grpc 1.81.1 → 1.82.0.pre2

data/src/core/xds/grpc/xds_routing.h

@@ -101,7 +101,7 @@ class XdsRouting final {
         const XdsRouteConfigResource::VirtualHost& vhost,
         FilterChainBuilder& builder,
         absl::AnyInvocable<void(FilterChainBuilder&)> add_last_filter,
-        const Blackboard* old_blackboard, Blackboard* new_blackboard);
+        Blackboard& blackboard);
 
     // Builds a filter chain for a route that has an individual cluster
     // or a ClusterSpecifierPlugin.
@@ -125,8 +125,7 @@ class XdsRouting final {
     const XdsRouteConfigResource::VirtualHost& vhost_;
     FilterChainBuilder& builder_;
     absl::AnyInvocable<void(FilterChainBuilder&)> add_last_filter_;
-    const Blackboard* old_blackboard_;
-    Blackboard* new_blackboard_;
+    Blackboard& blackboard_;
 
     // Same size as hcm_filter_configs_.
     std::vector<const XdsHttpFilterImpl*> filter_impls_;

data/src/core/xds/xds_client/lrs_client.cc

@@ -62,10 +62,10 @@ namespace grpc_core {
 
 using ::grpc_event_engine::experimental::EventEngine;
 
-// TODO(roth): Remove this once the feature passes interop tests.
+// TODO(roth): Remove this after the 1.83 release.
 bool XdsOrcaLrsPropagationChangesEnabled() {
   auto value = GetEnv("GRPC_EXPERIMENTAL_XDS_ORCA_LRS_PROPAGATION");
-  if (!value.has_value()) return false;
+  if (!value.has_value()) return true;
   bool parsed_value;
   bool parse_succeeded = gpr_parse_bool_value(value->c_str(), &parsed_value);
   return parse_succeeded && parsed_value;

data/src/ruby/ext/grpc/rb_byte_buffer.c

@@ -23,6 +23,7 @@
 #include <grpc/byte_buffer_reader.h>
 #include <grpc/grpc.h>
 #include <grpc/slice.h>
+#include <stdbool.h>
 
 #include "rb_grpc.h"
 #include "rb_grpc_imports.generated.h"

data/src/ruby/ext/grpc/rb_call.c

@@ -23,8 +23,11 @@
 #include <grpc/grpc.h>
 #include <grpc/impl/codegen/compression_types.h>
 #include <grpc/support/alloc.h>
+#include <stdbool.h>
 
 #include "rb_byte_buffer.h"
+/* TODO(nnepal): Include grpc/grpc_security.h for pure ruby call
+ * credentials after rb_call_credentials gets removed */
 #include "rb_call_credentials.h"
 #include "rb_completion_queue.h"
 #include "rb_grpc.h"

data/src/ruby/ext/grpc/rb_call_credentials.c

@@ -26,6 +26,7 @@
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 #include <ruby/thread.h>
+#include <stdbool.h>
 
 #include "rb_call.h"
 #include "rb_event_thread.h"

data/src/ruby/ext/grpc/rb_channel.c

@@ -27,6 +27,7 @@
 #include <grpc/support/log.h>
 #include <grpc/support/time.h>
 #include <ruby/thread.h>
+#include <stdbool.h>
 
 #include "rb_byte_buffer.h"
 #include "rb_call.h"

data/src/ruby/ext/grpc/rb_channel_args.c

@@ -23,6 +23,7 @@
 #include <grpc/grpc.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/string_util.h>
+#include <stdbool.h>
 
 #include "rb_grpc.h"
 #include "rb_grpc_imports.generated.h"

data/src/ruby/ext/grpc/rb_channel_credentials.c

@@ -24,6 +24,7 @@
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/alloc.h>
+#include <stdbool.h>
 #include <string.h>
 
 #include "rb_call_credentials.h"

data/src/ruby/ext/grpc/rb_completion_queue.c

@@ -24,6 +24,7 @@
 #include <grpc/support/log.h>
 #include <grpc/support/time.h>
 #include <ruby/thread.h>
+#include <stdbool.h>
 
 #include "rb_grpc.h"
 #include "rb_grpc_imports.generated.h"

data/src/ruby/ext/grpc/rb_compression_options.c

@@ -26,6 +26,7 @@
 #include <grpc/impl/grpc_types.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/string_util.h>
+#include <stdbool.h>
 #include <string.h>
 
 #include "rb_byte_buffer.h"

data/src/ruby/ext/grpc/rb_grpc_imports.generated.c

@@ -159,9 +159,9 @@ grpc_server_register_method_type grpc_server_register_method_import;
 grpc_server_request_registered_call_type grpc_server_request_registered_call_import;
 grpc_server_create_type grpc_server_create_import;
 grpc_server_register_completion_queue_type grpc_server_register_completion_queue_import;
+grpc_server_config_fetcher_arg_vtable_type grpc_server_config_fetcher_arg_vtable_import;
 grpc_server_config_fetcher_xds_create_type grpc_server_config_fetcher_xds_create_import;
-grpc_server_config_fetcher_destroy_type grpc_server_config_fetcher_destroy_import;
-grpc_server_set_config_fetcher_type grpc_server_set_config_fetcher_import;
+grpc_server_config_fetcher_unref_type grpc_server_config_fetcher_unref_import;
 grpc_server_add_http2_port_type grpc_server_add_http2_port_import;
 grpc_server_start_type grpc_server_start_import;
 grpc_server_shutdown_and_notify_type grpc_server_shutdown_and_notify_import;
@@ -448,9 +448,9 @@ void grpc_rb_load_imports(HMODULE library) {
   grpc_server_request_registered_call_import = (grpc_server_request_registered_call_type) GetProcAddress(library, "grpc_server_request_registered_call");
   grpc_server_create_import = (grpc_server_create_type) GetProcAddress(library, "grpc_server_create");
   grpc_server_register_completion_queue_import = (grpc_server_register_completion_queue_type) GetProcAddress(library, "grpc_server_register_completion_queue");
+  grpc_server_config_fetcher_arg_vtable_import = (grpc_server_config_fetcher_arg_vtable_type) GetProcAddress(library, "grpc_server_config_fetcher_arg_vtable");
   grpc_server_config_fetcher_xds_create_import = (grpc_server_config_fetcher_xds_create_type) GetProcAddress(library, "grpc_server_config_fetcher_xds_create");
-  grpc_server_config_fetcher_destroy_import = (grpc_server_config_fetcher_destroy_type) GetProcAddress(library, "grpc_server_config_fetcher_destroy");
-  grpc_server_set_config_fetcher_import = (grpc_server_set_config_fetcher_type) GetProcAddress(library, "grpc_server_set_config_fetcher");
+  grpc_server_config_fetcher_unref_import = (grpc_server_config_fetcher_unref_type) GetProcAddress(library, "grpc_server_config_fetcher_unref");
   grpc_server_add_http2_port_import = (grpc_server_add_http2_port_type) GetProcAddress(library, "grpc_server_add_http2_port");
   grpc_server_start_import = (grpc_server_start_type) GetProcAddress(library, "grpc_server_start");
   grpc_server_shutdown_and_notify_import = (grpc_server_shutdown_and_notify_type) GetProcAddress(library, "grpc_server_shutdown_and_notify");

data/src/ruby/ext/grpc/rb_grpc_imports.generated.h

@@ -453,15 +453,15 @@ extern grpc_server_create_type grpc_server_create_import;
 typedef void(*grpc_server_register_completion_queue_type)(grpc_server* server, grpc_completion_queue* cq, void* reserved);
 extern grpc_server_register_completion_queue_type grpc_server_register_completion_queue_import;
 #define grpc_server_register_completion_queue grpc_server_register_completion_queue_import
+typedef const grpc_arg_pointer_vtable*(*grpc_server_config_fetcher_arg_vtable_type)(void);
+extern grpc_server_config_fetcher_arg_vtable_type grpc_server_config_fetcher_arg_vtable_import;
+#define grpc_server_config_fetcher_arg_vtable grpc_server_config_fetcher_arg_vtable_import
 typedef grpc_server_config_fetcher*(*grpc_server_config_fetcher_xds_create_type)(grpc_server_xds_status_notifier notifier, const grpc_channel_args* args);
 extern grpc_server_config_fetcher_xds_create_type grpc_server_config_fetcher_xds_create_import;
 #define grpc_server_config_fetcher_xds_create grpc_server_config_fetcher_xds_create_import
-typedef void(*grpc_server_config_fetcher_destroy_type)(grpc_server_config_fetcher* config_fetcher);
-extern grpc_server_config_fetcher_destroy_type grpc_server_config_fetcher_destroy_import;
-#define grpc_server_config_fetcher_destroy grpc_server_config_fetcher_destroy_import
-typedef void(*grpc_server_set_config_fetcher_type)(grpc_server* server, grpc_server_config_fetcher* config_fetcher);
-extern grpc_server_set_config_fetcher_type grpc_server_set_config_fetcher_import;
-#define grpc_server_set_config_fetcher grpc_server_set_config_fetcher_import
+typedef void(*grpc_server_config_fetcher_unref_type)(grpc_server_config_fetcher* config_fetcher);
+extern grpc_server_config_fetcher_unref_type grpc_server_config_fetcher_unref_import;
+#define grpc_server_config_fetcher_unref grpc_server_config_fetcher_unref_import
 typedef int(*grpc_server_add_http2_port_type)(grpc_server* server, const char* addr, grpc_server_credentials* creds);
 extern grpc_server_add_http2_port_type grpc_server_add_http2_port_import;
 #define grpc_server_add_http2_port grpc_server_add_http2_port_import

data/src/ruby/ext/grpc/rb_server.c

@@ -25,6 +25,7 @@
 #include <grpc/grpc_security.h>
 #include <grpc/support/atm.h>
 #include <grpc/support/log.h>
+#include <stdbool.h>
 
 #include "rb_byte_buffer.h"
 #include "rb_call.h"

data/src/ruby/ext/grpc/rb_server_credentials.c

@@ -23,6 +23,7 @@
 #include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
+#include <stdbool.h>
 
 #include "rb_grpc.h"
 #include "rb_grpc_imports.generated.h"

data/src/ruby/ext/grpc/rb_xds_channel_credentials.c

@@ -24,6 +24,7 @@
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/alloc.h>
+#include <stdbool.h>
 #include <string.h>
 
 #include "rb_call_credentials.h"

data/src/ruby/ext/grpc/rb_xds_server_credentials.c

@@ -23,6 +23,7 @@
 #include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
+#include <stdbool.h>
 
 #include "rb_grpc.h"
 #include "rb_grpc_imports.generated.h"

data/src/ruby/lib/grpc/core/call_credentials.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+# Copyright 2026 gRPC authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module GRPC
+  module Core
+    # CallCredentials represents per-call credentials.
+    class CallCredentials
+      attr_reader :auth_proc
+
+      def initialize(auth_proc = nil, &block)
+        @auth_proc = auth_proc || block
+        fail TypeError, 'Argument to CallCredentials#new must be a proc' unless @auth_proc.is_a?(Proc)
+      end
+
+      def get_metadata(context)
+        @auth_proc.call(context)
+      end
+
+      def composite?
+        false
+      end
+
+      def compose(*others)
+        return self if others.empty?
+        valid_others = validate_credentials_list!(others)
+        CompositeCallCredentials.new([self] + valid_others)
+      end
+
+      private
+
+      def validate_credentials_list!(list)
+        list.flatten.each do |o|
+          fail TypeError, "Argument to compose must be a CallCredentials, got #{o.class}" \
+            unless o.is_a?(CallCredentials)
+        end
+      end
+    end
+
+    class CompositeCallCredentials < CallCredentials
+      def initialize(*creds)
+        flat_creds = creds.flatten.flat_map do |c|
+          c.composite? ? c.creds : c
+        end
+        @creds = flat_creds.uniq
+        super(proc { |context| get_metadata(context) })
+      end
+
+      def composite?
+        true
+      end
+
+      def get_metadata(context)
+        @creds.each_with_object({}) do |c, metadata|
+          creds_metadata = c.get_metadata(context)
+          next unless creds_metadata
+          metadata.merge!(
+            creds_metadata.is_a?(Hash) ? creds_metadata : fail(TypeError, "Call credentials must return Hash or nil, got #{creds_metadata.class}")
+          )
+        end
+      end
+
+      def compose(*others)
+        return self if others.empty?
+        valid_others = validate_credentials_list!(others)
+        CompositeCallCredentials.new(@creds + valid_others)
+      end
+
+      protected
+
+      attr_reader :creds
+    end
+  end
+end

data/src/ruby/lib/grpc/core/channel_credentials.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+# Copyright 2026 gRPC authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module GRPC
+  module Core
+    # Provides shared #compose logic for channel credential classes.
+    # @api private
+    module ChannelCredentialsComposable
+      def compose(*others)
+        return self if others.empty?
+        flat_others = others.flatten
+
+        flat_others.each do |o|
+          fail TypeError, "Argument to compose must be a CallCredentials, got #{o.class}" \
+            unless o.is_a?(CallCredentials)
+        end
+
+        call_creds = flat_others.size == 1 ? flat_others.first : CompositeCallCredentials.new(flat_others)
+        CompositeChannelCredentials.new(self, call_creds)
+      end
+    end
+
+    class ChannelCredentials
+      prepend ChannelCredentialsComposable
+    end
+
+    class XdsChannelCredentials
+      prepend ChannelCredentialsComposable
+    end
+
+    class CompositeChannelCredentials
+      attr_reader :channel_credentials, :call_credentials
+
+      def initialize(channel_creds, call_creds)
+        @channel_credentials = channel_creds
+        @call_credentials = call_creds
+      end
+
+      def compose(*others)
+        return self if others.empty?
+        flat_others = others.flatten
+
+        flat_others.each do |o|
+          fail TypeError, "Argument to compose must be a CallCredentials, got #{o.class}" \
+            unless o.is_a?(CallCredentials)
+        end
+
+        if @call_credentials
+          CompositeChannelCredentials.new(@channel_credentials, @call_credentials.compose(*flat_others))
+        else
+          CompositeChannelCredentials.new(@channel_credentials, CompositeCallCredentials.new(flat_others))
+        end
+      end
+    end
+  end
+end

data/src/ruby/lib/grpc/core/credentials_helper.rb

@@ -0,0 +1,126 @@
+# Copyright 2026 gRPC authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module GRPC
+  module Core
+    # Utility methods for resolving and applying call credentials to metadata.
+    # @api private
+    module CallCredentialsHelper
+      VALID_HEADER_KEY_PATTERN = /\A[a-z0-9\-_.]+\z/
+
+      # Composes channel and per-call credentials when both present, otherwise
+      # returns whichever is available.
+      def self.resolve(channel_call_creds, call_credentials)
+        return channel_call_creds.compose(call_credentials) if channel_call_creds && call_credentials
+        channel_call_creds || call_credentials
+      end
+
+      # Returns true if +key+ is a valid gRPC metadata header key.
+      def self.valid_header_key?(key)
+        !key.nil? && !key.empty? && VALID_HEADER_KEY_PATTERN.match?(key)
+      end
+
+      # Parses an RPC method path into [service_url, method_name].
+      # e.g. '/echo.EchoServer/Echo' on 'foo.test.google.fr' gives
+      # ['https://foo.test.google.fr/echo.EchoServer', 'Echo'].
+      def self.parse_method_info(ssl_target, method)
+        return ["https://#{ssl_target}", nil] if method.nil? || method.empty?
+        last_slash = method.rindex('/')
+        service_path = last_slash&.positive? ? method[0, last_slash] : ''
+        [
+          "https://#{ssl_target}#{service_path}",
+          last_slash ? method[(last_slash + 1)..] : nil
+        ]
+      end
+
+      # Merges +creds_metadata+ into +metadata+, validating all keys.
+      # Raises GRPC::Unavailable on invalid type or illegal header keys.
+      def self.merge_creds_metadata!(creds_metadata, metadata)
+        return if creds_metadata.nil?
+        unless creds_metadata.is_a?(Hash)
+          fail GRPC::Unavailable, "Call credentials must return Hash or nil, got #{creds_metadata.class}"
+        end
+        creds_metadata.each do |key, value|
+          key_str = key.to_s
+          unless valid_header_key?(key_str)
+            fail GRPC::Unavailable, "Illegal metadata: '#{key_str}' is an invalid header key"
+          end
+          metadata[key_str] = value.is_a?(Array) ? value.map(&:to_s) : value.to_s
+        end
+      end
+
+      # Calls +credentials.get_metadata+ and merges the result into +metadata+.
+      # No-op when +credentials+ is nil or the channel is insecure.
+      # Raises GRPC::Unavailable on failure.
+      def self.apply(credentials, metadata, ssl_target, channel_creds, method = nil)
+        return unless credentials
+        return if channel_creds == :this_channel_is_insecure
+        service_url, method_name = parse_method_info(ssl_target, method)
+        context = { service_url: service_url, jwt_aud_uri: service_url, method_name: method_name }
+        begin
+          merge_creds_metadata!(credentials.get_metadata(context), metadata)
+        rescue GRPC::BadStatus
+          raise
+        rescue StandardError => e
+          fail GRPC::Unavailable, "Call credentials failed: #{e.message}"
+        end
+      end
+    end
+
+    # Prepended into ClientStub when the pure Ruby credentials path is active.
+    # Handles CompositeChannelCredentials splitting and applies credentials via
+    # metadata injection instead of the C extension set_credentials! path.
+    # @api private
+    module CompositeCredentialsHandler
+      def initialize(host, creds,
+                     channel_override: nil,
+                     timeout: nil,
+                     propagate_mask: nil,
+                     channel_args: {},
+                     interceptors: [])
+        if creds.is_a?(Core::CompositeChannelCredentials)
+          pure_call_creds = creds.call_credentials
+          creds = creds.channel_credentials
+          super(host, creds,
+                channel_override: channel_override,
+                timeout: timeout,
+                propagate_mask: propagate_mask,
+                channel_args: channel_args,
+                interceptors: interceptors)
+          @call_creds = pure_call_creds
+        else
+          super
+        end
+      end
+
+      # credentials is intentionally overridden to nil in super to skip set_credentials!
+      def new_active_call(method, marshal, unmarshal,
+                          deadline: nil,
+                          parent: nil,
+                          credentials: nil) # rubocop:disable Lint/UnusedMethodArgument
+        super(method, marshal, unmarshal,
+              deadline: deadline,
+              parent: parent,
+              credentials: nil)
+      end
+
+      private
+
+      def resolve_call_metadata(metadata, credentials, method)
+        resolved = CallCredentialsHelper.resolve(@call_creds, credentials)
+        metadata.dup.tap { |m| CallCredentialsHelper.apply(resolved, m, @host, @channel_creds, method) }
+      end
+    end
+  end
+end