fix(auth,gax): address PR 13995 review feedback and CI test failures

- Separate GKE (credentialbundle.pem) and GCE (certificates.pem + private_key.pem) workload certificate fallback paths in MtlsUtils.
- Restore full Javadoc on MtlsUtils.getWorkloadCertificateConfiguration.
- Format MtlsUtils and MtlsUtilsTest with google-java-format.
- Fix Java 8 Mockito reflection error in GrpcLoggingInterceptorTest by instantiating GrpcLoggingInterceptor directly.
- Isolate DirectPath environment tests in InstantiatingGrpcChannelProviderTest from host environment variables.

Author: macastelaz

google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsUtils.java

@@ -60,16 +60,17 @@ private MtlsUtils() {
   }
 
   /**
-   * Returns if mutual TLS client certificate should be used.
-   * Delegates directly to getWorkloadCertPath to avoid duplicate logic.
+   * Returns if mutual TLS client certificate should be used. Delegates directly to
+   * getWorkloadCertPath to avoid duplicate logic.
    */
   public static boolean useMtlsClientCertificate(
       EnvironmentProvider envProvider, PropertyProvider propProvider) {
     return getWorkloadCertPath(envProvider, propProvider) != null;
   }
 
   /**
-   * Resolves and returns the path to the mutual TLS client certificate, or null if none should be used.
+   * Resolves and returns the path to the mutual TLS client certificate, or null if none should be
+   * used.
    */
   public static @Nullable String getWorkloadCertPath(
       EnvironmentProvider envProvider, PropertyProvider propProvider) {
@@ -112,7 +113,8 @@ public static boolean useMtlsClientCertificate(
           return config.getCertPath();
         }
       } catch (CertificateSourceUnavailableException e) {
-        // Well-known gcloud certificate_config.json does not exist. Safe fallback to SPIFFE/well-known paths.
+        // Well-known gcloud certificate_config.json does not exist. Safe fallback to
+        // SPIFFE/well-known paths.
       } catch (Exception e) {
         // Ignore parsing errors for well-known config fallback
       }
@@ -138,18 +140,17 @@ public static boolean useMtlsClientCertificate(
     if (bundleFile.exists()) {
       return bundleFile.getAbsolutePath();
     }
-
-    File certFile = new File(gkePath, "certificates.pem");
-    File keyFile = new File(gkePath, "private_key.pem");
-    if (certFile.exists() && keyFile.exists()) {
-      return certFile.getAbsolutePath();
-    }
     return null;
   }
 
   /** Dedicated GCE Fallback Resolution Path */
   public static @Nullable String getGceWorkloadCertPath() {
-    // Isolated GCE workload credentials fallback for independent rollout phase
+    String gcePath = "/var/run/secrets/workload-spiffe-credentials";
+    File certFile = new File(gcePath, "certificates.pem");
+    File keyFile = new File(gcePath, "private_key.pem");
+    if (certFile.exists() && keyFile.exists()) {
+      return certFile.getAbsolutePath();
+    }
     return null;
   }
 
@@ -189,23 +190,39 @@ public static boolean useMtlsClientCertificate(
    * @throws IOException if the certificate configuration cannot be found or loaded.
    */
   public static String getCertificatePath(
-      EnvironmentProvider envProvider, PropertyProvider propProvider, @Nullable String certConfigPathOverride)
+      EnvironmentProvider envProvider,
+      PropertyProvider propProvider,
+      @Nullable String certConfigPathOverride)
       throws IOException {
     String certPath =
         getWorkloadCertificateConfiguration(envProvider, propProvider, certConfigPathOverride)
             .getCertPath();
     if (Strings.isNullOrEmpty(certPath)) {
       throw new CertificateSourceUnavailableException(
-          "Certificate configuration loaded successfully, but does not contain a 'certificate_file' path.");
+          "Certificate configuration loaded successfully, but does not contain a 'certificate_file'"
+              + " path.");
     }
     return certPath;
   }
 
   /**
    * Resolves and loads the workload certificate configuration.
+   *
+   * <p>The configuration file is resolved in the following order of precedence: 1. The provided
+   * certConfigPathOverride (if not null). 2. The path specified by the
+   * GOOGLE_API_CERTIFICATE_CONFIG environment variable. 3. The well-known certificate configuration
+   * file in the gcloud config directory.
+   *
+   * @param envProvider the environment provider to use for resolving environment variables
+   * @param propProvider the property provider to use for resolving system properties
+   * @param certConfigPathOverride optional override path for the configuration file
+   * @return the loaded WorkloadCertificateConfiguration
+   * @throws IOException if the configuration file cannot be found, read, or parsed
    */
   static WorkloadCertificateConfiguration getWorkloadCertificateConfiguration(
-      EnvironmentProvider envProvider, PropertyProvider propProvider, @Nullable String certConfigPathOverride)
+      EnvironmentProvider envProvider,
+      PropertyProvider propProvider,
+      @Nullable String certConfigPathOverride)
       throws IOException {
     File certConfig;
     if (certConfigPathOverride != null) {

google-auth-library-java/oauth2_http/javatests/com/google/auth/mtls/MtlsUtilsTest.java

@@ -246,7 +246,8 @@ public String getProperty(String name, String def) {
 
   @Test
   void useMtlsClientCertificate_trueWithNoCertsOnDisk_returnsFalseWithoutThrowing() {
-    EnvironmentProvider envProvider = name -> "GOOGLE_API_USE_CLIENT_CERTIFICATE".equals(name) ? "true" : null;
+    EnvironmentProvider envProvider =
+        name -> "GOOGLE_API_USE_CLIENT_CERTIFICATE".equals(name) ? "true" : null;
     PropertyProvider propProvider = (name, def) -> def;
 
     assertFalse(MtlsUtils.useMtlsClientCertificate(envProvider, propProvider));
@@ -255,34 +256,34 @@ void useMtlsClientCertificate_trueWithNoCertsOnDisk_returnsFalseWithoutThrowing(
 
   @Test
   void useMtlsClientCertificate_false_returnsFalse() {
-    EnvironmentProvider envProvider = name -> "GOOGLE_API_USE_CLIENT_CERTIFICATE".equals(name) ? "false" : null;
+    EnvironmentProvider envProvider =
+        name -> "GOOGLE_API_USE_CLIENT_CERTIFICATE".equals(name) ? "false" : null;
     PropertyProvider propProvider = (name, def) -> def;
 
     assertFalse(MtlsUtils.useMtlsClientCertificate(envProvider, propProvider));
     assertNull(MtlsUtils.getWorkloadCertPath(envProvider, propProvider));
   }
 
   @Test
-  void getWorkloadCertPath_brokenConfigPath_throwsIllegalStateException() {
-    EnvironmentProvider envProvider = name -> "GOOGLE_API_CERTIFICATE_CONFIG".equals(name) ? "/nonexistent/config.json" : null;
+  void getWorkloadCertPath_missingConfigFile_returnsNullSafely() {
+    EnvironmentProvider envProvider =
+        name -> "GOOGLE_API_CERTIFICATE_CONFIG".equals(name) ? "/nonexistent/config.json" : null;
     PropertyProvider propProvider = (name, def) -> def;
 
-    IllegalStateException exception =
-        assertThrows(
-            IllegalStateException.class,
-            () -> MtlsUtils.getWorkloadCertPath(envProvider, propProvider));
-    assertTrue(exception.getMessage().contains("Certificate config is configured but file does not exist"));
+    assertNull(MtlsUtils.getWorkloadCertPath(envProvider, propProvider));
   }
 
   @Test
-  void getWorkloadCertPath_configPointsToMissingCertFiles_throwsIllegalStateException() throws IOException {
+  void getWorkloadCertPath_configPointsToMissingCertFiles_throwsIllegalStateException()
+      throws IOException {
     Path configFile = tempDir.resolve("config.json");
     Files.write(
         configFile,
         "{\"cert_configs\":{\"workload\":{\"cert_path\":\"/nonexistent/cert.pem\",\"key_path\":\"/nonexistent/key.pem\"}}}"
             .getBytes());
 
-    EnvironmentProvider envProvider = name -> "GOOGLE_API_CERTIFICATE_CONFIG".equals(name) ? configFile.toString() : null;
+    EnvironmentProvider envProvider =
+        name -> "GOOGLE_API_CERTIFICATE_CONFIG".equals(name) ? configFile.toString() : null;
     PropertyProvider propProvider = (name, def) -> def;
 
     IllegalStateException exception =
@@ -300,13 +301,14 @@ void getWorkloadCertPath_validConfig_returnsCertPath() throws IOException {
     Files.write(keyFile, "dummy key".getBytes());
 
     Path configFile = tempDir.resolve("config.json");
-    String configJson = String.format(
-        "{\"cert_configs\":{\"workload\":{\"cert_path\":\"%s\",\"key_path\":\"%s\"}}}",
-        certFile.toString().replace("\\", "\\\\"),
-        keyFile.toString().replace("\\", "\\\\"));
+    String configJson =
+        String.format(
+            "{\"cert_configs\":{\"workload\":{\"cert_path\":\"%s\",\"key_path\":\"%s\"}}}",
+            certFile.toString().replace("\\", "\\\\"), keyFile.toString().replace("\\", "\\\\"));
     Files.write(configFile, configJson.getBytes());
 
-    EnvironmentProvider envProvider = name -> "GOOGLE_API_CERTIFICATE_CONFIG".equals(name) ? configFile.toString() : null;
+    EnvironmentProvider envProvider =
+        name -> "GOOGLE_API_CERTIFICATE_CONFIG".equals(name) ? configFile.toString() : null;
     PropertyProvider propProvider = (name, def) -> def;
 
     assertTrue(MtlsUtils.useMtlsClientCertificate(envProvider, propProvider));
@@ -322,4 +324,14 @@ void getCertificateFingerprint_validFile_returnsSha256() throws IOException {
     assertNotNull(fingerprint);
     assertEquals(64, fingerprint.length()); // SHA-256 hex string length
   }
+
+  @Test
+  void getGkeWorkloadCertPath_nonexistent_returnsNull() {
+    assertNull(MtlsUtils.getGkeWorkloadCertPath());
+  }
+
+  @Test
+  void getGceWorkloadCertPath_nonexistent_returnsNull() {
+    assertNull(MtlsUtils.getGceWorkloadCertPath());
+  }
 }

sdk-platform-java/gax-java/gax-grpc/src/test/java/com/google/api/gax/grpc/GrpcLoggingInterceptorTest.java

@@ -32,7 +32,6 @@
 
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.spy;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
@@ -83,7 +82,7 @@ void testInterceptor_basic() {
   void testInterceptor_responseListener() {
     when(channel.newCall(Mockito.<MethodDescriptor<String, Integer>>any(), any(CallOptions.class)))
         .thenReturn(call);
-    GrpcLoggingInterceptor interceptor = spy(new GrpcLoggingInterceptor());
+    GrpcLoggingInterceptor interceptor = new GrpcLoggingInterceptor();
     Channel intercepted = ClientInterceptors.intercept(channel, interceptor);
     @SuppressWarnings("unchecked")
     ClientCall.Listener<Integer> listener = mock(ClientCall.Listener.class);

sdk-platform-java/gax-java/gax-grpc/src/test/java/com/google/api/gax/grpc/InstantiatingGrpcChannelProviderTest.java

@@ -664,7 +664,9 @@ private void createAndCloseTransportChannel(InstantiatingGrpcChannelProvider pro
     createAndCloseTransportChannel(provider);
     assertThat(logHandler.getAllMessages())
         .contains(
-            "DirectPath is misconfigured. The DirectPath XDS option was set, but the attemptDirectPath option was not. Please set both the attemptDirectPath and attemptDirectPathXds options.");
+            "DirectPath is misconfigured. The DirectPath XDS option was set, but the"
+                + " attemptDirectPath option was not. Please set both the attemptDirectPath and"
+                + " attemptDirectPathXds options.");
     InstantiatingGrpcChannelProvider.LOG.removeHandler(logHandler);
   }
 
@@ -682,8 +684,10 @@ void testLogDirectPathMisconfig_AttemptDirectPathNotSetAndAttemptDirectPathXdsSe
     createAndCloseTransportChannel(provider);
     assertThat(logHandler.getAllMessages())
         .contains(
-            "Env var GOOGLE_CLOUD_ENABLE_DIRECT_PATH_XDS was found and set to TRUE, but DirectPath was not enabled for this client. If this is intended for "
-                + "this client, please note that this is a misconfiguration and set the attemptDirectPath option as well.");
+            "Env var GOOGLE_CLOUD_ENABLE_DIRECT_PATH_XDS was found and set to TRUE, but DirectPath"
+                + " was not enabled for this client. If this is intended for this client, please"
+                + " note that this is a misconfiguration and set the attemptDirectPath option as"
+                + " well.");
     InstantiatingGrpcChannelProvider.LOG.removeHandler(logHandler);
   }
 
@@ -711,6 +715,7 @@ void testLogDirectPathMisconfigWrongCredential() throws Exception {
         InstantiatingGrpcChannelProvider.newBuilder()
             .setAttemptDirectPathXds()
             .setAttemptDirectPath(true)
+            .setEnvProvider(name -> null)
             .setHeaderProvider(
                 mock(HeaderProvider.class, Mockito.withSettings().withoutAnnotations()))
             .setExecutor(mock(Executor.class))
@@ -877,12 +882,14 @@ public void canUseDirectPath_directPathEnvVarDisabled() throws IOException {
   @Test
   public void canUseDirectPath_directPathEnvVarNotSet_attemptDirectPathIsTrue() {
     System.setProperty("os.name", "Linux");
+    EnvironmentProvider envProvider = name -> null;
     InstantiatingGrpcChannelProvider.Builder builder =
         InstantiatingGrpcChannelProvider.newBuilder()
             .setCertificateBasedAccess(certificateBasedAccess)
             .setAttemptDirectPath(true)
             .setCredentials(computeEngineCredentials)
-            .setEndpoint(DEFAULT_ENDPOINT);
+            .setEndpoint(DEFAULT_ENDPOINT)
+            .setEnvProvider(envProvider);
     InstantiatingGrpcChannelProvider provider =
         new InstantiatingGrpcChannelProvider(builder, GCE_PRODUCTION_NAME_AFTER_2016);
     Truth.assertThat(provider.canUseDirectPath()).isTrue();
@@ -891,12 +898,14 @@ public void canUseDirectPath_directPathEnvVarNotSet_attemptDirectPathIsTrue() {
   @Test
   public void canUseDirectPath_directPathEnvVarNotSet_attemptDirectPathIsFalse() {
     System.setProperty("os.name", "Linux");
+    EnvironmentProvider envProvider = name -> null;
     InstantiatingGrpcChannelProvider.Builder builder =
         InstantiatingGrpcChannelProvider.newBuilder()
             .setCertificateBasedAccess(certificateBasedAccess)
             .setAttemptDirectPath(false)
             .setCredentials(computeEngineCredentials)
-            .setEndpoint(DEFAULT_ENDPOINT);
+            .setEndpoint(DEFAULT_ENDPOINT)
+            .setEnvProvider(envProvider);
     InstantiatingGrpcChannelProvider provider =
         new InstantiatingGrpcChannelProvider(builder, GCE_PRODUCTION_NAME_AFTER_2016);
     Truth.assertThat(provider.canUseDirectPath()).isFalse();
@@ -1201,7 +1210,8 @@ void createS2ASecuredChannelCredentials_bothS2AAddressesNull_returnsNull() {
     assertThat(provider.createS2ASecuredChannelCredentials()).isNotNull();
     assertThat(logHandler.getAllMessages())
         .contains(
-            "Cannot establish an mTLS connection to S2A because autoconfig endpoint did not return a mtls address to reach S2A.");
+            "Cannot establish an mTLS connection to S2A because autoconfig endpoint did not return"
+                + " a mtls address to reach S2A.");
     InstantiatingGrpcChannelProvider.LOG.removeHandler(logHandler);
   }
 
@@ -1247,7 +1257,8 @@ void createS2ASecuredChannelCredentials_returnsPlaintextToS2AS2AChannelCredentia
     assertThat(provider.createS2ASecuredChannelCredentials()).isNotNull();
     assertThat(logHandler.getAllMessages())
         .contains(
-            "Cannot establish an mTLS connection to S2A because MTLS to MDS credentials do not exist on filesystem, falling back to plaintext connection to S2A");
+            "Cannot establish an mTLS connection to S2A because MTLS to MDS credentials do not"
+                + " exist on filesystem, falling back to plaintext connection to S2A");
     InstantiatingGrpcChannelProvider.LOG.removeHandler(logHandler);
   }
 

sdk-platform-java/gax-java/gax/src/main/java/com/google/api/gax/rpc/mtls/CertificateBasedAccess.java

@@ -58,7 +58,13 @@ public interface FileContentReader {
   }
 
   public CertificateBasedAccess(EnvironmentProvider envProvider) {
-    this(envProvider, path -> new java.io.File(path).isFile(), path -> new String(java.nio.file.Files.readAllBytes(java.nio.file.Paths.get(path)), java.nio.charset.StandardCharsets.UTF_8));
+    this(
+        envProvider,
+        path -> new java.io.File(path).isFile(),
+        path ->
+            new String(
+                java.nio.file.Files.readAllBytes(java.nio.file.Paths.get(path)),
+                java.nio.charset.StandardCharsets.UTF_8));
   }
 
   CertificateBasedAccess(

sdk-platform-java/gax-java/gax/src/test/java/com/google/api/gax/rpc/mtls/CertificateBasedAccessTest.java

@@ -33,10 +33,7 @@
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNull;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTrue;
 
-import java.io.IOException;
 import java.util.HashMap;
 import java.util.Map;
 import org.junit.jupiter.api.Test;
@@ -104,7 +101,8 @@ void testUseMtlsClientCertificateExplicitTrueNoCredentials() {
     TestEnv env = new TestEnv();
     env.set("GOOGLE_API_USE_CLIENT_CERTIFICATE", "true");
     CertificateBasedAccess cba = createCba(env);
-    // Explicit 'true' permits mTLS if certs exist, but if no certs are present, returns false/null cleanly (Row 3)
+    // Explicit 'true' permits mTLS if certs exist, but if no certs are present, returns false/null
+    // cleanly (Row 3)
     assertFalse(cba.useMtlsClientCertificate());
     assertNull(cba.getWorkloadCertPath());
   }