feat(auth): Regional access boundaries main merge#8665
Conversation
* RAB endpoints changed from staging to prod; Removed RAB env variable gate; updated tests. * removed sinon.createSandbox from nested beforeEach blocks in test.compute.ts, test.jwt.ts, and test.impersonated.ts.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces support for Regional Access Boundaries (RAB) across various authentication clients in the Google Auth Library for Node.js. It adds a RegionalAccessBoundaryManager to manage, fetch, and cache allowed locations, applying the x-allowed-locations header to outgoing requests while excluding ID token flows. It also updates utility functions, TypeScript configurations, and adds extensive test coverage. The review comments identify several critical improvement opportunities and robustness issues. Key feedback includes caching the resolved lookup URL to prevent redundant checks, adding defensive checks to avoid runtime TypeError crashes when parsing audience or handling null/undefined credentials and regionalAccessBoundaryData, and handling cases where serviceAccountEmail is falsy to prevent malformed lookup URLs.
shivanee-p
requested review from
a team
and removed request for
a team,
feywind and
nbayati
1 participant
The Regional Access Boundaries PR to main. Contains all the changes merged to the feature branch rebased on top of main.
P.S. Opening the PR directly to main as feature branch regional-access-boundaries has drifted from main and opening a rebased-PR to the feature branch shows 10k+ files changed.