Suppress google-auth's spurious quota-project UserWarning under ADC (#8)
`google.auth._default` emits a UserWarning whenever ADC user credentials load without a quota project pinned ("Your application has authenticated using end user credentials from Google Cloud SDK without a quota project. You might receive a 'quota exceeded' or 'API not enabled' error."). The heuristic does not apply to this CLI: every call to `colab.pa.googleapis.com` carries `X-Goog-User-Project: 1014160490159` (Colab's own project id), so the user's quota-project setting is irrelevant. The warning was visible on every single `colab` invocation under ADC. Wrap just the `google.auth.default(...)` call in `warnings.catch_warnings()` and filter the one specific message text. Tightly scoped so any genuinely-new warning from `google.auth` still surfaces. Two regression tests verify (a) the noisy warning is suppressed and (b) unrelated warnings from the same call site are NOT suppressed.
Tyler committed
May 12, 2026 at 13:25 UTC
fa9f7836f38528d19bc107764e6c4a2519de9888
2 files changed
+98
-1
src/colab_cli/auth.py
+21
-1
@@ -16,6 +16,7 @@ import enum
16
import json
17
import logging
18
import os
19
+import warnings
20
from typing import Optional
21
22
import google.auth
@@ -116,7 +117,26 @@ def _get_adc_credentials() -> Credentials:
117
(`openid` and `cloud-platform` are required by `gcloud` itself; `userinfo.email`
118
is required by the session backend; `colaboratory` is required by this RPC).
119
"""
119
- creds, _ = google.auth.default(scopes=list(PUBLIC_SCOPES))
120
+ # `google.auth._default` emits a UserWarning when ADC user credentials
121
+ # don't have a quota project pinned ("Your application has authenticated
122
+ # using end user credentials from Google Cloud SDK without a quota
123
+ # project. You might receive a 'quota exceeded' or 'API not enabled'
124
+ # error.").
125
+ #
126
+ # That heuristic does not apply to this CLI: every call we make to
127
+ # `colab.pa.googleapis.com` carries `X-Goog-User-Project: 1014160490159`
128
+ # (Colab's project id) — see AGENTS.md item 18 — so the user's
129
+ # quota-project setting is irrelevant. The warning shows up on every
130
+ # single `colab` invocation under ADC, which is pure noise. Filter it,
131
+ # but keep the scope as tight as possible: only this exact message,
132
+ # only during this one call.
133
+ with warnings.catch_warnings():
134
+ warnings.filterwarnings(
135
+ "ignore",
136
+ message=r"Your application has authenticated using end user credentials.*",
137
+ category=UserWarning,
138
+ )
139
+ creds, _ = google.auth.default(scopes=list(PUBLIC_SCOPES))
140
# Some credential subclasses ignore the `scopes=` kwarg in `default()`
141
# (e.g. user creds), so re-apply via `with_scopes` when supported.
142
if getattr(creds, "requires_scopes", False):
tests/test_auth_adc.py
+77
@@ -125,3 +125,80 @@ def test_get_credentials_adc_tolerates_with_scopes_failure(mocker):
125
126
# Falls back to using the original (un-rescoped) creds.
127
mock_session_cls.assert_called_once_with(mock_creds)
128
+
129
+
130
+def test_get_credentials_adc_suppresses_quota_project_warning(mocker, recwarn):
131
+ """`google-auth` emits a UserWarning ("Your application has authenticated
132
+ using end user credentials from Google Cloud SDK without a quota project.
133
+ You might receive a 'quota exceeded' or 'API not enabled' error.") whenever
134
+ ADC user credentials lack a quota project.
135
+
136
+ For this CLI the warning is strictly false: we send
137
+ `X-Goog-User-Project: 1014160490159` (Colab's project) ourselves
138
+ (AGENTS.md item 18), so google-auth's heuristic does not apply. Suppress
139
+ it locally around the `google.auth.default()` call so it never reaches
140
+ the user's terminal on every `colab` invocation.
141
+ """
142
+ import warnings
143
+
144
+ mock_creds = MagicMock()
145
+ mock_creds.requires_scopes = False
146
+
147
+ # Simulate google-auth emitting the noisy warning during default(), as
148
+ # google.auth._default does for `_CLOUD_SDK_CREDENTIALS_WARNING`.
149
+ def fake_default(*args, **kwargs):
150
+ warnings.warn(
151
+ "Your application has authenticated using end user credentials "
152
+ "from Google Cloud SDK without a quota project. You might receive "
153
+ 'a "quota exceeded" or "API not enabled" error. See the following '
154
+ "page for troubleshooting: "
155
+ "https://cloud.google.com/docs/authentication/adc-troubleshooting/user-creds. ",
156
+ UserWarning,
157
+ )
158
+ return mock_creds, "proj"
159
+
160
+ mocker.patch("google.auth.default", side_effect=fake_default)
161
+ mocker.patch("colab_cli.auth.requests.AuthorizedSession")
162
+
163
+ get_credentials(provider=AuthProvider.ADC)
164
+
165
+ # The quota-project warning must be filtered out; nothing else.
166
+ matching = [
167
+ w
168
+ for w in recwarn.list
169
+ if issubclass(w.category, UserWarning)
170
+ and "without a quota project" in str(w.message)
171
+ ]
172
+ assert matching == [], (
173
+ "Expected the quota-project UserWarning to be suppressed, but it "
174
+ f"was visible: {[str(w.message) for w in matching]}"
175
+ )
176
+
177
+
178
+def test_get_credentials_adc_does_not_suppress_unrelated_warnings(mocker, recwarn):
179
+ """Suppression must be tightly scoped to the quota-project warning text
180
+ so that any future genuinely-relevant `google.auth` warning still
181
+ surfaces to the user."""
182
+ import warnings
183
+
184
+ mock_creds = MagicMock()
185
+ mock_creds.requires_scopes = False
186
+
187
+ def fake_default(*args, **kwargs):
188
+ warnings.warn("some genuinely concerning new warning", UserWarning)
189
+ return mock_creds, "proj"
190
+
191
+ mocker.patch("google.auth.default", side_effect=fake_default)
192
+ mocker.patch("colab_cli.auth.requests.AuthorizedSession")
193
+
194
+ get_credentials(provider=AuthProvider.ADC)
195
+
196
+ matching = [
197
+ w
198
+ for w in recwarn.list
199
+ if issubclass(w.category, UserWarning)
200
+ and "genuinely concerning" in str(w.message)
201
+ ]
202
+ assert len(matching) == 1, (
203
+ "Unrelated UserWarnings from google.auth must NOT be suppressed."
204
+ )