grpc 1.48.0-x86_64-linux → 1.49.1-x86_64-linux

data/src/core/lib/security/credentials/external/aws_external_account_credentials.cc

@@ -413,16 +413,23 @@ void AwsExternalAccountCredentials::OnRetrieveSigningKeysInternal(
   }
   absl::string_view response_body(ctx_->response.body,
                                   ctx_->response.body_length);
-  Json json = Json::Parse(response_body, &error);
-  if (!GRPC_ERROR_IS_NONE(error) || json.type() != Json::Type::OBJECT) {
+  auto json = Json::Parse(response_body);
+  if (!json.ok()) {
     FinishRetrieveSubjectToken(
-        "", GRPC_ERROR_CREATE_REFERENCING_FROM_STATIC_STRING(
-                "Invalid retrieve signing keys response.", &error, 1));
-    GRPC_ERROR_UNREF(error);
+        "", GRPC_ERROR_CREATE_FROM_CPP_STRING(
+                absl::StrCat("Invalid retrieve signing keys response: ",
+                             json.status().ToString())));
+    return;
+  }
+  if (json->type() != Json::Type::OBJECT) {
+    FinishRetrieveSubjectToken("",
+                               GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+                                   "Invalid retrieve signing keys response: "
+                                   "JSON type is not object"));
     return;
   }
-  auto it = json.object_value().find("AccessKeyId");
-  if (it != json.object_value().end() &&
+  auto it = json->object_value().find("AccessKeyId");
+  if (it != json->object_value().end() &&
       it->second.type() == Json::Type::STRING) {
     access_key_id_ = it->second.string_value();
   } else {
@@ -431,8 +438,8 @@ void AwsExternalAccountCredentials::OnRetrieveSigningKeysInternal(
                 "Missing or invalid AccessKeyId in %s.", response_body)));
     return;
   }
-  it = json.object_value().find("SecretAccessKey");
-  if (it != json.object_value().end() &&
+  it = json->object_value().find("SecretAccessKey");
+  if (it != json->object_value().end() &&
       it->second.type() == Json::Type::STRING) {
     secret_access_key_ = it->second.string_value();
   } else {
@@ -441,8 +448,8 @@ void AwsExternalAccountCredentials::OnRetrieveSigningKeysInternal(
                 "Missing or invalid SecretAccessKey in %s.", response_body)));
     return;
   }
-  it = json.object_value().find("Token");
-  if (it != json.object_value().end() &&
+  it = json->object_value().find("Token");
+  if (it != json->object_value().end() &&
       it->second.type() == Json::Type::STRING) {
     token_ = it->second.string_value();
   } else {

data/src/core/lib/security/credentials/external/external_account_credentials.cc

@@ -28,6 +28,7 @@
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
 #include "absl/strings/match.h"
+#include "absl/strings/str_cat.h"
 #include "absl/strings/str_format.h"
 #include "absl/strings/str_join.h"
 #include "absl/strings/str_split.h"
@@ -393,18 +394,21 @@ void ExternalAccountCredentials::OnExchangeTokenInternal(
 }
 
 void ExternalAccountCredentials::ImpersenateServiceAccount() {
-  grpc_error_handle error = GRPC_ERROR_NONE;
   absl::string_view response_body(ctx_->response.body,
                                   ctx_->response.body_length);
-  Json json = Json::Parse(response_body, &error);
-  if (!GRPC_ERROR_IS_NONE(error) || json.type() != Json::Type::OBJECT) {
-    FinishTokenFetch(GRPC_ERROR_CREATE_REFERENCING_FROM_STATIC_STRING(
-        "Invalid token exchange response.", &error, 1));
-    GRPC_ERROR_UNREF(error);
+  auto json = Json::Parse(response_body);
+  if (!json.ok()) {
+    FinishTokenFetch(GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrCat(
+        "Invalid token exchange response: ", json.status().ToString())));
+    return;
+  }
+  if (json->type() != Json::Type::OBJECT) {
+    FinishTokenFetch(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+        "Invalid token exchange response: JSON type is not object"));
     return;
   }
-  auto it = json.object_value().find("access_token");
-  if (it == json.object_value().end() ||
+  auto it = json->object_value().find("access_token");
+  if (it == json->object_value().end() ||
       it->second.type() != Json::Type::STRING) {
     FinishTokenFetch(GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrFormat(
         "Missing or invalid access_token in %s.", response_body)));
@@ -470,23 +474,29 @@ void ExternalAccountCredentials::OnImpersenateServiceAccountInternal(
   }
   absl::string_view response_body(ctx_->response.body,
                                   ctx_->response.body_length);
-  Json json = Json::Parse(response_body, &error);
-  if (!GRPC_ERROR_IS_NONE(error) || json.type() != Json::Type::OBJECT) {
-    FinishTokenFetch(GRPC_ERROR_CREATE_REFERENCING_FROM_STATIC_STRING(
-        "Invalid service account impersonation response.", &error, 1));
-    GRPC_ERROR_UNREF(error);
+  auto json = Json::Parse(response_body);
+  if (!json.ok()) {
+    FinishTokenFetch(GRPC_ERROR_CREATE_FROM_CPP_STRING(
+        absl::StrCat("Invalid service account impersonation response: ",
+                     json.status().ToString())));
     return;
   }
-  auto it = json.object_value().find("accessToken");
-  if (it == json.object_value().end() ||
+  if (json->type() != Json::Type::OBJECT) {
+    FinishTokenFetch(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+        "Invalid service account impersonation response: "
+        "JSON type is not object"));
+    return;
+  }
+  auto it = json->object_value().find("accessToken");
+  if (it == json->object_value().end() ||
       it->second.type() != Json::Type::STRING) {
     FinishTokenFetch(GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrFormat(
         "Missing or invalid accessToken in %s.", response_body)));
     return;
   }
   std::string access_token = it->second.string_value();
-  it = json.object_value().find("expireTime");
-  if (it == json.object_value().end() ||
+  it = json->object_value().find("expireTime");
+  if (it == json->object_value().end() ||
       it->second.type() != Json::Type::STRING) {
     FinishTokenFetch(GRPC_ERROR_CREATE_FROM_CPP_STRING(absl::StrFormat(
         "Missing or invalid expireTime in %s.", response_body)));
@@ -538,18 +548,17 @@ void ExternalAccountCredentials::FinishTokenFetch(grpc_error_handle error) {
 
 grpc_call_credentials* grpc_external_account_credentials_create(
     const char* json_string, const char* scopes_string) {
-  grpc_error_handle error = GRPC_ERROR_NONE;
-  grpc_core::Json json = grpc_core::Json::Parse(json_string, &error);
-  if (!GRPC_ERROR_IS_NONE(error)) {
+  auto json = grpc_core::Json::Parse(json_string);
+  if (!json.ok()) {
     gpr_log(GPR_ERROR,
             "External account credentials creation failed. Error: %s.",
-            grpc_error_std_string(error).c_str());
-    GRPC_ERROR_UNREF(error);
+            json.status().ToString().c_str());
     return nullptr;
   }
   std::vector<std::string> scopes = absl::StrSplit(scopes_string, ',');
+  grpc_error_handle error = GRPC_ERROR_NONE;
   auto creds = grpc_core::ExternalAccountCredentials::Create(
-                   json, std::move(scopes), &error)
+                   *json, std::move(scopes), &error)
                    .release();
   if (!GRPC_ERROR_IS_NONE(error)) {
     gpr_log(GPR_ERROR,

data/src/core/lib/security/credentials/external/file_external_account_credentials.cc

@@ -20,6 +20,7 @@
 #include <map>
 #include <utility>
 
+#include "absl/status/statusor.h"
 #include "absl/strings/string_view.h"
 
 #include <grpc/slice.h>
@@ -114,17 +115,15 @@ void FileExternalAccountCredentials::RetrieveSubjectToken(
   }
   absl::string_view content = StringViewFromSlice(content_slice.slice);
   if (format_type_ == "json") {
-    Json content_json = Json::Parse(content, &error);
-    if (!GRPC_ERROR_IS_NONE(error) ||
-        content_json.type() != Json::Type::OBJECT) {
+    auto content_json = Json::Parse(content);
+    if (!content_json.ok() || content_json->type() != Json::Type::OBJECT) {
       cb("", GRPC_ERROR_CREATE_FROM_STATIC_STRING(
                  "The content of the file is not a valid json object."));
-      GRPC_ERROR_UNREF(error);
       return;
     }
     auto content_it =
-        content_json.object_value().find(format_subject_token_field_name_);
-    if (content_it == content_json.object_value().end()) {
+        content_json->object_value().find(format_subject_token_field_name_);
+    if (content_it == content_json->object_value().end()) {
       cb("", GRPC_ERROR_CREATE_FROM_STATIC_STRING(
                  "Subject token field not present."));
       return;

data/src/core/lib/security/credentials/external/url_external_account_credentials.cc

@@ -202,18 +202,16 @@ void UrlExternalAccountCredentials::OnRetrieveSubjectTokenInternal(
   absl::string_view response_body(ctx_->response.body,
                                   ctx_->response.body_length);
   if (format_type_ == "json") {
-    grpc_error_handle error = GRPC_ERROR_NONE;
-    Json response_json = Json::Parse(response_body, &error);
-    if (!GRPC_ERROR_IS_NONE(error) ||
-        response_json.type() != Json::Type::OBJECT) {
+    auto response_json = Json::Parse(response_body);
+    if (!response_json.ok() || response_json->type() != Json::Type::OBJECT) {
       FinishRetrieveSubjectToken(
           "", GRPC_ERROR_CREATE_FROM_STATIC_STRING(
                   "The format of response is not a valid json object."));
       return;
     }
     auto response_it =
-        response_json.object_value().find(format_subject_token_field_name_);
-    if (response_it == response_json.object_value().end()) {
+        response_json->object_value().find(format_subject_token_field_name_);
+    if (response_it == response_json->object_value().end()) {
       FinishRetrieveSubjectToken("", GRPC_ERROR_CREATE_FROM_STATIC_STRING(
                                          "Subject token field not present."));
       return;

data/src/core/lib/security/credentials/fake/fake_credentials.cc

@@ -28,7 +28,6 @@
 
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
-#include "src/core/lib/promise/poll.h"
 #include "src/core/lib/promise/promise.h"
 #include "src/core/lib/security/security_connector/fake/fake_security_connector.h"
 #include "src/core/lib/security/security_connector/security_connector.h"
@@ -43,10 +42,9 @@ class grpc_fake_channel_credentials final : public grpc_channel_credentials {
   grpc_core::RefCountedPtr<grpc_channel_security_connector>
   create_security_connector(
       grpc_core::RefCountedPtr<grpc_call_credentials> call_creds,
-      const char* target, const grpc_channel_args* args,
-      grpc_channel_args** /*new_args*/) override {
+      const char* target, grpc_core::ChannelArgs* args) override {
     return grpc_fake_channel_security_connector_create(
-        this->Ref(), std::move(call_creds), target, args);
+        this->Ref(), std::move(call_creds), target, *args);
   }
 
   grpc_core::UniqueTypeName type() const override {
@@ -65,7 +63,7 @@ class grpc_fake_channel_credentials final : public grpc_channel_credentials {
 class grpc_fake_server_credentials final : public grpc_server_credentials {
  public:
   grpc_core::RefCountedPtr<grpc_server_security_connector>
-  create_security_connector(const grpc_channel_args* /*args*/) override {
+  create_security_connector(const grpc_core::ChannelArgs& /*args*/) override {
     return grpc_fake_server_security_connector_create(this->Ref());
   }
 
@@ -91,13 +89,6 @@ grpc_arg grpc_fake_transport_expected_targets_arg(char* expected_targets) {
       expected_targets);
 }
 
-const char* grpc_fake_transport_get_expected_targets(
-    const grpc_channel_args* args) {
-  const grpc_arg* expected_target_arg =
-      grpc_channel_args_find(args, GRPC_ARG_FAKE_SECURITY_EXPECTED_TARGETS);
-  return grpc_channel_arg_get_string(expected_target_arg);
-}
-
 /* -- Metadata-only test credentials. -- */
 
 grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientMetadataHandle>>

data/src/core/lib/security/credentials/fake/fake_credentials.h

@@ -63,10 +63,6 @@ grpc_server_credentials* grpc_fake_transport_security_server_credentials_create(
  * latter is present. */
 grpc_arg grpc_fake_transport_expected_targets_arg(char* expected_targets);
 
-/* Return the value associated with the expected targets channel arg or NULL */
-const char* grpc_fake_transport_get_expected_targets(
-    const grpc_channel_args* args);
-
 /* --  Metadata-only Test credentials. -- */
 
 class grpc_md_only_test_credentials : public grpc_call_credentials {

data/src/core/lib/security/credentials/google_default/google_default_credentials.cc

@@ -30,9 +30,11 @@
 #include "absl/strings/match.h"
 #include "absl/strings/string_view.h"
 #include "absl/strings/strip.h"
+#include "absl/types/optional.h"
 
 #include <grpc/grpc_security.h>  // IWYU pragma: keep
 #include <grpc/grpc_security_constants.h>
+#include <grpc/impl/codegen/grpc_types.h>
 #include <grpc/slice.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
@@ -65,6 +67,7 @@
 #include "src/core/lib/slice/slice_internal.h"
 #include "src/core/lib/slice/slice_refcount.h"
 #include "src/core/lib/surface/api_trace.h"
+#include "src/core/lib/transport/error_utils.h"
 #include "src/core/lib/uri/uri_parser.h"
 
 using grpc_core::Json;
@@ -103,11 +106,11 @@ struct metadata_server_detector {
 
 namespace {
 
-bool IsXdsNonCfeCluster(const char* xds_cluster) {
-  if (xds_cluster == nullptr) return false;
-  if (absl::StartsWith(xds_cluster, "google_cfe_")) return false;
-  if (!absl::StartsWith(xds_cluster, "xdstp:")) return true;
-  auto uri = grpc_core::URI::Parse(xds_cluster);
+bool IsXdsNonCfeCluster(absl::optional<absl::string_view> xds_cluster) {
+  if (!xds_cluster.has_value()) return false;
+  if (absl::StartsWith(*xds_cluster, "google_cfe_")) return false;
+  if (!absl::StartsWith(*xds_cluster, "xdstp:")) return true;
+  auto uri = grpc_core::URI::Parse(*xds_cluster);
   if (!uri.ok()) return true;  // Shouldn't happen, but assume ALTS.
   return uri->authority() != "traffic-director-c2p.xds.googleapis.com" ||
          !absl::StartsWith(uri->path(),
@@ -119,15 +122,14 @@ bool IsXdsNonCfeCluster(const char* xds_cluster) {
 grpc_core::RefCountedPtr<grpc_channel_security_connector>
 grpc_google_default_channel_credentials::create_security_connector(
     grpc_core::RefCountedPtr<grpc_call_credentials> call_creds,
-    const char* target, const grpc_channel_args* args,
-    grpc_channel_args** new_args) {
-  const bool is_grpclb_load_balancer = grpc_channel_args_find_bool(
-      args, GRPC_ARG_ADDRESS_IS_GRPCLB_LOAD_BALANCER, false);
-  const bool is_backend_from_grpclb_load_balancer = grpc_channel_args_find_bool(
-      args, GRPC_ARG_ADDRESS_IS_BACKEND_FROM_GRPCLB_LOAD_BALANCER, false);
-  const char* xds_cluster =
-      grpc_channel_args_find_string(args, GRPC_ARG_XDS_CLUSTER_NAME);
-  const bool is_xds_non_cfe_cluster = IsXdsNonCfeCluster(xds_cluster);
+    const char* target, grpc_core::ChannelArgs* args) {
+  const bool is_grpclb_load_balancer =
+      args->GetBool(GRPC_ARG_ADDRESS_IS_GRPCLB_LOAD_BALANCER).value_or(false);
+  const bool is_backend_from_grpclb_load_balancer =
+      args->GetBool(GRPC_ARG_ADDRESS_IS_BACKEND_FROM_GRPCLB_LOAD_BALANCER)
+          .value_or(false);
+  const bool is_xds_non_cfe_cluster =
+      IsXdsNonCfeCluster(args->GetString(GRPC_ARG_XDS_CLUSTER_NAME));
   const bool use_alts = is_grpclb_load_balancer ||
                         is_backend_from_grpclb_load_balancer ||
                         is_xds_non_cfe_cluster;
@@ -137,22 +139,17 @@ grpc_google_default_channel_credentials::create_security_connector(
     return nullptr;
   }
   grpc_core::RefCountedPtr<grpc_channel_security_connector> sc =
-      use_alts ? alts_creds_->create_security_connector(call_creds, target,
-                                                        args, new_args)
-               : ssl_creds_->create_security_connector(call_creds, target, args,
-                                                       new_args);
+      use_alts
+          ? alts_creds_->create_security_connector(call_creds, target, args)
+          : ssl_creds_->create_security_connector(call_creds, target, args);
   /* grpclb-specific channel args are removed from the channel args set
    * to ensure backends and fallback adresses will have the same set of channel
    * args. By doing that, it guarantees the connections to backends will not be
    * torn down and re-connected when switching in and out of fallback mode.
    */
   if (use_alts) {
-    static const char* args_to_remove[] = {
-        GRPC_ARG_ADDRESS_IS_GRPCLB_LOAD_BALANCER,
-        GRPC_ARG_ADDRESS_IS_BACKEND_FROM_GRPCLB_LOAD_BALANCER,
-    };
-    *new_args = grpc_channel_args_copy_and_add_and_remove(
-        args, args_to_remove, GPR_ARRAY_SIZE(args_to_remove), nullptr, 0);
+    *args = args->Remove(GRPC_ARG_ADDRESS_IS_GRPCLB_LOAD_BALANCER)
+                .Remove(GRPC_ARG_ADDRESS_IS_BACKEND_FROM_GRPCLB_LOAD_BALANCER);
   }
   return sc;
 }
@@ -317,8 +314,14 @@ static grpc_error_handle create_default_creds_from_path(
   }
   error = grpc_load_file(creds_path.c_str(), 0, &creds_data);
   if (!GRPC_ERROR_IS_NONE(error)) goto end;
-  json = Json::Parse(grpc_core::StringViewFromSlice(creds_data), &error);
-  if (!GRPC_ERROR_IS_NONE(error)) goto end;
+  {
+    auto json_or = Json::Parse(grpc_core::StringViewFromSlice(creds_data));
+    if (!json_or.ok()) {
+      error = absl_status_to_grpc_error(json_or.status());
+      goto end;
+    }
+    json = std::move(*json_or);
+  }
   if (json.type() != Json::Type::OBJECT) {
     error = grpc_error_set_str(
         GRPC_ERROR_CREATE_FROM_STATIC_STRING("Failed to parse JSON"),

data/src/core/lib/security/credentials/google_default/google_default_credentials.h

@@ -24,7 +24,6 @@
 
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
-#include <grpc/impl/codegen/grpc_types.h>
 
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gpr/useful.h"
@@ -62,8 +61,7 @@ class grpc_google_default_channel_credentials
   grpc_core::RefCountedPtr<grpc_channel_security_connector>
   create_security_connector(
       grpc_core::RefCountedPtr<grpc_call_credentials> call_creds,
-      const char* target, const grpc_channel_args* args,
-      grpc_channel_args** new_args) override;
+      const char* target, grpc_core::ChannelArgs* args) override;
 
   grpc_core::ChannelArgs update_arguments(grpc_core::ChannelArgs args) override;
 

data/src/core/lib/security/credentials/iam/iam_credentials.cc

@@ -32,7 +32,6 @@
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/iomgr/exec_ctx.h"
-#include "src/core/lib/promise/poll.h"
 #include "src/core/lib/promise/promise.h"
 #include "src/core/lib/surface/api_trace.h"
 #include "src/core/lib/transport/metadata_batch.h"

data/src/core/lib/security/credentials/insecure/insecure_credentials.cc

@@ -24,6 +24,7 @@
 
 #include "absl/strings/string_view.h"
 
+#include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/security/security_connector/insecure/insecure_security_connector.h"
 
 namespace grpc_core {
@@ -31,8 +32,7 @@ namespace grpc_core {
 RefCountedPtr<grpc_channel_security_connector>
 InsecureCredentials::create_security_connector(
     RefCountedPtr<grpc_call_credentials> request_metadata_creds,
-    const char* /* target_name */, const grpc_channel_args* /* args */,
-    grpc_channel_args** /* new_args */) {
+    const char* /* target_name */, ChannelArgs* /* args */) {
   return MakeRefCounted<InsecureChannelSecurityConnector>(
       Ref(), std::move(request_metadata_creds));
 }
@@ -50,7 +50,7 @@ int InsecureCredentials::cmp_impl(
 
 RefCountedPtr<grpc_server_security_connector>
 InsecureServerCredentials::create_security_connector(
-    const grpc_channel_args* /* args */) {
+    const ChannelArgs& /* args */) {
   return MakeRefCounted<InsecureServerSecurityConnector>(Ref());
 }
 

data/src/core/lib/security/credentials/insecure/insecure_credentials.h

@@ -23,8 +23,8 @@
 
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
-#include <grpc/impl/codegen/grpc_types.h>
 
+#include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/gprpp/unique_type_name.h"
 #include "src/core/lib/security/credentials/credentials.h"
@@ -36,8 +36,7 @@ class InsecureCredentials final : public grpc_channel_credentials {
  public:
   RefCountedPtr<grpc_channel_security_connector> create_security_connector(
       RefCountedPtr<grpc_call_credentials> request_metadata_creds,
-      const char* /* target_name */, const grpc_channel_args* /* args */,
-      grpc_channel_args** /* new_args */) override;
+      const char* /* target_name */, ChannelArgs* /* args */) override;
 
   static UniqueTypeName Type();
 
@@ -50,7 +49,7 @@ class InsecureCredentials final : public grpc_channel_credentials {
 class InsecureServerCredentials final : public grpc_server_credentials {
  public:
   RefCountedPtr<grpc_server_security_connector> create_security_connector(
-      const grpc_channel_args* /* args */) override;
+      const ChannelArgs& /* args */) override;
 
   static UniqueTypeName Type();
 

data/src/core/lib/security/credentials/jwt/json_token.cc

@@ -25,12 +25,16 @@
 
 #include <map>
 #include <string>
+#include <utility>
 
 #include <openssl/bio.h>
 #include <openssl/evp.h>
 #include <openssl/pem.h>
 #include <openssl/rsa.h>
 
+#include "absl/status/status.h"
+#include "absl/status/statusor.h"
+
 #include <grpc/grpc_security.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
@@ -125,9 +129,14 @@ end:
 
 grpc_auth_json_key grpc_auth_json_key_create_from_string(
     const char* json_string) {
-  grpc_error_handle error = GRPC_ERROR_NONE;
-  Json json = Json::Parse(json_string, &error);
-  GRPC_LOG_IF_ERROR("JSON key parsing", error);
+  Json json;
+  auto json_or = Json::Parse(json_string);
+  if (!json_or.ok()) {
+    gpr_log(GPR_ERROR, "JSON key parsing error: %s",
+            json_or.status().ToString().c_str());
+  } else {
+    json = std::move(*json_or);
+  }
   return grpc_auth_json_key_create_from_json(json);
 }
 

data/src/core/lib/security/credentials/jwt/jwt_credentials.cc

@@ -37,10 +37,8 @@
 
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
-#include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/iomgr/exec_ctx.h"
 #include "src/core/lib/json/json.h"
-#include "src/core/lib/promise/poll.h"
 #include "src/core/lib/promise/promise.h"
 #include "src/core/lib/security/credentials/call_creds_util.h"
 #include "src/core/lib/surface/api_trace.h"
@@ -141,14 +139,12 @@ grpc_service_account_jwt_access_credentials_create_from_auth_json_key(
 }
 
 static char* redact_private_key(const char* json_key) {
-  grpc_error_handle error = GRPC_ERROR_NONE;
-  Json json = Json::Parse(json_key, &error);
-  if (!GRPC_ERROR_IS_NONE(error) || json.type() != Json::Type::OBJECT) {
-    GRPC_ERROR_UNREF(error);
+  auto json = Json::Parse(json_key);
+  if (!json.ok() || json->type() != Json::Type::OBJECT) {
     return gpr_strdup("<Json failed to parse.>");
   }
-  (*json.mutable_object())["private_key"] = "<redacted>";
-  return gpr_strdup(json.Dump(/*indent=*/2).c_str());
+  (*json->mutable_object())["private_key"] = "<redacted>";
+  return gpr_strdup(json->Dump(/*indent=*/2).c_str());
 }
 
 grpc_call_credentials* grpc_service_account_jwt_access_credentials_create(

data/src/core/lib/security/credentials/jwt/jwt_verifier.cc

@@ -38,6 +38,7 @@
 #include <openssl/rsa.h>
 #include <openssl/x509.h>
 
+#include "absl/status/status.h"
 #include "absl/status/statusor.h"
 #include "absl/strings/string_view.h"
 
@@ -111,16 +112,14 @@ static Json parse_json_part_from_jwt(const char* str, size_t len) {
     return Json();  // JSON null
   }
   absl::string_view string = grpc_core::StringViewFromSlice(slice);
-  grpc_error_handle error = GRPC_ERROR_NONE;
-  Json json = Json::Parse(string, &error);
-  if (!GRPC_ERROR_IS_NONE(error)) {
+  auto json = Json::Parse(string);
+  grpc_slice_unref_internal(slice);
+  if (!json.ok()) {
     gpr_log(GPR_ERROR, "JSON parse error: %s",
-            grpc_error_std_string(error).c_str());
-    GRPC_ERROR_UNREF(error);
-    json = Json();  // JSON null
+            json.status().ToString().c_str());
+    return Json();  // JSON null
   }
-  grpc_slice_unref_internal(slice);
-  return json;
+  return std::move(*json);
 }
 
 static const char* validate_string_field(const Json& json, const char* key) {
@@ -435,14 +434,13 @@ static Json json_from_http(const grpc_http_response* response) {
             response->status);
     return Json();  // JSON null
   }
-  grpc_error_handle error = GRPC_ERROR_NONE;
-  Json json = Json::Parse(
-      absl::string_view(response->body, response->body_length), &error);
-  if (!GRPC_ERROR_IS_NONE(error)) {
+  auto json =
+      Json::Parse(absl::string_view(response->body, response->body_length));
+  if (!json.ok()) {
     gpr_log(GPR_ERROR, "Invalid JSON found in response.");
     return Json();  // JSON null
   }
-  return json;
+  return std::move(*json);
 }
 
 static const Json* find_property_by_name(const Json& json, const char* name) {

data/src/core/lib/security/credentials/local/local_credentials.cc

@@ -31,10 +31,9 @@
 grpc_core::RefCountedPtr<grpc_channel_security_connector>
 grpc_local_credentials::create_security_connector(
     grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds,
-    const char* target_name, const grpc_channel_args* args,
-    grpc_channel_args** /*new_args*/) {
+    const char* target_name, grpc_core::ChannelArgs* args) {
   return grpc_local_channel_security_connector_create(
-      this->Ref(), std::move(request_metadata_creds), args, target_name);
+      this->Ref(), std::move(request_metadata_creds), *args, target_name);
 }
 
 grpc_core::UniqueTypeName grpc_local_credentials::type() const {
@@ -44,7 +43,7 @@ grpc_core::UniqueTypeName grpc_local_credentials::type() const {
 
 grpc_core::RefCountedPtr<grpc_server_security_connector>
 grpc_local_server_credentials::create_security_connector(
-    const grpc_channel_args* /* args */) {
+    const grpc_core::ChannelArgs& /* args */) {
   return grpc_local_server_security_connector_create(this->Ref());
 }
 

data/src/core/lib/security/credentials/local/local_credentials.h

@@ -24,8 +24,8 @@
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/grpc_security_constants.h>
-#include <grpc/impl/codegen/grpc_types.h>
 
+#include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gpr/useful.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/gprpp/unique_type_name.h"
@@ -41,8 +41,7 @@ class grpc_local_credentials final : public grpc_channel_credentials {
   grpc_core::RefCountedPtr<grpc_channel_security_connector>
   create_security_connector(
       grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds,
-      const char* target_name, const grpc_channel_args* args,
-      grpc_channel_args** new_args) override;
+      const char* target_name, grpc_core::ChannelArgs* args) override;
 
   grpc_core::UniqueTypeName type() const override;
 
@@ -65,7 +64,7 @@ class grpc_local_server_credentials final : public grpc_server_credentials {
   ~grpc_local_server_credentials() override = default;
 
   grpc_core::RefCountedPtr<grpc_server_security_connector>
-  create_security_connector(const grpc_channel_args* /* args */) override;
+  create_security_connector(const grpc_core::ChannelArgs& /* args */) override;
 
   grpc_core::UniqueTypeName type() const override;