cache userMtlsPolicy so we read only once other comment addressals.

Author: vverman

google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsUtils.java

@@ -159,7 +159,7 @@ private static File getWellKnownCertificateConfigFile(
    * @throws IOException if the configuration file is present but contains missing or malformed
    *     files
    */
-  public static boolean canMtlsBeEnabled(
+  public static boolean canBeEnabled(
       EnvironmentProvider envProvider, PropertyProvider propProvider, String certConfigPathOverride)
       throws IOException {
 
@@ -286,34 +286,38 @@ public static HttpTransportFactory prepareTransportFactoryIfMtlsEnabled(
 
     MtlsEndpointUsagePolicy mtlsPolicy = getMtlsEndpointUsagePolicy(envProvider);
     try {
-      boolean canMtls = canMtlsBeEnabled(envProvider, propProvider, certConfigPathOverride);
-      if (canMtls) {
-        if (baseTransportFactory instanceof MtlsHttpTransportFactory) {
-          // A custom MtlsHttpTransportFactory was already pre-configured by the user.
-          // Keep using it as-is without re-initializing.
-          return baseTransportFactory;
-        } else if (baseTransportFactory == OAuth2Utils.HTTP_TRANSPORT_FACTORY) {
-          // This is the default HttpTransportFactory assigned by credentials.
-          // Automatically discover and load client certificates to construct an mTLS factory.
-          X509Provider x509Provider =
-              new X509Provider(envProvider, propProvider, certConfigPathOverride);
-          KeyStore mtlsKeyStore = x509Provider.getKeyStore();
-          return new MtlsHttpTransportFactory(mtlsKeyStore);
-        } else {
-          // A user configured non-mTLS HttpTransportFactory was explicitly injected.
-          // Reject it to avoid bypassing mTLS enforcement or overriding the user's factory.
-          throw new IOException(
-              "mTLS is enabled on the system, but a user configured non-mTLS HttpTransportFactory was provided: "
-                  + baseTransportFactory.getClass().getName());
-        }
+      if (!canBeEnabled(envProvider, propProvider, certConfigPathOverride)) {
+        return baseTransportFactory;
+      }
+
+      if (baseTransportFactory instanceof MtlsHttpTransportFactory) {
+        // A custom MtlsHttpTransportFactory was already pre-configured by the user.
+        // Keep using it as-is without re-initializing.
+        return baseTransportFactory;
       }
+      
+      if (baseTransportFactory == OAuth2Utils.HTTP_TRANSPORT_FACTORY) {
+        // This is the default HttpTransportFactory assigned by credentials.
+        // Automatically discover and load client certificates to construct an mTLS factory.
+        X509Provider x509Provider =
+            new X509Provider(envProvider, propProvider, certConfigPathOverride);
+        KeyStore mtlsKeyStore = x509Provider.getKeyStore();
+        return new MtlsHttpTransportFactory(mtlsKeyStore);
+      }
+      
+      // A user configured non-mTLS HttpTransportFactory was explicitly injected.
+      // Reject it to avoid bypassing mTLS enforcement or overriding the user's factory.
+      throw new IOException(
+          "mTLS is enabled on the system, but a user configured non-mTLS HttpTransportFactory was provided: "
+              + baseTransportFactory.getClass().getName());
+
     } catch (Exception e) {
       if (mtlsPolicy == MtlsEndpointUsagePolicy.ALWAYS) {
         throw new IOException(
             "mTLS is configured to ALWAYS, but initialization failed: " + e.getMessage(), e);
       }
       // Graceful fallback to standard transport if mTLS initialization fails under AUTO policy
+      return baseTransportFactory;
     }
-    return baseTransportFactory;
   }
 }

google-auth-library-java/oauth2_http/java/com/google/auth/mtls/X509Provider.java

@@ -131,6 +131,6 @@ public KeyStore getKeyStore() throws CertificateSourceUnavailableException, IOEx
 
   @Override
   public boolean isAvailable() throws IOException {
-    return MtlsUtils.canMtlsBeEnabled(envProvider, propProvider, certConfigPathOverride);
+    return MtlsUtils.canBeEnabled(envProvider, propProvider, certConfigPathOverride);
   }
 }

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/GoogleCredentials.java

@@ -399,6 +399,7 @@ void refreshRegionalAccessBoundaryIfExpired(@Nullable URI uri, @Nullable AccessT
     }
 
     // Automatically discover certificates or enforce mTLS policy if applicable
+    // TODO: https://github.com/googleapis/google-cloud-java/issues/13461
     transportFactory =
         MtlsUtils.prepareTransportFactoryIfMtlsEnabled(
             transportFactory, getEnvironmentProvider(), getPropertyProvider(), null);
@@ -451,10 +452,6 @@ public Map<String, List<String>> getRequestMetadata(URI uri) throws IOException
       // Sets off an async refresh for request-metadata.
       refreshRegionalAccessBoundaryIfExpired(uri, getAccessToken());
     } catch (IOException e) {
-      if (MtlsUtils.getMtlsEndpointUsagePolicy(getEnvironmentProvider())
-          == MtlsUtils.MtlsEndpointUsagePolicy.ALWAYS) {
-        throw e;
-      }
       // Ignore failure in async refresh trigger.
     }
     return metadata;
@@ -485,11 +482,6 @@ public void onSuccess(Map<String, List<String>> metadata) {
             try {
               refreshRegionalAccessBoundaryIfExpired(uri, getAccessToken());
             } catch (IOException e) {
-              if (MtlsUtils.getMtlsEndpointUsagePolicy(getEnvironmentProvider())
-                  == MtlsUtils.MtlsEndpointUsagePolicy.ALWAYS) {
-                callback.onFailure(e);
-                return;
-              }
               // Ignore failure in async refresh trigger.
             }
             callback.onSuccess(metadata);

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundary.java

@@ -69,6 +69,8 @@ final class RegionalAccessBoundary implements Serializable {
   static final long TTL_MILLIS = 6 * 60 * 60 * 1000L; // 6 hours
   static final long REFRESH_THRESHOLD_MILLIS = 1 * 60 * 60 * 1000L; // 1 hour
 
+  private static MtlsUtils.MtlsEndpointUsagePolicy userMtlsPolicy = null;
+
   private final String encodedLocations;
   private final List<String> locations;
   private final long refreshTime;
@@ -190,10 +192,12 @@ static RegionalAccessBoundary refresh(
       throw new IllegalArgumentException("The provided access token is expired.");
     }
 
-    MtlsUtils.MtlsEndpointUsagePolicy mtlsPolicy =
-        MtlsUtils.getMtlsEndpointUsagePolicy(SystemEnvironmentProvider.getInstance());
+    if (userMtlsPolicy == null) {
+      userMtlsPolicy =
+          MtlsUtils.getMtlsEndpointUsagePolicy(SystemEnvironmentProvider.getInstance());
+    }
     if (transportFactory instanceof com.google.auth.mtls.MtlsHttpTransportFactory
-        || mtlsPolicy == MtlsUtils.MtlsEndpointUsagePolicy.ALWAYS) {
+        || userMtlsPolicy == MtlsUtils.MtlsEndpointUsagePolicy.ALWAYS) {
       url = url.replace("iamcredentials.googleapis.com", "iamcredentials.mtls.googleapis.com");
     }
 

google-auth-library-java/oauth2_http/javatests/com/google/auth/mtls/MtlsUtilsTest.java

@@ -244,9 +244,9 @@ public String getProperty(String name, String def) {
     assertEquals("APPDATA environment variable is not set on Windows.", exception.getMessage());
   }
 
-  // If client certificate usage is explicitly disabled, canMtlsBeEnabled should return false.
+  // If client certificate usage is explicitly disabled, canBeEnabled should return false.
   @Test
-  void canMtlsBeEnabled_allowanceExplicitFalse_returnsFalse() throws IOException {
+  void canBeEnabled_allowanceExplicitFalse_returnsFalse() throws IOException {
     EnvironmentProvider envProvider =
         new EnvironmentProvider() {
           @Override
@@ -259,13 +259,13 @@ public String getEnv(String name) {
         };
     PropertyProvider propProvider = (name, def) -> def;
 
-    assertFalse(MtlsUtils.canMtlsBeEnabled(envProvider, propProvider, null));
+    assertFalse(MtlsUtils.canBeEnabled(envProvider, propProvider, null));
   }
 
   // If client certificate usage is explicitly enabled and a valid configuration is present,
-  // canMtlsBeEnabled should return true.
+  // canBeEnabled should return true.
   @Test
-  void canMtlsBeEnabled_allowanceExplicitTrue_withConfig_returnsTrue() throws IOException {
+  void canBeEnabled_allowanceExplicitTrue_withConfig_returnsTrue() throws IOException {
     EnvironmentProvider envProvider =
         new EnvironmentProvider() {
           @Override
@@ -281,13 +281,13 @@ public String getEnv(String name) {
         };
     PropertyProvider propProvider = (name, def) -> def;
 
-    assertTrue(MtlsUtils.canMtlsBeEnabled(envProvider, propProvider, null));
+    assertTrue(MtlsUtils.canBeEnabled(envProvider, propProvider, null));
   }
 
   // If client certificate usage is unset but a valid configuration is present, mTLS should be
   // enabled by default (returns true).
   @Test
-  void canMtlsBeEnabled_allowanceUnset_withConfig_returnsTrue() throws IOException {
+  void canBeEnabled_allowanceUnset_withConfig_returnsTrue() throws IOException {
     EnvironmentProvider envProvider =
         new EnvironmentProvider() {
           @Override
@@ -300,13 +300,13 @@ public String getEnv(String name) {
         };
     PropertyProvider propProvider = (name, def) -> def;
 
-    assertTrue(MtlsUtils.canMtlsBeEnabled(envProvider, propProvider, null));
+    assertTrue(MtlsUtils.canBeEnabled(envProvider, propProvider, null));
   }
 
   // If the GOOGLE_API_CERTIFICATE_CONFIG environment variable points to a non-existent file,
-  // canMtlsBeEnabled should throw an IOException.
+  // canBeEnabled should throw an IOException.
   @Test
-  void canMtlsBeEnabled_envVarConfigMissingFile_throwsIOException() throws IOException {
+  void canBeEnabled_envVarConfigMissingFile_throwsIOException() throws IOException {
     Path nonExistentConfig = tempDir.resolve("non_existent.json");
     EnvironmentProvider envProvider =
         new EnvironmentProvider() {
@@ -321,13 +321,13 @@ public String getEnv(String name) {
     PropertyProvider propProvider = (name, def) -> def;
 
     assertThrows(
-        IOException.class, () -> MtlsUtils.canMtlsBeEnabled(envProvider, propProvider, null));
+        IOException.class, () -> MtlsUtils.canBeEnabled(envProvider, propProvider, null));
   }
 
-  // If the well-known gcloud certificate configuration file exists, canMtlsBeEnabled should return
+  // If the well-known gcloud certificate configuration file exists, canBeEnabled should return
   // true.
   @Test
-  void canMtlsBeEnabled_wellKnownConfigExists_returnsTrue() throws IOException {
+  void canBeEnabled_wellKnownConfigExists_returnsTrue() throws IOException {
     Path gcloudDir = tempDir.resolve(".config/gcloud");
     Files.createDirectories(gcloudDir);
     Path configFile = gcloudDir.resolve("certificate_config.json");
@@ -348,11 +348,11 @@ public String getProperty(String name, String def) {
           }
         };
 
-    assertTrue(MtlsUtils.canMtlsBeEnabled(envProvider, propProvider, null));
+    assertTrue(MtlsUtils.canBeEnabled(envProvider, propProvider, null));
   }
 
   @Test
-  void canMtlsBeEnabled_alwaysPolicy_clientCertDisabled_throwsException() {
+  void canBeEnabled_alwaysPolicy_clientCertDisabled_throwsException() {
     EnvironmentProvider envProvider =
         name -> {
           if ("GOOGLE_API_USE_CLIENT_CERTIFICATE".equals(name)) {
@@ -367,7 +367,7 @@ void canMtlsBeEnabled_alwaysPolicy_clientCertDisabled_throwsException() {
 
     assertThrows(
         CertificateSourceUnavailableException.class,
-        () -> MtlsUtils.canMtlsBeEnabled(envProvider, propProvider, null));
+        () -> MtlsUtils.canBeEnabled(envProvider, propProvider, null));
   }
 
   @Test
@@ -395,7 +395,7 @@ void getMtlsEndpointUsagePolicy_auto() {
   }
 
   @Test
-  void canMtlsBeEnabled_policyNever_returnsFalse() throws IOException {
+  void canBeEnabled_policyNever_returnsFalse() throws IOException {
     EnvironmentProvider envProvider =
         new EnvironmentProvider() {
           @Override
@@ -411,7 +411,7 @@ public String getEnv(String name) {
         };
     PropertyProvider propProvider = (name, def) -> def;
 
-    assertFalse(MtlsUtils.canMtlsBeEnabled(envProvider, propProvider, null));
+    assertFalse(MtlsUtils.canBeEnabled(envProvider, propProvider, null));
   }
 
   private String createJsonConfigString(Path certPath, Path keyPath) {

google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/GoogleCredentialsTest.java

@@ -1220,28 +1220,6 @@ public void regionalAccessBoundary_shouldFailOpenWhenRefreshCannotBeStarted() th
     assertNull(headers.get(X_ALLOWED_LOCATIONS_HEADER_KEY));
   }
 
-  @Test
-  public void regionalAccessBoundary_alwaysPolicy_missingCertConfig_throwsException() {
-    TestEnvironmentProvider envProvider = new TestEnvironmentProvider();
-    envProvider.setEnv("GOOGLE_API_USE_MTLS_ENDPOINT", "always");
-
-    GoogleCredentials credentials =
-        new TestRegionalCredentials(new AccessToken("some-token", null), envProvider);
-
-    assertThrows(IOException.class, () -> credentials.getRequestMetadata());
-  }
-
-  @Test
-  public void regionalAccessBoundary_alwaysPolicy_userConfiguredNonMtlsFactory_throwsException() {
-    TestEnvironmentProvider envProvider = new TestEnvironmentProvider();
-    envProvider.setEnv("GOOGLE_API_USE_MTLS_ENDPOINT", "always");
-
-    GoogleCredentials credentials =
-        new TestRegionalCredentials(
-            new AccessToken("some-token", null), envProvider, DUMMY_TRANSPORT_FACTORY);
-
-    assertThrows(IOException.class, () -> credentials.getRequestMetadata());
-  }
 
   @Test
   public void regionalAccessBoundary_deduplicationOfConcurrentRefreshes()