Simplified logic.

vverman · vverman · commit 97fa19f1e8e9 · 2026-06-04T18:07:28.000-07:00
diff --git a/core/packages/google-auth-library-nodejs/src/auth/computeclient.ts b/core/packages/google-auth-library-nodejs/src/auth/computeclient.ts
@@ -42,8 +42,7 @@ export class Compute extends OAuth2Client {
   private static readonly EMAIL_REGEX = /^[^@]+@[^@]+\.[^@]+$/;
   readonly serviceAccountEmail: string;
   scopes: string[];
-  private rabLookupSkippedWarningLogged = false;
-  private resolvedServiceAccountEmail?: string;
+  private isNonEmailAccount = false;
 
   /**
    * Google Compute Engine service account credentials.
@@ -145,21 +144,18 @@ export class Compute extends OAuth2Client {
 
   /**
    * Returns the regional access boundary lookup URL for the GCE instance.
-   * This implementation resolves the default service account email of the GCE
-   * instance to construct the lookup endpoint.
+   * This implementation resolves the service account email of the GCE
+   * instance to construct the lookup endpoint. If the resolved email is invalid
+   * or not found, it returns `null` to skip the regional access boundary check.
    *
-   * @return The regional access boundary URL string.
+   * @return The regional access boundary URL string, or null if regional access
+   * boundary checks should be skipped.
    * @internal
    */
   public async getRegionalAccessBoundaryUrl(): Promise<string | null> {
     const email = await this.resolveServiceAccountEmail();
-    if (!email || !Compute.EMAIL_REGEX.test(email)) {
-      if (!this.rabLookupSkippedWarningLogged) {
-        AuthClient.log.info(
-          `RegionalAccessBoundary: Service account email "${email}" is not in a valid email format. Skipping regional access boundary lookup.`,
-        );
-        this.rabLookupSkippedWarningLogged = true;
-      }
+    if (email === null) {
+      // This credential corresponds to a non-email account; skip RAB lookup.
       return null;
     }
     const regionalAccessBoundaryUrl = SERVICE_ACCOUNT_LOOKUP_ENDPOINT.replace(
@@ -172,24 +168,34 @@ export class Compute extends OAuth2Client {
   /**
    * Resolves the service account email. If the email is set to 'default',
    * it fetches the email from the GCE metadata server.
-   * @returns A promise that resolves with the service account email.
+   * @returns A promise that resolves with the service account email,
+   *  or null if MDS returns an invalid email format
    */
-  private async resolveServiceAccountEmail(): Promise<string> {
+  private async resolveServiceAccountEmail(): Promise<string | null> {
+    if (this.isNonEmailAccount) {
+      return null;
+    }
+
     if (this.serviceAccountEmail !== 'default') {
       // If a specific email is provided, return it directly.
       return this.serviceAccountEmail;
     }
 
-    if (this.resolvedServiceAccountEmail !== undefined) {
-      return this.resolvedServiceAccountEmail;
-    }
-
     // Otherwise, fetch the default email from the metadata server.
     try {
       const email = await gcpMetadata.instance<string>(
         'service-accounts/default/email',
       );
-      this.resolvedServiceAccountEmail = email;
+
+      // If the metadata server returned an non-email format, log a warning only once.
+      if (!email || !Compute.EMAIL_REGEX.test(email)) {
+        AuthClient.log.info(
+          `RegionalAccessBoundary: Service account email "${email}" is not in a valid email format. Skipping regional access boundary lookup.`,
+        );
+        this.isNonEmailAccount = true;
+        return null;
+      }
+
       return email;
     } catch (e) {
       throw new Error(
diff --git a/core/packages/google-auth-library-nodejs/test/test.compute.ts b/core/packages/google-auth-library-nodejs/test/test.compute.ts
@@ -384,10 +384,32 @@ describe('compute', () => {
       assert.strictEqual(url, null);
     });
 
-    it('should return null from getRegionalAccessBoundaryUrl if custom serviceAccountEmail is not a valid email format', async () => {
-      const compute = new Compute({serviceAccountEmail: 'not-an-email'});
+    it('should return valid URL from getRegionalAccessBoundaryUrl if custom serviceAccountEmail is set', async () => {
+      const email = 'custom-sa@example.com';
+      const compute = new Compute({serviceAccountEmail: email});
       const url = await compute.getRegionalAccessBoundaryUrl();
-      assert.strictEqual(url, null);
+      const expectedUrl = SERVICE_ACCOUNT_LOOKUP_ENDPOINT.replace(
+        '{service_account_email}',
+        encodeURIComponent(email),
+      );
+      assert.strictEqual(url, expectedUrl);
+    });
+
+    it('should return valid URL from getRegionalAccessBoundaryUrl when MDS returns a valid default service account email', async () => {
+      const compute = new Compute();
+      const fakeEmail = 'fake-default-sa@developer.gserviceaccount.com';
+      const metadataStub = sandbox.stub(gcpMetadata, 'instance');
+      metadataStub.callThrough();
+      metadataStub
+        .withArgs('service-accounts/default/email')
+        .resolves(fakeEmail);
+
+      const url = await compute.getRegionalAccessBoundaryUrl();
+      const expectedUrl = SERVICE_ACCOUNT_LOOKUP_ENDPOINT.replace(
+        '{service_account_email}',
+        encodeURIComponent(fakeEmail),
+      );
+      assert.strictEqual(url, expectedUrl);
     });
 
     it('should NOT trigger asynchronous RAB refresh and NOT attach RAB header if email from metadata server is not a valid email format', async () => {
