fix: support unencrypted workload certificates for mTLS in GoogleApiToolset

Co-authored-by: Xuan Yang <xygoogle@google.com>
PiperOrigin-RevId: 945407876

Author: xuanyang15

src/google/adk/tools/google_api_tool/google_api_toolset.py

@@ -88,7 +88,7 @@ def __init__(
     if use_client_cert:
       self._mtls_certs = MtlsClientCerts()
       cert_path, key_path, passphrase = self._mtls_certs.get_certs()
-      if cert_path and key_path and passphrase:
+      if cert_path and key_path:
 
         def client_factory() -> httpx.AsyncClient:
           if passphrase:

src/google/adk/tools/google_api_tool/googleapi_to_openapi_converter.py

@@ -79,7 +79,7 @@ def fetch_google_api_spec(self) -> None:
 
       if self._use_client_cert and self._mtls_certs:
         cert_path, key_path, passphrase = self._mtls_certs.get_certs()
-        if cert_path and key_path and passphrase:
+        if cert_path and key_path:
           # Set default HTTP timeout similar to googleapiclient.http.build_http()
           http_timeout = socket.getdefaulttimeout() or 60
           http_client = httplib2.Http(timeout=http_timeout)

tests/unittests/tools/google_api_tool/test_google_api_toolset.py

@@ -564,3 +564,47 @@ async def test_mtls_cleanup_on_close(
 
     mock_openapi_toolset_instance.close.assert_called_once()
     mock_mtls_certs_instance.close.assert_called_once()
+
+  @mock.patch(
+      "google.adk.tools.google_api_tool.google_api_toolset.httpx.AsyncClient"
+  )
+  @mock.patch(
+      "google.adk.tools.google_api_tool.google_api_toolset.OpenAPIToolset"
+  )
+  @mock.patch(
+      "google.adk.tools.google_api_tool.google_api_toolset.GoogleApiToOpenApiConverter"
+  )
+  @mock.patch(
+      "google.adk.tools.google_api_tool.google_api_toolset.MtlsClientCerts"
+  )
+  @mock.patch(
+      "google.adk.tools.google_api_tool.google_api_toolset.use_client_cert_effective"
+  )
+  async def test_mtls_no_passphrase(
+      self,
+      mock_use_client_cert,
+      mock_mtls_certs_class,
+      mock_converter_class,
+      mock_openapi_toolset_class,
+      mock_async_client_class,
+      mock_converter_instance,
+      mock_openapi_toolset_instance,
+  ):
+    """Test that mTLS is configured even if key passphrase is None."""
+    mock_converter_class.return_value = mock_converter_instance
+    mock_openapi_toolset_class.return_value = mock_openapi_toolset_instance
+
+    mock_use_client_cert.return_value = True
+    mock_mtls_certs_instance = mock.MagicMock()
+    mock_mtls_certs_instance.get_certs.return_value = ("cert", "key", None)
+    mock_mtls_certs_class.return_value = mock_mtls_certs_instance
+
+    tool_set = GoogleApiToolset(
+        api_name=TEST_API_NAME, api_version=TEST_API_VERSION
+    )
+
+    assert tool_set._httpx_client_factory is not None
+
+    client = tool_set._httpx_client_factory()
+    assert client is not None
+    mock_async_client_class.assert_called_once_with(cert=("cert", "key"))

tests/unittests/tools/google_api_tool/test_googleapi_to_openapi_converter.py

@@ -333,6 +333,50 @@ def test_fetch_google_api_spec_with_mtls(
         == "https://www.mtls.googleapis.com/discovery/v1/apis/{api}/{apiVersion}/rest"
     )
 
+  def test_fetch_google_api_spec_with_mtls_no_passphrase(
+      self, monkeypatch, mock_api_resource, calendar_api_spec
+  ):
+    """Test fetching Google API specification with mTLS enabled but no passphrase."""
+    mock_build = MagicMock(return_value=mock_api_resource)
+    monkeypatch.setattr(
+        "google.adk.tools.google_api_tool.googleapi_to_openapi_converter.build",
+        mock_build,
+    )
+
+    # Enable mTLS
+    monkeypatch.setattr(
+        "google.auth.transport.mtls.should_use_client_cert",
+        lambda: True,
+    )
+    monkeypatch.setattr(
+        "google.auth.transport.mtls.has_default_client_cert_source",
+        lambda: True,
+    )
+
+    # Return None for passphrase
+    mock_cert_source = MagicMock(
+        return_value=("/path/to/cert", "/path/to/key", None)
+    )
+    monkeypatch.setattr(
+        "google.auth.transport.mtls.default_client_encrypted_cert_source",
+        lambda c, k: mock_cert_source,
+    )
+
+    converter = GoogleApiToOpenApiConverter("calendar", "v3")
+    converter.fetch_google_api_spec()
+
+    assert converter._google_api_spec == calendar_api_spec
+
+    # Verify build was called with the http parameter set and mtls url
+    mock_build.assert_called_once()
+    _, kwargs = mock_build.call_args
+    assert "http" in kwargs
+    assert kwargs["http"] is not None
+    assert (
+        kwargs["discoveryServiceUrl"]
+        == "https://www.mtls.googleapis.com/discovery/v1/apis/{api}/{apiVersion}/rest"
+    )
+
   def test_fetch_google_api_spec_error(self, monkeypatch, converter):
     """Test error handling when fetching Google API specification."""
     # Create a mock that raises an error