feat(auth): implement in-place Regional Access Boundary configuration and add public RAB getters#16987
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces new properties for regional access boundary and updates existing methods _with_regional_access_boundary and _with_blocking_regional_access_boundary_lookup to _set_regional_access_boundary and _set_blocking_regional_access_boundary_lookup, respectively. The methods were modified to perform in-place mutation instead of returning a copy of the credentials. The reviewer noted that these changes are breaking and require a minor version bump, and advised maintaining the original cloning behavior to ensure proper isolation of background refresh logic.
| def _set_regional_access_boundary(self, seed): | ||
| """Applies the regional_access_boundary provided via the seed on these | ||
| credentials. This is intended for internal use only as invalid | ||
| seeds would produce unexpected results until automatic recovery is supported. | ||
| Currently this is used by the gcloud CLI and therefore changes to the | ||
| contract MUST be backwards compatible (e.g. the method signature must be | ||
| unchanged and a copy of the credenials with the RAB set must be returned). | ||
| unchanged and the credentials with the RAB set must be returned). | ||
|
|
||
|
|
||
| Returns: | ||
| google.auth.credentials.Credentials: A new credentials instance. | ||
| google.auth.credentials.Credentials: The credentials instance. | ||
| """ |
There was a problem hiding this comment.
The method _with_regional_access_boundary has been renamed to _set_regional_access_boundary and changed to mutate in-place. This is a breaking change that will impact consumers like the gcloud CLI. Per repository guidelines, breaking changes require a minor version bump rather than a patch. Furthermore, if you choose to revert to the previous cloning behavior to maintain compatibility, ensure that a new _RegionalAccessBoundaryManager is created for the clone to isolate background refresh logic.
References
- When a release introduces breaking changes, prefer a minor version bump over a patch version bump.
- When cloning credentials, create a new _RegionalAccessBoundaryManager for the clone to isolate background refresh logic.
| def _set_blocking_regional_access_boundary_lookup(self): | ||
| """Enables the blocking lookup mode on these credentials. | ||
| This is intended for internal use only as blocking lookup requires additional | ||
| care and consideration. Currently this is used by the gcloud CLI and | ||
| therefore changes to the contract MUST be backwards compatible (e.g. the | ||
| method signature must be unchanged and a copy of the credentials with the | ||
| method signature must be unchanged and the credentials with the | ||
| blocking lookup flag set to true must be returned). | ||
|
|
||
| Returns: | ||
| google.auth.credentials.Credentials: A new credentials instance. | ||
| google.auth.credentials.Credentials: The credentials instance. | ||
| """ |
There was a problem hiding this comment.
Renaming _with_blocking_regional_access_boundary_lookup and switching to in-place mutation violates backward compatibility requirements. This breaking change necessitates a minor version bump to maintain the ability to provide patches for previous versions. If the original 'copy' behavior is restored, remember to isolate background refresh logic by creating a new _RegionalAccessBoundaryManager for the cloned instance.
References
- When a release introduces breaking changes, prefer a minor version bump over a patch version bump.
- When cloning credentials, create a new _RegionalAccessBoundaryManager for the clone to isolate background refresh logic.
… & public getters - Rename _with_regional_access_boundary to _set_regional_access_boundary and _with_blocking_regional_access_boundary_lookup to _set_blocking_regional_access_boundary_lookup. - Modify both methods to apply changes in-place on self and return self instead of making copies. - Add public getters regional_access_boundary and regional_access_boundary_expiry to CredentialsWithRegionalAccessBoundary. - Update and split unit tests to verify in-place mutation and getters independently.
macastelaz
force-pushed
the
clean-rab-only-today
branch
from
5fbd9a5 to
386f479
Compare
PR created by the Librarian CLI to initialize a release. Merging this PR will auto trigger a release. Librarian Version: v0.12.0 Language Image: us-central1-docker.pkg.dev/cloud-sdk-librarian-prod/images-prod/python-librarian-generator@sha256:234b9d1f2ddb057ed7ac6a38db0bf8163d839c65c6cf88ade52530cddebce59e <details><summary>google-auth: v2.52.0</summary> ## [v2.52.0](google-auth-v2.51.0...google-auth-v2.52.0) (2026-05-07) ### Features * implement in-place Regional Access Boundary configuration and add public RAB getters (#16987) ([df07fce](df07fceb)) * make _CLOUD_RESOURCE_MANAGER URL universe-domain-aware (#16546) ([e938028](e938028b)) </details>
2 participants
This PR makes the following changes: