binder: normalize failed auth future status message

fixes #12873 

Previously, `BinderTransportSecurity.ServerAuthInterceptor` handled
failed authorization futures differently depending on whether the future
was already completed.

Author: Zhengcy05

binder/src/main/java/io/grpc/binder/internal/BinderTransportSecurity.java

@@ -108,13 +108,10 @@ public <ReqT, RespT> ServerCall.Listener<ReqT> interceptCall(
       Status authStatus;
       try {
         authStatus = Futures.getDone(authStatusFuture);
-      } catch (ExecutionException | CancellationException e) {
-        // Failed futures are treated as an internal error rather than a security rejection.
-        authStatus = Status.INTERNAL.withCause(e);
-        @Nullable String message = e.getMessage();
-        if (message != null) {
-          authStatus = authStatus.withDescription(message);
-        }
+      } catch (ExecutionException e) {
+        authStatus = statusFromFailedAuthorizationFuture(e.getCause());
+      } catch (CancellationException e) {
+        authStatus = statusFromFailedAuthorizationFuture(e);
       }
 
       if (authStatus.isOk()) {
@@ -147,14 +144,18 @@ public void onSuccess(Status authStatus) {
 
             @Override
             public void onFailure(Throwable t) {
-              call.close(
-                  Status.INTERNAL.withCause(t).withDescription("Authorization future failed"),
-                  new Metadata());
+              call.close(statusFromFailedAuthorizationFuture(t), new Metadata());
             }
           },
           executor);
       return listener;
     }
+
+    private static Status statusFromFailedAuthorizationFuture(Throwable cause) {
+      // The actual failure is retained as the cause for debugging, but peers should see a
+      // uniform transport-level failure instead of the underlying exception message.
+      return Status.INTERNAL.withCause(cause).withDescription("Authorization future failed");
+    }
   }
 
   /**

binder/src/test/java/io/grpc/binder/RobolectricBinderSecurityTest.java

@@ -164,7 +164,40 @@ public void testAsyncServerSecurityPolicy_failedFuture_failsWithCodeInternal() t
     ListenableFuture<Status> status = makeCall();
     statusesToSet.take().setException(new IllegalStateException("oops"));
 
-    assertThat(status.get().getCode()).isEqualTo(Status.Code.INTERNAL);
+    Status failureStatus = status.get();
+    assertThat(failureStatus.getCode()).isEqualTo(Status.Code.INTERNAL);
+    assertThat(failureStatus.getDescription()).isEqualTo("Authorization future failed");
+  }
+
+  @Test
+  public void testAsyncServerSecurityPolicy_failedFuture_subsequentCallHasOpaqueFailure()
+      throws Exception {
+    ListenableFuture<Status> firstStatusFuture = makeCall();
+    statusesToSet.take().setException(new IOException("ouch"));
+
+    Status firstStatus = firstStatusFuture.get();
+    assertThat(firstStatus.getCode()).isEqualTo(Status.Code.INTERNAL);
+    assertThat(firstStatus.getDescription()).isEqualTo("Authorization future failed");
+
+    // TransportAuthorizationState evicts failed futures so the second call triggers a fresh
+    // authorization check. Both calls must surface an opaque transport-level failure.
+    ListenableFuture<Status> secondStatusFuture = makeCall();
+    statusesToSet.take().setException(new IOException("ouch"));
+
+    Status secondStatus = secondStatusFuture.get();
+    assertThat(secondStatus.getCode()).isEqualTo(Status.Code.INTERNAL);
+    assertThat(secondStatus.getDescription()).isEqualTo("Authorization future failed");
+  }
+
+  @Test
+  public void testAsyncServerSecurityPolicy_failedFuture_cancelledFutureIsOpaque()
+      throws Exception {
+    ListenableFuture<Status> statusFuture = makeCall();
+    statusesToSet.take().cancel(false);
+
+    Status failureStatus = statusFuture.get();
+    assertThat(failureStatus.getCode()).isEqualTo(Status.Code.INTERNAL);
+    assertThat(failureStatus.getDescription()).isEqualTo("Authorization future failed");
   }
 
   @Test