tests: system tests for expired User Credentials (#1937)

This PR fixes flaky system tests that fail when `google.auth.default()`
picks up expired User Credentials.

The previous logic only exempted failures if the
`GOOGLE_APPLICATION_CREDENTIALS` environment variable pointed to a file
ending in "authorized_user.json". However, User Credentials can be
loaded from other locations (e.g., gcloud config), causing the test to
fail with `RefreshError` instead of ignoring it as intended.

Changes:
- Added `isinstance` check for `google.oauth2.credentials.Credentials`
to robustly identify User Credentials.
- Added `invalid_client` to the list of ignored error messages, as this
error can also occur with invalid tokens.
- Applied these fixes to both sync and async system tests.

---
*PR created automatically by Jules for task
[13051961428180802207](https://jules.google.com/task/13051961428180802207)
started by @chalmerlowe*

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: Chalmer Lowe <chalmerlowe@google.com>

Author: google-labs-jules[bot]

system_tests/system_tests_async/test_default.py

@@ -17,6 +17,7 @@
 
 from google.auth import _default_async
 from google.auth.exceptions import RefreshError
+import google.oauth2.credentials
 
 EXPECT_PROJECT_ID = os.getenv("EXPECT_PROJECT_ID")
 CREDENTIALS = os.getenv("GOOGLE_APPLICATION_CREDENTIALS", "")
@@ -34,12 +35,16 @@ async def test_application_default_credentials(verify_refresh):
     except RefreshError as e:
         # allow expired credentials for explicit_authorized_user tests
         # TODO: https://github.com/googleapis/google-auth-library-python/issues/1882
-        if not CREDENTIALS.endswith("authorized_user.json"):
+        is_user_credentials = isinstance(
+            credentials, google.oauth2.credentials.Credentials
+        )
+        if not is_user_credentials and not CREDENTIALS.endswith("authorized_user.json"):
             raise
 
         error_message = str(e)
         if (
             "Token has been expired or revoked" not in error_message
             and "invalid_grant" not in error_message
+            and "invalid_client" not in error_message
         ):
             raise

system_tests/system_tests_sync/test_default.py

@@ -16,6 +16,7 @@
 
 import google.auth
 from google.auth.exceptions import RefreshError
+import google.oauth2.credentials
 
 EXPECT_PROJECT_ID = os.getenv("EXPECT_PROJECT_ID")
 CREDENTIALS = os.getenv("GOOGLE_APPLICATION_CREDENTIALS", "")
@@ -32,12 +33,16 @@ def test_application_default_credentials(verify_refresh):
     except RefreshError as e:
         # allow expired credentials for explicit_authorized_user tests
         # TODO: https://github.com/googleapis/google-auth-library-python/issues/1882
-        if not CREDENTIALS.endswith("authorized_user.json"):
+        is_user_credentials = isinstance(
+            credentials, google.oauth2.credentials.Credentials
+        )
+        if not is_user_credentials and not CREDENTIALS.endswith("authorized_user.json"):
             raise
 
         error_message = str(e)
         if (
             "Token has been expired or revoked" not in error_message
             and "invalid_grant" not in error_message
+            and "invalid_client" not in error_message
         ):
             raise