[Feature Request] Allow use of GCP Service Accounts (ADC) for Vertex AI Embeddings

Describe your feature request

Enable full support for Google Cloud's Application Default Credentials (ADC) when configuring the GCP Vertex AI provider for embeddings.

When Typesense is running on a GCP VM with a correctly configured Service Account, a user should be able to create or update a collection schema with a minimal model_config that omits all explicit authentication keys. The underlying Google client library should automatically and securely authenticate using the VM's attached identity.

The ideal, working configuration should be as simple as this:

json
"model_config": {
  "model_name": "gcp/gemini-embedding-001",
  "project_id": "my-gcp-project-id",
  "region": "us-central1",
  "document_task": "RETRIEVAL_DOCUMENT",
  "query_task": "RETRIEVAL_QUERY"
}

Please describe your use-case for the feature request

I am building a Telegram bot that provides semantic search over a pharmacy's inventory. My architecture consists of:

• A Typesense server running on a Google Cloud Compute Engine (GCP) VM.
• The Typesense collection uses the gemini-embedding-001 model from GCP Vertex AI for auto-embedding generation.

This feature request is crucial for the security and manageability of my deployment. The standard, Google-recommended best practice for server-to-server authentication within GCP is to use an attached Service Account, which relies on Application Default Credentials. This avoids the need to manage, distribute, and rotate secret key files or refresh tokens manually.

Describe alternatives you've considered

I have attempted to configure this using several logical methods, but the current validator in v29.0 creates a "Catch-22" situation that makes it impossible to use Application Default Credentials for schema updates.

Alternative 1: Omitting all auth fields (The ideal ADC approach)
I tried providing a minimal model_config with no authentication keys.

• Result: This failed with a validation error, proving that the authentication keys are mandatory.
• Error: {"message":"Property 'embed.model_config.access_token' is missing or is not a string."} (and subsequently for refresh_token, etc.).

Alternative 2: Providing all auth fields as empty strings
I tried providing all the authentication keys from the documentation (access_token, refresh_token, client_id, client_secret) with empty string values ("").

• Result: This failed with a different validation error, proving that the presence of these keys triggers an OAuth 2.0 validation path that fails on empty strings.
• Error: {"message":"Invalid client_id, client_secret or refresh_token in 'embed.model_config'."}

This creates a deadlock: the authentication keys are mandatory according to the parser, but providing them in any non-OAuth-flow manner results in a validation failure. This makes the ADC authentication path for server-to-server communication effectively unusable for schema updates.

Additional context

• Typesense Version: v29.0
• Operating System: Debian 11 (Bullseye)
• Deployment Platform: Google Cloud Compute Engine VM
• Authentication Goal: Use an attached Service Account with the Vertex AI User IAM role.

Start with the Vertex AI embeddings provider's model_config validation in v29.0, then trace how authentication is initialized after validation. Verify that the minimal configuration using an attached GCP service account succeeds through schema creation or update, while existing OAuth configurations continue to work.