fix: Invalidate the SA's AccessToken when createScoped() is called (#1489)

* fix: Invalidate the SA's AccessToken when createScoped() is called * chore: Add comments for invalidating the access token * chore: Fix formatting * chore: Address PR comments

Author: lqiu96

oauth2_http/java/com/google/auth/oauth2/ServiceAccountCredentials.java

@@ -684,14 +684,17 @@ public GoogleCredentials createScoped(Collection<String> newScopes) {
  }
 
  /**
- * Clones the service account with the specified scopes.
+ * Clones the service account with the specified scopes. The Access Token is invalidated even if
+ * the same scopes are provided. Access Tokens contain information of the internal values (i.e.
+ * scope). If an internal value (scope) is modified, then the existing Access Token is no longer
+ * valid and should not be re-used.
  *
  * <p>Should be called before use for instances with empty scopes.
  */
  @Override
  public GoogleCredentials createScoped(
  Collection<String> newScopes, Collection<String> newDefaultScopes) {
- return this.toBuilder().setScopes(newScopes, newDefaultScopes).build();
+ return this.toBuilder().setScopes(newScopes, newDefaultScopes).setAccessToken(null).build();
  }
 
  /**

oauth2_http/javatests/com/google/auth/oauth2/ServiceAccountCredentialsTest.java

@@ -1705,6 +1705,31 @@ public void onFailure(Throwable exception) {
  assertTrue("Should have run onSuccess() callback", success.get());
  }
 
+ @Test
+ public void createScopes_existingAccessTokenInvalidated() throws IOException {
+ PrivateKey privateKey = OAuth2Utils.privateKeyFromPkcs8(PRIVATE_KEY_PKCS8);
+ MockTokenServerTransportFactory transportFactory = new MockTokenServerTransportFactory();
+ transportFactory.transport.addServiceAccount(CLIENT_EMAIL, ACCESS_TOKEN);
+ GoogleCredentials credentials =
+ ServiceAccountCredentials.newBuilder()
+ .setClientId(CLIENT_ID)
+ .setClientEmail(CLIENT_EMAIL)
+ .setPrivateKey(privateKey)
+ .setPrivateKeyId(PRIVATE_KEY_ID)
+ .setProjectId(PROJECT_ID)
+ .setQuotaProjectId("my-quota-project-id")
+ .setHttpTransportFactory(transportFactory)
+ .setScopes(SCOPES)
+ .build();
+ TestUtils.assertContainsBearerToken(credentials.getRequestMetadata(CALL_URI), ACCESS_TOKEN);
+
+ // Calling createScoped() again will invalidate the existing access token and calling
+ // `refresh()` is required to get a new Access Token.
+ credentials = credentials.createScoped("RANDOM_SCOPES");
+ AccessToken newAccessToken = credentials.getAccessToken();
+ assertNull(newAccessToken);
+ }
+
  private void verifyJwtAccess(Map<String, List<String>> metadata, String expectedScopeClaim)
  throws IOException {
  assertNotNull(metadata);