The download request for the downloadUri is missing the x-goog-user-project header, which is required by many Google APIs for quota and billing attribution when using a service account or specific project-based credentials. For consistency with the primary API request built in build_http_request, this header should be included if a quota project is configured.

                    let mut download_request = client.get(download_uri);
                    if let Some(quota_project) = crate::auth::get_quota_project() {
                        download_request = download_request.header("x-goog-user-project", quota_project);
                    }
                    if let Some(token) = token {
                        if auth_method == AuthMethod::OAuth {
                            download_request = download_request.bearer_auth(token);
                        }
                    }

The download request is built using only the download_uri and the quota project header. It does not inherit other potentially important headers from the original request, such as User-Agent or custom headers that might be required by the storage backend. Ensure that the client used (built at line 481) has the necessary default headers configured.

Using unwrap_or_default() when reading the error body might mask the actual error if the body cannot be read. While handle_error_response handles empty strings, it would be better to provide context if the body read fails, similar to how it's done for the main response body at line 537.

Adding an Authorization header to a Google download URI can cause a 400 Bad Request if the URI is a "Signed URL" (common for large file downloads from Google Cloud Storage). Signed URLs already contain authentication in their query parameters (e.g., GoogleAccessId or X-Goog-Signature), and providing a Bearer token simultaneously creates an authentication conflict. You should only add the bearer token if the URL does not appear to be signed.

    if let Some(token) = token {
        if *auth_method == AuthMethod::OAuth {
            // Only add Authorization header if the URL doesn't appear to be a GCS Signed URL.
            // Signed URLs contain authentication in query parameters, and adding a Bearer
            // token causes a 400 Bad Request conflict.
            let is_signed_url = reqwest::Url::parse(download_uri)
                .map(|u| {
                    u.query_pairs().any(|(k, _)| {
                        k == "GoogleAccessId" || k == "Signature" || k.starts_with("X-Goog-")
                    })
                })
                .unwrap_or(false);

            if !is_signed_url {
                request = request.bearer_auth(token);
            }
        }
    }

There are two significant concerns with this logic:

1. Method ID Accuracy: Please verify that drive.files.download is the correct method ID. In the standard Google Drive API v3 Discovery Document, the method for downloading file content is drive.files.get (typically used with alt=media). If the ID is actually drive.files.get, this block will never execute.
2. Security/Correctness Risk: Following a downloadUri from a JSON body is dangerous if the response is actually the file content (e.g., a user-controlled JSON file) rather than an API Operation or metadata. If a user's file contains a downloadUri field pointing to a malicious but Google-hosted domain (like a subdomain of googleusercontent.com), the CLI might follow it and leak the user's Bearer token.

To fix this, you should verify that the JSON response is indeed an API response (e.g., by checking for a "kind": "drive#operation" field or the presence of the "done" field characteristic of Google Operations) before attempting to extract and follow a download URI.

The check host == "storage.googleapis.com" is redundant because host.ends_with(".googleapis.com") already covers it. To ensure the host is either exactly the base domain or a proper subdomain, the check should include the base domain explicitly. Suggestions to add additional domains like googleusercontent.com are omitted to avoid scope creep.

The host validation logic is overly permissive and susceptible to token exfiltration. By allowing any host ending in .googleapis.com, the CLI will trust attacker-controlled subdomains such as attacker-bucket.storage.googleapis.com. An attacker could share a malicious JSON file that mimics a Drive operation, causing the CLI to send the user's OAuth Bearer token to the attacker's bucket during a download.

Restrict the allowed hosts to a strict allowlist of trusted Google API domains.

fn is_google_download_uri(uri: &str) -> bool {
    let Ok(url) = reqwest::Url::parse(uri) else {
        return false;
    };
    if url.scheme() != "https" || !url.username().is_empty() || url.password().is_some() {
        return false;
    }
    let Some(host) = url.host_str() else {
        return false;
    };

    // Restrict to known trusted Google API hosts to prevent token exfiltration 
    // to attacker-controlled subdomains (e.g., GCS virtual-hosted buckets).
    matches!(host, "googleapis.com" | "www.googleapis.com" | "storage.googleapis.com")
}

This implementation has two significant issues:

1. Signed URL Compatibility: Adding the x-goog-user-project header to a signed URL (like those from GCS) will cause a SignatureDoesNotMatch (403) error because the header was not part of the original signature.
2. Security (Token Leakage): Sending Bearer tokens to storage.googleapis.com is dangerous as it allows token exfiltration to user-controlled buckets. Bearer tokens should only be sent to the main API surface (www.googleapis.com). GCS downloads should rely on signed URLs which do not require the Authorization header.

fn build_download_request(
    client: &reqwest::Client,
    download_uri: &str,
    token: Option<&str>,
    auth_method: &AuthMethod,
) -> reqwest::RequestBuilder {
    let mut request = client.get(download_uri);
    let is_signed = is_signed_download_uri(download_uri);

    // Only add auth/quota headers if the URI is NOT a signed URL.
    if !is_signed {
        request = add_quota_project_header(request);
        if let Some(token) = token {
            // Only send Bearer tokens to the main API surface. 
            // GCS downloads (storage.googleapis.com) should use signed URLs.
            let is_api_host = reqwest::Url::parse(download_uri)
                .map(|u| matches!(u.host_str(), Some("www.googleapis.com" | "googleapis.com")))
                .unwrap_or(false);

            if *auth_method == AuthMethod::OAuth && is_api_host {
                request = request.bearer_auth(token);
            }
        }
    }
    request
}

Checking for the presence of a done field is too generic and can lead to false positives when downloading user-provided JSON files. This increases the risk of the CLI misinterpreting file content as an API operation. Rely on the more specific kind field or other unique markers of a Drive operation response.

fn is_drive_download_operation(json_val: &Value) -> bool {
    json_val
        .get("kind")
        .and_then(Value::as_str)
        .is_some_and(|kind| kind == "drive#operation")
}

There is a security risk here: if a user downloads a malicious JSON file that mimics a Drive operation response, the CLI will follow the downloadUri contained within that file. While the host check and token restrictions (suggested elsewhere) mitigate token theft, this still constitutes a Server-Side Request Forgery (SSRF) where the CLI makes unexpected requests based on untrusted content. Consider adding a check to ensure the response is an actual API response (e.g., by verifying the presence of Google-specific API headers like X-Goog-Api-Client) before attempting to extract a download URI.

The whitelist for following download URIs is too restrictive and will likely break legitimate Google Drive downloads. Google frequently uses various subdomains for content delivery, such as drive.googleusercontent.com or dynamically generated subdomains like doc-0k-8s-docs.googleusercontent.com.

It is safer to allow any subdomain of googleapis.com and googleusercontent.com for the purpose of following the redirect, as long as the authentication token is only sent to a more strictly validated set of hosts (which is handled separately in is_google_api_download_host).

fn is_google_download_uri(uri: &str) -> bool {
    parse_download_uri_host(uri).as_deref().is_some_and(|host| {
        host == "googleapis.com" || host.ends_with(".googleapis.com") || host.ends_with(".googleusercontent.com")
    })
}

The storage.googleapis.com host should be included in the list of hosts allowed to receive the Bearer authentication token. Many Drive download operations redirect to Google Cloud Storage (GCS). If the GCS URL is not a signed URL (e.g., it's a direct link to a private object), the request will fail with a 401/403 error unless the OAuth2 token is provided.

Note that exact matching on storage.googleapis.com is safe, as it prevents sending the token to virtual-hosted style buckets (e.g., bucket.storage.googleapis.com) which could be attacker-controlled.