fix(auth): restore scopes null check and normalize getter nullability annotations

Author: lqiu96

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java

@@ -608,44 +608,37 @@ private void readObject(ObjectInputStream input) throws IOException, ClassNotFou
     transportFactory = newInstance(transportFactoryClassName);
   }
 
-  @Nullable
-  public String getServiceAccountImpersonationUrl() {
+  public @Nullable String getServiceAccountImpersonationUrl() {
     return serviceAccountImpersonationUrl;
   }
 
   /**
    * @return The service account email to be impersonated, if available
    */
-  @Nullable
-  public String getServiceAccountEmail() {
+  public @Nullable String getServiceAccountEmail() {
     if (serviceAccountImpersonationUrl == null || serviceAccountImpersonationUrl.isEmpty()) {
       return null;
     }
     return ImpersonatedCredentials.extractTargetPrincipal(serviceAccountImpersonationUrl);
   }
 
-  @Nullable
-  public String getClientId() {
+  public @Nullable String getClientId() {
     return clientId;
   }
 
-  @Nullable
-  public String getClientSecret() {
+  public @Nullable String getClientSecret() {
     return clientSecret;
   }
 
-  @Nullable
-  public Collection<String> getScopes() {
+  public @Nullable Collection<String> getScopes() {
     return scopes;
   }
 
-  @Nullable
-  public String getWorkforcePoolUserProject() {
+  public @Nullable String getWorkforcePoolUserProject() {
     return workforcePoolUserProject;
   }
 
-  @Nullable
-  public ServiceAccountImpersonationOptions getServiceAccountImpersonationOptions() {
+  public @Nullable ServiceAccountImpersonationOptions getServiceAccountImpersonationOptions() {
     return serviceAccountImpersonationOptions;
   }
 

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/IdentityPoolCredentialSource.java

@@ -80,8 +80,7 @@ public void setCredentialLocation(String credentialLocation) {
    * @return The {@link CertificateConfig} object, or {@code null} if not configured for
    *     certificate-based credentials.
    */
-  @Nullable
-  public CertificateConfig getCertificateConfig() {
+  public @Nullable CertificateConfig getCertificateConfig() {
     return certificateConfig;
   }
 
@@ -208,11 +207,13 @@ public static class CertificateConfig implements java.io.Serializable {
 
       checkArgument(
           (useDefault || locationIsPresent),
-          "Invalid 'certificate' configuration in credential source: Must specify either 'certificate_config_location' or set 'use_default_certificate_config' to true.");
+          "Invalid 'certificate' configuration in credential source: Must specify either"
+              + " 'certificate_config_location' or set 'use_default_certificate_config' to true.");
 
       checkArgument(
           !(useDefault && locationIsPresent),
-          "Invalid 'certificate' configuration in credential source: Cannot specify both 'certificate_config_location' and set 'use_default_certificate_config' to true.");
+          "Invalid 'certificate' configuration in credential source: Cannot specify both"
+              + " 'certificate_config_location' and set 'use_default_certificate_config' to true.");
 
       this.useDefaultCertificateConfig = useDefault;
       this.certificateConfigLocation = certificateConfigLocation;
@@ -225,14 +226,12 @@ public boolean useDefaultCertificateConfig() {
     }
 
     /** Returns the path to the client certificate file, or null if not set. */
-    @Nullable
-    public String getCertificateConfigLocation() {
+    public @Nullable String getCertificateConfigLocation() {
       return certificateConfigLocation;
     }
 
     /** Returns the path to the trust chain file, or null if not set. */
-    @Nullable
-    public String getTrustChainPath() {
+    public @Nullable String getTrustChainPath() {
       return trustChainPath;
     }
   }
@@ -279,7 +278,8 @@ public IdentityPoolCredentialSource(Map<String, Object> credentialSourceMap) {
       this.certificateConfig = certificateConfigFromSourceMap(credentialSourceMap);
     } else {
       throw new IllegalArgumentException(
-          "Missing credential source file location, URL, or certificate. At least one must be specified.");
+          "Missing credential source file location, URL, or certificate. At least one must be"
+              + " specified.");
     }
 
     Map<String, String> headersMap = (Map<String, String>) credentialSourceMap.get("headers");

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/IdentityPoolCredentials.java

@@ -123,7 +123,7 @@ public AccessToken refreshAccessToken() throws IOException {
             .setAudience(getAudience());
 
     Collection<String> scopes = getScopes();
-    if (!scopes.isEmpty()) {
+    if (scopes != null && !scopes.isEmpty()) {
       stsTokenExchangeRequest.setScopes(new ArrayList<>(scopes));
     }