fix(auth): use an unencrypted key for mTLS certificate rotation (#18709)

`call_client_cert_callback()` in `google/auth/transport/_mtls_helper.py`
called `get_client_ssl_credentials(generate_encrypted_key=True)` and
then dropped the passphrase. With SecureConnect
(`context_aware_metadata.json`) that adds `--with_passphrase` to the
cert provider command, so the key it returns is encrypted.

Its only caller is `check_parameters_for_unauthorized_response()`, which
the 401 certificate rotation in `AuthorizedSession.request()` and
`AuthorizedHttp.urlopen()` uses. Both pass the key to
`configure_mtls_channel()` without a passphrase, so `load_cert_chain()`
gets an encrypted key with `password=None`.

This passes `generate_encrypted_key=False`, as
`get_client_cert_and_key()` already does for the initial mTLS setup, and
updates `test_call_client_cert_callback` to expect it. A new test drives
the SecureConnect path through a fake cert provider that returns an
encrypted key only for `--with_passphrase`, and checks that the returned
key loads without a passphrase. Workload certificates from
`certificate_config.json` are returned before the flag is read, so they
are not affected, and the async rotation path does not use this
function.

The change does not touch `requests.py` or `urllib3.py`, so it is
independent of #18381. The rotation paths added there also go through
`check_parameters_for_unauthorized_response()` and get the unencrypted
key too.

Testing (Python 3.13 on Windows, Python 3.12 on Linux):

- The updated `test_call_client_cert_callback` and the new
`test_call_client_cert_callback_secure_connect_unencrypted_key` fail
against `_mtls_helper.py` from `main` (the first with `Expected:
get_client_ssl_credentials(generate_encrypted_key=False)`, `Actual:
...(generate_encrypted_key=True)`; the second gets the encrypted key
back) and pass with the change.
- `pytest tests/transport/test__mtls_helper.py
tests/transport/test_requests.py tests/transport/test_urllib3.py
tests/transport/test_mtls.py`: 371 passed.
- `pytest tests tests_async` on Linux: 2263 passed, 7 skipped.
- `ruff check --select I` and `ruff format --check` (ruff 0.14.14 with
the flags from the `lint` session) and `flake8` on the two changed
files: no findings.
- On Linux, passing an encrypted key with no passphrase to
`_MutualTlsAdapter` with no terminal attached printed `Enter PEM pass
phrase:` and raised `MutualTLSChannelError` (caused by `OSError(22,
'Invalid argument')`); with a terminal it waits for input. The same key
unencrypted loads fine.

- [x] Make sure to open an issue as a
[bug/issue](https://github.com/googleapis/google-cloud-python/issues)
before writing your code! That way we can discuss the change, evaluate
designs, and agree on the general idea
- [x] Ensure the tests and linter pass
- [x] Code coverage does not decrease (if any source code was changed)
- [x] Appropriate docs were updated (if necessary)

Fixes #18467 🦕.
Closes #18538

Author: Thanatos9404

packages/google-auth/google/auth/transport/_mtls_helper.py

@@ -911,8 +911,10 @@ def check_parameters_for_unauthorized_response(cached_cert):
 
 def call_client_cert_callback():
     """Calls the client cert callback and returns the certificate and key."""
-    _, cert_bytes, key_bytes, passphrase = get_client_ssl_credentials(
-        generate_encrypted_key=True
+    # Callers load the key without a passphrase, so request an unencrypted
+    # key, as get_client_cert_and_key() does.
+    _, cert_bytes, key_bytes, _ = get_client_ssl_credentials(
+        generate_encrypted_key=False
     )
     return cert_bytes, key_bytes
 

packages/google-auth/tests/transport/test__mtls_helper.py

@@ -1332,17 +1332,51 @@ def test_call_client_cert_callback(self, mock_get_client_ssl_credentials):
             True,
             b"cert_bytes",
             b"key_bytes",
-            b"passphrase",
+            None,
         )
 
         cert, key = _mtls_helper.call_client_cert_callback()
 
         assert cert == b"cert_bytes"
         assert key == b"key_bytes"
         mock_get_client_ssl_credentials.assert_called_once_with(
-            generate_encrypted_key=True
+            generate_encrypted_key=False
         )
 
+    @mock.patch("subprocess.Popen", autospec=True)
+    @mock.patch("google.auth.transport._mtls_helper._load_json_file", autospec=True)
+    @mock.patch("google.auth.transport._mtls_helper._check_config_path", autospec=True)
+    @mock.patch(
+        "google.auth.transport._mtls_helper._get_workload_cert_and_key", autospec=True
+    )
+    def test_call_client_cert_callback_secure_connect_unencrypted_key(
+        self,
+        mock_get_workload_cert_and_key,
+        mock_check_config_path,
+        mock_load_json_file,
+        mock_popen,
+    ):
+        mock_get_workload_cert_and_key.return_value = (None, None)
+        mock_check_config_path.return_value = "/path/to/config"
+        mock_load_json_file.return_value = {"cert_provider_command": ["command"]}
+
+        process = mock.Mock()
+        process.configure_mock(
+            **{
+                "communicate.return_value": (
+                    pytest.public_cert_bytes + pytest.private_key_bytes,
+                    b"",
+                ),
+                "returncode": 0,
+            }
+        )
+        mock_popen.return_value = process
+
+        cert, key = _mtls_helper.call_client_cert_callback()
+
+        assert cert == pytest.public_cert_bytes
+        assert key == pytest.private_key_bytes
+
 
 class TestSecureCertKeyPaths(object):
     def test_tier1_pass_through(self):