diff --git a/google-auth-library-java/appengine/java/com/google/auth/appengine/AppEngineCredentials.java b/google-auth-library-java/appengine/java/com/google/auth/appengine/AppEngineCredentials.java index 1cb1af1379c1..64138f46ced9 100644 --- a/google-auth-library-java/appengine/java/com/google/auth/appengine/AppEngineCredentials.java +++ b/google-auth-library-java/appengine/java/com/google/auth/appengine/AppEngineCredentials.java @@ -48,6 +48,8 @@ import java.util.Collection; import java.util.Date; import java.util.Objects; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** * OAuth2 credentials representing the built-in service account for Google App Engine. You should @@ -55,6 +57,7 @@ * *

Fetches access tokens from the App Identity service. */ +@NullMarked public class AppEngineCredentials extends GoogleCredentials implements ServiceAccountSigner { private static final long serialVersionUID = -2627708355455064660L; @@ -122,7 +125,7 @@ public String toString() { } @Override - public boolean equals(Object obj) { + public boolean equals(@Nullable Object obj) { if (!(obj instanceof AppEngineCredentials)) { return false; } diff --git a/google-auth-library-java/appengine/pom.xml b/google-auth-library-java/appengine/pom.xml index f7e0cac701da..7a23847b0669 100644 --- a/google-auth-library-java/appengine/pom.xml +++ b/google-auth-library-java/appengine/pom.xml @@ -93,5 +93,9 @@ error_prone_annotations compile + + org.jspecify + jspecify + diff --git a/google-auth-library-java/cab-token-generator/java/com/google/auth/credentialaccessboundary/ClientSideCredentialAccessBoundaryFactory.java b/google-auth-library-java/cab-token-generator/java/com/google/auth/credentialaccessboundary/ClientSideCredentialAccessBoundaryFactory.java index 136c931a8984..9fbb02d056ee 100644 --- a/google-auth-library-java/cab-token-generator/java/com/google/auth/credentialaccessboundary/ClientSideCredentialAccessBoundaryFactory.java +++ b/google-auth-library-java/cab-token-generator/java/com/google/auth/credentialaccessboundary/ClientSideCredentialAccessBoundaryFactory.java @@ -78,6 +78,8 @@ import java.util.Date; import java.util.List; import java.util.concurrent.ExecutionException; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** * A factory for generating downscoped access tokens using a client-side approach. @@ -136,6 +138,7 @@ * token, allowing for automatic token refreshes by providing a {@link * OAuth2CredentialsWithRefresh.OAuth2RefreshHandler}. */ +@NullMarked public class ClientSideCredentialAccessBoundaryFactory { static final Duration DEFAULT_REFRESH_MARGIN = Duration.ofMinutes(45); static final Duration DEFAULT_MINIMUM_TOKEN_LIFETIME = Duration.ofMinutes(30); @@ -144,9 +147,9 @@ public class ClientSideCredentialAccessBoundaryFactory { private final String tokenExchangeEndpoint; private final Duration minimumTokenLifetime; private final Duration refreshMargin; - private RefreshTask refreshTask; + private @Nullable RefreshTask refreshTask; private final Object refreshLock = new byte[0]; - private volatile IntermediateCredentials intermediateCredentials = null; + private volatile @Nullable IntermediateCredentials intermediateCredentials = null; private final Clock clock; private final CelCompiler celCompiler; diff --git a/google-auth-library-java/cab-token-generator/pom.xml b/google-auth-library-java/cab-token-generator/pom.xml index 25d66e0cf2ff..9eb725f5adb9 100644 --- a/google-auth-library-java/cab-token-generator/pom.xml +++ b/google-auth-library-java/cab-token-generator/pom.xml @@ -60,6 +60,10 @@ com.google.crypto.tink tink + + org.jspecify + jspecify + junit diff --git a/google-auth-library-java/credentials/BUILD.bazel b/google-auth-library-java/credentials/BUILD.bazel index 04e31f4a1713..44e177a484eb 100644 --- a/google-auth-library-java/credentials/BUILD.bazel +++ b/google-auth-library-java/credentials/BUILD.bazel @@ -1,5 +1,8 @@ java_library( name = "credentials", srcs = glob(["java/**/*.java"]), + deps = [ + "@org_jspecify_jspecify//jar", + ], visibility = ["//visibility:public"], ) diff --git a/google-auth-library-java/credentials/java/com/google/auth/ApiKeyCredentials.java b/google-auth-library-java/credentials/java/com/google/auth/ApiKeyCredentials.java index 8c454d0a9f66..97bd5c0fcbe5 100644 --- a/google-auth-library-java/credentials/java/com/google/auth/ApiKeyCredentials.java +++ b/google-auth-library-java/credentials/java/com/google/auth/ApiKeyCredentials.java @@ -35,6 +35,7 @@ import java.util.Collections; import java.util.List; import java.util.Map; +import org.jspecify.annotations.NullMarked; /** * Credentials class for calling Google APIs using an API key. @@ -49,6 +50,7 @@ * Credentials credentials = ApiKeyCredentials.create("your api key"); * */ +@NullMarked public class ApiKeyCredentials extends Credentials { static final String API_KEY_HEADER_KEY = "x-goog-api-key"; private final String apiKey; diff --git a/google-auth-library-java/credentials/java/com/google/auth/CredentialTypeForMetrics.java b/google-auth-library-java/credentials/java/com/google/auth/CredentialTypeForMetrics.java index 50c90365c322..ece1ed6f1d05 100644 --- a/google-auth-library-java/credentials/java/com/google/auth/CredentialTypeForMetrics.java +++ b/google-auth-library-java/credentials/java/com/google/auth/CredentialTypeForMetrics.java @@ -31,6 +31,8 @@ package com.google.auth; +import org.jspecify.annotations.NullMarked; + /** * Defines the different types of credentials that can be used for metrics. * @@ -44,6 +46,7 @@ * * @see #getLabel() */ +@NullMarked public enum CredentialTypeForMetrics { USER_CREDENTIALS("u"), SERVICE_ACCOUNT_CREDENTIALS_AT("sa"), diff --git a/google-auth-library-java/credentials/java/com/google/auth/Credentials.java b/google-auth-library-java/credentials/java/com/google/auth/Credentials.java index b1579db612a9..3c78490ea676 100644 --- a/google-auth-library-java/credentials/java/com/google/auth/Credentials.java +++ b/google-auth-library-java/credentials/java/com/google/auth/Credentials.java @@ -37,8 +37,11 @@ import java.util.List; import java.util.Map; import java.util.concurrent.Executor; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** Represents an abstract authorized identity instance. */ +@NullMarked public abstract class Credentials implements Serializable { private static final long serialVersionUID = 808575179767517313L; @@ -161,7 +164,8 @@ protected final void blockingGetToCallback(URI uri, RequestMetadataCallback call * implement {@link Retryable} and {@code isRetryable()} will return true if the operation may * be retried. */ - public abstract Map> getRequestMetadata(URI uri) throws IOException; + public abstract Map> getRequestMetadata(@Nullable URI uri) + throws IOException; /** * Whether the credentials have metadata entries that should be added to each request. diff --git a/google-auth-library-java/credentials/java/com/google/auth/RequestMetadataCallback.java b/google-auth-library-java/credentials/java/com/google/auth/RequestMetadataCallback.java index 68a20c4ac156..456da2335f23 100644 --- a/google-auth-library-java/credentials/java/com/google/auth/RequestMetadataCallback.java +++ b/google-auth-library-java/credentials/java/com/google/auth/RequestMetadataCallback.java @@ -33,12 +33,14 @@ import java.util.List; import java.util.Map; +import org.jspecify.annotations.NullMarked; /** * The callback that receives the result of the asynchronous {@link * Credentials#getRequestMetadata(java.net.URI, java.util.concurrent.Executor, * RequestMetadataCallback)}. Exactly one method should be called. */ +@NullMarked public interface RequestMetadataCallback { /** * Called when metadata is successfully produced. diff --git a/google-auth-library-java/credentials/java/com/google/auth/Retryable.java b/google-auth-library-java/credentials/java/com/google/auth/Retryable.java index a25410ebf219..5aa4fcbbcbbb 100644 --- a/google-auth-library-java/credentials/java/com/google/auth/Retryable.java +++ b/google-auth-library-java/credentials/java/com/google/auth/Retryable.java @@ -31,7 +31,10 @@ package com.google.auth; +import org.jspecify.annotations.NullMarked; + // an interface to identify retryable errors +@NullMarked public interface Retryable { /** * A flag indicating whether the error is retryable diff --git a/google-auth-library-java/credentials/java/com/google/auth/ServiceAccountSigner.java b/google-auth-library-java/credentials/java/com/google/auth/ServiceAccountSigner.java index 840d447a55ef..f69a05015e9a 100644 --- a/google-auth-library-java/credentials/java/com/google/auth/ServiceAccountSigner.java +++ b/google-auth-library-java/credentials/java/com/google/auth/ServiceAccountSigner.java @@ -32,11 +32,14 @@ package com.google.auth; import java.util.Objects; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** * Interface for a service account signer. A signer for a service account is capable of signing * bytes using the private key associated with its service account. */ +@NullMarked public interface ServiceAccountSigner { class SigningException extends RuntimeException { @@ -48,7 +51,7 @@ public SigningException(String message, Exception cause) { } @Override - public boolean equals(Object obj) { + public boolean equals(@Nullable Object obj) { if (obj == this) { return true; } diff --git a/google-auth-library-java/credentials/pom.xml b/google-auth-library-java/credentials/pom.xml index a81406638926..31e6f8877d2b 100644 --- a/google-auth-library-java/credentials/pom.xml +++ b/google-auth-library-java/credentials/pom.xml @@ -52,6 +52,10 @@ + + org.jspecify + jspecify + org.junit.jupiter junit-jupiter-api diff --git a/google-auth-library-java/oauth2_http/BUILD.bazel b/google-auth-library-java/oauth2_http/BUILD.bazel index 3d8cc5b675c5..b028b375cdbf 100644 --- a/google-auth-library-java/oauth2_http/BUILD.bazel +++ b/google-auth-library-java/oauth2_http/BUILD.bazel @@ -14,6 +14,7 @@ java_library( "@com_google_auto_value_auto_value_annotations//jar", "@com_google_auto_value_auto_value//jar", "@org_slf4j_slf4j_api//jar", + "@org_jspecify_jspecify//jar", ], plugins = ["@com_google_api_gax_java//:auto_value_plugin"], visibility = ["//visibility:public"], diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/http/AuthHttpConstants.java b/google-auth-library-java/oauth2_http/java/com/google/auth/http/AuthHttpConstants.java index 16da64bdc15d..987224bd5442 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/http/AuthHttpConstants.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/http/AuthHttpConstants.java @@ -31,7 +31,10 @@ package com.google.auth.http; +import org.jspecify.annotations.NullMarked; + /** Constants used for auth in http */ +@NullMarked public class AuthHttpConstants { /** HTTP "Bearer" authentication scheme */ public static final String BEARER = "Bearer"; diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/http/HttpCredentialsAdapter.java b/google-auth-library-java/oauth2_http/java/com/google/auth/http/HttpCredentialsAdapter.java index 90a6c86f105e..195777642e15 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/http/HttpCredentialsAdapter.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/http/HttpCredentialsAdapter.java @@ -47,8 +47,10 @@ import java.util.logging.Level; import java.util.logging.Logger; import java.util.regex.Pattern; +import org.jspecify.annotations.NullMarked; /** A wrapper for using Credentials with the Google API Client Libraries for Java with Http. */ +@NullMarked public class HttpCredentialsAdapter implements HttpRequestInitializer, HttpUnsuccessfulResponseHandler { diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/http/HttpTransportFactory.java b/google-auth-library-java/oauth2_http/java/com/google/auth/http/HttpTransportFactory.java index ae1e7e20ad5d..66d4c38f7c31 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/http/HttpTransportFactory.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/http/HttpTransportFactory.java @@ -32,6 +32,7 @@ package com.google.auth.http; import com.google.api.client.http.HttpTransport; +import org.jspecify.annotations.NullMarked; /** * A base interface for all {@link HttpTransport} factories. @@ -39,6 +40,7 @@ *

Implementation must provide a public no-arg constructor. Loading of a factory implementation * is done via {@link java.util.ServiceLoader}. */ +@NullMarked public interface HttpTransportFactory { /** diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/http/InternalAuthHttpConstants.java b/google-auth-library-java/oauth2_http/java/com/google/auth/http/InternalAuthHttpConstants.java index 192dadad5abc..c03da4066899 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/http/InternalAuthHttpConstants.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/http/InternalAuthHttpConstants.java @@ -31,7 +31,10 @@ package com.google.auth.http; +import org.jspecify.annotations.NullMarked; + /** Internal constants used for auth in http */ +@NullMarked class InternalAuthHttpConstants { static final String BEARER_PREFIX = AuthHttpConstants.BEARER + " "; } diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/CertificateSourceUnavailableException.java b/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/CertificateSourceUnavailableException.java index 22a96ed224ad..fd813f4a2ce3 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/CertificateSourceUnavailableException.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/CertificateSourceUnavailableException.java @@ -31,12 +31,14 @@ package com.google.auth.mtls; import java.io.IOException; +import org.jspecify.annotations.NullMarked; /** * This exception is thrown by certificate providers in the Google auth library when the certificate * source is unavailable. This means that the transport layer should move on to the next certificate * source provider type. */ +@NullMarked public class CertificateSourceUnavailableException extends IOException { /** diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/ContextAwareMetadataJson.java b/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/ContextAwareMetadataJson.java index 11583c4d00d1..9ea2dcd9d20e 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/ContextAwareMetadataJson.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/ContextAwareMetadataJson.java @@ -34,6 +34,7 @@ import com.google.api.client.util.Key; import com.google.common.collect.ImmutableList; import java.util.List; +import org.jspecify.annotations.NullMarked; /** * Data class representing context_aware_metadata.json file. This is meant for internal Google Cloud @@ -43,6 +44,7 @@ * the Gax library. The Gax library version of ContextAwareMetadataJson will be marked as deprecated * in the future. */ +@NullMarked public class ContextAwareMetadataJson extends GenericJson { /** Cert provider command */ @Key("cert_provider_command") diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/DefaultMtlsProviderFactory.java b/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/DefaultMtlsProviderFactory.java index 08a9795a8377..8538f10c0d48 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/DefaultMtlsProviderFactory.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/DefaultMtlsProviderFactory.java @@ -32,7 +32,9 @@ import com.google.api.core.InternalApi; import java.io.IOException; +import org.jspecify.annotations.NullMarked; +@NullMarked @InternalApi public class DefaultMtlsProviderFactory { diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsHttpTransportFactory.java b/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsHttpTransportFactory.java index fef033350a7a..3e658322347a 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsHttpTransportFactory.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsHttpTransportFactory.java @@ -37,6 +37,7 @@ import java.security.GeneralSecurityException; import java.security.KeyStore; import java.util.Objects; +import org.jspecify.annotations.NullMarked; /** * An HttpTransportFactory that creates {@link NetHttpTransport} instances configured for mTLS @@ -46,6 +47,7 @@ *

Warning: This class is considered internal and is not intended for direct use by * library consumers. Its API and behavior may change without notice. */ +@NullMarked @InternalApi public class MtlsHttpTransportFactory implements HttpTransportFactory { private final KeyStore mtlsKeyStore; diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsProvider.java b/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsProvider.java index edc412552d06..0edc8c6cefc2 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsProvider.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsProvider.java @@ -32,6 +32,7 @@ import java.io.IOException; import java.security.KeyStore; +import org.jspecify.annotations.NullMarked; /** * MtlsProvider is used by the Gax library for configuring mutual TLS in the HTTP and GRPC transport @@ -41,6 +42,7 @@ * Gax library. The Gax library version of MtlsProvider will be marked as deprecated. See * https://github.com/googleapis/google-auth-library-java/issues/1758 */ +@NullMarked public interface MtlsProvider { /** * Returns a mutual TLS key store. diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsUtils.java b/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsUtils.java index 0d34cf271986..a5c4c0f86e77 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsUtils.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsUtils.java @@ -39,12 +39,14 @@ import java.io.IOException; import java.io.InputStream; import java.util.Locale; +import org.jspecify.annotations.NullMarked; /** * Utility class for mTLS related operations. * *

For internal use only. */ +@NullMarked @InternalApi public class MtlsUtils { static final String CERTIFICATE_CONFIGURATION_ENV_VARIABLE = "GOOGLE_API_CERTIFICATE_CONFIG"; diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/SecureConnectProvider.java b/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/SecureConnectProvider.java index 7c13dd16ced6..06294c611c7b 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/SecureConnectProvider.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/SecureConnectProvider.java @@ -44,6 +44,7 @@ import java.security.KeyStore; import java.util.List; import java.util.concurrent.TimeUnit; +import org.jspecify.annotations.NullMarked; /** * This class implements {@link MtlsProvider} for the Google Auth library transport layer via {@link @@ -59,6 +60,7 @@ *

Additionally, this implementation will replace the existing "MtlsProvider" in the Gax library. * The Gax library version of MtlsProvider will be marked as deprecated. */ +@NullMarked @InternalApi public class SecureConnectProvider implements MtlsProvider { interface ProcessProvider { diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/WorkloadCertificateConfiguration.java b/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/WorkloadCertificateConfiguration.java index db439eea584f..5b1e78e150c2 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/WorkloadCertificateConfiguration.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/WorkloadCertificateConfiguration.java @@ -40,7 +40,9 @@ import java.io.InputStream; import java.nio.charset.StandardCharsets; import java.util.Map; +import org.jspecify.annotations.NullMarked; +@NullMarked class WorkloadCertificateConfiguration { private String certPath; diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/X509Provider.java b/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/X509Provider.java index c87398940538..911c0fdcf922 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/X509Provider.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/mtls/X509Provider.java @@ -42,11 +42,14 @@ import java.io.InputStream; import java.io.SequenceInputStream; import java.security.KeyStore; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** * This class implements {@link MtlsProvider} for the Google Auth library transport layer via {@link * WorkloadCertificateConfiguration}. */ +@NullMarked @InternalApi public class X509Provider implements MtlsProvider { private final EnvironmentProvider envProvider; @@ -77,7 +80,7 @@ public X509Provider( * * @param certConfigPathOverride the path to read the certificate configuration from. */ - public X509Provider(String certConfigPathOverride) { + public X509Provider(@Nullable String certConfigPathOverride) { this( SystemEnvironmentProvider.getInstance(), SystemPropertyProvider.getInstance(), diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AccessToken.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AccessToken.java index 4ea49d93a233..5d97a1774668 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AccessToken.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AccessToken.java @@ -39,14 +39,17 @@ import java.util.Date; import java.util.List; import java.util.Objects; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** Represents a temporary OAuth2 access token and its expiration information. */ +@NullMarked public class AccessToken implements Serializable { private static final long serialVersionUID = -8514239465808977353L; private final String tokenValue; - private final Long expirationTimeMillis; + private final @Nullable Long expirationTimeMillis; private final List scopes; /** @@ -98,7 +101,7 @@ public String getTokenValue() { * * @return The expiration time as a {@link Date}. */ - public Date getExpirationTime() { + public @Nullable Date getExpirationTime() { if (expirationTimeMillis == null) { return null; } @@ -131,7 +134,7 @@ public String toString() { } @Override - public boolean equals(Object obj) { + public boolean equals(@Nullable Object obj) { if (!(obj instanceof AccessToken)) { return false; } diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ActingParty.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ActingParty.java index ad1d452fc028..34aa031a6cd6 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ActingParty.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ActingParty.java @@ -33,10 +33,13 @@ import static com.google.common.base.Preconditions.checkNotNull; +import org.jspecify.annotations.NullMarked; + /** * The acting party as defined in OAuth 2.0 Token * Exchange. */ +@NullMarked final class ActingParty { private final String actorToken; private final String actorTokenType; diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AppEngineCredentials.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AppEngineCredentials.java index 2ab1db8570fc..ee031baa33bd 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AppEngineCredentials.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AppEngineCredentials.java @@ -42,12 +42,15 @@ import java.util.Collection; import java.util.Date; import java.util.Objects; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** * OAuth2 credentials representing the built-in service account for Google App Engine. * *

Instances of this class use reflection to access AppIdentityService in AppEngine SDK. */ +@NullMarked class AppEngineCredentials extends GoogleCredentials implements ServiceAccountSigner { private static final long serialVersionUID = -493219027336622194L; @@ -93,7 +96,9 @@ class AppEngineCredentials extends GoogleCredentials implements ServiceAccountSi } AppEngineCredentials( - Collection scopes, Collection defaultScopes, AppEngineCredentials unscoped) { + Collection scopes, + @Nullable Collection defaultScopes, + AppEngineCredentials unscoped) { this.appIdentityService = unscoped.appIdentityService; this.getAccessToken = unscoped.getAccessToken; this.getAccessTokenResult = unscoped.getAccessTokenResult; @@ -198,7 +203,7 @@ public String toString() { } @Override - public boolean equals(Object obj) { + public boolean equals(@Nullable Object obj) { if (!(obj instanceof AppEngineCredentials)) { return false; } diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsCredentialSource.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsCredentialSource.java index a48b7d51d5a7..2f307e3ec277 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsCredentialSource.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsCredentialSource.java @@ -34,8 +34,11 @@ import java.util.Map; import java.util.regex.Matcher; import java.util.regex.Pattern; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** The AWS credential source. Stores data required to retrieve the AWS credential. */ +@NullMarked public class AwsCredentialSource extends ExternalAccountCredentials.CredentialSource { static final String IMDSV2_SESSION_TOKEN_URL_FIELD_NAME = "imdsv2_session_token_url"; @@ -44,7 +47,7 @@ public class AwsCredentialSource extends ExternalAccountCredentials.CredentialSo final String regionUrl; final String url; final String regionalCredentialVerificationUrl; - final String imdsv2SessionTokenUrl; + final @Nullable String imdsv2SessionTokenUrl; /** * The source of the AWS credential. The credential source map must contain the diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsCredentials.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsCredentials.java index bb943fcdf3b2..ce8ed886f608 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsCredentials.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsCredentials.java @@ -43,7 +43,8 @@ import java.util.HashMap; import java.util.List; import java.util.Map; -import javax.annotation.Nullable; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** * Credentials representing an AWS third-party identity for calling Google APIs. AWS security @@ -52,6 +53,7 @@ * *

By default, attempts to exchange the external credential for a GCP access token. */ +@NullMarked public class AwsCredentials extends ExternalAccountCredentials { static final String DEFAULT_REGIONAL_CREDENTIAL_VERIFICATION_URL = diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsDates.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsDates.java index abf81add9aad..5b9d5214a9c3 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsDates.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsDates.java @@ -38,8 +38,10 @@ import java.text.SimpleDateFormat; import java.util.Date; import java.util.TimeZone; +import org.jspecify.annotations.NullMarked; /** Formats dates required for AWS Signature V4 request signing. */ +@NullMarked final class AwsDates { private static final String X_AMZ_DATE_FORMAT = "yyyyMMdd'T'HHmmss'Z'"; private static final String HTTP_DATE_FORMAT = "E, dd MMM yyyy HH:mm:ss z"; diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsRequestSignature.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsRequestSignature.java index 99ec90cf439a..cb914852d612 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsRequestSignature.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsRequestSignature.java @@ -34,11 +34,13 @@ import com.google.errorprone.annotations.CanIgnoreReturnValue; import java.util.HashMap; import java.util.Map; +import org.jspecify.annotations.NullMarked; /** * Stores the AWS API request signature based on the AWS Signature Version 4 signing process, and * the parameters used in the signing process. */ +@NullMarked class AwsRequestSignature { private AwsSecurityCredentials awsSecurityCredentials; diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsRequestSigner.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsRequestSigner.java index 275c15105d37..cd20a06dba76 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsRequestSigner.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsRequestSigner.java @@ -50,9 +50,10 @@ import java.util.List; import java.util.Locale; import java.util.Map; -import javax.annotation.Nullable; import javax.crypto.Mac; import javax.crypto.spec.SecretKeySpec; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** * Internal utility that signs AWS API requests based on the AWS Signature Version 4 signing @@ -61,6 +62,7 @@ * @see AWS * Signature V4 */ +@NullMarked class AwsRequestSigner { // AWS Signature Version 4 signing algorithm identifier. diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsSecurityCredentials.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsSecurityCredentials.java index 7101dda3e5bf..1a60bc07c975 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsSecurityCredentials.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsSecurityCredentials.java @@ -31,12 +31,14 @@ package com.google.auth.oauth2; -import javax.annotation.Nullable; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** * Defines AWS security credentials. These are either retrieved from the AWS security_credentials * endpoint or AWS environment variables. */ +@NullMarked public class AwsSecurityCredentials { private final String accessKeyId; diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsSecurityCredentialsSupplier.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsSecurityCredentialsSupplier.java index f7f21992348b..994719119d64 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsSecurityCredentialsSupplier.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsSecurityCredentialsSupplier.java @@ -33,11 +33,13 @@ import java.io.IOException; import java.io.Serializable; +import org.jspecify.annotations.NullMarked; /** * Supplier for retrieving AWS Security credentials for {@link AwsCredentials} to exchange for GCP * access tokens. */ +@NullMarked public interface AwsSecurityCredentialsSupplier extends Serializable { /** diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/CertificateIdentityPoolSubjectTokenSupplier.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/CertificateIdentityPoolSubjectTokenSupplier.java index 49a8ec18d279..5b2ad1169ed0 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/CertificateIdentityPoolSubjectTokenSupplier.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/CertificateIdentityPoolSubjectTokenSupplier.java @@ -52,6 +52,7 @@ import java.util.List; import java.util.regex.Matcher; import java.util.regex.Pattern; +import org.jspecify.annotations.NullMarked; /** * Provider for retrieving the subject tokens for {@link IdentityPoolCredentials} by reading an @@ -59,6 +60,7 @@ * the leaf certificate is base64-encoded (DER format), wrapped in a JSON array, and used as the * subject token for STS exchange. */ +@NullMarked public class CertificateIdentityPoolSubjectTokenSupplier implements IdentityPoolSubjectTokenSupplier { diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ClientId.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ClientId.java index 4f1de34c3e5e..2cf9f0c2e6d5 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ClientId.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ClientId.java @@ -39,12 +39,14 @@ import java.io.InputStream; import java.nio.charset.StandardCharsets; import java.util.Map; +import org.jspecify.annotations.NullMarked; /** * An OAuth2 user authorization Client ID and associated information. * *

Corresponds to the information in the json file downloadable for a Client ID. */ +@NullMarked public class ClientId { private static final String FIELD_TYPE_INSTALLED = "installed"; diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/CloudShellCredentials.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/CloudShellCredentials.java index 7b1be7d9115f..6a80e7801180 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/CloudShellCredentials.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/CloudShellCredentials.java @@ -43,8 +43,11 @@ import java.util.ArrayList; import java.util.List; import java.util.Objects; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** OAuth2 credentials representing the built-in service account for Google Cloud Shell. */ +@NullMarked public class CloudShellCredentials extends GoogleCredentials { private static final long serialVersionUID = -2133257318957488451L; @@ -109,7 +112,7 @@ public String toString() { } @Override - public boolean equals(Object obj) { + public boolean equals(@Nullable Object obj) { if (!(obj instanceof CloudShellCredentials)) { return false; } diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ComputeEngineCredentials.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ComputeEngineCredentials.java index a9a62cf5d6bc..d1933126d629 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ComputeEngineCredentials.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ComputeEngineCredentials.java @@ -71,6 +71,8 @@ import java.util.Objects; import java.util.logging.Level; import java.util.logging.Logger; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** * OAuth2 credentials representing the built-in service account for a Google Compute Engine VM. @@ -79,6 +81,7 @@ * *

These credentials use the IAM API to sign data. See {@link #sign(byte[])} for more details. */ +@NullMarked public class ComputeEngineCredentials extends GoogleCredentials implements ServiceAccountSigner, IdTokenProvider { @@ -127,8 +130,8 @@ public class ComputeEngineCredentials extends GoogleCredentials private transient HttpTransportFactory transportFactory; - private String universeDomainFromMetadata = null; - private String projectId = null; + private @Nullable String universeDomainFromMetadata = null; + private @Nullable String projectId = null; /** * Experimental Feature. @@ -757,7 +760,7 @@ protected ToStringHelper toStringHelper() { } @Override - public boolean equals(Object obj) { + public boolean equals(@Nullable Object obj) { if (!(obj instanceof ComputeEngineCredentials)) { return false; } diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/CredentialAccessBoundary.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/CredentialAccessBoundary.java index 39b528ab1abc..324d53d0b782 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/CredentialAccessBoundary.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/CredentialAccessBoundary.java @@ -38,7 +38,8 @@ import com.google.errorprone.annotations.CanIgnoreReturnValue; import java.util.ArrayList; import java.util.List; -import javax.annotation.Nullable; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** * Defines an upper bound of permissions available for a GCP credential via {@link @@ -47,6 +48,7 @@ *

See for more * information. */ +@NullMarked public final class CredentialAccessBoundary { private static final int RULES_SIZE_LIMIT = 10; diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/CredentialFormatException.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/CredentialFormatException.java index 4186bc029521..2c716c275ce1 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/CredentialFormatException.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/CredentialFormatException.java @@ -32,8 +32,10 @@ package com.google.auth.oauth2; import java.io.IOException; +import org.jspecify.annotations.NullMarked; /** Indicates that the provided credential does not adhere to the required format. */ +@NullMarked class CredentialFormatException extends IOException { CredentialFormatException(String message, Throwable cause) { super(message, cause); diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/DefaultCredentialsProvider.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/DefaultCredentialsProvider.java index 3ce69b391609..f1da706ab754 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/DefaultCredentialsProvider.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/DefaultCredentialsProvider.java @@ -45,6 +45,8 @@ import java.util.Locale; import java.util.logging.Level; import java.util.logging.Logger; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** * Provides the Application Default Credential from the environment. @@ -52,6 +54,7 @@ *

An instance represents the per-process state used to get and cache the credential and allows * overriding the state and environment for testing purposes. */ +@NullMarked class DefaultCredentialsProvider { static final DefaultCredentialsProvider DEFAULT = new DefaultCredentialsProvider(); static final String CREDENTIAL_ENV_VAR = "GOOGLE_APPLICATION_CREDENTIALS"; @@ -85,7 +88,7 @@ class DefaultCredentialsProvider { "SUPPRESS_GCLOUD_CREDS_WARNING"; // These variables should only be accessed inside a synchronized block - private GoogleCredentials cachedCredentials = null; + private @Nullable GoogleCredentials cachedCredentials = null; private boolean checkedAppEngine = false; private boolean checkedComputeEngine = false; @@ -283,7 +286,7 @@ private boolean runningOnAppEngine() { cause); } - private GoogleCredentials tryGetCloudShellCredentials() { + private @Nullable GoogleCredentials tryGetCloudShellCredentials() { String port = getEnv(CLOUD_SHELL_ENV_VAR); if (port != null) { return CloudShellCredentials.create(Integer.parseInt(port)); @@ -292,7 +295,7 @@ private GoogleCredentials tryGetCloudShellCredentials() { } } - private GoogleCredentials tryGetAppEngineCredential() throws IOException { + private @Nullable GoogleCredentials tryGetAppEngineCredential() throws IOException { // Checking for App Engine requires a class load, so check only once if (checkedAppEngine) { return null; @@ -306,7 +309,8 @@ private GoogleCredentials tryGetAppEngineCredential() throws IOException { Collections.emptyList(), Collections.emptyList()); } - private final GoogleCredentials tryGetComputeCredentials(HttpTransportFactory transportFactory) { + private final @Nullable GoogleCredentials tryGetComputeCredentials( + HttpTransportFactory transportFactory) { // Checking compute engine requires a round-trip, so check only once if (checkedComputeEngine) { return null; diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/DefaultPKCEProvider.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/DefaultPKCEProvider.java index 33e3a3fc7182..dbdf9b2ba172 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/DefaultPKCEProvider.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/DefaultPKCEProvider.java @@ -35,12 +35,14 @@ import java.security.NoSuchAlgorithmException; import java.security.SecureRandom; import java.util.Base64; +import org.jspecify.annotations.NullMarked; /** * Implements PKCE using only the Java standard library. See https://www.rfc-editor.org/rfc/rfc7636. * *

https://developers.google.com/identity/protocols/oauth2/native-app#step1-code-verifier. */ +@NullMarked public class DefaultPKCEProvider implements PKCEProvider { private String codeVerifier; private CodeChallenge codeChallenge; diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/DownscopedCredentials.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/DownscopedCredentials.java index cafe8d5c8806..14fd9d24e1d5 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/DownscopedCredentials.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/DownscopedCredentials.java @@ -40,6 +40,7 @@ import com.google.common.annotations.VisibleForTesting; import com.google.errorprone.annotations.CanIgnoreReturnValue; import java.io.IOException; +import org.jspecify.annotations.NullMarked; /** * DownscopedCredentials enables the ability to downscope, or restrict, the Identity and Access @@ -94,6 +95,7 @@ * token, allowing for automatic token refreshes by providing a {@link * OAuth2CredentialsWithRefresh.OAuth2RefreshHandler}. */ +@NullMarked public final class DownscopedCredentials extends OAuth2Credentials { private final GoogleCredentials sourceCredential; diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/EnvironmentProvider.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/EnvironmentProvider.java index 26373f4cd729..2fe0045f4f47 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/EnvironmentProvider.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/EnvironmentProvider.java @@ -31,12 +31,14 @@ package com.google.auth.oauth2; import com.google.api.core.InternalApi; +import org.jspecify.annotations.NullMarked; /** * Interface for an environment provider. * *

For internal use only. */ +@NullMarked @InternalApi public interface EnvironmentProvider { String getEnv(String name); diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExecutableHandler.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExecutableHandler.java index a052f2a5bb99..07fe274e0874 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExecutableHandler.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExecutableHandler.java @@ -33,9 +33,11 @@ import java.io.IOException; import java.util.Map; -import javax.annotation.Nullable; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** An interface for 3rd party executable handling. */ +@NullMarked interface ExecutableHandler { /** An interface for required fields needed to call 3rd party executables. */ @@ -53,8 +55,7 @@ interface ExecutableOptions { /** * An output file path which points to the 3rd party credentials generated by the executable. */ - @Nullable - String getOutputFilePath(); + @Nullable String getOutputFilePath(); } /** diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExecutableResponse.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExecutableResponse.java index 278b71047cdb..1e8fa837ce2e 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExecutableResponse.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExecutableResponse.java @@ -35,12 +35,14 @@ import java.io.IOException; import java.math.BigDecimal; import java.time.Instant; -import javax.annotation.Nullable; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** * Encapsulates response values for the 3rd party executable response (e.g. OIDC, SAML, error * responses). */ +@NullMarked class ExecutableResponse { private static final String SAML_SUBJECT_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:saml2"; @@ -140,8 +142,7 @@ boolean isValid() { } /** Returns the subject token expiration time in seconds (Unix epoch time). */ - @Nullable - Long getExpirationTime() { + @Nullable Long getExpirationTime() { return this.expirationTime; } @@ -158,26 +159,22 @@ Long getExpirationTime() { * * @return The 3rd party subject token type for success responses, null otherwise. */ - @Nullable - String getTokenType() { + @Nullable String getTokenType() { return this.tokenType; } /** Returns the subject token if the execution was successful, null otherwise. */ - @Nullable - String getSubjectToken() { + @Nullable String getSubjectToken() { return this.subjectToken; } /** Returns the error code if the execution was unsuccessful, null otherwise. */ - @Nullable - String getErrorCode() { + @Nullable String getErrorCode() { return this.errorCode; } /** Returns the error message if the execution was unsuccessful, null otherwise. */ - @Nullable - String getErrorMessage() { + @Nullable String getErrorMessage() { return this.errorMessage; } diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountAuthorizedUserCredentials.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountAuthorizedUserCredentials.java index b274fec76c65..61ca133cf1d6 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountAuthorizedUserCredentials.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountAuthorizedUserCredentials.java @@ -54,7 +54,8 @@ import java.util.Date; import java.util.Map; import java.util.Objects; -import javax.annotation.Nullable; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** * OAuth2 credentials sourced using external identities through Workforce Identity Federation. @@ -74,6 +75,7 @@ * } * */ +@NullMarked public class ExternalAccountAuthorizedUserCredentials extends GoogleCredentials { private static final LoggerProvider LOGGER_PROVIDER = LoggerProvider.forClazz(ExternalAccountAuthorizedUserCredentials.class); @@ -309,7 +311,7 @@ public String toString() { } @Override - public boolean equals(Object obj) { + public boolean equals(@Nullable Object obj) { if (!(obj instanceof ExternalAccountAuthorizedUserCredentials)) { return false; } diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java index 47cb398d26bf..461dc62f9c64 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java @@ -55,7 +55,8 @@ import java.util.Map; import java.util.concurrent.Executor; import java.util.regex.Pattern; -import javax.annotation.Nullable; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** * Base external account credentials class. @@ -63,6 +64,7 @@ *

Handles initializing external credentials, calls to the Security Token Service, and service * account impersonation. */ +@NullMarked public abstract class ExternalAccountCredentials extends GoogleCredentials { private static final long serialVersionUID = 8049126194174465023L; @@ -279,7 +281,7 @@ protected ExternalAccountCredentials(ExternalAccountCredentials.Builder builder) this.name = GoogleCredentialsInfo.EXTERNAL_ACCOUNT_CREDENTIALS.getCredentialName(); } - ImpersonatedCredentials buildImpersonatedCredentials() { + @Nullable ImpersonatedCredentials buildImpersonatedCredentials() { if (serviceAccountImpersonationUrl == null) { return null; } diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountMetricsHandler.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountMetricsHandler.java index 18fc124b80c3..ec0efdd194c9 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountMetricsHandler.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountMetricsHandler.java @@ -31,10 +31,13 @@ package com.google.auth.oauth2; +import org.jspecify.annotations.NullMarked; + /** * A handler for generating the x-goog-api-client header value for BYOID external account * credentials. */ +@NullMarked class ExternalAccountMetricsHandler implements java.io.Serializable { private static final String SOURCE_KEY = "source"; private static final String IMPERSONATION_KEY = "sa-impersonation"; diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountSupplierContext.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountSupplierContext.java index 612c735e2d1f..4390f58f4891 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountSupplierContext.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountSupplierContext.java @@ -34,12 +34,14 @@ import com.google.auth.oauth2.ExternalAccountCredentials.SubjectTokenTypes; import com.google.errorprone.annotations.CanIgnoreReturnValue; import java.io.Serializable; +import org.jspecify.annotations.NullMarked; /** * Context object to pass relevant variables from external account credentials to suppliers. This * will be passed on any call made to {@link IdentityPoolSubjectTokenSupplier} or {@link * AwsSecurityCredentialsSupplier}. */ +@NullMarked public class ExternalAccountSupplierContext implements Serializable { private static final long serialVersionUID = -7852130853542313494L; diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/FileIdentityPoolSubjectTokenSupplier.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/FileIdentityPoolSubjectTokenSupplier.java index a939507d47a1..02654578a418 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/FileIdentityPoolSubjectTokenSupplier.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/FileIdentityPoolSubjectTokenSupplier.java @@ -44,11 +44,13 @@ import java.nio.file.Files; import java.nio.file.LinkOption; import java.nio.file.Paths; +import org.jspecify.annotations.NullMarked; /** * Internal provider for retrieving the subject tokens for {@link IdentityPoolCredentials} to * exchange for GCP access tokens via a local file. */ +@NullMarked class FileIdentityPoolSubjectTokenSupplier implements IdentityPoolSubjectTokenSupplier { private final long serialVersionUID = 2475549052347431992L; diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/GdchCredentials.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/GdchCredentials.java index e8b81c71c35d..1769dbe9ca8d 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/GdchCredentials.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/GdchCredentials.java @@ -79,7 +79,10 @@ import java.util.Date; import java.util.Map; import java.util.Objects; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; +@NullMarked public class GdchCredentials extends GoogleCredentials { private static final LoggerProvider LOGGER_PROVIDER = LoggerProvider.forClazz(GdchCredentials.class); @@ -454,7 +457,7 @@ public final String getGdchAudience() { * been set or if the audience string is not a valid URI. */ @ObsoleteApi("Use getGdchAudience() instead.") - public final URI getApiAudience() { + public final @Nullable URI getApiAudience() { if (Strings.isNullOrEmpty(apiAudience)) { return null; } @@ -518,7 +521,7 @@ public String toString() { } @Override - public boolean equals(Object obj) { + public boolean equals(@Nullable Object obj) { if (!(obj instanceof GdchCredentials)) { return false; } diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/GoogleAuthException.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/GoogleAuthException.java index a8b84387799c..bfb36fa90a45 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/GoogleAuthException.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/GoogleAuthException.java @@ -34,11 +34,14 @@ import com.google.api.client.http.HttpResponseException; import com.google.auth.Retryable; import java.io.IOException; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** * Base class for the standard Auth error response. It extends a default exception while keeping * Json response format */ +@NullMarked class GoogleAuthException extends IOException implements Retryable { private final boolean isRetryable; @@ -117,7 +120,7 @@ class GoogleAuthException extends IOException implements Retryable { * @return new instance of {@link GoogleAuthException} */ static GoogleAuthException createWithTokenEndpointResponseException( - HttpResponseException responseException, String message) { + HttpResponseException responseException, @Nullable String message) { int responseStatus = responseException.getStatusCode(); boolean isRetryable = OAuth2Utils.TOKEN_ENDPOINT_RETRYABLE_STATUS_CODES.contains(responseStatus); @@ -153,7 +156,7 @@ static GoogleAuthException createWithTokenEndpointResponseException( * @return new instance of {@link GoogleAuthException} */ static GoogleAuthException createWithTokenEndpointIOException( - IOException ioException, String message) { + IOException ioException, @Nullable String message) { if (message == null) { return new GoogleAuthException(true, OAuth2Utils.DEFAULT_NUMBER_OF_RETRIES, ioException); diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/GoogleAuthUtils.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/GoogleAuthUtils.java index 973411aff240..04a80c7dc73c 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/GoogleAuthUtils.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/GoogleAuthUtils.java @@ -33,11 +33,13 @@ import java.io.File; import java.io.IOException; +import org.jspecify.annotations.NullMarked; /** * This public class provides shared utilities for common OAuth2 utils or ADC. It also exposes * convenience methods such as a getter for well-known Application Default Credentials file path */ +@NullMarked public class GoogleAuthUtils { /** diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/GoogleCredentials.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/GoogleCredentials.java index 7395274c4786..5f59b6b46c11 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/GoogleCredentials.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/GoogleCredentials.java @@ -54,9 +54,11 @@ import java.util.List; import java.util.Map; import java.util.Objects; -import javax.annotation.Nullable; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** Base type for credentials for authorizing calls to Google APIs using OAuth2. */ +@NullMarked public class GoogleCredentials extends OAuth2Credentials implements QuotaProjectIdProvider { private static final long serialVersionUID = -1522852442442473691L; @@ -79,7 +81,7 @@ enum GoogleCredentialsInfo { private final String credentialName; @Nullable private final String fileType; - GoogleCredentialsInfo(String credentialName, String fileType) { + GoogleCredentialsInfo(String credentialName, @Nullable String fileType) { this.credentialName = credentialName; this.fileType = fileType; } @@ -88,8 +90,7 @@ String getCredentialName() { return credentialName; } - @Nullable - String getFileType() { + @Nullable String getFileType() { return fileType; } } @@ -423,7 +424,7 @@ protected GoogleCredentials() { * @param quotaProjectId a quotaProjectId, a project id to be used for billing purposes */ @Deprecated - protected GoogleCredentials(AccessToken accessToken, String quotaProjectId) { + protected GoogleCredentials(AccessToken accessToken, @Nullable String quotaProjectId) { this( GoogleCredentials.newBuilder() .setAccessToken(accessToken) @@ -501,7 +502,7 @@ public String toString() { } @Override - public boolean equals(Object obj) { + public boolean equals(@Nullable Object obj) { if (!(obj instanceof GoogleCredentials)) { return false; } diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/IamUtils.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/IamUtils.java index 48fe863f2d59..7f1005430cb4 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/IamUtils.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/IamUtils.java @@ -56,11 +56,13 @@ import java.util.HashSet; import java.util.Map; import java.util.Set; +import org.jspecify.annotations.NullMarked; /** * This internal class provides shared utilities for interacting with the IAM API for common * features like signing. */ +@NullMarked class IamUtils { // IAM credentials endpoints are to be formatted with universe domain and client email. diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/IdToken.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/IdToken.java index ccd670bba16b..e612d9548c49 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/IdToken.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/IdToken.java @@ -40,8 +40,11 @@ import java.io.Serializable; import java.util.Date; import java.util.Objects; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** Represents a temporary IdToken and its JsonWebSignature object */ +@NullMarked public class IdToken extends AccessToken implements Serializable { private static final long serialVersionUID = -8514239465808977353L; @@ -104,7 +107,7 @@ public String toString() { } @Override - public boolean equals(Object obj) { + public boolean equals(@Nullable Object obj) { if (!(obj instanceof IdToken)) { return false; } diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/IdTokenCredentials.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/IdTokenCredentials.java index ea7d324d9829..354aa9697e41 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/IdTokenCredentials.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/IdTokenCredentials.java @@ -37,6 +37,8 @@ import java.io.IOException; import java.util.List; import java.util.Objects; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** * IdTokenCredentials provides a Google Issued OpenIdConnect token.
@@ -101,6 +103,7 @@ * System.out.println(tokenCredential.getIdToken().getJsonWebSignature().getPayload().getExpirationTimeSeconds()); * */ +@NullMarked public class IdTokenCredentials extends OAuth2Credentials { private static final long serialVersionUID = -2133257318957588431L; @@ -140,7 +143,7 @@ public String toString() { } @Override - public boolean equals(Object obj) { + public boolean equals(@Nullable Object obj) { if (!(obj instanceof IdTokenCredentials)) { return false; } diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/IdTokenProvider.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/IdTokenProvider.java index 4d9b09e1846f..bb1e66ac8536 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/IdTokenProvider.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/IdTokenProvider.java @@ -33,8 +33,10 @@ import java.io.IOException; import java.util.List; +import org.jspecify.annotations.NullMarked; /** Interface for an Google OIDC token provider. This type represents a google issued OIDC token. */ +@NullMarked public interface IdTokenProvider { /** diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/IdentityPoolCredentialSource.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/IdentityPoolCredentialSource.java index 4ab63b8ed8fa..5ade1458b8d7 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/IdentityPoolCredentialSource.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/IdentityPoolCredentialSource.java @@ -36,12 +36,14 @@ import java.util.HashMap; import java.util.Locale; import java.util.Map; -import javax.annotation.Nullable; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** * The IdentityPool credential source. Dictates the retrieval method of the external credential, * which can either be through a metadata server or a local file. */ +@NullMarked public class IdentityPoolCredentialSource extends ExternalAccountCredentials.CredentialSource { private static final long serialVersionUID = -745855247050085694L; diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/IdentityPoolCredentials.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/IdentityPoolCredentials.java index 0ff9da853e2d..10f216139d7b 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/IdentityPoolCredentials.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/IdentityPoolCredentials.java @@ -43,12 +43,15 @@ import java.util.ArrayList; import java.util.Collection; import java.util.Map; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** * Url-sourced, file-sourced, or user provided supplier method-sourced external account credentials. * *

By default, attempts to exchange the external credential for a GCP access token. */ +@NullMarked public class IdentityPoolCredentials extends ExternalAccountCredentials { static final String FILE_METRICS_HEADER_VALUE = "file"; @@ -187,7 +190,8 @@ private X509Provider getX509Provider( return x509Provider; } - private static String getExplicitCertConfigPath(IdentityPoolCredentialSource credentialSource) { + private static @Nullable String getExplicitCertConfigPath( + IdentityPoolCredentialSource credentialSource) { IdentityPoolCredentialSource.CertificateConfig certConfig = credentialSource.getCertificateConfig(); if (certConfig == null) { diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/IdentityPoolSubjectTokenSupplier.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/IdentityPoolSubjectTokenSupplier.java index 01477f8bb3ec..c518797d8b2a 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/IdentityPoolSubjectTokenSupplier.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/IdentityPoolSubjectTokenSupplier.java @@ -33,12 +33,14 @@ import java.io.IOException; import java.io.Serializable; +import org.jspecify.annotations.NullMarked; @FunctionalInterface /** * Provider for retrieving the subject tokens for {@Link IdentityPoolCredentials} to exchange for * GCP access tokens. */ +@NullMarked public interface IdentityPoolSubjectTokenSupplier extends Serializable { /** diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ImpersonatedCredentials.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ImpersonatedCredentials.java index 34716d92b552..3cd65471b986 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ImpersonatedCredentials.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ImpersonatedCredentials.java @@ -70,6 +70,8 @@ import java.util.List; import java.util.Map; import java.util.Objects; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** * ImpersonatedCredentials allowing credentials issued to a user or service account to impersonate @@ -97,6 +99,7 @@ * System.out.println(b); * */ +@NullMarked public class ImpersonatedCredentials extends GoogleCredentials implements ServiceAccountSigner, IdTokenProvider { @@ -731,7 +734,7 @@ public String toString() { } @Override - public boolean equals(Object obj) { + public boolean equals(@Nullable Object obj) { if (!(obj instanceof ImpersonatedCredentials)) { return false; } diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/InternalAwsSecurityCredentialsSupplier.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/InternalAwsSecurityCredentialsSupplier.java index f8c75bc65b64..f78ceedcfc9f 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/InternalAwsSecurityCredentialsSupplier.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/InternalAwsSecurityCredentialsSupplier.java @@ -47,13 +47,15 @@ import java.util.HashMap; import java.util.List; import java.util.Map; -import javax.annotation.Nullable; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** * Internal provider for retrieving AWS security credentials for {@link AwsCredentials} to exchange * for GCP access tokens. The credentials are retrieved either via environment variables or metadata * endpoints. */ +@NullMarked class InternalAwsSecurityCredentialsSupplier implements AwsSecurityCredentialsSupplier { private static final long serialVersionUID = 4438370785261365013L; diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/JwtClaims.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/JwtClaims.java index 5e36ebde1589..cb165b76850c 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/JwtClaims.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/JwtClaims.java @@ -35,7 +35,8 @@ import com.google.common.collect.ImmutableMap; import java.io.Serializable; import java.util.Map; -import javax.annotation.Nullable; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** * Value class representing the set of fields used as the payload of a JWT token. @@ -50,6 +51,7 @@ * .build(); * */ +@NullMarked @AutoValue public abstract class JwtClaims implements Serializable { private static final long serialVersionUID = 4974444151019426702L; diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/JwtCredentials.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/JwtCredentials.java index 0bf9c537e8c1..a08909ade935 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/JwtCredentials.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/JwtCredentials.java @@ -48,6 +48,8 @@ import java.util.Map; import java.util.Objects; import java.util.concurrent.TimeUnit; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** * Credentials class for calling Google APIs using a JWT with custom claims. @@ -67,6 +69,7 @@ * .build(); * */ +@NullMarked public class JwtCredentials extends Credentials implements JwtProvider { private static final String JWT_ACCESS_PREFIX = OAuth2Utils.BEARER_PREFIX; private static final String JWT_INCOMPLETE_ERROR_MESSAGE = @@ -179,7 +182,7 @@ public boolean hasRequestMetadataOnly() { } @Override - public boolean equals(Object obj) { + public boolean equals(@Nullable Object obj) { if (!(obj instanceof JwtCredentials)) { return false; } diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/JwtProvider.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/JwtProvider.java index 0e25d20e6293..ca412e4dbb81 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/JwtProvider.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/JwtProvider.java @@ -31,7 +31,10 @@ package com.google.auth.oauth2; +import org.jspecify.annotations.NullMarked; + /** Interface for creating custom JWT tokens */ +@NullMarked public interface JwtProvider { /** diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/LoggerProvider.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/LoggerProvider.java index c093901dbb58..9d4d1394b3ad 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/LoggerProvider.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/LoggerProvider.java @@ -31,8 +31,10 @@ package com.google.auth.oauth2; +import org.jspecify.annotations.NullMarked; import org.slf4j.Logger; +@NullMarked class LoggerProvider { private Logger logger; diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/LoggingUtils.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/LoggingUtils.java index b08c56242ed7..5b5b98c31b47 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/LoggingUtils.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/LoggingUtils.java @@ -36,7 +36,9 @@ import com.google.api.client.util.GenericData; import java.util.Map; import java.util.logging.Level; +import org.jspecify.annotations.NullMarked; +@NullMarked class LoggingUtils { static final String GOOGLE_SDK_JAVA_LOGGING = "GOOGLE_SDK_JAVA_LOGGING"; diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/MemoryTokensStorage.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/MemoryTokensStorage.java index 4edebca0c255..104443ee98e7 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/MemoryTokensStorage.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/MemoryTokensStorage.java @@ -34,8 +34,10 @@ import java.io.IOException; import java.util.HashMap; import java.util.Map; +import org.jspecify.annotations.NullMarked; /** Represents an in-memory storage of tokens. */ +@NullMarked public class MemoryTokensStorage implements TokenStore { private final Map tokensStorage = new HashMap<>(); diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/MetricsUtils.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/MetricsUtils.java index 1330457dc2ad..44b3b783ec84 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/MetricsUtils.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/MetricsUtils.java @@ -36,7 +36,9 @@ import java.io.IOException; import java.io.InputStream; import java.util.Properties; +import org.jspecify.annotations.NullMarked; +@NullMarked class MetricsUtils { static final String API_CLIENT_HEADER = "x-goog-api-client"; static final String CRED_TYPE = "cred-type"; diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/OAuth2Credentials.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/OAuth2Credentials.java index e17714c3eee8..05c01f4f235a 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/OAuth2Credentials.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/OAuth2Credentials.java @@ -65,9 +65,11 @@ import java.util.concurrent.Callable; import java.util.concurrent.ExecutionException; import java.util.concurrent.Executor; -import javax.annotation.Nullable; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** Base type for Credentials using OAuth2. */ +@NullMarked public class OAuth2Credentials extends Credentials { private static final long serialVersionUID = 4556936364828217687L; @@ -80,8 +82,8 @@ public class OAuth2Credentials extends Credentials { // byte[] is serializable, so the lock variable can be final @VisibleForTesting final Object lock = new byte[0]; - private volatile OAuthValue value = null; - @VisibleForTesting transient RefreshTask refreshTask; + @Nullable private volatile OAuthValue value = null; + @Nullable @VisibleForTesting transient RefreshTask refreshTask; // Change listeners are not serialized private transient List changeListeners; @@ -108,7 +110,7 @@ protected OAuth2Credentials() { * * @param accessToken initial or temporary access token */ - protected OAuth2Credentials(AccessToken accessToken) { + protected OAuth2Credentials(@Nullable AccessToken accessToken) { this(accessToken, DEFAULT_REFRESH_MARGIN, DEFAULT_EXPIRATION_MARGIN); } @@ -147,6 +149,7 @@ public boolean hasRequestMetadataOnly() { * * @return The cached access token. */ + @Nullable public final AccessToken getAccessToken() { OAuthValue localState = value; if (localState != null) { @@ -472,7 +475,7 @@ public String toString() { } @Override - public boolean equals(Object obj) { + public boolean equals(@Nullable Object obj) { if (!(obj instanceof OAuth2Credentials)) { return false; } @@ -588,7 +591,7 @@ private OAuthValue(AccessToken temporaryAccess, Map> reques } @Override - public boolean equals(Object obj) { + public boolean equals(@Nullable Object obj) { if (!(obj instanceof OAuthValue)) { return false; } diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/OAuth2CredentialsWithRefresh.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/OAuth2CredentialsWithRefresh.java index 954378f7bed6..91b374da5e96 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/OAuth2CredentialsWithRefresh.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/OAuth2CredentialsWithRefresh.java @@ -35,12 +35,14 @@ import com.google.errorprone.annotations.CanIgnoreReturnValue; import java.io.IOException; +import org.jspecify.annotations.NullMarked; /** * A refreshable alternative to {@link OAuth2Credentials}. * *

To enable automatic token refreshes, you must provide an {@link OAuth2RefreshHandler}. */ +@NullMarked public class OAuth2CredentialsWithRefresh extends OAuth2Credentials { /** Interface for the refresh handler. */ diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/OAuth2Utils.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/OAuth2Utils.java index 2d5b18d7f67d..f740dd980e73 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/OAuth2Utils.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/OAuth2Utils.java @@ -68,8 +68,11 @@ import java.util.List; import java.util.Map; import java.util.Set; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** Internal utilities for the com.google.auth.oauth2 namespace. */ +@NullMarked @InternalApi public class OAuth2Utils { @@ -181,8 +184,8 @@ static void writeInputStreamToFile(InputStream credentials, String filePath) thr } /** Return the specified optional string from JSON or throw a helpful error message. */ - static String validateOptionalString(Map map, String key, String errorPrefix) - throws IOException { + static @Nullable String validateOptionalString( + Map map, String key, String errorPrefix) throws IOException { Object value = map.get(key); if (value == null) { return null; @@ -195,7 +198,7 @@ static String validateOptionalString(Map map, String key, String /** Return the specified list of strings from JSON or throw a helpful error message. */ @SuppressWarnings("unchecked") - static List validateOptionalListString( + static @Nullable List validateOptionalListString( Map map, String key, String errorPrefix) throws IOException { Object value = map.get(key); if (value == null) { diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/OAuthException.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/OAuthException.java index 011456e24188..0349227e8071 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/OAuthException.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/OAuthException.java @@ -37,12 +37,14 @@ import com.google.api.client.json.GenericJson; import com.google.api.client.json.JsonParser; import java.io.IOException; -import javax.annotation.Nullable; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** * Encapsulates the standard OAuth error response. See * https://tools.ietf.org/html/rfc6749#section-5.2. */ +@NullMarked class OAuthException extends GoogleAuthException { private final String errorCode; @@ -72,13 +74,11 @@ String getErrorCode() { return errorCode; } - @Nullable - String getErrorDescription() { + @Nullable String getErrorDescription() { return errorDescription; } - @Nullable - String getErrorUri() { + @Nullable String getErrorUri() { return errorUri; } diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/PKCEProvider.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/PKCEProvider.java index 0a0b2f8dd774..f54ec600cbfd 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/PKCEProvider.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/PKCEProvider.java @@ -31,6 +31,9 @@ package com.google.auth.oauth2; +import org.jspecify.annotations.NullMarked; + +@NullMarked public interface PKCEProvider { /** * Get the code_challenge parameter used in PKCE. diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/PluggableAuthCredentialSource.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/PluggableAuthCredentialSource.java index 44406e7f97d0..dcd04635b4f7 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/PluggableAuthCredentialSource.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/PluggableAuthCredentialSource.java @@ -35,7 +35,8 @@ import java.math.BigDecimal; import java.util.Map; -import javax.annotation.Nullable; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** * Encapsulates the credential source portion of the configuration for PluggableAuthCredentials. @@ -57,6 +58,7 @@ * } * */ +@NullMarked public class PluggableAuthCredentialSource extends ExternalAccountCredentials.CredentialSource { // The default timeout for waiting for the executable to finish (30 seconds). @@ -133,8 +135,7 @@ int getTimeoutMs() { return executableTimeoutMs; } - @Nullable - String getOutputFilePath() { + @Nullable String getOutputFilePath() { return outputFilePath; } } diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/PluggableAuthCredentials.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/PluggableAuthCredentials.java index 19802bbf605f..7e02aee07cd9 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/PluggableAuthCredentials.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/PluggableAuthCredentials.java @@ -40,7 +40,8 @@ import java.util.Collection; import java.util.HashMap; import java.util.Map; -import javax.annotation.Nullable; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** * PluggableAuthCredentials enables the exchange of workload identity pool external credentials for @@ -97,6 +98,7 @@ * *

Please see this repositories README for a complete executable request/response specification. */ +@NullMarked public class PluggableAuthCredentials extends ExternalAccountCredentials { static final String PLUGGABLE_AUTH_METRICS_HEADER_VALUE = "executable"; @@ -209,8 +211,7 @@ public Builder toBuilder() { } @VisibleForTesting - @Nullable - ExecutableHandler getExecutableHandler() { + @Nullable ExecutableHandler getExecutableHandler() { return this.handler; } diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/PluggableAuthException.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/PluggableAuthException.java index 00e2809834f6..d6edbdaf6073 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/PluggableAuthException.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/PluggableAuthException.java @@ -33,7 +33,10 @@ import static com.google.common.base.Preconditions.checkNotNull; +import org.jspecify.annotations.NullMarked; + /** Encapsulates the error response's for 3rd party executables defined by the executable spec. */ +@NullMarked class PluggableAuthException extends OAuthException { PluggableAuthException(String errorCode, String errorDescription) { diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/PluggableAuthHandler.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/PluggableAuthHandler.java index 6d62d69116d2..141cd14fe839 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/PluggableAuthHandler.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/PluggableAuthHandler.java @@ -49,7 +49,8 @@ import java.util.concurrent.Executors; import java.util.concurrent.Future; import java.util.concurrent.TimeUnit; -import javax.annotation.Nullable; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** * Internal handler for retrieving 3rd party tokens from user defined scripts/executables for @@ -57,6 +58,7 @@ * *

See {@link PluggableAuthCredentials}. */ +@NullMarked final class PluggableAuthHandler implements ExecutableHandler { // The maximum supported version for the executable response. @@ -148,8 +150,7 @@ public String retrieveTokenFromExecutable(ExecutableOptions options) throws IOEx return executableResponse.getSubjectToken(); } - @Nullable - ExecutableResponse getCachedExecutableResponse(ExecutableOptions options) + @Nullable ExecutableResponse getCachedExecutableResponse(ExecutableOptions options) throws PluggableAuthException { ExecutableResponse executableResponse = null; if (options.getOutputFilePath() != null && !options.getOutputFilePath().isEmpty()) { diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/PropertyProvider.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/PropertyProvider.java index 93343c84ebab..3ff2d4d3e3c9 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/PropertyProvider.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/PropertyProvider.java @@ -31,12 +31,14 @@ package com.google.auth.oauth2; import com.google.api.core.InternalApi; +import org.jspecify.annotations.NullMarked; /** * Interface for a system property provider. * *

For internal use only. */ +@NullMarked @InternalApi public interface PropertyProvider { String getProperty(String property, String def); diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/QuotaProjectIdProvider.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/QuotaProjectIdProvider.java index fac3b97b69cf..921d8f81b39e 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/QuotaProjectIdProvider.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/QuotaProjectIdProvider.java @@ -31,7 +31,10 @@ package com.google.auth.oauth2; +import org.jspecify.annotations.NullMarked; + /** Interface for {@link GoogleCredentials} that return a quota project ID. */ +@NullMarked public interface QuotaProjectIdProvider { /** * @return the quota project ID used for quota and billing purposes diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/SecureSessionAgent.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/SecureSessionAgent.java index c36f5342f421..f75d23430de5 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/SecureSessionAgent.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/SecureSessionAgent.java @@ -49,6 +49,7 @@ import java.util.ServiceLoader; import java.util.Set; import javax.annotation.concurrent.ThreadSafe; +import org.jspecify.annotations.NullMarked; /** * Utilities to fetch the S2A (Secure Session Agent) address from the mTLS configuration. @@ -58,6 +59,7 @@ * *

This is an experimental utility. */ +@NullMarked @ThreadSafe public class SecureSessionAgent { static final String S2A_JSON_KEY = "s2a"; diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/SecureSessionAgentConfig.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/SecureSessionAgentConfig.java index 1a8c36399004..190248f2f5cf 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/SecureSessionAgentConfig.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/SecureSessionAgentConfig.java @@ -31,8 +31,10 @@ package com.google.auth.oauth2; import com.google.errorprone.annotations.CanIgnoreReturnValue; +import org.jspecify.annotations.NullMarked; /** Holds an mTLS configuration (consists of address of S2A) retrieved from the Metadata Server. */ +@NullMarked public class SecureSessionAgentConfig { // plaintextAddress is the plaintext address to reach the S2A. private final String plaintextAddress; diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ServiceAccountCredentials.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ServiceAccountCredentials.java index a65ddbe8d26e..5f14a7708558 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ServiceAccountCredentials.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ServiceAccountCredentials.java @@ -83,12 +83,15 @@ import java.util.Map; import java.util.Objects; import java.util.concurrent.Executor; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** * OAuth2 credentials representing a Service Account for calling Google APIs. * *

By default uses a JSON Web Token (JWT) to fetch access tokens. */ +@NullMarked public class ServiceAccountCredentials extends GoogleCredentials implements ServiceAccountSigner, IdTokenProvider, JwtProvider { @@ -116,7 +119,7 @@ public class ServiceAccountCredentials extends GoogleCredentials private transient HttpTransportFactory transportFactory; - private transient JwtCredentials selfSignedJwtCredentialsWithScope = null; + private transient @Nullable JwtCredentials selfSignedJwtCredentialsWithScope = null; /** * Internal constructor @@ -748,7 +751,7 @@ public GoogleCredentials createScoped(Collection newScopes) { */ @Override public GoogleCredentials createScoped( - Collection newScopes, Collection newDefaultScopes) { + Collection newScopes, @Nullable Collection newDefaultScopes) { return this.toBuilder().setScopes(newScopes, newDefaultScopes).setAccessToken(null).build(); } @@ -908,7 +911,7 @@ protected ToStringHelper toStringHelper() { } @Override - public boolean equals(Object obj) { + public boolean equals(@Nullable Object obj) { if (!(obj instanceof ServiceAccountCredentials)) { return false; } @@ -1008,12 +1011,13 @@ static URI getUriForSelfSignedJWT(URI uri) { } @VisibleForTesting - JwtCredentials createSelfSignedJwtCredentials(final URI uri) { + JwtCredentials createSelfSignedJwtCredentials(final @Nullable URI uri) { return createSelfSignedJwtCredentials(uri, scopes.isEmpty() ? defaultScopes : scopes); } @VisibleForTesting - JwtCredentials createSelfSignedJwtCredentials(final URI uri, Collection scopes) { + JwtCredentials createSelfSignedJwtCredentials( + final @Nullable URI uri, Collection scopes) { // Create a JwtCredentials for self-signed JWT. See https://google.aip.dev/auth/4111. JwtClaims.Builder claimsBuilder = JwtClaims.newBuilder().setIssuer(clientEmail).setSubject(clientEmail); diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ServiceAccountJwtAccessCredentials.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ServiceAccountJwtAccessCredentials.java index b1769eb8edc9..035351ebe034 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ServiceAccountJwtAccessCredentials.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ServiceAccountJwtAccessCredentials.java @@ -67,12 +67,15 @@ import java.util.concurrent.ExecutionException; import java.util.concurrent.Executor; import java.util.concurrent.TimeUnit; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** * Service Account credentials for calling Google APIs using a JWT directly for access. * *

Uses a JSON Web Token (JWT) directly in the request metadata to provide authorization. */ +@NullMarked public class ServiceAccountJwtAccessCredentials extends Credentials implements JwtProvider, ServiceAccountSigner, QuotaProjectIdProvider { @@ -131,8 +134,8 @@ private ServiceAccountJwtAccessCredentials( String clientEmail, PrivateKey privateKey, String privateKeyId, - URI defaultAudience, - String quotaProjectId, + @Nullable URI defaultAudience, + @Nullable String quotaProjectId, String universeDomain) { this.clientId = clientId; this.clientEmail = Preconditions.checkNotNull(clientEmail); @@ -169,8 +172,8 @@ static ServiceAccountJwtAccessCredentials fromJson(Map json) thr * @return the credentials defined by the JSON. * @throws IOException if the credential cannot be created from the JSON. */ - static ServiceAccountJwtAccessCredentials fromJson(Map json, URI defaultAudience) - throws IOException { + static ServiceAccountJwtAccessCredentials fromJson( + Map json, @Nullable URI defaultAudience) throws IOException { String clientId = (String) json.get("client_id"); String clientEmail = (String) json.get("client_email"); String privateKeyPkcs8 = (String) json.get("private_key"); @@ -230,7 +233,7 @@ public static ServiceAccountJwtAccessCredentials fromPkcs8( String clientEmail, String privateKeyPkcs8, String privateKeyId, - URI defaultAudience) + @Nullable URI defaultAudience) throws IOException { return ServiceAccountJwtAccessCredentials.fromPkcs8( clientId, @@ -248,7 +251,7 @@ static ServiceAccountJwtAccessCredentials fromPkcs8( String privateKeyPkcs8, String privateKeyId, URI defaultAudience, - String quotaProjectId, + @Nullable String quotaProjectId, String universeDomain) throws IOException { PrivateKey privateKey = OAuth2Utils.privateKeyFromPkcs8(privateKeyPkcs8); @@ -285,7 +288,7 @@ public static ServiceAccountJwtAccessCredentials fromStream(InputStream credenti * @throws IOException if the credential cannot be created from the stream. */ public static ServiceAccountJwtAccessCredentials fromStream( - InputStream credentialsStream, URI defaultAudience) throws IOException { + InputStream credentialsStream, @Nullable URI defaultAudience) throws IOException { Preconditions.checkNotNull(credentialsStream); JsonFactory jsonFactory = OAuth2Utils.JSON_FACTORY; @@ -477,7 +480,7 @@ public String toString() { } @Override - public boolean equals(Object obj) { + public boolean equals(@Nullable Object obj) { if (!(obj instanceof ServiceAccountJwtAccessCredentials)) { return false; } diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/Slf4jLoggingHelpers.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/Slf4jLoggingHelpers.java index b10328661b71..02c1e2681539 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/Slf4jLoggingHelpers.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/Slf4jLoggingHelpers.java @@ -48,9 +48,11 @@ import java.util.Set; import java.util.TreeSet; import java.util.logging.Level; +import org.jspecify.annotations.NullMarked; import org.slf4j.Logger; /** Contains helper methods to log auth requests and responses */ +@NullMarked class Slf4jLoggingHelpers { private static final Gson gson = new Gson(); private static final Set SENSITIVE_KEYS = new TreeSet<>(String.CASE_INSENSITIVE_ORDER); diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/Slf4jUtils.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/Slf4jUtils.java index 887221d61a76..5aaacaab795a 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/Slf4jUtils.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/Slf4jUtils.java @@ -34,6 +34,7 @@ import com.google.gson.Gson; import java.util.Map; import java.util.Map.Entry; +import org.jspecify.annotations.NullMarked; import org.slf4j.ILoggerFactory; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -41,6 +42,7 @@ import org.slf4j.spi.LoggingEventBuilder; /** Contains util methods to get SLF4J logger and log conditionally based SLF4J major version */ +@NullMarked class Slf4jUtils { private static final Logger NO_OP_LOGGER = org.slf4j.helpers.NOPLogger.NOP_LOGGER; diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/StsRequestHandler.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/StsRequestHandler.java index ecd33ca14cf6..b1db8b682b9c 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/StsRequestHandler.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/StsRequestHandler.java @@ -48,7 +48,8 @@ import java.util.ArrayList; import java.util.Arrays; import java.util.List; -import javax.annotation.Nullable; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** * Implements the OAuth 2.0 token exchange based on Use the {@link #newBuilder(String, StsTokenExchangeRequest, HttpRequestFactory)} method to * create a new builder for constructing an instance of this class. */ +@NullMarked public final class StsRequestHandler { private static final LoggerProvider LOGGER_PROVIDER = LoggerProvider.forClazz(StsRequestHandler.class); diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/StsTokenExchangeRequest.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/StsTokenExchangeRequest.java index f0ce390ed47b..036e28aa0846 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/StsTokenExchangeRequest.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/StsTokenExchangeRequest.java @@ -35,7 +35,8 @@ import com.google.errorprone.annotations.CanIgnoreReturnValue; import java.util.List; -import javax.annotation.Nullable; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** * Represents an OAuth 2.0 token exchange request, as defined in Instances of this class are immutable. Use the {@link #newBuilder(String, String)} method to * create a new builder. */ +@NullMarked public final class StsTokenExchangeRequest { private static final String GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange"; diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/StsTokenExchangeResponse.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/StsTokenExchangeResponse.java index 62275778a867..51881027906c 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/StsTokenExchangeResponse.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/StsTokenExchangeResponse.java @@ -37,7 +37,8 @@ import java.util.ArrayList; import java.util.Date; import java.util.List; -import javax.annotation.Nullable; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** * Represents a successful OAuth 2.0 token exchange response from the Google Security Token Service @@ -51,6 +52,7 @@ *

Instances are immutable. Use {@link #newBuilder(String, String, String)} to create an * instance. */ +@NullMarked public final class StsTokenExchangeResponse { private final AccessToken accessToken; private final String issuedTokenType; diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/SystemEnvironmentProvider.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/SystemEnvironmentProvider.java index a58285831598..7250af472d8d 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/SystemEnvironmentProvider.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/SystemEnvironmentProvider.java @@ -32,12 +32,14 @@ import com.google.api.core.InternalApi; import java.io.Serializable; +import org.jspecify.annotations.NullMarked; /** * Represents the default system environment provider. * *

For internal use only. */ +@NullMarked @InternalApi public class SystemEnvironmentProvider implements EnvironmentProvider, Serializable { static final SystemEnvironmentProvider INSTANCE = new SystemEnvironmentProvider(); diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/SystemPropertyProvider.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/SystemPropertyProvider.java index 6c2042329be8..aaf883577fea 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/SystemPropertyProvider.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/SystemPropertyProvider.java @@ -32,12 +32,14 @@ import com.google.api.core.InternalApi; import java.io.Serializable; +import org.jspecify.annotations.NullMarked; /** * Represents the default system property provider. * *

For internal use only. */ +@NullMarked @InternalApi public class SystemPropertyProvider implements PropertyProvider, Serializable { public static final SystemPropertyProvider INSTANCE = new SystemPropertyProvider(); diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/TokenStore.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/TokenStore.java index 1d1e917a61be..50f712c3b322 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/TokenStore.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/TokenStore.java @@ -32,8 +32,10 @@ package com.google.auth.oauth2; import java.io.IOException; +import org.jspecify.annotations.NullMarked; /** Interface for long term storage of tokens */ +@NullMarked public interface TokenStore { /** diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/TokenVerifier.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/TokenVerifier.java index d07e3884ecba..2962cd6679fb 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/TokenVerifier.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/TokenVerifier.java @@ -74,6 +74,8 @@ import java.util.Set; import java.util.concurrent.ExecutionException; import java.util.concurrent.TimeUnit; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** * Handle verification of Google-signed JWT tokens. @@ -81,6 +83,7 @@ * @author Jeff Ching * @since 0.21.0 */ +@NullMarked public class TokenVerifier { private static final String IAP_CERT_URL = "https://www.gstatic.com/iap/verify/public_key-jwk"; private static final String FEDERATED_SIGNON_CERT_URL = @@ -371,7 +374,7 @@ public Map load(String certificateUrl) throws Exception { return keyCache; } - private PublicKey buildPublicKey(JsonWebKey key) + private @Nullable PublicKey buildPublicKey(JsonWebKey key) throws NoSuchAlgorithmException, InvalidParameterSpecException, InvalidKeySpecException { if ("ES256".equals(key.alg)) { return buildEs256PublicKey(key); diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/UrlIdentityPoolSubjectTokenSupplier.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/UrlIdentityPoolSubjectTokenSupplier.java index 10030d67c9d2..9a95701371b3 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/UrlIdentityPoolSubjectTokenSupplier.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/UrlIdentityPoolSubjectTokenSupplier.java @@ -40,11 +40,13 @@ import com.google.api.client.json.JsonObjectParser; import com.google.auth.http.HttpTransportFactory; import java.io.IOException; +import org.jspecify.annotations.NullMarked; /** * Provider for retrieving the subject tokens for {@link IdentityPoolCredentials} to exchange for * GCP access tokens. The subject token is retrieved by calling a URL that returns the token. */ +@NullMarked class UrlIdentityPoolSubjectTokenSupplier implements IdentityPoolSubjectTokenSupplier { private static final LoggerProvider LOGGER_PROVIDER = diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/UserAuthorizer.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/UserAuthorizer.java index e99e67f6186b..60f982ae6398 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/UserAuthorizer.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/UserAuthorizer.java @@ -52,9 +52,11 @@ import java.util.Date; import java.util.List; import java.util.Map; -import javax.annotation.Nullable; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** Handles an interactive 3-Legged-OAuth2 (3LO) user consent authorization. */ +@NullMarked public class UserAuthorizer { private static final LoggerProvider LOGGER_PROVIDER = @@ -196,7 +198,10 @@ public URL getAuthorizationUrl(String userId, String state, URI baseUri) { * @return The URL that can be navigated or redirected to. */ public URL getAuthorizationUrl( - String userId, String state, URI baseUri, Map additionalParameters) { + String userId, + String state, + URI baseUri, + @Nullable Map additionalParameters) { URI resolvedCallbackUri = getCallbackUri(baseUri); String scopesString = Joiner.on(' ').join(scopes); @@ -235,6 +240,7 @@ public URL getAuthorizationUrl( * @return The loaded credentials or null if there are no valid approved credentials. * @throws IOException If there is error retrieving or loading the credentials. */ + @Nullable public UserCredentials getCredentials(String userId) throws IOException { Preconditions.checkNotNull(userId); if (tokenStore == null) { @@ -297,7 +303,8 @@ public UserCredentials getCredentialsFromCode(String code, URI baseUri) throws I * @throws IOException An error from the server API call to get the tokens. */ public UserCredentials getCredentialsFromCode( - String code, URI baseUri, Map additionalParameters) throws IOException { + String code, URI baseUri, @Nullable Map additionalParameters) + throws IOException { TokenResponseWithConfig tokenResponseWithConfig = getCredentialsFromCodeInternal(code, baseUri, additionalParameters); return UserCredentials.newBuilder() diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/UserCredentials.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/UserCredentials.java index 5ec0920411d7..dcd024a30b57 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/UserCredentials.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/UserCredentials.java @@ -60,8 +60,11 @@ import java.util.List; import java.util.Map; import java.util.Objects; +import org.jspecify.annotations.NullMarked; +import org.jspecify.annotations.Nullable; /** OAuth2 Credentials representing a user's identity and consent. */ +@NullMarked public class UserCredentials extends GoogleCredentials implements IdTokenProvider { private static final String GRANT_TYPE = "refresh_token"; @@ -382,7 +385,7 @@ public String toString() { } @Override - public boolean equals(Object obj) { + public boolean equals(@Nullable Object obj) { if (!(obj instanceof UserCredentials)) { return false; } @@ -471,7 +474,7 @@ Builder setAccount(String account) { @Override @CanIgnoreReturnValue - public Builder setAccessToken(AccessToken token) { + public Builder setAccessToken(@Nullable AccessToken token) { super.setAccessToken(token); return this; } diff --git a/google-auth-library-java/oauth2_http/javatests/com/google/auth/TestUtils.java b/google-auth-library-java/oauth2_http/javatests/com/google/auth/TestUtils.java index 91b648992848..2f75fc7f519d 100644 --- a/google-auth-library-java/oauth2_http/javatests/com/google/auth/TestUtils.java +++ b/google-auth-library-java/oauth2_http/javatests/com/google/auth/TestUtils.java @@ -55,7 +55,7 @@ import java.util.HashMap; import java.util.List; import java.util.Map; -import javax.annotation.Nullable; +import org.jspecify.annotations.Nullable; /** Utilities for test code under com.google.auth. */ public class TestUtils { diff --git a/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/CertificateIdentityPoolSubjectTokenSupplierTest.java b/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/CertificateIdentityPoolSubjectTokenSupplierTest.java index dfb81281db53..06965d02f569 100644 --- a/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/CertificateIdentityPoolSubjectTokenSupplierTest.java +++ b/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/CertificateIdentityPoolSubjectTokenSupplierTest.java @@ -57,17 +57,13 @@ import java.util.List; import org.junit.jupiter.api.BeforeEach; import org.junit.jupiter.api.Test; -import org.junit.jupiter.api.extension.ExtendWith; -import org.mockito.Mock; -import org.mockito.junit.jupiter.MockitoExtension; /** Tests for {@link CertificateIdentityPoolSubjectTokenSupplier}. */ -@ExtendWith(MockitoExtension.class) class CertificateIdentityPoolSubjectTokenSupplierTest { - @Mock private IdentityPoolCredentialSource mockCredentialSource; - @Mock private CertificateConfig mockCertificateConfig; - @Mock private ExternalAccountSupplierContext mockContext; + private IdentityPoolCredentialSource mockCredentialSource; + private CertificateConfig mockCertificateConfig; + private ExternalAccountSupplierContext mockContext; private CertificateIdentityPoolSubjectTokenSupplier supplier; @@ -85,6 +81,18 @@ class CertificateIdentityPoolSubjectTokenSupplierTest { @BeforeEach void setUp() throws IOException, URISyntaxException { + mockCredentialSource = + org.mockito.Mockito.mock( + IdentityPoolCredentialSource.class, + org.mockito.Mockito.withSettings().withoutAnnotations()); + mockCertificateConfig = + org.mockito.Mockito.mock( + CertificateConfig.class, org.mockito.Mockito.withSettings().withoutAnnotations()); + mockContext = + org.mockito.Mockito.mock( + ExternalAccountSupplierContext.class, + org.mockito.Mockito.withSettings().withoutAnnotations()); + ClassLoader classLoader = getClass().getClassLoader(); URL leafCertUrl = classLoader.getResource("x509_leaf_certificate.pem"); assertNotNull(leafCertUrl, "Test leaf certificate file not found!"); diff --git a/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/IamUtilsTest.java b/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/IamUtilsTest.java index c9413c6cbdba..3e9e8258a0d9 100644 --- a/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/IamUtilsTest.java +++ b/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/IamUtilsTest.java @@ -56,7 +56,8 @@ void setup() throws IOException { // Mock this call for the Credentials because the IAM SignBlob RPC requires an access token. The // call is initialized with HttpCredentialsAdapter which will make a call to get the access // token - credentials = Mockito.mock(ServiceAccountCredentials.class); + credentials = + Mockito.mock(ServiceAccountCredentials.class, Mockito.withSettings().withoutAnnotations()); Mockito.when(credentials.getRequestMetadata(Mockito.any())).thenReturn(ImmutableMap.of()); Mockito.when(credentials.getUniverseDomain()).thenReturn("googleapis.com"); } diff --git a/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/IdentityPoolCredentialsTest.java b/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/IdentityPoolCredentialsTest.java index 674d523e5090..a1662cc10191 100644 --- a/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/IdentityPoolCredentialsTest.java +++ b/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/IdentityPoolCredentialsTest.java @@ -61,7 +61,7 @@ import java.util.HashMap; import java.util.List; import java.util.Map; -import javax.annotation.Nullable; +import org.jspecify.annotations.Nullable; import org.junit.jupiter.api.Test; import org.junit.jupiter.api.extension.ExtendWith; import org.mockito.junit.jupiter.MockitoExtension; diff --git a/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/ImpersonatedCredentialsTest.java b/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/ImpersonatedCredentialsTest.java index 044aa0ce6755..77ac9c06f995 100644 --- a/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/ImpersonatedCredentialsTest.java +++ b/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/ImpersonatedCredentialsTest.java @@ -850,7 +850,10 @@ void sign_universeDomainException() throws IOException { // Currently, no credentials allowed as source credentials throws exception for // getUniverseDomain(), mock this behavior for test only. ServiceAccountCredentials // should not throw for getUniverseDomain() calls. - ServiceAccountCredentials sourceCredentialsMock = mock(ServiceAccountCredentials.class); + ServiceAccountCredentials sourceCredentialsMock = + mock( + ServiceAccountCredentials.class, + org.mockito.Mockito.withSettings().withoutAnnotations()); when(sourceCredentialsMock.getUniverseDomain()).thenThrow(IOException.class); MockIAMCredentialsServiceTransportFactory transportFactory = diff --git a/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/PluggableAuthCredentialsTest.java b/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/PluggableAuthCredentialsTest.java index 094b21f9dbb2..a07d9450de35 100644 --- a/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/PluggableAuthCredentialsTest.java +++ b/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/PluggableAuthCredentialsTest.java @@ -51,7 +51,7 @@ import java.util.HashMap; import java.util.List; import java.util.Map; -import javax.annotation.Nullable; +import org.jspecify.annotations.Nullable; import org.junit.jupiter.api.Test; /** Tests for {@link PluggableAuthCredentials}. */ diff --git a/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/PluggableAuthHandlerTest.java b/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/PluggableAuthHandlerTest.java index 1566c7eed418..121adbd9bc2f 100644 --- a/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/PluggableAuthHandlerTest.java +++ b/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/PluggableAuthHandlerTest.java @@ -56,7 +56,7 @@ import java.util.List; import java.util.Map; import java.util.concurrent.TimeUnit; -import javax.annotation.Nullable; +import org.jspecify.annotations.Nullable; import org.junit.jupiter.api.Test; import org.junit.jupiter.api.extension.ExtendWith; import org.mockito.Mockito; diff --git a/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/Slf4jUtilsLogbackTest.java b/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/Slf4jUtilsLogbackTest.java index fd8ad94af812..a95273bcb237 100644 --- a/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/Slf4jUtilsLogbackTest.java +++ b/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/Slf4jUtilsLogbackTest.java @@ -141,7 +141,8 @@ void testLogGenericData() { data.put("key1", "value1"); data.put("token", "value2"); - LoggerProvider loggerProvider = mock(LoggerProvider.class); + LoggerProvider loggerProvider = + mock(LoggerProvider.class, org.mockito.Mockito.withSettings().withoutAnnotations()); when(loggerProvider.getLogger()).thenReturn(LOGGER); LoggingUtils.logResponsePayload(data, loggerProvider, "test generic data"); @@ -176,7 +177,8 @@ void testLogRequest() throws IOException { HttpRequest request = requestFactory.buildPostRequest(new GenericUrl(OAuth2Utils.TOKEN_SERVER_URI), content); - LoggerProvider loggerProvider = mock(LoggerProvider.class); + LoggerProvider loggerProvider = + mock(LoggerProvider.class, org.mockito.Mockito.withSettings().withoutAnnotations()); when(loggerProvider.getLogger()).thenReturn(LOGGER); LoggingUtils.logRequest(request, loggerProvider, "test log request"); diff --git a/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/Slf4jUtilsTest.java b/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/Slf4jUtilsTest.java index c3ee5b8725f4..4379121effc2 100644 --- a/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/Slf4jUtilsTest.java +++ b/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/Slf4jUtilsTest.java @@ -84,8 +84,10 @@ void testGetLogger_loggingEnabled_noBinding() { testEnvironmentProvider.setEnv(LoggingUtils.GOOGLE_SDK_JAVA_LOGGING, "true"); LoggingUtils.setEnvironmentProvider(testEnvironmentProvider); // Create a mock LoggerFactoryProvider - LoggerFactoryProvider mockLoggerFactoryProvider = mock(LoggerFactoryProvider.class); - ILoggerFactory mockLoggerFactory = mock(ILoggerFactory.class); + LoggerFactoryProvider mockLoggerFactoryProvider = + mock(LoggerFactoryProvider.class, org.mockito.Mockito.withSettings().withoutAnnotations()); + ILoggerFactory mockLoggerFactory = + mock(ILoggerFactory.class, org.mockito.Mockito.withSettings().withoutAnnotations()); when(mockLoggerFactoryProvider.getLoggerFactory()).thenReturn(mockLoggerFactory); when(mockLoggerFactory.getLogger(anyString())) .thenReturn(org.slf4j.helpers.NOPLogger.NOP_LOGGER); diff --git a/google-auth-library-java/oauth2_http/pom.xml b/google-auth-library-java/oauth2_http/pom.xml index e61f5d33fb8a..c9bff7a80d87 100644 --- a/google-auth-library-java/oauth2_http/pom.xml +++ b/google-auth-library-java/oauth2_http/pom.xml @@ -237,6 +237,10 @@ + + org.jspecify + jspecify + com.google.guava guava diff --git a/google-auth-library-java/pom.xml b/google-auth-library-java/pom.xml index 49cb98fadaf6..6ad83565f4cd 100644 --- a/google-auth-library-java/pom.xml +++ b/google-auth-library-java/pom.xml @@ -184,6 +184,11 @@ error_prone_annotations ${project.error-prone.version} + + org.jspecify + jspecify + 1.0.0 + commons-codec commons-codec