fix: don't use oauth client project_id as quota project

[Vijeth-Rai]

Fixes #729.

Problem

get_quota_project() returns the project_id from client_secret.json, which is then sent as x-goog-user-project on every API request. Google only honors that header if the authenticated end user holds serviceusage.services.use on that project, so any user who is not an IAM member of the project gets:

403 Caller does not have required permission to use project <project>.
Grant the caller the roles/serviceusage.serviceUsageConsumer role, or a custom
role with the serviceusage.services.use permission

This affects every command. It is invisible to the project owner (who has the permission implicitly) and breaks every other user, including anyone distributing an OAuth client to end users.

Repro

1. gws auth setup / gws auth login with an OAuth client from project P.
2. Authenticate as a user who is not an IAM member of P.
3. gws drive files list --params '{"pageSize":1}' → 403 as above.

Verified against a live account before/after with the same credentials and command — only the binary differs.

Fix

Drop client_secret.json's project_id as a quota-project source. Workspace APIs already attribute quota via the OAuth client ID, so the header is unnecessary for end-user OAuth credentials.

Both legitimate sources are kept:

• GOOGLE_WORKSPACE_PROJECT_ID — explicit opt-in, any credential type
• ADC quota_project_id — service accounts / ADC, where the header is genuinely required

Compatibility

This is a behavior change for anyone whose end users do hold serviceUsageConsumer and who relies on quota being billed to the client-secret project. They can restore the old behavior by setting GOOGLE_WORKSPACE_PROJECT_ID. I filed it as a patch changeset as a bug fix, but happy to relabel if you'd prefer minor.

Tests

• test_get_quota_project_priority_config → test_get_quota_project_ignores_client_config, now asserts None
• added test_get_quota_project_env_var_overrides_client_config

Both pass. Note: test_get_quota_project_reads_adc and test_get_quota_project_priority_adc_fallback fail on Windows both before and after this change — the tests set HOME, but dirs::home_dir() reads USERPROFILE on Windows, so the temp ADC file is never found. Unrelated to this patch; happy to open a separate issue.

[changeset-bot]

🦋 Changeset detected

Latest commit: 7fbd29a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@googleworkspace/cli	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses an issue where the CLI incorrectly used the OAuth client's project ID as the quota project for API requests. By removing this behavior, the CLI avoids unnecessary 403 errors for users who are not IAM members of the client project, as quota for end-user OAuth credentials is already handled via the OAuth client ID. Explicit overrides via environment variables remain supported.

Highlights

• Quota Project Resolution: Removed the automatic use of the OAuth client's project_id as the quota project, which was causing 403 errors for users lacking specific IAM permissions.
• Test Updates: Updated existing tests to reflect the change in quota project resolution and added a new test case to verify that environment variables correctly override client configurations.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Generative AI Prohibited Use Policy, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[gemini-code-assist]

Code Review

This pull request stops using the project_id from the OAuth client configuration (client_secret.json) as the quota project, which previously caused 403 errors for users without specific IAM permissions. Instead, quota attribution for end-user OAuth credentials will rely on the OAuth client ID. Feedback on the changes suggests setting GOOGLE_APPLICATION_CREDENTIALS to a non-existent path in tests rather than removing it, preventing flaky test failures on Windows where the host's actual ADC file might otherwise be read.

[googleworkspace-bot]

/gemini review

[gemini-code-assist]

Code Review

This pull request removes the use of the OAuth client's project_id as the quota project when making API requests, preventing 403 errors for users who are not IAM members of that project. The get_quota_project function in auth.rs has been updated to bypass the client configuration and prioritize the GOOGLE_WORKSPACE_PROJECT_ID environment variable and Application Default Credentials (ADC) instead. Corresponding unit tests have been updated to reflect this change. There are no review comments, and I have no additional feedback to provide.