fix(auth): add missing @Nullable annotations across credential types and providers

google-auth-library-java/appengine/java/com/google/auth/appengine/AppEngineCredentials.java

@@ -68,7 +68,8 @@ public class AppEngineCredentials extends GoogleCredentials implements ServiceAc
 
   private transient AppIdentityService appIdentityService;
 
-  private AppEngineCredentials(Collection<String> scopes, AppIdentityService appIdentityService) {
+  private AppEngineCredentials(
+      @Nullable Collection<String> scopes, @Nullable AppIdentityService appIdentityService) {
     this.scopes = scopes == null ? ImmutableSet.<String>of() : ImmutableList.copyOf(scopes);
     this.appIdentityService =
         appIdentityService != null
@@ -175,8 +176,8 @@ public Builder toBuilder() {
 
   public static class Builder extends GoogleCredentials.Builder {
 
-    private Collection<String> scopes;
-    private AppIdentityService appIdentityService;
+    private @Nullable Collection<String> scopes;
+    private @Nullable AppIdentityService appIdentityService;
 
     protected Builder() {}
 
@@ -186,22 +187,22 @@ protected Builder(AppEngineCredentials credentials) {
     }
 
     @CanIgnoreReturnValue
-    public Builder setScopes(Collection<String> scopes) {
+    public Builder setScopes(@Nullable Collection<String> scopes) {
       this.scopes = scopes;
       return this;
     }
 
     @CanIgnoreReturnValue
-    public Builder setAppIdentityService(AppIdentityService appIdentityService) {
+    public Builder setAppIdentityService(@Nullable AppIdentityService appIdentityService) {
       this.appIdentityService = appIdentityService;
       return this;
     }
 
-    public Collection<String> getScopes() {
+    public @Nullable Collection<String> getScopes() {
       return scopes;
     }
 
-    public AppIdentityService getAppIdentityService() {
+    public @Nullable AppIdentityService getAppIdentityService() {
       return appIdentityService;
     }
 

google-auth-library-java/cab-token-generator/java/com/google/auth/credentialaccessboundary/ClientSideCredentialAccessBoundaryFactory.java

@@ -604,8 +604,8 @@ public static Builder newBuilder() {
    */
   public static class Builder {
     private GoogleCredentials sourceCredential;
-    private HttpTransportFactory transportFactory;
-    private String universeDomain;
+    private @Nullable HttpTransportFactory transportFactory;
+    private @Nullable String universeDomain;
     private String tokenExchangeEndpoint;
     private Duration minimumTokenLifetime;
     private Duration refreshMargin;
@@ -686,7 +686,7 @@ public Builder setRefreshMargin(Duration refreshMargin) {
      * @return this {@code Builder} object
      */
     @CanIgnoreReturnValue
-    public Builder setHttpTransportFactory(HttpTransportFactory transportFactory) {
+    public Builder setHttpTransportFactory(@Nullable HttpTransportFactory transportFactory) {
       this.transportFactory = transportFactory;
       return this;
     }
@@ -698,7 +698,7 @@ public Builder setHttpTransportFactory(HttpTransportFactory transportFactory) {
      * @return this {@code Builder} object
      */
     @CanIgnoreReturnValue
-    public Builder setUniverseDomain(String universeDomain) {
+    public Builder setUniverseDomain(@Nullable String universeDomain) {
       this.universeDomain = universeDomain;
       return this;
     }
@@ -742,8 +742,8 @@ public ClientSideCredentialAccessBoundaryFactory build() {
       try {
         if (!universeDomain.equals(sourceCredential.getUniverseDomain())) {
           throw new IllegalArgumentException(
-              "The client side access boundary credential's universe domain must be the same as the source "
-                  + "credential.");
+              "The client side access boundary credential's universe domain must be the same as the"
+                  + " source credential.");
         }
       } catch (IOException e) {
         // Throwing an IOException would be a breaking change, so wrap it here.

google-auth-library-java/credentials/java/com/google/auth/Credentials.java

@@ -121,7 +121,7 @@ public Map<String, List<String>> getRequestMetadata() throws IOException {
    * @param callback Callback to execute when the request is finished.
    */
   public void getRequestMetadata(
-      final URI uri, Executor executor, final RequestMetadataCallback callback) {
+      final @Nullable URI uri, Executor executor, final RequestMetadataCallback callback) {
     executor.execute(
         new Runnable() {
           @Override
@@ -137,7 +137,7 @@ public void run() {
    * @param uri URI of the entry point for the request.
    * @param callback Callback handler to execute when the metadata completes.
    */
-  protected final void blockingGetToCallback(URI uri, RequestMetadataCallback callback) {
+  protected final void blockingGetToCallback(@Nullable URI uri, RequestMetadataCallback callback) {
     Map<String, List<String>> result;
     try {
       result = getRequestMetadata(uri);

google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsUtils.java

@@ -40,6 +40,7 @@
 import java.io.InputStream;
 import java.util.Locale;
 import org.jspecify.annotations.NullMarked;
+import org.jspecify.annotations.Nullable;
 
 /**
  * Utility class for mTLS related operations.
@@ -65,14 +66,17 @@ private MtlsUtils() {
    * @throws IOException if the certificate configuration cannot be found or loaded.
    */
   public static String getCertificatePath(
-      EnvironmentProvider envProvider, PropertyProvider propProvider, String certConfigPathOverride)
+      EnvironmentProvider envProvider,
+      PropertyProvider propProvider,
+      @Nullable String certConfigPathOverride)
       throws IOException {
     String certPath =
         getWorkloadCertificateConfiguration(envProvider, propProvider, certConfigPathOverride)
             .getCertPath();
     if (Strings.isNullOrEmpty(certPath)) {
       throw new CertificateSourceUnavailableException(
-          "Certificate configuration loaded successfully, but does not contain a 'certificate_file' path.");
+          "Certificate configuration loaded successfully, but does not contain a 'certificate_file'"
+              + " path.");
     }
     return certPath;
   }
@@ -92,7 +96,9 @@ public static String getCertificatePath(
    * @throws IOException if the configuration file cannot be found, read, or parsed
    */
   static WorkloadCertificateConfiguration getWorkloadCertificateConfiguration(
-      EnvironmentProvider envProvider, PropertyProvider propProvider, String certConfigPathOverride)
+      EnvironmentProvider envProvider,
+      PropertyProvider propProvider,
+      @Nullable String certConfigPathOverride)
       throws IOException {
     File certConfig;
     if (certConfigPathOverride != null) {

google-auth-library-java/oauth2_http/java/com/google/auth/mtls/X509Provider.java

@@ -54,7 +54,7 @@
 public class X509Provider implements MtlsProvider {
   private final EnvironmentProvider envProvider;
   private final PropertyProvider propProvider;
-  private final String certConfigPathOverride;
+  private final @Nullable String certConfigPathOverride;
 
   /**
    * Creates an X509 provider with an override path for the certificate configuration, bypassing the
@@ -69,7 +69,7 @@ public class X509Provider implements MtlsProvider {
   public X509Provider(
       EnvironmentProvider envProvider,
       PropertyProvider propProvider,
-      String certConfigPathOverride) {
+      @Nullable String certConfigPathOverride) {
     this.envProvider = envProvider;
     this.propProvider = propProvider;
     this.certConfigPathOverride = certConfigPathOverride;

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AccessToken.java

@@ -56,7 +56,7 @@ public class AccessToken implements Serializable {
    * @param tokenValue String representation of the access token.
    * @param expirationTime Time when access token will expire.
    */
-  public AccessToken(String tokenValue, Date expirationTime) {
+  public AccessToken(String tokenValue, @Nullable Date expirationTime) {
     this.tokenValue = tokenValue;
     this.expirationTimeMillis = (expirationTime == null) ? null : expirationTime.getTime();
     this.scopes = new ArrayList<>();
@@ -108,7 +108,7 @@ public String getTokenValue() {
     return new Date(expirationTimeMillis);
   }
 
-  Long getExpirationTimeMillis() {
+  @Nullable Long getExpirationTimeMillis() {
     return expirationTimeMillis;
   }
 
@@ -145,8 +145,8 @@ public boolean equals(@Nullable Object obj) {
   }
 
   public static class Builder {
-    private String tokenValue;
-    private Date expirationTime;
+    private @Nullable String tokenValue;
+    private @Nullable Date expirationTime;
     private List<String> scopes = new ArrayList<>();
 
     protected Builder() {}
@@ -157,15 +157,15 @@ protected Builder(AccessToken accessToken) {
       this.scopes = accessToken.getScopes();
     }
 
-    public String getTokenValue() {
+    public @Nullable String getTokenValue() {
       return this.tokenValue;
     }
 
     public List<String> getScopes() {
       return this.scopes;
     }
 
-    public Date getExpirationTime() {
+    public @Nullable Date getExpirationTime() {
       return this.expirationTime;
     }
 
@@ -176,15 +176,15 @@ public Builder setTokenValue(String tokenValue) {
     }
 
     @CanIgnoreReturnValue
-    public Builder setScopes(String scopes) {
+    public Builder setScopes(@Nullable String scopes) {
       if (scopes != null && scopes.trim().length() > 0) {
         this.scopes = Arrays.asList(scopes.split(" "));
       }
       return this;
     }
 
     @CanIgnoreReturnValue
-    public Builder setScopes(List<String> scopes) {
+    public Builder setScopes(@Nullable List<String> scopes) {
       if (scopes == null) {
         this.scopes = new ArrayList<>();
       } else {
@@ -195,7 +195,7 @@ public Builder setScopes(List<String> scopes) {
     }
 
     @CanIgnoreReturnValue
-    public Builder setExpirationTime(Date expirationTime) {
+    public Builder setExpirationTime(@Nullable Date expirationTime) {
       this.expirationTime = expirationTime;
       return this;
     }

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AppEngineCredentials.java

@@ -74,15 +74,16 @@ class AppEngineCredentials extends GoogleCredentials implements ServiceAccountSi
   private final Collection<String> scopes;
   private final boolean scopesRequired;
 
-  private transient Object appIdentityService;
-  private transient Method getAccessToken;
-  private transient Method getAccessTokenResult;
-  private transient Method getExpirationTime;
-  private transient Method signForApp;
-  private transient Method getSignature;
-  private transient String account;
-
-  AppEngineCredentials(Collection<String> scopes, Collection<String> defaultScopes)
+  private transient @Nullable Object appIdentityService;
+  private transient @Nullable Method getAccessToken;
+  private transient @Nullable Method getAccessTokenResult;
+  private transient @Nullable Method getExpirationTime;
+  private transient @Nullable Method signForApp;
+  private transient @Nullable Method getSignature;
+  private transient @Nullable String account;
+
+  AppEngineCredentials(
+      @Nullable Collection<String> scopes, @Nullable Collection<String> defaultScopes)
       throws IOException {
     // Use defaultScopes only when scopes don't exist.
     if (scopes == null || scopes.isEmpty()) {
@@ -96,7 +97,7 @@ class AppEngineCredentials extends GoogleCredentials implements ServiceAccountSi
   }
 
   AppEngineCredentials(
-      Collection<String> scopes,
+      @Nullable Collection<String> scopes,
       @Nullable Collection<String> defaultScopes,
       AppEngineCredentials unscoped) {
     this.appIdentityService = unscoped.appIdentityService;
@@ -164,13 +165,13 @@ public boolean createScopedRequired() {
   }
 
   @Override
-  public GoogleCredentials createScoped(Collection<String> scopes) {
+  public GoogleCredentials createScoped(@Nullable Collection<String> scopes) {
     return new AppEngineCredentials(scopes, null, this);
   }
 
   @Override
   public GoogleCredentials createScoped(
-      Collection<String> scopes, Collection<String> defaultScopes) {
+      @Nullable Collection<String> scopes, @Nullable Collection<String> defaultScopes) {
     return new AppEngineCredentials(scopes, defaultScopes, this);
   }
 

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsCredentials.java

@@ -83,7 +83,8 @@ public class AwsCredentials extends ExternalAccountCredentials {
     // Check that one and only one of supplier or credential source are provided.
     if (builder.awsSecurityCredentialsSupplier != null && builder.credentialSource != null) {
       throw new IllegalArgumentException(
-          "AwsCredentials cannot have both an awsSecurityCredentialsSupplier and a credentialSource.");
+          "AwsCredentials cannot have both an awsSecurityCredentialsSupplier and a"
+              + " credentialSource.");
     }
     if (builder.awsSecurityCredentialsSupplier == null && builder.credentialSource == null) {
       throw new IllegalArgumentException(
@@ -203,8 +204,7 @@ AwsSecurityCredentialsSupplier getAwsSecurityCredentialsSupplier() {
     return this.awsSecurityCredentialsSupplier;
   }
 
-  @Nullable
-  public String getRegionalCredentialVerificationUrlOverride() {
+  public @Nullable String getRegionalCredentialVerificationUrlOverride() {
     return this.regionalCredentialVerificationUrlOverride;
   }
 
@@ -239,7 +239,7 @@ public static class Builder extends ExternalAccountCredentials.Builder {
 
     private AwsSecurityCredentialsSupplier awsSecurityCredentialsSupplier;
 
-    private String regionalCredentialVerificationUrlOverride;
+    private @Nullable String regionalCredentialVerificationUrlOverride;
 
     Builder() {}
 
@@ -277,13 +277,13 @@ public Builder setAwsSecurityCredentialsSupplier(
      */
     @CanIgnoreReturnValue
     public Builder setRegionalCredentialVerificationUrlOverride(
-        String regionalCredentialVerificationUrlOverride) {
+        @Nullable String regionalCredentialVerificationUrlOverride) {
       this.regionalCredentialVerificationUrlOverride = regionalCredentialVerificationUrlOverride;
       return this;
     }
 
     @CanIgnoreReturnValue
-    public Builder setHttpTransportFactory(HttpTransportFactory transportFactory) {
+    public Builder setHttpTransportFactory(@Nullable HttpTransportFactory transportFactory) {
       super.setHttpTransportFactory(transportFactory);
       return this;
     }
@@ -319,55 +319,56 @@ public Builder setCredentialSource(AwsCredentialSource credentialSource) {
     }
 
     @CanIgnoreReturnValue
-    public Builder setServiceAccountImpersonationUrl(String serviceAccountImpersonationUrl) {
+    public Builder setServiceAccountImpersonationUrl(
+        @Nullable String serviceAccountImpersonationUrl) {
       super.setServiceAccountImpersonationUrl(serviceAccountImpersonationUrl);
       return this;
     }
 
     @CanIgnoreReturnValue
-    public Builder setTokenInfoUrl(String tokenInfoUrl) {
+    public Builder setTokenInfoUrl(@Nullable String tokenInfoUrl) {
       super.setTokenInfoUrl(tokenInfoUrl);
       return this;
     }
 
     @CanIgnoreReturnValue
-    public Builder setQuotaProjectId(String quotaProjectId) {
+    public Builder setQuotaProjectId(@Nullable String quotaProjectId) {
       super.setQuotaProjectId(quotaProjectId);
       return this;
     }
 
     @CanIgnoreReturnValue
-    public Builder setClientId(String clientId) {
+    public Builder setClientId(@Nullable String clientId) {
       super.setClientId(clientId);
       return this;
     }
 
     @CanIgnoreReturnValue
-    public Builder setClientSecret(String clientSecret) {
+    public Builder setClientSecret(@Nullable String clientSecret) {
       super.setClientSecret(clientSecret);
       return this;
     }
 
     @CanIgnoreReturnValue
-    public Builder setScopes(Collection<String> scopes) {
+    public Builder setScopes(@Nullable Collection<String> scopes) {
       super.setScopes(scopes);
       return this;
     }
 
     @CanIgnoreReturnValue
-    public Builder setWorkforcePoolUserProject(String workforcePoolUserProject) {
+    public Builder setWorkforcePoolUserProject(@Nullable String workforcePoolUserProject) {
       super.setWorkforcePoolUserProject(workforcePoolUserProject);
       return this;
     }
 
     @CanIgnoreReturnValue
-    public Builder setServiceAccountImpersonationOptions(Map<String, Object> optionsMap) {
+    public Builder setServiceAccountImpersonationOptions(@Nullable Map<String, Object> optionsMap) {
       super.setServiceAccountImpersonationOptions(optionsMap);
       return this;
     }
 
     @CanIgnoreReturnValue
-    public Builder setUniverseDomain(String universeDomain) {
+    public Builder setUniverseDomain(@Nullable String universeDomain) {
       super.setUniverseDomain(universeDomain);
       return this;
     }