feat(bigquery): add samples for control access 1/3#4023
Conversation
|
Here is the summary of changes. You are about to add 2 region tags.
This comment is generated by snippet-bot.
|
product-auto-label
Bot
added
api: bigquery
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hello @hivanalejandro, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!
Summary of Changes
This pull request introduces new NodeJS samples for granting access to BigQuery datasets, tables, or views using IAM. It includes two new files: grantAccessToDataset.js and grantAccessToTableOrView.js, along with corresponding tests and updates to the package.json and config.js files. The samples demonstrate how to grant roles to users or groups, enabling control over resource access within BigQuery.
Highlights
- New Samples: Adds
grantAccessToDataset.jsandgrantAccessToTableOrView.jsto demonstrate granting access to BigQuery resources. - IAM Integration: Demonstrates the use of IAM policies to control access to BigQuery datasets, tables, and views.
- Testing: Includes new tests to verify the functionality of the new samples.
Changelog
Click here to see the changelog
- bigquery/cloud-client/grantAccessToDataset.js
- Introduces a new function
grantAccessToDatasetto grant access to a BigQuery dataset for a specified entity. - Includes example code with placeholders for datasetId, entityId, and role.
- Uses
@google-cloud/bigquerylibrary to interact with BigQuery. - Handles potential
PRECONDITION_FAILEDerrors if the dataset is modified remotely.
- Introduces a new function
- bigquery/cloud-client/grantAccessToTableOrView.js
- Introduces a new function
grantAccessToTableOrViewto grant access to a BigQuery table or view for a specified principal. - Includes example code with placeholders for projectId, datasetId, resourceName, principalId, and role.
- Uses
@google-cloud/bigquerylibrary to interact with BigQuery. - Updates the IAM access policy for the table or view with the new binding.
- Introduces a new function
- bigquery/cloud-client/package.json
- Adds
bigquery-cloud-clientpackage with description, version, license, author, and engine details. - Includes scripts for deploy, start, unit-test, and test.
- Specifies
@google-cloud/bigqueryas a dependency. - Adds
c8,chai,mocha, andsinonas devDependencies.
- Adds
- bigquery/cloud-client/test/config.js
- Adds configuration file for tests, including setup and teardown functions.
- Defines constants for prefix, entity ID, dataset ID, table name, and view name.
- Includes helper functions to get shared resources like client, project ID, dataset, table, and view.
- Implements setupBeforeAll and teardownAfterAll functions to manage test resources.
- bigquery/cloud-client/test/grantAccessToDataset.test.js
- Adds tests for the
grantAccessToDatasetfunction. - Uses
chaifor assertions. - Imports necessary modules and functions from
./config.jsand../grantAccessToDataset.js. - Tests if the entity is added to access entries correctly.
- Adds tests for the
- bigquery/cloud-client/test/grantAccessToTableOrView.test.js
- Adds tests for the
grantAccessToTableOrViewfunction. - Uses
assertfor assertions. - Imports necessary modules and functions from
./config.jsand../grantAccessToTableOrView.js. - Tests if access is granted to a table correctly by verifying role and principal existence in the updated policy.
- Adds tests for the
Using Gemini Code Assist
The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.
Invoking Gemini
You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.
| Feature | Command | Description |
|---|---|---|
| Code Review | /gemini review |
Performs a code review for the current pull request in its current state. |
| Pull Request Summary | /gemini summary |
Provides a summary of the current pull request in its current state. |
| Comment | @gemini-code-assist | Responds in comments when explicitly tagged, both in issue comments and review comments. |
| Help | /gemini help |
Displays a list of available commands. |
Customization
To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.
Limitations & Feedback
Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.
You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.
Trivia time!
What is the underlying technology that powers BigQuery's query engine?
Click here for the answer
BigQuery's query engine is powered by Dremel, a scalable, interactive ad-hoc query system for analysis of read-only nested data.
Footnotes
-
Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩
There was a problem hiding this comment.
Code Review
This pull request introduces new NodeJS samples for granting access to BigQuery datasets, tables, or views. The code includes functions to grant access and corresponding tests. Overall, the code is well-structured and addresses the intended functionality. However, there are a few areas that could be improved for clarity and robustness.
Summary of Findings
- TODO comments: The code contains
TODOcomments with placeholders for the developer to update. While this is acceptable, it's important to ensure these are addressed before merging to avoid confusion or incomplete examples. - Error Handling: The error handling in
grantAccessToDatasetcould be improved by providing more context or guidance to the user on how to resolve thePRECONDITION_FAILEDerror. - Principal ID Format: In
grantAccessToTableOrView, the principal ID is hardcoded with agroup:prefix in the test. The code sample should reflect this format to avoid confusion.
Merge Readiness
The pull request is almost ready for merging. Addressing the TODO comments and clarifying the principal ID format would improve the overall quality of the samples. I am unable to directly approve this pull request, and recommend that others review and approve this code before merging. At a minimum, the TODO comments should be addressed before merging.
telpirion
left a comment
telpirion
left a comment
There was a problem hiding this comment.
I have multiple concerns about this sample. Given the number of comments, I will make a commit to this branch that demonstrates some of the changes I suggest.
| `Role '${role}' granted for entity '${entityId}' in dataset '${datasetId}'.` | ||
| ); | ||
|
|
||
| return updatedDataset.access; |
There was a problem hiding this comment.
issue: process results from the method call in the sample.
See: https://googlecloudplatform.github.io/samples-style-guide/#result
|
|
||
| // Define enum for HTTP codes. | ||
| const HTTP_STATUS = { | ||
| PRECONDITION_FAILED: 412, |
There was a problem hiding this comment.
question: can we use a library here instead of defining our own constant? Maybe something from the gRPC library for Node?
| const [dataset] = await client.dataset(datasetId).get(); | ||
|
|
||
| // The 'access entries' array is immutable. Create a copy for modifications. | ||
| const entries = Array.isArray(dataset.metadata.access) |
There was a problem hiding this comment.
issue: don't use ternary conditions in samples, as they are harder to read.
The condition that we're testing is "is dataset.metadata.access an array?" I think we can assume that it is an array, since it is returned by the API service.
| .dataset(datasetId) | ||
| .setMetadata(metadata); | ||
|
|
||
| // Show a success message. |
There was a problem hiding this comment.
nit: cut this comment, as it doesn't add any significant new information to what the code does.
| // Find more details about the AccessEntry object in the BigQuery documentation: | ||
| // https://cloud.google.com/python/docs/reference/bigquery/latest/google.cloud.bigquery.dataset.AccessEntry | ||
| entries.push({ | ||
| role: role, |
There was a problem hiding this comment.
nit: you can shorten this operation to just
entries.push({
role,
[entityType]: entityId,
})|
|
||
| 'use strict'; | ||
|
|
||
| const {expect} = require('chai'); |
There was a problem hiding this comment.
issue: explicitly import describe, it, before, and after from mocha.
There was a problem hiding this comment.
Also, let's use just regular assert() rather than expect().
| const VIEW_NAME = `${PREFIX}_view`; | ||
|
|
||
| // Shared client for all tests | ||
| let sharedClient = null; |
There was a problem hiding this comment.
issue: I have concerns about storing these variables globally. I think we should ensure that our set up function passes along resource names to each subsequent set up step in the object hierarchy.
| const PREFIX = createRandomPrefix(); | ||
| console.log(`Generated test prefix: ${PREFIX}`); | ||
|
|
||
| const ENTITY_ID = 'cloud-developer-relations@google.com'; // Group account |
There was a problem hiding this comment.
question: Do we know that using this entity ID "works"? I think we should look at the IAM samples to see if there is a better pattern used there.
| * @param {string} role Role to grant. | ||
| * @returns {Promise<Array>} Array of access entries. | ||
| */ | ||
| async function grantAccessToDataset(datasetId, entityId, role) { |
There was a problem hiding this comment.
nit: we typically write the Node samples so that there is an inner function and an outer function, where the outer function exposes arguments that are passed through to the inner function.
| ); | ||
|
|
||
| // Assert: Check if entity was added to access entries. | ||
| const updatedEntityIds = accessEntries |
There was a problem hiding this comment.
issue: check stdout rather than iterating over the returned types. We can trust that the BigQuery service behaves appropriately. We don't have to check that resources are, in fact created -- we're more interested in ensuring that the sample didn't fail.
2 participants
Description
Add the following NodeJS samples:
Step of Internal: b/394478489
PR 1/3
Checklist
npm test(see Testing)