Make ADC token refresh thread-safe to prevent race conditions

dataplex-quickstart-labs/00-resources/scripts/python/business-glossary-import/dataplex-glossary/export/README.md

@@ -78,11 +78,14 @@ The service account must have the required IAM roles, and your user account must
 # Authenticate your user account
 gcloud auth login
 
-# Then impersonate the service account for ADC
+# Impersonate the service account for ADC with required scopes
 SA_EMAIL="<service-account-emailid>"
 gcloud auth application-default login \
   --impersonate-service-account="${SA_EMAIL}" \
-  --scopes="https://www.googleapis.com/auth/spreadsheets"
+  --scopes="https://www.googleapis.com/auth/cloud-platform,https://www.googleapis.com/auth/spreadsheets"
+
+# (Optional) Export environment variable for additional safety
+export GOOGLE_IMPERSONATE_SERVICE_ACCOUNT="${SA_EMAIL}"
 ```
 
 ---

dataplex-quickstart-labs/00-resources/scripts/python/business-glossary-import/dataplex-glossary/import/README.md

@@ -65,11 +65,14 @@ The service account must have the required IAM roles, and your user account must
 # Authenticate your user account
 gcloud auth login
 
-# Then impersonate the service account for ADC
+# Impersonate the service account for ADC with required scopes
 SA_EMAIL="<service-account-emailid>"
 gcloud auth application-default login \
   --impersonate-service-account="${SA_EMAIL}" \
-  --scopes="https://www.googleapis.com/auth/spreadsheets.readonly"
+  --scopes="https://www.googleapis.com/auth/cloud-platform,https://www.googleapis.com/auth/spreadsheets"
+
+# (Optional) Export environment variable for additional safety
+export GOOGLE_IMPERSONATE_SERVICE_ACCOUNT="${SA_EMAIL}"
 ```
 
 ---

dataplex-quickstart-labs/00-resources/scripts/python/business-glossary-import/dataplex-glossary/utils/api_call_utils.py

@@ -18,12 +18,15 @@
 logger = logging_utils.get_logger()
 
 
+import threading
+
 # Cache
 cached_creds = None
 cached_token = None
 last_refresh_time = 0
 
 REFRESH_INTERVAL_SECONDS = 55 * 60  # 55 minutes
+_adc_token_lock = threading.Lock()
 
 
 def _is_auth_retryable(error: Exception) -> bool:
@@ -36,7 +39,10 @@ def _refresh_adc_token():
     global cached_creds, cached_token, last_refresh_time
 
     def _do_refresh():
-        creds, _ = google.auth.default()
+        creds, _ = google.auth.default(scopes=[
+            'https://www.googleapis.com/auth/cloud-platform',
+            'https://www.googleapis.com/auth/spreadsheets'
+        ])
         creds.refresh(Request())
         return creds
 
@@ -51,16 +57,17 @@ def _get_header(project_id: str) -> Dict[str, str]:
     """Return headers using ADC, refreshing token every 30 minutes."""
     global last_refresh_time, cached_token
 
-    is_token_expired = (time.time() - last_refresh_time) > REFRESH_INTERVAL_SECONDS
-    if not cached_token or is_token_expired:
-        logger.debug("Refreshing ADC token (interval reached)...")
-        _refresh_adc_token()
-
-    return {
-        "Content-Type": "application/json",
-        "Authorization": f"Bearer {cached_token}",
-        "X-Goog-User-Project": project_id,
-    }
+    with _adc_token_lock:
+        is_token_expired = (time.time() - last_refresh_time) > REFRESH_INTERVAL_SECONDS
+        if not cached_token or is_token_expired:
+            logger.debug("Refreshing ADC token (interval reached)...")
+            _refresh_adc_token()
+
+        return {
+            "Content-Type": "application/json",
+            "Authorization": f"Bearer {cached_token}",
+            "X-Goog-User-Project": project_id,
+        }
 
 def extract_error_details(
   response_err: requests.exceptions.RequestException,

dataplex-quickstart-labs/00-resources/scripts/python/business-glossary-import/dataplex-glossary/utils/constants.py

@@ -95,8 +95,8 @@
 SYMMETRIC_LINK_TYPES = {"synonym", "related"}
 PROJECT_NUMBER = "655216118709"
 
-# Unlaunched prod locations
-EXCLUDED_LOCATIONS = ["asia-southeast3"]
+# Unlaunched prod locations and non-catalog dual-region storage IDs
+EXCLUDED_LOCATIONS = ["asia-southeast3", "eur3", "nam5", "nam7"]
 
 # -- BACKOFF Constants ---
 MAX_ATTEMPTS = 10

dataplex-quickstart-labs/00-resources/scripts/python/business-glossary-import/migration/api_call_utils.py

@@ -15,12 +15,15 @@
 logger = logging_utils.get_logger()
 
 
+import threading
+
 # Cache
 cached_creds = None
 cached_token = None
 last_refresh_time = 0
 
 REFRESH_INTERVAL_SECONDS = 55 * 60  # 55 minutes
+_adc_token_lock = threading.Lock()
 
 def _refresh_adc_token():
     """Refresh ADC credentials and update cache."""
@@ -37,16 +40,17 @@ def _get_header(project_id: str) -> Dict[str, str]:
     """Return headers using ADC, refreshing token every 30 minutes."""
     global last_refresh_time, cached_token
 
-    is_token_expired = (time.time() - last_refresh_time) > REFRESH_INTERVAL_SECONDS
-    if not cached_token or is_token_expired:
-        logger.debug("Refreshing ADC token (interval reached)...")
-        _refresh_adc_token()
-
-    return {
-        "Content-Type": "application/json",
-        "Authorization": f"Bearer {cached_token}",
-        "X-Goog-User-Project": project_id,
-    }
+    with _adc_token_lock:
+        is_token_expired = (time.time() - last_refresh_time) > REFRESH_INTERVAL_SECONDS
+        if not cached_token or is_token_expired:
+            logger.debug("Refreshing ADC token (interval reached)...")
+            _refresh_adc_token()
+
+        return {
+            "Content-Type": "application/json",
+            "Authorization": f"Bearer {cached_token}",
+            "X-Goog-User-Project": project_id,
+        }
 
 def extract_error_details(
   response_err: requests.exceptions.RequestException,