chore: fix mtls explicit cert config path existence check

Author: nbayati

packages/google-auth/google/auth/transport/_mtls_helper.py

@@ -422,6 +422,7 @@ def _get_cert_config_path(certificate_config_path=None, include_context_aware=Tr
         The absolute path of the certificate config file, and None if the file does not exist.
     """
 
+    is_explicit = True
     if certificate_config_path is None:
         env_path = environ.get(environment_vars.GOOGLE_API_CERTIFICATE_CONFIG, None)
         if env_path is not None and env_path != "":
@@ -435,14 +436,22 @@ def _get_cert_config_path(certificate_config_path=None, include_context_aware=Tr
                 certificate_config_path = env_path
             else:
                 certificate_config_path = CERTIFICATE_CONFIGURATION_DEFAULT_PATH
+                is_explicit = False
 
     certificate_config_path = path.expanduser(certificate_config_path)
+    if not path.exists(certificate_config_path):
+        if is_explicit:
+            _LOGGER.warning(
+                "Certificate configuration file at %s does not exist",
+                certificate_config_path,
+            )
+        return None
     return certificate_config_path
 
 
 def _get_workload_cert_and_key_paths(config_path, include_context_aware=True):
     absolute_path = _get_cert_config_path(config_path, include_context_aware)
-    if absolute_path is None or not os.path.exists(absolute_path):
+    if absolute_path is None:
         return None, None
 
     data = _load_json_file(absolute_path)

packages/google-auth/google/auth/transport/mtls.py

@@ -43,10 +43,10 @@ def has_default_client_cert_source(include_context_aware=True):
     Returns:
         bool: indicating if the default client cert source exists.
     """
-    if (
-        _mtls_helper._get_cert_config_path(include_context_aware=include_context_aware)
-        is not None
-    ):
+    cert_path = _mtls_helper._get_cert_config_path(
+        include_context_aware=include_context_aware
+    )
+    if cert_path is not None:
         return True
     if (
         include_context_aware

packages/google-auth/tests/transport/test__mtls_helper.py

@@ -591,7 +591,7 @@ def test_success_with_override(self):
     def test_override_does_not_exist(self):
         config_path = "fake/file/path"
         returned_path = _mtls_helper._get_cert_config_path(config_path)
-        assert returned_path == config_path
+        assert returned_path is None
 
     @mock.patch.dict(
         os.environ,
@@ -630,10 +630,7 @@ def test_env_variable(self, mock_path_exists):
     def test_default_file_does_not_exist(self, mock_path_exists):
         mock_path_exists.return_value = False
         returned_path = _mtls_helper._get_cert_config_path()
-        expected_path = os.path.expanduser(
-            _mtls_helper.CERTIFICATE_CONFIGURATION_DEFAULT_PATH
-        )
-        assert returned_path == expected_path
+        assert returned_path is None
 
     def test_cert_config_path_precedence(self):
         # GOOGLE_API_CERTIFICATE_CONFIG takes precedence
@@ -673,7 +670,7 @@ def test_cert_config_path_fallback(self):
     def test_env_variable_file_does_not_exist(self, mock_path_exists):
         mock_path_exists.return_value = False
         returned_path = _mtls_helper._get_cert_config_path()
-        assert returned_path == "path/to/config/file"
+        assert returned_path is None
 
     @mock.patch.dict(
         os.environ,

packages/google-auth/tests/transport/test_grpc.py

@@ -404,13 +404,16 @@ def test_secure_authorized_channel_cert_callback_without_client_cert_env(
 @mock.patch("google.auth.transport._mtls_helper._load_json_file", autospec=True)
 @mock.patch("google.auth.transport._mtls_helper._check_config_path", autospec=True)
 class TestSslCredentials(object):
+    @mock.patch("os.path.exists", autospec=True)
     def test_no_context_aware_metadata(
         self,
+        mock_path_exists,
         mock_check_config_path,
         mock_load_json_file,
         mock_get_client_ssl_credentials,
         mock_ssl_channel_credentials,
     ):
+        mock_path_exists.return_value = False
         # Mock that the metadata file doesn't exist.
         mock_check_config_path.return_value = None