grpc 1.81.1 → 1.83.0

data/src/core/lib/iomgr/error_cfstream.cc

@@ -46,7 +46,6 @@ grpc_error_handle grpc_error_create_from_cferror(const char* file, int line,
       absl::StrFormat("%s (error domain:%s, code:%ld, description:%s)",
                       custom_desc, buf_domain, code, buf_desc);
   CFRelease(desc);
-  return StatusCreate(absl::StatusCode::kUnknown, error_msg,
-                      grpc_core::DebugLocation(file, line), {});
+  return absl::UnknownError(error_msg);
 }
 #endif  // GRPC_CFSTREAM

data/src/core/lib/iomgr/ev_epoll1_linux.cc

@@ -334,9 +334,7 @@ static void fork_fd_list_remove_grpc_fd(grpc_fd* fd) {
 
 static grpc_fd* fd_create(int fd, const char* name, bool track_err) {
   grpc_fd* new_fd = nullptr;
-  if (grpc_core::IsEventEngineForAllOtherEndpointsEnabled() &&
-      !grpc_event_engine::experimental::
-          EventEngineExperimentDisabledForPython()) {
+  if (grpc_core::IsEventEngineForAllOtherEndpointsEnabled()) {
     grpc_fd* new_fd = static_cast<grpc_fd*>(gpr_malloc(sizeof(grpc_fd)));
     new_fd->fd = fd;
     return new_fd;
@@ -418,9 +416,7 @@ static void fd_shutdown(grpc_fd* fd, grpc_error_handle why) {
 
 static void fd_orphan(grpc_fd* fd, grpc_closure* on_done, int* release_fd,
                       const char* reason) {
-  if (grpc_core::IsEventEngineForAllOtherEndpointsEnabled() &&
-      !grpc_event_engine::experimental::
-          EventEngineExperimentDisabledForPython()) {
+  if (grpc_core::IsEventEngineForAllOtherEndpointsEnabled()) {
     GRPC_CHECK_NE(release_fd, nullptr);
     GRPC_CHECK_EQ(on_done, nullptr);
     *release_fd = fd->fd;
@@ -672,7 +668,7 @@ static int poll_deadline_to_millis_timeout(grpc_core::Timestamp millis) {
 // - This function then processes up-to MAX_EPOLL_EVENTS_PER_ITERATION and
 //   updates the g_epoll_set.cursor
 
-// NOTE ON SYNCRHONIZATION: Similar to do_epoll_wait(), this function is only
+// NOTE ON SYNCHRONIZATION: Similar to do_epoll_wait(), this function is only
 // called by g_active_poller thread. So there is no need for synchronization
 // when accessing fields in g_epoll_set
 static grpc_error_handle process_epoll_events(grpc_pollset* /*pollset*/) {

data/src/core/lib/iomgr/ev_poll_posix.cc

@@ -379,9 +379,7 @@ static void unref_by(grpc_fd* fd, int n) {
 }
 
 static grpc_fd* fd_create(int fd, const char* name, bool track_err) {
-  if (grpc_core::IsEventEngineForAllOtherEndpointsEnabled() &&
-      !grpc_event_engine::experimental::
-          EventEngineExperimentDisabledForPython()) {
+  if (grpc_core::IsEventEngineForAllOtherEndpointsEnabled()) {
     GRPC_TRACE_LOG(event_engine, ERROR)
         << "Creating a wrapped EventEngine grpc_fd with fd:" << fd;
     grpc_fd* new_fd = static_cast<grpc_fd*>(gpr_malloc(sizeof(grpc_fd)));
@@ -480,9 +478,7 @@ static int fd_wrapped_fd(grpc_fd* fd) {
 
 static void fd_orphan(grpc_fd* fd, grpc_closure* on_done, int* release_fd,
                       const char* reason) {
-  if (grpc_core::IsEventEngineForAllOtherEndpointsEnabled() &&
-      !grpc_event_engine::experimental::
-          EventEngineExperimentDisabledForPython()) {
+  if (grpc_core::IsEventEngineForAllOtherEndpointsEnabled()) {
     GRPC_CHECK_NE(release_fd, nullptr);
     GRPC_CHECK_EQ(on_done, nullptr);
     *release_fd = fd->fd;

data/src/core/lib/iomgr/event_engine_shims/endpoint.cc

@@ -212,7 +212,7 @@ class EventEngineEndpointWrapper {
         kShutdownBit + 1) {
       auto* supports_fd =
           QueryExtension<EndpointSupportsFdExtension>(endpoint_.get());
-      if (supports_fd != nullptr && fd_ > 0 && on_release_fd_) {
+      if (supports_fd != nullptr && fd_ >= 0 && on_release_fd_) {
         supports_fd->Shutdown(std::move(on_release_fd_));
       }
       OnShutdownInternal();
@@ -241,7 +241,7 @@ class EventEngineEndpointWrapper {
         Ref();
         if (shutdown_ref_.fetch_sub(1, std::memory_order_acq_rel) ==
             kShutdownBit + 1) {
-          if (supports_fd != nullptr && fd_ > 0 && on_release_fd_) {
+          if (supports_fd != nullptr && fd_ >= 0 && on_release_fd_) {
             supports_fd->Shutdown(std::move(on_release_fd_));
           }
           OnShutdownInternal();

data/src/core/lib/iomgr/tcp_posix.cc

@@ -971,13 +971,14 @@ static bool tcp_do_read(grpc_tcp* tcp, grpc_error_handle* error)
     }
 
     if (read_bytes <= 0) {
+      int saved_errno = errno;
       // 0 read size ==> end of stream
       grpc_slice_buffer_reset_and_unref(tcp->incoming_buffer);
       if (read_bytes == 0) {
         *error = tcp_annotate_error(absl::InternalError("Socket closed"));
       } else {
         *error = tcp_annotate_error(absl::InternalError(
-            absl::StrCat("recvmsg:", grpc_core::StrError(errno))));
+            absl::StrCat("recvmsg:", grpc_core::StrError(saved_errno))));
       }
       return true;
     }
@@ -1925,9 +1926,7 @@ static const grpc_endpoint_vtable vtable = {tcp_read,
 grpc_endpoint* grpc_tcp_create(
     grpc_fd* fd, const grpc_event_engine::experimental::EndpointConfig& config,
     absl::string_view peer_string) {
-  if (grpc_core::IsEventEngineForAllOtherEndpointsEnabled() &&
-      !grpc_event_engine::experimental::
-          EventEngineExperimentDisabledForPython()) {
+  if (grpc_core::IsEventEngineForAllOtherEndpointsEnabled()) {
     // Create an EventEngine endpoint when creating the transport.
     auto* engine =
         reinterpret_cast<grpc_event_engine::experimental::EventEngine*>(
@@ -1955,9 +1954,7 @@ grpc_endpoint* grpc_tcp_create(grpc_fd* em_fd,
   GRPC_CHECK(!grpc_event_engine::experimental::UsePollsetAlternative())
       << "This function must not be called when the pollset_alternative "
          "experiment is enabled. This is a bug.";
-  GRPC_CHECK(
-      !grpc_core::IsEventEngineForAllOtherEndpointsEnabled() ||
-      grpc_event_engine::experimental::EventEngineExperimentDisabledForPython())
+  GRPC_CHECK(!grpc_core::IsEventEngineForAllOtherEndpointsEnabled())
       << "The event_engine_for_all_other_endpoints experiment should prevent "
          "this method from being called. This is a bug.";
   grpc_tcp* tcp = new grpc_tcp(options);

data/src/core/lib/iomgr/tcp_server_posix.cc

@@ -332,7 +332,7 @@ static void deactivated_all_ports(grpc_tcp_server* s) {
     grpc_tcp_listener* sp;
     for (sp = s->head; sp; sp = sp->next) {
       // Do not unlink if there is a pre-allocated FD
-      if (grpc_tcp_server_pre_allocated_fd(s) <= 0) {
+      if (grpc_tcp_server_pre_allocated_fd(s) < 0) {
         grpc_unlink_if_unix_domain_socket(&sp->addr);
       }
       GRPC_CLOSURE_INIT(&sp->destroyed_closure, destroyed_port, s,
@@ -643,7 +643,7 @@ static grpc_error_handle tcp_server_add_port(grpc_tcp_server* s,
             if (!listen_fd.ok()) {
               return;
             }
-            GRPC_DCHECK_GT(*listen_fd, 0);
+            GRPC_DCHECK_GE(*listen_fd, 0);
             s->listen_fd_to_index_map.insert_or_assign(
                 *listen_fd, std::tuple(s->n_bind_ports, fd_index++));
           });
@@ -698,7 +698,7 @@ static grpc_error_handle tcp_server_add_port(grpc_tcp_server* s,
 
   /* Do not unlink if there are pre-allocated FDs, or it will stop
      working after the first client connects */
-  if (grpc_tcp_server_pre_allocated_fd(s) <= 0) {
+  if (grpc_tcp_server_pre_allocated_fd(s) < 0) {
     grpc_unlink_if_unix_domain_socket(addr);
   }
 

data/src/core/lib/iomgr/tcp_server_utils_posix_common.cc

@@ -161,7 +161,7 @@ grpc_error_handle grpc_tcp_server_add_addr(grpc_tcp_server* s,
   fd = grpc_tcp_server_pre_allocated_fd(s);
 
   // Check if FD has been pre-allocated
-  if (fd > 0) {
+  if (fd >= 0) {
     int family = grpc_sockaddr_get_family(addr);
     // Set dsmode value
     if (family == AF_INET6) {

data/src/core/lib/promise/detail/promise_factory.h

@@ -204,20 +204,20 @@ PromiseFactoryImpl(Token, F& f, A&& arg) {
 // Given a callable() -> Promise<T>, promote it to a
 // PromiseFactory(A) -> Promise<T> by dropping the first argument.
 template <typename Token, typename A, typename F>
-GPR_ATTRIBUTE_ALWAYS_INLINE_FUNCTION
-    absl::enable_if_t<IsVoidCallable<ResultOf<F()>>::value,
-                      PromiseLike<decltype(std::declval<F>()())>>
-    PromiseFactoryImpl(Token, F&& f, A&&) {
+GPR_ATTRIBUTE_ALWAYS_INLINE_FUNCTION inline absl::enable_if_t<
+    IsVoidCallable<ResultOf<F()>>::value,
+    PromiseLike<decltype(std::declval<F>()())>>
+PromiseFactoryImpl(Token, F&& f, A&&) {
   return PromiseLike<decltype(std::declval<F>()())>(std::in_place,
                                                     std::forward<F>(f));
 }
 
 // Given a callable() -> Promise<T>, name it a PromiseFactory and use it.
 template <typename Token, typename F>
-GPR_ATTRIBUTE_ALWAYS_INLINE_FUNCTION
-    absl::enable_if_t<IsVoidCallable<ResultOf<F()>>::value,
-                      PromiseLike<decltype(std::declval<F>()())>>
-    PromiseFactoryImpl(Token, F&& f) {
+GPR_ATTRIBUTE_ALWAYS_INLINE_FUNCTION inline absl::enable_if_t<
+    IsVoidCallable<ResultOf<F()>>::value,
+    PromiseLike<decltype(std::declval<F>()())>>
+PromiseFactoryImpl(Token, F&& f) {
   return PromiseLike<decltype(std::declval<F>()())>(std::in_place,
                                                     std::forward<F>(f));
 }

data/src/core/lib/promise/interceptor_list.h

@@ -38,7 +38,7 @@
 namespace grpc_core {
 
 // Tracks a list of maps of T -> optional<T> via promises.
-// When Run, runs each transformation in order, and resolves to the ulimate
+// When Run, runs each transformation in order, and resolves to the ultimate
 // result.
 // If a map resolves to nullopt, the chain is terminated and the result is
 // nullopt.

data/src/core/lib/promise/try_seq.h

@@ -49,8 +49,8 @@ namespace promise_detail {
 //       indicate only success/failure. In the case of returning Status, the
 //       next functor in the chain takes no arguments.
 //    2. StatusFlag and ValueOrStatus can be return types if rich error
-//       information is not necessar. In this case the next functor in the chain
-//       takes no arguments.
+//       information is not necessary. In this case the next functor in the
+//       chain takes no arguments.
 //
 // Return :
 // Polling the TrySeq Promise combinator returns Poll<StatusOr<T>> where T is

data/src/core/lib/resource_quota/telemetry.cc

@@ -0,0 +1,54 @@
+// Copyright 2026 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "src/core/lib/resource_quota/telemetry.h"
+
+#include <grpc/support/port_platform.h>  // IWYU pragma: keep
+
+#include "src/core/telemetry/instrument.h"
+
+namespace grpc_core {
+
+// Telemetry domain static handle definitions and registrations (Dynamic on
+// Load)
+ResourceQuotaDomain::CounterHandle ResourceQuotaDomain::kCallsDropped =
+    ResourceQuotaDomain::RegisterCounter(
+        "grpc.resource_quota.calls_dropped",
+        "EXPERIMENTAL.  Number of calls dropped due to resource quota exceeded",
+        "calls");
+ResourceQuotaDomain::CounterHandle ResourceQuotaDomain::kCallsRejected =
+    ResourceQuotaDomain::RegisterCounter(
+        "grpc.resource_quota.calls_rejected",
+        "EXPERIMENTAL.  Number of calls rejected due to resource quota "
+        "exceeded",
+        "calls");
+ResourceQuotaDomain::CounterHandle ResourceQuotaDomain::kConnectionsDropped =
+    ResourceQuotaDomain::RegisterCounter(
+        "grpc.resource_quota.connections_dropped",
+        "EXPERIMENTAL.  Number of connections dropped due to resource quota "
+        "exceeded",
+        "connections");
+ResourceQuotaDomain::DoubleGaugeHandle
+    ResourceQuotaDomain::kInstantaneousMemoryPressure =
+        ResourceQuotaDomain::RegisterDoubleGauge(
+            "grpc.resource_quota.instantaneous_memory_pressure",
+            "The current instantaneously measured memory pressure.", "ratio");
+ResourceQuotaDomain::DoubleGaugeHandle ResourceQuotaDomain::
+    kMemoryPressureControlValue = ResourceQuotaDomain::RegisterDoubleGauge(
+        "grpc.resource_quota.memory_pressure_control_value",
+        "A control value that can be used to scale buffer sizes up or down to "
+        "adjust memory pressure to our target set point.",
+        "ratio");
+
+}  // namespace grpc_core

data/src/core/lib/resource_quota/telemetry.h

@@ -25,29 +25,11 @@ class ResourceQuotaDomain final : public InstrumentDomain<ResourceQuotaDomain> {
   using Backend = HighContentionBackend;
   static constexpr absl::string_view kName = "resource_quota";
 
-  static inline const auto kCallsDropped = RegisterCounter(
-      "grpc.resource_quota.calls_dropped",
-      "EXPERIMENTAL.  Number of calls dropped due to resource quota "
-      "exceeded",
-      "calls");
-  static inline const auto kCallsRejected = RegisterCounter(
-      "grpc.resource_quota.calls_rejected",
-      "EXPERIMENTAL.  Number of calls rejected due to resource quota "
-      "exceeded",
-      "calls");
-  static inline const auto kConnectionsDropped = RegisterCounter(
-      "grpc.resource_quota.connections_dropped",
-      "EXPERIMENTAL.  Number of connections dropped due to resource quota "
-      "exceeded",
-      "connections");
-  static inline const auto kInstantaneousMemoryPressure = RegisterDoubleGauge(
-      "grpc.resource_quota.instantaneous_memory_pressure",
-      "The current instantaneously measured memory pressure.", "ratio");
-  static inline const auto kMemoryPressureControlValue = RegisterDoubleGauge(
-      "grpc.resource_quota.memory_pressure_control_value",
-      "A control value that can be used to scale buffer sizes up or down to "
-      "adjust memory pressure to our target set point.",
-      "ratio");
+  static CounterHandle kCallsDropped;
+  static CounterHandle kCallsRejected;
+  static CounterHandle kConnectionsDropped;
+  static DoubleGaugeHandle kInstantaneousMemoryPressure;
+  static DoubleGaugeHandle kMemoryPressureControlValue;
 };
 
 }  // namespace grpc_core

data/src/core/lib/security/authorization/audit_logging.cc

@@ -62,7 +62,7 @@ bool AuditLoggerRegistry::FactoryExists(absl::string_view name) {
          registry->logger_factories_map_.end();
 }
 
-absl::StatusOr<std::unique_ptr<AuditLoggerFactory::Config>>
+absl::StatusOr<std::shared_ptr<const AuditLoggerFactory::Config>>
 AuditLoggerRegistry::ParseConfig(absl::string_view name, const Json& json) {
   MutexLock lock(mu);
   auto it = registry->logger_factories_map_.find(name);
@@ -74,7 +74,7 @@ AuditLoggerRegistry::ParseConfig(absl::string_view name, const Json& json) {
 }
 
 std::unique_ptr<AuditLogger> AuditLoggerRegistry::CreateAuditLogger(
-    std::unique_ptr<AuditLoggerFactory::Config> config) {
+    std::shared_ptr<const AuditLoggerFactory::Config> config) {
   MutexLock lock(mu);
   auto it = registry->logger_factories_map_.find(config->name());
   GRPC_CHECK(it != registry->logger_factories_map_.end());

data/src/core/lib/security/authorization/audit_logging.h

@@ -36,17 +36,17 @@ namespace experimental {
 
 class AuditLoggerRegistry {
  public:
-  static void RegisterFactory(std::unique_ptr<AuditLoggerFactory>);
+  static void RegisterFactory(std::unique_ptr<AuditLoggerFactory> factory);
 
   static bool FactoryExists(absl::string_view name);
 
-  static absl::StatusOr<std::unique_ptr<AuditLoggerFactory::Config>>
+  static absl::StatusOr<std::shared_ptr<const AuditLoggerFactory::Config>>
   ParseConfig(absl::string_view name, const Json& json);
 
   // This assume the given config is parsed and validated already.
   // Therefore, it should always succeed in creating a logger.
   static std::unique_ptr<AuditLogger> CreateAuditLogger(
-      std::unique_ptr<AuditLoggerFactory::Config>);
+      std::shared_ptr<const AuditLoggerFactory::Config> config);
 
   // Factories are registered during initialization. They should never be
   // unregistered since they will be looked up at any time till the program

data/src/core/lib/security/authorization/grpc_authorization_engine.cc

@@ -44,20 +44,18 @@ bool ShouldLog(const Decision& decision,
 
 }  // namespace
 
-GrpcAuthorizationEngine::GrpcAuthorizationEngine(Rbac policy)
-    : name_(std::move(policy.name)),
-      action_(policy.action),
-      audit_condition_(policy.audit_condition) {
-  for (auto& sub_policy : policy.policies) {
-    Policy policy;
-    policy.name = sub_policy.first;
-    policy.matcher = std::make_unique<PolicyAuthorizationMatcher>(
-        std::move(sub_policy.second));
-    policies_.push_back(std::move(policy));
+GrpcAuthorizationEngine::GrpcAuthorizationEngine(const Rbac& rbac)
+    : name_(rbac.name),
+      action_(rbac.action),
+      audit_condition_(rbac.audit_condition) {
+  for (auto& [name, policy] : rbac.policies) {
+    auto& engine_policy = policies_.emplace_back();
+    engine_policy.name = name;
+    engine_policy.matcher =
+        std::make_unique<PolicyAuthorizationMatcher>(policy);
   }
-  for (auto& logger_config : policy.logger_configs) {
-    auto logger =
-        AuditLoggerRegistry::CreateAuditLogger(std::move(logger_config));
+  for (const auto& logger_config : rbac.logger_configs) {
+    auto logger = AuditLoggerRegistry::CreateAuditLogger(logger_config);
     GRPC_CHECK(logger != nullptr);
     audit_loggers_.push_back(std::move(logger));
   }

data/src/core/lib/security/authorization/grpc_authorization_engine.h

@@ -44,7 +44,7 @@ class GrpcAuthorizationEngine : public AuthorizationEngine {
   explicit GrpcAuthorizationEngine(Rbac::Action action)
       : action_(action), audit_condition_(Rbac::AuditCondition::kNone) {}
   // Builds GrpcAuthorizationEngine with allow/deny RBAC policy.
-  explicit GrpcAuthorizationEngine(Rbac policy);
+  explicit GrpcAuthorizationEngine(const Rbac& rbac);
 
   GrpcAuthorizationEngine(GrpcAuthorizationEngine&& other) noexcept;
   GrpcAuthorizationEngine& operator=(GrpcAuthorizationEngine&& other) noexcept;

data/src/core/lib/security/authorization/matchers.cc

@@ -30,13 +30,13 @@
 namespace grpc_core {
 
 std::unique_ptr<AuthorizationMatcher> AuthorizationMatcher::Create(
-    Rbac::Permission permission) {
+    const Rbac::Permission& permission) {
   switch (permission.type) {
     case Rbac::Permission::RuleType::kAnd: {
       std::vector<std::unique_ptr<AuthorizationMatcher>> matchers;
       matchers.reserve(permission.permissions.size());
       for (const auto& rule : permission.permissions) {
-        matchers.push_back(AuthorizationMatcher::Create(std::move(*rule)));
+        matchers.push_back(AuthorizationMatcher::Create(*rule));
       }
       return std::make_unique<AndAuthorizationMatcher>(std::move(matchers));
     }
@@ -44,43 +44,43 @@ std::unique_ptr<AuthorizationMatcher> AuthorizationMatcher::Create(
       std::vector<std::unique_ptr<AuthorizationMatcher>> matchers;
       matchers.reserve(permission.permissions.size());
       for (const auto& rule : permission.permissions) {
-        matchers.push_back(AuthorizationMatcher::Create(std::move(*rule)));
+        matchers.push_back(AuthorizationMatcher::Create(*rule));
       }
       return std::make_unique<OrAuthorizationMatcher>(std::move(matchers));
     }
     case Rbac::Permission::RuleType::kNot:
       return std::make_unique<NotAuthorizationMatcher>(
-          AuthorizationMatcher::Create(std::move(*permission.permissions[0])));
+          AuthorizationMatcher::Create(*permission.permissions[0]));
     case Rbac::Permission::RuleType::kAny:
       return std::make_unique<AlwaysAuthorizationMatcher>();
     case Rbac::Permission::RuleType::kHeader:
       return std::make_unique<HeaderAuthorizationMatcher>(
-          std::move(permission.header_matcher));
+          permission.header_matcher);
     case Rbac::Permission::RuleType::kPath:
       return std::make_unique<PathAuthorizationMatcher>(
-          std::move(permission.string_matcher));
+          permission.string_matcher);
     case Rbac::Permission::RuleType::kDestIp:
       return std::make_unique<IpAuthorizationMatcher>(
-          IpAuthorizationMatcher::Type::kDestIp, std::move(permission.ip));
+          IpAuthorizationMatcher::Type::kDestIp, permission.ip);
     case Rbac::Permission::RuleType::kDestPort:
       return std::make_unique<PortAuthorizationMatcher>(permission.port);
     case Rbac::Permission::RuleType::kMetadata:
       return std::make_unique<MetadataAuthorizationMatcher>(permission.invert);
     case Rbac::Permission::RuleType::kReqServerName:
       return std::make_unique<ReqServerNameAuthorizationMatcher>(
-          std::move(permission.string_matcher));
+          permission.string_matcher);
   }
   return nullptr;
 }
 
 std::unique_ptr<AuthorizationMatcher> AuthorizationMatcher::Create(
-    Rbac::Principal principal) {
+    const Rbac::Principal& principal) {
   switch (principal.type) {
     case Rbac::Principal::RuleType::kAnd: {
       std::vector<std::unique_ptr<AuthorizationMatcher>> matchers;
       matchers.reserve(principal.principals.size());
       for (const auto& id : principal.principals) {
-        matchers.push_back(AuthorizationMatcher::Create(std::move(*id)));
+        matchers.push_back(AuthorizationMatcher::Create(*id));
       }
       return std::make_unique<AndAuthorizationMatcher>(std::move(matchers));
     }
@@ -88,34 +88,33 @@ std::unique_ptr<AuthorizationMatcher> AuthorizationMatcher::Create(
       std::vector<std::unique_ptr<AuthorizationMatcher>> matchers;
       matchers.reserve(principal.principals.size());
       for (const auto& id : principal.principals) {
-        matchers.push_back(AuthorizationMatcher::Create(std::move(*id)));
+        matchers.push_back(AuthorizationMatcher::Create(*id));
       }
       return std::make_unique<OrAuthorizationMatcher>(std::move(matchers));
     }
     case Rbac::Principal::RuleType::kNot:
       return std::make_unique<NotAuthorizationMatcher>(
-          AuthorizationMatcher::Create(std::move(*principal.principals[0])));
+          AuthorizationMatcher::Create(*principal.principals[0]));
     case Rbac::Principal::RuleType::kAny:
       return std::make_unique<AlwaysAuthorizationMatcher>();
     case Rbac::Principal::RuleType::kPrincipalName:
       return std::make_unique<AuthenticatedAuthorizationMatcher>(
-          std::move(principal.string_matcher));
+          principal.string_matcher);
     case Rbac::Principal::RuleType::kSourceIp:
       return std::make_unique<IpAuthorizationMatcher>(
-          IpAuthorizationMatcher::Type::kSourceIp, std::move(principal.ip));
+          IpAuthorizationMatcher::Type::kSourceIp, principal.ip);
     case Rbac::Principal::RuleType::kDirectRemoteIp:
       return std::make_unique<IpAuthorizationMatcher>(
-          IpAuthorizationMatcher::Type::kDirectRemoteIp,
-          std::move(principal.ip));
+          IpAuthorizationMatcher::Type::kDirectRemoteIp, principal.ip);
     case Rbac::Principal::RuleType::kRemoteIp:
       return std::make_unique<IpAuthorizationMatcher>(
-          IpAuthorizationMatcher::Type::kRemoteIp, std::move(principal.ip));
+          IpAuthorizationMatcher::Type::kRemoteIp, principal.ip);
     case Rbac::Principal::RuleType::kHeader:
       return std::make_unique<HeaderAuthorizationMatcher>(
-          std::move(principal.header_matcher));
+          principal.header_matcher);
     case Rbac::Principal::RuleType::kPath:
       return std::make_unique<PathAuthorizationMatcher>(
-          std::move(principal.string_matcher.value()));
+          principal.string_matcher.value());
     case Rbac::Principal::RuleType::kMetadata:
       return std::make_unique<MetadataAuthorizationMatcher>(principal.invert);
   }
@@ -150,7 +149,8 @@ bool HeaderAuthorizationMatcher::Matches(const EvaluateArgs& args) const {
       args.GetHeaderValue(matcher_.name(), &concatenated_value));
 }
 
-IpAuthorizationMatcher::IpAuthorizationMatcher(Type type, Rbac::CidrRange range)
+IpAuthorizationMatcher::IpAuthorizationMatcher(Type type,
+                                               const Rbac::CidrRange& range)
     : type_(type), prefix_len_(range.prefix_len) {
   auto address =
       StringToSockaddr(range.address_prefix, 0);  // Port does not matter here.

data/src/core/lib/security/authorization/matchers.h

@@ -42,12 +42,12 @@ class AuthorizationMatcher {
   // Creates an instance of a matcher based off the rules defined in Permission
   // config.
   static std::unique_ptr<AuthorizationMatcher> Create(
-      Rbac::Permission permission);
+      const Rbac::Permission& permission);
 
   // Creates an instance of a matcher based off the rules defined in Principal
   // config.
   static std::unique_ptr<AuthorizationMatcher> Create(
-      Rbac::Principal principal);
+      const Rbac::Principal& principal);
 };
 
 class AlwaysAuthorizationMatcher : public AuthorizationMatcher {
@@ -113,8 +113,8 @@ class MetadataAuthorizationMatcher : public AuthorizationMatcher {
 // Perform a match against HTTP headers.
 class HeaderAuthorizationMatcher : public AuthorizationMatcher {
  public:
-  explicit HeaderAuthorizationMatcher(HeaderMatcher matcher)
-      : matcher_(std::move(matcher)) {}
+  explicit HeaderAuthorizationMatcher(const HeaderMatcher& matcher)
+      : matcher_(matcher) {}
 
   bool Matches(const EvaluateArgs& args) const override;
 
@@ -132,7 +132,7 @@ class IpAuthorizationMatcher : public AuthorizationMatcher {
     kRemoteIp,
   };
 
-  IpAuthorizationMatcher(Type type, Rbac::CidrRange range);
+  IpAuthorizationMatcher(Type type, const Rbac::CidrRange& range);
 
   bool Matches(const EvaluateArgs& args) const override;
 
@@ -158,8 +158,9 @@ class PortAuthorizationMatcher : public AuthorizationMatcher {
 // or DNS SAN in that order, otherwise uses subject field.
 class AuthenticatedAuthorizationMatcher : public AuthorizationMatcher {
  public:
-  explicit AuthenticatedAuthorizationMatcher(std::optional<StringMatcher> auth)
-      : matcher_(std::move(auth)) {}
+  explicit AuthenticatedAuthorizationMatcher(
+      const std::optional<StringMatcher>& auth)
+      : matcher_(auth) {}
 
   bool Matches(const EvaluateArgs& args) const override;
 
@@ -172,8 +173,8 @@ class AuthenticatedAuthorizationMatcher : public AuthorizationMatcher {
 class ReqServerNameAuthorizationMatcher : public AuthorizationMatcher {
  public:
   explicit ReqServerNameAuthorizationMatcher(
-      StringMatcher requested_server_name)
-      : matcher_(std::move(requested_server_name)) {}
+      const StringMatcher& requested_server_name)
+      : matcher_(requested_server_name) {}
 
   bool Matches(const EvaluateArgs&) const override;
 
@@ -184,8 +185,8 @@ class ReqServerNameAuthorizationMatcher : public AuthorizationMatcher {
 // Perform a match against the path header of HTTP request.
 class PathAuthorizationMatcher : public AuthorizationMatcher {
  public:
-  explicit PathAuthorizationMatcher(StringMatcher path)
-      : matcher_(std::move(path)) {}
+  explicit PathAuthorizationMatcher(const StringMatcher& path)
+      : matcher_(path) {}
 
   bool Matches(const EvaluateArgs& args) const override;
 
@@ -198,11 +199,9 @@ class PathAuthorizationMatcher : public AuthorizationMatcher {
 // of its permissions and a match in one of its principals.
 class PolicyAuthorizationMatcher : public AuthorizationMatcher {
  public:
-  explicit PolicyAuthorizationMatcher(Rbac::Policy policy)
-      : permissions_(
-            AuthorizationMatcher::Create(std::move(policy.permissions))),
-        principals_(
-            AuthorizationMatcher::Create(std::move(policy.principals))) {}
+  explicit PolicyAuthorizationMatcher(const Rbac::Policy& policy)
+      : permissions_(AuthorizationMatcher::Create(policy.permissions)),
+        principals_(AuthorizationMatcher::Create(policy.principals)) {}
 
   bool Matches(const EvaluateArgs& args) const override;
 

data/src/core/lib/security/authorization/rbac_policy.h

@@ -183,7 +183,7 @@ struct Rbac {
   std::map<std::string, Policy> policies;
 
   AuditCondition audit_condition;
-  std::vector<std::unique_ptr<experimental::AuditLoggerFactory::Config>>
+  std::vector<std::shared_ptr<const experimental::AuditLoggerFactory::Config>>
       logger_configs;
 };
 

data/src/core/lib/security/authorization/stdout_logger.cc

@@ -57,13 +57,13 @@ std::string StdoutAuditLoggerFactory::Config::ToString() const { return "{}"; }
 
 absl::string_view StdoutAuditLoggerFactory::name() const { return kName; }
 
-absl::StatusOr<std::unique_ptr<AuditLoggerFactory::Config>>
+absl::StatusOr<std::shared_ptr<const AuditLoggerFactory::Config>>
 StdoutAuditLoggerFactory::ParseAuditLoggerConfig(const Json&) {
-  return std::make_unique<StdoutAuditLoggerFactory::Config>();
+  return std::make_shared<StdoutAuditLoggerFactory::Config>();
 }
 
 std::unique_ptr<AuditLogger> StdoutAuditLoggerFactory::CreateAuditLogger(
-    std::unique_ptr<AuditLoggerFactory::Config> config) {
+    std::shared_ptr<const AuditLoggerFactory::Config> config) {
   // Sanity check.
   GRPC_CHECK(config != nullptr);
   GRPC_CHECK_EQ(config->name(), name());