google-cloud-bigquery 1.54.0 → 1.55.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: cbfaf1f9de532a42e02ae04ce9a3373b337b401491a746a10e103c708b01d069
4
- data.tar.gz: 3d7dd0f1213c69fcb79fee23f342f3e435c66842af1cc7569bf7c861f5f54773
3
+ metadata.gz: 448f588a59a05dce2bc2deacac8b9976042ad075d2d88ab7c2f03cf26ed2e7ce
4
+ data.tar.gz: 685ab418b60a7acc5f0b6d5ca806e7beb0d207d68fca21080d72eaba8c9f8922
5
5
  SHA512:
6
- metadata.gz: 4144ce5964844c6f8aebc2e12049639a6e42c65d74458617b88836b7bccded75c061315548c49d0030f1667a8890496911e9d8334d518adc40c0b416dc968ffe
7
- data.tar.gz: 46d49fb84f11c0b97211ba5099a11be5001a21b20df26a21a4a31843633abba9869dad0cb4f80a9674156c5a4d78d84af2cfef9b77ee52395987e8e7637ce7b9
6
+ metadata.gz: 586615af0965f08ab9d2aed90d884ede5a4ccbeb3ead1aa82ac6d79d82faa9f84e26890c0a42ff353658ff3a2de378d0bab279dd9d28324bb9cec9d39cd44025
7
+ data.tar.gz: d484969612d8e0ed84a3aef824a606d45a98a376e62129b45b13318099d4b1dbe2c327983b92c06176a0e29046c0df996dda4efd9aa7c7f4d638274cf506ddcc
data/CHANGELOG.md CHANGED
@@ -1,5 +1,11 @@
1
1
  # Release History
2
2
 
3
+ ### 1.55.0 (2025-08-26)
4
+
5
+ #### Features
6
+
7
+ * Add support for IAM Condition in Dataset Access ([#30854](https://github.com/googleapis/google-cloud-ruby/issues/30854))
8
+
3
9
  ### 1.54.0 (2025-08-15)
4
10
 
5
11
  #### Features
@@ -0,0 +1,218 @@
1
+ # Copyright 2025 Google LLC
2
+ #
3
+ # Licensed under the Apache License, Version 2.0 (the "License");
4
+ # you may not use this file except in compliance with the License.
5
+ # You may obtain a copy of the License at
6
+ #
7
+ # https://www.apache.org/licenses/LICENSE-2.0
8
+ #
9
+ # Unless required by applicable law or agreed to in writing, software
10
+ # distributed under the License is distributed on an "AS IS" BASIS,
11
+ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12
+ # See the License for the specific language governing permissions and
13
+ # limitations under the License.
14
+
15
+ require "google/apis/bigquery_v2"
16
+
17
+ module Google
18
+ module Cloud
19
+ module Bigquery
20
+ ##
21
+ # # Condition
22
+ #
23
+ # Represents a textual expression in the Common Expression Language (CEL) syntax.
24
+ # CEL is a C-like expression language. The syntax and semantics of CEL are documented
25
+ # at https://github.com/google/cel-spec
26
+ #
27
+ # Used to define condition for {Dataset::Access} rules
28
+ #
29
+ class Condition
30
+ ##
31
+ # Returns the textual representation of an expression in Common Expression Language syntax.
32
+ #
33
+ # @return [String] The expression of the condition.
34
+ #
35
+ # @example
36
+ # condition = Google::Cloud::Bigquery::Condition.new(
37
+ # "resource.name.startsWith('projects/my-project')"
38
+ # )
39
+ # puts condition.expression # => "resource.name.startsWith('projects/my-project')"
40
+ #
41
+ def expression
42
+ @expression
43
+ end
44
+
45
+ ##
46
+ # Sets the textual representation of an expression in Common Expression Language syntax.
47
+ #
48
+ # @param [String] val The expression to set.
49
+ #
50
+ # @raise [ArgumentError] if the expression is nil or empty.
51
+ #
52
+ # @example
53
+ # condition = Google::Cloud::Bigquery::Condition.new(
54
+ # "resource.name.startsWith('projects/my-project')"
55
+ # )
56
+ # condition.expression = "document.summary.size() < 100"
57
+ #
58
+ def expression= val
59
+ if val.nil? || val.strip.empty?
60
+ raise ArgumentError, "Expression cannot be nil or empty"
61
+ end
62
+ @expression = val
63
+ end
64
+
65
+ ##
66
+ # Returns the optional description of the expression. This is a longer text which describes
67
+ # the expression, e.g. when hovered over it in a UI.
68
+ #
69
+ # @return [String, nil] The description of the condition. nil if not set.
70
+ #
71
+ # @example
72
+ # condition = Google::Cloud::Bigquery::Condition.new(
73
+ # "document.summary.size() < 100",
74
+ # description: "Checks if summary is less than 100 chars"
75
+ # )
76
+ # puts condition.description # => "Checks if summary is less than 100 chars"
77
+ #
78
+ def description
79
+ @description
80
+ end
81
+
82
+ ##
83
+ # Sets the optional description of the expression. This is a longer text which describes
84
+ # the expression, e.g. when hovered over it in a UI.
85
+ #
86
+ # @param [String, nil] val The description to set. nil to unset.
87
+ #
88
+ # @example
89
+ # condition = Google::Cloud::Bigquery::Condition.new(
90
+ # "document.summary.size() < 100"
91
+ # )
92
+ # condition.description = "Checks if summary is less than 100 chars"
93
+ #
94
+ def description= val
95
+ @description = val
96
+ end
97
+
98
+ ##
99
+ # Returns the optional string indicating the location of the expression for error reporting,
100
+ # e.g. a file name and a position in the file.
101
+ #
102
+ # @return [String, nil] The location of the condition. nil if not set.
103
+ #
104
+ # @example
105
+ # condition = Google::Cloud::Bigquery::Condition.new(
106
+ # "document.summary.size() < 100",
107
+ # location: "document/summary"
108
+ # )
109
+ # puts condition.location # => "document/summary"
110
+ #
111
+ def location
112
+ @location
113
+ end
114
+
115
+ ##
116
+ # Sets the optional string indicating the location of the expression for error reporting,
117
+ # e.g. a file name and a position in the file.
118
+ #
119
+ # @param [String, nil] val The location to set. nil to unset.
120
+ #
121
+ # @example
122
+ # condition = Google::Cloud::Bigquery::Condition.new(
123
+ # "document.summary.size() < 100"
124
+ # )
125
+ # condition.location = "document/summary"
126
+ #
127
+ def location= val
128
+ @location = val
129
+ end
130
+
131
+ ##
132
+ # Returns the optional title for the expression, i.e. a short string describing its purpose.
133
+ # This can be used e.g. in UIs which allow to enter the expression.
134
+ #
135
+ # @return [String, nil] The title of the condition. nil if not set.
136
+ #
137
+ # @example
138
+ # condition = Google::Cloud::Bigquery::Condition.new(
139
+ # "document.summary.size() < 100",
140
+ # title: "Summary size limit"
141
+ # )
142
+ # puts condition.title # => "Summary size limit"
143
+ #
144
+ def title
145
+ @title
146
+ end
147
+
148
+ ##
149
+ # Sets the optional title for the expression, i.e. a short string describing its purpose.
150
+ # This can be used e.g. in UIs which allow to enter the expression.
151
+ #
152
+ # @param [String, nil] val The title to set. nil to unset.
153
+ #
154
+ # @example
155
+ # condition = Google::Cloud::Bigquery::Condition.new(
156
+ # "document.summary.size() < 100"
157
+ # )
158
+ # condition.title = "Summary size limit"
159
+ #
160
+ def title= val
161
+ @title = val
162
+ end
163
+
164
+ ##
165
+ # Create a new Condition object.
166
+ #
167
+ # @param [String] expression The expression in CEL syntax.
168
+ # @param [String] description Optional description of the expression.
169
+ # @param [String] location Optional location of the expression for error reporting.
170
+ # @param [String] title Optional title for the expression.
171
+ #
172
+ # @raise [ArgumentError] if expression is nil or empty.
173
+ #
174
+ # @example
175
+ # condition = Google::Cloud::Bigquery::Condition.new(
176
+ # "document.summary.size() < 100",
177
+ # description: "Determines if a summary is less than 100 chars",
178
+ # location: "document/summary",
179
+ # title: "Summary size limit"
180
+ # )
181
+ #
182
+ # @see https://cloud.google.com/bigquery/docs/reference/auditlogs/rest/Shared.Types/Expr
183
+ #
184
+ def initialize expression, description: nil, location: nil, title: nil
185
+ if expression.nil? || expression.strip.empty?
186
+ raise ArgumentError, "Expression cannot be nil or empty"
187
+ end
188
+ @expression = expression
189
+ @description = description
190
+ @location = location
191
+ @title = title
192
+ end
193
+
194
+ ##
195
+ # @private Convert the Condition object to a Google API Client object.
196
+ #
197
+ # @return [Google::Apis::BigqueryV2::Expr] The Google API Client object representing the condition.
198
+ #
199
+ # @example
200
+ # condition = Google::Cloud::Bigquery::Condition.new(
201
+ # "resource.name.startsWith('projects/my-project')"
202
+ # )
203
+ # gapi_condition = condition.to_gapi
204
+ #
205
+ # @see https://cloud.google.com/bigquery/docs/reference/auditlogs/rest/Shared.Types/Expr
206
+ #
207
+ def to_gapi
208
+ gapi = Google::Apis::BigqueryV2::Expr.new
209
+ gapi.description = @description unless @description.nil?
210
+ gapi.expression = @expression
211
+ gapi.location = @location unless @location.nil?
212
+ gapi.title = @title unless @title.nil?
213
+ gapi
214
+ end
215
+ end
216
+ end
217
+ end
218
+ end
@@ -121,6 +121,13 @@ module Google
121
121
  # Add reader access to a user.
122
122
  #
123
123
  # @param [String] email The email address for the entity.
124
+ # @param [Google::Cloud::Bigquery::Condition, nil] condition An
125
+ # optional condition for the access rule. A condition is a CEL
126
+ # expression that is evaluated to determine if the access rule
127
+ # should be applied. See {Google::Cloud::Bigquery::Condition} for
128
+ # more information. To specify a condition, the
129
+ # `access_policy_version` on the dataset must be set to `3`. `nil`
130
+ # represents an absence of a condition. The default is `nil`.
124
131
  #
125
132
  # @example
126
133
  # require "google/cloud/bigquery"
@@ -132,14 +139,35 @@ module Google
132
139
  # access.add_reader_user "entity@example.com"
133
140
  # end
134
141
  #
135
- def add_reader_user email
136
- add_access_role_scope_value :reader, :user, email
142
+ # @example With a condition:
143
+ # require "google/cloud/bigquery"
144
+ #
145
+ # bigquery = Google::Cloud::Bigquery.new
146
+ # dataset = bigquery.dataset "my_dataset"
147
+ # condition = Google::Cloud::Bigquery::Condition.new(
148
+ # "resource.name.startsWith(\"projects/my-project/datasets/my_dataset/tables/foo\")",
149
+ # title: "Table foo only"
150
+ # )
151
+ #
152
+ # dataset.access do |access|
153
+ # access.add_reader_user "entity@example.com", condition: condition
154
+ # end
155
+ #
156
+ def add_reader_user email, condition: nil
157
+ add_access_role_scope_value :reader, :user, email, condition
137
158
  end
138
159
 
139
160
  ##
140
161
  # Add reader access to a group.
141
162
  #
142
163
  # @param [String] email The email address for the entity.
164
+ # @param [Google::Cloud::Bigquery::Condition, nil] condition An
165
+ # optional condition for the access rule. A condition is a CEL
166
+ # expression that is evaluated to determine if the access rule
167
+ # should be applied. See {Google::Cloud::Bigquery::Condition} for
168
+ # more information. To specify a condition, the
169
+ # `access_policy_version` on the dataset must be set to `3`. `nil`
170
+ # represents an absence of a condition. The default is `nil`.
143
171
  #
144
172
  # @example
145
173
  # require "google/cloud/bigquery"
@@ -151,8 +179,22 @@ module Google
151
179
  # access.add_reader_group "entity@example.com"
152
180
  # end
153
181
  #
154
- def add_reader_group email
155
- add_access_role_scope_value :reader, :group, email
182
+ # @example With a condition:
183
+ # require "google/cloud/bigquery"
184
+ #
185
+ # bigquery = Google::Cloud::Bigquery.new
186
+ # dataset = bigquery.dataset "my_dataset"
187
+ # condition = Google::Cloud::Bigquery::Condition.new(
188
+ # "resource.name.startsWith(\"projects/my-project/datasets/my_dataset/tables/foo\")",
189
+ # title: "Table foo only"
190
+ # )
191
+ #
192
+ # dataset.access do |access|
193
+ # access.add_reader_group "entity@example.com", condition: condition
194
+ # end
195
+ #
196
+ def add_reader_group email, condition: nil
197
+ add_access_role_scope_value :reader, :group, email, condition
156
198
  end
157
199
 
158
200
  ##
@@ -160,6 +202,13 @@ module Google
160
202
  # Policy but isn't a user, group, domain, or special group.
161
203
  #
162
204
  # @param [String] identity The identity reference.
205
+ # @param [Google::Cloud::Bigquery::Condition, nil] condition An
206
+ # optional condition for the access rule. A condition is a CEL
207
+ # expression that is evaluated to determine if the access rule
208
+ # should be applied. See {Google::Cloud::Bigquery::Condition} for
209
+ # more information. To specify a condition, the
210
+ # `access_policy_version` on the dataset must be set to `3`. `nil`
211
+ # represents an absence of a condition. The default is `nil`.
163
212
  #
164
213
  # @example
165
214
  # require "google/cloud/bigquery"
@@ -171,8 +220,22 @@ module Google
171
220
  # access.add_reader_iam_member "entity@example.com"
172
221
  # end
173
222
  #
174
- def add_reader_iam_member identity
175
- add_access_role_scope_value :reader, :iam_member, identity
223
+ # @example With a condition:
224
+ # require "google/cloud/bigquery"
225
+ #
226
+ # bigquery = Google::Cloud::Bigquery.new
227
+ # dataset = bigquery.dataset "my_dataset"
228
+ # condition = Google::Cloud::Bigquery::Condition.new(
229
+ # "resource.name.startsWith(\"projects/my-project/datasets/my_dataset/tables/foo\")",
230
+ # title: "Table foo only"
231
+ # )
232
+ #
233
+ # dataset.access do |access|
234
+ # access.add_reader_iam_member "entity@example.com", condition: condition
235
+ # end
236
+ #
237
+ def add_reader_iam_member identity, condition: nil
238
+ add_access_role_scope_value :reader, :iam_member, identity, condition
176
239
  end
177
240
 
178
241
  ##
@@ -180,6 +243,13 @@ module Google
180
243
  #
181
244
  # @param [String] domain A [Cloud Identity
182
245
  # domain](https://cloud.google.com/iam/docs/overview#cloudid_name_domain).
246
+ # @param [Google::Cloud::Bigquery::Condition, nil] condition An
247
+ # optional condition for the access rule. A condition is a CEL
248
+ # expression that is evaluated to determine if the access rule
249
+ # should be applied. See {Google::Cloud::Bigquery::Condition} for
250
+ # more information. To specify a condition, the
251
+ # `access_policy_version` on the dataset must be set to `3`. `nil`
252
+ # represents an absence of a condition. The default is `nil`.
183
253
  #
184
254
  # @example
185
255
  # require "google/cloud/bigquery"
@@ -191,8 +261,22 @@ module Google
191
261
  # access.add_reader_domain "example.com"
192
262
  # end
193
263
  #
194
- def add_reader_domain domain
195
- add_access_role_scope_value :reader, :domain, domain
264
+ # @example With a condition:
265
+ # require "google/cloud/bigquery"
266
+ #
267
+ # bigquery = Google::Cloud::Bigquery.new
268
+ # dataset = bigquery.dataset "my_dataset"
269
+ # condition = Google::Cloud::Bigquery::Condition.new(
270
+ # "resource.name.startsWith(\"projects/my-project/datasets/my_dataset/tables/foo\")",
271
+ # title: "Table foo only"
272
+ # )
273
+ #
274
+ # dataset.access do |access|
275
+ # access.add_reader_domain "example.com", condition: condition
276
+ # end
277
+ #
278
+ def add_reader_domain domain, condition: nil
279
+ add_access_role_scope_value :reader, :domain, domain, condition
196
280
  end
197
281
 
198
282
  ##
@@ -212,7 +296,7 @@ module Google
212
296
  # end
213
297
  #
214
298
  def add_reader_special group
215
- add_access_role_scope_value :reader, :special, group
299
+ add_access_role_scope_value :reader, :special, group, nil
216
300
  end
217
301
 
218
302
  ##
@@ -311,6 +395,13 @@ module Google
311
395
  # Add writer access to a user.
312
396
  #
313
397
  # @param [String] email The email address for the entity.
398
+ # @param [Google::Cloud::Bigquery::Condition, nil] condition An
399
+ # optional condition for the access rule. A condition is a CEL
400
+ # expression that is evaluated to determine if the access rule
401
+ # should be applied. See {Google::Cloud::Bigquery::Condition} for
402
+ # more information. To specify a condition, the
403
+ # `access_policy_version` on the dataset must be set to `3`. `nil`
404
+ # represents an absence of a condition. The default is `nil`.
314
405
  #
315
406
  # @example
316
407
  # require "google/cloud/bigquery"
@@ -322,14 +413,35 @@ module Google
322
413
  # access.add_writer_user "entity@example.com"
323
414
  # end
324
415
  #
325
- def add_writer_user email
326
- add_access_role_scope_value :writer, :user, email
416
+ # @example With a condition:
417
+ # require "google/cloud/bigquery"
418
+ #
419
+ # bigquery = Google::Cloud::Bigquery.new
420
+ # dataset = bigquery.dataset "my_dataset"
421
+ # condition = Google::Cloud::Bigquery::Condition.new(
422
+ # "resource.name.startsWith(\"projects/my-project/datasets/my_dataset/tables/foo\")",
423
+ # title: "Table foo only"
424
+ # )
425
+ #
426
+ # dataset.access do |access|
427
+ # access.add_writer_user "entity@example.com", condition: condition
428
+ # end
429
+ #
430
+ def add_writer_user email, condition: nil
431
+ add_access_role_scope_value :writer, :user, email, condition
327
432
  end
328
433
 
329
434
  ##
330
435
  # Add writer access to a group.
331
436
  #
332
437
  # @param [String] email The email address for the entity.
438
+ # @param [Google::Cloud::Bigquery::Condition, nil] condition An
439
+ # optional condition for the access rule. A condition is a CEL
440
+ # expression that is evaluated to determine if the access rule
441
+ # should be applied. See {Google::Cloud::Bigquery::Condition} for
442
+ # more information. To specify a condition, the
443
+ # `access_policy_version` on the dataset must be set to `3`. `nil`
444
+ # represents an absence of a condition. The default is `nil`.
333
445
  #
334
446
  # @example
335
447
  # require "google/cloud/bigquery"
@@ -341,8 +453,22 @@ module Google
341
453
  # access.add_writer_group "entity@example.com"
342
454
  # end
343
455
  #
344
- def add_writer_group email
345
- add_access_role_scope_value :writer, :group, email
456
+ # @example With a condition:
457
+ # require "google/cloud/bigquery"
458
+ #
459
+ # bigquery = Google::Cloud::Bigquery.new
460
+ # dataset = bigquery.dataset "my_dataset"
461
+ # condition = Google::Cloud::Bigquery::Condition.new(
462
+ # "resource.name.startsWith(\"projects/my-project/datasets/my_dataset/tables/foo\")",
463
+ # title: "Table foo only"
464
+ # )
465
+ #
466
+ # dataset.access do |access|
467
+ # access.add_writer_group "entity@example.com", condition: condition
468
+ # end
469
+ #
470
+ def add_writer_group email, condition: nil
471
+ add_access_role_scope_value :writer, :group, email, condition
346
472
  end
347
473
 
348
474
  ##
@@ -350,6 +476,13 @@ module Google
350
476
  # Policy but isn't a user, group, domain, or special group.
351
477
  #
352
478
  # @param [String] identity The identity reference.
479
+ # @param [Google::Cloud::Bigquery::Condition, nil] condition An
480
+ # optional condition for the access rule. A condition is a CEL
481
+ # expression that is evaluated to determine if the access rule
482
+ # should be applied. See {Google::Cloud::Bigquery::Condition} for
483
+ # more information. To specify a condition, the
484
+ # `access_policy_version` on the dataset must be set to `3`. `nil`
485
+ # represents an absence of a condition. The default is `nil`.
353
486
  #
354
487
  # @example
355
488
  # require "google/cloud/bigquery"
@@ -361,8 +494,22 @@ module Google
361
494
  # access.add_writer_iam_member "entity@example.com"
362
495
  # end
363
496
  #
364
- def add_writer_iam_member identity
365
- add_access_role_scope_value :writer, :iam_member, identity
497
+ # @example With a condition:
498
+ # require "google/cloud/bigquery"
499
+ #
500
+ # bigquery = Google::Cloud::Bigquery.new
501
+ # dataset = bigquery.dataset "my_dataset"
502
+ # condition = Google::Cloud::Bigquery::Condition.new(
503
+ # "resource.name.startsWith(\"projects/my-project/datasets/my_dataset/tables/foo\")",
504
+ # title: "Table foo only"
505
+ # )
506
+ #
507
+ # dataset.access do |access|
508
+ # access.add_writer_iam_member "entity@example.com", condition: condition
509
+ # end
510
+ #
511
+ def add_writer_iam_member identity, condition: nil
512
+ add_access_role_scope_value :writer, :iam_member, identity, condition
366
513
  end
367
514
 
368
515
  ##
@@ -370,6 +517,13 @@ module Google
370
517
  #
371
518
  # @param [String] domain A [Cloud Identity
372
519
  # domain](https://cloud.google.com/iam/docs/overview#cloudid_name_domain).
520
+ # @param [Google::Cloud::Bigquery::Condition, nil] condition An
521
+ # optional condition for the access rule. A condition is a CEL
522
+ # expression that is evaluated to determine if the access rule
523
+ # should be applied. See {Google::Cloud::Bigquery::Condition} for
524
+ # more information. To specify a condition, the
525
+ # `access_policy_version` on the dataset must be set to `3`. `nil`
526
+ # represents an absence of a condition. The default is `nil`.
373
527
  #
374
528
  # @example
375
529
  # require "google/cloud/bigquery"
@@ -381,8 +535,22 @@ module Google
381
535
  # access.add_writer_domain "example.com"
382
536
  # end
383
537
  #
384
- def add_writer_domain domain
385
- add_access_role_scope_value :writer, :domain, domain
538
+ # @example With a condition:
539
+ # require "google/cloud/bigquery"
540
+ #
541
+ # bigquery = Google::Cloud::Bigquery.new
542
+ # dataset = bigquery.dataset "my_dataset"
543
+ # condition = Google::Cloud::Bigquery::Condition.new(
544
+ # "resource.name.startsWith(\"projects/my-project/datasets/my_dataset/tables/foo\")",
545
+ # title: "Table foo only"
546
+ # )
547
+ #
548
+ # dataset.access do |access|
549
+ # access.add_writer_domain "example.com", condition: condition
550
+ # end
551
+ #
552
+ def add_writer_domain domain, condition: nil
553
+ add_access_role_scope_value :writer, :domain, domain, condition
386
554
  end
387
555
 
388
556
  ##
@@ -402,13 +570,20 @@ module Google
402
570
  # end
403
571
  #
404
572
  def add_writer_special group
405
- add_access_role_scope_value :writer, :special, group
573
+ add_access_role_scope_value :writer, :special, group, nil
406
574
  end
407
575
 
408
576
  ##
409
577
  # Add owner access to a user.
410
578
  #
411
579
  # @param [String] email The email address for the entity.
580
+ # @param [Google::Cloud::Bigquery::Condition, nil] condition An
581
+ # optional condition for the access rule. A condition is a CEL
582
+ # expression that is evaluated to determine if the access rule
583
+ # should be applied. See {Google::Cloud::Bigquery::Condition} for
584
+ # more information. To specify a condition, the
585
+ # `access_policy_version` on the dataset must be set to `3`. `nil`
586
+ # represents an absence of a condition. The default is `nil`.
412
587
  #
413
588
  # @example
414
589
  # require "google/cloud/bigquery"
@@ -420,14 +595,35 @@ module Google
420
595
  # access.add_owner_user "entity@example.com"
421
596
  # end
422
597
  #
423
- def add_owner_user email
424
- add_access_role_scope_value :owner, :user, email
598
+ # @example With a condition:
599
+ # require "google/cloud/bigquery"
600
+ #
601
+ # bigquery = Google::Cloud::Bigquery.new
602
+ # dataset = bigquery.dataset "my_dataset"
603
+ # condition = Google::Cloud::Bigquery::Condition.new(
604
+ # "resource.name.startsWith(\"projects/my-project/datasets/my_dataset/tables/foo\")",
605
+ # title: "Table foo only"
606
+ # )
607
+ #
608
+ # dataset.access do |access|
609
+ # access.add_owner_user "entity@example.com", condition: condition
610
+ # end
611
+ #
612
+ def add_owner_user email, condition: nil
613
+ add_access_role_scope_value :owner, :user, email, condition
425
614
  end
426
615
 
427
616
  ##
428
617
  # Add owner access to a group.
429
618
  #
430
619
  # @param [String] email The email address for the entity.
620
+ # @param [Google::Cloud::Bigquery::Condition, nil] condition An
621
+ # optional condition for the access rule. A condition is a CEL
622
+ # expression that is evaluated to determine if the access rule
623
+ # should be applied. See {Google::Cloud::Bigquery::Condition} for
624
+ # more information. To specify a condition, the
625
+ # `access_policy_version` on the dataset must be set to `3`. `nil`
626
+ # represents an absence of a condition. The default is `nil`.
431
627
  #
432
628
  # @example
433
629
  # require "google/cloud/bigquery"
@@ -439,8 +635,22 @@ module Google
439
635
  # access.add_owner_group "entity@example.com"
440
636
  # end
441
637
  #
442
- def add_owner_group email
443
- add_access_role_scope_value :owner, :group, email
638
+ # @example With a condition:
639
+ # require "google/cloud/bigquery"
640
+ #
641
+ # bigquery = Google::Cloud::Bigquery.new
642
+ # dataset = bigquery.dataset "my_dataset"
643
+ # condition = Google::Cloud::Bigquery::Condition.new(
644
+ # "resource.name.startsWith(\"projects/my-project/datasets/my_dataset/tables/foo\")",
645
+ # title: "Table foo only"
646
+ # )
647
+ #
648
+ # dataset.access do |access|
649
+ # access.add_owner_group "entity@example.com", condition: condition
650
+ # end
651
+ #
652
+ def add_owner_group email, condition: nil
653
+ add_access_role_scope_value :owner, :group, email, condition
444
654
  end
445
655
 
446
656
  ##
@@ -448,6 +658,13 @@ module Google
448
658
  # Policy but isn't a user, group, domain, or special group.
449
659
  #
450
660
  # @param [String] identity The identity reference.
661
+ # @param [Google::Cloud::Bigquery::Condition, nil] condition An
662
+ # optional condition for the access rule. A condition is a CEL
663
+ # expression that is evaluated to determine if the access rule
664
+ # should be applied. See {Google::Cloud::Bigquery::Condition} for
665
+ # more information. To specify a condition, the
666
+ # `access_policy_version` on the dataset must be set to `3`. `nil`
667
+ # represents an absence of a condition. The default is `nil`.
451
668
  #
452
669
  # @example
453
670
  # require "google/cloud/bigquery"
@@ -459,8 +676,22 @@ module Google
459
676
  # access.add_owner_iam_member "entity@example.com"
460
677
  # end
461
678
  #
462
- def add_owner_iam_member identity
463
- add_access_role_scope_value :owner, :iam_member, identity
679
+ # @example With a condition:
680
+ # require "google/cloud/bigquery"
681
+ #
682
+ # bigquery = Google::Cloud::Bigquery.new
683
+ # dataset = bigquery.dataset "my_dataset"
684
+ # condition = Google::Cloud::Bigquery::Condition.new(
685
+ # "resource.name.startsWith(\"projects/my-project/datasets/my_dataset/tables/foo\")",
686
+ # title: "Table foo only"
687
+ # )
688
+ #
689
+ # dataset.access do |access|
690
+ # access.add_owner_iam_member "entity@example.com", condition: condition
691
+ # end
692
+ #
693
+ def add_owner_iam_member identity, condition: nil
694
+ add_access_role_scope_value :owner, :iam_member, identity, condition
464
695
  end
465
696
 
466
697
  ##
@@ -468,6 +699,13 @@ module Google
468
699
  #
469
700
  # @param [String] domain A [Cloud Identity
470
701
  # domain](https://cloud.google.com/iam/docs/overview#cloudid_name_domain).
702
+ # @param [Google::Cloud::Bigquery::Condition, nil] condition An
703
+ # optional condition for the access rule. A condition is a CEL
704
+ # expression that is evaluated to determine if the access rule
705
+ # should be applied. See {Google::Cloud::Bigquery::Condition} for
706
+ # more information. To specify a condition, the
707
+ # `access_policy_version` on the dataset must be set to `3`. `nil`
708
+ # represents an absence of a condition. The default is `nil`.
471
709
  #
472
710
  # @example
473
711
  # require "google/cloud/bigquery"
@@ -479,8 +717,22 @@ module Google
479
717
  # access.add_owner_domain "example.com"
480
718
  # end
481
719
  #
482
- def add_owner_domain domain
483
- add_access_role_scope_value :owner, :domain, domain
720
+ # @example With a condition:
721
+ # require "google/cloud/bigquery"
722
+ #
723
+ # bigquery = Google::Cloud::Bigquery.new
724
+ # dataset = bigquery.dataset "my_dataset"
725
+ # condition = Google::Cloud::Bigquery::Condition.new(
726
+ # "resource.name.startsWith(\"projects/my-project/datasets/my_dataset/tables/foo\")",
727
+ # title: "Table foo only"
728
+ # )
729
+ #
730
+ # dataset.access do |access|
731
+ # access.add_owner_domain "example.com", condition: condition
732
+ # end
733
+ #
734
+ def add_owner_domain domain, condition: nil
735
+ add_access_role_scope_value :owner, :domain, domain, condition
484
736
  end
485
737
 
486
738
  ##
@@ -500,7 +752,7 @@ module Google
500
752
  # end
501
753
  #
502
754
  def add_owner_special group
503
- add_access_role_scope_value :owner, :special, group
755
+ add_access_role_scope_value :owner, :special, group, nil
504
756
  end
505
757
 
506
758
  ##
@@ -1309,7 +1561,7 @@ module Google
1309
1561
  end
1310
1562
 
1311
1563
  # @private
1312
- def add_access_role_scope_value role, scope, value
1564
+ def add_access_role_scope_value role, scope, value, condition
1313
1565
  role = validate_role role
1314
1566
  scope = validate_scope scope
1315
1567
  # If scope is special group, make sure value is in the list
@@ -1318,6 +1570,7 @@ module Google
1318
1570
  @rules.reject!(&find_by_scope_and_value(scope, value))
1319
1571
  # Add new rule for this role, scope, and value
1320
1572
  opts = { role: role, scope => value }
1573
+ opts[:condition] = condition.to_gapi unless condition.nil?
1321
1574
  @rules << Google::Apis::BigqueryV2::Dataset::Access.new(**opts)
1322
1575
  end
1323
1576
 
@@ -59,12 +59,17 @@ module Google
59
59
  # @private A Google API Client Dataset Reference object.
60
60
  attr_reader :reference
61
61
 
62
+ ##
63
+ # @private Access Policy Version for get, update, patch, and insert API calls
64
+ attr_accessor :access_policy_version
65
+
62
66
  ##
63
67
  # @private Create an empty Dataset object.
64
68
  def initialize
65
69
  @service = nil
66
70
  @gapi = nil
67
71
  @reference = nil
72
+ @access_policy_version = nil
68
73
  end
69
74
 
70
75
  ##
@@ -2447,7 +2452,7 @@ module Google
2447
2452
  #
2448
2453
  def reload!
2449
2454
  ensure_service!
2450
- @gapi = service.get_project_dataset project_id, dataset_id
2455
+ @gapi = service.get_project_dataset project_id, dataset_id, access_policy_version: @access_policy_version
2451
2456
  @reference = nil
2452
2457
  @exists = nil
2453
2458
  self
@@ -2576,10 +2581,11 @@ module Google
2576
2581
 
2577
2582
  ##
2578
2583
  # @private New Dataset from a Google API Client object.
2579
- def self.from_gapi gapi, conn
2584
+ def self.from_gapi gapi, conn, access_policy_version: nil
2580
2585
  new.tap do |f|
2581
2586
  f.gapi = gapi
2582
2587
  f.service = conn
2588
+ f.access_policy_version = access_policy_version
2583
2589
  end
2584
2590
  end
2585
2591
 
@@ -2903,7 +2909,7 @@ module Google
2903
2909
  patch_args = attributes.to_h { |attr| [attr, @gapi.send(attr)] }
2904
2910
  patch_gapi = Google::Apis::BigqueryV2::Dataset.new(**patch_args)
2905
2911
  patch_gapi.etag = etag if etag
2906
- @gapi = service.patch_dataset dataset_id, patch_gapi
2912
+ @gapi = service.patch_dataset dataset_id, patch_gapi, access_policy_version: @access_policy_version
2907
2913
  end
2908
2914
 
2909
2915
  ##
@@ -1382,6 +1382,20 @@ module Google
1382
1382
  # service. Calls made on this object will raise errors if the resource
1383
1383
  # does not exist. Default is `false`. Optional.
1384
1384
  # @param [String] project_id The GCP Project where the dataset lives.
1385
+ # @param [Integer] access_policy_version Optional. The version of the
1386
+ # provided access policy schema. Valid values are `0`, `1`, and `3`.
1387
+ # Requests specifying an invalid value will be rejected. This
1388
+ # version refers to the schema version of the access policy and not
1389
+ # the version of access policy. This field's value can be equal or
1390
+ # more than the access policy schema provided in the request. For
1391
+ # example, requests with conditional access policy binding in datasets
1392
+ # must specify version `3`. But dataset with no conditional role
1393
+ # bindings in access policy may specify any valid value or leave the
1394
+ # field unset. If unset or if `0` or `1` value is used for dataset with
1395
+ # conditional bindings, request will be rejected. This field will be
1396
+ # mapped to
1397
+ # [IAM Policy version](https://cloud.google.com/iam/docs/policies#versions)
1398
+ # and will be used to set policy in IAM.
1385
1399
  #
1386
1400
  # @return [Google::Cloud::Bigquery::Dataset, nil] Returns `nil` if the
1387
1401
  # dataset does not exist.
@@ -1409,12 +1423,12 @@ module Google
1409
1423
  #
1410
1424
  # dataset = bigquery.dataset "my_dataset", skip_lookup: true
1411
1425
  #
1412
- def dataset dataset_id, skip_lookup: nil, project_id: nil
1426
+ def dataset dataset_id, skip_lookup: nil, project_id: nil, access_policy_version: nil
1413
1427
  ensure_service!
1414
1428
  project_id ||= project
1415
1429
  return Dataset.new_reference project_id, dataset_id, service if skip_lookup
1416
- gapi = service.get_project_dataset project_id, dataset_id
1417
- Dataset.from_gapi gapi, service
1430
+ gapi = service.get_project_dataset project_id, dataset_id, access_policy_version: access_policy_version
1431
+ Dataset.from_gapi gapi, service, access_policy_version: access_policy_version
1418
1432
  rescue Google::Cloud::NotFoundError
1419
1433
  nil
1420
1434
  end
@@ -1433,6 +1447,20 @@ module Google
1433
1447
  # @param [String] location The geographic location where the dataset
1434
1448
  # should reside. Possible values include `EU` and `US`. The default
1435
1449
  # value is `US`.
1450
+ # @param [Integer] access_policy_version Optional. The version of the
1451
+ # provided access policy schema. Valid values are `0`, `1`, and `3`.
1452
+ # Requests specifying an invalid value will be rejected. This
1453
+ # version refers to the schema version of the access policy and not
1454
+ # the version of access policy. This field's value can be equal or
1455
+ # more than the access policy schema provided in the request. For
1456
+ # example, requests with conditional access policy binding in datasets
1457
+ # must specify version `3`. But dataset with no conditional role
1458
+ # bindings in access policy may specify any valid value or leave the
1459
+ # field unset. If unset or if `0` or `1` value is used for dataset with
1460
+ # conditional bindings, request will be rejected. This field will be
1461
+ # mapped to
1462
+ # [IAM Policy version](https://cloud.google.com/iam/docs/policies#versions)
1463
+ # and will be used to set policy in IAM.
1436
1464
  # @yield [access] a block for setting rules
1437
1465
  # @yieldparam [Google::Cloud::Bigquery::Dataset] access the object
1438
1466
  # accepting rules
@@ -1465,7 +1493,7 @@ module Google
1465
1493
  # end
1466
1494
  #
1467
1495
  def create_dataset dataset_id, name: nil, description: nil,
1468
- expiration: nil, location: nil
1496
+ expiration: nil, location: nil, access_policy_version: nil
1469
1497
  ensure_service!
1470
1498
 
1471
1499
  new_ds = Google::Apis::BigqueryV2::Dataset.new(
@@ -1488,8 +1516,8 @@ module Google
1488
1516
  updater.check_for_mutated_access!
1489
1517
  end
1490
1518
 
1491
- gapi = service.insert_dataset new_ds
1492
- Dataset.from_gapi gapi, service
1519
+ gapi = service.insert_dataset new_ds, access_policy_version: access_policy_version
1520
+ Dataset.from_gapi gapi, service, access_policy_version: access_policy_version
1493
1521
  end
1494
1522
 
1495
1523
  ##
@@ -109,29 +109,29 @@ module Google
109
109
 
110
110
  ##
111
111
  # Returns the dataset specified by datasetID.
112
- def get_dataset dataset_id
113
- get_project_dataset @project, dataset_id
112
+ def get_dataset dataset_id, access_policy_version: nil
113
+ get_project_dataset @project, dataset_id, access_policy_version: access_policy_version
114
114
  end
115
115
 
116
116
  ##
117
117
  # Gets the specified dataset resource by full dataset reference.
118
- def get_project_dataset project_id, dataset_id
118
+ def get_project_dataset project_id, dataset_id, access_policy_version: nil
119
119
  # The get operation is considered idempotent
120
120
  execute backoff: true do
121
- service.get_dataset project_id, dataset_id
121
+ service.get_dataset project_id, dataset_id, access_policy_version: access_policy_version
122
122
  end
123
123
  end
124
124
 
125
125
  ##
126
126
  # Creates a new empty dataset.
127
- def insert_dataset new_dataset_gapi
128
- execute { service.insert_dataset @project, new_dataset_gapi }
127
+ def insert_dataset new_dataset_gapi, access_policy_version: nil
128
+ execute { service.insert_dataset @project, new_dataset_gapi, access_policy_version: access_policy_version }
129
129
  end
130
130
 
131
131
  ##
132
132
  # Updates information in an existing dataset, only replacing
133
133
  # fields that are provided in the submitted dataset resource.
134
- def patch_dataset dataset_id, patched_dataset_gapi
134
+ def patch_dataset dataset_id, patched_dataset_gapi, access_policy_version: nil
135
135
  patch_with_backoff = false
136
136
  options = {}
137
137
  if patched_dataset_gapi.etag
@@ -140,7 +140,8 @@ module Google
140
140
  patch_with_backoff = true
141
141
  end
142
142
  execute backoff: patch_with_backoff do
143
- service.patch_dataset @project, dataset_id, patched_dataset_gapi, options: options
143
+ service.patch_dataset @project, dataset_id, patched_dataset_gapi, options: options,
144
+ access_policy_version: access_policy_version
144
145
  end
145
146
  end
146
147
 
@@ -16,7 +16,7 @@
16
16
  module Google
17
17
  module Cloud
18
18
  module Bigquery
19
- VERSION = "1.54.0".freeze
19
+ VERSION = "1.55.0".freeze
20
20
  end
21
21
  end
22
22
  end
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: google-cloud-bigquery
3
3
  version: !ruby/object:Gem::Version
4
- version: 1.54.0
4
+ version: 1.55.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - Mike Moore
@@ -134,6 +134,7 @@ files:
134
134
  - lib/google-cloud-bigquery.rb
135
135
  - lib/google/cloud/bigquery.rb
136
136
  - lib/google/cloud/bigquery/argument.rb
137
+ - lib/google/cloud/bigquery/condition.rb
137
138
  - lib/google/cloud/bigquery/convert.rb
138
139
  - lib/google/cloud/bigquery/copy_job.rb
139
140
  - lib/google/cloud/bigquery/credentials.rb