We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Password prompt opened by `google.auth.default()` when credentials have expired
When you have a reauthentication policy set in Google Cloud and your crendentials have expired, calling `google.auth.default()` will open a `Please enter your password:` password prompt, instead if raising a `DefaultCredentialsError` as I believe would be expected.

The password prompt interrupts the flow of the program, with no way to catch or handle it actively.

If credentials are _revoked_ (instead of expired), you don't get the password prompt, and instead get an exception as expected.

For example, when creating a `bigquery.Client`, its `__init__` calls `super(Client, self).__init__()` which in turn calls `google.auth.default()`, which in turn [calls the external program `gcloud config config-helper --format json` in a `subprocess`](https://github.com/googleapis/google-auth-library-python/blob/main/google/auth/_cloud_sdk.py#L108), which finally opens the prompt.

Full traceback after starting it with `python -m pdb ...` and hitting Ctrl-C from when the prompt is open:

```
Traceback (most recent call last):
  ".../code_under_test.py", line 90, in _bqclient
    client = bigquery.Client(
  File ".../.venv/lib/python3.10/site-packages/google/cloud/bigquery/client.py", line 244, in __init__
    super(Client, self).__init__(
  File ".../.venv/lib/python3.10/site-packages/google/cloud/client/__init__.py", line 321, in __init__
    Client.__init__(
  File ".../.venv/lib/python3.10/site-packages/google/cloud/client/__init__.py", line 178, in __init__
    credentials, _ = google.auth.default(scopes=scopes)
  File ".../.venv/lib/python3.10/site-packages/google/auth/_default.py", line 620, in default
    credentials, project_id = checker()
  File ".../.venv/lib/python3.10/site-packages/google/auth/_default.py", line 614, in <lambda>
    lambda: _get_gcloud_sdk_credentials(quota_project_id=quota_project_id),
  File ".../.venv/lib/python3.10/site-packages/google/auth/_default.py", line 205, in _get_gcloud_sdk_credentials
    project_id = _cloud_sdk.get_project_id()
  File ".../.venv/lib/python3.10/site-packages/google/auth/_cloud_sdk.py", line 108, in get_project_id
    output = _run_subprocess_ignore_stderr((command,) + _CLOUD_SDK_CONFIG_COMMAND)
  File ".../.venv/lib/python3.10/site-packages/google/auth/_cloud_sdk.py", line 90, in _run_subprocess_ignore_stderr
    output = subprocess.check_output(command, stderr=devnull)
  ...
```

#### Environment details

  - OS: macOS 13.2.1
  - Python version: 3.10.8
  - pip version: 23.0.1
  - `google-auth` version: 2.16.1

#### Steps to reproduce

  1. Set a [Reauthentication policy](https://admin.google.com/ac/security/reauth/admin-tools) in Google Cloud.
  2. Authenticate using `gcloud auth login --update-adc`.
  3. Let your access token expire.
  4. Now, `python -c "import google.auth; google.auth.default()"` will prompt you with `Please enter your password:`.

If instead of letting your token expire, you actively revoke it with `gcloud auth application-default revoke` and `gcloud auth revoke`, then you get the following exception raised:

```
Traceback (most recent call last):
  File "<string>", line 1, in <module>
  File ".../.venv/lib/python3.10/site-packages/google/auth/_default.py", line 653, in default
    raise exceptions.DefaultCredentialsError(_HELP_MESSAGE)
google.auth.exceptions.DefaultCredentialsError: Could not automatically determine credentials. Please set GOOGLE_APPLICATION_CREDENTIALS or explicitly create credentials and re-run the application. For more information, please see https://cloud.google.com/docs/authentication/getting-started
```

Also, for some reason the password prompt is **not** opened if you capture `stdin` like `subprocess.check_output(["gcloud", "config", "config-helper", "--format", "json"], stdin=subprocess.PIPE)`. This has the interesting effect that if you run code in `pytest`(that captures `stdin`), you don't get the password prompt, but if you run it with `pytest -s` you do.


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `google/auth/_cloud_sdk.py`
Content:
```
1 # Copyright 2015 Google Inc.
2 #
3 # Licensed under the Apache License, Version 2.0 (the "License");
4 # you may not use this file except in compliance with the License.
5 # You may obtain a copy of the License at
6 #
7 #      http://www.apache.org/licenses/LICENSE-2.0
8 #
9 # Unless required by applicable law or agreed to in writing, software
10 # distributed under the License is distributed on an "AS IS" BASIS,
11 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 # See the License for the specific language governing permissions and
13 # limitations under the License.
14 
15 """Helpers for reading the Google Cloud SDK's configuration."""
16 
17 import json
18 import os
19 import subprocess
20 
21 import six
22 
23 from google.auth import environment_vars
24 from google.auth import exceptions
25 
26 
27 # The ~/.config subdirectory containing gcloud credentials.
28 _CONFIG_DIRECTORY = "gcloud"
29 # Windows systems store config at %APPDATA%\gcloud
30 _WINDOWS_CONFIG_ROOT_ENV_VAR = "APPDATA"
31 # The name of the file in the Cloud SDK config that contains default
32 # credentials.
33 _CREDENTIALS_FILENAME = "application_default_credentials.json"
34 # The name of the Cloud SDK shell script
35 _CLOUD_SDK_POSIX_COMMAND = "gcloud"
36 _CLOUD_SDK_WINDOWS_COMMAND = "gcloud.cmd"
37 # The command to get the Cloud SDK configuration
38 _CLOUD_SDK_CONFIG_COMMAND = ("config", "config-helper", "--format", "json")
39 # The command to get google user access token
40 _CLOUD_SDK_USER_ACCESS_TOKEN_COMMAND = ("auth", "print-access-token")
41 # Cloud SDK's application-default client ID
42 CLOUD_SDK_CLIENT_ID = (
43     "764086051850-6qr4p6gpi6hn506pt8ejuq83di341hur.apps.googleusercontent.com"
44 )
45 
46 
47 def get_config_path():
48     """Returns the absolute path the the Cloud SDK's configuration directory.
49 
50     Returns:
51         str: The Cloud SDK config path.
52     """
53     # If the path is explicitly set, return that.
54     try:
55         return os.environ[environment_vars.CLOUD_SDK_CONFIG_DIR]
56     except KeyError:
57         pass
58 
59     # Non-windows systems store this at ~/.config/gcloud
60     if os.name != "nt":
61         return os.path.join(os.path.expanduser("~"), ".config", _CONFIG_DIRECTORY)
62     # Windows systems store config at %APPDATA%\gcloud
63     else:
64         try:
65             return os.path.join(
66                 os.environ[_WINDOWS_CONFIG_ROOT_ENV_VAR], _CONFIG_DIRECTORY
67             )
68         except KeyError:
69             # This should never happen unless someone is really
70             # messing with things, but we'll cover the case anyway.
71             drive = os.environ.get("SystemDrive", "C:")
72             return os.path.join(drive, "\\", _CONFIG_DIRECTORY)
73 
74 
75 def get_application_default_credentials_path():
76     """Gets the path to the application default credentials file.
77 
78     The path may or may not exist.
79 
80     Returns:
81         str: The full path to application default credentials.
82     """
83     config_path = get_config_path()
84     return os.path.join(config_path, _CREDENTIALS_FILENAME)
85 
86 
87 def _run_subprocess_ignore_stderr(command):
88     """ Return subprocess.check_output with the given command and ignores stderr."""
89     with open(os.devnull, "w") as devnull:
90         output = subprocess.check_output(command, stderr=devnull)
91     return output
92 
93 
94 def get_project_id():
95     """Gets the project ID from the Cloud SDK.
96 
97     Returns:
98         Optional[str]: The project ID.
99     """
100     if os.name == "nt":
101         command = _CLOUD_SDK_WINDOWS_COMMAND
102     else:
103         command = _CLOUD_SDK_POSIX_COMMAND
104 
105     try:
106         # Ignore the stderr coming from gcloud, so it won't be mixed into the output.
107         # https://github.com/googleapis/google-auth-library-python/issues/673
108         output = _run_subprocess_ignore_stderr((command,) + _CLOUD_SDK_CONFIG_COMMAND)
109     except (subprocess.CalledProcessError, OSError, IOError):
110         return None
111 
112     try:
113         configuration = json.loads(output.decode("utf-8"))
114     except ValueError:
115         return None
116 
117     try:
118         return configuration["configuration"]["properties"]["core"]["project"]
119     except KeyError:
120         return None
121 
122 
123 def get_auth_access_token(account=None):
124     """Load user access token with the ``gcloud auth print-access-token`` command.
125 
126     Args:
127         account (Optional[str]): Account to get the access token for. If not
128             specified, the current active account will be used.
129 
130     Returns:
131         str: The user access token.
132 
133     Raises:
134         google.auth.exceptions.UserAccessTokenError: if failed to get access
135             token from gcloud.
136     """
137     if os.name == "nt":
138         command = _CLOUD_SDK_WINDOWS_COMMAND
139     else:
140         command = _CLOUD_SDK_POSIX_COMMAND
141 
142     try:
143         if account:
144             command = (
145                 (command,)
146                 + _CLOUD_SDK_USER_ACCESS_TOKEN_COMMAND
147                 + ("--account=" + account,)
148             )
149         else:
150             command = (command,) + _CLOUD_SDK_USER_ACCESS_TOKEN_COMMAND
151 
152         access_token = subprocess.check_output(command, stderr=subprocess.STDOUT)
153         # remove the trailing "\n"
154         return access_token.decode("utf-8").strip()
155     except (subprocess.CalledProcessError, OSError, IOError) as caught_exc:
156         new_exc = exceptions.UserAccessTokenError(
157             "Failed to obtain access token", caught_exc
158         )
159         six.raise_from(new_exc, caught_exc)
160
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/google/auth/_cloud_sdk.py b/google/auth/_cloud_sdk.py
--- a/google/auth/_cloud_sdk.py
+++ b/google/auth/_cloud_sdk.py
@@ -14,12 +14,12 @@
 
 """Helpers for reading the Google Cloud SDK's configuration."""
 
-import json
 import os
 import subprocess
 
 import six
 
+from google.auth import _helpers
 from google.auth import environment_vars
 from google.auth import exceptions
 
@@ -35,7 +35,7 @@
 _CLOUD_SDK_POSIX_COMMAND = "gcloud"
 _CLOUD_SDK_WINDOWS_COMMAND = "gcloud.cmd"
 # The command to get the Cloud SDK configuration
-_CLOUD_SDK_CONFIG_COMMAND = ("config", "config-helper", "--format", "json")
+_CLOUD_SDK_CONFIG_GET_PROJECT_COMMAND = ("config", "get", "project")
 # The command to get google user access token
 _CLOUD_SDK_USER_ACCESS_TOKEN_COMMAND = ("auth", "print-access-token")
 # Cloud SDK's application-default client ID
@@ -105,18 +105,14 @@
     try:
         # Ignore the stderr coming from gcloud, so it won't be mixed into the output.
         # https://github.com/googleapis/google-auth-library-python/issues/673
-        output = _run_subprocess_ignore_stderr((command,) + _CLOUD_SDK_CONFIG_COMMAND)
-    except (subprocess.CalledProcessError, OSError, IOError):
-        return None
-
-    try:
-        configuration = json.loads(output.decode("utf-8"))
-    except ValueError:
-        return None
+        project = _run_subprocess_ignore_stderr(
+            (command,) + _CLOUD_SDK_CONFIG_GET_PROJECT_COMMAND
+        )
 
-    try:
-        return configuration["configuration"]["properties"]["core"]["project"]
-    except KeyError:
+        # Turn bytes into a string and remove "\n"
+        project = _helpers.from_bytes(project).strip()
+        return project if project else None
+    except (subprocess.CalledProcessError, OSError, IOError):
         return None

{"golden_diff": "diff --git a/google/auth/_cloud_sdk.py b/google/auth/_cloud_sdk.py\n--- a/google/auth/_cloud_sdk.py\n+++ b/google/auth/_cloud_sdk.py\n@@ -14,12 +14,12 @@\n \n \"\"\"Helpers for reading the Google Cloud SDK's configuration.\"\"\"\n \n-import json\n import os\n import subprocess\n \n import six\n \n+from google.auth import _helpers\n from google.auth import environment_vars\n from google.auth import exceptions\n \n@@ -35,7 +35,7 @@\n _CLOUD_SDK_POSIX_COMMAND = \"gcloud\"\n _CLOUD_SDK_WINDOWS_COMMAND = \"gcloud.cmd\"\n # The command to get the Cloud SDK configuration\n-_CLOUD_SDK_CONFIG_COMMAND = (\"config\", \"config-helper\", \"--format\", \"json\")\n+_CLOUD_SDK_CONFIG_GET_PROJECT_COMMAND = (\"config\", \"get\", \"project\")\n # The command to get google user access token\n _CLOUD_SDK_USER_ACCESS_TOKEN_COMMAND = (\"auth\", \"print-access-token\")\n # Cloud SDK's application-default client ID\n@@ -105,18 +105,14 @@\n     try:\n         # Ignore the stderr coming from gcloud, so it won't be mixed into the output.\n         # https://github.com/googleapis/google-auth-library-python/issues/673\n-        output = _run_subprocess_ignore_stderr((command,) + _CLOUD_SDK_CONFIG_COMMAND)\n-    except (subprocess.CalledProcessError, OSError, IOError):\n-        return None\n-\n-    try:\n-        configuration = json.loads(output.decode(\"utf-8\"))\n-    except ValueError:\n-        return None\n+        project = _run_subprocess_ignore_stderr(\n+            (command,) + _CLOUD_SDK_CONFIG_GET_PROJECT_COMMAND\n+        )\n \n-    try:\n-        return configuration[\"configuration\"][\"properties\"][\"core\"][\"project\"]\n-    except KeyError:\n+        # Turn bytes into a string and remove \"\\n\"\n+        project = _helpers.from_bytes(project).strip()\n+        return project if project else None\n+    except (subprocess.CalledProcessError, OSError, IOError):\n         return None\n", "issue": "Password prompt opened by `google.auth.default()` when credentials have expired\nWhen you have a reauthentication policy set in Google Cloud and your crendentials have expired, calling `google.auth.default()` will open a `Please enter your password:` password prompt, instead if raising a `DefaultCredentialsError` as I believe would be expected.\r\n\r\nThe password prompt interrupts the flow of the program, with no way to catch or handle it actively.\r\n\r\nIf credentials are _revoked_ (instead of expired), you don't get the password prompt, and instead get an exception as expected.\r\n\r\nFor example, when creating a `bigquery.Client`, its `__init__` calls `super(Client, self).__init__()` which in turn calls `google.auth.default()`, which in turn [calls the external program `gcloud config config-helper --format json` in a `subprocess`](https://github.com/googleapis/google-auth-library-python/blob/main/google/auth/_cloud_sdk.py#L108), which finally opens the prompt.\r\n\r\nFull traceback after starting it with `python -m pdb ...` and hitting Ctrl-C from when the prompt is open:\r\n\r\n```\r\nTraceback (most recent call last):\r\n  \".../code_under_test.py\", line 90, in _bqclient\r\n    client = bigquery.Client(\r\n  File \".../.venv/lib/python3.10/site-packages/google/cloud/bigquery/client.py\", line 244, in __init__\r\n    super(Client, self).__init__(\r\n  File \".../.venv/lib/python3.10/site-packages/google/cloud/client/__init__.py\", line 321, in __init__\r\n    Client.__init__(\r\n  File \".../.venv/lib/python3.10/site-packages/google/cloud/client/__init__.py\", line 178, in __init__\r\n    credentials, _ = google.auth.default(scopes=scopes)\r\n  File \".../.venv/lib/python3.10/site-packages/google/auth/_default.py\", line 620, in default\r\n    credentials, project_id = checker()\r\n  File \".../.venv/lib/python3.10/site-packages/google/auth/_default.py\", line 614, in <lambda>\r\n    lambda: _get_gcloud_sdk_credentials(quota_project_id=quota_project_id),\r\n  File \".../.venv/lib/python3.10/site-packages/google/auth/_default.py\", line 205, in _get_gcloud_sdk_credentials\r\n    project_id = _cloud_sdk.get_project_id()\r\n  File \".../.venv/lib/python3.10/site-packages/google/auth/_cloud_sdk.py\", line 108, in get_project_id\r\n    output = _run_subprocess_ignore_stderr((command,) + _CLOUD_SDK_CONFIG_COMMAND)\r\n  File \".../.venv/lib/python3.10/site-packages/google/auth/_cloud_sdk.py\", line 90, in _run_subprocess_ignore_stderr\r\n    output = subprocess.check_output(command, stderr=devnull)\r\n  ...\r\n```\r\n\r\n#### Environment details\r\n\r\n  - OS: macOS 13.2.1\r\n  - Python version: 3.10.8\r\n  - pip version: 23.0.1\r\n  - `google-auth` version: 2.16.1\r\n\r\n#### Steps to reproduce\r\n\r\n  1. Set a [Reauthentication policy](https://admin.google.com/ac/security/reauth/admin-tools) in Google Cloud.\r\n  2. Authenticate using `gcloud auth login --update-adc`.\r\n  3. Let your access token expire.\r\n  4. Now, `python -c \"import google.auth; google.auth.default()\"` will prompt you with `Please enter your password:`.\r\n\r\nIf instead of letting your token expire, you actively revoke it with `gcloud auth application-default revoke` and `gcloud auth revoke`, then you get the following exception raised:\r\n\r\n```\r\nTraceback (most recent call last):\r\n  File \"<string>\", line 1, in <module>\r\n  File \".../.venv/lib/python3.10/site-packages/google/auth/_default.py\", line 653, in default\r\n    raise exceptions.DefaultCredentialsError(_HELP_MESSAGE)\r\ngoogle.auth.exceptions.DefaultCredentialsError: Could not automatically determine credentials. Please set GOOGLE_APPLICATION_CREDENTIALS or explicitly create credentials and re-run the application. For more information, please see https://cloud.google.com/docs/authentication/getting-started\r\n```\r\n\r\nAlso, for some reason the password prompt is **not** opened if you capture `stdin` like `subprocess.check_output([\"gcloud\", \"config\", \"config-helper\", \"--format\", \"json\"], stdin=subprocess.PIPE)`. This has the interesting effect that if you run code in `pytest`(that captures `stdin`), you don't get the password prompt, but if you run it with `pytest -s` you do.\r\n\n", "before_files": [{"content": "# Copyright 2015 Google Inc.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\");\n# you may not use this file except in compliance with the License.\n# You may obtain a copy of the License at\n#\n#      http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS,\n# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n# See the License for the specific language governing permissions and\n# limitations under the License.\n\n\"\"\"Helpers for reading the Google Cloud SDK's configuration.\"\"\"\n\nimport json\nimport os\nimport subprocess\n\nimport six\n\nfrom google.auth import environment_vars\nfrom google.auth import exceptions\n\n\n# The ~/.config subdirectory containing gcloud credentials.\n_CONFIG_DIRECTORY = \"gcloud\"\n# Windows systems store config at %APPDATA%\\gcloud\n_WINDOWS_CONFIG_ROOT_ENV_VAR = \"APPDATA\"\n# The name of the file in the Cloud SDK config that contains default\n# credentials.\n_CREDENTIALS_FILENAME = \"application_default_credentials.json\"\n# The name of the Cloud SDK shell script\n_CLOUD_SDK_POSIX_COMMAND = \"gcloud\"\n_CLOUD_SDK_WINDOWS_COMMAND = \"gcloud.cmd\"\n# The command to get the Cloud SDK configuration\n_CLOUD_SDK_CONFIG_COMMAND = (\"config\", \"config-helper\", \"--format\", \"json\")\n# The command to get google user access token\n_CLOUD_SDK_USER_ACCESS_TOKEN_COMMAND = (\"auth\", \"print-access-token\")\n# Cloud SDK's application-default client ID\nCLOUD_SDK_CLIENT_ID = (\n    \"764086051850-6qr4p6gpi6hn506pt8ejuq83di341hur.apps.googleusercontent.com\"\n)\n\n\ndef get_config_path():\n    \"\"\"Returns the absolute path the the Cloud SDK's configuration directory.\n\n    Returns:\n        str: The Cloud SDK config path.\n    \"\"\"\n    # If the path is explicitly set, return that.\n    try:\n        return os.environ[environment_vars.CLOUD_SDK_CONFIG_DIR]\n    except KeyError:\n        pass\n\n    # Non-windows systems store this at ~/.config/gcloud\n    if os.name != \"nt\":\n        return os.path.join(os.path.expanduser(\"~\"), \".config\", _CONFIG_DIRECTORY)\n    # Windows systems store config at %APPDATA%\\gcloud\n    else:\n        try:\n            return os.path.join(\n                os.environ[_WINDOWS_CONFIG_ROOT_ENV_VAR], _CONFIG_DIRECTORY\n            )\n        except KeyError:\n            # This should never happen unless someone is really\n            # messing with things, but we'll cover the case anyway.\n            drive = os.environ.get(\"SystemDrive\", \"C:\")\n            return os.path.join(drive, \"\\\\\", _CONFIG_DIRECTORY)\n\n\ndef get_application_default_credentials_path():\n    \"\"\"Gets the path to the application default credentials file.\n\n    The path may or may not exist.\n\n    Returns:\n        str: The full path to application default credentials.\n    \"\"\"\n    config_path = get_config_path()\n    return os.path.join(config_path, _CREDENTIALS_FILENAME)\n\n\ndef _run_subprocess_ignore_stderr(command):\n    \"\"\" Return subprocess.check_output with the given command and ignores stderr.\"\"\"\n    with open(os.devnull, \"w\") as devnull:\n        output = subprocess.check_output(command, stderr=devnull)\n    return output\n\n\ndef get_project_id():\n    \"\"\"Gets the project ID from the Cloud SDK.\n\n    Returns:\n        Optional[str]: The project ID.\n    \"\"\"\n    if os.name == \"nt\":\n        command = _CLOUD_SDK_WINDOWS_COMMAND\n    else:\n        command = _CLOUD_SDK_POSIX_COMMAND\n\n    try:\n        # Ignore the stderr coming from gcloud, so it won't be mixed into the output.\n        # https://github.com/googleapis/google-auth-library-python/issues/673\n        output = _run_subprocess_ignore_stderr((command,) + _CLOUD_SDK_CONFIG_COMMAND)\n    except (subprocess.CalledProcessError, OSError, IOError):\n        return None\n\n    try:\n        configuration = json.loads(output.decode(\"utf-8\"))\n    except ValueError:\n        return None\n\n    try:\n        return configuration[\"configuration\"][\"properties\"][\"core\"][\"project\"]\n    except KeyError:\n        return None\n\n\ndef get_auth_access_token(account=None):\n    \"\"\"Load user access token with the ``gcloud auth print-access-token`` command.\n\n    Args:\n        account (Optional[str]): Account to get the access token for. If not\n            specified, the current active account will be used.\n\n    Returns:\n        str: The user access token.\n\n    Raises:\n        google.auth.exceptions.UserAccessTokenError: if failed to get access\n            token from gcloud.\n    \"\"\"\n    if os.name == \"nt\":\n        command = _CLOUD_SDK_WINDOWS_COMMAND\n    else:\n        command = _CLOUD_SDK_POSIX_COMMAND\n\n    try:\n        if account:\n            command = (\n                (command,)\n                + _CLOUD_SDK_USER_ACCESS_TOKEN_COMMAND\n                + (\"--account=\" + account,)\n            )\n        else:\n            command = (command,) + _CLOUD_SDK_USER_ACCESS_TOKEN_COMMAND\n\n        access_token = subprocess.check_output(command, stderr=subprocess.STDOUT)\n        # remove the trailing \"\\n\"\n        return access_token.decode(\"utf-8\").strip()\n    except (subprocess.CalledProcessError, OSError, IOError) as caught_exc:\n        new_exc = exceptions.UserAccessTokenError(\n            \"Failed to obtain access token\", caught_exc\n        )\n        six.raise_from(new_exc, caught_exc)\n", "path": "google/auth/_cloud_sdk.py"}], "after_files": [{"content": "# Copyright 2015 Google Inc.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\");\n# you may not use this file except in compliance with the License.\n# You may obtain a copy of the License at\n#\n#      http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS,\n# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n# See the License for the specific language governing permissions and\n# limitations under the License.\n\n\"\"\"Helpers for reading the Google Cloud SDK's configuration.\"\"\"\n\nimport os\nimport subprocess\n\nimport six\n\nfrom google.auth import _helpers\nfrom google.auth import environment_vars\nfrom google.auth import exceptions\n\n\n# The ~/.config subdirectory containing gcloud credentials.\n_CONFIG_DIRECTORY = \"gcloud\"\n# Windows systems store config at %APPDATA%\\gcloud\n_WINDOWS_CONFIG_ROOT_ENV_VAR = \"APPDATA\"\n# The name of the file in the Cloud SDK config that contains default\n# credentials.\n_CREDENTIALS_FILENAME = \"application_default_credentials.json\"\n# The name of the Cloud SDK shell script\n_CLOUD_SDK_POSIX_COMMAND = \"gcloud\"\n_CLOUD_SDK_WINDOWS_COMMAND = \"gcloud.cmd\"\n# The command to get the Cloud SDK configuration\n_CLOUD_SDK_CONFIG_GET_PROJECT_COMMAND = (\"config\", \"get\", \"project\")\n# The command to get google user access token\n_CLOUD_SDK_USER_ACCESS_TOKEN_COMMAND = (\"auth\", \"print-access-token\")\n# Cloud SDK's application-default client ID\nCLOUD_SDK_CLIENT_ID = (\n    \"764086051850-6qr4p6gpi6hn506pt8ejuq83di341hur.apps.googleusercontent.com\"\n)\n\n\ndef get_config_path():\n    \"\"\"Returns the absolute path the the Cloud SDK's configuration directory.\n\n    Returns:\n        str: The Cloud SDK config path.\n    \"\"\"\n    # If the path is explicitly set, return that.\n    try:\n        return os.environ[environment_vars.CLOUD_SDK_CONFIG_DIR]\n    except KeyError:\n        pass\n\n    # Non-windows systems store this at ~/.config/gcloud\n    if os.name != \"nt\":\n        return os.path.join(os.path.expanduser(\"~\"), \".config\", _CONFIG_DIRECTORY)\n    # Windows systems store config at %APPDATA%\\gcloud\n    else:\n        try:\n            return os.path.join(\n                os.environ[_WINDOWS_CONFIG_ROOT_ENV_VAR], _CONFIG_DIRECTORY\n            )\n        except KeyError:\n            # This should never happen unless someone is really\n            # messing with things, but we'll cover the case anyway.\n            drive = os.environ.get(\"SystemDrive\", \"C:\")\n            return os.path.join(drive, \"\\\\\", _CONFIG_DIRECTORY)\n\n\ndef get_application_default_credentials_path():\n    \"\"\"Gets the path to the application default credentials file.\n\n    The path may or may not exist.\n\n    Returns:\n        str: The full path to application default credentials.\n    \"\"\"\n    config_path = get_config_path()\n    return os.path.join(config_path, _CREDENTIALS_FILENAME)\n\n\ndef _run_subprocess_ignore_stderr(command):\n    \"\"\" Return subprocess.check_output with the given command and ignores stderr.\"\"\"\n    with open(os.devnull, \"w\") as devnull:\n        output = subprocess.check_output(command, stderr=devnull)\n    return output\n\n\ndef get_project_id():\n    \"\"\"Gets the project ID from the Cloud SDK.\n\n    Returns:\n        Optional[str]: The project ID.\n    \"\"\"\n    if os.name == \"nt\":\n        command = _CLOUD_SDK_WINDOWS_COMMAND\n    else:\n        command = _CLOUD_SDK_POSIX_COMMAND\n\n    try:\n        # Ignore the stderr coming from gcloud, so it won't be mixed into the output.\n        # https://github.com/googleapis/google-auth-library-python/issues/673\n        project = _run_subprocess_ignore_stderr(\n            (command,) + _CLOUD_SDK_CONFIG_GET_PROJECT_COMMAND\n        )\n\n        # Turn bytes into a string and remove \"\\n\"\n        project = _helpers.from_bytes(project).strip()\n        return project if project else None\n    except (subprocess.CalledProcessError, OSError, IOError):\n        return None\n\n\ndef get_auth_access_token(account=None):\n    \"\"\"Load user access token with the ``gcloud auth print-access-token`` command.\n\n    Args:\n        account (Optional[str]): Account to get the access token for. If not\n            specified, the current active account will be used.\n\n    Returns:\n        str: The user access token.\n\n    Raises:\n        google.auth.exceptions.UserAccessTokenError: if failed to get access\n            token from gcloud.\n    \"\"\"\n    if os.name == \"nt\":\n        command = _CLOUD_SDK_WINDOWS_COMMAND\n    else:\n        command = _CLOUD_SDK_POSIX_COMMAND\n\n    try:\n        if account:\n            command = (\n                (command,)\n                + _CLOUD_SDK_USER_ACCESS_TOKEN_COMMAND\n                + (\"--account=\" + account,)\n            )\n        else:\n            command = (command,) + _CLOUD_SDK_USER_ACCESS_TOKEN_COMMAND\n\n        access_token = subprocess.check_output(command, stderr=subprocess.STDOUT)\n        # remove the trailing \"\\n\"\n        return access_token.decode(\"utf-8\").strip()\n    except (subprocess.CalledProcessError, OSError, IOError) as caught_exc:\n        new_exc = exceptions.UserAccessTokenError(\n            \"Failed to obtain access token\", caught_exc\n        )\n        six.raise_from(new_exc, caught_exc)\n", "path": "google/auth/_cloud_sdk.py"}]}