Apply scopes to explicitly provided credentials if needed

api_core/google/api_core/grpc_helpers.py

@@ -20,6 +20,7 @@
 from google.api_core import exceptions
 from google.api_core import general_helpers
 import google.auth
+import google.auth.credentials
 import google.auth.transport.grpc
 import google.auth.transport.requests
 
@@ -127,6 +128,9 @@ def create_channel(target, credentials=None, scopes=None, **kwargs):
     """
     if credentials is None:
         credentials, _ = google.auth.default(scopes=scopes)
+    else:
+        credentials = google.auth.credentials.with_scopes_if_required(
+            credentials, scopes)
 
     request = google.auth.transport.requests.Request()
 

api_core/tests/unit/test_grpc_helpers.py

@@ -16,6 +16,7 @@
 import mock
 import pytest
 
+import google.auth.credentials
 from google.api_core import exceptions
 from google.api_core import grpc_helpers
 
@@ -169,3 +170,19 @@ def test_create_channel_explicit(secure_authorized_channel):
     assert channel is secure_authorized_channel.return_value
     secure_authorized_channel.assert_called_once_with(
         mock.sentinel.credentials, mock.ANY, target)
+
+
+@mock.patch('google.auth.transport.grpc.secure_authorized_channel')
+def test_create_channel_explicit_scoped(unused_secure_authorized_channel):
+    scopes = ['1', '2']
+
+    credentials = mock.create_autospec(
+        google.auth.credentials.Scoped, instance=True)
+    credentials.requires_scopes = True
+
+    grpc_helpers.create_channel(
+        mock.sentinel.target,
+        credentials=credentials,
+        scopes=scopes)
+
+    credentials.with_scopes.assert_called_once_with(scopes)