fix(gax): address mTLS cert config parsing and channel refresh lifecycle edge cases

Author: macastelaz

sdk-platform-java/gax-java/gax-httpjson/src/main/java/com/google/api/gax/httpjson/RefreshingHttpJsonChannel.java

@@ -35,13 +35,15 @@
 import com.google.api.gax.httpjson.ForwardingHttpJsonClientCallListener.SimpleForwardingHttpJsonClientCallListener;
 import com.google.api.gax.rpc.mtls.WorkloadCertificateUtils;
 import com.google.common.annotations.VisibleForTesting;
+import java.util.concurrent.CancellationException;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicInteger;
 import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.Supplier;
 import java.util.logging.Level;
 import java.util.logging.Logger;
+import org.jspecify.annotations.Nullable;
 
 /**
  * An implementation of {@link ManagedHttpJsonChannel} that supports dynamic mTLS certificate
@@ -240,7 +242,6 @@ public void shutdownNow() {
     synchronized (refreshLock) {
       isShuttingDown = true;
       for (ChannelEntry entry : allEntries) {
-        entry.requestShutdown();
         entry.channel.shutdownNow();
       }
     }
@@ -329,6 +330,7 @@ private void shutdown() {
   private static class ReleasingHttpJsonClientCall<ReqT, RespT>
       extends SimpleForwardingHttpJsonClientCall<ReqT, RespT> {
 
+    private @Nullable CancellationException cancellationException;
     private final ChannelEntry entry;
     private final AtomicBoolean wasClosed = new AtomicBoolean(false);
     private final AtomicBoolean wasReleased = new AtomicBoolean(false);
@@ -340,6 +342,12 @@ private static class ReleasingHttpJsonClientCall<ReqT, RespT>
 
     @Override
     public void start(Listener<RespT> responseListener, HttpJsonMetadata requestHeaders) {
+      if (cancellationException != null) {
+        if (wasReleased.compareAndSet(false, true)) {
+          entry.release();
+        }
+        throw new IllegalStateException("Call is already cancelled", cancellationException);
+      }
       try {
         super.start(
             new SimpleForwardingHttpJsonClientCallListener<RespT>(responseListener) {
@@ -365,5 +373,11 @@ public void onClose(int statusCode, HttpJsonMetadata trailers) {
         throw e;
       }
     }
+
+    @Override
+    public void cancel(@Nullable String message, @Nullable Throwable cause) {
+      this.cancellationException = new CancellationException(message);
+      super.cancel(message, cause);
+    }
   }
 }

sdk-platform-java/gax-java/gax/src/main/java/com/google/api/gax/rpc/mtls/CertificateBasedAccess.java

@@ -111,8 +111,7 @@ private CertificateConfig parseCertificateConfig(String configPath) throws IOExc
     String keyPath = extractJsonValue(content, "key_path");
 
     if (certPath == null || keyPath == null) {
-      throw new IllegalStateException(
-          "Malformed certificate config JSON. Must contain 'cert_path' and 'key_path'.");
+      return null;
     }
 
     return new CertificateConfig(certPath, keyPath);
@@ -176,6 +175,9 @@ private boolean validateAndResolveConfig(String configPath) {
     }
     try {
       CertificateConfig config = parseCertificateConfig(configPath);
+      if (config == null) {
+        return false;
+      }
       if (!fileExistenceProvider.exists(config.certPath)
           || !fileExistenceProvider.exists(config.keyPath)) {
         throw new IllegalStateException(
@@ -216,7 +218,7 @@ public String getWorkloadCertPath() {
     if (certConfigPath != null && !certConfigPath.isEmpty()) {
       try {
         CertificateConfig config = parseCertificateConfig(certConfigPath);
-        return config.certPath;
+        return config != null ? config.certPath : null;
       } catch (Exception e) {
         throw new IllegalStateException("Failed to parse GOOGLE_API_CERTIFICATE_CONFIG", e);
       }

sdk-platform-java/gax-java/gax/src/test/java/com/google/api/gax/rpc/mtls/CertificateBasedAccessTest.java

@@ -208,7 +208,7 @@ void testUseMtlsClientCertificateEnvTrueOverride() {
   }
 
   @Test
-  void testUseMtlsClientCertificateConfigMalformedJson() {
+  void testUseMtlsClientCertificateConfigNonWorkloadJson() {
     TestEnv env = new TestEnv();
     env.set("GOOGLE_API_CERTIFICATE_CONFIG", "/path/to/config.json");
 
@@ -217,9 +217,7 @@ void testUseMtlsClientCertificateConfigMalformedJson() {
 
     CertificateBasedAccess cba = createCba(env, fs);
 
-    IllegalStateException ex =
-        assertThrows(IllegalStateException.class, cba::useMtlsClientCertificate);
-    assertTrue(ex.getMessage().contains("Failed to parse or validate certificate config"));
+    assertFalse(cba.useMtlsClientCertificate());
   }
 
   @Test