fix: Fix docstrings and minor nits

Signed-off-by: Radhika Agrawal <agrawalradhika@google.com>

Author: agrawalradhika-cell

google/auth/transport/_mtls_helper.py

@@ -410,11 +410,12 @@ def client_cert_callback():
 def check_use_client_cert():
     """Returns boolean for whether the client certificate should be used for mTLS.
 
-    This value is meant to be interpreted as a boolean representing whether
-    the client certificate should be used. If GOOGLE_API_USE_CLIENT_CERTIFICATE
-    is unset, the value will be inferred by reading a file pointed at by
-    GOOGLE_API_CERTIFICATE_CONFIG, and verifying it contains a "workload"
-    section. If so, the function will return True, otherwise False.
+    If GOOGLE_API_USE_CLIENT_CERTIFICATE is set to true or false, a corresponding
+    bool value will be returned.
+    If GOOGLE_API_USE_CLIENT_CERTIFICATE is unset, the value will be inferred
+    by reading a file pointed at by GOOGLE_API_CERTIFICATE_CONFIG, and verifying
+    it contains a "workload" section. If so, the function will return True,
+    otherwise False.
 
     Returns:
         bool: Whether the client certificate should be used for mTLS connection.
@@ -424,10 +425,7 @@ def check_use_client_cert():
     if use_client_cert:
         if use_client_cert.lower() == "true":
             return True
-        # Check if GOOGLE_API_USE_CLIENT_CERTIFICATE is set to false explicitly.
-        # Invalid values for GOOGLE_API_USE_CLIENT_CERTIFICATE are not handled here.
-        # That will be handled by the code calling this function.
-        elif use_client_cert.lower() == "false":
+        else:
             return False
     else:
         # Check if the value of GOOGLE_API_CERTIFICATE_CONFIG is set.

google/auth/transport/grpc.py

@@ -292,7 +292,7 @@ class SslCredentials:
 
     def __init__(self):
         use_client_cert = _mtls_helper.check_use_client_cert()
-        if use_client_cert:
+        if not use_client_cert:
             self._is_mtls = False
         else:
             # Load client SSL credentials.

google/auth/transport/mtls.py

@@ -116,14 +116,12 @@ def should_use_client_cert():
     """Returns boolean for whether the client certificate should be used for mTLS.
 
     This is a wrapper around _mtls_helper.check_use_client_cert().
-    The value is meant to be interpreted as a boolean representing whether
-    the client certificate should be used. If GOOGLE_API_USE_CLIENT_CERTIFICATE
-    is unset, the value will be inferred by reading a file pointed at by
-    GOOGLE_API_CERTIFICATE_CONFIG, and verifying it contains a "workload"
-    section. If so, the function will return True, otherwise False. Also, note
-    that if GOOGLE_API_USE_CLIENT_CERTIFICATE is set but is not 'true' or 'false'
-    (case-insensitive), this check is inconclusive, that case should be handled
-    by the caller.
+    If GOOGLE_API_USE_CLIENT_CERTIFICATE is set to true or false, a corresponding
+    bool value will be returned
+    If GOOGLE_API_USE_CLIENT_CERTIFICATE is unset, the value will be inferred by
+    reading a file pointed at by GOOGLE_API_CERTIFICATE_CONFIG, and verifying it
+    contains a "workload" section. If so, the function will return True,
+    otherwise False.
 
     Returns:
        bool: indicating whether the client certificate should be used for mTLS.

google/auth/transport/requests.py

@@ -443,7 +443,7 @@ def configure_mtls_channel(self, client_cert_callback=None):
                 creation failed for any reason.
         """
         use_client_cert = google.auth.transport._mtls_helper.check_use_client_cert()
-        if use_client_cert:
+        if not use_client_cert:
             self._is_mtls = False
             return
         try:

google/auth/transport/urllib3.py

@@ -334,7 +334,7 @@ def configure_mtls_channel(self, client_cert_callback=None):
                 creation failed for any reason.
         """
         use_client_cert = transport._mtls_helper.check_use_client_cert()
-        if use_client_cert:
+        if not use_client_cert:
             return False
         try:
             import OpenSSL

tests/transport/test__mtls_helper.py

@@ -643,7 +643,7 @@ def test_crypto_error(self):
     def test_check_use_client_cert(self, monkeypatch):
         monkeypatch.setenv("GOOGLE_API_USE_CLIENT_CERTIFICATE", "true")
         use_client_cert = _mtls_helper.check_use_client_cert()
-        assert use_client_cert
+        assert use_client_cert is True
 
     def test_check_use_client_cert_for_workload_with_config_file(self, monkeypatch):
         config_data = {
@@ -663,19 +663,19 @@ def test_check_use_client_cert_for_workload_with_config_file(self, monkeypatch):
         mock_file_handle = mock.mock_open(read_data=config_file_content)
         with mock.patch("builtins.open", mock_file_handle):
             use_client_cert = _mtls_helper.check_use_client_cert()
-            assert use_client_cert
+            assert use_client_cert is True
 
     def test_check_use_client_cert_false(self, monkeypatch):
         monkeypatch.setenv("GOOGLE_API_USE_CLIENT_CERTIFICATE", "false")
         use_client_cert = _mtls_helper.check_use_client_cert()
-        assert not use_client_cert
+        assert use_client_cert is False
 
     def test_check_use_client_cert_for_workload_with_config_file_not_found(
         self, monkeypatch
     ):
         monkeypatch.setenv("GOOGLE_API_USE_CLIENT_CERTIFICATE", "")
         use_client_cert = _mtls_helper.check_use_client_cert()
-        assert not use_client_cert
+        assert use_client_cert is False
 
     def test_check_use_client_cert_for_workload_with_config_file_not_json(
         self, monkeypatch
@@ -688,7 +688,7 @@ def test_check_use_client_cert_for_workload_with_config_file_not_json(
         mock_file_handle = mock.mock_open(read_data=config_file_content)
         with mock.patch("builtins.open", mock_file_handle):
             use_client_cert = _mtls_helper.check_use_client_cert()
-            assert not use_client_cert
+            assert use_client_cert is False
 
     def test_check_use_client_cert_for_workload_with_config_file_no_workload(
         self, monkeypatch
@@ -702,11 +702,11 @@ def test_check_use_client_cert_for_workload_with_config_file_no_workload(
         mock_file_handle = mock.mock_open(read_data=config_file_content)
         with mock.patch("builtins.open", mock_file_handle):
             use_client_cert = _mtls_helper.check_use_client_cert()
-            assert not use_client_cert
+            assert use_client_cert is False
 
     def test_check_use_client_cert_when_file_does_not_exist(self, monkeypatch):
         config_filename = "mock_certificate_config.json"
         monkeypatch.setenv("GOOGLE_API_CERTIFICATE_CONFIG", config_filename)
         monkeypatch.setenv("GOOGLE_API_USE_CLIENT_CERTIFICATE", "")
         use_client_cert = _mtls_helper.check_use_client_cert()
-        assert not use_client_cert
+        assert use_client_cert is False