feat(google-auth): make _CLOUD_RESOURCE_MANAGER URL universe-domain-aware#16546
Conversation
…ware
Replace hardcoded googleapis.com in _CLOUD_RESOURCE_MANAGER with a
{universe_domain} placeholder, resolved at credential construction time
via self._cloud_resource_manager_url. This mirrors the existing pattern
used for _DEFAULT_TOKEN_URL.
Add tests verifying the URL is correctly built for both the default
(googleapis.com) and custom universe domains, including an end-to-end
test through get_project_id.
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the external_account module to support custom universe domains for the Cloud Resource Manager URL by parameterizing the base URL and initializing it within the class. Unit tests were added to verify the URL construction for both default and custom domains. A review comment suggests using .format() for URL construction to improve readability and robustness.
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
vverman
left a comment
vverman
left a comment
There was a problem hiding this comment.
Approved.
Just curious, as to whether this a long-standing concern or an one-off observed bug?
Hey, this is a one-off observed bug because the url was hardcoded which not adequate to sovereign-cloud scenarios (GCD with s3ns: https://cloud.google.com/sovereign-cloud) , though we'll probably have more of these in the future |
daniel-sanche
left a comment
daniel-sanche
left a comment
There was a problem hiding this comment.
LGTM, with a couple small comments
| ) | ||
| self._cloud_resource_manager_url = _CLOUD_RESOURCE_MANAGER.replace( | ||
| "{universe_domain}", self._universe_domain | ||
| ) |
There was a problem hiding this comment.
A couple inconsequential comments:
- do we actually need to save this as an attribute? Seems like it's still only used in one place
- since we're using
{universe_domain}as a template, maybe we should handle theproject_numberin the same way, instead of concatenating it on the end
There was a problem hiding this comment.
Tried to follow similar behaviour of previous PR so I've limited myself on made changes, would be good if we can go with this to unblock partner and do those changes later on.
daniel-sanche
added
the
kokoro:run
yoshi-kokoro
removed
the
kokoro:run
PR created by the Librarian CLI to initialize a release. Merging this PR will auto trigger a release. Librarian Version: v0.12.0 Language Image: us-central1-docker.pkg.dev/cloud-sdk-librarian-prod/images-prod/python-librarian-generator@sha256:234b9d1f2ddb057ed7ac6a38db0bf8163d839c65c6cf88ade52530cddebce59e <details><summary>google-auth: v2.52.0</summary> ## [v2.52.0](google-auth-v2.51.0...google-auth-v2.52.0) (2026-05-07) ### Features * implement in-place Regional Access Boundary configuration and add public RAB getters (#16987) ([df07fce](df07fceb)) * make _CLOUD_RESOURCE_MANAGER URL universe-domain-aware (#16546) ([e938028](e938028b)) </details>
5 participants
Replace hardcoded googleapis.com in _CLOUD_RESOURCE_MANAGER with a {universe_domain} placeholder, resolved at credential construction time via self._cloud_resource_manager_url. This mirrors the existing pattern used for _DEFAULT_TOKEN_URL.
Add tests verifying the URL is correctly built for both the default (googleapis.com) and custom universe domains, including an end-to-end test through get_project_id.
Fixes #16545