Files
Jan WojtasandJoão Westerberg 8db87f44e4 fix(auth): keep the init context alive so token sources can refresh (#1904)
lazyTokenSource bounded init with context.WithTimeout and canceled the
context as soon as init returned. A golang.org/x/oauth2 token source
keeps the context it was built on and makes its token requests on it, so
a credential from ADC() or ServiceAccount() was minting on a dead
context. For local gcloud ADC and for impersonated service accounts,
which hold no token at construction, that meant every mint failed with
"context canceled" from the first one.

Bound init with a timer that cancels the context only while init is
still running, and stop the timer once init returns. The source then
holds a context that is never canceled, while a hung init is still cut
off after initTimeout. An init that outruns the bound now fails even if
it returned a source, since that source cannot mint a token, and the
error keeps the text of init's own error without its chain: that chain
carries the init context's context.Canceled, which callers reading
cancellation as control flow would mistake for a cancellation.

For: b/556734005

Co-authored-by: João Westerberg <westerberg@google.com>
2026-10-27 11:52:05 +01:00
..