From e87d4ce02b8e583392094ea88b1dd413adf32a8c Mon Sep 17 00:00:00 2001
From: JiriUhlir <149317995+JiriUhlir@users.noreply.github.com>
Date: Mon, 20 Jul 2026 15:27:53 +0200
Subject: [PATCH] update problemu s hlavickami

---
 src/index.ts | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/src/index.ts b/src/index.ts
index d1b695b..ac49532 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -1024,12 +1024,25 @@ function applyCredentialHeaders(req: Request, body: GoogleRequestBody): void {
 }
 
 async function applyServiceAccountAuthorization(req: Request, body: GoogleRequestBody): Promise<void> {
-  if (body.accessToken || body.accessTokenEnv || readBearerToken(req)) {
+  const existingToken = body.accessToken || readEnvValue(body.accessTokenEnv) || readBearerToken(req);
+  if (existingToken) {
+    body.accessToken = existingToken;
     return;
   }
 
+  if (body.accessTokenEnv) {
+    console.warn(`[google-service] accessTokenEnv "${body.accessTokenEnv}" is not set in the environment; falling back to other credentials.`);
+  }
+
   const serviceAccountJson = readServiceAccountJson(req, body);
   if (!serviceAccountJson) {
+    if (!body.apiKey && !readEnvValue(body.apiKeyEnv) && !process.env.GOOGLE_API_KEY) {
+      throw new Error(
+        "No usable Google credential resolved. Provide an access token (Authorization: Bearer, accessToken, X-Google-Access-Token, or a populated accessTokenEnv), a service account JSON (serviceAccountJson, X-Google-Service-Account-Json, or a populated serviceAccountJsonEnv / GOOGLE_SERVICE_ACCOUNT_JSON), or an API key."
+      );
+    }
+
+    console.warn("[google-service] No access token or service account JSON resolved; calling Google with API key only.");
     return;
   }
 
@@ -1048,13 +1061,19 @@ async function applyServiceAccountAuthorization(req: Request, body: GoogleReques
 function readServiceAccountJson(req: Request, body?: GoogleRequestBody | ServiceAccountTokenBody): GoogleServiceAccountJson | undefined {
   const bodyValue = body && "serviceAccountJson" in body ? body.serviceAccountJson : undefined;
   const envName = body && "serviceAccountJsonEnv" in body ? body.serviceAccountJsonEnv : undefined;
+  const headerEnvName = req.header("x-google-service-account-json-env");
   const raw =
     bodyValue ||
     req.header("x-google-service-account-json") ||
     readEnvValue(envName) ||
-    readEnvValue(req.header("x-google-service-account-json-env")) ||
+    readEnvValue(headerEnvName) ||
     process.env.GOOGLE_SERVICE_ACCOUNT_JSON;
 
+  const requestedEnvName = envName || headerEnvName;
+  if (requestedEnvName && !readEnvValue(requestedEnvName)) {
+    console.warn(`[google-service] serviceAccountJsonEnv "${requestedEnvName}" is not set in the environment.`);
+  }
+
   if (!raw) {
     return undefined;
   }