fix(auth,gax): align mTLS certificate discovery and error handling with go/sdk-mtls-by-default-cert-discovery

Address PR 13995 review feedback from @nbayati:
- Align discovery and error behavior with go/sdk-mtls-by-default-cert-discovery:
  - Fail closed (IllegalStateException) when GOOGLE_API_CERTIFICATE_CONFIG points to a missing, unreadable, malformed, or missing cert/key configuration.
  - Safe fallback (return null) when implicit default gcloud config is missing or is an ECP-only configuration without a workload block.
  - Fail closed with clear source identification if default gcloud config is unreadable, malformed, or points to missing cert/key files.
- Replace .exists() with .isFile() && .canRead() checks across config, certificate, and key paths.
- Make getGkeWorkloadCertPath and getGceWorkloadCertPath package-private stubs returning null with explanatory comments for phased rollout.
- Explicitly identify the resolution source (GOOGLE_API_CERTIFICATE_CONFIG vs default gcloud location) in all error messages.
- Update getCertificatePath exception message to reference 'cert_configs.workload.cert_path' rather than legacy 'certificate_file'.
- Add comprehensive test coverage in MtlsUtilsTest and CertificateBasedAccessTest.

Author: macastelaz

google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsUtils.java

@@ -79,47 +79,78 @@ public static boolean useMtlsClientCertificate(
       return null;
     }
 
-    String certConfigPath = envProvider.getEnv(CERTIFICATE_CONFIGURATION_ENV_VARIABLE);
-    if (!Strings.isNullOrEmpty(certConfigPath)) {
+    String explicitConfigPath = envProvider.getEnv(CERTIFICATE_CONFIGURATION_ENV_VARIABLE);
+
+    // 1. Explicit Configuration Path (Fail Closed)
+    if (!Strings.isNullOrEmpty(explicitConfigPath)) {
+      File configFile = new File(explicitConfigPath);
+      if (!configFile.exists()) {
+        throw new IllegalStateException(
+            "Certificate configuration file specified via GOOGLE_API_CERTIFICATE_CONFIG at '"
+                + explicitConfigPath
+                + "' does not exist.");
+      }
+      if (!configFile.isFile() || !configFile.canRead()) {
+        throw new IllegalStateException(
+            "Failed to read certificate configuration file specified via"
+                + " GOOGLE_API_CERTIFICATE_CONFIG at '"
+                + explicitConfigPath
+                + "'.");
+      }
       try {
         WorkloadCertificateConfiguration config =
-            getWorkloadCertificateConfiguration(envProvider, propProvider, certConfigPath);
-
-        File certFile = new File(config.getCertPath());
-        File keyFile = new File(config.getPrivateKeyPath());
-        if (!certFile.exists() || !keyFile.exists()) {
-          throw new IllegalStateException(
-              "Certificate config points to certificate/key files that do not exist on disk: "
-                  + "cert_path="
-                  + config.getCertPath()
-                  + ", key_path="
-                  + config.getPrivateKeyPath());
-        }
+            getWorkloadCertificateConfiguration(envProvider, propProvider, explicitConfigPath);
+        validateCertAndKeyFiles(config, explicitConfigPath, false);
         return config.getCertPath();
       } catch (CertificateSourceUnavailableException e) {
-        // Certificate config file does not exist on disk -> safe fallback
+        // ECP / PKCS11 configuration without workload section; safe fallback
+        return null;
       } catch (IllegalStateException e) {
         throw e;
       } catch (Exception e) {
-        throw new IllegalStateException("Failed to parse certificate config: " + certConfigPath, e);
+        throw new IllegalStateException(
+            "Certificate configuration file specified via GOOGLE_API_CERTIFICATE_CONFIG at '"
+                + explicitConfigPath
+                + "' is malformed: "
+                + e.getMessage(),
+            e);
+      }
+    }
+
+    // 2. Implicit / Default gcloud Configuration Path
+    File defaultConfigFile = null;
+    try {
+      defaultConfigFile = getWellKnownCertificateConfigFile(envProvider, propProvider);
+    } catch (IOException e) {
+      // APPDATA missing on Windows, etc. Safe fallback.
+    }
+    if (defaultConfigFile != null && defaultConfigFile.exists()) {
+      if (!defaultConfigFile.isFile() || !defaultConfigFile.canRead()) {
+        throw new IllegalStateException(
+            "Default certificate configuration file at '"
+                + defaultConfigFile.getAbsolutePath()
+                + "' exists but could not be read.");
       }
-    } else {
       try {
         WorkloadCertificateConfiguration config =
             getWorkloadCertificateConfiguration(envProvider, propProvider, null);
-        File certFile = new File(config.getCertPath());
-        File keyFile = new File(config.getPrivateKeyPath());
-        if (certFile.exists() && keyFile.exists()) {
-          return config.getCertPath();
-        }
+        validateCertAndKeyFiles(config, defaultConfigFile.getAbsolutePath(), true);
+        return config.getCertPath();
       } catch (CertificateSourceUnavailableException e) {
-        // Well-known gcloud certificate_config.json does not exist. Safe fallback to
-        // SPIFFE/well-known paths.
+        // ECP-only configuration without workload section; safe fallback
+      } catch (IllegalStateException e) {
+        throw e;
       } catch (Exception e) {
-        // Ignore parsing errors for well-known config fallback
+        throw new IllegalStateException(
+            "Default certificate configuration file at '"
+                + defaultConfigFile.getAbsolutePath()
+                + "' is malformed: "
+                + e.getMessage(),
+            e);
       }
     }
 
+    // 3. Platform SPIFFE Fallbacks (Stubs)
     String gkeCertPath = getGkeWorkloadCertPath();
     if (gkeCertPath != null) {
       return gkeCertPath;
@@ -133,24 +164,40 @@ public static boolean useMtlsClientCertificate(
     return null;
   }
 
-  /** Dedicated GKE Fallback Resolution Path */
-  public static @Nullable String getGkeWorkloadCertPath() {
-    String gkePath = "/var/run/secrets/workload-spiffe-credentials";
-    File bundleFile = new File(gkePath, "credentialbundle.pem");
-    if (bundleFile.exists()) {
-      return bundleFile.getAbsolutePath();
+  private static void validateCertAndKeyFiles(
+      WorkloadCertificateConfiguration config, String configPath, boolean isDefaultConfig) {
+    File certFile = new File(config.getCertPath());
+    File keyFile = new File(config.getPrivateKeyPath());
+    if (!certFile.isFile() || !certFile.canRead() || !keyFile.isFile() || !keyFile.canRead()) {
+      String sourcePrefix =
+          isDefaultConfig
+              ? "referenced by default configuration '"
+              : "referenced by configuration '";
+      throw new IllegalStateException(
+          "Failed to read certificate/key file at '"
+              + config.getCertPath()
+              + "' or '"
+              + config.getPrivateKeyPath()
+              + "' "
+              + sourcePrefix
+              + configPath
+              + "'.");
     }
+  }
+
+  /** Dedicated GKE Fallback Resolution Path */
+  static @Nullable String getGkeWorkloadCertPath() {
+    // GKE workload certificate resolution is temporarily disabled (returns null)
+    // pending Phase 1 rollout of bound token support on GKE
+    // (go/agentic-bound-token-sdk-rollout-plan).
     return null;
   }
 
   /** Dedicated GCE Fallback Resolution Path */
-  public static @Nullable String getGceWorkloadCertPath() {
-    String gcePath = "/var/run/secrets/workload-spiffe-credentials";
-    File certFile = new File(gcePath, "certificates.pem");
-    File keyFile = new File(gcePath, "private_key.pem");
-    if (certFile.exists() && keyFile.exists()) {
-      return certFile.getAbsolutePath();
-    }
+  static @Nullable String getGceWorkloadCertPath() {
+    // GCE workload certificate resolution is temporarily disabled (returns null)
+    // pending Phase 2 rollout of bound token support on GCE
+    // (go/agentic-bound-token-sdk-rollout-plan).
     return null;
   }
 
@@ -160,7 +207,7 @@ public static boolean useMtlsClientCertificate(
       return null;
     }
     File file = new File(certPath);
-    if (!file.exists()) {
+    if (!file.isFile() || !file.canRead()) {
       return null;
     }
     try {
@@ -199,8 +246,8 @@ public static String getCertificatePath(
             .getCertPath();
     if (Strings.isNullOrEmpty(certPath)) {
       throw new CertificateSourceUnavailableException(
-          "Certificate configuration loaded successfully, but does not contain a 'certificate_file'"
-              + " path.");
+          "Certificate configuration loaded successfully, but does not contain a"
+              + " 'cert_configs.workload.cert_path' path.");
     }
     return certPath;
   }
@@ -236,7 +283,7 @@ static WorkloadCertificateConfiguration getWorkloadCertificateConfiguration(
       }
     }
 
-    if (!certConfig.isFile()) {
+    if (!certConfig.isFile() || !certConfig.canRead()) {
       throw new CertificateSourceUnavailableException(
           "Certificate configuration file does not exist or is not a file: "
               + certConfig.getAbsolutePath());