[YauheniPo]

The Console hands the OAuth client over as a downloadable document, so users paste it into the gws auth setup prompts. save_client_config stored those strings verbatim, producing a client_secret.json whose client_id and client_secret each contained the whole document; every later login then failed with 401 invalid_client.

This extracts the pair when a pasted value parses as a Console document (installed or web scope) and keeps plain values exactly as given. Reported in #947.

What changed

• crates/google-workspace-cli/src/oauth_config.rs — extract_client_credentials pulls client_id / client_secret out of a pasted document; save_client_config applies it to both prompts. Input that is not a Console document is stored unchanged, so credentials pasted in plain form behave exactly as before.
• .changeset/auth-setup-pasted-client-json.md — patch changeset.

No new command is added, so --dry-run output does not apply here.

Testing

• cargo test — 796 passed, 0 failed (82 + 714 across the two crate suites).
• New unit tests cover: installed document, web document, non-document input left untouched, save_client_config expanding a pasted document, save_client_config keeping plain credentials.
• cargo fmt --all --check — clean.
• cargo clippy --workspace -- -D warnings — the two lints it reports predate this PR and live in files it does not touch: src/auth.rs:140 (must_use without a message) and src/helpers/script.rs:173 (collapsible if inside match), both with rustc 1.99.1. This PR introduces no clippy diagnostics in oauth_config.rs.

Checklist

• My code follows the AGENTS.md guidelines (no generated google-* crates).
• I have run cargo fmt --all to format the code perfectly.
• I have run cargo clippy -- -D warnings and resolved all warnings (only the two pre-existing lints above remain, in untouched files).
• I have added tests that prove my fix is effective or that my feature works.
• I have provided a Changeset file to document my changes.

[changeset-bot]

🦋 Changeset detected

Latest commit: 1187bda

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@googleworkspace/cli	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[googleworkspace-bot]

/gemini review

[YauheniPo]

Friendly ping for a maintainer look when someone has a moment.

State of this PR: CLA signed, changeset included, cargo test green locally (796 passed), branch sits on top of the current main (a3768d0), and no files outside oauth_config.rs are touched. The workflow runs for this PR are still action_required, so CI, Coverage, Policy and Release have not reported yet — they need a maintainer to approve the runs for a fork PR.

What it fixes (#947): the Cloud Console hands the OAuth client over as a downloadable client_secret.json, and users paste that document into the gws auth setup prompts. save_client_config stored the pasted strings verbatim, so both client_id and client_secret ended up containing the whole JSON document and every subsequent login failed with 401 invalid_client. The PR extracts the pair when the value parses as an installed or web document and leaves plain values untouched, so existing setups behave exactly as before.

Happy to change the approach if you would rather validate at read time instead of write time, or to add a migration for already-saved broken files.

[YauheniPo]

Hi @jpoehnelt!
Please help with this PR