fix(auth): handle missing APPDATA on Windows gracefully

Other languages (such as Python and Node.js) handle missing HOME or APPDATA directories by falling back gracefully or failing with a structured Error/Exception. This change brings Java into parity by ensuring an orderly IOException is explicitly thrown by getWellKnownCredentialsFile instead of triggering an opaque NullPointerException when APPDATA is null.

Fixes #12565

Author: westarle

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/DefaultCredentialsProvider.java

@@ -239,7 +239,7 @@ private final GoogleCredentials getDefaultCredentialsUnsynchronized(
     return credentials;
   }
 
-  private final File getWellKnownCredentialsFile() {
+  private final File getWellKnownCredentialsFile() throws IOException {
     return GoogleAuthUtils.getWellKnownCredentialsFile(this);
   }
 

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/GoogleAuthUtils.java

@@ -32,6 +32,7 @@
 package com.google.auth.oauth2;
 
 import java.io.File;
+import java.io.IOException;
 
 /**
  * This public class provides shared utilities for common OAuth2 utils or ADC. It also exposes
@@ -45,7 +46,7 @@ public class GoogleAuthUtils {
    * @return the path to the well-known Application Default Credentials file location
    */
   public static final String getWellKnownCredentialsPath() {
-    return getWellKnownCredentialsFile(DefaultCredentialsProvider.DEFAULT).getAbsolutePath();
+    return getWellKnownCredentialsPath(DefaultCredentialsProvider.DEFAULT);
   }
 
   /**
@@ -54,7 +55,11 @@ public static final String getWellKnownCredentialsPath() {
    * @return the path to the well-known Application Default Credentials file location
    */
   static final String getWellKnownCredentialsPath(DefaultCredentialsProvider provider) {
-    return getWellKnownCredentialsFile(provider).getAbsolutePath();
+    try {
+      return getWellKnownCredentialsFile(provider).getAbsolutePath();
+    } catch (IOException e) {
+      throw new RuntimeException(e);
+    }
   }
 
   /**
@@ -64,13 +69,17 @@ static final String getWellKnownCredentialsPath(DefaultCredentialsProvider provi
    *     purposes)
    * @return the well-known Application Default Credentials file
    */
-  static final File getWellKnownCredentialsFile(DefaultCredentialsProvider provider) {
+  static final File getWellKnownCredentialsFile(DefaultCredentialsProvider provider) throws IOException {
     File cloudConfigPath;
     String envPath = provider.getEnv("CLOUDSDK_CONFIG");
     if (envPath != null) {
       cloudConfigPath = new File(envPath);
     } else if (provider.getOsName().indexOf("windows") >= 0) {
-      File appDataPath = new File(provider.getEnv("APPDATA"));
+      String appData = provider.getEnv("APPDATA");
+      if (appData == null) {
+        throw new IOException(DefaultCredentialsProvider.CLOUDSDK_MISSING_CREDENTIALS);
+      }
+      File appDataPath = new File(appData);
       cloudConfigPath = new File(appDataPath, provider.CLOUDSDK_CONFIG_DIRECTORY);
     } else {
       File configPath = new File(provider.getProperty("user.home", ""), ".config");

google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/DefaultCredentialsProviderTest.java

@@ -115,6 +115,21 @@ void getDefaultCredentials_noCredentials_throws() {
     assertEquals(DefaultCredentialsProvider.CLOUDSDK_MISSING_CREDENTIALS, message);
   }
 
+  @Test
+  void getDefaultCredentials_windowsMissingAppData_throws() {
+    // When APPDATA is unset on Windows, the ADC resolution should fail gracefully 
+    // with a structured missing credentials exception, rather than crashing with an NPE.
+    // This matches the expected behavior seen in Node.js and Python implementations.
+    MockHttpTransportFactory transportFactory = new MockHttpTransportFactory();
+    TestDefaultCredentialsProvider testProvider = new TestDefaultCredentialsProvider();
+    testProvider.setProperty("os.name", "windows");
+    testProvider.setEnv("APPDATA", null);
+
+    IOException e =
+        assertThrows(IOException.class, () -> testProvider.getDefaultCredentials(transportFactory));
+    assertEquals(DefaultCredentialsProvider.CLOUDSDK_MISSING_CREDENTIALS, e.getMessage());
+  }
+
   @Test
   void getDefaultCredentials_noCredentialsSandbox_throwsNonSecurity() {
     MockHttpTransportFactory transportFactory = new MockHttpTransportFactory();

google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/GoogleAuthUtilsTest.java

@@ -37,6 +37,8 @@
 import java.io.File;
 import org.junit.jupiter.api.Test;
 
+import java.io.IOException;
+
 class GoogleAuthUtilsTest {
 
   @Test