fix(auth): fix serialization gaps in DownscopedCredentials and UrlIdentityPoolSubjectTokenSupplier (#14341)

Fixes serialization issues tracked in
#12580

### Problem
1. **`DownscopedCredentials`**:
- Held a `private final transient HttpTransportFactory
transportFactory;` without retaining its class name or defining a
`readObject` method. Upon deserialization, `transportFactory` was null,
throwing a `NullPointerException` on `transportFactory.create()` during
token refresh.
- Contained a non-serializable `CredentialAccessBoundary` field,
preventing instances of `DownscopedCredentials` from being serialized at
all (`NotSerializableException`).
2. **`UrlIdentityPoolSubjectTokenSupplier`**:
- Held a `private final transient HttpTransportFactory
transportFactory;` without retaining its class name or defining
`readObject`. When deserialized (either directly or as part of an
`IdentityPoolCredentials` configured with a URL source),
`transportFactory` was null, throwing a `NullPointerException` on
`transportFactory.create()` when retrieving the subject token.

### Solution
- Implemented `readObject()` in both `DownscopedCredentials` and
`UrlIdentityPoolSubjectTokenSupplier` to reconstruct `transportFactory`
via `newInstance(transportFactoryClassName)` /
`OAuth2Credentials.newInstance(transportFactoryClassName)`.
- Preserved backward compatibility by explicitly setting
`serialVersionUID` for `DownscopedCredentials` to its previously
computed default UID (`3159528426501345486L`).
- Made `CredentialAccessBoundary` and its inner classes
(`AccessBoundaryRule`, `AvailabilityCondition`) implement
`Serializable`.
- Added serialization unit tests in `DownscopedCredentialsTest`,
`IdentityPoolCredentialsTest`, and `CredentialAccessBoundaryTest`
verifying deserialization and token refresh using in-memory mock
transports.

Author: lqiu96

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/CredentialAccessBoundary.java

@@ -36,8 +36,10 @@
 
 import com.google.api.client.json.GenericJson;
 import com.google.errorprone.annotations.CanIgnoreReturnValue;
+import java.io.Serializable;
 import java.util.ArrayList;
 import java.util.List;
+import java.util.Objects;
 import org.jspecify.annotations.NullMarked;
 import org.jspecify.annotations.Nullable;
 
@@ -49,7 +51,9 @@
  * information.</a>
  */
 @NullMarked
-public final class CredentialAccessBoundary {
+public final class CredentialAccessBoundary implements Serializable {
+
+  private static final long serialVersionUID = 1L;
 
   private static final int RULES_SIZE_LIMIT = 10;
 
@@ -63,7 +67,7 @@ public final class CredentialAccessBoundary {
         accessBoundaryRules.size() < RULES_SIZE_LIMIT,
         String.format(
             "The provided list has more than %s access boundary rules.", RULES_SIZE_LIMIT));
-    this.accessBoundaryRules = accessBoundaryRules;
+    this.accessBoundaryRules = new ArrayList<>(accessBoundaryRules);
   }
 
   /**
@@ -110,6 +114,20 @@ public List<AccessBoundaryRule> getAccessBoundaryRules() {
     return accessBoundaryRules;
   }
 
+  @Override
+  public boolean equals(@Nullable Object obj) {
+    if (!(obj instanceof CredentialAccessBoundary)) {
+      return false;
+    }
+    CredentialAccessBoundary other = (CredentialAccessBoundary) obj;
+    return Objects.equals(this.accessBoundaryRules, other.accessBoundaryRules);
+  }
+
+  @Override
+  public int hashCode() {
+    return Objects.hashCode(accessBoundaryRules);
+  }
+
   public static Builder newBuilder() {
     return new Builder();
   }
@@ -161,7 +179,9 @@ public CredentialAccessBoundary build() {
    *   .build();
    * </code></pre>
    */
-  public static final class AccessBoundaryRule {
+  public static final class AccessBoundaryRule implements Serializable {
+
+    private static final long serialVersionUID = 1L;
 
     private final String availableResource;
     private final List<String> availablePermissions;
@@ -202,6 +222,22 @@ public AvailabilityCondition getAvailabilityCondition() {
       return availabilityCondition;
     }
 
+    @Override
+    public boolean equals(@Nullable Object obj) {
+      if (!(obj instanceof AccessBoundaryRule)) {
+        return false;
+      }
+      AccessBoundaryRule other = (AccessBoundaryRule) obj;
+      return Objects.equals(this.availableResource, other.availableResource)
+          && Objects.equals(this.availablePermissions, other.availablePermissions)
+          && Objects.equals(this.availabilityCondition, other.availabilityCondition);
+    }
+
+    @Override
+    public int hashCode() {
+      return Objects.hash(availableResource, availablePermissions, availabilityCondition);
+    }
+
     public static Builder newBuilder() {
       return new Builder();
     }
@@ -293,7 +329,10 @@ public AccessBoundaryRule build() {
      *   .build();
      * </code></pre>
      */
-    public static final class AvailabilityCondition {
+    public static final class AvailabilityCondition implements Serializable {
+
+      private static final long serialVersionUID = 1L;
+
       private final String expression;
 
       @Nullable private final String title;
@@ -322,6 +361,22 @@ public String getDescription() {
         return description;
       }
 
+      @Override
+      public boolean equals(@Nullable Object obj) {
+        if (!(obj instanceof AvailabilityCondition)) {
+          return false;
+        }
+        AvailabilityCondition other = (AvailabilityCondition) obj;
+        return Objects.equals(this.expression, other.expression)
+            && Objects.equals(this.title, other.title)
+            && Objects.equals(this.description, other.description);
+      }
+
+      @Override
+      public int hashCode() {
+        return Objects.hash(expression, title, description);
+      }
+
       public static Builder newBuilder() {
         return new Builder();
       }

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/DownscopedCredentials.java

@@ -40,6 +40,8 @@
 import com.google.common.annotations.VisibleForTesting;
 import com.google.errorprone.annotations.CanIgnoreReturnValue;
 import java.io.IOException;
+import java.io.ObjectInputStream;
+import java.util.Objects;
 import org.jspecify.annotations.NullMarked;
 import org.jspecify.annotations.Nullable;
 
@@ -99,11 +101,14 @@
 @NullMarked
 public final class DownscopedCredentials extends OAuth2Credentials {
 
+  private static final long serialVersionUID = 3159528426501345486L;
+
   private final GoogleCredentials sourceCredential;
   private final CredentialAccessBoundary credentialAccessBoundary;
   private final String universeDomain;
+  private final String transportFactoryClassName;
 
-  private final transient HttpTransportFactory transportFactory;
+  private transient HttpTransportFactory transportFactory;
 
   private final String tokenExchangeEndpoint;
 
@@ -113,6 +118,7 @@ private DownscopedCredentials(Builder builder) {
         firstNonNull(
             builder.transportFactory,
             getFromServiceLoader(HttpTransportFactory.class, OAuth2Utils.HTTP_TRANSPORT_FACTORY));
+    this.transportFactoryClassName = this.transportFactory.getClass().getName();
     this.sourceCredential = checkNotNull(builder.sourceCredential);
     this.credentialAccessBoundary = checkNotNull(builder.credentialAccessBoundary);
 
@@ -199,6 +205,36 @@ HttpTransportFactory getTransportFactory() {
     return transportFactory;
   }
 
+  @Override
+  public boolean equals(@Nullable Object obj) {
+    if (!(obj instanceof DownscopedCredentials)) {
+      return false;
+    }
+    DownscopedCredentials other = (DownscopedCredentials) obj;
+    return super.equals(other)
+        && Objects.equals(this.sourceCredential, other.sourceCredential)
+        && Objects.equals(this.credentialAccessBoundary, other.credentialAccessBoundary)
+        && Objects.equals(this.universeDomain, other.universeDomain)
+        && Objects.equals(this.transportFactoryClassName, other.transportFactoryClassName)
+        && Objects.equals(this.tokenExchangeEndpoint, other.tokenExchangeEndpoint);
+  }
+
+  @Override
+  public int hashCode() {
+    return Objects.hash(
+        super.hashCode(),
+        sourceCredential,
+        credentialAccessBoundary,
+        universeDomain,
+        transportFactoryClassName,
+        tokenExchangeEndpoint);
+  }
+
+  private void readObject(ObjectInputStream input) throws IOException, ClassNotFoundException {
+    input.defaultReadObject();
+    transportFactory = OAuth2Credentials.newInstance(transportFactoryClassName);
+  }
+
   public static Builder newBuilder() {
     return new Builder();
   }

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/UrlIdentityPoolSubjectTokenSupplier.java

@@ -32,15 +32,19 @@
 package com.google.auth.oauth2;
 
 import static com.google.auth.oauth2.FileIdentityPoolSubjectTokenSupplier.parseToken;
+import static com.google.common.base.MoreObjects.firstNonNull;
 
 import com.google.api.client.http.GenericUrl;
 import com.google.api.client.http.HttpHeaders;
 import com.google.api.client.http.HttpRequest;
 import com.google.api.client.http.HttpResponse;
 import com.google.api.client.json.JsonObjectParser;
 import com.google.auth.http.HttpTransportFactory;
+import com.google.common.annotations.VisibleForTesting;
 import java.io.IOException;
+import java.io.ObjectInputStream;
 import org.jspecify.annotations.NullMarked;
+import org.jspecify.annotations.Nullable;
 
 /**
  * Provider for retrieving the subject tokens for {@link IdentityPoolCredentials} to exchange for
@@ -55,7 +59,8 @@ class UrlIdentityPoolSubjectTokenSupplier implements IdentityPoolSubjectTokenSup
   private static final long serialVersionUID = 4964578313468011844L;
 
   private final IdentityPoolCredentialSource credentialSource;
-  private final transient HttpTransportFactory transportFactory;
+  private final String transportFactoryClassName;
+  private transient HttpTransportFactory transportFactory;
 
   /**
    * Constructor for UrlIdentityPoolSubjectTokenProvider.
@@ -64,9 +69,15 @@ class UrlIdentityPoolSubjectTokenSupplier implements IdentityPoolSubjectTokenSup
    * @param transportFactory the transport factory to use for calling the URL.
    */
   UrlIdentityPoolSubjectTokenSupplier(
-      IdentityPoolCredentialSource credentialSource, HttpTransportFactory transportFactory) {
+      IdentityPoolCredentialSource credentialSource,
+      @Nullable HttpTransportFactory transportFactory) {
     this.credentialSource = credentialSource;
-    this.transportFactory = transportFactory;
+    this.transportFactory =
+        firstNonNull(
+            transportFactory,
+            OAuth2Credentials.getFromServiceLoader(
+                HttpTransportFactory.class, OAuth2Utils.HTTP_TRANSPORT_FACTORY));
+    this.transportFactoryClassName = this.transportFactory.getClass().getName();
   }
 
   @Override
@@ -100,4 +111,14 @@ public String getSubjectToken(ExternalAccountSupplierContext context) throws IOE
           String.format("Error getting subject token from metadata server: %s", e.getMessage()), e);
     }
   }
+
+  private void readObject(ObjectInputStream input) throws IOException, ClassNotFoundException {
+    input.defaultReadObject();
+    transportFactory = OAuth2Credentials.newInstance(transportFactoryClassName);
+  }
+
+  @VisibleForTesting
+  HttpTransportFactory getTransportFactory() {
+    return transportFactory;
+  }
 }

google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/CredentialAccessBoundaryTest.java

@@ -43,7 +43,7 @@
 import org.junit.jupiter.api.Test;
 
 /** Tests for {@link CredentialAccessBoundary} and encompassing classes. */
-class CredentialAccessBoundaryTest {
+class CredentialAccessBoundaryTest extends BaseSerializationTest {
 
   @Test
   void credentialAccessBoundary() {
@@ -288,4 +288,31 @@ void availabilityCondition_emptyExpression_throws() {
         assertThrows(IllegalArgumentException.class, builder::build);
     assertEquals("The provided expression is empty.", exception.getMessage());
   }
+
+  @Test
+  void serializeAndDeserialize_success() throws Exception {
+    AvailabilityCondition availabilityCondition =
+        AvailabilityCondition.newBuilder()
+            .setExpression("expression")
+            .setTitle("title")
+            .setDescription("description")
+            .build();
+
+    AccessBoundaryRule rule =
+        AccessBoundaryRule.newBuilder()
+            .setAvailableResource("resource")
+            .addAvailablePermission("permission")
+            .setAvailabilityCondition(availabilityCondition)
+            .build();
+
+    CredentialAccessBoundary cab = CredentialAccessBoundary.newBuilder().addRule(rule).build();
+
+    // Verify CredentialAccessBoundary and nested rules/conditions can be serialized and
+    // deserialized
+    // so downscoped credentials containing them do not throw NotSerializableException.
+    CredentialAccessBoundary deserialized = serializeAndDeserialize(cab);
+    assertEquals(cab, deserialized);
+    assertEquals(cab.hashCode(), deserialized.hashCode());
+    assertEquals(cab.toJson(), deserialized.toJson());
+  }
 }

google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/DownscopedCredentialsTest.java

@@ -43,10 +43,11 @@
 import java.io.IOException;
 import java.util.Date;
 import java.util.Map;
+import java.util.concurrent.TimeUnit;
 import org.junit.jupiter.api.Test;
 
 /** Tests for {@link DownscopedCredentials}. */
-class DownscopedCredentialsTest {
+class DownscopedCredentialsTest extends BaseSerializationTest {
 
   private static final String SA_PRIVATE_KEY_PKCS8 =
       "-----BEGIN PRIVATE KEY-----\n"
@@ -81,6 +82,54 @@ public HttpTransport create() {
     }
   }
 
+  public static class StatefulMockStsTransportFactory implements HttpTransportFactory {
+
+    private static MockStsTransport transport = new MockStsTransport();
+
+    public StatefulMockStsTransportFactory() {}
+
+    @Override
+    public HttpTransport create() {
+      return transport;
+    }
+  }
+
+  @Test
+  void refreshAccessToken_reserialized_success() throws Exception {
+    StatefulMockStsTransportFactory.transport = new MockStsTransport();
+    StatefulMockStsTransportFactory transportFactory = new StatefulMockStsTransportFactory();
+
+    // Set token expiration to 1 hour (3_600_000 ms) in the future so that
+    // sourceCredential.refreshIfExpired() considers the source token valid and
+    // does not attempt an external network call to refresh the source credential.
+    long oneHourInMillis = TimeUnit.HOURS.toMillis(1);
+    AccessToken sourceAccessToken =
+        new AccessToken(
+            "sourceAccessToken", new Date(System.currentTimeMillis() + oneHourInMillis));
+    GoogleCredentials sourceCredentials =
+        ((ServiceAccountCredentials) getServiceAccountSourceCredentials(/* canRefresh= */ true))
+            .toBuilder().setAccessToken(sourceAccessToken).build();
+
+    DownscopedCredentials downscopedCredentials =
+        DownscopedCredentials.newBuilder()
+            .setSourceCredential(sourceCredentials)
+            .setCredentialAccessBoundary(CREDENTIAL_ACCESS_BOUNDARY)
+            .setHttpTransportFactory(transportFactory)
+            .build();
+
+    // Verify deserialization succeeds and reconstructs the transient HTTP transport factory
+    // so that subsequent token refreshes do not throw a NullPointerException.
+    DownscopedCredentials deserialized = serializeAndDeserialize(downscopedCredentials);
+    assertNotNull(deserialized.getTransportFactory());
+    assertEquals(downscopedCredentials, deserialized);
+    assertEquals(downscopedCredentials.hashCode(), deserialized.hashCode());
+
+    // In-memory mock transport responds with a valid token exchange without network calls.
+    AccessToken accessToken = deserialized.refreshAccessToken();
+    assertEquals(
+        StatefulMockStsTransportFactory.transport.getAccessToken(), accessToken.getTokenValue());
+  }
+
   @Test
   void refreshAccessToken() throws IOException {
     MockStsTransportFactory transportFactory = new MockStsTransportFactory();