feat: implement updated design for regional access boundary#16084
feat: implement updated design for regional access boundary#16084nbayati wants to merge 16 commits intogoogleapis:mainfrom
Conversation
Make the fetching async and non blocking. Implement proactive refresh every 6 hours. Centralize the logic in a new class. Remove no-op signal and checks. Refactor to Regional Access Boundary name.
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly overhauls the internal handling of regional access boundaries within the authentication library. The primary goal is to enhance the reliability and performance of this feature by introducing an asynchronous, non-blocking data fetching mechanism with proactive background refreshes. This refactoring centralizes the complex logic, streamlines error handling, and sets the stage for more robust regional access control. Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a significant and well-executed refactoring of the regional access boundary feature. The changes implement a more robust design with non-blocking, asynchronous fetching, proactive refresh, and exponential backoff on failure. The logic has been effectively centralized into new utility classes, and the feature has been consistently renamed from "Trust Boundary" to "Regional Access Boundary" across the codebase. The implementation appears solid and greatly improves the feature's resilience. I have a couple of minor suggestions to modernize the Python syntax for super() calls in the new and modified code.
packages/google-auth/google/auth/_regional_access_boundary_utils.py
Outdated
Show resolved
Hide resolved
…gional_access_boundary_lookup_url` and add a new test.
….Request` for metadata server requests.
…ve type hinting across various credential types.
Review
Test Coverage Gaps
|
daniel-sanche
left a comment
daniel-sanche
left a comment
There was a problem hiding this comment.
few small comments and questions, but overall looks good
| from google.auth.transport import _http_client | ||
|
|
||
| request = google_auth_requests.Request() | ||
| request = _http_client.Request() |
There was a problem hiding this comment.
We're running into issues because _http_client doesn't support mtls. Will that be a problem here?
There was a problem hiding this comment.
Good catch! Yeah this would be a problem here. To address both your original concern (optional dependencies) and your follow-up (mTLS support), I’ve applied a try / except ImportError pattern to both _build_regional_access_boundary_lookup_url and universe_domain properties so we can try to import and use requests which for those who are using mTLS must be installed anyway, and fallback to _http_client if it's not installed.
There was a problem hiding this comment.
requests ... for those who are using mTLS must be installed anyway
Where is this enforced? In #16090 (comment), we're running into an issue where that's not the case
This question is probably outside the scope of this change, but I just want to understand it better
Thanks for the review feedback @lsirac Re |
3 participants
Original PR: googleapis/google-auth-library-python#1955
Make the fetching async and non blocking.
Implement proactive refresh every 6 hours.
Centralize the logic in a new class.
Remove no-op signal and checks.
Refactor to Regional Access Boundary name.