fix: resolve lazy load issue by dynamic base class resolution using metaclass

Author: hebaalazzeh

packages/google-auth/google/auth/_helpers.py

@@ -534,3 +534,35 @@ def response_log(logger: logging.Logger, response: Any) -> None:
     if is_logging_enabled(logger):
         json_response = _parse_response(response)
         _response_log_base(logger, json_response)
+
+
+class LazyBasesMeta(type):
+    """Metaclass that allows dynamic lazy resolution of class bases.
+
+    This metaclass avoids eager loading of heavy dependencies during import
+    time by allowing classes to inherit from a dummy class initially.
+    The real base classes are dynamically resolved and swapped in when the
+    class is first instantiated, subclassed, or has its attributes inspected.
+    """
+
+    def __call__(cls, *args, **kwargs):
+        type(cls)._resolve_bases(cls)
+        return super(LazyBasesMeta, cls).__call__(*args, **kwargs)
+
+    def __getattribute__(cls, name):
+        type(cls)._resolve_bases(cls)
+        return super(LazyBasesMeta, cls).__getattribute__(name)
+
+    def _resolve_bases(cls):
+        pass
+
+
+class HeapDummy(object):
+    """A heap-allocated dummy class.
+
+    This class serves as a safe initial base class for classes using LazyBasesMeta.
+    Inheriting from HeapDummy instead of built-in `object` ensures that Python's
+    memory layout check passes when we swap bases to another heap-allocated class.
+    """
+    pass
+

packages/google-auth/google/auth/transport/requests.py

@@ -53,6 +53,18 @@
 import google.auth.transport._mtls_helper
 from google.oauth2 import service_account
 
+
+class _LazyBasesMeta(_helpers.LazyBasesMeta):
+    def _resolve_bases(cls):
+        current_bases = type.__getattribute__(cls, "__bases__")
+        if current_bases == (_helpers.HeapDummy,):
+            cls_name = type.__getattribute__(cls, "__name__")
+            if cls_name in ("_MutualTlsAdapter", "_MutualTlsOffloadAdapter"):
+                cls.__bases__ = (requests.adapters.HTTPAdapter,)
+            elif cls_name == "AuthorizedSession":
+                cls.__bases__ = (requests.Session,)
+
+
 _LOGGER = logging.getLogger(__name__)
 
 _DEFAULT_TIMEOUT = 120  # in seconds
@@ -208,7 +220,7 @@ def __call__(
             raise new_exc from caught_exc
 
 
-class _MutualTlsAdapter(requests.adapters.HTTPAdapter):
+class _MutualTlsAdapter(_helpers.HeapDummy, metaclass=_LazyBasesMeta):
     """
     A TransportAdapter that enables mutual TLS.
 
@@ -274,7 +286,7 @@ def proxy_manager_for(self, *args, **kwargs):
         return super(_MutualTlsAdapter, self).proxy_manager_for(*args, **kwargs)
 
 
-class _MutualTlsOffloadAdapter(requests.adapters.HTTPAdapter):
+class _MutualTlsOffloadAdapter(_helpers.HeapDummy, metaclass=_LazyBasesMeta):
     """
     A TransportAdapter that enables mutual TLS and offloads the client side
     signing operation to the signing library.
@@ -324,7 +336,7 @@ def proxy_manager_for(self, *args, **kwargs):
         return super(_MutualTlsOffloadAdapter, self).proxy_manager_for(*args, **kwargs)
 
 
-class AuthorizedSession(requests.Session):
+class AuthorizedSession(_helpers.HeapDummy, metaclass=_LazyBasesMeta):
     """A Requests Session class with credentials.
 
     This class is used to perform requests to API endpoints that require

packages/google-auth/google/auth/transport/urllib3.py

@@ -51,16 +51,38 @@
     ) from caught_exc
 
 
+from typing import Set
+
 from google.auth import _helpers
 from google.auth import exceptions
 from google.auth import transport
 from google.auth.transport import _mtls_helper
 from google.oauth2 import service_account
 
-if version.parse(urllib3.__version__) >= version.parse("2.0.0"):  # pragma: NO COVER
-    RequestMethods = urllib3._request_methods.RequestMethods  # type: ignore
-else:  # pragma: NO COVER
-    RequestMethods = urllib3.request.RequestMethods  # type: ignore
+# PEP 0810: Explicit Lazy Imports
+# Python 3.15+ natively intercepts and defers these imports.
+# Developers can disable this behavior and force eager imports.
+# For more information, see:
+# https://docs.python.org/3.15/library/sys.html#sys.set_lazy_imports_filter
+# Older Python versions safely ignore this variable.
+__lazy_modules__: Set[str] = {
+    "urllib3",
+    "urllib3.exceptions",
+    "certifi",
+    "packaging",
+    "packaging.version",
+}
+
+
+class _LazyBasesMeta(_helpers.LazyBasesMeta):
+    def _resolve_bases(cls):
+        current_bases = type.__getattribute__(cls, "__bases__")
+        if current_bases == (_helpers.HeapDummy,):
+            if version.parse(urllib3.__version__) >= version.parse("2.0.0"):
+                request_methods_class = urllib3._request_methods.RequestMethods  # type: ignore
+            else:
+                request_methods_class = urllib3.request.RequestMethods  # type: ignore
+            cls.__bases__ = (request_methods_class,)
 
 
 _LOGGER = logging.getLogger(__name__)
@@ -205,7 +227,7 @@ def _make_mutual_tls_http(cert, key):
     return http
 
 
-class AuthorizedHttp(RequestMethods):  # type: ignore
+class AuthorizedHttp(_helpers.HeapDummy, metaclass=_LazyBasesMeta):
     """A urllib3 HTTP class with credentials.
 
     This class is used to perform requests to API endpoints that require