class Google::Auth::UserRefreshCredentials

def self.make_creds options = {} # rubocop:disable Metrics/MethodLength
  json_key_io, scope = options.values_at :json_key_io, :scope
  user_creds = if json_key_io
                 json_key = JSON.parse json_key_io.read
                 if json_key.key? "type"
                   json_key_io.rewind
                 else # Defaults to class credential 'type' if missing.
                   json_key["type"] = CREDENTIAL_TYPE_NAME
                   json_key_io = StringIO.new JSON.generate(json_key)
                 end
                 CredentialsLoader.load_and_verify_json_key_type json_key_io, CREDENTIAL_TYPE_NAME
                 read_json_key json_key_io
               else
                 {
                   "client_id"     => ENV[CredentialsLoader::CLIENT_ID_VAR],
                   "client_secret" => ENV[CredentialsLoader::CLIENT_SECRET_VAR],
                   "refresh_token" => ENV[CredentialsLoader::REFRESH_TOKEN_VAR],
                   "project_id"    => ENV[CredentialsLoader::PROJECT_ID_VAR],
                   "quota_project_id" => nil,
                   "universe_domain" => nil
                 }
               end
  new(token_credential_uri: TOKEN_CRED_URI,
      client_id:            user_creds["client_id"],
      client_secret:        user_creds["client_secret"],
      refresh_token:        user_creds["refresh_token"],
      project_id:           user_creds["project_id"],
      quota_project_id:     user_creds["quota_project_id"],
      scope:                scope,
      universe_domain:      user_creds["universe_domain"] || "googleapis.com")
    .configure_connection(options)
end