feat: Regional Access Boundary Changes by vverman · Pull Request #891 · googleapis/google-cloud-node-core

vverman · 2026-01-17T01:31:30Z

Contains changes for the feature Regional Access Boundary (Previously Called Trust Boundaries).

The following are salient changes:

Calls to refresh RAB are now all async and in a separate thread.
Logic for refreshing RAB now exists in its own class for cleaner maintenance.
Self-signed jwts are within scope.
Changes to how we trigger RAB refresh and deal with refresh errors.

…d JWT

…ure.

packages/google-auth-library-nodejs/src/auth/regionalaccessboundary.ts

packages/google-auth-library-nodejs/src/auth/baseexternalclient.ts

packages/google-auth-library-nodejs/src/auth/regionalaccessboundary.ts

packages/google-auth-library-nodejs/src/auth/baseexternalclient.ts

packages/google-auth-library-nodejs/src/auth/externalAccountAuthorizedUserClient.ts

nbayati · 2026-01-28T00:14:00Z

packages/google-auth-library-nodejs/src/auth/externalAccountAuthorizedUserClient.ts

   * @throws {Error} If the URL cannot be constructed for a compatible client.
   */
-  protected async getTrustBoundaryUrl(): Promise<string | null> {
+  public async getRegionalAccessBoundaryUrl(): Promise<string | null> {


Why this method became public?

I made it so for ease of testing the getRegionalAccessBoundaryUrl logic. For ex: in the base external client we have scenarios where we want to test if the right url is returned or error is thrown in case of workload, workforce or a null audience.

I'd go ahead and put an @private on it, as that will cause it to be omitted from docs, but it will still show up in the transpiled class. Anyone digging in the source can see the @private to know they shouldn't use it.

Actually, it looks like @internal omits it from any exported .d.ts, so that may be enough. I'd double-check the output though, to see what it makes.

@vverman +1 to using @internal if you can verify that it's omitted from docs and transpiled classes.

While @internal removes it from the type definitions, it doesn't remove it from the transpiled classes aka the .js files since they are needed for the logic to execute at runtime.

However if they are removed from the type definitions i.e. the d.ts type files a user cannot easily discover them as they wouldn't show up in their intellisense.

packages/google-auth-library-nodejs/src/auth/regionalaccessboundary.ts

packages/google-auth-library-nodejs/src/auth/jwtclient.ts

…e requestAsync level. RAB urls now have googleapis as universe domain.

…been excluded and test suite updated.

…504 are the only retryable look up failures.

feywind

I don't see anything too weird in this, I guess let me know when you've got one that merges against main?

packages/google-auth-library-nodejs/src/auth/authclient.ts

feywind · 2026-02-02T20:26:55Z

packages/google-auth-library-nodejs/src/auth/externalAccountAuthorizedUserClient.ts

   * @throws {Error} If the URL cannot be constructed for a compatible client.
   */
-  protected async getTrustBoundaryUrl(): Promise<string | null> {
+  public async getRegionalAccessBoundaryUrl(): Promise<string | null> {


I'd go ahead and put an @private on it, as that will cause it to be omitted from docs, but it will still show up in the transpiled class. Anyone digging in the source can see the @private to know they shouldn't use it.

Actually, it looks like @internal omits it from any exported .d.ts, so that may be enough. I'd double-check the output though, to see what it makes.

packages/google-auth-library-nodejs/src/auth/impersonated.ts

packages/google-auth-library-nodejs/src/auth/jwtclient.ts

packages/google-auth-library-nodejs/src/auth/regionalaccessboundary.ts

packages/google-auth-library-nodejs/test/test.baseexternalclient.ts

packages/google-auth-library-nodejs/src/auth/computeclient.ts

nbayati · 2026-02-20T23:55:18Z

packages/google-auth-library-nodejs/src/auth/regionalaccessboundary.ts

+   * @param url The URL to check.
+   */
+  private isGlobalEndpoint(url: string | URL): boolean {
+    const hostname = url instanceof URL ? url.hostname : new URL(url).hostname;


new URL(url) will throws a TypeError if the url string is a relative URL, or a malformed one.
We need to gracefully handle those cases by assuming they are global.

packages/google-auth-library-nodejs/src/auth/regionalaccessboundary.ts

packages/google-auth-library-nodejs/src/auth/externalAccountAuthorizedUserClient.ts

packages/google-auth-library-nodejs/src/auth/baseexternalclient.ts

nbayati · 2026-02-21T00:33:33Z

packages/google-auth-library-nodejs/src/auth/externalAccountAuthorizedUserClient.ts

   * @throws {Error} If the URL cannot be constructed for a compatible client.
   */
-  protected async getTrustBoundaryUrl(): Promise<string | null> {
+  public async getRegionalAccessBoundaryUrl(): Promise<string | null> {


@vverman +1 to using @internal if you can verify that it's omitted from docs and transpiled classes.

nbayati · 2026-02-21T01:12:52Z

packages/google-auth-library-nodejs/src/auth/oauth2client.ts

  async getRequestHeaders(url?: string | URL): Promise<Headers> {
-    const headers = (await this.getRequestMetadataAsync(url)).headers;
+    const {headers, isIDToken} = await this.getRequestMetadataAsync(url);
+    if (!isIDToken) {


idtoken client overrides getRequestMetadataAsync is not returning isIDToken=true.
IIUC, IdTokenClient inherits the default getRegionalAccessBoundaryUrl (which returns null), so RAB lookup happen for idtoken and we won't attach the header anyway, but I think setting this flag explicitly ensures we skip the RAB logic entirely and avoids unnecessary checks and future-proofs against changes in the base classes.

Made the change to IdToken client now passes back isIDtoken flag.

My only concern with this was that implementing a flag to explicitly exclude a client would mean we have to include all the clients like refreshclient (for long living Authorized user workflows).

However considering we're already implementing a flag for id-token I am okay with IdTokenClient explicitly returning a flag.

…6h. Documentation changes.

vverman added 3 commits January 14, 2026 15:38

Changes for trust boundaries async refresh and support for self-signe…

7d283f5

…d JWT

Fixed unit tests moved RAB logic out of authclient.

c6c1c7b

Changed getRegionalAccessBoundaryUrl and fixed a self-signed jwt fail…

635bae2

…ure.

vverman requested a review from a team as a code owner January 17, 2026 01:31

vverman assigned sofisl, nbayati and miguelvelezsa Jan 17, 2026

Fixed url for service account RAB lookup.

0cfa454

lsirac requested review from miguelvelezsa, nbayati and sofisl January 22, 2026 01:32