAuth2Auth
+    from google.adk.auth.auth_tool import AuthConfig
+
+    auth_config = AuthConfig(
+        auth_scheme=OAuth2(
+            flows=OAuthFlows(
+                authorizationCode=OAuthFlowAuthorizationCode(
+                    authorizationUrl=(
+                        "https://accounts.google.com/o/oauth2/auth"
+                    ),
+                    tokenUrl="https://oauth2.googleapis.com/token",
+                    scopes={
+                        "https://www.googleapis.com/auth/calendar": (
+                            "See calendars"
+                        )
+                    },
+                )
+            )
+        ),
+        raw_auth_credential=AuthCredential(
+            auth_type=AuthCredentialTypes.OAUTH2,
+            oauth2=OAuth2Auth(
+                client_id="oauth_client_id",
+                client_secret="oauth_client_secret",
+            ),
+        ),
+    )
+    event = create_auth_request_event(auth_config, "auth-id-1")
+
+    fc = event.content.parts[0].function_call
+
+    # python-mode dump leaves auth_scheme.type a live enum, breaking json.dumps
+    json.dumps(fc.args)
+    assert fc.args["authConfig"]["authScheme"]["type"] == "oauth2"
+
 
 #