feat(auth): add CredentialStore and cache GCP credentials#1174
Open
wolo-lab wants to merge 2 commits into
Open
feat(auth): add CredentialStore and cache GCP credentials#1174wolo-lab wants to merge 2 commits into
wolo-lab wants to merge 2 commits into
Conversation
wolo-lab
force-pushed
the
wolo/auth-store-cache
branch
from
July 18, 2026 20:44
995f518 to
32dc472
Compare
wolo-lab
force-pushed
the
wolo/auth-gcp-provider
branch
from
July 18, 2026 20:44
a46455a to
421a856
Compare
Add auth.CredentialStore (keyed by app+user+slot) with an in-memory implementation, and use it in the GCP provider so a resolved credential is reused across requests instead of hitting the credential service on every tool call (each miss is a round-trip plus up to a ~10s pending poll). - auth.CredentialStore / InMemoryCredentialStore: concurrency-safe, agent-free (keyed by explicit strings), with per-entry expiry and a small clock-skew margin. TokenSource-backed providers are self-caching and do not need it. - gcp.Provider caches via the store (default in-memory, override with WithStore), keyed by (appName, userID, resource); the GCP client now surfaces the service's expireTime so entries expire correctly. Deferred (documented): SessionStateCredentialStore lands with the interactive consent flow (A3) — it persists across the consent round-trip and needs write access to session state, which the read-only RoundTripper/provider path does not have. Downstream-401 invalidation (force_refresh) is a follow-up.
wolo-lab
force-pushed
the
wolo/auth-store-cache
branch
from
July 18, 2026 23:33
32dc472 to
d392cd9
Compare
wolo-lab
force-pushed
the
wolo/auth-gcp-provider
branch
from
July 18, 2026 23:33
421a856 to
eadd5a6
Compare
…thod
RetrieveCredential was a thin public wrapper that dropped the expiry from an
unexported retrieve() the provider called directly, so the real prod path used
the unexported variant while the public one was test-only. Collapse both into a
single RetrieveCredential returning *Retrieval{Credential, ExpiresAt}, making
the expiry a documented public field (zero => "do not cache").
wolo-lab
force-pushed
the
wolo/auth-store-cache
branch
from
July 19, 2026 14:48
eb90b2c to
b8ec0e5
Compare
wolo-lab
marked this pull request as ready for review
July 19, 2026 14:58
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The GCP provider does a credential-service round-trip (plus up to a ~10s pending
poll) on every request; there is no caching. adk-python has an
InMemoryCredentialService.
Summary
with per-entry expiry and a small clock-skew margin. TokenSource-backed
providers are self-caching and do not need it.
`ProviderConfig.Store`), keyed by (app, user, resource); the client surfaces
the service's `expireTime` so entries expire correctly.