fix(client): Move x-goog-user-project header to API requests only

.changeset/fix-quota-header-discovery.md

@@ -0,0 +1,5 @@
+---
+"@googleworkspace/cli": patch
+---
+
+Move x-goog-user-project header from default client headers to API request builder, fixing Discovery Document fetches failing with 403 when the quota project lacks certain APIs enabled

src/auth.rs

@@ -738,6 +738,7 @@ mod tests {
         .unwrap();
 
         let _home_guard = EnvVarGuard::set("HOME", tmp.path());
+        let _adc_guard = EnvVarGuard::remove("GOOGLE_APPLICATION_CREDENTIALS");
         assert_eq!(get_quota_project(), Some("my-project-123".to_string()));
     }
 }

src/client.rs

@@ -11,13 +11,6 @@ pub fn build_client() -> Result<reqwest::Client, crate::error::GwsError> {
         headers.insert("x-goog-api-client", header_value);
     }
 
-    // Set quota project from ADC for billing/quota attribution
-    if let Some(quota_project) = crate::auth::get_quota_project() {
-        if let Ok(header_value) = HeaderValue::from_str(&quota_project) {
-            headers.insert("x-goog-user-project", header_value);
-        }
-    }
-
     reqwest::Client::builder()
         .default_headers(headers)
         .build()

src/executor.rs

@@ -165,6 +165,11 @@ async fn build_http_request(
         }
     }
 
+    // Set quota project from ADC for billing/quota attribution
+    if let Some(quota_project) = crate::auth::get_quota_project() {
+        request = request.header("x-goog-user-project", quota_project);
+    }
+
     for (key, value) in &input.query_params {
         request = request.query(&[(key, value)]);
     }