fix: Improved empty credential case on GCE machine (#42)
Seth Troisi committed
Jun 3, 2026 at 21:42 UTC
4e2863ac6117b1af47f91a19bd84447b424b7ae1
1 file changed
+28
src/colab_cli/auth.py
+28
@@ -20,6 +20,7 @@ import warnings
20
from typing import Optional
21
22
import google.auth
23
+import typer
24
from google.auth.transport import requests
25
from google.auth.transport.requests import Request
26
from google.oauth2.credentials import Credentials
@@ -137,6 +138,33 @@ def _get_adc_credentials() -> Credentials:
138
category=UserWarning,
139
)
140
creds, _ = google.auth.default(scopes=list(PUBLIC_SCOPES))
141
+
142
+ if not creds.valid:
143
+ from google.auth import compute_engine
144
+
145
+ if isinstance(creds, compute_engine.Credentials):
146
+ creds = None
147
+ else:
148
+ logger.warning("Failed to obtain valid ADC credentials.")
149
+ try:
150
+ logger.warning("Trying to refresh ADC credentials")
151
+ creds.refresh(Request())
152
+ except Exception as e:
153
+ logger.warning(f"Failed to refresh token: {e}")
154
+ creds = None
155
+
156
+ if not creds:
157
+ typer.echo(
158
+ "No valid default credentials found. To authenticate, run:\n\n"
159
+ " gcloud auth application-default login \\\n"
160
+ " --scopes=openid,"
161
+ "https://www.googleapis.com/auth/cloud-platform,"
162
+ "https://www.googleapis.com/auth/userinfo.email,"
163
+ "https://www.googleapis.com/auth/colaboratory\n",
164
+ err=True,
165
+ )
166
+ exit(1)
167
+
168
# Some credential subclasses ignore the `scopes=` kwarg in `default()`
169
# (e.g. user creds), so re-apply via `with_scopes` when supported.
170
if getattr(creds, "requires_scopes", False):