def openid_dict_to_scheme_credential(
    config_dict: Dict[str, Any],
    scopes: List[str],
    credential_dict: Dict[str, Any],
) -> Tuple[OpenIdConnectWithConfig, AuthCredential]:
  """Constructs OpenID scheme and credential from configuration and credential dictionaries.

  Args:
      config_dict: Dictionary containing OpenID Connect configuration,  must
        include at least 'authorization_endpoint' and 'token_endpoint'.
      scopes: List of scopes to be used.
      credential_dict: Dictionary containing credential information, must
        include 'client_id', 'client_secret', and 'scopes'.  May optionally
        include 'redirect_uri'.

  Returns:
      Tuple: (OpenIdConnectWithConfig, AuthCredential)

  Raises:
      ValueError: If required fields are missing in the input dictionaries.
  """

  # Validate and create the OpenIdConnectWithConfig scheme
  try:
    config_dict["scopes"] = scopes
    # If user provides the OpenID Config as a static dict, it may not contain
    # openIdConnect URL.
    if "openIdConnectUrl" not in config_dict:
      config_dict["openIdConnectUrl"] = ""
    openid_scheme = OpenIdConnectWithConfig.model_validate(config_dict)
  except ValidationError as e:
    raise ValueError(f"Invalid OpenID Connect configuration: {e}") from e

  # Attempt to adjust credential_dict if this is a key downloaded from Google
  # OAuth config
  if len(list(credential_dict.values())) == 1:
    credential_value = list(credential_dict.values())[0]
    if "client_id" in credential_value and "client_secret" in credential_value:
      credential_dict = credential_value

  # Validate credential_dict
  required_credential_fields = ["client_id", "client_secret"]
  missing_fields = [
      field
      for field in required_credential_fields
      if field not in credential_dict
  ]
  if missing_fields:
    raise ValueError(
        "Missing required fields in credential_dict:"
        f" {', '.join(missing_fields)}"
    )

  # Construct AuthCredential
  auth_credential = AuthCredential(
      auth_type=AuthCredentialTypes.OPEN_ID_CONNECT,
      oauth2=OAuth2Auth(
          client_id=credential_dict["client_id"],
          client_secret=credential_dict["client_secret"],
          redirect_uri=credential_dict.get("redirect_uri", None),
      ),
  )

  return openid_scheme, auth_credential
Constructs OpenID scheme and credential from configuration and credential dictionaries.

  Args:
      config_dict: Dictionary containing OpenID Connect configuration,  must
        include at least 'authorization_endpoint' and 'token_endpoint'.
      scopes: List of scopes to be used.
      credential_dict: Dictionary containing credential information, must
        include 'client_id', 'client_secret', and 'scopes'.  May optionally
        include 'redirect_uri'.

  Returns:
      Tuple: (OpenIdConnectWithConfig, AuthCredential)

  Raises:
      ValueError: If required fields are missing in the input dictionaries.
  
src/google/adk/tools/openapi_tool/auth/auth_helpers.py