1 files changed, 60 insertions, 69 deletions

diff --git a/src/core/lib/security/credentials/jwt/jwt_credentials.cc b/src/core/lib/security/credentials/jwt/jwt_credentials.cc
index 05c08a68b0..f2591a1ea5 100644
--- a/src/core/lib/security/credentials/jwt/jwt_credentials.cc
+++ b/src/core/lib/security/credentials/jwt/jwt_credentials.cc
@@ -23,6 +23,8 @@
 #include <inttypes.h>
 #include <string.h>
 
+#include "src/core/lib/gprpp/ref_counted.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/surface/api_trace.h"
 
 #include <grpc/support/alloc.h>
@@ -30,71 +32,66 @@
 #include <grpc/support/string_util.h>
 #include <grpc/support/sync.h>
 
-static void jwt_reset_cache(grpc_service_account_jwt_access_credentials* c) {
-  GRPC_MDELEM_UNREF(c->cached.jwt_md);
-  c->cached.jwt_md = GRPC_MDNULL;
-  if (c->cached.service_url != nullptr) {
-    gpr_free(c->cached.service_url);
-    c->cached.service_url = nullptr;
+void grpc_service_account_jwt_access_credentials::reset_cache() {
+  GRPC_MDELEM_UNREF(cached_.jwt_md);
+  cached_.jwt_md = GRPC_MDNULL;
+  if (cached_.service_url != nullptr) {
+    gpr_free(cached_.service_url);
+    cached_.service_url = nullptr;
   }
-  c->cached.jwt_expiration = gpr_inf_past(GPR_CLOCK_REALTIME);
+  cached_.jwt_expiration = gpr_inf_past(GPR_CLOCK_REALTIME);
 }
 
-static void jwt_destruct(grpc_call_credentials* creds) {
-  grpc_service_account_jwt_access_credentials* c =
-      reinterpret_cast<grpc_service_account_jwt_access_credentials*>(creds);
-  grpc_auth_json_key_destruct(&c->key);
-  jwt_reset_cache(c);
-  gpr_mu_destroy(&c->cache_mu);
+grpc_service_account_jwt_access_credentials::
+    ~grpc_service_account_jwt_access_credentials() {
+  grpc_auth_json_key_destruct(&key_);
+  reset_cache();
+  gpr_mu_destroy(&cache_mu_);
 }
 
-static bool jwt_get_request_metadata(grpc_call_credentials* creds,
-                                     grpc_polling_entity* pollent,
-                                     grpc_auth_metadata_context context,
-                                     grpc_credentials_mdelem_array* md_array,
-                                     grpc_closure* on_request_metadata,
-                                     grpc_error** error) {
-  grpc_service_account_jwt_access_credentials* c =
-      reinterpret_cast<grpc_service_account_jwt_access_credentials*>(creds);
+bool grpc_service_account_jwt_access_credentials::get_request_metadata(
+    grpc_polling_entity* pollent, grpc_auth_metadata_context context,
+    grpc_credentials_mdelem_array* md_array, grpc_closure* on_request_metadata,
+    grpc_error** error) {
   gpr_timespec refresh_threshold = gpr_time_from_seconds(
       GRPC_SECURE_TOKEN_REFRESH_THRESHOLD_SECS, GPR_TIMESPAN);
 
   /* See if we can return a cached jwt. */
   grpc_mdelem jwt_md = GRPC_MDNULL;
   {
-    gpr_mu_lock(&c->cache_mu);
-    if (c->cached.service_url != nullptr &&
-        strcmp(c->cached.service_url, context.service_url) == 0 &&
-        !GRPC_MDISNULL(c->cached.jwt_md) &&
-        (gpr_time_cmp(gpr_time_sub(c->cached.jwt_expiration,
-                                   gpr_now(GPR_CLOCK_REALTIME)),
-                      refresh_threshold) > 0)) {
-      jwt_md = GRPC_MDELEM_REF(c->cached.jwt_md);
+    gpr_mu_lock(&cache_mu_);
+    if (cached_.service_url != nullptr &&
+        strcmp(cached_.service_url, context.service_url) == 0 &&
+        !GRPC_MDISNULL(cached_.jwt_md) &&
+        (gpr_time_cmp(
+             gpr_time_sub(cached_.jwt_expiration, gpr_now(GPR_CLOCK_REALTIME)),
+             refresh_threshold) > 0)) {
+      jwt_md = GRPC_MDELEM_REF(cached_.jwt_md);
     }
-    gpr_mu_unlock(&c->cache_mu);
+    gpr_mu_unlock(&cache_mu_);
   }
 
   if (GRPC_MDISNULL(jwt_md)) {
     char* jwt = nullptr;
     /* Generate a new jwt. */
-    gpr_mu_lock(&c->cache_mu);
-    jwt_reset_cache(c);
-    jwt = grpc_jwt_encode_and_sign(&c->key, context.service_url,
-                                   c->jwt_lifetime, nullptr);
+    gpr_mu_lock(&cache_mu_);
+    reset_cache();
+    jwt = grpc_jwt_encode_and_sign(&key_, context.service_url, jwt_lifetime_,
+                                   nullptr);
     if (jwt != nullptr) {
       char* md_value;
       gpr_asprintf(&md_value, "Bearer %s", jwt);
       gpr_free(jwt);
-      c->cached.jwt_expiration =
-          gpr_time_add(gpr_now(GPR_CLOCK_REALTIME), c->jwt_lifetime);
-      c->cached.service_url = gpr_strdup(context.service_url);
-      c->cached.jwt_md = grpc_mdelem_from_slices(
+      cached_.jwt_expiration =
+          gpr_time_add(gpr_now(GPR_CLOCK_REALTIME), jwt_lifetime_);
+      cached_.service_url = gpr_strdup(context.service_url);
+      cached_.jwt_md = grpc_mdelem_from_slices(
           grpc_slice_from_static_string(GRPC_AUTHORIZATION_METADATA_KEY),
           grpc_slice_from_copied_string(md_value));
       gpr_free(md_value);
-      jwt_md = GRPC_MDELEM_REF(c->cached.jwt_md);
+      jwt_md = GRPC_MDELEM_REF(cached_.jwt_md);
     }
-    gpr_mu_unlock(&c->cache_mu);
+    gpr_mu_unlock(&cache_mu_);
   }
 
   if (!GRPC_MDISNULL(jwt_md)) {
@@ -106,29 +103,15 @@ static bool jwt_get_request_metadata(grpc_call_credentials* creds,
   return true;
 }
 
-static void jwt_cancel_get_request_metadata(
-    grpc_call_credentials* c, grpc_credentials_mdelem_array* md_array,
-    grpc_error* error) {
+void grpc_service_account_jwt_access_credentials::cancel_get_request_metadata(
+    grpc_credentials_mdelem_array* md_array, grpc_error* error) {
   GRPC_ERROR_UNREF(error);
 }
 
-static grpc_call_credentials_vtable jwt_vtable = {
-    jwt_destruct, jwt_get_request_metadata, jwt_cancel_get_request_metadata};
-
-grpc_call_credentials*
-grpc_service_account_jwt_access_credentials_create_from_auth_json_key(
-    grpc_auth_json_key key, gpr_timespec token_lifetime) {
-  grpc_service_account_jwt_access_credentials* c;
-  if (!grpc_auth_json_key_is_valid(&key)) {
-    gpr_log(GPR_ERROR, "Invalid input for jwt credentials creation");
-    return nullptr;
-  }
-  c = static_cast<grpc_service_account_jwt_access_credentials*>(
-      gpr_zalloc(sizeof(grpc_service_account_jwt_access_credentials)));
-  c->base.type = GRPC_CALL_CREDENTIALS_TYPE_JWT;
-  gpr_ref_init(&c->base.refcount, 1);
-  c->base.vtable = &jwt_vtable;
-  c->key = key;
+grpc_service_account_jwt_access_credentials::
+    grpc_service_account_jwt_access_credentials(grpc_auth_json_key key,
+                                                gpr_timespec token_lifetime)
+    : grpc_call_credentials(GRPC_CALL_CREDENTIALS_TYPE_JWT), key_(key) {
   gpr_timespec max_token_lifetime = grpc_max_auth_token_lifetime();
   if (gpr_time_cmp(token_lifetime, max_token_lifetime) > 0) {
     gpr_log(GPR_INFO,
@@ -136,10 +119,20 @@ grpc_service_account_jwt_access_credentials_create_from_auth_json_key(
             static_cast<int>(max_token_lifetime.tv_sec));
     token_lifetime = grpc_max_auth_token_lifetime();
   }
-  c->jwt_lifetime = token_lifetime;
-  gpr_mu_init(&c->cache_mu);
-  jwt_reset_cache(c);
-  return &c->base;
+  jwt_lifetime_ = token_lifetime;
+  gpr_mu_init(&cache_mu_);
+  reset_cache();
+}
+
+grpc_core::RefCountedPtr<grpc_call_credentials>
+grpc_service_account_jwt_access_credentials_create_from_auth_json_key(
+    grpc_auth_json_key key, gpr_timespec token_lifetime) {
+  if (!grpc_auth_json_key_is_valid(&key)) {
+    gpr_log(GPR_ERROR, "Invalid input for jwt credentials creation");
+    return nullptr;
+  }
+  return grpc_core::MakeRefCounted<grpc_service_account_jwt_access_credentials>(
+      key, token_lifetime);
 }
 
 static char* redact_private_key(const char* json_key) {
@@ -182,9 +175,7 @@ grpc_call_credentials* grpc_service_account_jwt_access_credentials_create(
   }
   GPR_ASSERT(reserved == nullptr);
   grpc_core::ExecCtx exec_ctx;
-  grpc_call_credentials* creds =
-      grpc_service_account_jwt_access_credentials_create_from_auth_json_key(
-          grpc_auth_json_key_create_from_string(json_key), token_lifetime);
-
-  return creds;
+  return grpc_service_account_jwt_access_credentials_create_from_auth_json_key(
+             grpc_auth_json_key_create_from_string(json_key), token_lifetime)
+      .release();
 }