grpc 1.81.1 → 1.83.0

data/src/core/credentials/call/regional_access_boundary_fetcher.cc

@@ -0,0 +1,411 @@
+//
+// Copyright 2026 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#include "src/core/credentials/call/regional_access_boundary_fetcher.h"
+
+#include <grpc/support/alloc.h>
+#include <grpc/support/string_util.h>
+
+#include "src/core/credentials/call/call_credentials.h"
+#include "src/core/credentials/transport/transport_credentials.h"
+#include "src/core/lib/iomgr/polling_entity.h"
+#include "src/core/lib/iomgr/pollset_set.h"
+#include "src/core/util/env.h"
+#include "src/core/util/grpc_check.h"
+#include "src/core/util/host_port.h"
+#include "src/core/util/http_client/httpcli_ssl_credentials.h"
+#include "src/core/util/json/json.h"
+#include "src/core/util/json/json_reader.h"
+#include "src/core/util/status_helper.h"
+#include "src/core/util/uri.h"
+#include "absl/log/log.h"
+#include "absl/strings/ascii.h"
+#include "absl/strings/match.h"
+#include "absl/strings/str_cat.h"
+#include "absl/strings/str_format.h"
+
+namespace grpc_core {
+
+namespace {
+constexpr absl::string_view kAllowedLocationsKey = "x-allowed-locations";
+constexpr Duration kRegionalAccessBoundarySoftCacheGraceDuration =
+    Duration::Hours(1);
+constexpr Duration kRegionalAccessBoundaryCacheDuration = Duration::Hours(6);
+constexpr absl::string_view kRegionalEndpoint = "rep.googleapis.com";
+constexpr char kComputeEngineDefaultSaEmailPath[] =
+    "/computeMetadata/v1/instance/service-accounts/default/email";
+}  // namespace
+
+RefCountedPtr<RegionalAccessBoundaryFetcher>
+RegionalAccessBoundaryFetcher::Create(
+    absl::string_view lookup_url,
+    std::shared_ptr<grpc_event_engine::experimental::EventEngine> event_engine,
+    std::optional<BackOff::Options> backoff_options) {
+  auto uri = URI::Parse(lookup_url);
+  if (!uri.ok()) {
+    LOG(INFO) << "Invalid RegionalAccessBoundary lookup URI \"" << lookup_url
+              << "\" (" << uri.status() << "); RAB data will not be fetched";
+    return nullptr;
+  }
+  return MakeRefCounted<RegionalAccessBoundaryFetcher>(
+      std::move(*uri), std::move(event_engine), backoff_options);
+}
+
+RegionalAccessBoundaryFetcher::RegionalAccessBoundaryFetcher(
+    URI lookup_uri,
+    std::shared_ptr<grpc_event_engine::experimental::EventEngine> event_engine,
+    std::optional<BackOff::Options> backoff_options)
+    : event_engine_(
+          event_engine == nullptr
+              ? grpc_event_engine::experimental::GetDefaultEventEngine()
+              : std::move(event_engine)),
+      lookup_uri_(std::move(lookup_uri)),
+      backoff_(backoff_options.has_value()
+                   ? *backoff_options
+                   : BackOff::Options()
+                         .set_initial_backoff(Duration::Seconds(1))
+                         .set_multiplier(2.0)
+                         .set_jitter(0.2)
+                         .set_max_backoff(Duration::Seconds(60))) {
+  GRPC_CHECK(event_engine_ != nullptr);
+}
+
+void RegionalAccessBoundaryFetcher::OnFetchSuccess(Slice encoded_locations) {
+  MutexLock lock(&cache_mu_);
+  if (shutdown_) return;
+  cache_ = {std::move(encoded_locations),
+            Timestamp::Now() + kRegionalAccessBoundaryCacheDuration};
+  backoff_.Reset();
+  pending_request_.reset();
+}
+
+void RegionalAccessBoundaryFetcher::OnFetchFailure(
+    grpc_error_handle error, int http_status, absl::string_view response_body) {
+  MutexLock lock(&cache_mu_);
+  if (shutdown_) return;
+  auto log_message = absl::StrCat(
+      "Regional access boundary request will be retried after failing with "
+      "error: ",
+      StatusToString(error), ", HTTP Status: ", http_status);
+  if (response_body.data() != nullptr) {
+    absl::StrAppend(&log_message, ", Body: ", response_body);
+  }
+  LOG(INFO) << log_message;
+  next_fetch_time_ = Timestamp::Now() + backoff_.NextAttemptDelay();
+  pending_request_.reset();
+}
+
+void RegionalAccessBoundaryFetcher::Fetch(absl::string_view access_token,
+                                          ClientMetadata& initial_metadata) {
+  const Slice* authority_ptr =
+      initial_metadata.get_pointer(HttpAuthorityMetadata());
+  if (authority_ptr == nullptr) {
+    return;
+  }
+  absl::string_view authority = authority_ptr->as_string_view();
+  absl::string_view host;
+  absl::string_view port;
+  if (SplitHostPort(authority, &host, &port)) {
+    if (!host.empty()) {
+      authority = host;
+    }
+  }
+  // Regional access boundary is only applicable for non-regional googleapis
+  // endpoints. All other endpoints would not benefit from the regional access
+  // boundary metadata.
+  bool is_regional =
+      authority == kRegionalEndpoint ||
+      absl::EndsWith(authority, absl::StrCat(".", kRegionalEndpoint));
+  if (is_regional) {
+    return;
+  }
+  {
+    const Timestamp now = Timestamp::Now();
+    MutexLock lock(&cache_mu_);
+    // We kick off a new fetch attempt if all of the following are true:
+    // - We have no cached Regioanl Access Boundary data, or the cached
+    //   Regional Access Boundary data's expiration time is less than the grace
+    //   period in the future.
+    // - There is no pending fetch currently in flight.
+    // - We are not currently in backoff after a failed fetch attempt.
+    if ((!cache_.has_value() ||
+         cache_->expiration <=
+             now + kRegionalAccessBoundarySoftCacheGraceDuration) &&
+        pending_request_ == nullptr && next_fetch_time_ <= now) {
+      pending_request_ = MakeOrphanable<Request>(WeakRef(), access_token);
+      pending_request_->Start();
+    }
+    // If we have cached non-expired Regional Access Boundary data, use it.
+    if (cache_.has_value() && cache_->expiration > now) {
+      initial_metadata.Append(
+          kAllowedLocationsKey, cache_->encoded_locations.Ref(),
+          [](absl::string_view, const Slice&) {
+            LOG_EVERY_N_SEC(WARNING, 60)
+                << "Regional access boundary header could not be appended";
+          });
+    }
+  }
+}
+
+void RegionalAccessBoundaryFetcher::Orphaned() {
+  MutexLock lock(&cache_mu_);
+  shutdown_ = true;
+  pending_request_.reset();
+}
+
+RegionalAccessBoundaryFetcher::Request::Request(
+    WeakRefCountedPtr<RegionalAccessBoundaryFetcher> fetcher,
+    absl::string_view access_token)
+    : access_token_(access_token), fetcher_(std::move(fetcher)) {
+  memset(&response_, 0, sizeof(response_));
+  pollent_ =
+      grpc_polling_entity_create_from_pollset_set(grpc_pollset_set_create());
+}
+
+RegionalAccessBoundaryFetcher::Request::~Request() {
+  grpc_http_response_destroy(&response_);
+  grpc_pollset_set_destroy(grpc_polling_entity_pollset_set(&pollent_));
+}
+
+void RegionalAccessBoundaryFetcher::Request::Start() {
+  grpc_http_request request;
+  memset(&request, 0, sizeof(grpc_http_request));
+  grpc_http_header header = {const_cast<char*>("Authorization"),
+                             const_cast<char*>(access_token_.c_str())};
+  request.hdr_count = 1;
+  request.hdrs = &header;
+  // We pass this as arg to OnResponseWrapper. We must
+  // manually take a ref because C-callback doesn't. The Ref is consumed in
+  // OnResponseWrapper.
+  Ref().release();
+  GRPC_CLOSURE_INIT(&closure_, OnResponseWrapper, this,
+                    grpc_schedule_on_exec_ctx);
+  http_request_ = HttpRequest::Get(fetcher_->lookup_uri_,
+                                   nullptr,  // channel_args
+                                   &pollent_, &request,
+                                   Timestamp::Now() + Duration::Seconds(60),
+                                   &closure_, &response_,
+                                   RefCountedPtr<grpc_channel_credentials>(
+                                       CreateHttpRequestSSLCredentials()));
+  http_request_->Start();
+}
+
+void RegionalAccessBoundaryFetcher::Request::Orphan() {
+  http_request_.reset();
+  Unref();
+}
+
+void RegionalAccessBoundaryFetcher::Request::OnResponseWrapper(
+    void* arg, grpc_error_handle error) {
+  RefCountedPtr<Request> req(static_cast<Request*>(arg));
+  req->OnResponse(error);
+}
+
+void RegionalAccessBoundaryFetcher::Request::OnResponse(
+    grpc_error_handle error) {
+  bool success = false;
+  std::string encoded_locations;
+  absl::string_view response_body;
+  if (response_.body != nullptr) {
+    response_body = absl::string_view(response_.body, response_.body_length);
+  }
+  if (error.ok() && response_.status == 200) {
+    absl::StatusOr<Json> json = JsonParse(response_body);
+    if (json.ok() && json->type() == Json::Type::kObject) {
+      auto it_encoded = json->object().find("encodedLocations");
+      if (it_encoded != json->object().end() &&
+          it_encoded->second.type() == Json::Type::kString) {
+        encoded_locations = it_encoded->second.string();
+      }
+      if (!encoded_locations.empty()) {
+        success = true;
+      }
+    }
+  }
+  if (success) {
+    fetcher_->OnFetchSuccess(Slice::FromCopiedString(encoded_locations));
+  } else {
+    fetcher_->OnFetchFailure(error, response_.status, response_body);
+  }
+}
+
+class EmailFetcher::EmailRequest final
+    : public InternallyRefCounted<EmailRequest> {
+ public:
+  explicit EmailRequest(WeakRefCountedPtr<EmailFetcher> fetcher)
+      : fetcher_(std::move(fetcher)) {
+    memset(&response_, 0, sizeof(response_));
+    pollent_ =
+        grpc_polling_entity_create_from_pollset_set(grpc_pollset_set_create());
+  }
+
+  ~EmailRequest() override {
+    grpc_http_response_destroy(&response_);
+    grpc_pollset_set_destroy(grpc_polling_entity_pollset_set(&pollent_));
+  }
+
+  void Start() {
+    grpc_http_header header = {const_cast<char*>("Metadata-Flavor"),
+                               const_cast<char*>("Google")};
+    grpc_http_request request = {};
+    request.hdr_count = 1;
+    request.hdrs = &header;
+    auto uri = URI::Create(
+        "http", /*user_info=*/"", GRPC_COMPUTE_ENGINE_METADATA_HOST,
+        kComputeEngineDefaultSaEmailPath, /*query_parameter_pairs=*/{},
+        /*fragment=*/"");
+    GRPC_CHECK(uri.ok());
+    GRPC_CLOSURE_INIT(&closure_, OnResponseWrapper, this,
+                      grpc_schedule_on_exec_ctx);
+    http_request_ = HttpRequest::Get(
+        std::move(*uri), /*args=*/nullptr, &pollent_, &request,
+        Timestamp::Now() + Duration::Seconds(60), &closure_, &response_,
+        RefCountedPtr<grpc_channel_credentials>(
+            grpc_insecure_credentials_create()));
+    Ref().release();  // Ref held by HTTP request callback.
+    http_request_->Start();
+  }
+
+  void Orphan() override {
+    http_request_.reset();
+    Unref();
+  }
+
+ private:
+  static void OnResponseWrapper(void* arg, grpc_error_handle error) {
+    RefCountedPtr<EmailRequest> req(static_cast<EmailRequest*>(arg));
+    // RefCountedPtr adopts the reference from Start().
+    req->OnResponse(error);
+  }
+
+  void OnResponse(grpc_error_handle error) {
+    absl::string_view response_body;
+    if (response_.body != nullptr) {
+      response_body = absl::string_view(response_.body, response_.body_length);
+    }
+    if (!error.ok()) {
+      fetcher_->OnEmailFetchError(error);
+    } else if (response_.status != 200) {
+      fetcher_->OnEmailFetchError(GRPC_ERROR_CREATE(absl::StrCat(
+          "Failed to fetch service account email: HTTP ", response_.status)));
+    } else {
+      fetcher_->OnEmailFetchComplete(response_body);
+    }
+  }
+
+  grpc_http_response response_;
+  OrphanablePtr<HttpRequest> http_request_;
+  grpc_polling_entity pollent_;
+  WeakRefCountedPtr<EmailFetcher> fetcher_;
+  grpc_closure closure_;
+};
+
+EmailFetcher::EmailFetcher(
+    std::shared_ptr<grpc_event_engine::experimental::EventEngine> event_engine)
+    : event_engine_(
+          event_engine == nullptr
+              ? grpc_event_engine::experimental::GetDefaultEventEngine()
+              : std::move(event_engine)) {}
+
+EmailFetcher::~EmailFetcher() = default;
+
+void EmailFetcher::StartEmailFetch() {
+  MutexLock lock(&mu_);
+  if (Timestamp::Now() < next_fetch_earliest_time_) {
+    return;
+  }
+  // Check if we are in the initial/retryable state (null EmailRequest)
+  auto* pending = std::get_if<OrphanablePtr<EmailRequest>>(&state_);
+  if (pending == nullptr) return;   // Already have RAB fetcher.
+  if (*pending != nullptr) return;  // Email fetch already in progress.
+  auto request = MakeOrphanable<EmailRequest>(WeakRef());
+  request->Start();
+  state_ = std::move(request);
+}
+
+void EmailFetcher::Fetch(absl::string_view token,
+                         ClientMetadata& initial_metadata) {
+  MutexLock lock(&mu_);
+  auto* rab_fetcher =
+      std::get_if<RefCountedPtr<RegionalAccessBoundaryFetcher>>(&state_);
+  if (rab_fetcher == nullptr) return;   // Don't yet have RAB fetcher.
+  if (*rab_fetcher == nullptr) return;  // Shouldn't happen, but be defensive.
+  (*rab_fetcher)->Fetch(token, initial_metadata);
+}
+
+void EmailFetcher::Orphaned() {
+  MutexLock lock(&mu_);
+  state_ = RefCountedPtr<RegionalAccessBoundaryFetcher>(nullptr);
+}
+
+void EmailFetcher::OnEmailFetchComplete(absl::string_view email) {
+  MutexLock lock(&mu_);
+  if (std::holds_alternative<OrphanablePtr<EmailRequest>>(state_)) {
+    absl::string_view trimmed_email = absl::StripAsciiWhitespace(email);
+    if (!IsValidEmail(trimmed_email)) {
+      LOG(INFO) << "Regional Access Boundary fetch skipped: service account "
+                   "email is not a valid email address (could be a principal "
+                   "string or pool id): \""
+                << trimmed_email << "\"";
+      state_ = RefCountedPtr<RegionalAccessBoundaryFetcher>(nullptr);
+      return;
+    }
+    std::string rab_url = absl::StrFormat(
+        "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/"
+        "%s/allowedLocations",
+        trimmed_email);
+    auto rab_fetcher =
+        RegionalAccessBoundaryFetcher::Create(rab_url, event_engine_);
+    if (rab_fetcher != nullptr) {
+      state_ = std::move(rab_fetcher);
+    } else {
+      state_ = OrphanablePtr<EmailRequest>(nullptr);
+    }
+  }
+}
+
+void EmailFetcher::OnEmailFetchError(grpc_error_handle error) {
+  MutexLock lock(&mu_);
+  if (std::holds_alternative<OrphanablePtr<EmailRequest>>(state_)) {
+    LOG_EVERY_N_SEC(INFO, 60) << "Regional Access Boundary fetch skipped due "
+                                 "to service account email fetch failure: "
+                              << StatusToString(error);
+    state_ = OrphanablePtr<EmailRequest>(
+        nullptr);  // Reset to allow retry on next invocation.
+    next_fetch_earliest_time_ = Timestamp::Now() + backoff_.NextAttemptDelay();
+  }
+}
+
+bool EmailFetcher::IsValidEmail(absl::string_view email) {
+  size_t at_pos = email.find('@');
+  if (at_pos == absl::string_view::npos || at_pos == 0 ||
+      at_pos == email.size() - 1) {
+    return false;
+  }
+  if (email.find('@', at_pos + 1) != absl::string_view::npos) {
+    return false;
+  }
+  absl::string_view domain = email.substr(at_pos + 1);
+  size_t dot_pos = domain.find('.');
+  while (dot_pos != absl::string_view::npos) {
+    if (dot_pos > 0 && dot_pos < domain.size() - 1) {
+      return true;
+    }
+    dot_pos = domain.find('.', dot_pos + 1);
+  }
+  return false;
+}
+}  // namespace grpc_core

data/src/core/credentials/call/regional_access_boundary_fetcher.h

@@ -0,0 +1,158 @@
+//
+// Copyright 2026 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#ifndef GRPC_SRC_CORE_CREDENTIALS_CALL_REGIONAL_ACCESS_BOUNDARY_FETCHER_H
+#define GRPC_SRC_CORE_CREDENTIALS_CALL_REGIONAL_ACCESS_BOUNDARY_FETCHER_H
+
+#include <grpc/event_engine/event_engine.h>
+#include <grpc/support/port_platform.h>
+#include <grpc/support/sync.h>
+#include <grpc/support/time.h>
+
+#include <optional>
+#include <string>
+#include <variant>
+#include <vector>
+
+#include "src/core/call/metadata.h"
+#include "src/core/lib/iomgr/error.h"
+#include "src/core/util/backoff.h"
+#include "src/core/util/dual_ref_counted.h"
+#include "src/core/util/http_client/httpcli.h"
+#include "src/core/util/ref_counted_ptr.h"
+#include "absl/status/statusor.h"
+
+namespace grpc_core {
+
+class RegionalAccessBoundaryFetcher final
+    : public DualRefCounted<RegionalAccessBoundaryFetcher> {
+ public:
+  static RefCountedPtr<RegionalAccessBoundaryFetcher> Create(
+      absl::string_view lookup_url,
+      std::shared_ptr<grpc_event_engine::experimental::EventEngine>
+          event_engine = nullptr,
+      std::optional<BackOff::Options> backoff_options = std::nullopt);
+
+  explicit RegionalAccessBoundaryFetcher(
+      URI lookup_uri,
+      std::shared_ptr<grpc_event_engine::experimental::EventEngine>
+          event_engine = nullptr,
+      std::optional<BackOff::Options> backoff_options = std::nullopt);
+
+  // Attaches regional access boundary header (x-allowed-locations) to the
+  // initial metadata if available, otherwise initiates non-blocking,
+  // asynchronous fetch of regional access boundary if not already cached or in
+  // flight.
+  void Fetch(absl::string_view access_token, ClientMetadata& initial_metadata);
+
+  // Cancels any pending fetch of regional access boundary which must be called
+  // during destruction of any CallCredential which supports regional access
+  // boundary to avoid memory leaks from pending http requests.
+  void Orphaned() override;
+
+ private:
+  friend class RegionalAccessBoundaryFetcherTest;
+
+  struct RegionalAccessBoundary {
+    Slice encoded_locations;
+    Timestamp expiration;
+  };
+
+  class Request;
+
+  void OnFetchSuccess(Slice encoded_locations);
+  void OnFetchFailure(grpc_error_handle error, int http_status,
+                      absl::string_view response_body);
+
+  std::shared_ptr<grpc_event_engine::experimental::EventEngine> event_engine_;
+  const URI lookup_uri_;
+  Mutex cache_mu_;
+  std::optional<RegionalAccessBoundary> cache_ ABSL_GUARDED_BY(&cache_mu_);
+  Timestamp next_fetch_time_ ABSL_GUARDED_BY(&cache_mu_) = Timestamp::InfPast();
+  BackOff backoff_ ABSL_GUARDED_BY(&cache_mu_);
+  OrphanablePtr<Request> pending_request_ ABSL_GUARDED_BY(&cache_mu_);
+  bool shutdown_ ABSL_GUARDED_BY(&cache_mu_) = false;
+};
+
+class RegionalAccessBoundaryFetcher::Request final
+    : public InternallyRefCounted<Request> {
+ public:
+  Request(WeakRefCountedPtr<RegionalAccessBoundaryFetcher> fetcher,
+          absl::string_view access_token);
+
+  ~Request() override;
+
+  void Start();
+
+  // Cancels any pending http request which must be called during
+  // destruction to avoid memory leaks from pending http requests.
+  void Orphan() override;
+
+ private:
+  static void OnResponseWrapper(void* arg, grpc_error_handle error);
+  void OnResponse(grpc_error_handle error);
+
+  grpc_http_response response_;
+  OrphanablePtr<HttpRequest> http_request_;
+  std::string access_token_;
+  grpc_polling_entity pollent_;
+  WeakRefCountedPtr<RegionalAccessBoundaryFetcher> fetcher_;
+  grpc_closure closure_;
+};
+
+class EmailFetcher final : public DualRefCounted<EmailFetcher> {
+ public:
+  explicit EmailFetcher(
+      std::shared_ptr<grpc_event_engine::experimental::EventEngine>
+          event_engine = nullptr);
+
+  ~EmailFetcher() override;
+
+  static bool IsValidEmail(absl::string_view email);
+
+  void StartEmailFetch();
+
+  // Wrapper for RAB fetcher.
+  void Fetch(absl::string_view token, ClientMetadata& metadata);
+
+  void Orphaned() override;
+
+ private:
+  class EmailRequest;
+
+  void OnEmailFetchComplete(absl::string_view email);
+  void OnEmailFetchError(grpc_error_handle error);
+
+  std::shared_ptr<grpc_event_engine::experimental::EventEngine> event_engine_;
+  Mutex mu_;
+
+  // Either a pending email request or an RAB fetcher.
+  std::variant<OrphanablePtr<EmailRequest>,
+               RefCountedPtr<RegionalAccessBoundaryFetcher>>
+      state_ ABSL_GUARDED_BY(&mu_);
+  BackOff backoff_ ABSL_GUARDED_BY(&mu_) =
+      BackOff(BackOff::Options()
+                  .set_initial_backoff(Duration::Seconds(15))
+                  .set_multiplier(1.75)
+                  .set_jitter(0.1)
+                  .set_max_backoff(Duration::Minutes(2)));
+  Timestamp next_fetch_earliest_time_ ABSL_GUARDED_BY(&mu_) =
+      Timestamp::InfPast();
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_CREDENTIALS_CALL_REGIONAL_ACCESS_BOUNDARY_FETCHER_H

data/src/core/credentials/call/token_fetcher/token_fetcher_credentials.cc

@@ -49,7 +49,7 @@ TokenFetcherCredentials::Token::Token(Slice token, Timestamp expiration)
       expiration_(expiration - kTokenExpirationAdjustmentDuration) {}
 
 void TokenFetcherCredentials::Token::AddTokenToClientInitialMetadata(
-    ClientMetadata& metadata) const {
+    ClientMetadata& metadata) {
   metadata.Append(GRPC_AUTHORIZATION_METADATA_KEY, token_.Ref(),
                   [](absl::string_view, const Slice&) { abort(); });
 }

data/src/core/credentials/call/token_fetcher/token_fetcher_credentials.h

@@ -55,7 +55,11 @@ class TokenFetcherCredentials : public grpc_call_credentials {
     Timestamp ExpirationTime() const { return expiration_; }
 
     // Adds the token to the call's client initial metadata.
-    void AddTokenToClientInitialMetadata(ClientMetadata& metadata) const;
+    virtual void AddTokenToClientInitialMetadata(ClientMetadata& metadata);
+
+   protected:
+    // Returns the token's value.
+    const Slice& token() const { return token_; }
 
    private:
     Slice token_;
@@ -66,6 +70,8 @@ class TokenFetcherCredentials : public grpc_call_credentials {
 
   void Orphaned() override;
 
+  // TODO(roth): Change internal code to not override this method and then
+  // change it to 'final'.
   ArenaPromise<absl::StatusOr<ClientMetadataHandle>> GetRequestMetadata(
       ClientMetadataHandle initial_metadata,
       const GetRequestMetadataArgs* args) override;

data/src/core/credentials/transport/insecure/insecure_security_connector.h

@@ -45,7 +45,7 @@ namespace grpc_core {
 extern const char kInsecureTransportSecurityType[];
 
 // Exposed for testing purposes only.
-// Create an auth context which is necessary to pass the santiy check in
+// Create an auth context which is necessary to pass the sanity check in
 // client_auth_filter that verifies if the peer's auth context is obtained
 // during handshakes.
 RefCountedPtr<grpc_auth_context> TestOnlyMakeInsecureAuthContext();

data/src/core/credentials/transport/local/local_security_connector.cc

@@ -155,7 +155,7 @@ void local_check_peer(tsi_peer peer, grpc_endpoint* ep,
       &peer.properties[peer.property_count]);
   if (result != TSI_OK) return;
   peer.property_count++;
-  // Create an auth context which is necessary to pass the santiy check in
+  // Create an auth context which is necessary to pass the sanity check in
   // {client, server}_auth_filter that verifies if the peer's auth context is
   // obtained during handshakes. The auth context is only checked for its
   // existence and not actually used.

data/src/core/credentials/transport/ssl/ssl_security_connector.cc

@@ -39,6 +39,7 @@
 #include "src/core/lib/iomgr/iomgr_fwd.h"
 #include "src/core/lib/promise/arena_promise.h"
 #include "src/core/lib/promise/promise.h"
+#include "src/core/telemetry/metrics.h"
 #include "src/core/transport/auth_context.h"
 #include "src/core/tsi/ssl_transport_security.h"
 #include "src/core/tsi/transport_security.h"
@@ -103,13 +104,19 @@ class grpc_ssl_channel_security_connector final
                        grpc_core::HandshakeManager* handshake_mgr) override {
     // Instantiate TSI handshaker.
     tsi_handshaker* tsi_hs = nullptr;
+    auto stats_plugin_group = args.GetObject<
+        grpc_core::GlobalStatsPluginRegistry::StatsPluginGroup>();
+    grpc_core::RefCountedPtr<grpc_core::CollectionScope> collection_scope =
+        stats_plugin_group != nullptr ? stats_plugin_group->GetCollectionScope()
+                                      : nullptr;
     tsi_result result = tsi_ssl_client_handshaker_factory_create_handshaker(
         client_handshaker_factory_,
         overridden_target_name_.empty() ? target_name_.c_str()
                                         : overridden_target_name_.c_str(),
         /*network_bio_buf_size=*/0,
         /*ssl_bio_buf_size=*/0,
-        args.GetOwnedString(GRPC_ARG_TRANSPORT_PROTOCOLS), &tsi_hs);
+        args.GetOwnedString(GRPC_ARG_TRANSPORT_PROTOCOLS),
+        std::move(collection_scope), &tsi_hs);
     if (result != TSI_OK) {
       LOG(ERROR) << "Handshaker creation failed with error "
                  << tsi_result_to_string(result);
@@ -274,9 +281,14 @@ class grpc_ssl_server_security_connector
     // Instantiate TSI handshaker.
     try_fetch_ssl_server_credentials();
     tsi_handshaker* tsi_hs = nullptr;
+    auto stats_plugin_group = args.GetObject<
+        grpc_core::GlobalStatsPluginRegistry::StatsPluginGroup>();
+    grpc_core::RefCountedPtr<grpc_core::CollectionScope> collection_scope =
+        stats_plugin_group != nullptr ? stats_plugin_group->GetCollectionScope()
+                                      : nullptr;
     tsi_result result = tsi_ssl_server_handshaker_factory_create_handshaker(
         server_handshaker_factory_, /*network_bio_buf_size=*/0,
-        /*ssl_bio_buf_size=*/0, &tsi_hs);
+        /*ssl_bio_buf_size=*/0, std::move(collection_scope), &tsi_hs);
     if (result != TSI_OK) {
       LOG(ERROR) << "Handshaker creation failed with error "
                  << tsi_result_to_string(result);