feat(auth): add CredentialStore and cache GCP credentials#1174
Open
wolo-lab wants to merge 1 commit into
Open
Conversation
wolo-lab
force-pushed
the
wolo/auth-store-cache
branch
from
July 18, 2026 20:44
995f518 to
32dc472
Compare
wolo-lab
force-pushed
the
wolo/auth-gcp-provider
branch
from
July 18, 2026 20:44
a46455a to
421a856
Compare
wolo-lab
force-pushed
the
wolo/auth-store-cache
branch
from
July 18, 2026 23:33
32dc472 to
d392cd9
Compare
wolo-lab
force-pushed
the
wolo/auth-gcp-provider
branch
from
July 18, 2026 23:33
421a856 to
eadd5a6
Compare
wolo-lab
force-pushed
the
wolo/auth-store-cache
branch
from
July 19, 2026 14:48
eb90b2c to
b8ec0e5
Compare
wolo-lab
marked this pull request as ready for review
July 19, 2026 14:58
wolo-lab
force-pushed
the
wolo/auth-gcp-provider
branch
3 times, most recently
from
July 20, 2026 11:49
c65d414 to
9186dc4
Compare
wolo-lab
force-pushed
the
wolo/auth-store-cache
branch
2 times, most recently
from
July 22, 2026 19:51
df296cf to
725560f
Compare
wolo-lab
force-pushed
the
wolo/auth-gcp-provider
branch
from
July 22, 2026 21:21
9186dc4 to
edeb3da
Compare
wolo-lab
force-pushed
the
wolo/auth-store-cache
branch
2 times, most recently
from
July 22, 2026 21:43
8376298 to
fe42c2e
Compare
Add auth.CredentialStore + InMemoryCredentialStore (concurrency-safe, per-entry expiry with a small clock-skew margin) and cache resolved GCP credentials in the provider, keyed by (app, user, resource). The client surfaces the service's expireTime via a Retrieval result so entries expire correctly; TokenSource-backed providers are self-caching and don't use it. Resolves the acting user via agent.IdentityFromContext (rebased onto the current auth/gcp provider).
wolo-lab
force-pushed
the
wolo/auth-gcp-provider
branch
from
July 22, 2026 22:27
edeb3da to
a4d444d
Compare
wolo-lab
force-pushed
the
wolo/auth-store-cache
branch
from
July 22, 2026 22:27
fe42c2e to
3b151ed
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The GCP provider (#1173) does a credential-service round-trip — plus up to a
~10s pending poll — on every request; there is no caching.
adk-python has an
InMemoryCredentialService.Summary
auth.CredentialStore+InMemoryCredentialStore: concurrency-safe,with per-entry expiry and a small clock-skew margin. TokenSource-backed
providers are self-caching and do not need it.
ProviderConfig.Store), keyed by (app, user, resource).Client.RetrieveCredentialnow returns a
*Retrievalthat surfaces the service'sexpireTime, so cacheentries expire correctly.
expiry means "unknown lifetime", and caching that would risk serving a stale
credential forever, so those results are not cached. Store writes are
best-effort (a write failure never fails auth).
agent.IdentityFromContext(from feat(auth/gcp): add GCP credential provider #1173) and keysthe cache on
id.AppName/id.UserID.