grpc 1.66.0 → 1.67.0.pre1

data/src/core/lib/security/credentials/external/aws_external_account_credentials.h

@@ -38,46 +38,67 @@ namespace grpc_core {
 
 class AwsExternalAccountCredentials final : public ExternalAccountCredentials {
  public:
-  static RefCountedPtr<AwsExternalAccountCredentials> Create(
+  static absl::StatusOr<RefCountedPtr<AwsExternalAccountCredentials>> Create(
       Options options, std::vector<std::string> scopes,
-      grpc_error_handle* error);
-
-  AwsExternalAccountCredentials(Options options,
-                                std::vector<std::string> scopes,
-                                grpc_error_handle* error);
-
- private:
-  bool ShouldUseMetadataServer();
-  void RetrieveSubjectToken(
-      HTTPRequestContext* ctx, const Options& options,
-      std::function<void(std::string, grpc_error_handle)> cb) override;
-
-  void RetrieveRegion();
-  static void OnRetrieveRegion(void* arg, grpc_error_handle error);
-  void OnRetrieveRegionInternal(grpc_error_handle error);
-
-  void RetrieveImdsV2SessionToken();
-  static void OnRetrieveImdsV2SessionToken(void* arg, grpc_error_handle error);
-  void OnRetrieveImdsV2SessionTokenInternal(grpc_error_handle error);
+      std::shared_ptr<grpc_event_engine::experimental::EventEngine>
+          event_engine = nullptr);
 
-  void RetrieveRoleName();
-  static void OnRetrieveRoleName(void* arg, grpc_error_handle error);
-  void OnRetrieveRoleNameInternal(grpc_error_handle error);
+  AwsExternalAccountCredentials(
+      Options options, std::vector<std::string> scopes,
+      std::shared_ptr<grpc_event_engine::experimental::EventEngine>
+          event_engine,
+      grpc_error_handle* error);
 
-  void RetrieveSigningKeys();
-  static void OnRetrieveSigningKeys(void* arg, grpc_error_handle error);
-  void OnRetrieveSigningKeysInternal(grpc_error_handle error);
+  std::string debug_string() override;
 
-  void BuildSubjectToken();
-  void FinishRetrieveSubjectToken(std::string subject_token,
-                                  grpc_error_handle error);
+  UniqueTypeName type() const override;
 
-  void AddMetadataRequestHeaders(grpc_http_request* request);
+ private:
+  // A FetchBody impl that itself performs a sequence of FetchBody operations.
+  class AwsFetchBody : public FetchBody {
+   public:
+    AwsFetchBody(absl::AnyInvocable<void(absl::StatusOr<std::string>)> on_done,
+                 AwsExternalAccountCredentials* creds, Timestamp deadline);
+
+   private:
+    void Shutdown() override;
+
+    void AsyncFinish(absl::StatusOr<std::string> result);
+    bool MaybeFail(absl::Status status) ABSL_EXCLUSIVE_LOCKS_REQUIRED(&mu_);
+
+    void Start();
+    void RetrieveImdsV2SessionToken() ABSL_EXCLUSIVE_LOCKS_REQUIRED(&mu_);
+    void RetrieveRegion() ABSL_EXCLUSIVE_LOCKS_REQUIRED(&mu_);
+    void RetrieveRoleName() ABSL_EXCLUSIVE_LOCKS_REQUIRED(&mu_);
+    void RetrieveSigningKeys() ABSL_EXCLUSIVE_LOCKS_REQUIRED(&mu_);
+    void OnRetrieveSigningKeys(std::string result)
+        ABSL_EXCLUSIVE_LOCKS_REQUIRED(&mu_);
+    void BuildSubjectToken() ABSL_EXCLUSIVE_LOCKS_REQUIRED(&mu_);
+
+    void AddMetadataRequestHeaders(grpc_http_request* request);
+
+    AwsExternalAccountCredentials* creds_;
+    Timestamp deadline_;
+
+    Mutex mu_;
+    OrphanablePtr<FetchBody> fetch_body_ ABSL_GUARDED_BY(&mu_);
+
+    // Information required by request signer
+    std::string region_;
+    std::string role_name_;
+    std::string access_key_id_;
+    std::string secret_access_key_;
+    std::string token_;
+    std::string imdsv2_session_token_;
+  };
+
+  OrphanablePtr<FetchBody> RetrieveSubjectToken(
+      Timestamp deadline,
+      absl::AnyInvocable<void(absl::StatusOr<std::string>)> on_done) override;
 
   absl::string_view CredentialSourceType() override;
 
   std::string audience_;
-  OrphanablePtr<HttpRequest> http_request_;
 
   // Fields of credential source
   std::string region_url_;
@@ -85,19 +106,9 @@ class AwsExternalAccountCredentials final : public ExternalAccountCredentials {
   std::string regional_cred_verification_url_;
   std::string imdsv2_session_token_url_;
 
-  // Information required by request signer
-  std::string region_;
-  std::string role_name_;
-  std::string access_key_id_;
-  std::string secret_access_key_;
-  std::string token_;
-  std::string imdsv2_session_token_;
-
+  // These fields are set on the first fetch attempt and cached after that.
   std::unique_ptr<AwsRequestSigner> signer_;
   std::string cred_verification_url_;
-
-  HTTPRequestContext* ctx_ = nullptr;
-  std::function<void(std::string, grpc_error_handle)> cb_ = nullptr;
 };
 
 }  // namespace grpc_core