[fix] Supertest - GCP Error - 2 UNKNOWN: Getting metadata from plugin failed with error: Unexpected Gaxios Error

[bhala-ki]

Describe the bug

Node.js version: v25.1.0

OS version: macOS Tahoe 26.1

Description: Getting an error "2 UNKNOWN: Getting metadata from plugin failed with error: Unexpected Gaxios Error" while trying to retrieve the GCP secret.

Actual behavior

Getting an error "2 UNKNOWN: Getting metadata from plugin failed with error: Unexpected Gaxios Error" while trying to retrieve the GCP secret.

Expected behavior

Should be able to retrieve the GCP secrets successfully without any errors.

Code to reproduce

import request, { Response } from "supertest";

describe("Endpoints", () => {
let authToken: string;
beforeAll(async () => {
authToken = await getAccessToken(BASE_URL);
});

export async function getAccessToken(baseUrl: string): Promise {
const username = await getSecretValue("<secret_name>");
const reqBody = "<request_body>";

request(baseUrl)
.post("/auth/token")
.auth(username)
.set("Content-Type", "application/x-www-form-urlencoded")
.send(reqBody);
}

import { SecretManagerServiceClient } from '@google-cloud/secret-manager';
import { gcp_secret_project_name } from '../../config';

const client = new SecretManagerServiceClient();

export async function getSecretValue(secretId: string): Promise {
const [version] = await client.accessSecretVersion({
name: projects/${gcp_secret_project_name}/secrets/${secretId}/versions/latest,
});

return version.payload?.data?.toString() || '';
}

Failing in this line of code: await client.accessSecretVersion({
name: projects/${gcp_secret_project_name}/secrets/${secretId}/versions/latest,
});
with:
2 UNKNOWN: Getting metadata from plugin failed with error: Unexpected Gaxios Error

Checklist

• I have searched through GitHub issues for similar issues.
• I have completely read through the README and documentation.
• I have tested my code with the latest version of Node.js and this package and confirmed it is still not working.

[bhala-ki]

Workaround is to create a new test service account with required permissions (secretManagerAccess) in cloud and generate a key for it in JSON format, something like this:
"type": "service_account", "project_id": "${PROJECT_ID}", "private_key_id": "${PRIVATE_KEY_ID}", "private_key": "-----BEGIN PRIVATE KEY-----

now use this JSON as GitHub secret variables in base64 encoded format else it will complaint on the syntax in CI run.

[konradschewe]

From my experience, the latest Google Cloud packages use ECMAScript Modules (ESM).
Therefore we are getting issues when running Jest tests, as Jest disables ESM by default: https://jestjs.io/docs/ecmascript-modules.

Jest provides the option to set the flag --experimental-vm-modules to enable ESM experimentally. Unfortunately, they are telling that "The implementation may have bugs and lack features".
For productive services, you should not do that.

There is actually another workaround you can try to use the Jest option transformIgnorePatterns to ignore ESM packages.
We use that as follows to disable ESM packages to be transformed by Jest.
This makes it possible to authenticate using your local user against Pub/Sub (no need for a service account's GOOGLE_APPLICATION_CREDENTIALS to be set).

"transformIgnorePatterns": [
    "node_modules/(?!(@google-cloud/pubsub|@google-cloud/secret-manager|gaxios|node-fetch|data-uri-to-buffer|fetch-blob|formdata-polyfill)/)"
  ]