This change updates the credential key generation to use a stable hash (SHA256) instead of Python's built-in hash, which can vary based on PYTHONHASHSEED. It also makes sure that temporary or exchanged OAuth2 fields are excluded from the key calculation. I also added when saving credentials, a copy of the AuthConfig is used to avoid modifying the original shared AuthConfig instance with user-specific exchanged credentials.
Co-authored-by: George Weale <gweale@google.com>
PiperOrigin-RevId: 864599326
This seems a breaking change, but actually credential manager is used internally only and also it won't work if some one call it using callback context
Co-authored-by: Xiang (Sean) Zhou <seanzhougoogle@google.com>
PiperOrigin-RevId: 863534476
The _load_existing_credential method in CredentialManager will now only attempt to load credentials from the credential service and will no longer check the AuthConfig's exchanged_auth_credential cache.
Close#3772
Co-authored-by: George Weale <gweale@google.com>
PiperOrigin-RevId: 852944533
This fixes MCP authentication for gcloud service accounts. Previously it was failing to authenticate tool calls.
Co-authored-by: Kathy Wu <wukathy@google.com>
PiperOrigin-RevId: 826639044
1. credential service may be accessed by callbacks
2. plan to add load_credential and save_credential method in CallbackContext (see cl/782158513) given customer has requirement to access credential service themselves. (see https://github.com/google/adk-python/issues/1816)
It's backward compatible given CallbackContext is parent class of ToolContext
PiperOrigin-RevId: 783480378
George WealeandCopybara-Service
Xiang (Sean) ZhouandCopybara-Service
Kathy WuandCopybara-Service
Google Team MemberandCopybara-Service