feat(auth): implement regional access boundary support for standalone JWT and async service accounts by nbayati · Pull Request #17025 · googleapis/google-cloud-python

nbayati · 2026-05-11T16:36:44Z

This PR implements the following changes:

Add RAB support to async service account credential type, by providing async manager and fetching methods.
Update unit tests to accept both mtls and standard lookup endpoint urls.
Refactor before_request to use a _after_refresh hook so we don't have to override the method.
Add RAb support for self signed jwt flow through jwt.py
some small enhancements for test coverage and backward compatibility

…ement async refresh manager

…ndpoint.

…support Regional Access Boundary logic

gemini-code-assist

Code Review

This pull request implements asynchronous support for Regional Access Boundary (RAB) management, including background refresh tasks and mTLS endpoint support. Key changes include the addition of _AsyncRegionalAccessBoundaryRefreshManager, updates to JWT and service account credentials to handle RAB state during cloning and serialization, and comprehensive test coverage for these new flows. However, a critical issue was identified where the refresh method in google/auth/jwt.py was renamed to _perform_refresh_token, which will break token updates as the base class expects a refresh method. Additionally, a typo was found in a test assertion URL.

macastelaz · 2026-05-12T17:16:30Z

+        self._worker_task = None
+
+    def __getstate__(self):
+        """Pickle helper that serializes the _lock and _worker_task attributes."""


This comment seems misleading/incorrect to me. From what I can tell, this removes these attributes from the serialization of this manager entirely (it doesn't help in/allow the attributes to be serialized).

macastelaz · 2026-05-12T17:17:15Z

+        return state
+
+    def __setstate__(self, state):
+        """Pickle helper that deserializes the _lock and _worker_task attributes."""


Similarly, I don't think this is actually deserializing anything for these attributes, but it is re-initiating them

lsirac · 2026-05-12T21:02:56Z

+        except asyncio.TimeoutError:
+            return False, {}, False
+
+        response_body1 = await response.content()


This is an async_generator, not an awaitable method. I think this crashes as written. Should call await response.read() instead.

Let's also add a test that will catch this, and cover in try/catch block

lsirac · 2026-05-12T21:08:05Z

+        try:
+            if timeout:
+                response = await asyncio.wait_for(
+                    request(method="GET", url=url, headers=headers), timeout=timeout


Should timeout be passed to the request here?

lsirac · 2026-05-12T21:11:42Z

+                )
+            else:
+                response = await request(method="GET", url=url, headers=headers)
+        except asyncio.TimeoutError:


What happens if the request fails? I think we may need to catch additional errors here (timeout error, transport error..)

lsirac · 2026-05-12T21:15:19Z

@@ -369,6 +401,8 @@ def _copy_regional_access_boundary_manager(self, target):
        # but share the immutable data reference to avoid unnecessary initial lookups.
        new_manager = _regional_access_boundary_utils._RegionalAccessBoundaryManager()
        new_manager._data = self._rab_manager._data
+        # Preserve the type of refresh manager (sync or async)
+        new_manager.refresh_manager = self._rab_manager.refresh_manager.__class__()


I don't think this is safe across sync/async creds.

Using the source refresh-manager means we can have an async refresh manager on a sync cred which can later call asyncio.create_task() from a sync before_request.

_use_blocking_regional_access_boundary_lookup is not kept, so a credential configured for blocking RAB can become non-blocking after with_scopes(), with_quota_project(), etc (breaking gcloud)

I think the cred should keep its initialized manager type and we should only copy the RAB data/config.

lsirac · 2026-05-12T21:27:11Z

+        # Error was already logged by _lookup_regional_access_boundary_request
+        return None
+
+    if "encodedLocations" not in response_data:


Nit: should fail open on bad server responses, so we should check that response_data is a dict

lsirac · 2026-05-12T21:50:31Z

+        except ValueError:
+            response_data = response_body
+
+        if response.status == http_client.OK:


In google.auth.aio.transport.Response, the HTTP status code is exposed via the status_code property, not status. Passing a compliant google.auth.aio transport callable raises AttributeError: 'Response' object has no attribute 'status'. Please update the async lookup and grant methods to check .status_code.

lsirac · 2026-05-12T21:52:34Z

@@ -288,3 +289,145 @@ async def refresh_grant(
        request, token_uri, body, can_retry=can_retry
    )
    return client._handle_refresh_grant_response(response_data, refresh_token)
+
+


is _jwt_async.py out of scope?

lsirac · 2026-05-12T21:53:12Z

        await credentials_async.Credentials.before_request(
            self, request, method, url, headers
        )
+        self._maybe_start_regional_access_boundary_refresh(request, url)
+        self._rab_manager.apply_headers(headers)


This may be redundant, why is this needed?

lsirac · 2026-05-12T21:55:17Z

+                # A refresh is already in progress.
+                return
+
+            async def _worker():


Unlike the synchronous refresh manager which safely deepcopies the transport (copied_request = copy.deepcopy(request)), the async manager passes the exact same request instance directly into the background coroutine task. Because start_refresh is invoked inside before_request, the main application coroutine immediately proceeds to make its actual service API HTTP call using the exact same request transport while the background task is concurrently using it, risking HTTP state corruption or interleaved headers.

Additionally, spawning asyncio.create_task(_worker()) without tracking cancellation hooks upon client session closure can potentially cause dangling tasks that raise RuntimeError: Session is closed when executing against closed client sessions.

lsirac · 2026-05-12T21:56:50Z

@@ -66,6 +67,12 @@ class Credentials(
        credentials = credentials.with_quota_project('myproject-123')
    """

+    def __init__(self, *args, **kwargs):


_service_account_async.Credentials lacks a __setstate__ override. When older pickled async credentials unpickle, they fall back to CredentialsWithRegionalAccessBoundary.__setstate__, which attaches a synchronous _RegionalAccessBoundaryRefreshManager. If a background RAB lookup triggers on this unpickled credential, a synchronous background thread will invoke async def _lookup_regional_access_boundary synchronously without awaiting it, causing a fatal thread crash (AttributeError: 'coroutine' object has no attribute 'get'). Please implement __setstate__ to ensure self._rab_manager.refresh_manager is always restored as an _AsyncRegionalAccessBoundaryRefreshManager().

nbayati added 8 commits May 7, 2026 17:12

feat: add async support for RAB to ServiceAccountCredentials and impl…

b33d818

…ement async refresh manager

Add unit tests for the async RAB implementation.

80529c6

fix async unit tests

73617c5

Update unit tests to accept both mtls and standard allowedLocations e…

9e43ecc

…ndpoint.

test: verify iam endpoint constant resolution in mTLS environments

4d5787b

refactor: introduce _after_refresh hook in Credentials base class to …

e3f8e90

…support Regional Access Boundary logic

add __setstate__ to the base RAB class for backward compatibility

95af8e5

Implement RAB support for jwt credentials

1b4270b

gemini-code-assist Bot reviewed May 11, 2026

View reviewed changes

Comment thread packages/google-auth/google/auth/jwt.py

Comment thread packages/google-auth/tests/test_external_account_authorized_user.py Outdated

nbayati changed the title ~~Add RAB support for async SA and jwt.py~~ feat(auth): implement regional access boundary support for standalone JWT and async service accounts May 11, 2026

fix lint errors

0478330

nbayati marked this pull request as ready for review May 11, 2026 20:40

nbayati requested review from a team as code owners May 11, 2026 20:40

fix: preserve refresh manager type when copying RAB manager

9650ac7

macastelaz self-assigned this May 12, 2026

macastelaz approved these changes May 12, 2026

View reviewed changes

lsirac requested changes May 12, 2026

View reviewed changes

Conversation

nbayati commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

nbayati commented May 11, 2026 •

edited

Loading