Review session improvements

- Fix copyright year (2024 -> 2026) in FileIdentityPoolSubjectTokenSupplier
- Add Javadoc explaining class name retained for serialization compatibility
- Add hasKeyStore() to MtlsHttpTransportFactory for watertight mTLS validation
- Update isMtlsConfigured() to verify KeyStore is non-null via hasKeyStore()
- Update no-arg constructor Javadoc to explain serialization requirement
- Add comment to Builder copy constructor explaining supplier reconstruction
- Add 3 unit tests for hasKeyStore() and no-arg factory validation

Author: macastelaz

google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsHttpTransportFactory.java

@@ -55,10 +55,12 @@ public class MtlsHttpTransportFactory implements HttpTransportFactory {
   @Nullable private final KeyStore mtlsKeyStore;
 
   /**
-   * No-arg constructor required for deserialization via reflection. Not intended for direct use;
-   * callers should use {@link #MtlsHttpTransportFactory(KeyStore)}.
+   * No-arg constructor required for Java serialization. {@link IdentityPoolCredentials} stores this
+   * factory in its serializable {@code transportFactory} field, and {@link
+   * java.io.ObjectInputStream} needs a no-arg constructor to reconstruct it during
+   * deserialization. Not intended for direct use; callers should use {@link
+   * #MtlsHttpTransportFactory(KeyStore)}.
    */
-  @InternalApi
   public MtlsHttpTransportFactory() {
     this.mtlsKeyStore = null;
   }
@@ -74,6 +76,15 @@ public MtlsHttpTransportFactory(KeyStore mtlsKeyStore) {
     this.mtlsKeyStore = Objects.requireNonNull(mtlsKeyStore, "mtlsKeyStore cannot be null");
   }
 
+  /**
+   * Returns whether this factory was constructed with a non-null {@link KeyStore} containing
+   * client certificates for mTLS. A factory created via the no-arg constructor (e.g. during
+   * deserialization) will return {@code false}.
+   */
+  public boolean hasKeyStore() {
+    return this.mtlsKeyStore != null;
+  }
+
   @Override
   public HttpTransport create() {
     try {

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/FileIdentityPoolSubjectTokenSupplier.java

@@ -52,6 +52,10 @@
 /**
  * Internal provider for retrieving the subject and actor tokens for {@link IdentityPoolCredentials}
  * to exchange for GCP access tokens via a local file.
+ *
+ * <p>Note: Despite the name, this class handles both subject <em>and</em> actor tokens. The class
+ * name retains "Subject" for serialization backward compatibility; renaming it would break
+ * deserialization of previously serialized credentials.
  */
 @NullMarked
 class FileIdentityPoolSubjectTokenSupplier

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/IdentityPoolCredentials.java

@@ -167,11 +167,14 @@ public class IdentityPoolCredentials extends ExternalAccountCredentials {
 
   /**
    * Checks whether mTLS is properly configured by verifying that an X509Provider is set or the
-   * transport factory is an MtlsHttpTransportFactory. This avoids relying solely on instanceof
-   * checks which could pass for a misconfigured factory.
+   * transport factory is an MtlsHttpTransportFactory with a non-null KeyStore. This avoids false
+   * positives from a no-arg-constructed MtlsHttpTransportFactory (e.g. after deserialization)
+   * that has no actual certificates.
    */
   private boolean isMtlsConfigured() {
-    return this.x509Provider != null || this.transportFactory instanceof MtlsHttpTransportFactory;
+    return this.x509Provider != null
+        || (this.transportFactory instanceof MtlsHttpTransportFactory
+            && ((MtlsHttpTransportFactory) this.transportFactory).hasKeyStore());
   }
 
   @Override
@@ -338,6 +341,10 @@ public static class Builder extends ExternalAccountCredentials.Builder {
         this.subjectTokenSupplier = credentials.subjectTokenSupplier;
         this.actorTokenSupplier = credentials.actorTokenSupplier;
       }
+      // Note: when credentialSource is present, subjectTokenSupplier and actorTokenSupplier
+      // are intentionally NOT copied here. They will be reconstructed from credentialSource
+      // during build(), which ensures they share the same FileIdentityPoolSubjectTokenSupplier
+      // instance for atomic token reads.
       this.actorTokenType = credentials.actorTokenType;
       this.x509Provider = credentials.x509Provider;
     }

google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/IdentityPoolCredentialsTest.java

@@ -1730,6 +1730,46 @@ void builder_actorTokenWithoutMtls_throws() {
                 "Actor tokens are only supported for mTLS token exchanges."));
   }
 
+  @Test
+  void builder_actorTokenWithNoArgMtlsFactory_throws() throws Exception {
+    // A no-arg MtlsHttpTransportFactory (e.g. from deserialization) has no KeyStore,
+    // so isMtlsConfigured() should return false and building should fail.
+    MtlsHttpTransportFactory noArgFactory = new MtlsHttpTransportFactory();
+    assertFalse(noArgFactory.hasKeyStore());
+
+    IllegalArgumentException e =
+        assertThrows(
+            IllegalArgumentException.class,
+            () ->
+                IdentityPoolCredentials.newBuilder()
+                    .setSubjectTokenSupplier(testProvider)
+                    .setActorTokenSupplier(testActorSupplier)
+                    .setActorTokenType("urn:ietf:params:oauth:token-type:jwt")
+                    .setHttpTransportFactory(noArgFactory)
+                    .setAudience("audience")
+                    .setSubjectTokenType("subjectTokenType")
+                    .setTokenUrl("https://sts.mtls.googleapis.com/v1/token")
+                    .build());
+    assertTrue(
+        e.getMessage()
+            .contains(
+                "Actor tokens are only supported for mTLS token exchanges."));
+  }
+
+  @Test
+  void mtlsHttpTransportFactory_hasKeyStore_withKeyStore_returnsTrue() throws Exception {
+    KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
+    ks.load(null, null);
+    MtlsHttpTransportFactory factory = new MtlsHttpTransportFactory(ks);
+    assertTrue(factory.hasKeyStore());
+  }
+
+  @Test
+  void mtlsHttpTransportFactory_hasKeyStore_noArg_returnsFalse() {
+    MtlsHttpTransportFactory factory = new MtlsHttpTransportFactory();
+    assertFalse(factory.hasKeyStore());
+  }
+
   // ==================================================================================
   // Section A: Cert Pinning & Transport Factory Tests
   // ==================================================================================