1 files changed, 119 insertions, 95 deletions

diff --git a/src/core/lib/security/credentials/credentials.h b/src/core/lib/security/credentials/credentials.h
index 3878958b38..4091ef3dfb 100644
--- a/src/core/lib/security/credentials/credentials.h
+++ b/src/core/lib/security/credentials/credentials.h
@@ -26,6 +26,7 @@
 #include <grpc/support/sync.h>
 #include "src/core/lib/transport/metadata_batch.h"
 
+#include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/http/httpcli.h"
 #include "src/core/lib/http/parser.h"
 #include "src/core/lib/iomgr/polling_entity.h"
@@ -90,44 +91,46 @@ void grpc_override_well_known_credentials_path_getter(
 
 #define GRPC_ARG_CHANNEL_CREDENTIALS "grpc.channel_credentials"
 
-typedef struct {
-  void (*destruct)(grpc_channel_credentials* c);
-
-  grpc_security_status (*create_security_connector)(
-      grpc_channel_credentials* c, grpc_call_credentials* call_creds,
+// This type is forward declared as a C struct and we cannot define it as a
+// class. Otherwise, compiler will complain about type mismatch due to
+// -Wmismatched-tags.
+struct grpc_channel_credentials
+    : grpc_core::RefCounted<grpc_channel_credentials> {
+ public:
+  explicit grpc_channel_credentials(const char* type) : type_(type) {}
+  virtual ~grpc_channel_credentials() = default;
+
+  // Creates a security connector for the channel. May also create new channel
+  // args for the channel to be used in place of the passed in const args if
+  // returned non NULL. In that case the caller is responsible for destroying
+  // new_args after channel creation.
+  virtual grpc_core::RefCountedPtr<grpc_channel_security_connector>
+  create_security_connector(
+      grpc_core::RefCountedPtr<grpc_call_credentials> call_creds,
       const char* target, const grpc_channel_args* args,
-      grpc_channel_security_connector** sc, grpc_channel_args** new_args);
-
-  grpc_channel_credentials* (*duplicate_without_call_credentials)(
-      grpc_channel_credentials* c);
-} grpc_channel_credentials_vtable;
-
-struct grpc_channel_credentials {
-  const grpc_channel_credentials_vtable* vtable;
-  const char* type;
-  gpr_refcount refcount;
+      grpc_channel_args** new_args) {
+    // Tell clang-tidy that call_creds cannot be passed as const-ref.
+    call_creds.reset();
+    GRPC_ABSTRACT;
+  }
+
+  // Creates a version of the channel credentials without any attached call
+  // credentials. This can be used in order to open a channel to a non-trusted
+  // gRPC load balancer.
+  virtual grpc_core::RefCountedPtr<grpc_channel_credentials>
+  duplicate_without_call_credentials() {
+    // By default we just increment the refcount.
+    return Ref();
+  }
+
+  const char* type() const { return type_; }
+
+  GRPC_ABSTRACT_BASE_CLASS
+
+ private:
+  const char* type_;
 };
 
-grpc_channel_credentials* grpc_channel_credentials_ref(
-    grpc_channel_credentials* creds);
-void grpc_channel_credentials_unref(grpc_channel_credentials* creds);
-
-/* Creates a security connector for the channel. May also create new channel
-   args for the channel to be used in place of the passed in const args if
-   returned non NULL. In that case the caller is responsible for destroying
-   new_args after channel creation. */
-grpc_security_status grpc_channel_credentials_create_security_connector(
-    grpc_channel_credentials* creds, const char* target,
-    const grpc_channel_args* args, grpc_channel_security_connector** sc,
-    grpc_channel_args** new_args);
-
-/* Creates a version of the channel credentials without any attached call
-   credentials. This can be used in order to open a channel to a non-trusted
-   gRPC load balancer. */
-grpc_channel_credentials*
-grpc_channel_credentials_duplicate_without_call_credentials(
-    grpc_channel_credentials* creds);
-
 /* Util to encapsulate the channel credentials in a channel arg. */
 grpc_arg grpc_channel_credentials_to_arg(grpc_channel_credentials* credentials);
 
@@ -158,44 +161,39 @@ void grpc_credentials_mdelem_array_destroy(grpc_credentials_mdelem_array* list);
 
 /* --- grpc_call_credentials. --- */
 
-typedef struct {
-  void (*destruct)(grpc_call_credentials* c);
-  bool (*get_request_metadata)(grpc_call_credentials* c,
-                               grpc_polling_entity* pollent,
-                               grpc_auth_metadata_context context,
-                               grpc_credentials_mdelem_array* md_array,
-                               grpc_closure* on_request_metadata,
-                               grpc_error** error);
-  void (*cancel_get_request_metadata)(grpc_call_credentials* c,
-                                      grpc_credentials_mdelem_array* md_array,
-                                      grpc_error* error);
-} grpc_call_credentials_vtable;
-
-struct grpc_call_credentials {
-  const grpc_call_credentials_vtable* vtable;
-  const char* type;
-  gpr_refcount refcount;
+// This type is forward declared as a C struct and we cannot define it as a
+// class. Otherwise, compiler will complain about type mismatch due to
+// -Wmismatched-tags.
+struct grpc_call_credentials
+    : public grpc_core::RefCounted<grpc_call_credentials> {
+ public:
+  explicit grpc_call_credentials(const char* type) : type_(type) {}
+  virtual ~grpc_call_credentials() = default;
+
+  // Returns true if completed synchronously, in which case \a error will
+  // be set to indicate the result.  Otherwise, \a on_request_metadata will
+  // be invoked asynchronously when complete.  \a md_array will be populated
+  // with the resulting metadata once complete.
+  virtual bool get_request_metadata(grpc_polling_entity* pollent,
+                                    grpc_auth_metadata_context context,
+                                    grpc_credentials_mdelem_array* md_array,
+                                    grpc_closure* on_request_metadata,
+                                    grpc_error** error) GRPC_ABSTRACT;
+
+  // Cancels a pending asynchronous operation started by
+  // grpc_call_credentials_get_request_metadata() with the corresponding
+  // value of \a md_array.
+  virtual void cancel_get_request_metadata(
+      grpc_credentials_mdelem_array* md_array, grpc_error* error) GRPC_ABSTRACT;
+
+  const char* type() const { return type_; }
+
+  GRPC_ABSTRACT_BASE_CLASS
+
+ private:
+  const char* type_;
 };
 
-grpc_call_credentials* grpc_call_credentials_ref(grpc_call_credentials* creds);
-void grpc_call_credentials_unref(grpc_call_credentials* creds);
-
-/// Returns true if completed synchronously, in which case \a error will
-/// be set to indicate the result.  Otherwise, \a on_request_metadata will
-/// be invoked asynchronously when complete.  \a md_array will be populated
-/// with the resulting metadata once complete.
-bool grpc_call_credentials_get_request_metadata(
-    grpc_call_credentials* creds, grpc_polling_entity* pollent,
-    grpc_auth_metadata_context context, grpc_credentials_mdelem_array* md_array,
-    grpc_closure* on_request_metadata, grpc_error** error);
-
-/// Cancels a pending asynchronous operation started by
-/// grpc_call_credentials_get_request_metadata() with the corresponding
-/// value of \a md_array.
-void grpc_call_credentials_cancel_get_request_metadata(
-    grpc_call_credentials* c, grpc_credentials_mdelem_array* md_array,
-    grpc_error* error);
-
 /* Metadata-only credentials with the specified key and value where
    asynchronicity can be simulated for testing. */
 grpc_call_credentials* grpc_md_only_test_credentials_create(
@@ -203,26 +201,40 @@ grpc_call_credentials* grpc_md_only_test_credentials_create(
 
 /* --- grpc_server_credentials. --- */
 
-typedef struct {
-  void (*destruct)(grpc_server_credentials* c);
-  grpc_security_status (*create_security_connector)(
-      grpc_server_credentials* c, grpc_server_security_connector** sc);
-} grpc_server_credentials_vtable;
-
-struct grpc_server_credentials {
-  const grpc_server_credentials_vtable* vtable;
-  const char* type;
-  gpr_refcount refcount;
-  grpc_auth_metadata_processor processor;
-};
+// This type is forward declared as a C struct and we cannot define it as a
+// class. Otherwise, compiler will complain about type mismatch due to
+// -Wmismatched-tags.
+struct grpc_server_credentials
+    : public grpc_core::RefCounted<grpc_server_credentials> {
+ public:
+  explicit grpc_server_credentials(const char* type) : type_(type) {}
 
-grpc_security_status grpc_server_credentials_create_security_connector(
-    grpc_server_credentials* creds, grpc_server_security_connector** sc);
+  virtual ~grpc_server_credentials() { DestroyProcessor(); }
 
-grpc_server_credentials* grpc_server_credentials_ref(
-    grpc_server_credentials* creds);
+  virtual grpc_core::RefCountedPtr<grpc_server_security_connector>
+  create_security_connector() GRPC_ABSTRACT;
 
-void grpc_server_credentials_unref(grpc_server_credentials* creds);
+  const char* type() const { return type_; }
+
+  const grpc_auth_metadata_processor& auth_metadata_processor() const {
+    return processor_;
+  }
+  void set_auth_metadata_processor(
+      const grpc_auth_metadata_processor& processor);
+
+  GRPC_ABSTRACT_BASE_CLASS
+
+ private:
+  void DestroyProcessor() {
+    if (processor_.destroy != nullptr && processor_.state != nullptr) {
+      processor_.destroy(processor_.state);
+    }
+  }
+
+  const char* type_;
+  grpc_auth_metadata_processor processor_ =
+      grpc_auth_metadata_processor();  // Zero-initialize the C struct.
+};
 
 #define GRPC_SERVER_CREDENTIALS_ARG "grpc.server_credentials"
 
@@ -233,15 +245,27 @@ grpc_server_credentials* grpc_find_server_credentials_in_args(
 
 /* -- Credentials Metadata Request. -- */
 
-typedef struct {
-  grpc_call_credentials* creds;
+struct grpc_credentials_metadata_request {
+  explicit grpc_credentials_metadata_request(
+      grpc_core::RefCountedPtr<grpc_call_credentials> creds)
+      : creds(std::move(creds)) {}
+  ~grpc_credentials_metadata_request() {
+    grpc_http_response_destroy(&response);
+  }
+
+  grpc_core::RefCountedPtr<grpc_call_credentials> creds;
   grpc_http_response response;
-} grpc_credentials_metadata_request;
+};
 
-grpc_credentials_metadata_request* grpc_credentials_metadata_request_create(
-    grpc_call_credentials* creds);
+inline grpc_credentials_metadata_request*
+grpc_credentials_metadata_request_create(
+    grpc_core::RefCountedPtr<grpc_call_credentials> creds) {
+  return grpc_core::New<grpc_credentials_metadata_request>(std::move(creds));
+}
 
-void grpc_credentials_metadata_request_destroy(
-    grpc_credentials_metadata_request* r);
+inline void grpc_credentials_metadata_request_destroy(
+    grpc_credentials_metadata_request* r) {
+  grpc_core::Delete(r);
+}
 
 #endif /* GRPC_CORE_LIB_SECURITY_CREDENTIALS_CREDENTIALS_H */