From c296c920b90a9679a51b5abdfd3df0e410f802b1 Mon Sep 17 00:00:00 2001
From: Luwei Ge <lwge@google.com>
Date: Wed, 15 Oct 2025 23:11:15 +0000
Subject: [PATCH 1/4] feat: Enable ALTS hard bound token in Bigtable w/ direct
 access

---
 .../bigtable/data/v2/stub/EnhancedBigtableStubSettings.java  | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/google-cloud-bigtable/src/main/java/com/google/cloud/bigtable/data/v2/stub/EnhancedBigtableStubSettings.java b/google-cloud-bigtable/src/main/java/com/google/cloud/bigtable/data/v2/stub/EnhancedBigtableStubSettings.java
index 31d6f76055..a384a968f8 100644
--- a/google-cloud-bigtable/src/main/java/com/google/cloud/bigtable/data/v2/stub/EnhancedBigtableStubSettings.java
+++ b/google-cloud-bigtable/src/main/java/com/google/cloud/bigtable/data/v2/stub/EnhancedBigtableStubSettings.java
@@ -64,6 +64,7 @@
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 import java.util.Base64;
+import java.util.Collections;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
@@ -438,6 +439,10 @@ public static InstantiatingGrpcChannelProvider.Builder defaultGrpcTransportProvi
       grpcTransportProviderBuilder
           .setAttemptDirectPathXds()
           .setAttemptDirectPath(true)
+          // Try to fetch a hard-bound access token for direct access if the runtime
+          // environment supports it.
+          .setAllowHardBoundTokenTypes(
+              Collections.singletonList(InstantiatingGrpcChannelProvider.HardBoundTokenTypes.ALTS))
           // Allow using non-default service account in DirectPath.
           .setAllowNonDefaultServiceAccount(true);
     }

From 5d6fe37228d1c3af510e439efcbd450ac4c4017f Mon Sep 17 00:00:00 2001
From: Luwei Ge <lwge@google.com>
Date: Fri, 17 Oct 2025 21:53:43 +0000
Subject: [PATCH 2/4] add env var to allow disabling bound token

---
 .../v2/stub/EnhancedBigtableStubSettings.java     | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/google-cloud-bigtable/src/main/java/com/google/cloud/bigtable/data/v2/stub/EnhancedBigtableStubSettings.java b/google-cloud-bigtable/src/main/java/com/google/cloud/bigtable/data/v2/stub/EnhancedBigtableStubSettings.java
index a384a968f8..ab4bbff3d4 100644
--- a/google-cloud-bigtable/src/main/java/com/google/cloud/bigtable/data/v2/stub/EnhancedBigtableStubSettings.java
+++ b/google-cloud-bigtable/src/main/java/com/google/cloud/bigtable/data/v2/stub/EnhancedBigtableStubSettings.java
@@ -114,6 +114,10 @@ public class EnhancedBigtableStubSettings extends StubSettings<EnhancedBigtableS
   private static final boolean DIRECT_PATH_ENABLED =
       Boolean.parseBoolean(System.getenv("CBT_ENABLE_DIRECTPATH"));
 
+  // If true, disable the bound-token-by-default feature for DirectPath.
+  private static final boolean DIRECT_PATH_BOUND_TOKEN_DISABLED =
+      Boolean.parseBoolean(System.getenv("CBT_DISABLE_DIRECTPATH_BOUND_TOKEN"));
+
   private static final boolean SKIP_TRAILERS =
       Optional.ofNullable(System.getenv("CBT_SKIP_HEADERS"))
           .map(Boolean::parseBoolean)
@@ -439,12 +443,15 @@ public static InstantiatingGrpcChannelProvider.Builder defaultGrpcTransportProvi
       grpcTransportProviderBuilder
           .setAttemptDirectPathXds()
           .setAttemptDirectPath(true)
-          // Try to fetch a hard-bound access token for direct access if the runtime
-          // environment supports it.
-          .setAllowHardBoundTokenTypes(
-              Collections.singletonList(InstantiatingGrpcChannelProvider.HardBoundTokenTypes.ALTS))
           // Allow using non-default service account in DirectPath.
           .setAllowNonDefaultServiceAccount(true);
+      if (!DIRECT_PATH_BOUND_TOKEN_DISABLED) {
+        // Try to fetch a hard-bound access token for direct access if the runtime
+        // environment supports it.
+        grpcTransportProviderBuilder
+          .setAllowHardBoundTokenTypes(
+              Collections.singletonList(InstantiatingGrpcChannelProvider.HardBoundTokenTypes.ALTS));
+      } 
     }
     return grpcTransportProviderBuilder
         .setChannelPoolSettings(

From 2f62b942aacae5d695d43ff5c42efb01ed3f0fd1 Mon Sep 17 00:00:00 2001
From: Luwei Ge <lwge@google.com>
Date: Fri, 17 Oct 2025 21:58:11 +0000
Subject: [PATCH 3/4] format

---
 .../bigtable/data/v2/stub/EnhancedBigtableStubSettings.java | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/google-cloud-bigtable/src/main/java/com/google/cloud/bigtable/data/v2/stub/EnhancedBigtableStubSettings.java b/google-cloud-bigtable/src/main/java/com/google/cloud/bigtable/data/v2/stub/EnhancedBigtableStubSettings.java
index ab4bbff3d4..ee63e64862 100644
--- a/google-cloud-bigtable/src/main/java/com/google/cloud/bigtable/data/v2/stub/EnhancedBigtableStubSettings.java
+++ b/google-cloud-bigtable/src/main/java/com/google/cloud/bigtable/data/v2/stub/EnhancedBigtableStubSettings.java
@@ -449,9 +449,9 @@ public static InstantiatingGrpcChannelProvider.Builder defaultGrpcTransportProvi
         // Try to fetch a hard-bound access token for direct access if the runtime
         // environment supports it.
         grpcTransportProviderBuilder
-          .setAllowHardBoundTokenTypes(
-              Collections.singletonList(InstantiatingGrpcChannelProvider.HardBoundTokenTypes.ALTS));
-      } 
+            .setAllowHardBoundTokenTypes(
+                Collections.singletonList(InstantiatingGrpcChannelProvider.HardBoundTokenTypes.ALTS));
+      }
     }
     return grpcTransportProviderBuilder
         .setChannelPoolSettings(

From 0764d0ac64d38e79acd0660312e8e5665ca76fd5 Mon Sep 17 00:00:00 2001
From: Luwei Ge <lwge@google.com>
Date: Fri, 17 Oct 2025 22:14:59 +0000
Subject: [PATCH 4/4] format

---
 .../bigtable/data/v2/stub/EnhancedBigtableStubSettings.java  | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/google-cloud-bigtable/src/main/java/com/google/cloud/bigtable/data/v2/stub/EnhancedBigtableStubSettings.java b/google-cloud-bigtable/src/main/java/com/google/cloud/bigtable/data/v2/stub/EnhancedBigtableStubSettings.java
index ee63e64862..f4572333c9 100644
--- a/google-cloud-bigtable/src/main/java/com/google/cloud/bigtable/data/v2/stub/EnhancedBigtableStubSettings.java
+++ b/google-cloud-bigtable/src/main/java/com/google/cloud/bigtable/data/v2/stub/EnhancedBigtableStubSettings.java
@@ -448,9 +448,8 @@ public static InstantiatingGrpcChannelProvider.Builder defaultGrpcTransportProvi
       if (!DIRECT_PATH_BOUND_TOKEN_DISABLED) {
         // Try to fetch a hard-bound access token for direct access if the runtime
         // environment supports it.
-        grpcTransportProviderBuilder
-            .setAllowHardBoundTokenTypes(
-                Collections.singletonList(InstantiatingGrpcChannelProvider.HardBoundTokenTypes.ALTS));
+        grpcTransportProviderBuilder.setAllowHardBoundTokenTypes(
+            Collections.singletonList(InstantiatingGrpcChannelProvider.HardBoundTokenTypes.ALTS));
       }
     }
     return grpcTransportProviderBuilder