feat(auth): add Google Application Default Credentials support for Vertex AI (#2326)

Author: amitksingh1490

Cargo.lock

@@ -129,6 +129,7 @@ num-format = "0.4"
 humantime = "2.1.0"
 dashmap = "7.0.0-rc2"
 async-openai = { version = "0.31.1", default-features = false, features = ["response-types"] } # Using only types, not the API client - reduces dependencies
+google-cloud-auth = "1.4.0" # Google Cloud authentication with automatic token refresh
 
 # Internal crates
 forge_api = { path = "crates/forge_api" }

Cargo.toml

@@ -11,6 +11,8 @@ pub enum AuthMethod {
     OAuthDevice(OAuthConfig),
     #[serde(rename = "oauth_code")]
     OAuthCode(OAuthConfig),
+    #[serde(rename = "google_adc")]
+    GoogleAdc,
 }
 
 impl AuthMethod {
@@ -22,10 +24,14 @@ impl AuthMethod {
         Self::OAuthCode(config)
     }
 
+    pub fn google_adc() -> Self {
+        Self::GoogleAdc
+    }
+
     pub fn oauth_config(&self) -> Option<&OAuthConfig> {
         match self {
             Self::OAuthDevice(config) | Self::OAuthCode(config) => Some(config),
-            Self::ApiKey => None,
+            Self::ApiKey | Self::GoogleAdc => None,
         }
     }
 }

crates/forge_domain/src/auth/auth_method.rs

@@ -44,6 +44,7 @@ serde_urlencoded = "0.7.1"
 http.workspace = true
 url.workspace = true
 tonic.workspace = true
+google-cloud-auth.workspace = true
 
 [dev-dependencies]
 tokio = { workspace = true, features = ["macros", "rt", "time", "test-util"] }

crates/forge_infra/Cargo.toml

@@ -5,6 +5,7 @@ use forge_domain::{
     ApiKey, ApiKeyRequest, AuthContextRequest, AuthContextResponse, AuthCredential, CodeRequest,
     DeviceCodeRequest, OAuthConfig, OAuthTokenResponse, OAuthTokens, ProviderId, URLParam,
 };
+use google_cloud_auth::credentials::Builder;
 use oauth2::basic::BasicClient;
 use oauth2::{ClientId, DeviceAuthorizationUrl, Scope, TokenUrl};
 use reqwest::header::{HeaderMap, HeaderValue};
@@ -343,6 +344,99 @@ impl AuthStrategy for OAuthWithApiKeyStrategy {
     }
 }
 
+/// Google Application Default Credentials (ADC) Strategy
+/// Uses Google Cloud SDK's ADC mechanism with automatic token refresh
+pub struct GoogleAdcStrategy {
+    provider_id: ProviderId,
+    required_params: Vec<URLParam>,
+}
+
+impl GoogleAdcStrategy {
+    pub fn new(provider_id: ProviderId, required_params: Vec<URLParam>) -> Self {
+        Self { provider_id, required_params }
+    }
+}
+
+#[async_trait::async_trait]
+impl AuthStrategy for GoogleAdcStrategy {
+    async fn init(&self) -> anyhow::Result<AuthContextRequest> {
+        // For Google ADC, we don't need any user interaction for the API key
+        // The credentials are automatically discovered from:
+        // 1. GOOGLE_APPLICATION_CREDENTIALS env var (service account)
+        // 2. gcloud ADC credentials (user credentials)
+        // 3. Metadata server (GCP environment)
+        // However, we still need to collect URL params like PROJECT_ID and LOCATION
+        Ok(AuthContextRequest::ApiKey(ApiKeyRequest {
+            required_params: self.required_params.clone(),
+            existing_params: None,
+            api_key: Some("google_adc_marker".to_string().into()), // Marker to indicate ADC usage
+        }))
+    }
+
+    async fn complete(
+        &self,
+        context_response: AuthContextResponse,
+    ) -> anyhow::Result<AuthCredential> {
+        match context_response {
+            AuthContextResponse::ApiKey(ctx) => {
+                // Validate that gcloud auth is properly configured before completing
+                // authentication This ensures the user has run 'gcloud auth
+                // application-default login'
+                use google_cloud_auth::credentials::Builder;
+                let credentials = Builder::default()
+                    .build_access_token_credentials()
+                    .map_err(|e| {
+                        AuthError::CompletionFailed(format!(
+                            "Google ADC not configured: {e}. Please run 'gcloud auth application-default login' to set up credentials."
+                        ))
+                    })?;
+
+                // Try to fetch a token to verify authentication works
+                credentials
+                    .access_token()
+                    .await
+                    .map_err(|e| {
+                        AuthError::CompletionFailed(format!(
+                            "{e}. Please run 'gcloud auth application-default login' to set up credentials."
+                        ))
+                    })?;
+
+                // For Google ADC, we save a marker instead of the actual token
+                // The token will be refreshed on every use
+                // But we still need to save the url_params (PROJECT_ID, LOCATION)
+                Ok(AuthCredential::new_api_key(
+                    self.provider_id.clone(),
+                    ApiKey::from("google_adc_marker".to_string()), /* Marker that will trigger
+                                                                    * refresh */
+                )
+                .url_params(ctx.response.url_params))
+            }
+            _ => Err(AuthError::InvalidContext("Expected ApiKey context".to_string()).into()),
+        }
+    }
+
+    async fn refresh(&self, _credential: &AuthCredential) -> anyhow::Result<AuthCredential> {
+        // Google ADC handles token refresh automatically
+        // We just need to get a fresh token using the Builder API
+        let credentials = Builder::default()
+            .build_access_token_credentials()
+            .map_err(|e| {
+                AuthError::RefreshFailed(format!(
+                    "Failed to create Google credentials builder: {e}"
+                ))
+            })?;
+
+        let access_token = credentials.access_token().await.map_err(|e| {
+            AuthError::RefreshFailed(format!("Failed to refresh Google access token: {e}"))
+        })?;
+
+        Ok(AuthCredential::new_api_key(
+            self.provider_id.clone(),
+            ApiKey::from(access_token.token),
+        ))
+    }
+}
+
 /// Refresh OAuth credential - handles all OAuth flows
 async fn refresh_oauth_credential(
     credential: &AuthCredential,
@@ -590,6 +684,7 @@ pub enum AnyAuthStrategy {
     OAuthCodeGithub(OAuthCodeStrategy<GithubHttpProvider>),
     OAuthDevice(OAuthDeviceStrategy),
     OAuthWithApiKey(OAuthWithApiKeyStrategy),
+    GoogleAdc(GoogleAdcStrategy),
 }
 
 #[async_trait::async_trait]
@@ -602,6 +697,7 @@ impl AuthStrategy for AnyAuthStrategy {
             Self::OAuthCodeGithub(s) => s.init().await,
             Self::OAuthDevice(s) => s.init().await,
             Self::OAuthWithApiKey(s) => s.init().await,
+            Self::GoogleAdc(s) => s.init().await,
         }
     }
 
@@ -616,6 +712,7 @@ impl AuthStrategy for AnyAuthStrategy {
             Self::OAuthCodeGithub(s) => s.complete(context_response).await,
             Self::OAuthDevice(s) => s.complete(context_response).await,
             Self::OAuthWithApiKey(s) => s.complete(context_response).await,
+            Self::GoogleAdc(s) => s.complete(context_response).await,
         }
     }
 
@@ -627,6 +724,7 @@ impl AuthStrategy for AnyAuthStrategy {
             Self::OAuthCodeGithub(s) => s.refresh(credential).await,
             Self::OAuthDevice(s) => s.refresh(credential).await,
             Self::OAuthWithApiKey(s) => s.refresh(credential).await,
+            Self::GoogleAdc(s) => s.refresh(credential).await,
         }
     }
 }
@@ -696,6 +794,9 @@ impl StrategyFactory for ForgeAuthStrategyFactory {
                     )))
                 }
             }
+            forge_domain::AuthMethod::GoogleAdc => Ok(AnyAuthStrategy::GoogleAdc(
+                GoogleAdcStrategy::new(provider_id, required_params),
+            )),
         }
     }
 }

crates/forge_infra/src/auth/strategy.rs

@@ -2018,21 +2018,35 @@ impl<A: API + ConsoleWriter + 'static, F: Fn() -> A + Send + Sync> UI<A, F> {
             })
             .collect::<anyhow::Result<HashMap<_, _>>>()?;
 
-        let input = if let Some(default_key) = &request.api_key {
-            // ApiKey's Display shows masked version, AsRef<str> gives actual value
-            ForgeSelect::input(format!("Enter your {provider_id} API key:"))
-                .with_default(default_key)
+        // Check if API key is already provided
+        // For Google ADC, we use a marker to skip prompting
+        // For other providers, we use the existing key as a default value (autofill)
+        let api_key_str = if let Some(default_key) = &request.api_key {
+            let key_str = default_key.as_ref();
+
+            // Skip prompting only for Google ADC marker
+            if key_str == "google_adc_marker" {
+                key_str.to_string()
+            } else {
+                // For other providers, show the existing key as default (autofill)
+                let input = ForgeSelect::input(format!("Enter your {provider_id} API key:"))
+                    .with_default(key_str);
+                let api_key = input.prompt()?.context("API key input cancelled")?;
+                let api_key_str = api_key.trim();
+                anyhow::ensure!(!api_key_str.is_empty(), "API key cannot be empty");
+                api_key_str.to_string()
+            }
         } else {
-            ForgeSelect::input(format!("Enter your {provider_id} API key:"))
+            // Prompt for API key input (no existing key)
+            let input = ForgeSelect::input(format!("Enter your {provider_id} API key:"));
+            let api_key = input.prompt()?.context("API key input cancelled")?;
+            let api_key_str = api_key.trim();
+            anyhow::ensure!(!api_key_str.is_empty(), "API key cannot be empty");
+            api_key_str.to_string()
         };
 
-        let api_key_str = input.prompt()?.context("API key input cancelled")?;
-
-        let api_key_str = api_key_str.trim();
-        anyhow::ensure!(!api_key_str.is_empty(), "API key cannot be empty");
-
         // Update the context with collected data
-        let response = AuthContextResponse::api_key(request.clone(), api_key_str, url_params);
+        let response = AuthContextResponse::api_key(request.clone(), &api_key_str, url_params);
 
         self.api
             .complete_provider_auth(
@@ -2231,6 +2245,7 @@ impl<A: API + ConsoleWriter + 'static, F: Fn() -> A + Send + Sync> UI<A, F> {
                 AuthMethod::ApiKey => "API Key".to_string(),
                 AuthMethod::OAuthDevice(_) => "OAuth Device Flow".to_string(),
                 AuthMethod::OAuthCode(_) => "OAuth Authorization Code".to_string(),
+                AuthMethod::GoogleAdc => "Google Application Default Credentials (ADC)".to_string(),
             })
             .collect();
 

crates/forge_main/src/ui.rs

@@ -45,6 +45,7 @@ derive_more.workspace = true
 gray_matter = { workspace = true }
 dirs.workspace = true
 async-openai.workspace = true
+google-cloud-auth.workspace = true
 
 # gRPC for codebase client
 tonic.workspace = true

crates/forge_repo/Cargo.toml

@@ -66,6 +66,7 @@ impl<H: HttpInfra> OpenAIProvider<H> {
                         });
                     }
                 }
+                forge_domain::AuthMethod::GoogleAdc => {}
             });
         headers
     }

crates/forge_repo/src/provider/openai.rs

@@ -72,6 +72,7 @@ impl<H: HttpInfra> OpenAIResponsesProvider<H> {
                         });
                     }
                 }
+                forge_domain::AuthMethod::GoogleAdc => {}
             });
         headers
     }

crates/forge_repo/src/provider/openai_responses/repository.rs

@@ -426,7 +426,7 @@
     "response_type": "OpenAI",
     "url": "{{#if (eq LOCATION \"global\")}}https://aiplatform.googleapis.com/v1/projects/{{PROJECT_ID}}/locations/{{LOCATION}}/endpoints/openapi/chat/completions{{else}}https://{{LOCATION}}-aiplatform.googleapis.com/v1/projects/{{PROJECT_ID}}/locations/{{LOCATION}}/endpoints/openapi/chat/completions{{/if}}",
     "models": "{{#if (eq LOCATION \"global\")}}https://aiplatform.googleapis.com/v1/projects/{{PROJECT_ID}}/locations/{{LOCATION}}/endpoints/openapi/models{{else}}https://{{LOCATION}}-aiplatform.googleapis.com/v1/projects/{{PROJECT_ID}}/locations/{{LOCATION}}/endpoints/openapi/models{{/if}}",
-    "auth_methods": ["api_key"]
+    "auth_methods": ["google_adc"]
   },
   {
     "id": "azure",