update tests

Author: scotthart

ci/cloudbuild/builds/cmake-install.sh

@@ -133,7 +133,6 @@ expected_dirs+=(
   ./include/google/cloud/storage/internal/grpc
   ./include/google/cloud/storage/internal/rest
   ./include/google/cloud/storage/mocks
-  ./include/google/cloud/storage/oauth2
   ./include/google/cloud/storage/testing
   # no gRPC services in google/cloud/workflows/type.
   ./include/google/cloud/workflows/type

google/cloud/credentials.h

@@ -335,6 +335,9 @@ std::shared_ptr<Credentials> MakeServiceAccountCredentials(
  * [service account key]:
  * https://cloud.google.com/iam/docs/creating-managing-service-account-keys#iam-service-account-keys-create-cpp
  *
+ * Use `ScopesOption` to restrict the authentication scope for the obtained
+ * credentials.
+ *
  * @ingroup guac
  *
  * @note While JSON file formats are supported for both REST and gRPC transport,

google/cloud/internal/unified_rest_credentials.cc

@@ -165,10 +165,16 @@ std::shared_ptr<oauth2_internal::Credentials> MapCredentials(
 
     void visit(ServiceAccountConfig const& cfg) override {
       if (cfg.file_path().has_value()) {
-        result = Decorate(CreateServiceAccountCredentialsFromFilePath(
-                              *cfg.file_path(), {}, {}, cfg.options(),
-                              std::move(client_factory_)),
-                          cfg.options());
+        std::set<std::string> scopes;
+        if (cfg.options().has<ScopesOption>()) {
+          auto s = cfg.options().get<ScopesOption>();
+          scopes.insert(s.begin(), s.end());
+        }
+        result =
+            Decorate(CreateServiceAccountCredentialsFromFilePath(
+                         *cfg.file_path(), std::move(scopes), absl::nullopt,
+                         cfg.options(), std::move(client_factory_)),
+                     cfg.options());
       } else {
         auto creds = CreateServiceAccountCredentialsFromJsonContents(
             cfg.json_object(), cfg.options(), std::move(client_factory_));

google/cloud/storage/ci/run_integration_tests_emulator_bazel.sh

@@ -59,7 +59,6 @@ readonly PRODUCTION_ONLY_BASE=(
   "//google/cloud/storage/tests:alternative_endpoint_integration_test"
   "//google/cloud/storage/tests:key_file_integration_test"
   "//google/cloud/storage/tests:signed_url_integration_test"
-  "//google/cloud/storage/tests:unified_credentials_integration_test"
 )
 for base in "${PRODUCTION_ONLY_BASE[@]}"; do
   production_only_targets+=(

google/cloud/storage/tests/service_account_credentials_integration_test.cc

@@ -12,7 +12,6 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-// #include "google/cloud/storage/oauth2/google_credentials.h"
 #include "google/cloud/storage/testing/retry_http_request.h"
 #include "google/cloud/storage/testing/storage_integration_test.h"
 #include "google/cloud/internal/getenv.h"
@@ -23,7 +22,6 @@
 #include <gmock/gmock.h>
 #include <nlohmann/json.hpp>
 #include <chrono>
-#include <set>
 #include <string>
 #include <utility>
 
@@ -44,6 +42,10 @@ TEST_F(ServiceAccountCredentialsTest, UserInfoOAuth2) {
       "GOOGLE_CLOUD_CPP_STORAGE_TEST_KEY_FILE_JSON");
   if (UsingEmulator() || !filename) GTEST_SKIP();
 
+  auto options = Options{}.set<ScopesOption>(std::vector<std::string>(
+      {"https://www.googleapis.com/auth/userinfo.email",
+       "https://www.googleapis.com/auth/cloud-platform"}));
+
   auto credentials = MakeServiceAccountCredentialsFromFile(*filename);
 
   // auto credentials = oauth2::CreateServiceAccountCredentialsFromFilePath(