fix(gapic-generator): forward quota_project_id, scopes, credentials_file and mTLS in REST transport

packages/gapic-generator/gapic/templates/%namespace/%name_%version/%sub/services/%service/transports/base.py.j2

@@ -146,6 +146,16 @@ class {{ service.name }}Transport(abc.ABC):
             # Don't apply audience if the credentials file passed from user.
             if hasattr(credentials, "with_gdch_audience"):
                 credentials = credentials.with_gdch_audience(api_audience if api_audience else host)
+        else:
+            credentials = ga_credentials.with_scopes_if_required(
+                credentials,
+                scopes=scopes,
+                default_scopes=self.AUTH_SCOPES,
+            )
+            if quota_project_id and isinstance(
+                credentials, ga_credentials.CredentialsWithQuotaProject
+            ):
+                credentials = credentials.with_quota_project(quota_project_id)
 
         # If the credentials are service account credentials, then always try to use self signed JWT.
         if always_use_jwt_access and isinstance(credentials, service_account.Credentials) and hasattr(service_account.Credentials, "with_always_use_jwt_access"):

packages/gapic-generator/gapic/templates/%namespace/%name_%version/%sub/services/%service/transports/rest.py.j2

@@ -155,19 +155,20 @@ class {{service.name}}RestTransport(_Base{{ service.name }}RestTransport):
                 custom OpenTelemetry tracer providers.
         """
         # Run the base constructor
-        # TODO(yon-mg): resolve other ctor params i.e. scopes, quota, etc.
-        # TODO: When custom host (api_endpoint) is set, `scopes` must *also* be set on the
-        # credentials object
         super().__init__(
             host=host,
             credentials=credentials,
+            credentials_file=credentials_file,
+            scopes=scopes,
+            quota_project_id=quota_project_id,
             client_info=client_info,
             always_use_jwt_access=always_use_jwt_access,
             url_scheme=url_scheme,
             api_audience=api_audience,
             client_options=client_options,
             **kwargs,
         )
+        self._client_cert_source_for_mtls = client_cert_source_for_mtls
         self._session = AuthorizedSession(
             self._credentials, default_host=self.DEFAULT_HOST)
         {% if service.has_lro %}
@@ -212,6 +213,7 @@ class {{service.name}}RestTransport(_Base{{ service.name }}RestTransport):
                     # use the credentials which are saved
                     credentials=self._credentials,
                     scopes=self._scopes,
+                    client_cert_source_for_mtls=self._client_cert_source_for_mtls,
                     http_options=http_options,
                     path_prefix="{{ service.client_package_version }}")
 

packages/gapic-generator/gapic/templates/%namespace/%name_%version/%sub/services/%service/transports/rest_base.py.j2

@@ -57,6 +57,9 @@ class _Base{{ service.name }}RestTransport({{service.name}}Transport):
     def __init__(self, *,
             host: str{% if service.host %} = '{{ service.host }}'{% endif %},
             credentials: Optional[Any] = None,
+            credentials_file: Optional[str] = None,
+            scopes: Optional[Sequence[str]] = None,
+            quota_project_id: Optional[str] = None,
             client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO,
             always_use_jwt_access: Optional[bool] = False,
             url_scheme: str = 'https',
@@ -104,6 +107,9 @@ class _Base{{ service.name }}RestTransport({{service.name}}Transport):
         super().__init__(
             host=host,
             credentials=credentials,
+            credentials_file=credentials_file,
+            scopes=scopes,
+            quota_project_id=quota_project_id,
             client_info=client_info,
             always_use_jwt_access=always_use_jwt_access,
             api_audience=api_audience,

packages/gapic-generator/gapic/templates/tests/unit/gapic/%name_%version/%sub/test_%service.py.j2

@@ -1432,6 +1432,18 @@ def test_{{ service.name|snake_case }}_base_transport_with_adc():
         adc.assert_called_once()
 
 
+def test_{{ service.name|snake_case }}_base_transport_with_credentials():
+    # Test the explicit credentials are scoped and assigned quota_project_id if provided.
+    creds = service_account.Credentials(None, None, None)
+    transport = transports.{{ service.name }}Transport(
+        credentials=creds,
+        quota_project_id="octopus",
+        scopes=["1", "2"],
+    )
+    assert transport._credentials.quota_project_id == "octopus"
+    assert transport._credentials.scopes == ["1", "2"]
+
+
 def test_{{ service.name|snake_case }}_auth_adc():
     # If no credentials are provided, we should use ADC credentials.
     with mock.patch.object(google.auth, 'default', autospec=True) as adc:
@@ -1447,14 +1459,31 @@ def test_{{ service.name|snake_case }}_auth_adc():
         )
 
 
-{% if 'grpc' in opts.transport %}
+{% if 'grpc' in opts.transport and 'rest' in opts.transport %}
+@pytest.mark.parametrize(
+    "transport_class",
+    [
+        transports.{{ service.name }}GrpcTransport,
+        transports.{{ service.name }}GrpcAsyncIOTransport,
+        transports.{{ service.name }}RestTransport,
+    ],
+)
+{% elif 'grpc' in opts.transport %}
 @pytest.mark.parametrize(
     "transport_class",
     [
         transports.{{ service.name }}GrpcTransport,
         transports.{{ service.name }}GrpcAsyncIOTransport,
     ],
 )
+{% elif 'rest' in opts.transport %}
+@pytest.mark.parametrize(
+    "transport_class",
+    [
+        transports.{{ service.name }}RestTransport,
+    ],
+)
+{% endif %}
 def test_{{ service.name|snake_case }}_transport_auth_adc(transport_class):
     # If credentials and host are not provided, the transport class should use
     # ADC credentials.
@@ -1511,6 +1540,7 @@ def test_{{ service.name|snake_case }}_transport_auth_gdch_credentials(transport
             )
 
 
+{% if 'grpc' in opts.transport %}
 @pytest.mark.parametrize(
     "transport_class,grpc_helpers",
     [

packages/gapic-generator/tests/integration/goldens/asset/google/cloud/asset_v1/services/asset_service/transports/base.py

@@ -120,6 +120,16 @@ def __init__(
             # Don't apply audience if the credentials file passed from user.
             if hasattr(credentials, "with_gdch_audience"):
                 credentials = credentials.with_gdch_audience(api_audience if api_audience else host)
+        else:
+            credentials = ga_credentials.with_scopes_if_required(
+                credentials,
+                scopes=scopes,
+                default_scopes=self.AUTH_SCOPES,
+            )
+            if quota_project_id and isinstance(
+                credentials, ga_credentials.CredentialsWithQuotaProject
+            ):
+                credentials = credentials.with_quota_project(quota_project_id)
 
         # If the credentials are service account credentials, then always try to use self signed JWT.
         if always_use_jwt_access and isinstance(credentials, service_account.Credentials) and hasattr(service_account.Credentials, "with_always_use_jwt_access"):

packages/gapic-generator/tests/integration/goldens/asset/google/cloud/asset_v1/services/asset_service/transports/rest.py

@@ -1139,19 +1139,20 @@ def __init__(self, *,
                 custom OpenTelemetry tracer providers.
         """
         # Run the base constructor
-        # TODO(yon-mg): resolve other ctor params i.e. scopes, quota, etc.
-        # TODO: When custom host (api_endpoint) is set, `scopes` must *also* be set on the
-        # credentials object
         super().__init__(
             host=host,
             credentials=credentials,
+            credentials_file=credentials_file,
+            scopes=scopes,
+            quota_project_id=quota_project_id,
             client_info=client_info,
             always_use_jwt_access=always_use_jwt_access,
             url_scheme=url_scheme,
             api_audience=api_audience,
             client_options=client_options,
             **kwargs,
         )
+        self._client_cert_source_for_mtls = client_cert_source_for_mtls
         self._session = AuthorizedSession(
             self._credentials, default_host=self.DEFAULT_HOST)
         self._operations_client: Optional[operations_v1.AbstractOperationsClient] = None
@@ -1183,6 +1184,7 @@ def operations_client(self) -> operations_v1.AbstractOperationsClient:
                     # use the credentials which are saved
                     credentials=self._credentials,
                     scopes=self._scopes,
+                    client_cert_source_for_mtls=self._client_cert_source_for_mtls,
                     http_options=http_options,
                     path_prefix="v1")
 

packages/gapic-generator/tests/integration/goldens/asset/google/cloud/asset_v1/services/asset_service/transports/rest_base.py

@@ -46,6 +46,9 @@ class _BaseAssetServiceRestTransport(AssetServiceTransport):
     def __init__(self, *,
             host: str = 'cloudasset.googleapis.com',
             credentials: Optional[Any] = None,
+            credentials_file: Optional[str] = None,
+            scopes: Optional[Sequence[str]] = None,
+            quota_project_id: Optional[str] = None,
             client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO,
             always_use_jwt_access: Optional[bool] = False,
             url_scheme: str = 'https',
@@ -88,6 +91,9 @@ def __init__(self, *,
         super().__init__(
             host=host,
             credentials=credentials,
+            credentials_file=credentials_file,
+            scopes=scopes,
+            quota_project_id=quota_project_id,
             client_info=client_info,
             always_use_jwt_access=always_use_jwt_access,
             api_audience=api_audience,

packages/gapic-generator/tests/integration/goldens/asset/tests/unit/gapic/asset_v1/test_asset_service.py

@@ -17520,6 +17520,18 @@ def test_asset_service_base_transport_with_adc():
         adc.assert_called_once()
 
 
+def test_asset_service_base_transport_with_credentials():
+    # Test the explicit credentials are scoped and assigned quota_project_id if provided.
+    creds = service_account.Credentials(None, None, None)
+    transport = transports.AssetServiceTransport(
+        credentials=creds,
+        quota_project_id="octopus",
+        scopes=["1", "2"],
+    )
+    assert transport._credentials.quota_project_id == "octopus"
+    assert transport._credentials.scopes == ["1", "2"]
+
+
 def test_asset_service_auth_adc():
     # If no credentials are provided, we should use ADC credentials.
     with mock.patch.object(google.auth, 'default', autospec=True) as adc:
@@ -17539,6 +17551,7 @@ def test_asset_service_auth_adc():
     [
         transports.AssetServiceGrpcTransport,
         transports.AssetServiceGrpcAsyncIOTransport,
+        transports.AssetServiceRestTransport,
     ],
 )
 def test_asset_service_transport_auth_adc(transport_class):

packages/gapic-generator/tests/integration/goldens/credentials/google/iam/credentials_v1/services/iam_credentials/transports/base.py

@@ -117,6 +117,16 @@ def __init__(
             # Don't apply audience if the credentials file passed from user.
             if hasattr(credentials, "with_gdch_audience"):
                 credentials = credentials.with_gdch_audience(api_audience if api_audience else host)
+        else:
+            credentials = ga_credentials.with_scopes_if_required(
+                credentials,
+                scopes=scopes,
+                default_scopes=self.AUTH_SCOPES,
+            )
+            if quota_project_id and isinstance(
+                credentials, ga_credentials.CredentialsWithQuotaProject
+            ):
+                credentials = credentials.with_quota_project(quota_project_id)
 
         # If the credentials are service account credentials, then always try to use self signed JWT.
         if always_use_jwt_access and isinstance(credentials, service_account.Credentials) and hasattr(service_account.Credentials, "with_always_use_jwt_access"):

packages/gapic-generator/tests/integration/goldens/credentials/google/iam/credentials_v1/services/iam_credentials/transports/rest.py

@@ -352,19 +352,20 @@ def __init__(self, *,
                 custom OpenTelemetry tracer providers.
         """
         # Run the base constructor
-        # TODO(yon-mg): resolve other ctor params i.e. scopes, quota, etc.
-        # TODO: When custom host (api_endpoint) is set, `scopes` must *also* be set on the
-        # credentials object
         super().__init__(
             host=host,
             credentials=credentials,
+            credentials_file=credentials_file,
+            scopes=scopes,
+            quota_project_id=quota_project_id,
             client_info=client_info,
             always_use_jwt_access=always_use_jwt_access,
             url_scheme=url_scheme,
             api_audience=api_audience,
             client_options=client_options,
             **kwargs,
         )
+        self._client_cert_source_for_mtls = client_cert_source_for_mtls
         self._session = AuthorizedSession(
             self._credentials, default_host=self.DEFAULT_HOST)
         if client_cert_source_for_mtls:

packages/gapic-generator/tests/integration/goldens/credentials/google/iam/credentials_v1/services/iam_credentials/transports/rest_base.py

@@ -44,6 +44,9 @@ class _BaseIAMCredentialsRestTransport(IAMCredentialsTransport):
     def __init__(self, *,
             host: str = 'iamcredentials.googleapis.com',
             credentials: Optional[Any] = None,
+            credentials_file: Optional[str] = None,
+            scopes: Optional[Sequence[str]] = None,
+            quota_project_id: Optional[str] = None,
             client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO,
             always_use_jwt_access: Optional[bool] = False,
             url_scheme: str = 'https',
@@ -86,6 +89,9 @@ def __init__(self, *,
         super().__init__(
             host=host,
             credentials=credentials,
+            credentials_file=credentials_file,
+            scopes=scopes,
+            quota_project_id=quota_project_id,
             client_info=client_info,
             always_use_jwt_access=always_use_jwt_access,
             api_audience=api_audience,

packages/gapic-generator/tests/integration/goldens/credentials/tests/unit/gapic/credentials_v1/test_iam_credentials.py

@@ -3934,6 +3934,18 @@ def test_iam_credentials_base_transport_with_adc():
         adc.assert_called_once()
 
 
+def test_iam_credentials_base_transport_with_credentials():
+    # Test the explicit credentials are scoped and assigned quota_project_id if provided.
+    creds = service_account.Credentials(None, None, None)
+    transport = transports.IAMCredentialsTransport(
+        credentials=creds,
+        quota_project_id="octopus",
+        scopes=["1", "2"],
+    )
+    assert transport._credentials.quota_project_id == "octopus"
+    assert transport._credentials.scopes == ["1", "2"]
+
+
 def test_iam_credentials_auth_adc():
     # If no credentials are provided, we should use ADC credentials.
     with mock.patch.object(google.auth, 'default', autospec=True) as adc:
@@ -3953,6 +3965,7 @@ def test_iam_credentials_auth_adc():
     [
         transports.IAMCredentialsGrpcTransport,
         transports.IAMCredentialsGrpcAsyncIOTransport,
+        transports.IAMCredentialsRestTransport,
     ],
 )
 def test_iam_credentials_transport_auth_adc(transport_class):

packages/gapic-generator/tests/integration/goldens/eventarc/google/cloud/eventarc_v1/services/eventarc/transports/base.py

@@ -132,6 +132,16 @@ def __init__(
             # Don't apply audience if the credentials file passed from user.
             if hasattr(credentials, "with_gdch_audience"):
                 credentials = credentials.with_gdch_audience(api_audience if api_audience else host)
+        else:
+            credentials = ga_credentials.with_scopes_if_required(
+                credentials,
+                scopes=scopes,
+                default_scopes=self.AUTH_SCOPES,
+            )
+            if quota_project_id and isinstance(
+                credentials, ga_credentials.CredentialsWithQuotaProject
+            ):
+                credentials = credentials.with_quota_project(quota_project_id)
 
         # If the credentials are service account credentials, then always try to use self signed JWT.
         if always_use_jwt_access and isinstance(credentials, service_account.Credentials) and hasattr(service_account.Credentials, "with_always_use_jwt_access"):

packages/gapic-generator/tests/integration/goldens/eventarc/google/cloud/eventarc_v1/services/eventarc/transports/rest.py

@@ -2089,19 +2089,20 @@ def __init__(self, *,
                 custom OpenTelemetry tracer providers.
         """
         # Run the base constructor
-        # TODO(yon-mg): resolve other ctor params i.e. scopes, quota, etc.
-        # TODO: When custom host (api_endpoint) is set, `scopes` must *also* be set on the
-        # credentials object
         super().__init__(
             host=host,
             credentials=credentials,
+            credentials_file=credentials_file,
+            scopes=scopes,
+            quota_project_id=quota_project_id,
             client_info=client_info,
             always_use_jwt_access=always_use_jwt_access,
             url_scheme=url_scheme,
             api_audience=api_audience,
             client_options=client_options,
             **kwargs,
         )
+        self._client_cert_source_for_mtls = client_cert_source_for_mtls
         self._session = AuthorizedSession(
             self._credentials, default_host=self.DEFAULT_HOST)
         self._operations_client: Optional[operations_v1.AbstractOperationsClient] = None
@@ -2152,6 +2153,7 @@ def operations_client(self) -> operations_v1.AbstractOperationsClient:
                     # use the credentials which are saved
                     credentials=self._credentials,
                     scopes=self._scopes,
+                    client_cert_source_for_mtls=self._client_cert_source_for_mtls,
                     http_options=http_options,
                     path_prefix="v1")
 

packages/gapic-generator/tests/integration/goldens/eventarc/google/cloud/eventarc_v1/services/eventarc/transports/rest_base.py

@@ -58,6 +58,9 @@ class _BaseEventarcRestTransport(EventarcTransport):
     def __init__(self, *,
             host: str = 'eventarc.googleapis.com',
             credentials: Optional[Any] = None,
+            credentials_file: Optional[str] = None,
+            scopes: Optional[Sequence[str]] = None,
+            quota_project_id: Optional[str] = None,
             client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO,
             always_use_jwt_access: Optional[bool] = False,
             url_scheme: str = 'https',
@@ -100,6 +103,9 @@ def __init__(self, *,
         super().__init__(
             host=host,
             credentials=credentials,
+            credentials_file=credentials_file,
+            scopes=scopes,
+            quota_project_id=quota_project_id,
             client_info=client_info,
             always_use_jwt_access=always_use_jwt_access,
             api_audience=api_audience,