Merge branch 'main' into id-sign

zhumin8 · web-flow · commit 9831d5db3acc · 2024-12-17T14:38:59.000-05:00
diff --git a/.github/workflows/sonar.yaml b/.github/workflows/sonar.yaml
@@ -39,7 +39,6 @@ jobs:
             -DenableFullTestCoverage \
             -Dsonar.coverage.jacoco.xmlReportPaths=oauth2_http/target/site/jacoco/jacoco.xml \
             org.sonarsource.scanner.maven:sonar-maven-plugin:sonar \
-            -Pcoverage \
             -Dsonar.projectKey=googleapis_google-auth-library-java \
             -Dsonar.organization=googleapis \
-            -Dsonar.host.url=https://sonarcloud.io
+            -Dsonar.host.url=https://sonarcloud.io
diff --git a/.kokoro/build.sh b/.kokoro/build.sh
@@ -72,11 +72,15 @@ integration)
     ;;
 graalvmA)
     # Run Unit and Integration Tests with Native Image
+    bash .kokoro/populate-secrets.sh
+    export GOOGLE_APPLICATION_CREDENTIALS="${KOKORO_GFILE_DIR}/secret_manager/java-it-service-account"
     mvn -B ${INTEGRATION_TEST_ARGS} -ntp -Pnative -Pnative-test test -pl 'oauth2_http'
     RETURN_CODE=$?
     ;;
 graalvmB)
     # Run Unit and Integration Tests with Native Image
+    bash .kokoro/populate-secrets.sh
+    export GOOGLE_APPLICATION_CREDENTIALS="${KOKORO_GFILE_DIR}/secret_manager/java-it-service-account"
     mvn -B ${INTEGRATION_TEST_ARGS} -ntp -Pnative -Pnative-test test -pl 'oauth2_http'
     RETURN_CODE=$?
     ;;
diff --git a/.kokoro/populate-secrets.sh b/.kokoro/populate-secrets.sh
@@ -28,13 +28,19 @@ mkdir -p ${SECRET_LOCATION}
 for key in $(echo ${SECRET_MANAGER_KEYS} | sed "s/,/ /g")
 do
   msg "Retrieving secret ${key}"
-  docker run --entrypoint=gcloud \
-    --volume=${KOKORO_GFILE_DIR}:${KOKORO_GFILE_DIR} \
-    gcr.io/google.com/cloudsdktool/cloud-sdk \
-    secrets versions access latest \
+  if [[ "${JOB_TYPE}" == *"graalvm"* ]]; then
+    gcloud secrets versions access latest \
     --project cloud-devrel-kokoro-resources \
-    --secret ${key} > \
-    "${SECRET_LOCATION}/${key}"
+    --secret ${key} > "${SECRET_LOCATION}/${key}"
+  else
+    docker run --entrypoint=gcloud \
+      --volume=${KOKORO_GFILE_DIR}:${KOKORO_GFILE_DIR} \
+      gcr.io/google.com/cloudsdktool/cloud-sdk \
+      secrets versions access latest \
+      --project cloud-devrel-kokoro-resources \
+      --secret ${key} > \
+      "${SECRET_LOCATION}/${key}"
+  fi
   if [[ $? == 0 ]]; then
     msg "Secret written to ${SECRET_LOCATION}/${key}"
   else
diff --git a/.kokoro/presubmit/common.cfg b/.kokoro/presubmit/common.cfg
@@ -23,12 +23,3 @@ env_vars: {
   key: "JOB_TYPE"
   value: "test"
 }
-
-before_action {
-  fetch_keystore {
-    keystore_resource {
-      keystore_config_id: 73713
-      keyname: "dpebot_codecov_token"
-    }
-  }
-}
diff --git a/.kokoro/presubmit/graalvm-native-a.cfg b/.kokoro/presubmit/graalvm-native-a.cfg
@@ -1,10 +1,6 @@
 # Format: //devtools/kokoro/config/proto/build.proto
 
-# Configure the docker image for kokoro-trampoline.
-env_vars: {
-  key: "TRAMPOLINE_IMAGE"
-  value: "gcr.io/cloud-devrel-public-resources/graalvm_a:1.11.3"
-}
+build_file: "google-auth-library-java/.kokoro/build.sh"
 
 env_vars: {
   key: "JOB_TYPE"
@@ -47,3 +43,7 @@ env_vars: {
   value: "gcloud-devel"
 }
 
+container_properties {
+  docker_image: "us-docker.pkg.dev/java-graalvm-ci-prod/graalvm-integration-testing/graalvm_a:1.12.2"
+}
+
diff --git a/.kokoro/presubmit/graalvm-native-b.cfg b/.kokoro/presubmit/graalvm-native-b.cfg
@@ -1,10 +1,6 @@
 # Format: //devtools/kokoro/config/proto/build.proto
 
-# Configure the docker image for kokoro-trampoline.
-env_vars: {
-  key: "TRAMPOLINE_IMAGE"
-  value: "gcr.io/cloud-devrel-public-resources/graalvm_b:1.11.3"
-}
+build_file: "google-auth-library-java/.kokoro/build.sh"
 
 env_vars: {
   key: "JOB_TYPE"
@@ -46,3 +42,7 @@ env_vars: {
   key: "GOOGLE_CLOUD_QUOTA_PROJECT"
   value: "gcloud-devel"
 }
+
+container_properties {
+  docker_image: "us-docker.pkg.dev/java-graalvm-ci-prod/graalvm-integration-testing/graalvm_b:1.12.2"
+}
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,24 @@
 # Changelog
 
+## [1.30.1](https://github.com/googleapis/google-auth-library-java/compare/v1.30.0...v1.30.1) (2024-12-11)
+
+
+### Bug Fixes
+
+* JSON parsing of S2A addresses. ([#1589](https://github.com/googleapis/google-auth-library-java/issues/1589)) ([9d5ebfe](https://github.com/googleapis/google-auth-library-java/commit/9d5ebfe8870a11d27af3a7c7f3fd9930ab207162))
+
+## [1.30.0](https://github.com/googleapis/google-auth-library-java/compare/v1.29.0...v1.30.0) (2024-11-08)
+
+
+### Features
+
+* Support querying S2A Addresses from MDS ([#1400](https://github.com/googleapis/google-auth-library-java/issues/1400)) ([df06bd1](https://github.com/googleapis/google-auth-library-java/commit/df06bd1f94d03c4f8807c2adf42d25d29b731531))
+
+
+### Bug Fixes
+
+* Make it explicit that there is a network call to MDS to get SecureSessionAgentConfig ([#1573](https://github.com/googleapis/google-auth-library-java/issues/1573)) ([18020fe](https://github.com/googleapis/google-auth-library-java/commit/18020fedb855742ee27b6558f5de58d3818c6b48))
+
 ## [1.29.0](https://github.com/googleapis/google-auth-library-java/compare/v1.28.0...v1.29.0) (2024-10-22)
 
 
diff --git a/appengine/pom.xml b/appengine/pom.xml
@@ -5,7 +5,7 @@
   <parent>
     <groupId>com.google.auth</groupId>
     <artifactId>google-auth-library-parent</artifactId>
-    <version>1.29.1-SNAPSHOT</version><!-- {x-version-update:google-auth-library-parent:current} -->
+    <version>1.30.2-SNAPSHOT</version><!-- {x-version-update:google-auth-library-parent:current} -->
     <relativePath>../pom.xml</relativePath>
   </parent>
 
diff --git a/bom/pom.xml b/bom/pom.xml
@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.google.auth</groupId>
   <artifactId>google-auth-library-bom</artifactId>
-  <version>1.29.1-SNAPSHOT</version><!-- {x-version-update:google-auth-library-bom:current} -->
+  <version>1.30.2-SNAPSHOT</version><!-- {x-version-update:google-auth-library-bom:current} -->
   <packaging>pom</packaging>
   <name>Google Auth Library for Java BOM</name>
   <description>
@@ -83,7 +83,7 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-javadoc-plugin</artifactId>
-        <version>3.10.1</version>
+        <version>3.11.2</version>
         <configuration>
           <skip>true</skip>
         </configuration>
diff --git a/credentials/pom.xml b/credentials/pom.xml
@@ -4,7 +4,7 @@
   <parent>
     <groupId>com.google.auth</groupId>
     <artifactId>google-auth-library-parent</artifactId>
-    <version>1.29.1-SNAPSHOT</version><!-- {x-version-update:google-auth-library-parent:current} -->
+    <version>1.30.2-SNAPSHOT</version><!-- {x-version-update:google-auth-library-parent:current} -->
     <relativePath>../pom.xml</relativePath>
   </parent>
 
diff --git a/oauth2_http/java/com/google/auth/oauth2/GoogleAuthException.java b/oauth2_http/java/com/google/auth/oauth2/GoogleAuthException.java
@@ -156,8 +156,6 @@ static GoogleAuthException createWithTokenEndpointIOException(
       IOException ioException, String message) {
 
     if (message == null) {
-      // TODO: temporarily setting retry Count to service account default to remove a direct
-      // dependency, to be reverted after release
       return new GoogleAuthException(true, OAuth2Utils.DEFAULT_NUMBER_OF_RETRIES, ioException);
     } else {
       return new GoogleAuthException(
diff --git a/oauth2_http/java/com/google/auth/oauth2/SecureSessionAgent.java b/oauth2_http/java/com/google/auth/oauth2/SecureSessionAgent.java
@@ -45,6 +45,7 @@
 import java.io.InputStream;
 import java.util.Arrays;
 import java.util.HashSet;
+import java.util.Map;
 import java.util.ServiceLoader;
 import java.util.Set;
 import javax.annotation.concurrent.ThreadSafe;
@@ -58,7 +59,8 @@
  * <p>This is an experimental utility.
  */
 @ThreadSafe
-public final class S2A {
+public class SecureSessionAgent {
+  static final String S2A_JSON_KEY = "s2a";
   static final String S2A_PLAINTEXT_ADDRESS_JSON_KEY = "plaintext_address";
   static final String S2A_MTLS_ADDRESS_JSON_KEY = "mtls_address";
   static final String S2A_CONFIG_ENDPOINT_POSTFIX =
@@ -72,23 +74,25 @@ public final class S2A {
   private static final String MDS_MTLS_ENDPOINT =
       ComputeEngineCredentials.getMetadataServerUrl() + S2A_CONFIG_ENDPOINT_POSTFIX;
 
-  private S2AConfig config;
-
   private transient HttpTransportFactory transportFactory;
 
-  S2A(S2A.Builder builder) {
+  SecureSessionAgent(SecureSessionAgent.Builder builder) {
     this.transportFactory = builder.getHttpTransportFactory();
-    this.config = getS2AConfigFromMDS();
   }
 
-  /** @return the mTLS S2A Address from the mTLS config. */
-  public String getMtlsS2AAddress() {
-    return config.getMtlsAddress();
+  /**
+   * This method makes a network call to MDS to get the {@link SecureSessionAgentConfig} which
+   * contains the plaintext and mtls address to reach the S2A (Secure Session Agent).
+   *
+   * @return a SecureSessionAgentConfig.
+   */
+  public SecureSessionAgentConfig getConfig() {
+    return getSecureSessionAgentConfigFromMDS();
   }
 
-  /** @return the plaintext S2A Address from the mTLS config. */
-  public String getPlaintextS2AAddress() {
-    return config.getPlaintextAddress();
+  /** @return default instance of SecureSessionAgent */
+  public static SecureSessionAgent create() {
+    return newBuilder().build();
   }
 
   public static Builder newBuilder() {
@@ -110,17 +114,18 @@ public HttpTransportFactory getHttpTransportFactory() {
       return this.transportFactory;
     }
 
-    public S2A build() {
-      return new S2A(this);
+    public SecureSessionAgent build() {
+      return new SecureSessionAgent(this);
     }
   }
 
   /**
-   * Queries the MDS mTLS Autoconfiguration endpoint and returns the {@link S2AConfig}.
+   * Queries the MDS mTLS Autoconfiguration endpoint and returns the {@link
+   * SecureSessionAgentConfig}.
    *
-   * <p>Returns {@link S2AConfig}. If S2A is not running, or if any error occurs when making the
-   * request to MDS / processing the response, {@link S2AConfig} will be populated with empty
-   * addresses.
+   * <p>Returns {@link SecureSessionAgentConfig}. If S2A is not running, or if any error occurs when
+   * making the request to MDS / processing the response, {@link SecureSessionAgentConfig} will be
+   * populated with empty addresses.
    *
    * <p>Users are expected to try to fetch the mTLS-S2A address first (via {@link
    * getMtlsS2AAddress}). If it is empty or they have some problem loading the mTLS-MDS credentials,
@@ -129,9 +134,9 @@ public S2A build() {
    * when talking to the MDS / processing the response or that S2A is not running in the
    * environment; in either case this indicates S2A shouldn't be used.
    *
-   * @return the {@link S2AConfig}.
+   * @return the {@link SecureSessionAgentConfig}.
    */
-  private S2AConfig getS2AConfigFromMDS() {
+  private SecureSessionAgentConfig getSecureSessionAgentConfigFromMDS() {
     if (transportFactory == null) {
       transportFactory =
           Iterables.getFirst(
@@ -144,9 +149,9 @@ private S2AConfig getS2AConfigFromMDS() {
       request = transportFactory.create().createRequestFactory().buildGetRequest(genericUrl);
     } catch (IOException ignore) {
       /*
-       * Return empty addresses in {@link S2AConfig} if error building the GET request.
+       * Return empty addresses in {@link SecureSessionAgentConfig} if error building the GET request.
        */
-      return S2AConfig.createBuilder().build();
+      return SecureSessionAgentConfig.createBuilder().build();
     }
 
     request.setParser(new JsonObjectParser(OAuth2Utils.JSON_FACTORY));
@@ -173,36 +178,44 @@ private S2AConfig getS2AConfigFromMDS() {
       HttpResponse response = request.execute();
       InputStream content = response.getContent();
       if (content == null) {
-        return S2AConfig.createBuilder().build();
+        return SecureSessionAgentConfig.createBuilder().build();
       }
       responseData = response.parseAs(GenericData.class);
     } catch (IOException ignore) {
       /*
-       * Return empty addresses in {@link S2AConfig} once all retries have been exhausted.
+       * Return empty addresses in {@link SecureSessionAgentConfig} once all retries have been exhausted.
        */
-      return S2AConfig.createBuilder().build();
+      return SecureSessionAgentConfig.createBuilder().build();
     }
 
     String plaintextS2AAddress = "";
     String mtlsS2AAddress = "";
+    Map<String, Object> s2aAddressConfig = (Map<String, Object>) responseData.get(S2A_JSON_KEY);
+    if (s2aAddressConfig == null) {
+      /*
+       * Return empty addresses in {@link SecureSessionAgentConfig} if endpoint doesn't return anything.
+       */
+      return SecureSessionAgentConfig.createBuilder().build();
+    }
     try {
       plaintextS2AAddress =
-          OAuth2Utils.validateString(responseData, S2A_PLAINTEXT_ADDRESS_JSON_KEY, PARSE_ERROR_S2A);
+          OAuth2Utils.validateString(
+              s2aAddressConfig, S2A_PLAINTEXT_ADDRESS_JSON_KEY, PARSE_ERROR_S2A);
     } catch (IOException ignore) {
       /*
-       * Do not throw error because of parsing error, just leave the address as empty in {@link S2AConfig}.
+       * Do not throw error because of parsing error, just leave the address as empty in {@link SecureSessionAgentConfig}.
        */
     }
     try {
       mtlsS2AAddress =
-          OAuth2Utils.validateString(responseData, S2A_MTLS_ADDRESS_JSON_KEY, PARSE_ERROR_S2A);
+          OAuth2Utils.validateString(s2aAddressConfig, S2A_MTLS_ADDRESS_JSON_KEY, PARSE_ERROR_S2A);
     } catch (IOException ignore) {
       /*
-       * Do not throw error because of parsing error, just leave the address as empty in {@link S2AConfig}.
+       * Do not throw error because of parsing error, just leave the address as empty in {@link SecureSessionAgentConfig}.
        */
     }
 
-    return S2AConfig.createBuilder()
+    return SecureSessionAgentConfig.createBuilder()
         .setPlaintextAddress(plaintextS2AAddress)
         .setMtlsAddress(mtlsS2AAddress)
         .build();
diff --git a/oauth2_http/java/com/google/auth/oauth2/SecureSessionAgentConfig.java b/oauth2_http/java/com/google/auth/oauth2/SecureSessionAgentConfig.java
@@ -33,7 +33,7 @@
 import com.google.errorprone.annotations.CanIgnoreReturnValue;
 
 /** Holds an mTLS configuration (consists of address of S2A) retrieved from the Metadata Server. */
-final class S2AConfig {
+public class SecureSessionAgentConfig {
   // plaintextAddress is the plaintext address to reach the S2A.
   private final String plaintextAddress;
 
@@ -86,12 +86,12 @@ public Builder setMtlsAddress(String mtlsAddress) {
       return this;
     }
 
-    public S2AConfig build() {
-      return new S2AConfig(plaintextAddress, mtlsAddress);
+    public SecureSessionAgentConfig build() {
+      return new SecureSessionAgentConfig(plaintextAddress, mtlsAddress);
     }
   }
 
-  private S2AConfig(String plaintextAddress, String mtlsAddress) {
+  private SecureSessionAgentConfig(String plaintextAddress, String mtlsAddress) {
     this.plaintextAddress = plaintextAddress;
     this.mtlsAddress = mtlsAddress;
   }
diff --git a/oauth2_http/javatests/com/google/auth/oauth2/MockMetadataServerTransport.java b/oauth2_http/javatests/com/google/auth/oauth2/MockMetadataServerTransport.java
@@ -291,18 +291,16 @@ private MockLowLevelHttpRequest getMockRequestForMtlsConfig(String url) {
       @Override
       public LowLevelHttpResponse execute() throws IOException {
 
-        String metadataRequestHeader = getFirstHeaderValue(S2A.METADATA_FLAVOR);
-        if (!S2A.GOOGLE.equals(metadataRequestHeader)) {
+        String metadataRequestHeader = getFirstHeaderValue(SecureSessionAgent.METADATA_FLAVOR);
+        if (!SecureSessionAgent.GOOGLE.equals(metadataRequestHeader)) {
           throw new IOException("Metadata request header not found");
         }
 
         // Create the JSON response
         GenericJson content = new GenericJson();
         content.setFactory(OAuth2Utils.JSON_FACTORY);
         if (requestStatusCode == 200) {
-          for (Map.Entry<String, String> entrySet : s2aContentMap.entrySet()) {
-            content.put(entrySet.getKey(), entrySet.getValue());
-          }
+          content.put(SecureSessionAgent.S2A_JSON_KEY, s2aContentMap);
         }
         String contentText = content.toPrettyString();
 
@@ -336,7 +334,7 @@ protected boolean isIdentityDocumentUrl(String url) {
 
   protected boolean isMtlsConfigRequestUrl(String url) {
     return url.equals(
-        String.format(
-            ComputeEngineCredentials.getMetadataServerUrl() + S2A.S2A_CONFIG_ENDPOINT_POSTFIX));
+        ComputeEngineCredentials.getMetadataServerUrl()
+            + SecureSessionAgent.S2A_CONFIG_ENDPOINT_POSTFIX);
   }
 }
diff --git a/oauth2_http/javatests/com/google/auth/oauth2/SecureSessionAgentConfigTest.java b/oauth2_http/javatests/com/google/auth/oauth2/SecureSessionAgentConfigTest.java
diff --git a/oauth2_http/javatests/com/google/auth/oauth2/SecureSessionAgentTest.java b/oauth2_http/javatests/com/google/auth/oauth2/SecureSessionAgentTest.java
diff --git a/oauth2_http/pom.xml b/oauth2_http/pom.xml
diff --git a/pom.xml b/pom.xml
diff --git a/renovate.json b/renovate.json
diff --git a/samples/snippets/pom.xml b/samples/snippets/pom.xml
diff --git a/versions.txt b/versions.txt
