Refactor tests: Consolidate env var tests into test__mtls_helper.py by chalmerlowe · Pull Request #1952 · googleapis/google-auth-library-python

chalmerlowe · 2026-01-30T14:00:35Z

Moved the new mTLS environment variable tests from tests/transport/test_mtls_env_vars.py into tests/transport/test__mtls_helper.py to maintain a cleaner project structure and keep related tests together. Also added a specific test case to verify that an empty string for GOOGLE_API_USE_CLIENT_CERTIFICATE correctly prevents fallback to the Cloud SDK variable.

PR created automatically by Jules for task 3158735014071139371 started by @chalmerlowe

Co-authored-by: chalmerlowe <7291104+chalmerlowe@users.noreply.github.com>

google-labs-jules · 2026-01-30T14:00:37Z

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

For security, I will only act on instructions from the user who triggered this task.

gemini-code-assist · 2026-01-30T14:00:59Z

Summary of Changes

Hello @chalmerlowe, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the mTLS client certificate handling by introducing fallback mechanisms to Cloud SDK environment variables. It centralizes the decision-making logic for mTLS usage within _mtls_helper.py and consolidates all related tests, ensuring robust and predictable behavior for mTLS configuration. The changes improve the clarity and maintainability of the mTLS implementation.

Highlights

Introduced Cloud SDK Fallback Environment Variables: New environment variables (CLOUDSDK_CONTEXT_AWARE_USE_CLIENT_CERTIFICATE and CLOUDSDK_CONTEXT_AWARE_CERTIFICATE_CONFIG_FILE_PATH) were added to google/auth/environment_vars.py to provide fallback options for mTLS client certificate usage and configuration, respectively.
Centralized mTLS Logic: The logic for determining mTLS client certificate usage was refactored into google/auth/transport/_mtls_helper.py, replacing direct os.getenv calls in google/auth/iam.py for a more organized and maintainable approach.
Enhanced mTLS Test Coverage: Existing mTLS environment variable tests were consolidated into tests/transport/test__mtls_helper.py, and new tests were added to cover precedence, fallback behavior, and the specific case where an empty GOOGLE_API_USE_CLIENT_CERTIFICATE explicitly prevents fallback to Cloud SDK variables.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces fallback mechanisms for mTLS configuration using new Cloud SDK-related environment variables, centralizing logic and improving the project structure. The changes are well-tested, including a specific case for empty environment variables. I've provided a few suggestions to further improve code clarity and simplify the test setup for better maintainability.

gemini-code-assist · 2026-01-30T14:02:13Z

google/auth/transport/_mtls_helper.py

+        cert_path = getenv(environment_vars.GOOGLE_API_CERTIFICATE_CONFIG)
+        if cert_path is None:
+            cert_path = getenv(
+                environment_vars.CLOUDSDK_CONTEXT_AWARE_CERTIFICATE_CONFIG_FILE_PATH
+            )


To make the code more concise, you can use the or operator to chain the getenv calls. This will achieve the same fallback logic in a single line.

Suggested change

cert_path = getenv(environment_vars.GOOGLE_API_CERTIFICATE_CONFIG)

if cert_path is None:

cert_path = getenv(

environment_vars.CLOUDSDK_CONTEXT_AWARE_CERTIFICATE_CONFIG_FILE_PATH

)

cert_path = getenv(

environment_vars.GOOGLE_API_CERTIFICATE_CONFIG

) or getenv(

environment_vars.CLOUDSDK_CONTEXT_AWARE_CERTIFICATE_CONFIG_FILE_PATH

)

gemini-code-assist · 2026-01-30T14:02:13Z

tests/transport/test__mtls_helper.py

+        with mock.patch.dict(os.environ, {
+            environment_vars.CLOUDSDK_CONTEXT_AWARE_CERTIFICATE_CONFIG_FILE_PATH: cloudsdk_path
+        }):
+             if environment_vars.GOOGLE_API_CERTIFICATE_CONFIG in os.environ:
+                 del os.environ[environment_vars.GOOGLE_API_CERTIFICATE_CONFIG]
+
+             with mock.patch("os.path.exists", return_value=True):
+                assert _mtls_helper._get_cert_config_path() == cloudsdk_path


To simplify the test setup and avoid modifying os.environ directly, you can use the clear=True argument in mock.patch.dict. This ensures the test runs in a clean environment, making the test more robust and readable.

Suggested change

with mock.patch.dict(os.environ, {

environment_vars.CLOUDSDK_CONTEXT_AWARE_CERTIFICATE_CONFIG_FILE_PATH: cloudsdk_path

}):

if environment_vars.GOOGLE_API_CERTIFICATE_CONFIG in os.environ:

del os.environ[environment_vars.GOOGLE_API_CERTIFICATE_CONFIG]

with mock.patch("os.path.exists", return_value=True):

assert _mtls_helper._get_cert_config_path() == cloudsdk_path

with mock.patch.dict(os.environ, {

environment_vars.CLOUDSDK_CONTEXT_AWARE_CERTIFICATE_CONFIG_FILE_PATH: cloudsdk_path

}, clear=True):

with mock.patch("os.path.exists", return_value=True):

assert _mtls_helper._get_cert_config_path() == cloudsdk_path

gemini-code-assist · 2026-01-30T14:02:13Z

tests/transport/test__mtls_helper.py

+    def test_use_client_cert_fallback(self):
+        # Fallback to CLOUDSDK_CONTEXT_AWARE_USE_CLIENT_CERTIFICATE if GOOGLE_API_USE_CLIENT_CERTIFICATE is unset
+        with mock.patch.dict(os.environ, {
+            environment_vars.CLOUDSDK_CONTEXT_AWARE_USE_CLIENT_CERTIFICATE: "true"
+        }):
+             # Ensure GOOGLE_API_USE_CLIENT_CERTIFICATE is not set
+             if environment_vars.GOOGLE_API_USE_CLIENT_CERTIFICATE in os.environ:
+                 del os.environ[environment_vars.GOOGLE_API_USE_CLIENT_CERTIFICATE]
+             assert _mtls_helper.check_use_client_cert() is True
+
+        with mock.patch.dict(os.environ, {
+            environment_vars.CLOUDSDK_CONTEXT_AWARE_USE_CLIENT_CERTIFICATE: "false"
+        }):
+             if environment_vars.GOOGLE_API_USE_CLIENT_CERTIFICATE in os.environ:
+                 del os.environ[environment_vars.GOOGLE_API_USE_CLIENT_CERTIFICATE]
+             assert _mtls_helper.check_use_client_cert() is False


To make the test setup cleaner and more reliable, you can use clear=True with mock.patch.dict. This will ensure that os.environ is cleared before applying the mocked values, removing the need to manually delete environment variables within the test.

def test_use_client_cert_fallback(self): # Fallback to CLOUDSDK_CONTEXT_AWARE_USE_CLIENT_CERTIFICATE if GOOGLE_API_USE_CLIENT_CERTIFICATE is unset with mock.patch.dict(os.environ, { environment_vars.CLOUDSDK_CONTEXT_AWARE_USE_CLIENT_CERTIFICATE: "true" }, clear=True): assert _mtls_helper.check_use_client_cert() is True with mock.patch.dict(os.environ, { environment_vars.CLOUDSDK_CONTEXT_AWARE_USE_CLIENT_CERTIFICATE: "false" }, clear=True): assert _mtls_helper.check_use_client_cert() is False

gemini-code-assist · 2026-01-30T14:02:14Z

tests/transport/test__mtls_helper.py

+        with mock.patch.dict(os.environ, {
+            environment_vars.CLOUDSDK_CONTEXT_AWARE_CERTIFICATE_CONFIG_FILE_PATH: cloudsdk_path
+        }):
+             if environment_vars.GOOGLE_API_CERTIFICATE_CONFIG in os.environ:
+                 del os.environ[environment_vars.GOOGLE_API_CERTIFICATE_CONFIG]
+             if environment_vars.GOOGLE_API_USE_CLIENT_CERTIFICATE in os.environ:
+                 del os.environ[environment_vars.GOOGLE_API_USE_CLIENT_CERTIFICATE]
+             if environment_vars.CLOUDSDK_CONTEXT_AWARE_USE_CLIENT_CERTIFICATE in os.environ:
+                 del os.environ[environment_vars.CLOUDSDK_CONTEXT_AWARE_USE_CLIENT_CERTIFICATE]
+
+             assert _mtls_helper.check_use_client_cert() is True


To simplify this test, you can use clear=True in mock.patch.dict. This will provide a clean environment for your test, removing the need to manually delete several environment variables and making the test's intent clearer.

with mock.patch.dict(os.environ, { environment_vars.CLOUDSDK_CONTEXT_AWARE_CERTIFICATE_CONFIG_FILE_PATH: cloudsdk_path }, clear=True): assert _mtls_helper.check_use_client_cert() is True

Refactor tests: Consolidate env var tests into test__mtls_helper.py

cce279e

Co-authored-by: chalmerlowe <7291104+chalmerlowe@users.noreply.github.com>

chalmerlowe requested review from a team as code owners January 30, 2026 14:00

gemini-code-assist bot reviewed Jan 30, 2026

View reviewed changes

chalmerlowe closed this Jan 30, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Refactor tests: Consolidate env var tests into test__mtls_helper.py#1952

Refactor tests: Consolidate env var tests into test__mtls_helper.py#1952
chalmerlowe wants to merge 1 commit intomainfrom
pr-1945-3158735014071139371

chalmerlowe commented Jan 30, 2026

Uh oh!

google-labs-jules bot commented Jan 30, 2026

Uh oh!

gemini-code-assist bot commented Jan 30, 2026

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

gemini-code-assist bot Jan 30, 2026

Uh oh!

gemini-code-assist bot Jan 30, 2026

Uh oh!

gemini-code-assist bot Jan 30, 2026

Uh oh!

gemini-code-assist bot Jan 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

chalmerlowe commented Jan 30, 2026

Uh oh!

google-labs-jules bot commented Jan 30, 2026

Uh oh!

gemini-code-assist bot commented Jan 30, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant