[quirogas]

Description

Add runtime deprecation and validation warnings for unvalidated credential loading methods.

Impact

Warns users about unvalidated credentials without emitting warnings during ADC flows.

Changes

• Add runtime console.warn messages in GoogleAuth.constructor (keyFilename/keyFile and credentials), GoogleAuth.fromJSON, GoogleAuth.fromStream, ExternalAccountClient.fromJSON, and Impersonated.constructor.
• Update keyFilename deprecation warning to recommend using the auth object constructor.
• Add @internal warning suppression helpers (suppressAdcWarning and suppressFromJsonWarning) in src/util.ts so Application Default Credentials (_getApplicationCredentialsFromFilePath) never emit warnings for any credential type, and internal fromJSON calls (_cacheClientFromJSON and fromImpersonatedJSON) do not emit duplicate fromJSON warnings while preserving this.fromJSON in the call chain.
• Ensure setGapicJWTValues uses nullish coalescing assignment (??=) and syncs GAPIC JWT properties on cached JWT instances in getClient().

Testing

• Added unit tests in test/test.externalclient.ts, test/test.impersonated.ts, and test/test.googleauth.ts covering all 6 warning messages.
• Added unit tests verifying zero warnings are emitted across all credential types when loaded via ADC (_getApplicationCredentialsFromFilePath), including concurrent non-ADC calls while an ADC stream is reading.
• Added unit test verifying setGapicJWTValues syncs on cached JWT credentials when getClient() is called after getProjectId().

Alternatives

• Not adding runtime warnings leaves users unaware of the security risks of loading unvalidated external credential configurations.
• Extracting private _fromJSONInternal / _fromStreamInternalAsync methods without ADC suppression (as in google-auth-library-nodejs#2176) still emitted warnings during ADC for external_account and impersonated_service_account credentials and bypassed this.fromJSON spies/overrides.

[gemini-code-assist]

Code Review

This pull request introduces deprecation and validation warnings for several credential configuration methods and constructors (such as 'fromJSON', 'fromStream', and 'Impersonated'), along with mechanisms to suppress these warnings during internal operations like Application Default Credentials (ADC) loading. It also ensures GAPIC JWT values are synchronized on cached credentials and adds comprehensive unit tests. The review feedback suggests improving the tests by using 'sinon.stub' instead of 'sinon.spy' on 'console.warn' to prevent expected warning messages from cluttering the test execution logs.

[gemini-code-assist]

Using sinon.spy on console.warn allows the warning messages to be printed to the console during test execution, which can clutter the test output and make CI/CD logs noisy. Consider using sandbox.stub instead to silence the expected warnings while still allowing assertions on them.

Suggested change

	beforeEach(() => {
	sandbox = sinon.createSandbox();
	auth = new GoogleAuth();
	warnSpy = sandbox.spy(console, 'warn');
	});
	beforeEach(() => {
	sandbox = sinon.createSandbox();
	auth = new GoogleAuth();
	warnSpy = sandbox.stub(console, 'warn');
	});

[gemini-code-assist]

Using sinon.spy on console.warn allows the warning messages to be printed to the console during test execution, which can clutter the test output and make CI/CD logs noisy. Consider using sinon.stub instead to silence the expected warnings while still allowing assertions on them.

Suggested change

	it('should log a warning when called directly', () => {
	const warnSpy = sinon.spy(console, 'warn');
	try {
	it('should log a warning when called directly', () => {
	const warnSpy = sinon.stub(console, 'warn');
	try {

[gemini-code-assist]

Using sinon.spy on console.warn allows the warning messages to be printed to the console during test execution, which can clutter the test output and make CI/CD logs noisy. Consider using sinon.stub instead to silence the expected warnings while still allowing assertions on them.

Suggested change

	it('should log a warning when instantiated directly', () => {
	const sourceClient = createSampleJWTClient();
	const warnSpy = sinon.spy(console, 'warn');
	try {
	it('should log a warning when instantiated directly', () => {
	const sourceClient = createSampleJWTClient();
	const warnSpy = sinon.stub(console, 'warn');
	try {