grpc 1.63.0 → 1.65.2

data/src/core/lib/security/credentials/jwt/jwt_verifier.cc

@@ -16,8 +16,6 @@
 //
 //
 
-#include <grpc/support/port_platform.h>
-
 #include "src/core/lib/security/credentials/jwt/jwt_verifier.h"
 
 #include <limits.h>
@@ -37,10 +35,14 @@
 #include <openssl/pem.h>
 #include <openssl/rsa.h>
 #include <openssl/x509.h>
+
+#include <grpc/support/port_platform.h>
 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
 #include <openssl/param_build.h>
 #endif
 
+#include "absl/log/check.h"
+#include "absl/log/log.h"
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
 #include "absl/strings/escaping.h"
@@ -49,28 +51,27 @@
 #include <grpc/slice.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/json.h>
-#include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
 #include <grpc/support/time.h>
 
-#include "src/core/lib/gpr/string.h"
 #include "src/core/lib/gprpp/manual_constructor.h"
 #include "src/core/lib/gprpp/memory.h"
 #include "src/core/lib/gprpp/orphanable.h"
-#include "src/core/lib/http/httpcli.h"
-#include "src/core/lib/http/httpcli_ssl_credentials.h"
-#include "src/core/lib/http/parser.h"
 #include "src/core/lib/iomgr/closure.h"
 #include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/iomgr/exec_ctx.h"
 #include "src/core/lib/iomgr/iomgr_fwd.h"
 #include "src/core/lib/iomgr/polling_entity.h"
-#include "src/core/lib/json/json_reader.h"
 #include "src/core/lib/security/credentials/credentials.h"  // IWYU pragma: keep
 #include "src/core/lib/slice/slice.h"
 #include "src/core/lib/slice/slice_internal.h"
 #include "src/core/lib/uri/uri_parser.h"
 #include "src/core/tsi/ssl_types.h"
+#include "src/core/util/http_client/httpcli.h"
+#include "src/core/util/http_client/httpcli_ssl_credentials.h"
+#include "src/core/util/http_client/parser.h"
+#include "src/core/util/json/json_reader.h"
+#include "src/core/util/string.h"
 
 using grpc_core::Json;
 
@@ -113,13 +114,12 @@ static const EVP_MD* evp_md_from_alg(const char* alg) {
 static Json parse_json_part_from_jwt(const char* str, size_t len) {
   std::string string;
   if (!absl::WebSafeBase64Unescape(absl::string_view(str, len), &string)) {
-    gpr_log(GPR_ERROR, "Invalid base64.");
+    LOG(ERROR) << "Invalid base64.";
     return Json();  // JSON null
   }
   auto json = grpc_core::JsonParse(string);
   if (!json.ok()) {
-    gpr_log(GPR_ERROR, "JSON parse error: %s",
-            json.status().ToString().c_str());
+    LOG(ERROR) << "JSON parse error: " << json.status();
     return Json();  // JSON null
   }
   return std::move(*json);
@@ -127,7 +127,7 @@ static Json parse_json_part_from_jwt(const char* str, size_t len) {
 
 static const char* validate_string_field(const Json& json, const char* key) {
   if (json.type() != Json::Type::kString) {
-    gpr_log(GPR_ERROR, "Invalid %s field", key);
+    LOG(ERROR) << "Invalid " << key << " field";
     return nullptr;
   }
   return json.string().c_str();
@@ -136,7 +136,7 @@ static const char* validate_string_field(const Json& json, const char* key) {
 static gpr_timespec validate_time_field(const Json& json, const char* key) {
   gpr_timespec result = gpr_time_0(GPR_CLOCK_REALTIME);
   if (json.type() != Json::Type::kNumber) {
-    gpr_log(GPR_ERROR, "Invalid %s field", key);
+    LOG(ERROR) << "Invalid " << key << " field";
     return result;
   }
   result.tv_sec = strtol(json.string().c_str(), nullptr, 10);
@@ -162,13 +162,13 @@ static jose_header* jose_header_from_json(Json json) {
   Json::Object::const_iterator it;
   jose_header* h = grpc_core::Zalloc<jose_header>();
   if (json.type() != Json::Type::kObject) {
-    gpr_log(GPR_ERROR, "JSON value is not an object");
+    LOG(ERROR) << "JSON value is not an object";
     goto error;
   }
   // Check alg field.
   it = json.object().find("alg");
   if (it == json.object().end()) {
-    gpr_log(GPR_ERROR, "Missing alg field.");
+    LOG(ERROR) << "Missing alg field.";
     goto error;
   }
   // We only support RSA-1.5 signatures for now.
@@ -179,7 +179,7 @@ static jose_header* jose_header_from_json(Json json) {
   if (it->second.type() != Json::Type::kString ||
       strncmp(alg_value, "RS", 2) != 0 ||
       evp_md_from_alg(alg_value) == nullptr) {
-    gpr_log(GPR_ERROR, "Invalid alg field");
+    LOG(ERROR) << "Invalid alg field";
     goto error;
   }
   h->alg = alg_value;
@@ -313,18 +313,18 @@ grpc_jwt_verifier_status grpc_jwt_claims_check(const grpc_jwt_claims* claims,
   gpr_timespec skewed_now;
   int audience_ok;
 
-  GPR_ASSERT(claims != nullptr);
+  CHECK_NE(claims, nullptr);
 
   skewed_now =
       gpr_time_add(gpr_now(GPR_CLOCK_REALTIME), grpc_jwt_verifier_clock_skew);
   if (gpr_time_cmp(skewed_now, claims->nbf) < 0) {
-    gpr_log(GPR_ERROR, "JWT is not valid yet.");
+    LOG(ERROR) << "JWT is not valid yet.";
     return GRPC_JWT_VERIFIER_TIME_CONSTRAINT_FAILURE;
   }
   skewed_now =
       gpr_time_sub(gpr_now(GPR_CLOCK_REALTIME), grpc_jwt_verifier_clock_skew);
   if (gpr_time_cmp(skewed_now, claims->exp) > 0) {
-    gpr_log(GPR_ERROR, "JWT is expired.");
+    LOG(ERROR) << "JWT is expired.";
     return GRPC_JWT_VERIFIER_TIME_CONSTRAINT_FAILURE;
   }
 
@@ -333,9 +333,9 @@ grpc_jwt_verifier_status grpc_jwt_claims_check(const grpc_jwt_claims* claims,
   // issued.
   if (grpc_jwt_issuer_email_domain(claims->iss) != nullptr &&
       claims->sub != nullptr && strcmp(claims->iss, claims->sub) != 0) {
-    gpr_log(GPR_ERROR,
-            "Email issuer (%s) cannot assert another subject (%s) than itself.",
-            claims->iss, claims->sub);
+    LOG(ERROR) << "Email issuer (" << claims->iss
+               << ") cannot assert another subject (" << claims->sub
+               << ") than itself.";
     return GRPC_JWT_VERIFIER_BAD_SUBJECT;
   }
 
@@ -345,9 +345,9 @@ grpc_jwt_verifier_status grpc_jwt_claims_check(const grpc_jwt_claims* claims,
     audience_ok = claims->aud != nullptr && strcmp(audience, claims->aud) == 0;
   }
   if (!audience_ok) {
-    gpr_log(GPR_ERROR, "Audience mismatch: expected %s and found %s.",
-            audience == nullptr ? "NULL" : audience,
-            claims->aud == nullptr ? "NULL" : claims->aud);
+    LOG(ERROR) << "Audience mismatch: expected "
+               << (audience == nullptr ? "NULL" : audience) << " and found "
+               << (claims->aud == nullptr ? "NULL" : claims->aud);
     return GRPC_JWT_VERIFIER_BAD_AUDIENCE;
   }
   return GRPC_JWT_VERIFIER_OK;
@@ -429,18 +429,17 @@ struct grpc_jwt_verifier {
 
 static Json json_from_http(const grpc_http_response* response) {
   if (response == nullptr) {
-    gpr_log(GPR_ERROR, "HTTP response is NULL.");
+    LOG(ERROR) << "HTTP response is NULL.";
     return Json();  // JSON null
   }
   if (response->status != 200) {
-    gpr_log(GPR_ERROR, "Call to http server failed with error %d.",
-            response->status);
+    LOG(ERROR) << "Call to http server failed with error " << response->status;
     return Json();  // JSON null
   }
   auto json = grpc_core::JsonParse(
       absl::string_view(response->body, response->body_length));
   if (!json.ok()) {
-    gpr_log(GPR_ERROR, "Invalid JSON found in response.");
+    LOG(ERROR) << "Invalid JSON found in response.";
     return Json();  // JSON null
   }
   return std::move(*json);
@@ -459,16 +458,16 @@ static EVP_PKEY* extract_pkey_from_x509(const char* x509_str) {
   EVP_PKEY* result = nullptr;
   BIO* bio = BIO_new(BIO_s_mem());
   size_t len = strlen(x509_str);
-  GPR_ASSERT(len < INT_MAX);
+  CHECK_LT(len, static_cast<size_t>(INT_MAX));
   BIO_write(bio, x509_str, static_cast<int>(len));
   x509 = PEM_read_bio_X509(bio, nullptr, nullptr, nullptr);
   if (x509 == nullptr) {
-    gpr_log(GPR_ERROR, "Unable to parse x509 cert.");
+    LOG(ERROR) << "Unable to parse x509 cert.";
     goto end;
   }
   result = X509_get_pubkey(x509);
   if (result == nullptr) {
-    gpr_log(GPR_ERROR, "Cannot find public key in X509 cert.");
+    LOG(ERROR) << "Cannot find public key in X509 cert.";
   }
 
 end:
@@ -481,7 +480,7 @@ static BIGNUM* bignum_from_base64(const char* b64) {
   if (b64 == nullptr) return nullptr;
   std::string string;
   if (!absl::WebSafeBase64Unescape(b64, &string)) {
-    gpr_log(GPR_ERROR, "Invalid base64 for big num.");
+    LOG(ERROR) << "Invalid base64 for big num.";
     return nullptr;
   }
   return BN_bin2bn(reinterpret_cast<const uint8_t*>(string.data()),
@@ -530,36 +529,36 @@ static EVP_PKEY* pkey_from_jwk(const Json& json, const char* kty) {
   BIGNUM* tmp_e = nullptr;
   Json::Object::const_iterator it;
 
-  GPR_ASSERT(json.type() == Json::Type::kObject);
-  GPR_ASSERT(kty != nullptr);
+  CHECK(json.type() == Json::Type::kObject);
+  CHECK_NE(kty, nullptr);
   if (strcmp(kty, "RSA") != 0) {
-    gpr_log(GPR_ERROR, "Unsupported key type %s.", kty);
+    LOG(ERROR) << "Unsupported key type " << kty;
     goto end;
   }
 #if OPENSSL_VERSION_NUMBER < 0x30000000L
   rsa = RSA_new();
   if (rsa == nullptr) {
-    gpr_log(GPR_ERROR, "Could not create rsa key.");
+    LOG(ERROR) << "Could not create rsa key.";
     goto end;
   }
 #endif
   it = json.object().find("n");
   if (it == json.object().end()) {
-    gpr_log(GPR_ERROR, "Missing RSA public key field.");
+    LOG(ERROR) << "Missing RSA public key field.";
     goto end;
   }
   tmp_n = bignum_from_base64(validate_string_field(it->second, "n"));
   if (tmp_n == nullptr) goto end;
   it = json.object().find("e");
   if (it == json.object().end()) {
-    gpr_log(GPR_ERROR, "Missing RSA public key field.");
+    LOG(ERROR) << "Missing RSA public key field.";
     goto end;
   }
   tmp_e = bignum_from_base64(validate_string_field(it->second, "e"));
   if (tmp_e == nullptr) goto end;
 #if OPENSSL_VERSION_NUMBER < 0x30000000L
   if (!RSA_set0_key(rsa, tmp_n, tmp_e, nullptr)) {
-    gpr_log(GPR_ERROR, "Cannot set RSA key from inputs.");
+    LOG(ERROR) << "Cannot set RSA key from inputs.";
     goto end;
   }
   // RSA_set0_key takes ownership on success.
@@ -572,21 +571,21 @@ static EVP_PKEY* pkey_from_jwk(const Json& json, const char* kty) {
   if (!OSSL_PARAM_BLD_push_BN(bld, "n", tmp_n) ||
       !OSSL_PARAM_BLD_push_BN(bld, "e", tmp_e) ||
       (params = OSSL_PARAM_BLD_to_param(bld)) == NULL) {
-    gpr_log(GPR_ERROR, "Could not create OSSL_PARAM");
+    LOG(ERROR) << "Could not create OSSL_PARAM";
     goto end;
   }
 
   ctx = EVP_PKEY_CTX_new_from_name(nullptr, "RSA", nullptr);
   if (ctx == nullptr) {
-    gpr_log(GPR_ERROR, "Could not create rsa key.");
+    LOG(ERROR) << "Could not create rsa key.";
     goto end;
   }
   if (EVP_PKEY_fromdata_init(ctx) <= 0) {
-    gpr_log(GPR_ERROR, "Could not create rsa key.");
+    LOG(ERROR) << "Could not create rsa key.";
     goto end;
   }
   if (EVP_PKEY_fromdata(ctx, &result, EVP_PKEY_KEYPAIR, params) <= 0) {
-    gpr_log(GPR_ERROR, "Cannot set RSA key from inputs.");
+    LOG(ERROR) << "Cannot set RSA key from inputs.";
     goto end;
   }
 #endif
@@ -617,8 +616,7 @@ static EVP_PKEY* find_verification_key(const Json& json, const char* header_alg,
     return extract_pkey_from_x509(cur->string().c_str());
   }
   if (jwt_keys->type() != Json::Type::kArray) {
-    gpr_log(GPR_ERROR,
-            "Unexpected value type of keys property in jwks key set.");
+    LOG(ERROR) << "Unexpected value type of keys property in jwks key set.";
     return nullptr;
   }
   // Key format is specified in:
@@ -645,9 +643,8 @@ static EVP_PKEY* find_verification_key(const Json& json, const char* header_alg,
       return pkey_from_jwk(jkey, kty);
     }
   }
-  gpr_log(GPR_ERROR,
-          "Could not find matching key in key set for kid=%s and alg=%s",
-          header_kid, header_alg);
+  LOG(ERROR) << "Could not find matching key in key set for kid=" << header_kid
+             << " and alg=" << header_alg;
   return nullptr;
 }
 
@@ -658,23 +655,23 @@ static int verify_jwt_signature(EVP_PKEY* key, const char* alg,
   const EVP_MD* md = evp_md_from_alg(alg);
   int result = 0;
 
-  GPR_ASSERT(md != nullptr);  // Checked before.
+  CHECK_NE(md, nullptr);  // Checked before.
   if (md_ctx == nullptr) {
-    gpr_log(GPR_ERROR, "Could not create EVP_MD_CTX.");
+    LOG(ERROR) << "Could not create EVP_MD_CTX.";
     goto end;
   }
   if (EVP_DigestVerifyInit(md_ctx, nullptr, md, nullptr, key) != 1) {
-    gpr_log(GPR_ERROR, "EVP_DigestVerifyInit failed.");
+    LOG(ERROR) << "EVP_DigestVerifyInit failed.";
     goto end;
   }
   if (EVP_DigestVerifyUpdate(md_ctx, GRPC_SLICE_START_PTR(signed_data),
                              GRPC_SLICE_LENGTH(signed_data)) != 1) {
-    gpr_log(GPR_ERROR, "EVP_DigestVerifyUpdate failed.");
+    LOG(ERROR) << "EVP_DigestVerifyUpdate failed.";
     goto end;
   }
   if (EVP_DigestVerifyFinal(md_ctx, GRPC_SLICE_START_PTR(signature),
                             GRPC_SLICE_LENGTH(signature)) != 1) {
-    gpr_log(GPR_ERROR, "JWT signature verification failed.");
+    LOG(ERROR) << "JWT signature verification failed.";
 
     goto end;
   }
@@ -699,8 +696,8 @@ static void on_keys_retrieved(void* user_data, grpc_error_handle /*error*/) {
   verification_key =
       find_verification_key(json, ctx->header->alg, ctx->header->kid);
   if (verification_key == nullptr) {
-    gpr_log(GPR_ERROR, "Could not find verification key with kid %s.",
-            ctx->header->kid);
+    LOG(ERROR) << "Could not find verification key with kid "
+               << ctx->header->kid;
     status = GRPC_JWT_VERIFIER_KEY_RETRIEVAL_ERROR;
     goto end;
   }
@@ -741,13 +738,13 @@ static void on_openid_config_retrieved(void* user_data,
   if (json.type() == Json::Type::kNull) goto error;
   cur = find_property_by_name(json, "jwks_uri");
   if (cur == nullptr) {
-    gpr_log(GPR_ERROR, "Could not find jwks_uri in openid config.");
+    LOG(ERROR) << "Could not find jwks_uri in openid config.";
     goto error;
   }
   jwks_uri = validate_string_field(*cur, "jwks_uri");
   if (jwks_uri == nullptr) goto error;
   if (strstr(jwks_uri, "https://") != jwks_uri) {
-    gpr_log(GPR_ERROR, "Invalid non https jwks_uri: %s.", jwks_uri);
+    LOG(ERROR) << "Invalid non https jwks_uri: " << jwks_uri;
     goto error;
   }
   jwks_uri += 8;
@@ -797,7 +794,7 @@ static email_key_mapping* verifier_get_mapping(grpc_jwt_verifier* v,
 static void verifier_put_mapping(grpc_jwt_verifier* v, const char* email_domain,
                                  const char* key_url_prefix) {
   email_key_mapping* mapping = verifier_get_mapping(v, email_domain);
-  GPR_ASSERT(v->num_mappings < v->allocated_mappings);
+  CHECK(v->num_mappings < v->allocated_mappings);
   if (mapping != nullptr) {
     gpr_free(mapping->key_url_prefix);
     mapping->key_url_prefix = gpr_strdup(key_url_prefix);
@@ -806,7 +803,7 @@ static void verifier_put_mapping(grpc_jwt_verifier* v, const char* email_domain,
   v->mappings[v->num_mappings].email_domain = gpr_strdup(email_domain);
   v->mappings[v->num_mappings].key_url_prefix = gpr_strdup(key_url_prefix);
   v->num_mappings++;
-  GPR_ASSERT(v->num_mappings <= v->allocated_mappings);
+  CHECK(v->num_mappings <= v->allocated_mappings);
 }
 
 // Very non-sophisticated way to detect an email address. Should be good
@@ -818,7 +815,7 @@ const char* grpc_jwt_issuer_email_domain(const char* issuer) {
   if (*email_domain == '\0') return nullptr;
   const char* dot = strrchr(email_domain, '.');
   if (dot == nullptr || dot == email_domain) return email_domain;
-  GPR_ASSERT(dot > email_domain);
+  CHECK(dot > email_domain);
   // There may be a subdomain, we just want the domain.
   dot = static_cast<const char*>(
       gpr_memrchr(email_domain, '.', static_cast<size_t>(dot - email_domain)));
@@ -839,15 +836,14 @@ static void retrieve_key_and_verify(verifier_cb_ctx* ctx) {
   char* path;
   absl::StatusOr<grpc_core::URI> uri;
 
-  GPR_ASSERT(ctx != nullptr && ctx->header != nullptr &&
-             ctx->claims != nullptr);
+  CHECK(ctx != nullptr && ctx->header != nullptr && ctx->claims != nullptr);
   iss = ctx->claims->iss;
   if (ctx->header->kid == nullptr) {
-    gpr_log(GPR_ERROR, "Missing kid in jose header.");
+    LOG(ERROR) << "Missing kid in jose header.";
     goto error;
   }
   if (iss == nullptr) {
-    gpr_log(GPR_ERROR, "Missing iss in claims.");
+    LOG(ERROR) << "Missing iss in claims.";
     goto error;
   }
 
@@ -859,10 +855,10 @@ static void retrieve_key_and_verify(verifier_cb_ctx* ctx) {
   email_domain = grpc_jwt_issuer_email_domain(iss);
   if (email_domain != nullptr) {
     email_key_mapping* mapping;
-    GPR_ASSERT(ctx->verifier != nullptr);
+    CHECK_NE(ctx->verifier, nullptr);
     mapping = verifier_get_mapping(ctx->verifier, email_domain);
     if (mapping == nullptr) {
-      gpr_log(GPR_ERROR, "Missing mapping for issuer email.");
+      LOG(ERROR) << "Missing mapping for issuer email.";
       goto error;
     }
     host = gpr_strdup(mapping->key_url_prefix);
@@ -926,8 +922,8 @@ void grpc_jwt_verifier_verify(grpc_jwt_verifier* verifier,
   Json json;
   std::string signature_str;
 
-  GPR_ASSERT(verifier != nullptr && jwt != nullptr && audience != nullptr &&
-             cb != nullptr);
+  CHECK(verifier != nullptr && jwt != nullptr && audience != nullptr &&
+        cb != nullptr);
   dot = strchr(cur, '.');
   if (dot == nullptr) goto error;
   json = parse_json_part_from_jwt(cur, static_cast<size_t>(dot - cur));

data/src/core/lib/security/credentials/jwt/jwt_verifier.h

@@ -19,15 +19,14 @@
 #ifndef GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_JWT_JWT_VERIFIER_H
 #define GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_JWT_JWT_VERIFIER_H
 
-#include <grpc/support/port_platform.h>
-
 #include <stddef.h>
 
+#include <grpc/support/port_platform.h>
 #include <grpc/support/time.h>
 
 #include "src/core/lib/gprpp/time.h"
 #include "src/core/lib/iomgr/iomgr_fwd.h"
-#include "src/core/lib/json/json.h"
+#include "src/core/util/json/json.h"
 
 // --- Constants. ---
 

data/src/core/lib/security/credentials/local/local_credentials.cc

@@ -16,13 +16,12 @@
 //
 //
 
-#include <grpc/support/port_platform.h>
-
 #include "src/core/lib/security/credentials/local/local_credentials.h"
 
 #include <utility>
 
 #include <grpc/grpc.h>
+#include <grpc/support/port_platform.h>
 
 #include "src/core/lib/security/security_connector/local/local_security_connector.h"
 

data/src/core/lib/security/credentials/local/local_credentials.h

@@ -19,18 +19,18 @@
 #ifndef GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_LOCAL_LOCAL_CREDENTIALS_H
 #define GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_LOCAL_LOCAL_CREDENTIALS_H
 
-#include <grpc/support/port_platform.h>
-
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/grpc_security_constants.h>
+#include <grpc/support/port_platform.h>
 
 #include "src/core/lib/channel/channel_args.h"
-#include "src/core/lib/gpr/useful.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/gprpp/unique_type_name.h"
 #include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/security/security_connector/security_connector.h"
+#include "src/core/util/useful.h"
 
 // Main class for grpc local channel credential.
 class grpc_local_credentials final : public grpc_channel_credentials {

data/src/core/lib/security/credentials/oauth2/oauth2_credentials.cc

@@ -16,8 +16,6 @@
 //
 //
 
-#include <grpc/support/port_platform.h>
-
 #include "src/core/lib/security/credentials/oauth2/oauth2_credentials.h"
 
 #include <stdlib.h>
@@ -29,18 +27,22 @@
 #include <memory>
 #include <vector>
 
+#include "absl/log/check.h"
+#include "absl/log/log.h"
 #include "absl/status/status.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/str_format.h"
 #include "absl/strings/str_join.h"
 #include "absl/strings/string_view.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/slice.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/json.h>
 #include <grpc/support/log.h>
+#include <grpc/support/port_platform.h>
 #include <grpc/support/string_util.h>
 #include <grpc/support/time.h>
 
@@ -49,11 +51,8 @@
 #include "src/core/lib/gprpp/memory.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/gprpp/status_helper.h"
-#include "src/core/lib/http/httpcli_ssl_credentials.h"
 #include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/iomgr/pollset_set.h"
-#include "src/core/lib/json/json.h"
-#include "src/core/lib/json/json_reader.h"
 #include "src/core/lib/promise/context.h"
 #include "src/core/lib/promise/poll.h"
 #include "src/core/lib/promise/promise.h"
@@ -62,6 +61,9 @@
 #include "src/core/lib/transport/error_utils.h"
 #include "src/core/lib/transport/metadata_batch.h"
 #include "src/core/lib/uri/uri_parser.h"
+#include "src/core/util/http_client/httpcli_ssl_credentials.h"
+#include "src/core/util/json/json.h"
+#include "src/core/util/json/json_reader.h"
 
 using grpc_core::Json;
 
@@ -85,7 +87,7 @@ grpc_auth_refresh_token grpc_auth_refresh_token_create_from_json(
   memset(&result, 0, sizeof(grpc_auth_refresh_token));
   result.type = GRPC_AUTH_JSON_TYPE_INVALID;
   if (json.type() != Json::Type::kObject) {
-    gpr_log(GPR_ERROR, "Invalid json.");
+    LOG(ERROR) << "Invalid json.";
     goto end;
   }
 
@@ -160,7 +162,7 @@ grpc_oauth2_token_fetcher_credentials_parse_server_response(
   grpc_credentials_status status = GRPC_CREDENTIALS_OK;
 
   if (response == nullptr) {
-    gpr_log(GPR_ERROR, "Received NULL response.");
+    LOG(ERROR) << "Received NULL response.";
     status = GRPC_CREDENTIALS_ERROR;
     goto end;
   }
@@ -192,14 +194,14 @@ grpc_oauth2_token_fetcher_credentials_parse_server_response(
       goto end;
     }
     if (json->type() != Json::Type::kObject) {
-      gpr_log(GPR_ERROR, "Response should be a JSON object");
+      LOG(ERROR) << "Response should be a JSON object";
       status = GRPC_CREDENTIALS_ERROR;
       goto end;
     }
     it = json->object().find("access_token");
     if (it == json->object().end() ||
         it->second.type() != Json::Type::kString) {
-      gpr_log(GPR_ERROR, "Missing or invalid access_token in JSON.");
+      LOG(ERROR) << "Missing or invalid access_token in JSON.";
       status = GRPC_CREDENTIALS_ERROR;
       goto end;
     }
@@ -207,7 +209,7 @@ grpc_oauth2_token_fetcher_credentials_parse_server_response(
     it = json->object().find("token_type");
     if (it == json->object().end() ||
         it->second.type() != Json::Type::kString) {
-      gpr_log(GPR_ERROR, "Missing or invalid token_type in JSON.");
+      LOG(ERROR) << "Missing or invalid token_type in JSON.";
       status = GRPC_CREDENTIALS_ERROR;
       goto end;
     }
@@ -215,7 +217,7 @@ grpc_oauth2_token_fetcher_credentials_parse_server_response(
     it = json->object().find("expires_in");
     if (it == json->object().end() ||
         it->second.type() != Json::Type::kNumber) {
-      gpr_log(GPR_ERROR, "Missing or invalid expires_in in JSON.");
+      LOG(ERROR) << "Missing or invalid expires_in in JSON.";
       status = GRPC_CREDENTIALS_ERROR;
       goto end;
     }
@@ -395,7 +397,7 @@ class grpc_compute_engine_token_fetcher_credentials
     auto uri = grpc_core::URI::Create("http", GRPC_COMPUTE_ENGINE_METADATA_HOST,
                                       GRPC_COMPUTE_ENGINE_METADATA_TOKEN_PATH,
                                       {} /* query params */, "" /* fragment */);
-    GPR_ASSERT(uri.ok());  // params are hardcoded
+    CHECK(uri.ok());  // params are hardcoded
     http_request_ = grpc_core::HttpRequest::Get(
         std::move(*uri), nullptr /* channel args */, pollent, &request,
         deadline,
@@ -424,7 +426,7 @@ grpc_call_credentials* grpc_google_compute_engine_credentials_create(
     void* reserved) {
   GRPC_API_TRACE("grpc_compute_engine_credentials_create(reserved=%p)", 1,
                  (reserved));
-  GPR_ASSERT(reserved == nullptr);
+  CHECK_EQ(reserved, nullptr);
   return grpc_core::MakeRefCounted<
              grpc_compute_engine_token_fetcher_credentials>()
       .release();
@@ -461,7 +463,7 @@ void grpc_google_refresh_token_credentials::fetch_oauth2(
   auto uri = grpc_core::URI::Create("https", GRPC_GOOGLE_OAUTH2_SERVICE_HOST,
                                     GRPC_GOOGLE_OAUTH2_SERVICE_TOKEN_PATH,
                                     {} /* query params */, "" /* fragment */);
-  GPR_ASSERT(uri.ok());  // params are hardcoded
+  CHECK(uri.ok());  // params are hardcoded
   http_request_ = grpc_core::HttpRequest::Post(
       std::move(*uri), nullptr /* channel args */, pollent, &request, deadline,
       GRPC_CLOSURE_INIT(&http_post_cb_closure_, response_cb, metadata_req,
@@ -478,7 +480,7 @@ grpc_core::RefCountedPtr<grpc_call_credentials>
 grpc_refresh_token_credentials_create_from_auth_refresh_token(
     grpc_auth_refresh_token refresh_token) {
   if (!grpc_auth_refresh_token_is_valid(&refresh_token)) {
-    gpr_log(GPR_ERROR, "Invalid input for refresh token credentials creation");
+    LOG(ERROR) << "Invalid input for refresh token credentials creation";
     return nullptr;
   }
   return grpc_core::MakeRefCounted<grpc_google_refresh_token_credentials>(
@@ -511,13 +513,13 @@ grpc_call_credentials* grpc_google_refresh_token_credentials_create(
     const char* json_refresh_token, void* reserved) {
   grpc_auth_refresh_token token =
       grpc_auth_refresh_token_create_from_string(json_refresh_token);
-  if (GRPC_TRACE_FLAG_ENABLED(grpc_api_trace)) {
+  if (GRPC_TRACE_FLAG_ENABLED(api)) {
     gpr_log(GPR_INFO,
             "grpc_refresh_token_credentials_create(json_refresh_token=%s, "
             "reserved=%p)",
             create_loggable_refresh_token(&token).c_str(), reserved);
   }
-  GPR_ASSERT(reserved == nullptr);
+  CHECK_EQ(reserved, nullptr);
   return grpc_refresh_token_credentials_create_from_auth_refresh_token(token)
       .release();
 }
@@ -700,7 +702,7 @@ absl::StatusOr<URI> ValidateStsCredentialsOptions(
 
 grpc_call_credentials* grpc_sts_credentials_create(
     const grpc_sts_credentials_options* options, void* reserved) {
-  GPR_ASSERT(reserved == nullptr);
+  CHECK_EQ(reserved, nullptr);
   absl::StatusOr<grpc_core::URI> sts_url =
       grpc_core::ValidateStsCredentialsOptions(options);
   if (!sts_url.ok()) {
@@ -747,7 +749,7 @@ grpc_call_credentials* grpc_access_token_credentials_create(
       "grpc_access_token_credentials_create(access_token=<redacted>, "
       "reserved=%p)",
       1, (reserved));
-  GPR_ASSERT(reserved == nullptr);
+  CHECK_EQ(reserved, nullptr);
   return grpc_core::MakeRefCounted<grpc_access_token_credentials>(access_token)
       .release();
 }