fix(workflow): omit the oauth client secret from the credential request event

Co-authored-by: George Weale <gweale@google.com>
PiperOrigin-RevId: 974138172

Author: GWeale

src/google/adk/workflow/utils/_workflow_hitl_utils.py

@@ -163,6 +163,27 @@ def _build_auth_message(auth_config: AuthConfig) -> str:
   return 'Please provide your authentication credentials.'
 
 
+def _without_client_secret(auth_config: AuthConfig) -> AuthConfig:
+  """Returns a copy of the auth config with the OAuth client secret removed.
+
+  The auth request is handed to the caller, which needs the authorization uri
+  and the state to complete the flow but never the developer's client secret.
+  The secret stays on this side and is supplied again when the response comes
+  back.
+
+  Args:
+    auth_config: The auth configuration for the node.
+  """
+  without_secret = auth_config.model_copy(deep=True)
+  for credential in (
+      without_secret.raw_auth_credential,
+      without_secret.exchanged_auth_credential,
+  ):
+    if credential and credential.oauth2:
+      credential.oauth2.client_secret = None
+  return without_secret
+
+
 def create_auth_request_event(
     auth_config: AuthConfig,
     interrupt_id: str,
@@ -190,7 +211,7 @@ def create_auth_request_event(
     state[_oauth_state_key(interrupt_id)] = generated_credential.oauth2.state
   args = AuthToolArguments(
       function_call_id=interrupt_id,
-      auth_config=auth_request,
+      auth_config=_without_client_secret(auth_request),
   ).model_dump(mode='json', exclude_none=True, by_alias=True)
 
   # Add message so the UI / CLI knows what to display.
@@ -291,6 +312,23 @@ async def process_auth_resume(
 
   resumed_config = auth_config.model_copy(deep=True)
   resumed_config.exchanged_auth_credential = exchanged_credential
+
+  # The client secret is never handed out with the request, so the response
+  # cannot carry it back; the node's own credential supplies it for the token
+  # exchange.
+  raw_oauth2 = (
+      resumed_config.raw_auth_credential.oauth2
+      if resumed_config.raw_auth_credential
+      else None
+  )
+  exchanged_oauth2 = (
+      resumed_config.exchanged_auth_credential.oauth2
+      if resumed_config.exchanged_auth_credential
+      else None
+  )
+  if raw_oauth2 and raw_oauth2.client_secret and exchanged_oauth2:
+    exchanged_oauth2.client_secret = raw_oauth2.client_secret
+
   await AuthHandler(auth_config=resumed_config).parse_and_store_auth_response(
       state=state
   )

tests/unittests/workflow/utils/test_workflow_hitl_utils.py

@@ -218,6 +218,18 @@ def test_args_are_json_serializable(self):
     json.dumps(fc.args)
     assert fc.args["authConfig"]["authScheme"]["type"] == "oauth2"
 
+  def test_client_secret_is_not_handed_to_the_caller(self):
+    """The caller gets what completes the flow; the secret stays behind."""
+    auth_config = _oauth_auth_config()
+    event = create_auth_request_event(auth_config, "auth-id-1", _empty_state())
+
+    fc = event.content.parts[0].function_call
+    oauth2 = fc.args["authConfig"]["exchangedAuthCredential"]["oauth2"]
+    assert oauth2["authUri"]
+    assert oauth2["state"]
+    assert oauth2["clientId"] == "client-id"
+    assert "client-secret" not in json.dumps(fc.args)
+
 
 # --- process_auth_resume / has_auth_credential ---
 
@@ -363,7 +375,6 @@ def _oauth_resume_response(auth_config, state_value: str):
       auth_type=AuthCredentialTypes.OAUTH2,
       oauth2=OAuth2Auth(
           client_id="client-id",
-          client_secret="client-secret",
           state=state_value,
           auth_code="authorization-code",
       ),
@@ -381,17 +392,20 @@ class TestProcessAuthResumeOAuth:
 
   @pytest.fixture(autouse=True)
   def _no_network_exchange(self, monkeypatch):
-    """Records the auth scheme each exchange runs against, without network."""
+    """Records what each exchange runs against, without network."""
     from google.adk.auth import auth_handler as auth_handler_module
     from google.adk.auth.exchanger.base_credential_exchanger import ExchangeResult
 
     self.exchanged_schemes = []
-    recorded = self.exchanged_schemes
+    self.exchanged_credentials = []
+    recorded_schemes = self.exchanged_schemes
+    recorded_credentials = self.exchanged_credentials
 
     class _RecordingExchanger:
 
       async def exchange(self, auth_credential, auth_scheme=None):
-        recorded.append(auth_scheme)
+        recorded_schemes.append(auth_scheme)
+        recorded_credentials.append(auth_credential)
         return ExchangeResult(auth_credential, True)
 
     monkeypatch.setattr(
@@ -433,6 +447,23 @@ async def test_existence_check_does_not_exchange(self):
     assert has_auth_credential(auth_config, state) is True
     assert len(self.exchanged_schemes) == exchanges_so_far
 
+  @pytest.mark.asyncio
+  async def test_exchange_uses_the_client_secret_from_the_node(self):
+    """The response has no secret to echo, so the node's config supplies it."""
+    auth_config = _oauth_auth_config()
+    state = _empty_state()
+    event = create_auth_request_event(auth_config, "auth-id-1", state)
+
+    await process_auth_resume(
+        _oauth_resume_response(auth_config, _requested_state(event)),
+        auth_config,
+        state,
+        "auth-id-1",
+    )
+
+    assert len(self.exchanged_credentials) == 1
+    assert self.exchanged_credentials[0].oauth2.client_secret == "client-secret"
+
   @pytest.mark.asyncio
   async def test_response_with_another_state_is_rejected(self):
     """A response that does not echo the generated state is not exchanged."""