fix(auth): resolve LazyBasesMeta subclassing, thread safety, and recursion bugs

Author: hebaalazzeh

packages/google-auth/google/auth/_helpers.py

@@ -22,6 +22,7 @@
 import json
 import logging
 import sys
+import threading
 from typing import Any, Dict, Mapping, Optional, Union
 import urllib
 
@@ -545,15 +546,49 @@ class LazyBasesMeta(type):
     class is first instantiated, subclassed, or has its attributes inspected.
     """
 
+    _lock = threading.RLock()
+
+    def __new__(mcls, name, bases, attrs):
+        # Automatically resolve lazy bases of any base classes at subclass definition time.
+        for base in bases:
+            if isinstance(base, LazyBasesMeta):
+                type(base)._resolve_bases(base)
+
+        cls = super(LazyBasesMeta, mcls).__new__(mcls, name, bases, attrs)
+        type.__setattr__(cls, "_lazy_bases_resolved", False)
+        return cls
+
     def __call__(cls, *args, **kwargs):
         type(cls)._resolve_bases(cls)
         return super(LazyBasesMeta, cls).__call__(*args, **kwargs)
 
     def __getattribute__(cls, name):
-        type(cls)._resolve_bases(cls)
+        if name not in (
+            "_lazy_bases_resolved",
+            "_resolve_bases",
+            "_perform_resolve_bases",
+        ):
+            type(cls)._resolve_bases(cls)
         return super(LazyBasesMeta, cls).__getattribute__(name)
 
     def _resolve_bases(cls):
+        try:
+            resolved = type.__getattribute__(cls, "_lazy_bases_resolved")
+        except AttributeError:
+            resolved = False
+
+        if not resolved:
+            with type(cls)._lock:
+                try:
+                    resolved = type.__getattribute__(cls, "_lazy_bases_resolved")
+                except AttributeError:
+                    resolved = False
+
+                if not resolved:
+                    type(cls)._perform_resolve_bases(cls)
+                    type.__setattr__(cls, "_lazy_bases_resolved", True)
+
+    def _perform_resolve_bases(cls):
         pass
 
 

packages/google-auth/google/auth/transport/requests.py

@@ -63,7 +63,7 @@
 
 
 class _LazyBasesMeta(_helpers.LazyBasesMeta):
-    def _resolve_bases(cls):
+    def _perform_resolve_bases(cls):
         current_bases = type.__getattribute__(cls, "__bases__")
         if current_bases == (_helpers.HeapDummy,):
             cls_name = type.__getattribute__(cls, "__name__")

packages/google-auth/google/auth/transport/urllib3.py

@@ -74,7 +74,7 @@
 
 
 class _LazyBasesMeta(_helpers.LazyBasesMeta):
-    def _resolve_bases(cls):
+    def _perform_resolve_bases(cls):
         current_bases = type.__getattribute__(cls, "__bases__")
         if current_bases == (_helpers.HeapDummy,):
             if version.parse(urllib3.__version__) >= version.parse("2.0.0"):

packages/google-auth/tests/transport/test_lazy_bases.py

@@ -0,0 +1,95 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import threading
+import time
+from google.auth import _helpers
+
+
+def test_lazy_bases_subclassing():
+    class RealBase:
+        x = 42
+
+    class MyLazyBasesMeta(_helpers.LazyBasesMeta):
+        def _perform_resolve_bases(cls):
+            current_bases = type.__getattribute__(cls, "__bases__")
+            if current_bases == (_helpers.HeapDummy,):
+                cls.__bases__ = (RealBase,)
+
+    class LazyClass(_helpers.HeapDummy, metaclass=MyLazyBasesMeta):
+        pass
+
+    # Subclass the lazy class
+    class SubClass(LazyClass):
+        pass
+
+    # The lazy bases of LazyClass should have been resolved when SubClass was defined.
+    assert LazyClass.__bases__ == (RealBase,)
+    assert SubClass.__bases__ == (LazyClass,)
+    assert SubClass.x == 42
+    assert SubClass().x == 42
+
+
+def test_lazy_bases_thread_safety():
+    class RealBase:
+        x = 42
+
+    class MyLazyBasesMeta(_helpers.LazyBasesMeta):
+        def _perform_resolve_bases(cls):
+            time.sleep(0.05)  # Simulate slow resolution
+            current_bases = type.__getattribute__(cls, "__bases__")
+            if current_bases == (_helpers.HeapDummy,):
+                cls.__bases__ = (RealBase,)
+
+    class LazyClass(_helpers.HeapDummy, metaclass=MyLazyBasesMeta):
+        pass
+
+    # Test concurrent instantiation
+    errors = []
+
+    def worker():
+        try:
+            obj = LazyClass()
+            assert obj.x == 42
+        except Exception as e:
+            errors.append(e)
+
+    threads = [threading.Thread(target=worker) for _ in range(10)]
+    for t in threads:
+        t.start()
+    for t in threads:
+        t.join()
+
+    assert not errors
+    assert LazyClass.__bases__ == (RealBase,)
+
+
+def test_lazy_bases_recursion_guard():
+    class RealBase:
+        x = 42
+
+    class MyLazyBasesMeta(_helpers.LazyBasesMeta):
+        def _perform_resolve_bases(cls):
+            current_bases = type.__getattribute__(cls, "__bases__")
+            if current_bases == (_helpers.HeapDummy,):
+                cls.__bases__ = (RealBase,)
+
+    class LazyClass(_helpers.HeapDummy, metaclass=MyLazyBasesMeta):
+        pass
+
+    # Accessing internal metaclass/resolution attributes should not trigger recursion
+    # and should be safely accessible.
+    assert hasattr(LazyClass, "_lazy_bases_resolved")
+    assert hasattr(LazyClass, "_resolve_bases")
+    assert hasattr(LazyClass, "_perform_resolve_bases")

packages/google-auth/tests/transport/test_lazy_imports.py

@@ -0,0 +1,75 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import subprocess
+import sys
+
+import pytest
+
+SCRIPT_PYTHON_315 = """
+import sys
+import google.auth.transport.requests
+import google.auth.transport.urllib3
+
+# The heavy underlying modules should NOT be loaded yet
+HEAVY_MODULES = ["requests", "urllib3"]
+
+for mod in HEAVY_MODULES:
+    if mod in sys.modules:
+        print(f"FAILED: {mod} was eagerly loaded into sys.modules")
+        sys.exit(1)
+
+# Trigger reification of requests
+from google.auth.transport import requests
+_ = requests.__name__
+
+if "requests" not in sys.modules:
+    print("FAILED: requests was not lazily loaded upon access")
+    sys.exit(2)
+
+sys.exit(0)
+"""
+
+SCRIPT_PRE_315 = """
+import sys
+import google.auth.transport.requests
+import google.auth.transport.urllib3
+
+HEAVY_MODULES = ["requests", "urllib3"]
+
+for mod in HEAVY_MODULES:
+    if mod not in sys.modules:
+        print(f"FAILED: {mod} was not eagerly loaded into sys.modules")
+        sys.exit(1)
+
+sys.exit(0)
+"""
+
+
+@pytest.mark.skipif(sys.version_info < (3, 15), reason="PEP 810 requires Python 3.15+")
+def test_lazy_imports_on_python_315():
+    result = subprocess.run(
+        [sys.executable, "-c", SCRIPT_PYTHON_315], capture_output=True, text=True
+    )
+    assert result.returncode == 0, f"Subprocess failed: {result.stdout}"
+
+
+@pytest.mark.skipif(
+    sys.version_info >= (3, 15), reason="Testing fallback behavior on < 3.15"
+)
+def test_fallback_eager_imports_pre_315():
+    result = subprocess.run(
+        [sys.executable, "-c", SCRIPT_PRE_315], capture_output=True, text=True
+    )
+    assert result.returncode == 0, f"Subprocess failed: {result.stdout}"