chore: import upstream snapshot with attribution

tests/unittests/integrations/bigquery/test_bigquery_credentials.py

@@ -0,0 +1,189 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from unittest import mock
+
+from google.adk.integrations.bigquery import BigQueryCredentialsConfig
+# Mock the Google OAuth and API dependencies
+import google.auth.credentials
+import google.oauth2.credentials
+import pytest
+
+
+class TestBigQueryCredentials:
+  """Test suite for BigQueryCredentials configuration validation.
+
+  This class tests the credential configuration logic that ensures
+  either existing credentials or client ID/secret pairs are provided.
+  """
+
+  def test_valid_credentials_object_auth_credentials(self):
+    """Test that providing valid Credentials object works correctly with
+    google.auth.credentials.Credentials.
+
+    When a user already has valid OAuth credentials, they should be able
+    to pass them directly without needing to provide client ID/secret.
+    """
+    # Create a mock auth credentials object
+    auth_creds = mock.create_autospec(
+        google.auth.credentials.Credentials, instance=True
+    )
+
+    config = BigQueryCredentialsConfig(credentials=auth_creds)
+
+    # Verify that the credentials are properly stored and attributes are extracted
+    assert config.credentials == auth_creds
+    assert config.client_secret is None
+    assert config.scopes == [
+        "https://www.googleapis.com/auth/bigquery",
+        "https://www.googleapis.com/auth/dataplex.read-write",
+    ]
+
+  def test_valid_credentials_object_oauth2_credentials(self):
+    """Test that providing valid Credentials object works correctly with
+    google.oauth2.credentials.Credentials.
+
+    When a user already has valid OAuth credentials, they should be able
+    to pass them directly without needing to provide client ID/secret.
+    """
+    # Create a mock oauth2 credentials object
+    oauth2_creds = google.oauth2.credentials.Credentials(
+        "test_token",
+        client_id="test_client_id",
+        client_secret="test_client_secret",
+        scopes=["https://www.googleapis.com/auth/calendar"],
+    )
+
+    config = BigQueryCredentialsConfig(credentials=oauth2_creds)
+
+    # Verify that the credentials are properly stored and attributes are extracted
+    assert config.credentials == oauth2_creds
+    assert config.client_id == "test_client_id"
+    assert config.client_secret == "test_client_secret"
+    assert config.scopes == ["https://www.googleapis.com/auth/calendar"]
+
+  def test_valid_client_id_secret_pair_default_scope(self):
+    """Test that providing client ID and secret with default scope works.
+
+    This tests the scenario where users want to create new OAuth credentials
+    from scratch using their application's client ID and secret and does not
+    specify the scopes explicitly.
+    """
+    config = BigQueryCredentialsConfig(
+        client_id="test_client_id",
+        client_secret="test_client_secret",
+    )
+
+    assert config.credentials is None
+    assert config.client_id == "test_client_id"
+    assert config.client_secret == "test_client_secret"
+    assert config.scopes == [
+        "https://www.googleapis.com/auth/bigquery",
+        "https://www.googleapis.com/auth/dataplex.read-write",
+    ]
+
+  def test_valid_client_id_secret_pair_w_scope(self):
+    """Test that providing client ID and secret with explicit scopes works.
+
+    This tests the scenario where users want to create new OAuth credentials
+    from scratch using their application's client ID and secret and does specify
+    the scopes explicitly.
+    """
+    config = BigQueryCredentialsConfig(
+        client_id="test_client_id",
+        client_secret="test_client_secret",
+        scopes=[
+            "https://www.googleapis.com/auth/bigquery",
+            "https://www.googleapis.com/auth/drive",
+        ],
+    )
+
+    assert config.credentials is None
+    assert config.client_id == "test_client_id"
+    assert config.client_secret == "test_client_secret"
+    assert config.scopes == [
+        "https://www.googleapis.com/auth/bigquery",
+        "https://www.googleapis.com/auth/drive",
+    ]
+
+  def test_valid_client_id_secret_pair_w_empty_scope(self):
+    """Test that providing client ID and secret with empty scope works.
+
+    This tests the corner case scenario where users want to create new OAuth
+    credentials from scratch using their application's client ID and secret but
+    specifies empty scope, in which case the default BQ scope is used.
+    """
+    config = BigQueryCredentialsConfig(
+        client_id="test_client_id",
+        client_secret="test_client_secret",
+        scopes=[],
+    )
+
+    assert config.credentials is None
+    assert config.client_id == "test_client_id"
+    assert config.client_secret == "test_client_secret"
+    assert config.scopes == [
+        "https://www.googleapis.com/auth/bigquery",
+        "https://www.googleapis.com/auth/dataplex.read-write",
+    ]
+
+  def test_missing_client_secret_raises_error(self):
+    """Test that missing client secret raises appropriate validation error.
+
+    This ensures that incomplete OAuth configuration is caught early
+    rather than failing during runtime.
+    """
+    with pytest.raises(
+        ValueError,
+        match=(
+            "Must provide one of credentials, external_access_token_key, or"
+            " client_id and client_secret pair"
+        ),
+    ):
+      BigQueryCredentialsConfig(client_id="test_client_id")
+
+  def test_missing_client_id_raises_error(self):
+    """Test that missing client ID raises appropriate validation error."""
+    with pytest.raises(
+        ValueError,
+        match=(
+            "Must provide one of credentials, external_access_token_key, or"
+            " client_id and client_secret pair"
+        ),
+    ):
+      BigQueryCredentialsConfig(client_secret="test_client_secret")
+
+  def test_empty_configuration_raises_error(self):
+    """Test that completely empty configuration is rejected.
+
+    Users must provide either existing credentials or the components
+    needed to create new ones.
+    """
+    with pytest.raises(
+        ValueError,
+        match=(
+            "Must provide one of credentials, external_access_token_key, or"
+            " client_id and client_secret pair"
+        ),
+    ):
+      BigQueryCredentialsConfig()
+
+  def test_invalid_property_raises_error(self):
+    """Test BigQueryCredentialsConfig raises exception when setting invalid property."""
+    with pytest.raises(ValueError):
+      BigQueryCredentialsConfig(
+          client_id="test_client_id",
+          client_secret="test_client_secret",
+          non_existent_field="some value",
+      )