feat(auth): make RAB feature production ready

[nbayati]

This PR resolves issues identified during verification of gcloud Regional Access Boundary (RAB) flows and enables RAB verification by default:

• Removes the client-side environment variable feature gate (GOOGLE_AUTH_TRUST_BOUNDARY_ENABLED) to execute RAB lookups by default across standard credential classes.
• Updates the Python auth SDK to recognize mTLS regional endpoints (.rep.mtls.googleapis.com), bypassing redundant RAB lookups on secure transport boundaries.
• Defers Service Account impersonation setup until HTTP request execution before_request, propagating active cached tokens downward onto the inner credential to guarantee that access tokens restored across external CLI entrypoints correctly delegate regional access boundary (RAB) lookups to target Service Account endpoints without forcing redundant STS network renewal.

[gemini-code-assist]

Code Review

This pull request enables the Regional Access Boundary (RAB) feature by default by removing the GOOGLE_AUTH_TRUST_BOUNDARY_ENABLED environment variable gate. It also expands regional endpoint detection to support MTLS domains and updates external account credentials to initialize impersonated credentials immediately, delegating token and expiry management. Unit tests have been adjusted to remove obsolete environment variable mocks and to mock the RAB allowed locations endpoint. There are no review comments, so I have no feedback to provide.

[lsirac]

While the new unit tests cover the basic happy paths, there are a few critical testing gaps around backward compatibility, error handling, and subclassing that should be addressed before merging:

1. Backward Compatibility with Pickled States:

   • The Gap: No test verifies unpickling a credential object serialized in a previous release.
   • The Risk: Because token and expiry are now properties (data descriptors), they override instance __dict__ lookups. Older unpickled credentials (which store 'token' and 'expiry' as plain keys) will have their cached tokens silently ignored, forcing redundant STS network calls.
   • Recommendation: Add a test that unpickles a legacy state and asserts the token is preserved.

2. Extensibility & Custom Subclassing:

   • The Gap: No test verifies that external developers can safely subclass these credentials.
   • The Risk: Triggering immediate impersonation in the base constructor calls _constructor_args() before the subclass has finished setting up. This causes a fatal AttributeError on subclass instantiation.
   • Recommendation: Add a test verifying instantiation of a mock custom subclass.

3. Error-Handling on Misconfiguration:

   • The Gap: No test verifies that invalid/misconfigured setups fail gracefully.
   • The Risk: Misconfiguring the credential source and supplier triggers the immediate copying flow, crashing with a confusing, internal AttributeError instead of raising a clean exceptions.InvalidValue validation error.
   • Recommendation: Add a test asserting that invalid configurations raise exceptions.InvalidValue.

4. Programmatic Suppliers in from_info:

   • The Gap: No test verifies passing programmatic suppliers to the static from_info method.
   • The Risk: from_info in both aws.py and identity_pool.py unconditionally updates kwargs with None from the JSON dictionary, silently discarding the user's programmatic supplier.
   • Recommendation: Add a test calling Credentials.from_info(info, supplier=my_callback) and assert the callback retention.callback)` and assert the check that the callback is preserved supplier works.

[nbayati]

• Backward Compatibility with Pickled States:

  • The Gap: No test verifies unpickling a credential object serialized in a previous release.
  • The Risk: Because token and expiry are now properties (data descriptors), they override instance __dict__ lookups. Older unpickled credentials (which store 'token' and 'expiry' as plain keys) will have their cached tokens silently ignored, forcing redundant STS network calls.
  • Recommendation: Add a test that unpickles a legacy state and asserts the token is preserved.

• Extensibility & Custom Subclassing:

  • The Gap: No test verifies that external developers can safely subclass these credentials.
  • The Risk: Triggering immediate impersonation in the base constructor calls _constructor_args() before the subclass has finished setting up. This causes a fatal AttributeError on subclass instantiation.
  • Recommendation: Add a test verifying instantiation of a mock custom subclass.

• Error-Handling on Misconfiguration:

  • The Gap: No test verifies that invalid/misconfigured setups fail gracefully.
  • The Risk: Misconfiguring the credential source and supplier triggers the immediate copying flow, crashing with a confusing, internal AttributeError instead of raising a clean exceptions.InvalidValue validation error.
  • Recommendation: Add a test asserting that invalid configurations raise exceptions.InvalidValue.

• Programmatic Suppliers in from_info:

  • The Gap: No test verifies passing programmatic suppliers to the static from_info method.
  • The Risk: from_info in both aws.py and identity_pool.py unconditionally updates kwargs with None from the JSON dictionary, silently discarding the user's programmatic supplier.
  • Recommendation: Add a test calling Credentials.from_info(info, supplier=my_callback) and assert the callback retention.callback)` and assert the check that the callback is preserved supplier works.

Gaps 1, 2, and 3 are not relevant anymore since I changed the way we were fixing the gcloud impersonation RAB lookup bug. I added checks and tests for gap 4 though!

[lsirac]

• Backward Compatibility with Pickled States:

  • The Gap: No test verifies unpickling a credential object serialized in a previous release.
  • The Risk: Because token and expiry are now properties (data descriptors), they override instance __dict__ lookups. Older unpickled credentials (which store 'token' and 'expiry' as plain keys) will have their cached tokens silently ignored, forcing redundant STS network calls.
  • Recommendation: Add a test that unpickles a legacy state and asserts the token is preserved.

• Extensibility & Custom Subclassing:

  • The Gap: No test verifies that external developers can safely subclass these credentials.
  • The Risk: Triggering immediate impersonation in the base constructor calls _constructor_args() before the subclass has finished setting up. This causes a fatal AttributeError on subclass instantiation.
  • Recommendation: Add a test verifying instantiation of a mock custom subclass.

• Error-Handling on Misconfiguration:

  • The Gap: No test verifies that invalid/misconfigured setups fail gracefully.
  • The Risk: Misconfiguring the credential source and supplier triggers the immediate copying flow, crashing with a confusing, internal AttributeError instead of raising a clean exceptions.InvalidValue validation error.
  • Recommendation: Add a test asserting that invalid configurations raise exceptions.InvalidValue.

• Programmatic Suppliers in from_info:

  • The Gap: No test verifies passing programmatic suppliers to the static from_info method.
  • The Risk: from_info in both aws.py and identity_pool.py unconditionally updates kwargs with None from the JSON dictionary, silently discarding the user's programmatic supplier.
  • Recommendation: Add a test calling Credentials.from_info(info, supplier=my_callback) and assert the callback retention.callback)` and assert the check that the callback is preserved supplier works.

Gaps 1, 2, and 3 are not relevant anymore since I changed the way we were fixing the gcloud impersonation RAB lookup bug. I added checks and tests for gap 4 though!

Awesome, thank you for adding the checks and tests for gap 4!

re: the other gaps, let's still add these tests to prevent regressions in the future

[daniel-sanche]

This looks like a publicly accessible value. I don't think it's safe to remove, in case someone imported it. Can we just leave it with a comment that it's deprecated?

[nbayati]

Done!

[daniel-sanche]

LGTM