feat: Regional Access Boundary Changes by vverman · Pull Request #891 · googleapis/google-cloud-node-core

vverman · 2026-01-17T01:31:30Z

Contains changes for the feature Regional Access Boundary (Previously Called Trust Boundaries).

The following are salient changes:

Calls to refresh RAB are now all async and in a separate thread.
Logic for refreshing RAB now exists in its own class for cleaner maintenance.
Self-signed jwts are within scope.
Changes to how we trigger RAB refresh and deal with refresh errors.

…d JWT

…ure.

packages/google-auth-library-nodejs/src/auth/regionalaccessboundary.ts

packages/google-auth-library-nodejs/src/auth/baseexternalclient.ts

packages/google-auth-library-nodejs/src/auth/regionalaccessboundary.ts

packages/google-auth-library-nodejs/src/auth/baseexternalclient.ts

packages/google-auth-library-nodejs/src/auth/externalAccountAuthorizedUserClient.ts

nbayati · 2026-01-28T00:14:00Z

packages/google-auth-library-nodejs/src/auth/externalAccountAuthorizedUserClient.ts

   * @throws {Error} If the URL cannot be constructed for a compatible client.
   */
-  protected async getTrustBoundaryUrl(): Promise<string | null> {
+  public async getRegionalAccessBoundaryUrl(): Promise<string | null> {


Why this method became public?

I made it so for ease of testing the getRegionalAccessBoundaryUrl logic. For ex: in the base external client we have scenarios where we want to test if the right url is returned or error is thrown in case of workload, workforce or a null audience.

I'd go ahead and put an @private on it, as that will cause it to be omitted from docs, but it will still show up in the transpiled class. Anyone digging in the source can see the @private to know they shouldn't use it.

Actually, it looks like @internal omits it from any exported .d.ts, so that may be enough. I'd double-check the output though, to see what it makes.

@vverman +1 to using @internal if you can verify that it's omitted from docs and transpiled classes.

packages/google-auth-library-nodejs/src/auth/regionalaccessboundary.ts

packages/google-auth-library-nodejs/src/auth/jwtclient.ts

…e requestAsync level. RAB urls now have googleapis as universe domain.

…been excluded and test suite updated.

…504 are the only retryable look up failures.

feywind

I don't see anything too weird in this, I guess let me know when you've got one that merges against main?

packages/google-auth-library-nodejs/src/auth/authclient.ts

feywind · 2026-02-02T20:22:34Z

packages/google-auth-library-nodejs/src/auth/authclient.ts

+    if (res && res.status === 400) {
+      const data = res.data as {error?: {message?: string}; message?: string};
+      const message =
+        data?.error?.message || data?.message || error.message || '';


?? might be more idiomatic now, unless e.g. data?.message could be empty but not null/undefined.

feywind · 2026-02-02T20:26:55Z

packages/google-auth-library-nodejs/src/auth/externalAccountAuthorizedUserClient.ts

   * @throws {Error} If the URL cannot be constructed for a compatible client.
   */
-  protected async getTrustBoundaryUrl(): Promise<string | null> {
+  public async getRegionalAccessBoundaryUrl(): Promise<string | null> {


I'd go ahead and put an @private on it, as that will cause it to be omitted from docs, but it will still show up in the transpiled class. Anyone digging in the source can see the @private to know they shouldn't use it.

Actually, it looks like @internal omits it from any exported .d.ts, so that may be enough. I'd double-check the output though, to see what it makes.

feywind · 2026-02-02T20:27:37Z

packages/google-auth-library-nodejs/src/auth/impersonated.ts

  }

-  protected async getTrustBoundaryUrl(): Promise<string> {
+  public async getRegionalAccessBoundaryUrl(): Promise<string> {


Same comment re protected -> public.

feywind · 2026-02-02T20:28:01Z

packages/google-auth-library-nodejs/src/auth/jwtclient.ts

  }

-  protected async getTrustBoundaryUrl(): Promise<string> {
+  public async getRegionalAccessBoundaryUrl(): Promise<string> {


Ditto protected -> public.

feywind · 2026-02-02T20:45:04Z

packages/google-auth-library-nodejs/src/auth/regionalaccessboundary.ts

+   * Triggers an asynchronous regional access boundary refresh if needed.
+   * @param accessToken The access token to use for the lookup.
+   */
+  private maybeTriggerRegionalAccessBoundaryRefresh(accessToken: string) {


Absolutely nitpicky, but I like to try to put an explicit return type on void methods just to make sure that you notice if something changes internal to it.

Done, thanks for the suggestion!

packages/google-auth-library-nodejs/test/test.baseexternalclient.ts

nbayati · 2026-02-20T23:37:36Z

packages/google-auth-library-nodejs/src/auth/computeclient.ts

      '{universe_domain}',
      this.universeDomain,


SERVICE_ACCOUNT_LOOKUP_ENDPOINT no longer has a placeholder for universedomain.
The tests such as test/test.authclient.ts and test/test.compute.ts should be updated to remove the unnecessary replace too.

nbayati · 2026-02-20T23:55:18Z

packages/google-auth-library-nodejs/src/auth/regionalaccessboundary.ts

+   * @param url The URL to check.
+   */
+  private isGlobalEndpoint(url: string | URL): boolean {
+    const hostname = url instanceof URL ? url.hostname : new URL(url).hostname;


new URL(url) will throws a TypeError if the url string is a relative URL, or a malformed one.
We need to gracefully handle those cases by assuming they are global.

nbayati · 2026-02-21T00:17:03Z

packages/google-auth-library-nodejs/src/auth/regionalaccessboundary.ts

+/**
+ * Maximum cooldown period for RAB lookup failures.
+ */
+const RAB_MAX_COOLDOWN_MILLIS = 24 * 60 * 60 * 1000;


Let's update this to be 6 hours.

nbayati · 2026-02-21T00:20:34Z

packages/google-auth-library-nodejs/src/auth/externalAccountAuthorizedUserClient.ts

   * returned response.
   * @param opts The HTTP request options.
   * @param reAuthRetried Whether the current attempt is a retry after a failed attempt due to an auth failure.
+   * @param retryWithoutRAB Whether the current attempt is a retry after a failed attempt due to a stale regional access boundary.


Since we no longer have the reactive refresh in this PR, this parameter should be removed too.

nbayati · 2026-02-21T00:20:51Z

packages/google-auth-library-nodejs/src/auth/baseexternalclient.ts

   * returned response.
   * @param opts The HTTP request options.
   * @param reAuthRetried Whether the current attempt is a retry after a failed attempt due to an auth failure.
+   * @param retryWithoutRAB Whether the current attempt is a retry after a failed attempt due to a stale regional access boundary.


Unused parameter: Since we no longer have the reactive refresh in this PR, this parameter should be removed too.

nbayati · 2026-02-21T00:33:33Z

packages/google-auth-library-nodejs/src/auth/externalAccountAuthorizedUserClient.ts

   * @throws {Error} If the URL cannot be constructed for a compatible client.
   */
-  protected async getTrustBoundaryUrl(): Promise<string | null> {
+  public async getRegionalAccessBoundaryUrl(): Promise<string | null> {


@vverman +1 to using @internal if you can verify that it's omitted from docs and transpiled classes.

nbayati · 2026-02-21T01:12:52Z

packages/google-auth-library-nodejs/src/auth/oauth2client.ts

  async getRequestHeaders(url?: string | URL): Promise<Headers> {
-    const headers = (await this.getRequestMetadataAsync(url)).headers;
+    const {headers, isIDToken} = await this.getRequestMetadataAsync(url);
+    if (!isIDToken) {


idtoken client overrides getRequestMetadataAsync is not returning isIDToken=true.
IIUC, IdTokenClient inherits the default getRegionalAccessBoundaryUrl (which returns null), so RAB lookup happen for idtoken and we won't attach the header anyway, but I think setting this flag explicitly ensures we skip the RAB logic entirely and avoids unnecessary checks and future-proofs against changes in the base classes.

vverman added 3 commits January 14, 2026 15:38

Changes for trust boundaries async refresh and support for self-signe…

7d283f5

…d JWT

Fixed unit tests moved RAB logic out of authclient.

c6c1c7b

Changed getRegionalAccessBoundaryUrl and fixed a self-signed jwt fail…

635bae2

…ure.

vverman requested a review from a team as a code owner January 17, 2026 01:31

vverman assigned sofisl, nbayati and miguelvelezsa Jan 17, 2026

Fixed url for service account RAB lookup.

0cfa454

lsirac requested review from miguelvelezsa, nbayati and sofisl January 22, 2026 01:32