Can't make analytics calls work through a proxy server

[machinehum]

• OS: Debian GNU/Linux 12 (bookworm)
• PHP version: 8.2.15
• Package name and version: analytics-data 0.9.4, analytics-admin 0.10.0

I'm trying to retrieve Google Analytics 4 data with the google cloud PHP libraries and having a devil of a time with proxy settings (server is behind an outbound proxy). I'll start by saying that if I set the https_proxy env var, then everything works as expected, so my config is working otherwise. For various reasons that's not ideal and I'd rather deal with it in code, and that seems to be supported via things like passing an authHttpHandler to CredentialsWrapper, or rest transport configs, but I've tried a hundred permutations and can't make it work. I also can't find solid docs.

Here's one example (slightly simplified):

$proxyHttpClient =  new \GuzzleHttp\Client([
            'proxy'      => 'http://foo.com:3128',
            'exceptions' => false,
            'base_uri'   => 'https://www.googleapis.com'
        ]);

        $proxyHttpHandler = HttpHandlerFactory::build($proxyHttpClient);

        $credentialWrapper =  CredentialsWrapper::build(
            'keyFile' => $this->getClientConfiguration(),
            'authHttpHandler' => $proxyHttpHandler
        );

        $adminClient = new AnalyticsAdminServiceClient(['credentials' => $credentialWrapper, 'transportConfig' => ['rest' => ['httpHandler' => $proxyHttpHandler]]]);

        $adminClient->getProperty($propertyId);

This code times out at the proxy, at the first step of trying to reach oauth.googleapis.com. If I set https_proxy env var, it works. When I do some debug inspecting in CredentialsWrapper, it seems to be getting the correct arguments. I inspected a bunch of things at various points of GapicClientTrait::buildClientOptions and ::setClientOptions, and it seemed right. I tried a few permutations of the client constructor arguments, for example using credentialsConfig instead of constructing the CredentialsWrapper. No difference.

This feels hard to call a "bug" because there isn't real clear documentation the right way to do this, but I'm hoping to get some help here. In case it's useful this is what the credentialWrapper looks like at the end of GapicClientTrait:: setClientOptions:

credentialsWrapper:
Google\ApiCore\CredentialsWrapper::__set_state(array(
   'credentialsFetcher' =>
  Google\Auth\FetchAuthTokenCache::__set_state(array(
     'fetcher' =>
    Google\Auth\Credentials\UserRefreshCredentials::__set_state(array(
       'auth' =>
      Google\Auth\OAuth2::__set_state(array(
         'authorizationUri' => NULL,
         'tokenCredentialUri' =>
        GuzzleHttp\Psr7\Uri::__set_state(array(
           'scheme' => 'https',
           'userInfo' => '',
           'host' => 'oauth2.googleapis.com',
           'port' => NULL,
           'path' => '/token',
           'query' => '',
           'fragment' => '',
           'composedComponents' => NULL,
        )),
         'redirectUri' => NULL,
         'clientId' => 'XXXXXXXXX.apps.googleusercontent.com',
         'clientSecret' => 'XXXX-XXXXX-XXXXXXX',
         'username' => NULL,
         'password' => NULL,
         'scope' => NULL,
         'state' => NULL,
         'code' => NULL,
         'issuer' => NULL,
         'audience' => NULL,
         'sub' => NULL,
         'expiry' => 3600,
         'signingKey' => NULL,
         'signingKeyId' => NULL,
         'signingAlgorithm' => NULL,
         'refreshToken' => 'XXXXXXXXXXXX',
         'accessToken' => NULL,
         'idToken' => NULL,
         'grantedScope' => NULL,
         'expiresIn' => NULL,
         'expiresAt' => NULL,
         'issuedAt' => NULL,
         'grantType' => NULL,
         'extensionParams' =>
        array (
        ),
         'additionalClaims' =>
        array (
        ),
         'codeVerifier' => NULL,
         'resource' => NULL,
         'subjectTokenFetcher' => NULL,
         'subjectTokenType' => NULL,
         'actorToken' => NULL,
         'actorTokenType' => NULL,
         'issuedTokenType' => NULL,
      )),
       'quotaProject' => NULL,
    )),
     'eagerRefreshThresholdSeconds' => 10,
     'maxKeyLength' => 64,
     'cacheConfig' =>
    array (
      'lifetime' => 1500,
      'prefix' => '',
    ),
     'cache' =>
    Google\Auth\Cache\MemoryCacheItemPool::__set_state(array(
       'items' => NULL,
       'deferredItems' => NULL,
    )),
  )),
   'authHttpHandler' =>
  Auth\HttpHandler\Guzzle7HttpHandler::__set_state(array(
     'client' =>
    GuzzleHttp\Client::__set_state(array(
       'config' =>
      array (
        'proxy' => 'http://foo.com:3128',
        'exceptions' => false,
        'base_uri' =>
        GuzzleHttp\Psr7\Uri::__set_state(array(
           'scheme' => 'https',
           'userInfo' => '',
           'host' => 'www.googleapis.com',
           'port' => NULL,
           'path' => '',
           'query' => '',
           'fragment' => '',
           'composedComponents' => NULL,
        )),
        'handler' =>
        GuzzleHttp\HandlerStack::__set_state(array(
           'handler' =>
          \Closure::__set_state(array(
          )),
           'stack' =>
          array (
            0 =>
            array (
              0 =>
              \Closure::__set_state(array(
              )),
              1 => 'http_errors',
            ),
            1 =>
            array (
              0 =>
              \Closure::__set_state(array(
              )),
              1 => 'allow_redirects',
            ),
            2 =>
            array (
              0 =>
              \Closure::__set_state(array(
              )),
              1 => 'cookies',
            ),
            3 =>
            array (
              0 =>
              \Closure::__set_state(array(
              )),
              1 => 'prepare_body',
            ),
          ),
           'cached' => NULL,
        )),
        'allow_redirects' =>
        array (
          'max' => 5,
          'protocols' =>
          array (
            0 => 'http',
            1 => 'https',
          ),
          'strict' => false,
          'referer' => false,
          'track_redirects' => false,
        ),
        'http_errors' => true,
        'decode_content' => true,
        'verify' => true,
        'cookies' => false,
        'idn_conversion' => false,
        'headers' =>
        array (
          'User-Agent' => 'GuzzleHttp/7',
        ),
      ),
    )),
  )),
))