Merge https://github.com/google/adk-python/pull/5371
**Please ensure you have read the [contribution guide](https://github.com/google/adk-python/blob/main/CONTRIBUTING.md) before creating a pull request.**
### Link to Issue or Description of Change
**1. Link to an existing issue (if applicable):**
- Closes: #5370
**2. Or, if no issue exists, describe the change:**
**Problem:**
Both `SecretManagerClient` and `ParameterManagerClient` advertise an `auth_token` constructor path, but the implementation instantiates `google.auth.credentials.Credentials(...)` directly. That base class is abstract, so callers hit a `TypeError` before the underlying Google Cloud client is constructed.
`SecretManagerClient` also documents that `service_account_json` and `auth_token` are mutually exclusive, but the current implementation silently accepts both inputs and ignores the token.
**Solution:**
- Switch both helpers to `google.oauth2.credentials.Credentials(token=auth_token)` for the `auth_token` path.
- Keep the change narrow to the validated runtime regression and its adjacent contract mismatch.
- Replace the mocked-constructor token-path tests with regression coverage that exercises the real credentials constructor path.
- Add a `SecretManagerClient` test that confirms conflicting credential inputs raise `ValueError`.
### Testing Plan
**Unit Tests:**
- [x] I have added or updated unit tests for my change.
- [x] All unit tests pass locally.
Passed locally:
```text
.venv/bin/pytest tests/unittests/integrations/secret_manager/test_secret_client.py tests/unittests/integrations/parameter_manager/test_parameter_client.py -q
17 passed, 1 warning in 24.43s
```
**Manual End-to-End (E2E) Tests:**
I also re-ran the original local reproductions with patched cloud clients to confirm the behavior change:
```python
from unittest.mock import MagicMock, patch
from google.adk.integrations.secret_manager.secret_client import SecretManagerClient
from google.adk.integrations.parameter_manager.parameter_client import ParameterManagerClient
with patch("google.cloud.secretmanager.SecretManagerServiceClient", return_value=MagicMock()):
client = SecretManagerClient(auth_token="test-token")
assert client._credentials.token == "test-token"
with patch("google.cloud.parametermanager_v1.ParameterManagerClient", return_value=MagicMock()):
client = ParameterManagerClient(auth_token="test-token")
assert client._credentials.token == "test-token"
```
And for the conflicting-input case:
```python
import json
from google.adk.integrations.secret_manager.secret_client import SecretManagerClient
try:
SecretManagerClient(
service_account_json=json.dumps({"type": "service_account"}),
auth_token="test-token",
)
except ValueError:
pass
else:
raise AssertionError("Expected conflicting credentials to raise ValueError")
```
### Checklist
- [x] I have read the [CONTRIBUTING.md](https://github.com/google/adk-python/blob/main/CONTRIBUTING.md) document.
- [x] I have performed a self-review of my own code.
- [x] I have commented my code, particularly in hard-to-understand areas.
- [x] I have added tests that prove my fix is effective or that my feature works.
- [x] New and existing unit tests pass locally with my changes.
- [x] I have manually tested my changes end-to-end.
- [x] Any dependent changes have been merged and published in downstream modules.
### Additional context
I intentionally kept this PR focused on the reproducible auth helper regressions that are still present in the latest stable release and current `main`.
Co-authored-by: Haran Rajkumar <haranrk@google.com>
COPYBARA_INTEGRATE_REVIEW=https://github.com/google/adk-python/pull/5371 from shaun0927:fix/token-credentials-for-integrations 3567a25cdb7fa8367c4299a8e7f72ba3ac8e6b9b
PiperOrigin-RevId: 939989046
Junghwan
46a2181761