feat(bigquery): add samples for control access 1/3 #4023

hivanalejandro · 2025-03-08T13:15:16Z

Description

Add the following NodeJS samples:

Step of Internal: b/394478489

PR 1/3

Checklist

I have followed guidelines from CONTRIBUTING.MD and Samples Style Guide
Tests pass: npm test (see Testing)
Please merge this PR for me once it is approved

snippet-bot · 2025-03-08T13:15:22Z

Here is the summary of changes.

You are about to add 2 region tags.

bigquery/cloud-client/grantAccessToDataset.js:18, tag bigquery_grant_access_to_dataset
bigquery/cloud-client/grantAccessToTableOrView.js:18, tag bigquery_grant_access_to_table_or_view

This comment is generated by snippet-bot.
If you find problems with this result, please file an issue at:
https://github.com/googleapis/repo-automation-bots/issues.
To update this comment, add snippet-bot:force-run label or use the checkbox below:

Refresh this comment

gemini-code-assist

Hello @hivanalejandro, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

Summary of Changes

This pull request introduces new NodeJS samples for granting access to BigQuery datasets, tables, or views using IAM. It includes two new files: grantAccessToDataset.js and grantAccessToTableOrView.js, along with corresponding tests and updates to the package.json and config.js files. The samples demonstrate how to grant roles to users or groups, enabling control over resource access within BigQuery.

Highlights

New Samples: Adds grantAccessToDataset.js and grantAccessToTableOrView.js to demonstrate granting access to BigQuery resources.
IAM Integration: Demonstrates the use of IAM policies to control access to BigQuery datasets, tables, and views.
Testing: Includes new tests to verify the functionality of the new samples.

Changelog

Click here to see the changelog

bigquery/cloud-client/grantAccessToDataset.js
- Introduces a new function grantAccessToDataset to grant access to a BigQuery dataset for a specified entity.
- Includes example code with placeholders for datasetId, entityId, and role.
- Uses @google-cloud/bigquery library to interact with BigQuery.
- Handles potential PRECONDITION_FAILED errors if the dataset is modified remotely.
bigquery/cloud-client/grantAccessToTableOrView.js
- Introduces a new function grantAccessToTableOrView to grant access to a BigQuery table or view for a specified principal.
- Includes example code with placeholders for projectId, datasetId, resourceName, principalId, and role.
- Uses @google-cloud/bigquery library to interact with BigQuery.
- Updates the IAM access policy for the table or view with the new binding.
bigquery/cloud-client/package.json
- Adds bigquery-cloud-client package with description, version, license, author, and engine details.
- Includes scripts for deploy, start, unit-test, and test.
- Specifies @google-cloud/bigquery as a dependency.
- Adds c8, chai, mocha, and sinon as devDependencies.
bigquery/cloud-client/test/config.js
- Adds configuration file for tests, including setup and teardown functions.
- Defines constants for prefix, entity ID, dataset ID, table name, and view name.
- Includes helper functions to get shared resources like client, project ID, dataset, table, and view.
- Implements setupBeforeAll and teardownAfterAll functions to manage test resources.
bigquery/cloud-client/test/grantAccessToDataset.test.js
- Adds tests for the grantAccessToDataset function.
- Uses chai for assertions.
- Imports necessary modules and functions from ./config.js and ../grantAccessToDataset.js.
- Tests if the entity is added to access entries correctly.
bigquery/cloud-client/test/grantAccessToTableOrView.test.js
- Adds tests for the grantAccessToTableOrView function.
- Uses assert for assertions.
- Imports necessary modules and functions from ./config.js and ../grantAccessToTableOrView.js.
- Tests if access is granted to a table correctly by verifying role and principal existence in the updated policy.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Trivia time!

What is the underlying technology that powers BigQuery's query engine?

Click here for the answer

BigQuery's query engine is powered by Dremel, a scalable, interactive ad-hoc query system for analysis of read-only nested data.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces new NodeJS samples for granting access to BigQuery datasets, tables, or views. The code includes functions to grant access and corresponding tests. Overall, the code is well-structured and addresses the intended functionality. However, there are a few areas that could be improved for clarity and robustness.

Summary of Findings

TODO comments: The code contains TODO comments with placeholders for the developer to update. While this is acceptable, it's important to ensure these are addressed before merging to avoid confusion or incomplete examples.
Error Handling: The error handling in grantAccessToDataset could be improved by providing more context or guidance to the user on how to resolve the PRECONDITION_FAILED error.
Principal ID Format: In grantAccessToTableOrView, the principal ID is hardcoded with a group: prefix in the test. The code sample should reflect this format to avoid confusion.

Merge Readiness

The pull request is almost ready for merging. Addressing the TODO comments and clarifying the principal ID format would improve the overall quality of the samples. I am unable to directly approve this pull request, and recommend that others review and approve this code before merging. At a minimum, the TODO comments should be addressed before merging.

bigquery/cloud-client/grantAccessToDataset.js

bigquery/cloud-client/grantAccessToTableOrView.js

gemini-code-assist · 2025-03-08T13:15:42Z

bigquery/cloud-client/test/grantAccessToTableOrView.test.js

+    const entityId = getEntityId();
+
+    const ROLE = 'roles/bigquery.dataViewer';
+    const PRINCIPAL_ID = `group:${entityId}`;


It's good that the principal ID includes the group: prefix. To avoid confusion, consider adding a comment in the code sample (grantAccessToTableOrView.js) to indicate that the principal ID should be formatted as group:[email protected] or user:[email protected].

Suggested change

const PRINCIPAL_ID = `group:${entityId}`;

const PRINCIPAL_ID = `group:${entityId}`; // Ensure the principal ID is formatted as group: or user:

telpirion

I have multiple concerns about this sample. Given the number of comments, I will make a commit to this branch that demonstrates some of the changes I suggest.

telpirion · 2025-03-10T20:58:11Z

bigquery/cloud-client/grantAccessToDataset.js

+      `Role '${role}' granted for entity '${entityId}' in dataset '${datasetId}'.`
+    );
+
+    return updatedDataset.access;


issue: process results from the method call in the sample.

See: https://googlecloudplatform.github.io/samples-style-guide/#result

telpirion · 2025-03-10T21:08:39Z

bigquery/cloud-client/grantAccessToDataset.js

+
+  // Define enum for HTTP codes.
+  const HTTP_STATUS = {
+    PRECONDITION_FAILED: 412,


question: can we use a library here instead of defining our own constant? Maybe something from the gRPC library for Node?

telpirion · 2025-03-10T21:16:06Z

bigquery/cloud-client/grantAccessToDataset.js

+    const [dataset] = await client.dataset(datasetId).get();
+
+    // The 'access entries' array is immutable. Create a copy for modifications.
+    const entries = Array.isArray(dataset.metadata.access)


issue: don't use ternary conditions in samples, as they are harder to read.

The condition that we're testing is "is dataset.metadata.access an array?" I think we can assume that it is an array, since it is returned by the API service.

telpirion · 2025-03-10T21:23:01Z

bigquery/cloud-client/grantAccessToDataset.js

+      .dataset(datasetId)
+      .setMetadata(metadata);
+
+    // Show a success message.


nit: cut this comment, as it doesn't add any significant new information to what the code does.

telpirion · 2025-03-10T21:25:31Z

bigquery/cloud-client/grantAccessToDataset.js

+    // Find more details about the AccessEntry object in the BigQuery documentation:
+    // https://cloud.google.com/python/docs/reference/bigquery/latest/google.cloud.bigquery.dataset.AccessEntry
+    entries.push({
+      role: role,


nit: you can shorten this operation to just

entries.push({ role, [entityType]: entityId, })

telpirion · 2025-03-10T22:53:38Z

bigquery/cloud-client/test/grantAccessToDataset.test.js

+
+'use strict';
+
+const {expect} = require('chai');


issue: explicitly import describe, it, before, and after from mocha.

Also, let's use just regular assert() rather than expect().

telpirion · 2025-03-10T23:35:24Z

bigquery/cloud-client/test/config.js

+const VIEW_NAME = `${PREFIX}_view`;
+
+// Shared client for all tests
+let sharedClient = null;


issue: I have concerns about storing these variables globally. I think we should ensure that our set up function passes along resource names to each subsequent set up step in the object hierarchy.

telpirion · 2025-03-10T23:36:08Z

bigquery/cloud-client/test/config.js

+const PREFIX = createRandomPrefix();
+console.log(`Generated test prefix: ${PREFIX}`);
+
+const ENTITY_ID = '[email protected]'; // Group account


question: Do we know that using this entity ID "works"? I think we should look at the IAM samples to see if there is a better pattern used there.

telpirion · 2025-03-10T23:37:14Z

bigquery/cloud-client/grantAccessToDataset.js

+ * @param {string} role Role to grant.
+ * @returns {Promise<Array>} Array of access entries.
+ */
+async function grantAccessToDataset(datasetId, entityId, role) {


nit: we typically write the Node samples so that there is an inner function and an outer function, where the outer function exposes arguments that are passed through to the inner function.

telpirion · 2025-03-10T23:39:36Z

bigquery/cloud-client/test/grantAccessToDataset.test.js

+    );
+
+    // Assert: Check if entity was added to access entries.
+    const updatedEntityIds = accessEntries


issue: check stdout rather than iterating over the returned types. We can trust that the BigQuery service behaves appropriately. We don't have to check that resources are, in fact created -- we're more interested in ensuring that the sample didn't fail.

feat(bigquery): add samples for control access

f2b62df

hivanalejandro requested review from a team as code owners March 8, 2025 13:15

product-auto-label bot added api: bigquery Issues related to the BigQuery API. samples Issues that are directly related to samples. labels Mar 8, 2025

gemini-code-assist bot reviewed Mar 8, 2025

View reviewed changes

This was referenced Mar 8, 2025

feat(bigquery): Add samples for control access 2/3 #4024

Draft

feat(bigquery): Add samples for control access 3/3 #4025

Draft

hivanalejandro requested review from eapl-gemugami and grayside March 8, 2025 13:45

hivanalejandro mentioned this pull request Mar 10, 2025

feat(bigquery): Add cloud-client samples for access policies #3975

Closed

4 tasks

telpirion self-assigned this Mar 10, 2025

telpirion requested changes Mar 10, 2025

View reviewed changes

telpirion added 2 commits March 11, 2025 11:22

testing, stylistic update

0041270

Merge branch 'main' into hivanalejandro-features-bigquery-1

54f2250

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(bigquery): add samples for control access 1/3 #4023

feat(bigquery): add samples for control access 1/3 #4023

hivanalejandro commented Mar 8, 2025 •

edited

Loading

snippet-bot bot commented Mar 8, 2025 •

edited

Loading

gemini-code-assist bot left a comment

gemini-code-assist bot left a comment

gemini-code-assist bot Mar 8, 2025

telpirion left a comment

telpirion Mar 10, 2025

telpirion Mar 10, 2025

telpirion Mar 10, 2025

telpirion Mar 10, 2025

telpirion Mar 10, 2025

telpirion Mar 10, 2025

telpirion Mar 10, 2025

telpirion Mar 10, 2025

telpirion Mar 10, 2025

telpirion Mar 10, 2025

telpirion Mar 10, 2025

	const PRINCIPAL_ID = `group:${entityId}`;
	const PRINCIPAL_ID = `group:${entityId}`; // Ensure the principal ID is formatted as group: or user:

feat(bigquery): add samples for control access 1/3 #4023

Are you sure you want to change the base?

feat(bigquery): add samples for control access 1/3 #4023

Conversation

hivanalejandro commented Mar 8, 2025 • edited Loading

Description

Checklist

snippet-bot bot commented Mar 8, 2025 • edited Loading

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Summary of Changes

Highlights

Changelog

Footnotes

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Summary of Findings

Merge Readiness

gemini-code-assist bot Mar 8, 2025

Choose a reason for hiding this comment

telpirion left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hivanalejandro commented Mar 8, 2025 •

edited

Loading

snippet-bot bot commented Mar 8, 2025 •

edited

Loading