From fba6ef0f11cc4a4b387afe55d90560a2eadbdbd2 Mon Sep 17 00:00:00 2001 From: Wes Tarle Date: Mon, 15 Jun 2026 12:44:41 +0000 Subject: [PATCH] test(auth): Assert multiple scopes are space-separated in JWT claim This commit adds a test to verify that when a Service Account is configured with multiple scopes during Self-Signed JWT authentication, the scopes are correctly serialized into a single space-separated string within the JWT's 'scope' claim. This brings the Java library's test suite into alignment with the expected auth specification. Other Google Cloud client libraries like Go, Node.js, and Python natively assert that multiple scopes are appropriately space-separated during their JWT generation tests. --- .../auth/oauth2/ServiceAccountCredentialsTest.java | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/ServiceAccountCredentialsTest.java b/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/ServiceAccountCredentialsTest.java index ed26a0af3c6f..57ab82a55347 100644 --- a/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/ServiceAccountCredentialsTest.java +++ b/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/ServiceAccountCredentialsTest.java @@ -1762,6 +1762,17 @@ void createScopes_existingAccessTokenInvalidated() throws IOException { assertNull(newAccessToken); } + @Test + void getRequestMetadata_withMultipleScopes_selfSignedJWT() throws IOException { + List scopes = Arrays.asList("scope1", "scope2"); + ServiceAccountCredentials credentials = + createDefaultBuilderWithKey(OAuth2Utils.privateKeyFromPkcs8(PRIVATE_KEY_PKCS8)) + .setScopes(scopes) + .setUseJwtAccessWithScope(true) + .build(); + verifyJwtAccess(credentials.getRequestMetadata(CALL_URI), "scope1 scope2"); + } + private void verifyJwtAccess(Map> metadata, String expectedScopeClaim) throws IOException { assertNotNull(metadata);