fix(auth): Use public refresh method for source credentials in ImpersonatedCredentials #1884
Conversation
…onatedCredentials
Summary of ChangesHello @nbayati, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request addresses a critical bug within the Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request effectively resolves a bug in ImpersonatedCredentials by updating the credential refresh mechanism. The change correctly replaces a call to a private method (_refresh_token) with the public refresh method of the source_credentials. This significantly improves the robustness and compatibility of the impersonation flow, especially for custom credential types that may not implement the private _refresh_token method.
| self._source_credentials.token_state == credentials.TokenState.STALE | ||
| or self._source_credentials.token_state == credentials.TokenState.INVALID | ||
| ): | ||
| self._source_credentials._refresh_token(request) |
There was a problem hiding this comment.
The previous implementation relied on the private _refresh_token method of _source_credentials. This could lead to issues with custom credential types that do not expose this private method, resulting in AttributeError or unexpected behavior. Using the public refresh method, as introduced in this change, ensures adherence to the public API contract and improves compatibility across various credential implementations.
| self._source_credentials._refresh_token(request) | |
| self._source_credentials.refresh(request) |
PR created by the Librarian CLI to initialize a release. Merging this PR will auto trigger a release. Librarian Version: v0.7.0 Language Image: us-central1-docker.pkg.dev/cloud-sdk-librarian-prod/images-prod/python-librarian-generator:latest <details><summary>google-auth: 2.44.0</summary> ## [2.44.0](v2.43.0...v2.44.0) (2025-12-12) ### Features * MDS connections use mTLS (#1856) ([0387bb9](0387bb95)) * support Python 3.14 (#1822) ([0f7097e](0f7097e7)) * add ecdsa p-384 support (#1872) ([39c381a](39c381a5)) * Add shlex to correctly parse executable commands with spaces (#1855) ([cf6fc3c](cf6fc3cc)) * Implement token revocation in STS client and add revoke() metho… (#1849) ([d563898](d5638986)) ### Bug Fixes * Add temporary patch to workload cert logic to accomodate Cloud Run mis-configuration (#1880) ([78de790](78de7907)) * Delegate workload cert and key default lookup to helper function (#1877) ([b0993c7](b0993c7e)) * Use public refresh method for source credentials in ImpersonatedCredentials (#1884) ([e0c3296](e0c3296f)) </details>
2 participants
This PR addresses a bug in ImpersonatedCredentials that causes a issues when the source_credential is of a type that does not implement the private _refresh_token method (for example, a custom credential type).