Skip to content

Commit 0bf0220

Browse files
vvermanvverman
committed
Reintroduced env variables.
1 parent a6f6b90 commit 0bf0220

12 files changed

Lines changed: 127 additions & 71 deletions

‎oauth2_http/java/com/google/auth/oauth2/GoogleCredentials.java‎

Lines changed: 5 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -111,11 +111,6 @@ String getFileType() {
111111
private final String universeDomain;
112112
private final boolean isExplicitUniverseDomain;
113113

114-
// Note: this is for internal testing use use only.
115-
// TODO: Fix unit test mocks so this can be removed
116-
// Refer -> https://github.com/googleapis/google-auth-library-java/issues/1898
117-
@VisibleForTesting static boolean disableRabRefreshForTest = false;
118-
119114
transient RegionalAccessBoundaryManager regionalAccessBoundaryManager =
120115
new RegionalAccessBoundaryManager(clock);
121116

@@ -366,10 +361,9 @@ void refreshRegionalAccessBoundaryIfExpired(
366361
@Nullable AccessToken token,
367362
@Nullable java.util.concurrent.Executor executor)
368363
throws IOException {
369-
if (disableRabRefreshForTest) {
370-
return;
371-
}
372-
if (!(this instanceof RegionalAccessBoundaryProvider) || !isDefaultUniverseDomain()) {
364+
if (!(this instanceof RegionalAccessBoundaryProvider)
365+
|| !RegionalAccessBoundary.isEnabled()
366+
|| !isDefaultUniverseDomain()) {
373367
return;
374368
}
375369

@@ -539,8 +533,8 @@ static Map<String, List<String>> addQuotaProjectIdToRequestMetadata(
539533
}
540534

541535
/**
542-
* Adds Regional Access Boundary header to requestMetadata if available. Overwrites if present.
543-
* If the current RAB is null, it removes any stale header that might have survived serialization.
536+
* Adds Regional Access Boundary header to requestMetadata if available. Overwrites if present. If
537+
* the current RAB is null, it removes any stale header that might have survived serialization.
544538
*
545539
* @param uri The URI of the request.
546540
* @param requestMetadata The request metadata.

‎oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundary.java‎

Lines changed: 36 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@
5252
import java.io.Serializable;
5353
import java.util.Collections;
5454
import java.util.List;
55+
import javax.annotation.Nullable;
5556

5657
/**
5758
* Represents the regional access boundary configuration for a credential. This class holds the
@@ -65,6 +66,10 @@ public final class RegionalAccessBoundary implements Serializable {
6566
public static final String X_ALLOWED_LOCATIONS_HEADER_KEY = "x-allowed-locations";
6667
private static final long serialVersionUID = -2428522338274020302L;
6768

69+
// Note: this is for internal testing use use only.
70+
// TODO: Fix unit test mocks so this can be removed
71+
// Refer -> https://github.com/googleapis/google-auth-library-java/issues/1898
72+
static final String ENABLE_EXPERIMENT_ENV_VAR = "GOOGLE_AUTH_TRUST_BOUNDARY_ENABLE_EXPERIMENT";
6873
static final long TTL_MILLIS = 6 * 60 * 60 * 1000L; // 6 hours
6974
static final long REFRESH_THRESHOLD_MILLIS = 1 * 60 * 60 * 1000L; // 1 hour
7075

@@ -73,6 +78,8 @@ public final class RegionalAccessBoundary implements Serializable {
7378
private final long refreshTime;
7479
private final transient Clock clock;
7580

81+
private static EnvironmentProvider environmentProvider = SystemEnvironmentProvider.getInstance();
82+
7683
/**
7784
* Creates a new RegionalAccessBoundary instance.
7885
*
@@ -164,6 +171,30 @@ public String toString() {
164171
}
165172
}
166173

174+
@VisibleForTesting
175+
static void setEnvironmentProviderForTest(@Nullable EnvironmentProvider provider) {
176+
environmentProvider = provider == null ? SystemEnvironmentProvider.getInstance() : provider;
177+
}
178+
179+
/**
180+
* Checks if the regional access boundary feature is enabled. The feature is enabled if the
181+
* environment variable or system property "GOOGLE_AUTH_TRUST_BOUNDARY_ENABLE_EXPERIMENT" is set
182+
* to "true" or "1" (case-insensitive).
183+
*
184+
* @return True if the regional access boundary feature is enabled, false otherwise.
185+
*/
186+
static boolean isEnabled() {
187+
String enabled = environmentProvider.getEnv(ENABLE_EXPERIMENT_ENV_VAR);
188+
if (enabled == null) {
189+
enabled = System.getProperty(ENABLE_EXPERIMENT_ENV_VAR);
190+
}
191+
if (enabled == null) {
192+
return false;
193+
}
194+
String lowercased = enabled.toLowerCase();
195+
return "true".equals(lowercased) || "1".equals(enabled);
196+
}
197+
167198
/**
168199
* Refreshes the regional access boundary by making a network call to the lookup endpoint.
169200
*
@@ -177,7 +208,11 @@ public String toString() {
177208
* @throws IOException If a network error occurs or the response is malformed.
178209
*/
179210
static RegionalAccessBoundary refresh(
180-
HttpTransportFactory transportFactory, String url, AccessToken accessToken, Clock clock, int maxRetryElapsedTimeMillis)
211+
HttpTransportFactory transportFactory,
212+
String url,
213+
AccessToken accessToken,
214+
Clock clock,
215+
int maxRetryElapsedTimeMillis)
181216
throws IOException {
182217
Preconditions.checkNotNull(accessToken, "The provided access token is null.");
183218
if (accessToken.getExpirationTimeMillis() != null

‎oauth2_http/javatests/com/google/auth/oauth2/AwsCredentialsTest.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -65,13 +65,11 @@
6565
public class AwsCredentialsTest extends BaseSerializationTest {
6666

6767
@org.junit.Before
68-
public void setUp() {
69-
GoogleCredentials.disableRabRefreshForTest = true;
70-
}
68+
public void setUp() {}
7169

7270
@org.junit.After
7371
public void tearDown() {
74-
GoogleCredentials.disableRabRefreshForTest = false;
72+
RegionalAccessBoundary.setEnvironmentProviderForTest(null);
7573
}
7674

7775
private static final String STS_URL = "https://sts.googleapis.com/v1/token";
@@ -1412,7 +1410,9 @@ public AwsSecurityCredentials getCredentials(ExternalAccountSupplierContext cont
14121410

14131411
@Test
14141412
public void testRefresh_regionalAccessBoundarySuccess() throws IOException, InterruptedException {
1415-
GoogleCredentials.disableRabRefreshForTest = false;
1413+
TestEnvironmentProvider environmentProvider = new TestEnvironmentProvider();
1414+
RegionalAccessBoundary.setEnvironmentProviderForTest(environmentProvider);
1415+
environmentProvider.setEnv(RegionalAccessBoundary.ENABLE_EXPERIMENT_ENV_VAR, "1");
14161416

14171417
MockExternalAccountCredentialsTransportFactory transportFactory =
14181418
new MockExternalAccountCredentialsTransportFactory();

‎oauth2_http/javatests/com/google/auth/oauth2/ComputeEngineCredentialsTest.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -80,13 +80,11 @@
8080
public class ComputeEngineCredentialsTest extends BaseSerializationTest {
8181

8282
@org.junit.Before
83-
public void setUp() {
84-
GoogleCredentials.disableRabRefreshForTest = true;
85-
}
83+
public void setUp() {}
8684

8785
@org.junit.After
8886
public void tearDown() {
89-
GoogleCredentials.disableRabRefreshForTest = false;
87+
RegionalAccessBoundary.setEnvironmentProviderForTest(null);
9088
}
9189

9290
private static final URI CALL_URI = URI.create("http://googleapis.com/testapi/v1/foo");
@@ -1158,7 +1156,9 @@ public void idTokenWithAudience_503StatusCode() {
11581156

11591157
@Test
11601158
public void refresh_regionalAccessBoundarySuccess() throws IOException, InterruptedException {
1161-
GoogleCredentials.disableRabRefreshForTest = false;
1159+
TestEnvironmentProvider environmentProvider = new TestEnvironmentProvider();
1160+
RegionalAccessBoundary.setEnvironmentProviderForTest(environmentProvider);
1161+
environmentProvider.setEnv(RegionalAccessBoundary.ENABLE_EXPERIMENT_ENV_VAR, "1");
11621162

11631163
String defaultAccountEmail = "default@email.com";
11641164
MockMetadataServerTransportFactory transportFactory = new MockMetadataServerTransportFactory();

‎oauth2_http/javatests/com/google/auth/oauth2/ExternalAccountAuthorizedUserCredentialsTest.java‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -128,13 +128,12 @@ public HttpTransport create() {
128128

129129
@Before
130130
public void setup() {
131-
GoogleCredentials.disableRabRefreshForTest = true;
132131
transportFactory = new MockExternalAccountAuthorizedUserCredentialsTransportFactory();
133132
}
134133

135134
@org.junit.After
136135
public void tearDown() {
137-
GoogleCredentials.disableRabRefreshForTest = false;
136+
RegionalAccessBoundary.setEnvironmentProviderForTest(null);
138137
}
139138

140139
@Test
@@ -1223,7 +1222,9 @@ public void toString_expectedFormat() {
12231222

12241223
@Test
12251224
public void testRefresh_regionalAccessBoundarySuccess() throws IOException, InterruptedException {
1226-
GoogleCredentials.disableRabRefreshForTest = false;
1225+
TestEnvironmentProvider environmentProvider = new TestEnvironmentProvider();
1226+
RegionalAccessBoundary.setEnvironmentProviderForTest(environmentProvider);
1227+
environmentProvider.setEnv(RegionalAccessBoundary.ENABLE_EXPERIMENT_ENV_VAR, "1");
12271228

12281229
ExternalAccountAuthorizedUserCredentials credentials =
12291230
ExternalAccountAuthorizedUserCredentials.newBuilder()

‎oauth2_http/javatests/com/google/auth/oauth2/ExternalAccountCredentialsTest.java‎

Lines changed: 17 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -89,13 +89,12 @@ public HttpTransport create() {
8989

9090
@Before
9191
public void setup() {
92-
GoogleCredentials.disableRabRefreshForTest = true;
9392
transportFactory = new MockExternalAccountCredentialsTransportFactory();
9493
}
9594

9695
@org.junit.After
9796
public void tearDown() {
98-
GoogleCredentials.disableRabRefreshForTest = false;
97+
RegionalAccessBoundary.setEnvironmentProviderForTest(null);
9998
}
10099

101100
@Test
@@ -1311,7 +1310,9 @@ public void getRegionalAccessBoundaryUrl_invalidAudience_throws() {
13111310
@Test
13121311
public void refresh_workload_regionalAccessBoundarySuccess()
13131312
throws IOException, InterruptedException {
1314-
GoogleCredentials.disableRabRefreshForTest = false;
1313+
TestEnvironmentProvider environmentProvider = new TestEnvironmentProvider();
1314+
RegionalAccessBoundary.setEnvironmentProviderForTest(environmentProvider);
1315+
environmentProvider.setEnv(RegionalAccessBoundary.ENABLE_EXPERIMENT_ENV_VAR, "1");
13151316
String audience =
13161317
"//iam.googleapis.com/projects/12345/locations/global/workloadIdentityPools/my-pool/providers/my-provider";
13171318

@@ -1346,7 +1347,9 @@ public String retrieveSubjectToken() throws IOException {
13461347
@Test
13471348
public void refresh_workforce_regionalAccessBoundarySuccess()
13481349
throws IOException, InterruptedException {
1349-
GoogleCredentials.disableRabRefreshForTest = false;
1350+
TestEnvironmentProvider environmentProvider = new TestEnvironmentProvider();
1351+
RegionalAccessBoundary.setEnvironmentProviderForTest(environmentProvider);
1352+
environmentProvider.setEnv(RegionalAccessBoundary.ENABLE_EXPERIMENT_ENV_VAR, "1");
13501353
String audience =
13511354
"//iam.googleapis.com/locations/global/workforcePools/my-pool/providers/my-provider";
13521355

@@ -1381,7 +1384,9 @@ public String retrieveSubjectToken() throws IOException {
13811384
@Test
13821385
public void refresh_impersonated_workload_regionalAccessBoundarySuccess()
13831386
throws IOException, InterruptedException {
1384-
GoogleCredentials.disableRabRefreshForTest = false;
1387+
TestEnvironmentProvider environmentProvider = new TestEnvironmentProvider();
1388+
RegionalAccessBoundary.setEnvironmentProviderForTest(environmentProvider);
1389+
environmentProvider.setEnv(RegionalAccessBoundary.ENABLE_EXPERIMENT_ENV_VAR, "1");
13851390
String projectNumber = "12345";
13861391
String poolId = "my-pool";
13871392
String providerId = "my-provider";
@@ -1397,7 +1402,8 @@ public void refresh_impersonated_workload_regionalAccessBoundarySuccess()
13971402
String.format(
13981403
IAM_CREDENTIALS_ALLOWED_LOCATIONS_URL_FORMAT_WORKLOAD_POOL, projectNumber, poolId);
13991404
RegionalAccessBoundary workloadRab =
1400-
new RegionalAccessBoundary("workload-encoded", Collections.singletonList("workload-loc"), null);
1405+
new RegionalAccessBoundary(
1406+
"workload-encoded", Collections.singletonList("workload-loc"), null);
14011407
transportFactory.transport.addRegionalAccessBoundary(workloadRabUrl, workloadRab);
14021408

14031409
String saEmail =
@@ -1442,7 +1448,9 @@ public void refresh_impersonated_workload_regionalAccessBoundarySuccess()
14421448
@Test
14431449
public void refresh_impersonated_workforce_regionalAccessBoundarySuccess()
14441450
throws IOException, InterruptedException {
1445-
GoogleCredentials.disableRabRefreshForTest = false;
1451+
TestEnvironmentProvider environmentProvider = new TestEnvironmentProvider();
1452+
RegionalAccessBoundary.setEnvironmentProviderForTest(environmentProvider);
1453+
environmentProvider.setEnv(RegionalAccessBoundary.ENABLE_EXPERIMENT_ENV_VAR, "1");
14461454
String poolId = "my-pool";
14471455
String providerId = "my-provider";
14481456
String audience =
@@ -1456,7 +1464,8 @@ public void refresh_impersonated_workforce_regionalAccessBoundarySuccess()
14561464
String workforceRabUrl =
14571465
String.format(IAM_CREDENTIALS_ALLOWED_LOCATIONS_URL_FORMAT_WORKFORCE_POOL, poolId);
14581466
RegionalAccessBoundary workforceRab =
1459-
new RegionalAccessBoundary("workforce-encoded", Collections.singletonList("workforce-loc"), null);
1467+
new RegionalAccessBoundary(
1468+
"workforce-encoded", Collections.singletonList("workforce-loc"), null);
14601469
transportFactory.transport.addRegionalAccessBoundary(workforceRabUrl, workforceRab);
14611470

14621471
String saEmail =

‎oauth2_http/javatests/com/google/auth/oauth2/GoogleCredentialsTest.java‎

Lines changed: 31 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -102,13 +102,11 @@ public class GoogleCredentialsTest extends BaseSerializationTest {
102102
private static final String TPC_UNIVERSE = "foo.bar";
103103

104104
@org.junit.Before
105-
public void setUp() {
106-
GoogleCredentials.disableRabRefreshForTest = true;
107-
}
105+
public void setUp() {}
108106

109107
@org.junit.After
110108
public void tearDown() {
111-
GoogleCredentials.disableRabRefreshForTest = false;
109+
RegionalAccessBoundary.setEnvironmentProviderForTest(null);
112110
}
113111

114112
@Test
@@ -803,12 +801,17 @@ public void serialize() throws IOException, ClassNotFoundException {
803801

804802
@Test
805803
public void serialize_removesStaleRabHeaders() throws Exception {
806-
GoogleCredentials.disableRabRefreshForTest = false;
804+
TestEnvironmentProvider environmentProvider = new TestEnvironmentProvider();
805+
RegionalAccessBoundary.setEnvironmentProviderForTest(environmentProvider);
806+
environmentProvider.setEnv(RegionalAccessBoundary.ENABLE_EXPERIMENT_ENV_VAR, "1");
807807

808808
MockTokenServerTransportFactory transportFactory = new MockTokenServerTransportFactory();
809809
RegionalAccessBoundary rab =
810810
new RegionalAccessBoundary(
811-
"test-encoded", Collections.singletonList("test-loc"), System.currentTimeMillis(), null);
811+
"test-encoded",
812+
Collections.singletonList("test-loc"),
813+
System.currentTimeMillis(),
814+
null);
812815
transportFactory.transport.setRegionalAccessBoundary(rab);
813816
transportFactory.transport.addServiceAccount(SA_CLIENT_EMAIL, ACCESS_TOKEN);
814817

@@ -842,8 +845,7 @@ public void serialize_removesStaleRabHeaders() throws Exception {
842845

843846
// The metadata should NOT contain the RAB header anymore, preventing stale headers.
844847
Map<String, List<String>> deserializedMetadata = deserialized.getRequestMetadata();
845-
assertNull(
846-
deserializedMetadata.get(RegionalAccessBoundary.X_ALLOWED_LOCATIONS_HEADER_KEY));
848+
assertNull(deserializedMetadata.get(RegionalAccessBoundary.X_ALLOWED_LOCATIONS_HEADER_KEY));
847849
}
848850

849851
@Test
@@ -998,7 +1000,9 @@ public void getCredentialInfo_impersonatedServiceAccount() throws IOException {
9981000
@Test
9991001
public void regionalAccessBoundary_shouldFetchAndReturnRegionalAccessBoundaryDataSuccessfully()
10001002
throws IOException, InterruptedException {
1001-
GoogleCredentials.disableRabRefreshForTest = false;
1003+
TestEnvironmentProvider environmentProvider = new TestEnvironmentProvider();
1004+
RegionalAccessBoundary.setEnvironmentProviderForTest(environmentProvider);
1005+
environmentProvider.setEnv(RegionalAccessBoundary.ENABLE_EXPERIMENT_ENV_VAR, "1");
10021006
MockTokenServerTransport transport = new MockTokenServerTransport();
10031007
transport.addServiceAccount(SA_CLIENT_EMAIL, ACCESS_TOKEN);
10041008
RegionalAccessBoundary regionalAccessBoundary =
@@ -1033,7 +1037,9 @@ public void regionalAccessBoundary_shouldFetchAndReturnRegionalAccessBoundaryDat
10331037
@Test
10341038
public void regionalAccessBoundary_shouldRetryRegionalAccessBoundaryLookupOnFailure()
10351039
throws IOException, InterruptedException {
1036-
GoogleCredentials.disableRabRefreshForTest = false;
1040+
TestEnvironmentProvider environmentProvider = new TestEnvironmentProvider();
1041+
RegionalAccessBoundary.setEnvironmentProviderForTest(environmentProvider);
1042+
environmentProvider.setEnv(RegionalAccessBoundary.ENABLE_EXPERIMENT_ENV_VAR, "1");
10371043

10381044
// This transport will be used for the regional access boundary lookup.
10391045
// We will configure it to fail on the first attempt.
@@ -1085,7 +1091,9 @@ public com.google.api.client.http.LowLevelHttpRequest buildRequest(
10851091
@Test
10861092
public void regionalAccessBoundary_refreshShouldNotThrowWhenNoValidAccessTokenIsPassed()
10871093
throws IOException {
1088-
GoogleCredentials.disableRabRefreshForTest = false;
1094+
TestEnvironmentProvider environmentProvider = new TestEnvironmentProvider();
1095+
RegionalAccessBoundary.setEnvironmentProviderForTest(environmentProvider);
1096+
environmentProvider.setEnv(RegionalAccessBoundary.ENABLE_EXPERIMENT_ENV_VAR, "1");
10891097
MockTokenServerTransport transport = new MockTokenServerTransport();
10901098
// Return an expired access token.
10911099
transport.addServiceAccount(SA_CLIENT_EMAIL, "expired-token");
@@ -1108,7 +1116,9 @@ public void regionalAccessBoundary_refreshShouldNotThrowWhenNoValidAccessTokenIs
11081116
@Test
11091117
public void regionalAccessBoundary_cooldownDoublingAndRefresh()
11101118
throws IOException, InterruptedException {
1111-
GoogleCredentials.disableRabRefreshForTest = false;
1119+
TestEnvironmentProvider environmentProvider = new TestEnvironmentProvider();
1120+
RegionalAccessBoundary.setEnvironmentProviderForTest(environmentProvider);
1121+
environmentProvider.setEnv(RegionalAccessBoundary.ENABLE_EXPERIMENT_ENV_VAR, "1");
11121122
MockTokenServerTransport transport = new MockTokenServerTransport();
11131123
transport.addServiceAccount(SA_CLIENT_EMAIL, ACCESS_TOKEN);
11141124
// Always fail lookup for now.
@@ -1168,7 +1178,9 @@ public void regionalAccessBoundary_cooldownDoublingAndRefresh()
11681178

11691179
@Test
11701180
public void regionalAccessBoundary_shouldFailOpenWhenRefreshCannotBeStarted() throws IOException {
1171-
GoogleCredentials.disableRabRefreshForTest = false;
1181+
TestEnvironmentProvider environmentProvider = new TestEnvironmentProvider();
1182+
RegionalAccessBoundary.setEnvironmentProviderForTest(environmentProvider);
1183+
environmentProvider.setEnv(RegionalAccessBoundary.ENABLE_EXPERIMENT_ENV_VAR, "1");
11721184
// Use a simple AccessToken-based credential that won't try to refresh.
11731185
GoogleCredentials credentials = GoogleCredentials.create(new AccessToken("some-token", null));
11741186

@@ -1180,7 +1192,9 @@ public void regionalAccessBoundary_shouldFailOpenWhenRefreshCannotBeStarted() th
11801192
@Test
11811193
public void regionalAccessBoundary_deduplicationOfConcurrentRefreshes()
11821194
throws IOException, InterruptedException {
1183-
GoogleCredentials.disableRabRefreshForTest = false;
1195+
TestEnvironmentProvider environmentProvider = new TestEnvironmentProvider();
1196+
RegionalAccessBoundary.setEnvironmentProviderForTest(environmentProvider);
1197+
environmentProvider.setEnv(RegionalAccessBoundary.ENABLE_EXPERIMENT_ENV_VAR, "1");
11841198
MockTokenServerTransport transport = new MockTokenServerTransport();
11851199
transport.setRegionalAccessBoundary(
11861200
new RegionalAccessBoundary("valid", Collections.singletonList("us-central1"), null));
@@ -1209,7 +1223,9 @@ public void regionalAccessBoundary_deduplicationOfConcurrentRefreshes()
12091223

12101224
@Test
12111225
public void regionalAccessBoundary_shouldSkipRefreshForRegionalEndpoints() throws IOException {
1212-
GoogleCredentials.disableRabRefreshForTest = false;
1226+
TestEnvironmentProvider environmentProvider = new TestEnvironmentProvider();
1227+
RegionalAccessBoundary.setEnvironmentProviderForTest(environmentProvider);
1228+
environmentProvider.setEnv(RegionalAccessBoundary.ENABLE_EXPERIMENT_ENV_VAR, "1");
12131229
MockTokenServerTransport transport = new MockTokenServerTransport();
12141230
GoogleCredentials credentials = createTestCredentials(transport);
12151231

0 commit comments

Comments
 (0)