#20534

Committed 16 Oct 2026 08:25AM UTC coverage: 89.428% (-0.008%) from 89.436%

Build # #20534

Build Type

push

github

Committed by

web-flow

Commit Message

api, auth: add CallCredentials.allowedSecurityLevel() helper (#13056)

Adds a `protected static` helper on `CallCredentials`.

Coverage Stats

39361 of 44014 relevant lines covered (89.43%)

0.89 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

66.67

/../api/src/main/java/io/grpc/CallCredentials.java

/*
 * Copyright 2016 The gRPC Authors
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package io.grpc;

import java.util.concurrent.Executor;

/**
 * Carries credential data that will be propagated to the server via request metadata for each RPC.
 *
 * <p>This is used by {@link CallOptions#withCallCredentials} and {@code withCallCredentials()} on
 * the generated stub, for example:
 * <pre>
 * FooGrpc.FooStub stub = FooGrpc.newStub(channel);
 * response = stub.withCallCredentials(creds).bar(request);
 * </pre>
 *
 * <p>The contents and nature of this class (and whether it remains an abstract class) is
 * experimental, in that it can change. However, we are guaranteeing stability for the
 * <em>name</em>. That is, we are guaranteeing stability for code to be returned a reference and
 * pass that reference to gRPC for usage. However, code may not call or implement the {@code
 * CallCredentials} itself if it wishes to only use stable APIs.
 */
public abstract class CallCredentials {

  /**
   * Pass the credential data to the given {@link CallCredentials.MetadataApplier}, which will
   * propagate it to the request metadata.
   *
   * <p>It is called for each individual RPC, within the {@link Context} of the call, before the
   * stream is about to be created on a transport. Implementations should not block in this
   * method. If metadata is not immediately available, e.g., needs to be fetched from network, the
   * implementation may give the {@code appExecutor} an asynchronous task which will eventually call
   * the {@code applier}. The RPC proceeds only after the {@code applier} is called.
   *
   * @param requestInfo request-related information
   * @param appExecutor The application thread-pool. It is provided to the implementation in case it
   *        needs to perform blocking operations.
   * @param applier The outlet of the produced headers. It can be called either before or after this
   *        method returns.
   */
  public abstract void applyRequestMetadata(
      RequestInfo requestInfo, Executor appExecutor, CallCredentials.MetadataApplier applier);

  /**
   * With this class now being stable this method moves from an abstract one to a normal one with
   * a no-op implementation. This method is marked deprecated to allow extenders time to remove the
   * method before it is removed here.
   */
  @ExperimentalApi("https://github.com/grpc/grpc-java/issues/1914")
  @Deprecated
  public void thisUsesUnstableApi() {
  }

  /**
   * Determines whether the security level of the transport is higher than or equal to the minimum
   * security level required to transfer these {@link CallCredentials}.
   *
   * <p>It is intended to be called from {@link #applyRequestMetadata} before sending any individual
   * RPC. The credentials should not be sent if this method returns {@code false}. More details can
   * be found in <a
   * href="https://github.com/grpc/proposal/blob/master/L62-core-call-credential-security-level.md">
   * gRFC L62</a>.
   *
   * @param requestInfo request-related information
   * @param minSecurity minimum security level required by these {@code CallCredentials}
   */
  protected static final boolean allowedSecurityLevel(
      RequestInfo requestInfo, SecurityLevel minSecurity) {
    return requestInfo.getSecurityLevel().compareTo(minSecurity) >= 0;
  }

  /**
   * The outlet of the produced headers. Not thread-safe.
   *
   * <p>Exactly one of its methods must be called to make the RPC proceed.
   */
  public abstract static class MetadataApplier {
    /**
     * Called when headers are successfully generated. They will be merged into the original
     * headers.
     */
    public abstract void apply(Metadata headers);

    /**
     * Called when there has been an error when preparing the headers. This will fail the RPC.
     */
    public abstract void fail(Status status);
  }

  /**
   * The request-related information passed to {@code CallCredentials.applyRequestMetadata()}.
   */
  public abstract static class RequestInfo {
    /**
     * The method descriptor of this RPC.
     */
    public abstract MethodDescriptor<?, ?> getMethodDescriptor();

    /**
     * The call options used to call this RPC.
     */
    public CallOptions getCallOptions() {
      throw new UnsupportedOperationException("Not implemented");
    }

    /**
     * The security level on the transport.
     */
    public abstract SecurityLevel getSecurityLevel();

    /**
     * Returns the authority string used to authenticate the server for this call.
     */
    public abstract String getAuthority();

    /**
     * Returns the transport attributes.
     */
    @Grpc.TransportAttr
    public abstract Attributes getTransportAttrs();
  }
}

1	/*
2	* Copyright 2016 The gRPC Authors
3	*
4	* Licensed under the Apache License, Version 2.0 (the "License");
5	* you may not use this file except in compliance with the License.
6	* You may obtain a copy of the License at
7	*
8	* http://www.apache.org/licenses/LICENSE-2.0
9	*
10	* Unless required by applicable law or agreed to in writing, software
11	* distributed under the License is distributed on an "AS IS" BASIS,
12	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13	* See the License for the specific language governing permissions and
14	* limitations under the License.
15	*/
16
17	package io.grpc;
18
19	import java.util.concurrent.Executor;
20
21	/**
22	* Carries credential data that will be propagated to the server via request metadata for each RPC.
23	*
24	* <p>This is used by {@link CallOptions#withCallCredentials} and {@code withCallCredentials()} on
25	* the generated stub, for example:
26	* <pre>
27	* FooGrpc.FooStub stub = FooGrpc.newStub(channel);
28	* response = stub.withCallCredentials(creds).bar(request);
29	* </pre>
30	*
31	* <p>The contents and nature of this class (and whether it remains an abstract class) is
32	* experimental, in that it can change. However, we are guaranteeing stability for the
33	* <em>name</em>. That is, we are guaranteeing stability for code to be returned a reference and
34	* pass that reference to gRPC for usage. However, code may not call or implement the {@code
35	* CallCredentials} itself if it wishes to only use stable APIs.
36	*/
37	public abstract class CallCredentials {	1 ✔
38
39	/**
40	* Pass the credential data to the given {@link CallCredentials.MetadataApplier}, which will
41	* propagate it to the request metadata.
42	*
43	* <p>It is called for each individual RPC, within the {@link Context} of the call, before the
44	* stream is about to be created on a transport. Implementations should not block in this
45	* method. If metadata is not immediately available, e.g., needs to be fetched from network, the
46	* implementation may give the {@code appExecutor} an asynchronous task which will eventually call
47	* the {@code applier}. The RPC proceeds only after the {@code applier} is called.
48	*
49	* @param requestInfo request-related information
50	* @param appExecutor The application thread-pool. It is provided to the implementation in case it
51	* needs to perform blocking operations.
52	* @param applier The outlet of the produced headers. It can be called either before or after this
53	* method returns.
54	*/
55	public abstract void applyRequestMetadata(
56	RequestInfo requestInfo, Executor appExecutor, CallCredentials.MetadataApplier applier);
57
58	/**
59	* With this class now being stable this method moves from an abstract one to a normal one with
60	* a no-op implementation. This method is marked deprecated to allow extenders time to remove the
61	* method before it is removed here.
62	*/
63	@ExperimentalApi("https://github.com/grpc/grpc-java/issues/1914")
64	@Deprecated
65	public void thisUsesUnstableApi() {
66	}	×
67
68	/**
69	* Determines whether the security level of the transport is higher than or equal to the minimum
70	* security level required to transfer these {@link CallCredentials}.
71	*
72	* <p>It is intended to be called from {@link #applyRequestMetadata} before sending any individual
73	* RPC. The credentials should not be sent if this method returns {@code false}. More details can
74	* be found in <a
75	* href="https://github.com/grpc/proposal/blob/master/L62-core-call-credential-security-level.md">
76	* gRFC L62</a>.
77	*
78	* @param requestInfo request-related information
79	* @param minSecurity minimum security level required by these {@code CallCredentials}
80	*/
81	protected static final boolean allowedSecurityLevel(
82	RequestInfo requestInfo, SecurityLevel minSecurity) {
83	return requestInfo.getSecurityLevel().compareTo(minSecurity) >= 0;	1 ✔
84	}
85
86	/**
87	* The outlet of the produced headers. Not thread-safe.
88	*
89	* <p>Exactly one of its methods must be called to make the RPC proceed.
90	*/
91	public abstract static class MetadataApplier {	1 ✔
92	/**
93	* Called when headers are successfully generated. They will be merged into the original
94	* headers.
95	*/
96	public abstract void apply(Metadata headers);
97
98	/**
99	* Called when there has been an error when preparing the headers. This will fail the RPC.
100	*/
101	public abstract void fail(Status status);
102	}
103
104	/**
105	* The request-related information passed to {@code CallCredentials.applyRequestMetadata()}.
106	*/
107	public abstract static class RequestInfo {	1 ✔
108	/**
109	* The method descriptor of this RPC.
110	*/
111	public abstract MethodDescriptor<?, ?> getMethodDescriptor();
112
113	/**
114	* The call options used to call this RPC.
115	*/
116	public CallOptions getCallOptions() {
117	throw new UnsupportedOperationException("Not implemented");	×
118	}
119
120	/**
121	* The security level on the transport.
122	*/
123	public abstract SecurityLevel getSecurityLevel();
124
125	/**
126	* Returns the authority string used to authenticate the server for this call.
127	*/
128	public abstract String getAuthority();
129
130	/**
131	* Returns the transport attributes.
132	*/
133	@Grpc.TransportAttr
134	public abstract Attributes getTransportAttrs();
135	}
136	}

grpc / grpc-java / #20534

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous