grpc 1.70.1 → 1.72.0

data/src/core/client_channel/subchannel_stream_client.cc

@@ -130,7 +130,7 @@ void SubchannelStreamClient::StartRetryTimerLocked() {
   const Duration timeout = retry_backoff_.NextAttemptDelay();
   if (GPR_UNLIKELY(tracer_ != nullptr)) {
     LOG(INFO) << tracer_ << " " << this
-              << ": SubchannelStreamClient health check call lost...";
+              << ": SubchannelStreamClient call lost...";
     if (timeout > Duration::Zero()) {
       LOG(INFO) << tracer_ << " " << this << ": ... will retry in "
                 << timeout.millis() << "ms.";
@@ -139,11 +139,10 @@ void SubchannelStreamClient::StartRetryTimerLocked() {
     }
   }
   retry_timer_handle_ = event_engine_->RunAfter(
-      timeout, [self = Ref(DEBUG_LOCATION, "health_retry_timer")]() mutable {
-        ApplicationCallbackExecCtx callback_exec_ctx;
+      timeout, [self = Ref(DEBUG_LOCATION, "retry_timer")]() mutable {
         ExecCtx exec_ctx;
         self->OnRetryTimer();
-        self.reset(DEBUG_LOCATION, "health_retry_timer");
+        self.reset(DEBUG_LOCATION, "retry_timer");
       });
 }
 
@@ -153,7 +152,7 @@ void SubchannelStreamClient::OnRetryTimer() {
       call_state_ == nullptr) {
     if (GPR_UNLIKELY(tracer_ != nullptr)) {
       LOG(INFO) << tracer_ << " " << this
-                << ": SubchannelStreamClient restarting health check call";
+                << ": SubchannelStreamClient restarting call";
     }
     StartCallLocked();
   }
@@ -165,9 +164,9 @@ void SubchannelStreamClient::OnRetryTimer() {
 //
 
 SubchannelStreamClient::CallState::CallState(
-    RefCountedPtr<SubchannelStreamClient> health_check_client,
+    RefCountedPtr<SubchannelStreamClient> subchannel_stream_client,
     grpc_pollset_set* interested_parties)
-    : subchannel_stream_client_(std::move(health_check_client)),
+    : subchannel_stream_client_(std::move(subchannel_stream_client)),
       pollent_(grpc_polling_entity_create_from_pollset_set(interested_parties)),
       arena_(subchannel_stream_client_->call_allocator_->MakeArena()) {}
 
@@ -193,7 +192,6 @@ void SubchannelStreamClient::CallState::StartCallLocked() {
   SubchannelCall::Args args = {
       subchannel_stream_client_->connected_subchannel_,
       &pollent_,
-      Slice::FromStaticString("/grpc.health.v1.Health/Watch"),
       gpr_get_cycle_counter(),  // start_time
       Timestamp::InfFuture(),   // deadline
       arena_.get(),
@@ -300,7 +298,7 @@ void SubchannelStreamClient::CallState::AfterCallStackDestruction(
 void SubchannelStreamClient::CallState::OnCancelComplete(
     void* arg, grpc_error_handle /*error*/) {
   auto* self = static_cast<SubchannelStreamClient::CallState*>(arg);
-  GRPC_CALL_COMBINER_STOP(&self->call_combiner_, "health_cancel");
+  GRPC_CALL_COMBINER_STOP(&self->call_combiner_, "cancel_batch");
   self->call_->Unref(DEBUG_LOCATION, "cancel");
 }
 
@@ -323,7 +321,7 @@ void SubchannelStreamClient::CallState::Cancel() {
     GRPC_CALL_COMBINER_START(
         &call_combiner_,
         GRPC_CLOSURE_CREATE(StartCancel, this, grpc_schedule_on_exec_ctx),
-        absl::OkStatus(), "health_cancel");
+        absl::OkStatus(), "cancel_batch");
   }
 }
 
@@ -407,18 +405,22 @@ void SubchannelStreamClient::CallState::RecvTrailingMetadataReady(
     LOG(INFO) << self->subchannel_stream_client_->tracer_ << " "
               << self->subchannel_stream_client_.get()
               << ": SubchannelStreamClient CallState " << self
-              << ": health watch failed with status " << status;
+              << ": call failed with status " << status;
   }
   // Clean up.
   self->recv_trailing_metadata_.Clear();
   // Report call end.
+  // Note: We hold a ref to the SubchannelStreamClient here to ensure
+  // that it lives long enough for us to release the mutex, since the
+  // call to CallEndedLocked() may release the last ref.
+  auto subchannel_stream_client = self->subchannel_stream_client_->Ref();
   MutexLock lock(&self->subchannel_stream_client_->mu_);
   if (self->subchannel_stream_client_->event_handler_ != nullptr) {
     self->subchannel_stream_client_->event_handler_
         ->RecvTrailingMetadataReadyLocked(self->subchannel_stream_client_.get(),
                                           status);
   }
-  // For status UNIMPLEMENTED, give up and assume always healthy.
+  // For status UNIMPLEMENTED, give up.
   self->CallEndedLocked(/*retry=*/status != GRPC_STATUS_UNIMPLEMENTED);
 }
 

data/src/core/client_channel/subchannel_stream_client.h

@@ -25,11 +25,12 @@
 
 #include <atomic>
 #include <memory>
+#include <optional>
 
 #include "absl/base/thread_annotations.h"
 #include "absl/status/status.h"
 #include "absl/strings/string_view.h"
-#include "absl/types/optional.h"
+#include "src/core/call/metadata_batch.h"
 #include "src/core/client_channel/subchannel.h"
 #include "src/core/lib/iomgr/call_combiner.h"
 #include "src/core/lib/iomgr/closure.h"
@@ -40,7 +41,6 @@
 #include "src/core/lib/resource_quota/memory_quota.h"
 #include "src/core/lib/slice/slice.h"
 #include "src/core/lib/slice/slice_buffer.h"
-#include "src/core/lib/transport/metadata_batch.h"
 #include "src/core/lib/transport/transport.h"
 #include "src/core/util/backoff.h"
 #include "src/core/util/orphanable.h"
@@ -172,7 +172,7 @@ class SubchannelStreamClient final
     grpc_closure recv_initial_metadata_ready_;
 
     // recv_message
-    absl::optional<SliceBuffer> recv_message_;
+    std::optional<SliceBuffer> recv_message_;
     grpc_closure recv_message_ready_;
     std::atomic<bool> seen_response_{false};
 
@@ -202,13 +202,13 @@ class SubchannelStreamClient final
   Mutex mu_;
   std::unique_ptr<CallEventHandler> event_handler_ ABSL_GUARDED_BY(mu_);
 
-  // The data associated with the current health check call.  It holds a ref
+  // The data associated with the current call.  It holds a ref
   // to this SubchannelStreamClient object.
   OrphanablePtr<CallState> call_state_ ABSL_GUARDED_BY(mu_);
 
   // Call retry state.
   BackOff retry_backoff_ ABSL_GUARDED_BY(mu_);
-  absl::optional<grpc_event_engine::experimental::EventEngine::TaskHandle>
+  std::optional<grpc_event_engine::experimental::EventEngine::TaskHandle>
       retry_timer_handle_ ABSL_GUARDED_BY(mu_);
   // A raw pointer will suffice since connected_subchannel_ holds a copy of the
   // ChannelArgs which holds an std::shared_ptr of the EventEngine.

data/src/core/config/config_vars.cc

@@ -22,6 +22,7 @@
 
 #include "absl/flags/flag.h"
 #include "absl/strings/escaping.h"
+#include "absl/types/optional.h"
 #include "src/core/config/load_config.h"
 
 #ifndef GPR_DEFAULT_LOG_VERBOSITY_STRING

data/src/core/config/config_vars.h

@@ -23,6 +23,7 @@
 #include <stdint.h>
 
 #include <atomic>
+#include <optional>
 #include <string>
 
 #include "absl/strings/string_view.h"

data/src/core/config/core_configuration.h

@@ -21,11 +21,11 @@
 
 #include "absl/functional/any_invocable.h"
 #include "absl/log/check.h"
+#include "src/core/credentials/transport/channel_creds_registry.h"
+#include "src/core/credentials/transport/tls/certificate_provider_registry.h"
 #include "src/core/handshaker/handshaker_registry.h"
 #include "src/core/handshaker/proxy_mapper_registry.h"
 #include "src/core/lib/channel/channel_args_preconditioning.h"
-#include "src/core/lib/security/certificate_provider/certificate_provider_registry.h"
-#include "src/core/lib/security/credentials/channel_creds_registry.h"
 #include "src/core/lib/surface/channel_init.h"
 #include "src/core/load_balancing/lb_policy_registry.h"
 #include "src/core/resolver/resolver_registry.h"

data/src/core/config/load_config.cc

@@ -17,17 +17,18 @@
 #include <grpc/support/port_platform.h>
 #include <stdio.h>
 
+#include <optional>
+
 #include "absl/flags/marshalling.h"
 #include "absl/log/check.h"
 #include "absl/strings/numbers.h"
 #include "absl/strings/str_join.h"
-#include "absl/types/optional.h"
 #include "src/core/util/env.h"
 
 namespace grpc_core {
 
 namespace {
-absl::optional<std::string> LoadEnv(absl::string_view environment_variable) {
+std::optional<std::string> LoadEnv(absl::string_view environment_variable) {
   return GetEnv(std::string(environment_variable).c_str());
 }
 }  // namespace

data/src/core/config/load_config.h

@@ -18,12 +18,12 @@
 #include <grpc/support/port_platform.h>
 #include <stdint.h>
 
+#include <optional>
 #include <string>
 #include <vector>
 
 #include "absl/flags/flag.h"
 #include "absl/strings/string_view.h"
-#include "absl/types/optional.h"
 
 namespace grpc_core {
 

data/src/core/credentials/call/call_credentials.h

@@ -0,0 +1,157 @@
+//
+// Copyright 2015 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#ifndef GRPC_SRC_CORE_CREDENTIALS_CALL_CALL_CREDENTIALS_H
+#define GRPC_SRC_CORE_CREDENTIALS_CALL_CALL_CREDENTIALS_H
+
+#include <grpc/credentials.h>
+#include <grpc/grpc.h>
+#include <grpc/grpc_security.h>
+#include <grpc/grpc_security_constants.h>
+#include <grpc/impl/grpc_types.h>
+#include <grpc/support/port_platform.h>
+
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "absl/log/check.h"
+#include "absl/status/statusor.h"
+#include "absl/strings/string_view.h"
+#include "src/core/credentials/transport/security_connector.h"
+#include "src/core/lib/channel/channel_args.h"
+#include "src/core/lib/promise/arena_promise.h"
+#include "src/core/lib/slice/slice.h"
+#include "src/core/lib/transport/transport.h"
+#include "src/core/transport/auth_context.h"
+#include "src/core/util/crash.h"
+#include "src/core/util/ref_counted.h"
+#include "src/core/util/ref_counted_ptr.h"
+#include "src/core/util/unique_type_name.h"
+
+// --- Constants. ---
+
+typedef enum {
+  GRPC_CREDENTIALS_OK = 0,
+  GRPC_CREDENTIALS_ERROR
+} grpc_credentials_status;
+
+#define GRPC_AUTHORIZATION_METADATA_KEY "authorization"
+#define GRPC_IAM_AUTHORIZATION_TOKEN_METADATA_KEY \
+  "x-goog-iam-authorization-token"
+#define GRPC_IAM_AUTHORITY_SELECTOR_METADATA_KEY "x-goog-iam-authority-selector"
+
+#define GRPC_SECURE_TOKEN_REFRESH_THRESHOLD_SECS 60
+
+#define GRPC_COMPUTE_ENGINE_METADATA_HOST "metadata.google.internal."
+#define GRPC_COMPUTE_ENGINE_METADATA_TOKEN_PATH \
+  "/computeMetadata/v1/instance/service-accounts/default/token"
+
+#define GRPC_GOOGLE_OAUTH2_SERVICE_HOST "oauth2.googleapis.com"
+#define GRPC_GOOGLE_OAUTH2_SERVICE_TOKEN_PATH "/token"
+
+#define GRPC_SERVICE_ACCOUNT_POST_BODY_PREFIX                         \
+  "grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&" \
+  "assertion="
+
+#define GRPC_REFRESH_TOKEN_POST_BODY_FORMAT_STRING \
+  "client_id=%s&client_secret=%s&refresh_token=%s&grant_type=refresh_token"
+
+// --- Google utils ---
+
+// It is the caller's responsibility to gpr_free the result if not NULL.
+std::string grpc_get_well_known_google_credentials_file_path(void);
+
+// Implementation function for the different platforms.
+std::string grpc_get_well_known_google_credentials_file_path_impl(void);
+
+// Override for testing only. Not thread-safe
+typedef std::string (*grpc_well_known_credentials_path_getter)(void);
+void grpc_override_well_known_credentials_path_getter(
+    grpc_well_known_credentials_path_getter getter);
+
+// --- grpc_core::CredentialsMetadataArray. ---
+
+namespace grpc_core {
+using CredentialsMetadataArray = std::vector<std::pair<Slice, Slice>>;
+}
+
+// --- grpc_call_credentials. ---
+
+// This type is forward declared as a C struct and we cannot define it as a
+// class. Otherwise, compiler will complain about type mismatch due to
+// -Wmismatched-tags.
+struct grpc_call_credentials
+    : public grpc_core::DualRefCounted<grpc_call_credentials> {
+ public:
+  // TODO(roth): Consider whether security connector actually needs to
+  // be part of this interface.  Currently, it is here only for the
+  // url_scheme() method, which we might be able to instead add as an
+  // auth context property.
+  struct GetRequestMetadataArgs {
+    grpc_core::RefCountedPtr<grpc_channel_security_connector>
+        security_connector;
+    grpc_core::RefCountedPtr<grpc_auth_context> auth_context;
+  };
+
+  // The pointer value \a type is used to uniquely identify a creds
+  // implementation for down-casting purposes. Every creds implementation should
+  // use a unique string instance, which should be returned by all instances of
+  // that creds implementation.
+  explicit grpc_call_credentials(
+      grpc_security_level min_security_level = GRPC_PRIVACY_AND_INTEGRITY)
+      : min_security_level_(min_security_level) {}
+
+  ~grpc_call_credentials() override = default;
+
+  virtual grpc_core::ArenaPromise<
+      absl::StatusOr<grpc_core::ClientMetadataHandle>>
+  GetRequestMetadata(grpc_core::ClientMetadataHandle initial_metadata,
+                     const GetRequestMetadataArgs* args) = 0;
+
+  virtual grpc_security_level min_security_level() const {
+    return min_security_level_;
+  }
+
+  // Compares this grpc_call_credentials object with \a other.
+  // If this method returns 0, it means that gRPC can treat the two call
+  // credentials as effectively the same..
+  int cmp(const grpc_call_credentials* other) const {
+    CHECK_NE(other, nullptr);
+    int r = type().Compare(other->type());
+    if (r != 0) return r;
+    return cmp_impl(other);
+  }
+
+  virtual std::string debug_string() {
+    return "grpc_call_credentials did not provide debug string";
+  }
+
+  // The pointer value \a type is used to uniquely identify a creds
+  // implementation for down-casting purposes. Every creds implementation should
+  // use a unique string instance, which should be returned by all instances of
+  // that creds implementation.
+  virtual grpc_core::UniqueTypeName type() const = 0;
+
+ private:
+  // Implementation for `cmp` method intended to be overridden by subclasses.
+  // Only invoked if `type()` and `other->type()` point to the same string.
+  virtual int cmp_impl(const grpc_call_credentials* other) const = 0;
+
+  const grpc_security_level min_security_level_;
+};
+
+#endif  // GRPC_SRC_CORE_CREDENTIALS_CALL_CALL_CREDENTIALS_H

data/src/core/{lib/security/credentials → credentials/call}/call_creds_util.cc

@@ -14,7 +14,7 @@
 // limitations under the License.
 //
 
-#include "src/core/lib/security/credentials/call_creds_util.h"
+#include "src/core/credentials/call/call_creds_util.h"
 
 #include <grpc/support/port_platform.h>
 #include <grpc/support/string_util.h>
@@ -24,9 +24,9 @@
 #include "absl/log/log.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"
-#include "src/core/lib/security/context/security_context.h"
-#include "src/core/lib/security/security_connector/security_connector.h"
-#include "src/core/lib/transport/metadata_batch.h"
+#include "src/core/call/metadata_batch.h"
+#include "src/core/credentials/transport/security_connector.h"
+#include "src/core/transport/auth_context.h"
 #include "src/core/util/ref_counted_ptr.h"
 
 namespace grpc_core {

data/src/core/{lib/security/credentials → credentials/call}/call_creds_util.h

@@ -14,8 +14,8 @@
 // limitations under the License.
 //
 
-#ifndef GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_CALL_CREDS_UTIL_H
-#define GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_CALL_CREDS_UTIL_H
+#ifndef GRPC_SRC_CORE_CREDENTIALS_CALL_CALL_CREDS_UTIL_H
+#define GRPC_SRC_CORE_CREDENTIALS_CALL_CALL_CREDS_UTIL_H
 
 #include <grpc/credentials.h>
 #include <grpc/grpc_security.h>
@@ -23,7 +23,7 @@
 
 #include <string>
 
-#include "src/core/lib/security/credentials/credentials.h"
+#include "src/core/credentials/call/call_credentials.h"
 #include "src/core/lib/transport/transport.h"
 
 namespace grpc_core {
@@ -40,4 +40,4 @@ grpc_auth_metadata_context MakePluginAuthMetadataContext(
 
 }  // namespace grpc_core
 
-#endif  // GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_CALL_CREDS_UTIL_H
+#endif  // GRPC_SRC_CORE_CREDENTIALS_CALL_CALL_CREDS_UTIL_H

data/src/core/{lib/security/credentials/composite/composite_credentials.cc → credentials/call/composite/composite_call_credentials.cc}

@@ -16,9 +16,7 @@
 //
 //
 
-#include "src/core/lib/security/credentials/composite/composite_credentials.h"
-
-#include <grpc/support/port_platform.h>
+#include "src/core/credentials/call/composite/composite_call_credentials.h"
 
 #include <cstring>
 #include <memory>
@@ -27,22 +25,11 @@
 #include "absl/log/check.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/str_join.h"
+#include "src/core/call/metadata_batch.h"
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/promise/try_seq.h"
-#include "src/core/lib/transport/metadata_batch.h"
 #include "src/core/util/ref_counted_ptr.h"
 
-//
-// grpc_composite_channel_credentials
-//
-
-grpc_core::UniqueTypeName grpc_composite_channel_credentials::Type() {
-  static grpc_core::UniqueTypeName::Factory kFactory("Composite");
-  return kFactory.Create();
-}
-
-// -- Composite call credentials. --
-
 grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientMetadataHandle>>
 grpc_composite_call_credentials::GetRequestMetadata(
     grpc_core::ClientMetadataHandle initial_metadata,
@@ -113,14 +100,6 @@ grpc_composite_call_credentials::grpc_composite_call_credentials(
   }
 }
 
-static grpc_core::RefCountedPtr<grpc_call_credentials>
-composite_call_credentials_create(
-    grpc_core::RefCountedPtr<grpc_call_credentials> creds1,
-    grpc_core::RefCountedPtr<grpc_call_credentials> creds2) {
-  return grpc_core::MakeRefCounted<grpc_composite_call_credentials>(
-      std::move(creds1), std::move(creds2));
-}
-
 grpc_call_credentials* grpc_composite_call_credentials_create(
     grpc_call_credentials* creds1, grpc_call_credentials* creds2,
     void* reserved) {
@@ -130,39 +109,7 @@ grpc_call_credentials* grpc_composite_call_credentials_create(
   CHECK_EQ(reserved, nullptr);
   CHECK_NE(creds1, nullptr);
   CHECK_NE(creds2, nullptr);
-
-  return composite_call_credentials_create(creds1->Ref(), creds2->Ref())
+  return grpc_core::MakeRefCounted<grpc_composite_call_credentials>(
+             creds1->Ref(), creds2->Ref())
       .release();
 }
-
-// -- Composite channel credentials. --
-
-grpc_core::RefCountedPtr<grpc_channel_security_connector>
-grpc_composite_channel_credentials::create_security_connector(
-    grpc_core::RefCountedPtr<grpc_call_credentials> call_creds,
-    const char* target, grpc_core::ChannelArgs* args) {
-  CHECK(inner_creds_ != nullptr);
-  CHECK(call_creds_ != nullptr);
-  // If we are passed a call_creds, create a call composite to pass it
-  // downstream.
-  if (call_creds != nullptr) {
-    return inner_creds_->create_security_connector(
-        composite_call_credentials_create(call_creds_, std::move(call_creds)),
-        target, args);
-  } else {
-    return inner_creds_->create_security_connector(call_creds_, target, args);
-  }
-}
-
-grpc_channel_credentials* grpc_composite_channel_credentials_create(
-    grpc_channel_credentials* channel_creds, grpc_call_credentials* call_creds,
-    void* reserved) {
-  CHECK(channel_creds != nullptr && call_creds != nullptr &&
-        reserved == nullptr);
-  GRPC_TRACE_LOG(api, INFO)
-      << "grpc_composite_channel_credentials_create(channel_creds="
-      << channel_creds << ", call_creds=" << call_creds
-      << ", reserved=" << reserved << ")";
-  return new grpc_composite_channel_credentials(channel_creds->Ref(),
-                                                call_creds->Ref());
-}

data/src/core/credentials/call/composite/composite_call_credentials.h

@@ -0,0 +1,82 @@
+//
+//
+// Copyright 2015 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#ifndef GRPC_SRC_CORE_CREDENTIALS_CALL_COMPOSITE_COMPOSITE_CALL_CREDENTIALS_H
+#define GRPC_SRC_CORE_CREDENTIALS_CALL_COMPOSITE_COMPOSITE_CALL_CREDENTIALS_H
+
+#include <grpc/credentials.h>
+#include <grpc/grpc.h>
+#include <grpc/grpc_security.h>
+#include <grpc/grpc_security_constants.h>
+
+#include <algorithm>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "absl/status/statusor.h"
+#include "src/core/credentials/call/call_credentials.h"
+#include "src/core/credentials/transport/security_connector.h"
+#include "src/core/lib/channel/channel_args.h"
+#include "src/core/lib/promise/arena_promise.h"
+#include "src/core/lib/transport/transport.h"
+#include "src/core/util/ref_counted_ptr.h"
+#include "src/core/util/unique_type_name.h"
+#include "src/core/util/useful.h"
+
+class grpc_composite_call_credentials : public grpc_call_credentials {
+ public:
+  using CallCredentialsList =
+      std::vector<grpc_core::RefCountedPtr<grpc_call_credentials>>;
+
+  grpc_composite_call_credentials(
+      grpc_core::RefCountedPtr<grpc_call_credentials> creds1,
+      grpc_core::RefCountedPtr<grpc_call_credentials> creds2);
+  ~grpc_composite_call_credentials() override = default;
+
+  void Orphaned() override { inner_.clear(); }
+
+  grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientMetadataHandle>>
+  GetRequestMetadata(grpc_core::ClientMetadataHandle initial_metadata,
+                     const GetRequestMetadataArgs* args) override;
+
+  grpc_security_level min_security_level() const override {
+    return min_security_level_;
+  }
+
+  const CallCredentialsList& inner() const { return inner_; }
+  std::string debug_string() override;
+
+  static grpc_core::UniqueTypeName Type();
+
+  grpc_core::UniqueTypeName type() const override { return Type(); }
+
+ private:
+  int cmp_impl(const grpc_call_credentials* other) const override {
+    // TODO(yashykt): Check if we can do something better here
+    return grpc_core::QsortCompare(
+        static_cast<const grpc_call_credentials*>(this), other);
+  }
+
+  void push_to_inner(grpc_core::RefCountedPtr<grpc_call_credentials> creds,
+                     bool is_composite);
+  grpc_security_level min_security_level_;
+  CallCredentialsList inner_;
+};
+
+#endif  // GRPC_SRC_CORE_CREDENTIALS_CALL_COMPOSITE_COMPOSITE_CALL_CREDENTIALS_H

data/src/core/{lib/security/credentials → credentials/call}/external/aws_external_account_credentials.cc

@@ -13,7 +13,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 //
-#include "src/core/lib/security/credentials/external/aws_external_account_credentials.h"
+#include "src/core/credentials/call/external/aws_external_account_credentials.h"
 
 #include <grpc/credentials.h>
 #include <grpc/grpc.h>
@@ -25,6 +25,7 @@
 #include <string.h>
 
 #include <map>
+#include <optional>
 #include <utility>
 
 #include "absl/log/check.h"
@@ -34,9 +35,8 @@
 #include "absl/strings/str_format.h"
 #include "absl/strings/str_replace.h"
 #include "absl/strings/string_view.h"
-#include "absl/types/optional.h"
+#include "src/core/credentials/transport/transport_credentials.h"
 #include "src/core/lib/iomgr/closure.h"
-#include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/util/env.h"
 #include "src/core/util/http_client/httpcli_ssl_credentials.h"
 #include "src/core/util/json/json.h"
@@ -110,7 +110,6 @@ void AwsExternalAccountCredentials::AwsFetchBody::AsyncFinish(
     absl::StatusOr<std::string> result) {
   creds_->event_engine().Run(
       [this, self = Ref(), result = std::move(result)]() mutable {
-        ApplicationCallbackExecCtx application_exec_ctx;
         ExecCtx exec_ctx;
         Finish(std::move(result));
         self.reset();

data/src/core/{lib/security/credentials → credentials/call}/external/aws_external_account_credentials.h

@@ -14,8 +14,8 @@
 // limitations under the License.
 //
 
-#ifndef GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_EXTERNAL_AWS_EXTERNAL_ACCOUNT_CREDENTIALS_H
-#define GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_EXTERNAL_AWS_EXTERNAL_ACCOUNT_CREDENTIALS_H
+#ifndef GRPC_SRC_CORE_CREDENTIALS_CALL_EXTERNAL_AWS_EXTERNAL_ACCOUNT_CREDENTIALS_H
+#define GRPC_SRC_CORE_CREDENTIALS_CALL_EXTERNAL_AWS_EXTERNAL_ACCOUNT_CREDENTIALS_H
 
 #include <grpc/support/port_platform.h>
 
@@ -25,9 +25,9 @@
 #include <vector>
 
 #include "absl/strings/string_view.h"
+#include "src/core/credentials/call/external/aws_request_signer.h"
+#include "src/core/credentials/call/external/external_account_credentials.h"
 #include "src/core/lib/iomgr/error.h"
-#include "src/core/lib/security/credentials/external/aws_request_signer.h"
-#include "src/core/lib/security/credentials/external/external_account_credentials.h"
 #include "src/core/util/http_client/httpcli.h"
 #include "src/core/util/http_client/parser.h"
 #include "src/core/util/orphanable.h"
@@ -114,4 +114,4 @@ class AwsExternalAccountCredentials final : public ExternalAccountCredentials {
 
 }  // namespace grpc_core
 
-#endif  // GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_EXTERNAL_AWS_EXTERNAL_ACCOUNT_CREDENTIALS_H
+#endif  // GRPC_SRC_CORE_CREDENTIALS_CALL_EXTERNAL_AWS_EXTERNAL_ACCOUNT_CREDENTIALS_H

data/src/core/{lib/security/credentials → credentials/call}/external/aws_request_signer.cc

@@ -13,7 +13,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 //
-#include "src/core/lib/security/credentials/external/aws_request_signer.h"
+#include "src/core/credentials/call/external/aws_request_signer.h"
 
 #include <grpc/support/port_platform.h>
 #include <openssl/crypto.h>