Summary
Signet::OAuth2::Client#duplicate copies credential options, but calls configure_connection only with newly supplied overrides. A connection previously configured on the source client is silently replaced by defaults when no connection override is given.
Proposed correction
Seed duplication with default_connection: @connection_info, then merge explicit duplication options so caller overrides still win. Candidate: 4baf55d76e8bb1a54164b94c3779f87ad86185c2 on 1.17.4/current main (01431c9ecd59e1efc5d262694971ded925044fdc).
The focused model covers preservation, independence and explicit override behavior. The cumulative suite passes 659 RSpec examples (20 expected pending), 103 Minitest runs /201 assertions and four integration runs /41 assertions, plus RuboCop, syntax, YARD and package/install checks.
I used an AI coding assistant during source review and verification. I am opening an issue first because repository policy requires tests, a changelog and a Google CLA for pull requests; this audit cannot alter repository tests and no CLA was signed as part of it.
Summary
Signet::OAuth2::Client#duplicatecopies credential options, but callsconfigure_connectiononly with newly supplied overrides. A connection previously configured on the source client is silently replaced by defaults when no connection override is given.Proposed correction
Seed duplication with
default_connection: @connection_info, then merge explicit duplication options so caller overrides still win. Candidate:4baf55d76e8bb1a54164b94c3779f87ad86185c2on 1.17.4/currentmain(01431c9ecd59e1efc5d262694971ded925044fdc).The focused model covers preservation, independence and explicit override behavior. The cumulative suite passes 659 RSpec examples (20 expected pending), 103 Minitest runs /201 assertions and four integration runs /41 assertions, plus RuboCop, syntax, YARD and package/install checks.
I used an AI coding assistant during source review and verification. I am opening an issue first because repository policy requires tests, a changelog and a Google CLA for pull requests; this audit cannot alter repository tests and no CLA was signed as part of it.