Skip to content

chore(auth): Regional access boundaries port the feature latest RAB feature branch - #8769

Merged
vverman merged 7 commits into
googleapis:regional-access-boudaries-july2026from
vverman:regional-access-boundaries-main-merge
Jul 14, 2026
Merged

chore(auth): Regional access boundaries port the feature latest RAB feature branch#8769
vverman merged 7 commits into
googleapis:regional-access-boudaries-july2026from
vverman:regional-access-boundaries-main-merge

Conversation

@vverman

@vverman vverman commented Jun 26, 2026

Copy link
Copy Markdown
Contributor

The Regional Access Boundaries PR to main. Contains all the changes merged to the feature branch "regional-access-boundaries" rebased on top of main.

vverman added 5 commits June 16, 2026 17:37
@vverman
feat: Regional Access Boundary Migration. (googleapis#8043)
9cbebcc
@vverman
feat: Update Regional Access Boundaries (googleapis#8099)
07c8a5b 
* RAB endpoints changed from staging to prod; Removed RAB env variable gate; updated tests.

* removed sinon.createSandbox from nested beforeEach blocks in test.compute.ts, test.jwt.ts, and test.impersonated.ts.
@vverman
feat(auth): Skip RAB lookup if MDS returns a non-email. (googleapis#8440
9b490cf 
)

* feat(auth): Skip RAB lookup if MDS returns a non-email.

* Added logic to skip MDS calls in case non-email is returned. Added tests.

* Added email regex as a const.

* Simplified logic.
@vverman
Addressed comments.
6b2764f
@vverman
Changed log levels to debug.
02db3e6
@vverman vverman added the do not merge Indicates a pull request not ready for merge, due to either quality or timing. label Jun 26, 2026
@vverman
vverman marked this pull request as ready for review June 26, 2026 21:16
@vverman
vverman requested a review from a team as a code owner June 26, 2026 21:16
gemini-code-assist[bot]
gemini-code-assist Bot reviewed Jun 26, 2026
View reviewed changes

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces Regional Access Boundary (RAB) support to the Google Auth Library for Node.js, adding a RegionalAccessBoundaryManager to fetch, cache, and apply regional access boundary rules (such as the x-allowed-locations header) across various auth clients. Feedback on the changes includes correcting swapped comments for workload and workforce identity pools in baseexternalclient.ts, and replacing flaky polling loops with direct awaits on the internal refresh promise in the test suite.

Comment thread core/packages/google-auth-library-nodejs/src/auth/baseexternalclient.ts Outdated
Comment thread core/packages/google-auth-library-nodejs/test/test.authclient.ts Outdated
@vverman
vverman changed the base branch from main to regional-access-boudaries-july2026 July 10, 2026 19:36
@vverman vverman removed the do not merge Indicates a pull request not ready for merge, due to either quality or timing. label Jul 10, 2026
@vverman vverman changed the title feat(auth): Regional access boundaries main merge chore(auth): Regional access boundaries port the feature latest RAB feature branch Jul 10, 2026
nbayati
nbayati reviewed Jul 14, 2026
View reviewed changes

@nbayati nbayati left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for opening this PR, everything looks great.

I did notice one pre-existing issue carried over from the old feature branch that we should probably address here. Across several test files, the tests are using a setTimeout polling loop to wait for the background RAB refresh to complete, rather than awaiting the promise directly. I see you already started cleaning this up in test.authclient.ts in your recent nit fixes commit by directly awaiting regionalAccessBoundaryRefreshPromise. It would be great to apply that same pattern to the remaining test files.

Comment thread core/packages/google-auth-library-nodejs/test/test.baseexternalclient.ts Outdated
Comment thread core/packages/google-auth-library-nodejs/test/test.baseexternalclient.ts Outdated
Comment thread core/packages/google-auth-library-nodejs/test/test.baseexternalclient.ts Outdated
Comment thread core/packages/google-auth-library-nodejs/test/test.compute.ts Outdated
Comment thread core/packages/google-auth-library-nodejs/test/test.compute.ts Outdated
Comment thread core/packages/google-auth-library-nodejs/test/test.externalaccountauthorizeduserclient.ts Outdated
Comment thread core/packages/google-auth-library-nodejs/test/test.impersonated.ts Outdated
Comment thread core/packages/google-auth-library-nodejs/test/test.jwt.ts Outdated
Comment thread core/packages/google-auth-library-nodejs/test/test.jwt.ts Outdated
@vverman
vverman requested a review from nbayati July 14, 2026 20:43
@vverman
vverman merged commit 6643bec into googleapis:regional-access-boudaries-july2026 Jul 14, 2026
12 checks passed
@vverman
vverman deleted the regional-access-boundaries-main-merge branch July 14, 2026 21:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@nbayati nbayati nbayati approved these changes
+1 more reviewer
@gemini-code-assist gemini-code-assist[bot] gemini-code-assist[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@vverman @nbayati