Changed check to enable mTLS so we only do it once every ~5 hours.

Author: vverman

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/GoogleCredentials.java

@@ -398,14 +398,12 @@ void refreshRegionalAccessBoundaryIfExpired(@Nullable URI uri, @Nullable AccessT
       return;
     }
 
-    // Automatically discover certificates or enforce mTLS policy if applicable
-    // TODO: https://github.com/googleapis/google-cloud-java/issues/13461
-    transportFactory =
-        MtlsUtils.prepareTransportFactoryIfMtlsEnabled(
-            transportFactory, getEnvironmentProvider(), getPropertyProvider(), null);
-
     regionalAccessBoundaryManager.triggerAsyncRefresh(
-        transportFactory, (RegionalAccessBoundaryProvider) this, token, getEnvironmentProvider());
+        transportFactory,
+        (RegionalAccessBoundaryProvider) this,
+        token,
+        getEnvironmentProvider(),
+        getPropertyProvider());
   }
 
   /**

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundaryManager.java

@@ -178,7 +178,8 @@ void triggerAsyncRefresh(
       final HttpTransportFactory transportFactory,
       final RegionalAccessBoundaryProvider provider,
       final AccessToken accessToken,
-      final EnvironmentProvider envProvider) {
+      final EnvironmentProvider envProvider,
+      final PropertyProvider propProvider) {
     if (skipRAB.get() || isCooldownActive()) {
       return;
     }
@@ -200,9 +201,12 @@ void triggerAsyncRefresh(
                 skipRAB.set(true);
                 return;
               }
+              HttpTransportFactory upgradedTransportFactory =
+                  com.google.auth.mtls.MtlsUtils.prepareTransportFactoryIfMtlsEnabled(
+                      transportFactory, envProvider, propProvider, null);
               RegionalAccessBoundary newRAB =
                   RegionalAccessBoundary.refresh(
-                      transportFactory,
+                      upgradedTransportFactory,
                       url,
                       accessToken,
                       clock,

google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/RegionalAccessBoundaryTest.java

@@ -184,7 +184,11 @@ public void testManagerTriggersRefreshInGracePeriod() throws InterruptedExceptio
 
     // 1. Let's first get a RAB into the cache
     manager.triggerAsyncRefresh(
-        transportFactory, provider, token, SystemEnvironmentProvider.getInstance());
+        transportFactory,
+        provider,
+        token,
+        SystemEnvironmentProvider.getInstance(),
+        SystemPropertyProvider.getInstance());
 
     // Wait for it to be cached
     int retries = 0;
@@ -216,7 +220,11 @@ public void testManagerTriggersRefreshInGracePeriod() throws InterruptedExceptio
 
     // 4. Trigger refresh - should start because we are in grace period
     manager.triggerAsyncRefresh(
-        transportFactory2, provider, token, SystemEnvironmentProvider.getInstance());
+        transportFactory2,
+        provider,
+        token,
+        SystemEnvironmentProvider.getInstance(),
+        SystemPropertyProvider.getInstance());
 
     // 5. Wait for background refresh to complete
     // We expect the cached RAB to eventually change to newerEncoded
@@ -301,7 +309,11 @@ public int read() throws java.io.IOException {
               RegionalAccessBoundaryManager.DEFAULT_MAX_RETRY_ELAPSED_TIME_MILLIS,
               testExecutor);
       managers[i].triggerAsyncRefresh(
-          transportFactory, provider, token, SystemEnvironmentProvider.getInstance());
+          transportFactory,
+          provider,
+          token,
+          SystemEnvironmentProvider.getInstance(),
+          SystemPropertyProvider.getInstance());
     }
 
     RegionalAccessBoundaryManager extraManager =
@@ -312,7 +324,11 @@ public int read() throws java.io.IOException {
     assertFalse(extraManager.isCooldownActive());
 
     extraManager.triggerAsyncRefresh(
-        transportFactory, provider, token, SystemEnvironmentProvider.getInstance());
+        transportFactory,
+        provider,
+        token,
+        SystemEnvironmentProvider.getInstance(),
+        SystemPropertyProvider.getInstance());
 
     assertFalse(
         extraManager.isCooldownActive(),