Executor is no longer used to execute RAB refresh.

Author: vverman

oauth2_http/java/com/google/auth/oauth2/GoogleCredentials.java

@@ -353,13 +353,9 @@ final RegionalAccessBoundary getRegionalAccessBoundary() {
    *
    * @param uri The URI of the outbound request.
    * @param token The access token to use for the refresh.
-   * @param executor The executor to use for the background task. If null, a new thread is created.
    * @throws IOException If getting the universe domain fails.
    */
-  void refreshRegionalAccessBoundaryIfExpired(
-      @Nullable URI uri,
-      @Nullable AccessToken token,
-      @Nullable java.util.concurrent.Executor executor)
+  void refreshRegionalAccessBoundaryIfExpired(@Nullable URI uri, @Nullable AccessToken token)
       throws IOException {
     if (!(this instanceof RegionalAccessBoundaryProvider)
         || !RegionalAccessBoundary.isEnabled()
@@ -388,7 +384,7 @@ void refreshRegionalAccessBoundaryIfExpired(
     }
 
     regionalAccessBoundaryManager.triggerAsyncRefresh(
-        transportFactory, (RegionalAccessBoundaryProvider) this, token, executor);
+        transportFactory, (RegionalAccessBoundaryProvider) this, token);
   }
 
   /**
@@ -397,12 +393,9 @@ void refreshRegionalAccessBoundaryIfExpired(
    *
    * @param uri The URI of the outbound request.
    * @param requestMetadata The request metadata containing the authorization header.
-   * @param executor The executor to use for the background task.
    */
   void refreshRegionalAccessBoundaryWithSelfSignedJwtIfExpired(
-      @Nullable URI uri,
-      Map<String, List<String>> requestMetadata,
-      @Nullable java.util.concurrent.Executor executor) {
+      @Nullable URI uri, Map<String, List<String>> requestMetadata) {
     List<String> authHeaders = requestMetadata.get(AuthHttpConstants.AUTHORIZATION);
     if (authHeaders != null && !authHeaders.isEmpty()) {
       String authHeader = authHeaders.get(0);
@@ -411,7 +404,7 @@ void refreshRegionalAccessBoundaryWithSelfSignedJwtIfExpired(
         // Use a null expiration as JWTs are short-lived anyway.
         AccessToken wrappedToken = new AccessToken(tokenValue, null);
         try {
-          refreshRegionalAccessBoundaryIfExpired(uri, wrappedToken, executor);
+          refreshRegionalAccessBoundaryIfExpired(uri, wrappedToken);
         } catch (IOException e) {
           // Ignore failure in async refresh trigger.
         }
@@ -436,7 +429,7 @@ public Map<String, List<String>> getRequestMetadata(URI uri) throws IOException
     metadata = addRegionalAccessBoundaryToRequestMetadata(uri, metadata);
     try {
       // Sets off an async refresh for request-metadata.
-      refreshRegionalAccessBoundaryIfExpired(uri, getAccessToken(), null);
+      refreshRegionalAccessBoundaryIfExpired(uri, getAccessToken());
     } catch (IOException e) {
       // Ignore failure in async refresh trigger.
     }
@@ -466,7 +459,7 @@ public void getRequestMetadata(
           public void onSuccess(Map<String, List<String>> metadata) {
             metadata = addRegionalAccessBoundaryToRequestMetadata(uri, metadata);
             try {
-              refreshRegionalAccessBoundaryIfExpired(uri, getAccessToken(), executor);
+              refreshRegionalAccessBoundaryIfExpired(uri, getAccessToken());
             } catch (IOException e) {
               // Ignore failure in async refresh trigger.
             }

oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundaryManager.java

@@ -121,13 +121,11 @@ RegionalAccessBoundary getCachedRAB() {
    * @param transportFactory The HTTP transport factory to use for the lookup.
    * @param provider The provider used to retrieve the lookup endpoint URL.
    * @param accessToken The access token for authentication.
-   * @param executor The executor to use for the background task. If null, a new thread is created.
    */
   void triggerAsyncRefresh(
       final HttpTransportFactory transportFactory,
       final RegionalAccessBoundaryProvider provider,
-      final AccessToken accessToken,
-      @Nullable final java.util.concurrent.Executor executor) {
+      final AccessToken accessToken) {
     if (isCooldownActive()) {
       return;
     }
@@ -163,18 +161,14 @@ void triggerAsyncRefresh(
           };
 
       try {
-        if (executor != null) {
-          executor.execute(refreshTask);
-        } else {
-          // We use new Thread() here instead of
-          // CompletableFuture.runAsync() (which uses ForkJoinPool.commonPool()).
-          // This avoids consuming CPU resources since
-          // The common pool has a small, fixed number of threads designed for
-          // CPU-bound tasks.
-          Thread refreshThread = new Thread(refreshTask, "RAB-refresh-thread");
-          refreshThread.setDaemon(true);
-          refreshThread.start();
-        }
+        // We use new Thread() here instead of
+        // CompletableFuture.runAsync() (which uses ForkJoinPool.commonPool()).
+        // This avoids consuming CPU resources since
+        // The common pool has a small, fixed number of threads designed for
+        // CPU-bound tasks.
+        Thread refreshThread = new Thread(refreshTask, "RAB-refresh-thread");
+        refreshThread.setDaemon(true);
+        refreshThread.start();
       } catch (Exception | Error e) {
         // If scheduling fails (e.g., RejectedExecutionException, OutOfMemoryError for threads),
         // the task's finally block will never execute. We must release the lock here.

oauth2_http/java/com/google/auth/oauth2/ServiceAccountCredentials.java

@@ -1148,7 +1148,7 @@ private Map<String, List<String>> getRequestMetadataWithSelfSignedJwt(URI uri)
 
     Map<String, List<String>> requestMetadata = jwtCredentials.getRequestMetadata(null);
     requestMetadata = addRegionalAccessBoundaryToRequestMetadata(uri, requestMetadata);
-    refreshRegionalAccessBoundaryWithSelfSignedJwtIfExpired(uri, requestMetadata, null);
+    refreshRegionalAccessBoundaryWithSelfSignedJwtIfExpired(uri, requestMetadata);
     return addQuotaProjectIdToRequestMetadata(quotaProjectId, requestMetadata);
   }
 

oauth2_http/javatests/com/google/auth/oauth2/GoogleCredentialsTest.java

@@ -1247,10 +1247,7 @@ public AccessToken refreshAccessToken() throws IOException {
 
           @Override
           void refreshRegionalAccessBoundaryIfExpired(
-              @Nullable URI uri,
-              @Nullable AccessToken token,
-              @Nullable java.util.concurrent.Executor executor)
-              throws IOException {
+              @Nullable URI uri, @Nullable AccessToken token) throws IOException {
             throw new IOException("Simulated RAB failure");
           }
         };
@@ -1272,10 +1269,7 @@ public AccessToken refreshAccessToken() throws IOException {
 
           @Override
           void refreshRegionalAccessBoundaryIfExpired(
-              @Nullable URI uri,
-              @Nullable AccessToken token,
-              @Nullable java.util.concurrent.Executor executor)
-              throws IOException {
+              @Nullable URI uri, @Nullable AccessToken token) throws IOException {
             throw new IOException("Simulated RAB failure");
           }
         };

oauth2_http/javatests/com/google/auth/oauth2/RegionalAccessBoundaryTest.java

@@ -153,7 +153,7 @@ public void testManagerTriggersRefreshInGracePeriod() throws InterruptedExceptio
     RegionalAccessBoundaryManager manager = new RegionalAccessBoundaryManager(testClock);
 
     // 1. Let's first get a RAB into the cache
-    manager.triggerAsyncRefresh(transportFactory, provider, token, null);
+    manager.triggerAsyncRefresh(transportFactory, provider, token);
 
     // Wait for it to be cached
     int retries = 0;
@@ -184,7 +184,7 @@ public void testManagerTriggersRefreshInGracePeriod() throws InterruptedExceptio
     HttpTransportFactory transportFactory2 = () -> transport2;
 
     // 4. Trigger refresh - should start because we are in grace period
-    manager.triggerAsyncRefresh(transportFactory2, provider, token, null);
+    manager.triggerAsyncRefresh(transportFactory2, provider, token);
 
     // 5. Wait for background refresh to complete
     // We expect the cached RAB to eventually change to newerEncoded
@@ -205,46 +205,6 @@ public void testManagerTriggersRefreshInGracePeriod() throws InterruptedExceptio
     assertEquals(newerEncoded, resultRab.getEncodedLocations());
   }
 
-  @Test
-  public void testManagerReleasesLockOnSchedulingFailure() {
-    RegionalAccessBoundaryManager manager = new RegionalAccessBoundaryManager(testClock);
-    HttpTransportFactory transportFactory = () -> new MockHttpTransport();
-    RegionalAccessBoundaryProvider provider = () -> "https://dummy";
-    AccessToken token =
-        new AccessToken("token", new java.util.Date(System.currentTimeMillis() + 10 * 3600000L));
-
-    java.util.concurrent.Executor rejectingExecutor =
-        new java.util.concurrent.Executor() {
-          @Override
-          public void execute(Runnable command) {
-            throw new java.util.concurrent.RejectedExecutionException("Simulated rejection");
-          }
-        };
-
-    manager.triggerAsyncRefresh(transportFactory, provider, token, rejectingExecutor);
-
-    // After rejection, the lock should be released, but it should be in cooldown.
-    assertTrue(manager.isCooldownActive());
-
-    // Advance the clock to bypass cooldown
-    testClock.set(
-        testClock.currentTimeMillis() + RegionalAccessBoundaryManager.MAX_COOLDOWN_MILLIS + 1000);
-    assertFalse(manager.isCooldownActive());
-
-    // Schedule again with a valid executor to prove the lock was released.
-    java.util.concurrent.atomic.AtomicBoolean taskRan =
-        new java.util.concurrent.atomic.AtomicBoolean(false);
-    java.util.concurrent.Executor workingExecutor =
-        new java.util.concurrent.Executor() {
-          @Override
-          public void execute(Runnable command) {
-            taskRan.set(true);
-          }
-        };
-    manager.triggerAsyncRefresh(transportFactory, provider, token, workingExecutor);
-    assertTrue(taskRan.get());
-  }
-
   private static class TestClock implements Clock {
     private final AtomicLong currentTime = new AtomicLong(System.currentTimeMillis());