google-auth 2.56.2__tar.gz → 2.56.3__tar.gz

{google_auth-2.56.2/google_auth.egg-info → google_auth-2.56.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: google-auth
-Version: 2.56.2
+Version: 2.56.3
 Summary: Google Authentication Library
 Home-page: https://github.com/googleapis/google-cloud-python/tree/main/packages/google-auth
 Author: Google Cloud Platform

{google_auth-2.56.2 → google_auth-2.56.3}/google/auth/aio/transport/sessions.py

@@ -192,14 +192,13 @@ class AsyncAuthorizedSession:
                     ) = await mtls.get_client_cert_and_key(client_cert_callback)
 
                     if is_mtls:
-                        ssl_context = await mtls._run_in_executor(
-                            mtls.make_client_cert_ssl_context, cert, key
-                        )
-
                         # Re-create the auth request with the new SSL context
                         if AIOHTTP_INSTALLED and isinstance(
                             self._auth_request, AiohttpRequest
                         ):
+                            ssl_context = await mtls._run_in_executor(
+                                mtls.make_client_cert_ssl_context, cert, key
+                            )
                             connector = aiohttp.TCPConnector(ssl=ssl_context)
                             new_session = aiohttp.ClientSession(connector=connector)
 

{google_auth-2.56.2 → google_auth-2.56.3}/google/auth/transport/grpc.py

@@ -48,9 +48,13 @@ class AuthMetadataPlugin(grpc.AuthMetadataPlugin):
         default_host (Optional[str]): A host like "pubsub.googleapis.com".
             This is used when a self-signed JWT is created from service
             account credentials.
+        suppress_metrics_header (bool): When enabled, ``x-goog-api-client``
+            will be stripped from authorization headers.
     """
 
-    def __init__(self, credentials, request, default_host=None):
+    def __init__(
+        self, credentials, request, default_host=None, *, suppress_metrics_header=False
+    ):
         # pylint: disable=no-value-for-parameter
         # pylint doesn't realize that the super method takes no arguments
         # because this class is the same name as the superclass.
@@ -58,6 +62,7 @@ class AuthMetadataPlugin(grpc.AuthMetadataPlugin):
         self._credentials = credentials
         self._request = request
         self._default_host = default_host
+        self._suppress_metrics_header = suppress_metrics_header
 
     def _get_authorization_headers(self, context):
         """Gets the authorization headers for a request.
@@ -81,6 +86,9 @@ class AuthMetadataPlugin(grpc.AuthMetadataPlugin):
             self._request, context.method_name, context.service_url, headers
         )
 
+        if self._suppress_metrics_header and "x-goog-api-client" in headers:
+            del headers["x-goog-api-client"]
+
         return list(headers.items())
 
     def __call__(self, context, callback):

{google_auth-2.56.2 → google_auth-2.56.3}/google/auth/transport/requests.py

@@ -647,7 +647,14 @@ class AuthorizedSession(requests.Session):
         ):
             # Handle unauthorized permission error(401 status code)
             if response.status_code == http_client.UNAUTHORIZED:
-                if self.is_mtls:
+                MTLS_URL_PREFIXES = [
+                    "mtls.googleapis.com",
+                    "mtls.sandbox.googleapis.com",
+                ]
+                use_mtls = self.is_mtls and any(
+                    prefix in url for prefix in MTLS_URL_PREFIXES
+                )
+                if use_mtls:
                     (
                         call_cert_bytes,
                         call_key_bytes,

{google_auth-2.56.2 → google_auth-2.56.3}/google/auth/version.py

@@ -12,4 +12,4 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-__version__ = "2.56.2"
+__version__ = "2.56.3"

{google_auth-2.56.2 → google_auth-2.56.3}/google/oauth2/id_token.py

@@ -124,7 +124,7 @@ def verify_token(
             intended for. If None then the audience is not verified.
         certs_url (str): The URL that specifies the certificates to use to
             verify the token. This URL should return JSON in the format of
-            ``{'key id': 'x509 certificate'}`` or a certificate array according to
+            ``{'key id': 'x509 certificate'}`` or a JWK Set according to
             the JWK spec (see https://tools.ietf.org/html/rfc7517).
         clock_skew_in_seconds (int): The clock skew used for `iat` and `exp`
             validation.
@@ -132,17 +132,35 @@ def verify_token(
     Returns:
         Mapping[str, Any]: The decoded token.
     """
+    if isinstance(id_token, bytes):
+        id_token = id_token.decode("utf-8")
+
     certs = _fetch_certs(request, certs_url)
 
     if "keys" in certs:
         try:
-            import jwt as jwt_lib  # type: ignore
+            import jwt as jwt_lib
+            from jwt.api_jwk import PyJWKSet
+            from jwt.exceptions import PyJWKClientError
         except ImportError as caught_exc:  # pragma: NO COVER
             raise ImportError(
                 "The pyjwt library is not installed, please install the pyjwt package to use the jwk certs format."
             ) from caught_exc
-        jwks_client = jwt_lib.PyJWKClient(certs_url)
-        signing_key = jwks_client.get_signing_key_from_jwt(id_token)
+        jwkset = PyJWKSet.from_dict(certs)
+        header = jwt_lib.get_unverified_header(id_token)
+        kid = header.get("kid")
+
+        signing_key = None
+        for key in jwkset.keys:
+            if kid and key.key_id == kid and key.public_key_use in ("sig", None):
+                signing_key = key
+                break
+
+        if signing_key is None:
+            raise PyJWKClientError(
+                f'Unable to find a signing key that matches: "{kid}"'
+            )
+
         return jwt_lib.decode(
             id_token,
             signing_key.key,

{google_auth-2.56.2 → google_auth-2.56.3}/google/oauth2/webauthn_handler.py

@@ -57,9 +57,24 @@ class PluginHandler(WebAuthnHandler):
         request = length_bytes_le + input_json.encode()
 
         # Call plugin
-        process_result = subprocess.run(
-            [cmd], input=request, capture_output=True, check=True
-        )
+        process_result = subprocess.run([cmd], input=request, capture_output=True)
+
+        if process_result.returncode != 0:
+            stdout_bytes = process_result.stdout
+            if (
+                len(stdout_bytes) >= 4
+                and struct.unpack("<I", stdout_bytes[:4])[0] == len(stdout_bytes) - 4
+            ):
+                stdout_bytes = stdout_bytes[4:]
+
+            error_msg = "Command '{}' returned non-zero exit status {}.\nStdout: {}\nStderr: {}".format(
+                cmd,
+                process_result.returncode,
+                stdout_bytes.decode(errors="replace").strip(),
+                process_result.stderr.decode(errors="replace").strip(),
+            )
+
+            raise exceptions.GoogleAuthError(error_msg)
 
         # Check length of response
         response_len_le = process_result.stdout[:4]

{google_auth-2.56.2 → google_auth-2.56.3/google_auth.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: google-auth
-Version: 2.56.2
+Version: 2.56.3
 Summary: Google Authentication Library
 Home-page: https://github.com/googleapis/google-cloud-python/tree/main/packages/google-auth
 Author: Google Cloud Platform

{google_auth-2.56.2 → google_auth-2.56.3}/setup.py

@@ -15,8 +15,7 @@
 import io
 import os
 
-from setuptools import find_namespace_packages
-from setuptools import setup
+from setuptools import find_namespace_packages, setup
 
 cryptography_base_require = [
     "cryptography >= 38.0.3; python_version < '3.14'",

{google_auth-2.56.2 → google_auth-2.56.3}/tests/oauth2/test_id_token.py

@@ -86,28 +86,66 @@ def test_verify_token(_fetch_certs, decode):
 
 
 @mock.patch("google.oauth2.id_token._fetch_certs", autospec=True)
-@mock.patch("jwt.PyJWKClient", autospec=True)
+@mock.patch("jwt.api_jwk.PyJWKSet", autospec=True)
+@mock.patch("jwt.get_unverified_header", autospec=True)
 @mock.patch("jwt.decode", autospec=True)
-def test_verify_token_jwk(decode, py_jwk, _fetch_certs):
+def test_verify_token_jwk(decode, get_unverified_header, py_jwk_set, _fetch_certs):
     certs_url = "abc123"
     data = {"keys": [{"alg": "RS256"}]}
     _fetch_certs.return_value = data
+    get_unverified_header.return_value = {"kid": "mock-kid"}
+
+    mock_key = mock.MagicMock()
+    mock_key.key_id = "mock-kid"
+    mock_key.public_key_use = "sig"
+    mock_key.key = mock.sentinel.key
+    mock_key.algorithm_name = "mock-alg"
+    py_jwk_set.from_dict.return_value.keys = [mock_key]
     result = id_token.verify_token(
         mock.sentinel.token, mock.sentinel.request, certs_url=certs_url
     )
     assert result == decode.return_value
-    py_jwk.assert_called_once_with(certs_url)
-    signing_key = py_jwk.return_value.get_signing_key_from_jwt
+    py_jwk_set.from_dict.assert_called_once_with(data)
+    get_unverified_header.assert_called_once_with(mock.sentinel.token)
+
     _fetch_certs.assert_called_once_with(mock.sentinel.request, certs_url)
-    signing_key.assert_called_once_with(mock.sentinel.token)
     decode.assert_called_once_with(
         mock.sentinel.token,
-        signing_key.return_value.key,
-        algorithms=[signing_key.return_value.algorithm_name],
+        mock.sentinel.key,
+        algorithms=["mock-alg"],
         audience=None,
     )
 
 
+@mock.patch("google.oauth2.id_token._fetch_certs", autospec=True)
+@mock.patch("jwt.api_jwk.PyJWKSet", autospec=True)
+@mock.patch("jwt.get_unverified_header", autospec=True)
+@mock.patch("jwt.decode", autospec=True)
+def test_verify_token_jwk_missing_kid(
+    decode, get_unverified_header, py_jwk_set, _fetch_certs
+):
+    from jwt.exceptions import PyJWKClientError
+
+    certs_url = "abc123"
+    data = {"keys": [{"alg": "RS256"}]}
+    _fetch_certs.return_value = data
+    get_unverified_header.return_value = {"kid": "mock-kid"}
+
+    mock_key = mock.MagicMock()
+    mock_key.key_id = "different-kid"
+    mock_key.public_key_use = "sig"
+    mock_key.key = mock.sentinel.key
+    mock_key.algorithm_name = "mock-alg"
+    py_jwk_set.from_dict.return_value.keys = [mock_key]
+
+    with pytest.raises(
+        PyJWKClientError, match='Unable to find a signing key that matches: "mock-kid"'
+    ):
+        id_token.verify_token(
+            mock.sentinel.token, mock.sentinel.request, certs_url=certs_url
+        )
+
+
 @mock.patch("google.auth.jwt.decode", autospec=True)
 @mock.patch("google.oauth2.id_token._fetch_certs", autospec=True)
 def test_verify_token_args(_fetch_certs, decode):

{google_auth-2.56.2 → google_auth-2.56.3}/tests/oauth2/test_webauthn_handler.py

@@ -49,6 +49,7 @@ def test_malformated_get_assertion_response(os_get_stub, subprocess_run_stub):
     response_len = struct.pack("<I", 5)
     response = "1234567890"
     mock_response = mock.Mock()
+    mock_response.returncode = 0
     mock_response.stdout = response_len + response.encode()
     subprocess_run_stub.return_value = mock_response
 
@@ -68,6 +69,7 @@ def test_failure_get_assertion(os_get_stub, subprocess_run_stub):
 
     # process returns get response in json
     mock_response = mock.Mock()
+    mock_response.returncode = 0
     mock_response.stdout = response_len + response_json
     subprocess_run_stub.return_value = mock_response
 
@@ -96,6 +98,7 @@ def test_success_get_assertion(os_get_stub, subprocess_run_stub):
 
     # process returns get response in json
     mock_response = mock.Mock()
+    mock_response.returncode = 0
     mock_response.stdout = valid_plugin_response_len + valid_plugin_response_json
     subprocess_run_stub.return_value = mock_response
 
@@ -146,3 +149,21 @@ def test_success_get_assertion(os_get_stub, subprocess_run_stub):
     assert (
         got_response.response.user_handle == success_response["response"]["userHandle"]
     )
+
+
+def test_plugin_nonzero_exit(os_get_stub, subprocess_run_stub):
+    response_json = b"detailed_gnubby_internal_crash_log"
+    response_len = struct.pack("<I", len(response_json))
+
+    mock_response = mock.Mock()
+    mock_response.returncode = 1
+    mock_response.stdout = response_len + response_json
+    mock_response.stderr = b"stderr dump"
+    subprocess_run_stub.return_value = mock_response
+
+    test_handler = webauthn_handler.PluginHandler()
+    with pytest.raises(exceptions.GoogleAuthError) as excinfo:
+        test_handler.get(GET_ASSERTION_REQUEST)
+
+    assert "returned non-zero exit status 1" in str(excinfo.value)
+    assert "detailed_gnubby_internal_crash_log" in str(excinfo.value)

{google_auth-2.56.2 → google_auth-2.56.3}/tests/transport/aio/test_sessions.py

@@ -335,6 +335,32 @@ class TestAsyncAuthorizedSession(object):
             assert await response.read() == expected_payload
             response = await authed_session.close()
 
+    @pytest.mark.asyncio
+    async def test_configure_mtls_channel_with_custom_transport_and_broken_cert(self):
+        auth_request = MockRequest()
+        authed_session = sessions.AsyncAuthorizedSession(
+            self.credentials, auth_request=auth_request
+        )
+
+        with patch(
+            "google.auth.transport._mtls_helper.check_use_client_cert",
+            return_value=True,
+        ):
+
+            def callback():
+                return b"invalid-cert", b"invalid-key"
+
+            with pytest.warns(
+                UserWarning,
+                match="Attempted to establish mTLS, but a custom async transport was provided",
+            ):
+                await authed_session.configure_mtls_channel(callback)
+
+            assert authed_session._is_mtls is False
+            assert authed_session._cached_cert is None
+
+        await authed_session.close()
+
 
 def test_mock_request_clone():
     request = MockRequest()

{google_auth-2.56.2 → google_auth-2.56.3}/tests/transport/aio/test_sessions_mtls.py

@@ -193,9 +193,7 @@ class TestSessionsMtls:
             # If the request handler is not an AiohttpRequest, the library cannot configure
             # the connection to use mTLS, so _is_mtls must be False to reflect this unconfigured state.
             assert session._is_mtls is False
-            mock_make_context.assert_called_once_with(
-                b"fake_cert_data", b"fake_key_data"
-            )
+            mock_make_context.assert_not_called()
             await session.close()
 
     @pytest.mark.asyncio

{google_auth-2.56.2 → google_auth-2.56.3}/tests/transport/test_grpc.py

@@ -132,6 +132,35 @@ class TestAuthMetadataPlugin(object):
             "https://{}/".format(default_host)
         )
 
+    def test_suppress_metrics_header(self):
+        credentials = mock.create_autospec(service_account.Credentials)
+
+        # Mock credentials before_request that adds metric and authorization
+        def mock_before_request(request, method, url, headers):
+            headers["x-goog-api-client"] = "foo"
+            headers["authorization"] = "Bearer token"
+
+        credentials.before_request.side_effect = mock_before_request
+        request = mock.create_autospec(transport.Request)
+
+        # By default, suppress_metrics_header=False
+        plugin = google.auth.transport.grpc.AuthMetadataPlugin(credentials, request)
+        context = mock.create_autospec(grpc.AuthMetadataContext, instance=True)
+        context.method_name = "methodName"
+        context.service_url = "https://pubsub.googleapis.com/methodName"
+
+        headers = dict(plugin._get_authorization_headers(context))
+        assert "x-goog-api-client" in headers
+        assert headers["x-goog-api-client"] == "foo"
+
+        # With suppress_metrics_header=True
+        plugin_suppressed = google.auth.transport.grpc.AuthMetadataPlugin(
+            credentials, request, suppress_metrics_header=True
+        )
+        headers_suppressed = dict(plugin_suppressed._get_authorization_headers(context))
+        assert "x-goog-api-client" not in headers_suppressed
+        assert headers_suppressed["authorization"] == "Bearer token"
+
 
 @mock.patch(
     "google.auth.transport._mtls_helper.get_client_ssl_credentials", autospec=True

{google_auth-2.56.2 → google_auth-2.56.3}/tests/transport/test_requests.py

@@ -213,6 +213,7 @@ def make_response(status=http_client.OK, data=None):
 
 class TestAuthorizedSession(object):
     TEST_URL = "http://example.com/"
+    MTLS_TEST_URL = "https://example.mtls.googleapis.com/"
 
     def test_constructor(self):
         authed_session = google.auth.transport.requests.AuthorizedSession(
@@ -727,7 +728,7 @@ class TestAuthorizedSession(object):
         authed_session = google.auth.transport.requests.AuthorizedSession(
             credentials, refresh_timeout=60
         )
-        authed_session.mount(self.TEST_URL, adapter)
+        authed_session.mount(self.MTLS_TEST_URL, adapter)
 
         old_cert = b"-----BEGIN CERTIFICATE-----\nMIIBdTCCARqgAwIBAgIJAOYVvu/axMxvMAoGCCqGSM49BAMCMCcxJTAjBgNVBAMM\nHEdvb2dsZSBFbmRwb2ludCBWZXJpZmljYXRpb24wHhcNMjUwNzMwMjMwNjA4WhcN\nMjYwNzMxMjMwNjA4WjAnMSUwIwYDVQQDDBxHb29nbGUgRW5kcG9pbnQgVmVyaWZp\nY2F0aW9uMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbtr18gkEtwPow2oqyZsU\n4KLwFaLFlRlYv55UATS3QTDykDnIufC42TJCnqFRYhwicwpE2jnUV+l9g3Voias8\nraMvMC0wCQYDVR0TBAIwADALBgNVHQ8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUH\nAwIwCgYIKoZIzj0EAwIDSQAwRgIhAKcjW6dmF1YCksXPgDPlPu/nSnOjb3qCcivz\n/Jxq2zoeAiEA7/aNxcEoCGS3hwMIXoaaD/vPcZOOopKSyqXCvxRooKQ=\n-----END CERTIFICATE-----\n"
 
@@ -745,7 +746,7 @@ class TestAuthorizedSession(object):
             "call_client_cert_callback",
             return_value=(new_cert, new_key),
         ) as mock_callback:
-            result = authed_session.request("GET", self.TEST_URL)
+            result = authed_session.request("GET", self.MTLS_TEST_URL)
 
         # Asserts to verify the behavior.
         assert mock_callback.called
@@ -766,7 +767,7 @@ class TestAuthorizedSession(object):
         authed_session = google.auth.transport.requests.AuthorizedSession(
             credentials, refresh_timeout=60
         )
-        authed_session.mount(self.TEST_URL, adapter)
+        authed_session.mount(self.MTLS_TEST_URL, adapter)
         authed_session._is_mtls = True
 
         old_cert = CERT_MOCK_VAL
@@ -784,7 +785,7 @@ class TestAuthorizedSession(object):
             "call_client_cert_callback",
             return_value=(new_cert, new_key),
         ):
-            result = authed_session.request("GET", self.TEST_URL)
+            result = authed_session.request("GET", self.MTLS_TEST_URL)
 
         # Asserts to verify the behavior.
         assert credentials.refresh.call_count == 2
@@ -832,11 +833,11 @@ class TestAuthorizedSession(object):
         authed_session = google.auth.transport.requests.AuthorizedSession(
             credentials, refresh_timeout=60
         )
-        authed_session.mount(self.TEST_URL, adapter)
+        authed_session.mount(self.MTLS_TEST_URL, adapter)
 
         authed_session._is_mtls = True
 
-        result = authed_session.request("GET", self.TEST_URL)
+        result = authed_session.request("GET", self.MTLS_TEST_URL)
         assert result.status_code == final_response.status_code
 
         # Asserts to verify the behavior.
@@ -851,7 +852,7 @@ class TestAuthorizedSession(object):
         authed_session = google.auth.transport.requests.AuthorizedSession(
             credentials, refresh_timeout=60
         )
-        authed_session.mount(self.TEST_URL, adapter)
+        authed_session.mount(self.MTLS_TEST_URL, adapter)
 
         old_cert = b"-----BEGIN CERTIFICATE-----\nMIIBdTCCARqgAwIBAgIJAOYVvu/axMxvMAoGCCqGSM49BAMCMCcxJTAjBgNVBAMM\nHEdvb2dsZSBFbmRwb2ludCBWZXJpZmljYXRpb24wHhcNMjUwNzMwMjMwNjA4WhcN\nMjYwNzMxMjMwNjA4WjAnMSUwIwYDVQQDDBxHb29nbGUgRW5kcG9pbnQgVmVyaWZp\nY2F0aW9uMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbtr18gkEtwPow2oqyZsU\n4KLwFaLFlRlYv55UATS3QTDykDnIufC42TJCnqFRYhwicwpE2jnUV+l9g3Voias8\nraMvMC0wCQYDVR0TBAIwADALBgNVHQ8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUH\nAwIwCgYIKoZIzj0EAwIDSQAwRgIhAKcjW6dmF1YCksXPgDPlPu/nSnOjb3qCcivz\n/Jxq2zoeAiEA7/aNxcEoCGS3hwMIXoaaD/vPcZOOopKSyqXCvxRooKQ=\n-----END CERTIFICATE-----\n"
 
@@ -873,7 +874,7 @@ class TestAuthorizedSession(object):
                 side_effect=Exception("Failed to reconfigure"),
             ):
                 with pytest.raises(exceptions.MutualTLSChannelError):
-                    authed_session.request("GET", self.TEST_URL)
+                    authed_session.request("GET", self.MTLS_TEST_URL)
 
                 # Assert to verify behavior
                 credentials.refresh.assert_not_called()
@@ -885,7 +886,7 @@ class TestAuthorizedSession(object):
         authed_session = google.auth.transport.requests.AuthorizedSession(
             credentials, refresh_timeout=60
         )
-        authed_session.mount(self.TEST_URL, adapter)
+        authed_session.mount(self.MTLS_TEST_URL, adapter)
         authed_session._is_mtls = True
         authed_session._cached_cert = b"cached_cert"
 
@@ -894,7 +895,7 @@ class TestAuthorizedSession(object):
             side_effect=Exception("check_params failed"),
         ) as mock_check_params:
             with pytest.raises(Exception, match="check_params failed"):
-                authed_session.request("GET", self.TEST_URL)
+                authed_session.request("GET", self.MTLS_TEST_URL)
 
             mock_check_params.assert_called_once()
             credentials.refresh.assert_not_called()
@@ -920,7 +921,7 @@ class TestAuthorizedSession(object):
         authed_session = google.auth.transport.requests.AuthorizedSession(
             credentials, refresh_status_codes=custom_refresh_codes
         )
-        authed_session.mount(self.TEST_URL, adapter)
+        authed_session.mount(self.MTLS_TEST_URL, adapter)
 
         # Enable mTLS to prove it is skipped despite being enabled
         authed_session._is_mtls = True
@@ -928,7 +929,7 @@ class TestAuthorizedSession(object):
         with mock.patch(
             "google.auth.transport.requests._mtls_helper", autospec=True
         ) as mock_helper:
-            authed_session.request("GET", self.TEST_URL)
+            authed_session.request("GET", self.MTLS_TEST_URL)
 
             # Assert refresh happened (Outer Check was True)
             assert credentials.refresh.called
@@ -936,6 +937,36 @@ class TestAuthorizedSession(object):
             # Assert mTLS check logic was SKIPPED (Inner Check was False)
             assert not mock_helper.check_parameters_for_unauthorized_response.called
 
+    def test_cert_rotation_skipped_on_non_mtls_url(self):
+        """
+        Tests that mTLS cert rotation is skipped on a non-mTLS URL even if
+        mTLS is enabled and an UNAUTHORIZED (401) response is received.
+        """
+        credentials = mock.Mock(wraps=CredentialsStub())
+        # First request will 401, second request will succeed.
+        adapter = AdapterStub(
+            [
+                make_response(status=http_client.UNAUTHORIZED),
+                make_response(status=http_client.OK),
+            ]
+        )
+        authed_session = google.auth.transport.requests.AuthorizedSession(
+            credentials, refresh_timeout=60
+        )
+        authed_session.mount(self.TEST_URL, adapter)
+        authed_session._is_mtls = True
+
+        with mock.patch(
+            "google.auth.transport.requests._mtls_helper", autospec=True
+        ) as mock_helper:
+            authed_session.request("GET", self.TEST_URL)
+
+            # Assert refresh happened
+            assert credentials.refresh.called
+
+            # Assert mTLS check logic was SKIPPED
+            assert not mock_helper.check_parameters_for_unauthorized_response.called
+
     def test_configure_mtls_channel_subsequent_failure(self):
         # 1. Setup successful mTLS configuration
         mock_callback = mock.Mock()