feat: Regional Access Boundary Changes by vverman · Pull Request #891 · googleapis/google-cloud-node-core

vverman · 2026-01-17T01:31:30Z

Contains changes for the feature Regional Access Boundary (Previously Called Trust Boundaries).

The following are salient changes:

Calls to refresh RAB are now all async and in a separate thread.
Logic for refreshing RAB now exists in its own class for cleaner maintenance.
Self-signed jwts are within scope.
Changes to how we trigger RAB refresh and deal with refresh errors.

…d JWT

…ure.

packages/google-auth-library-nodejs/src/auth/regionalaccessboundary.ts

packages/google-auth-library-nodejs/src/auth/baseexternalclient.ts

packages/google-auth-library-nodejs/src/auth/regionalaccessboundary.ts

nbayati · 2026-01-27T21:48:33Z

packages/google-auth-library-nodejs/src/auth/regionalaccessboundary.ts

+      const maxRetryTime = 60 * 1000;
+      let shouldContinue = true;
+
+      while (shouldContinue) {


This library already uses gaxios, which provides a powerful and configurable built-in retry mechanism (including exponential backoff) via its retryConfig. This library already uses gaxios, which provides a powerful and configurable built-in retry mechanism (including exponential backoff) via its retryConfig.

The fetchRegionalAccessBoundary method already enables gaxios retries, and then we're wrapping it here in the custom retry logic. I'd recommend refactoring to remove this while loop. Instead, you can add retry conditions to the retryConfig in fetchRegionalAccessBoundary method to achieve the desired behavior. This would leverage existing gaxios functionality, simplify the code, and align with the library's established patterns for request retries.

Implemented! Thank you for the suggestion!

packages/google-auth-library-nodejs/src/auth/baseexternalclient.ts

nbayati · 2026-01-28T00:09:57Z

packages/google-auth-library-nodejs/src/auth/baseexternalclient.ts

+        !reAuthRetried
+      ) {
+        this.clearRegionalAccessBoundaryCache();
+        return await this.requestAsync<T>(opts, true);


I think we should have two separate flags for the auth retry, and this one (retryWithoutRAB maybe?). Consider this scenario which the single flag approach would fail to handle:

Initial Call: requestAsync(opts) is called.

First Failure: The request fails with a stale RAB error. The catch block clears the RAB cache and retries
the request, with reAuthRetried set to True.

Second Failure: The retried request (now sent without the x-allowed-locations header) fails, but this time with a 401 Unauthorized error because the access token has just expired.

With a single reAuthRetried flag, this second failure would not be handled because it thinks the token has already been refreshed and the request has been retried with the updated credential, and an error would be thrown.

If we use two flags, we can ensure that we only try once without the allowed location header, and then we attempt a true reAuth.

Great point, I was of the opinion that we shouldn't hold the user back with too many retries. Thanks for the clarification, I have made the changes.

nbayati · 2026-01-28T00:11:14Z

packages/google-auth-library-nodejs/src/auth/externalAccountAuthorizedUserClient.ts

  }

-  async getRequestHeaders(): Promise<Headers> {
+  async getRequestHeaders(url?: string | URL): Promise<Headers> {


Same concern with the getRequestHeaders method in the baseexternalclient.ts file.

We are now calling the refresh RAB from the requestAsync with the URL so this concern has been addressed!

nbayati · 2026-01-28T00:12:02Z

packages/google-auth-library-nodejs/src/auth/externalAccountAuthorizedUserClient.ts

-      response = await this.transporter.request<T>(opts);
+      response = await this.transporter.request<T>(requestOpts);
    } catch (e) {
+      if (


Same concern with reusing the reAuthRetried flag for the two different scenario.

nbayati · 2026-01-28T00:14:00Z

packages/google-auth-library-nodejs/src/auth/externalAccountAuthorizedUserClient.ts

   * @throws {Error} If the URL cannot be constructed for a compatible client.
   */
-  protected async getTrustBoundaryUrl(): Promise<string | null> {
+  public async getRegionalAccessBoundaryUrl(): Promise<string | null> {


Why this method became public?

I made it so for ease of testing the getRegionalAccessBoundaryUrl logic. For ex: in the base external client we have scenarios where we want to test if the right url is returned or error is thrown in case of workload, workforce or a null audience.

I'd go ahead and put an @private on it, as that will cause it to be omitted from docs, but it will still show up in the transpiled class. Anyone digging in the source can see the @private to know they shouldn't use it.

Actually, it looks like @internal omits it from any exported .d.ts, so that may be enough. I'd double-check the output though, to see what it makes.

nbayati · 2026-01-28T00:37:19Z

packages/google-auth-library-nodejs/src/auth/regionalaccessboundary.ts

+  'https://staging-iamcredentials.sandbox.{universe_domain}/v1/projects/-/serviceAccounts/{service_account_email}/allowedLocations';
+
+export const WORKLOAD_LOOKUP_ENDPOINT =
+  'https://iamcredentials.{universe_domain}/v1/projects/{project_id}/locations/global/workloadIdentityPools/{pool_id}/allowedLocations';


We heard back from the backend team that the TPC won't be supported in the future either, so we don't have to consider universe domains other than GDU in here. Let's hardcode it in the URLs and simplify our logic too.

Gotcha, implemented the change!

nbayati · 2026-01-28T01:50:00Z

packages/google-auth-library-nodejs/src/auth/jwtclient.ts

+        this.maybeTriggerRegionalAccessBoundaryRefresh(
+          url ?? undefined,
+          (tokens.access_token ?? tokens.id_token)!,
+        );


IIUC the flow correctly, this block is for requesting an id token, and id tokens are not supported by RAB, so there is no need to trigger a refresh here.

Thanks for this catch, I have implemented an isIDtoken flag which indicates to requestAsync inside oauth2client as to whether the token is an idToken and if so we skip RAB lookup.

…e requestAsync level. RAB urls now have googleapis as universe domain.

…been excluded and test suite updated.

…504 are the only retryable look up failures.

feywind

I don't see anything too weird in this, I guess let me know when you've got one that merges against main?

packages/google-auth-library-nodejs/src/auth/authclient.ts

feywind · 2026-02-02T20:22:34Z

packages/google-auth-library-nodejs/src/auth/authclient.ts

+    if (res && res.status === 400) {
+      const data = res.data as {error?: {message?: string}; message?: string};
+      const message =
+        data?.error?.message || data?.message || error.message || '';


?? might be more idiomatic now, unless e.g. data?.message could be empty but not null/undefined.

feywind · 2026-02-02T20:26:55Z

packages/google-auth-library-nodejs/src/auth/externalAccountAuthorizedUserClient.ts

   * @throws {Error} If the URL cannot be constructed for a compatible client.
   */
-  protected async getTrustBoundaryUrl(): Promise<string | null> {
+  public async getRegionalAccessBoundaryUrl(): Promise<string | null> {


I'd go ahead and put an @private on it, as that will cause it to be omitted from docs, but it will still show up in the transpiled class. Anyone digging in the source can see the @private to know they shouldn't use it.

Actually, it looks like @internal omits it from any exported .d.ts, so that may be enough. I'd double-check the output though, to see what it makes.

feywind · 2026-02-02T20:27:37Z

packages/google-auth-library-nodejs/src/auth/impersonated.ts

  }

-  protected async getTrustBoundaryUrl(): Promise<string> {
+  public async getRegionalAccessBoundaryUrl(): Promise<string> {


Same comment re protected -> public.

feywind · 2026-02-02T20:28:01Z

packages/google-auth-library-nodejs/src/auth/jwtclient.ts

  }

-  protected async getTrustBoundaryUrl(): Promise<string> {
+  public async getRegionalAccessBoundaryUrl(): Promise<string> {


Ditto protected -> public.

feywind · 2026-02-02T20:45:04Z

packages/google-auth-library-nodejs/src/auth/regionalaccessboundary.ts

+   * Triggers an asynchronous regional access boundary refresh if needed.
+   * @param accessToken The access token to use for the lookup.
+   */
+  private maybeTriggerRegionalAccessBoundaryRefresh(accessToken: string) {


Absolutely nitpicky, but I like to try to put an explicit return type on void methods just to make sure that you notice if something changes internal to it.

feywind · 2026-02-02T21:08:39Z

packages/google-auth-library-nodejs/test/test.baseexternalclient.ts

-        accessToken: MOCK_ACCESS_TOKEN,
-        expireTime: new Date(now + ONE_HOUR_IN_SECS * 1000).toISOString(),
+        accessToken: 'SA_ACCESS_TOKEN',
+        expireTime: new Date(Date.now() + 3600000).toISOString(),


You could still do the multiplication thing here... like 60 * 60 * 1000.

vverman added 3 commits January 14, 2026 15:38

Changes for trust boundaries async refresh and support for self-signe…

7d283f5

…d JWT

Fixed unit tests moved RAB logic out of authclient.

c6c1c7b

Changed getRegionalAccessBoundaryUrl and fixed a self-signed jwt fail…

635bae2

…ure.

vverman requested a review from a team as a code owner January 17, 2026 01:31

vverman assigned sofisl, nbayati and miguelvelezsa Jan 17, 2026

Fixed url for service account RAB lookup.

0cfa454

lsirac requested review from miguelvelezsa, nbayati and sofisl January 22, 2026 01:32