fix: address PR feedback for agent identity utils

Author: nbayati

packages/google-auth/google/auth/_agent_identity_utils.py

@@ -99,7 +99,15 @@ def get_agent_identity_certificate_path():
     # For all other paths, we return early to avoid introducing unnecessary startup
     # delays.
     well_known_dir = os.path.dirname(_WELL_KNOWN_CERT_PATH)
-    should_poll = cert_config_path.startswith(well_known_dir)
+    try:
+        abs_cert_path = os.path.abspath(cert_config_path)
+        abs_well_known_dir = os.path.abspath(well_known_dir)
+        should_poll = (
+            os.path.commonpath([abs_well_known_dir, abs_cert_path])
+            == abs_well_known_dir
+        )
+    except ValueError:
+        should_poll = False
 
     return _get_cert_path_with_optional_polling(cert_config_path, should_poll)
 
@@ -197,7 +205,7 @@ def _parse_cert_path_from_config(cert_config_path):
     """
     import json
 
-    with open(cert_config_path, "r") as f:
+    with open(cert_config_path, "r", encoding="utf-8") as f:
         cert_config = json.load(f)
 
     cert_configs = (

packages/google-auth/tests/test_agent_identity_utils.py

@@ -76,6 +76,23 @@ def test_get_agent_identity_certificate_path_empty_env(self, monkeypatch):
         result = _agent_identity_utils.get_agent_identity_certificate_path()
         assert result is None
 
+    @mock.patch("google.auth._agent_identity_utils.os.path.commonpath")
+    @mock.patch(
+        "google.auth._agent_identity_utils._get_cert_path_with_optional_polling"
+    )
+    def test_get_agent_identity_certificate_path_value_error(
+        self, mock_get_cert, mock_commonpath, monkeypatch
+    ):
+        monkeypatch.setenv(
+            environment_vars.GOOGLE_API_CERTIFICATE_CONFIG, "/path/to/config.json"
+        )
+        mock_commonpath.side_effect = ValueError("Different drives")
+        mock_get_cert.return_value = "cert_path"
+
+        result = _agent_identity_utils.get_agent_identity_certificate_path()
+        assert result == "cert_path"
+        mock_get_cert.assert_called_once_with("/path/to/config.json", False)
+
     @mock.patch("google.auth._agent_identity_utils.os.stat")
     def test_is_certificate_file_ready_permission_error(self, mock_stat):
         mock_stat.side_effect = PermissionError("Permission denied")