google-cloud-bigtable 2.12.0 → 2.12.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d532accadd2ab9206259a83bc75b52a460d8e15e2253c81ee9f7124fdefbfa83
-  data.tar.gz: d1bee0fb74cf2522095176d827323731d347e6a60575f3b2beb1f664879aa616
+  metadata.gz: 95305d13ed4a835f5f0568999568f9b7ffb0034776d9fd626bf9df8dc00ae241
+  data.tar.gz: 97be595610413344edd7b183dc30d79e08139d785578a6aa643a8a27c9078b29
 SHA512:
-  metadata.gz: 3c7164cb81c2f57bbfadb426cc1038fe1fe817cb102e6305e468c41034e0f081e4e13183c6490b49c93203b8390b4415e8288e84a3c2a330beb2a0f4b80b0fae
-  data.tar.gz: e8c61bb38bc9a0297cbf2954323239bd4ebd95a4578627b1a1707683b7e40b35e50bfd3e5f2dd8d90389330cad1562e88cd0de946006a71500db0060d4d00143
+  metadata.gz: d7e0b410f8cc24923495e7b6fdf754f353139228fbd79b121ba5f92da514b10388c9debe69b82aea68a2572612a5ad3a3bb8627dbb873e8176ab681de3e98fc2
+  data.tar.gz: 5f5cbc2a3e60ae44725321079ae07028c1932ca8847b19b0715429adf8158c3f294cf0236d94bcac7629c70ed36ab06508d48ce3963f0bad674f5d845251ae43

data/AUTHENTICATION.md

@@ -46,6 +46,12 @@ code.
 
 **Credentials** are discovered in the following order:
 
+> [!WARNING]
+> If you accept a credential configuration (JSON file or Hash) from an
+> external source for authentication to Google Cloud, you must validate it before
+> providing it to a Google API client library. Providing an unvalidated credential
+> configuration to Google APIs can compromise the security of your systems and data.
+
 1. Specify credentials in method arguments
 2. Specify credentials in configuration
 3. Discover credentials path in environment variables
@@ -99,11 +105,16 @@ The **Project ID** and the path to the **Credentials JSON** file can be configur
 instead of placing them in environment variables or providing them as arguments.
 
 ```ruby
+require "googleauth"
 require "google/cloud/bigtable"
 
+credentials = ::Google::Auth::ServiceAccountCredentials.make_creds(
+  json_key_io: ::File.open("/path/to/keyfile.json")
+)
+
 Google::Cloud::Bigtable.configure do |config|
   config.project_id  = "my-project-id"
-  config.credentials = "path/to/keyfile.json"
+  config.credentials = credentials
 end
 
 client = Google::Cloud::Bigtable.new

data/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Release History
 
+### 2.12.2 (2025-11-04)
+
+#### Documentation
+
+* add warning about loading unvalidated credentials ([#32121](https://github.com/googleapis/google-cloud-ruby/issues/32121)) 
+
+### 2.12.1 (2025-08-12)
+
+#### Bug Fixes
+
+* Fix mutate rows logic to handle errors ([#30766](https://github.com/googleapis/google-cloud-ruby/issues/30766)) 
+
 ### 2.12.0 (2025-02-25)
 
 #### Features

data/lib/google/cloud/bigtable/chunk_processor.rb

@@ -94,12 +94,23 @@ module Google
         #   or if family name or column qualifier are empty
         #
         def validate_new_row
-          raise_if row.key, "A new row cannot have existing state"
-          raise_if chunk.row_key.empty?, "A row key must be set"
-          raise_if chunk.reset_row, "A new row cannot be reset"
-          raise_if last_key == chunk.row_key, "A commit happened but the same key followed"
-          raise_if chunk.family_name.nil?, "A family must be set"
-          raise_if chunk.qualifier.nil?, "A column qualifier must be set"
+          validations = [
+            [row.key, "A new row cannot have existing state"],
+            [chunk.row_key.empty?, "A row key must be set"],
+            [chunk.reset_row, "A new row cannot be reset"],
+            [last_key == chunk.row_key, "A commit happened but the same key followed"],
+            [
+              last_key && chunk.row_key < last_key,
+              "Out of order row key, must be strictly increasing. " \
+              "New key: '#{chunk.row_key}', Previous key: '#{last_key}'"
+            ],
+            [chunk.family_name.nil?, "A family must be set"],
+            [chunk.qualifier.nil?, "A column qualifier must be set"]
+          ]
+
+          validations.each do |condition, message|
+            raise_if condition, message
+          end
         end
 
         ##

data/lib/google/cloud/bigtable/rows_mutator.rb

@@ -39,6 +39,10 @@ module Google
         RETRY_LIMIT = 3
 
         # @private
+        # The prefix for routing cookies. Used to dynamically find cookie
+        # headers in metadata.
+        COOKIE_KEY_PREFIX = "x-goog-cbt-cookie"
+
         #
         # Creates a mutate rows instance.
         #
@@ -57,18 +61,20 @@ module Google
         #
         def apply_mutations
           @req_entries = @entries.map(&:to_grpc)
-          statuses = mutate_rows @req_entries
+          statuses, delay, cookies = mutate_rows @req_entries
 
-          # Collects retryable mutations indices.
           indices = statuses.each_with_object [] do |e, r|
             r << e.index if @entries[e.index].retryable? && RETRYABLE_CODES[e.status.code]
           end
 
           return statuses if indices.empty?
 
-          (RETRY_LIMIT - 1).times do
+          RETRY_LIMIT.times do
             break if indices.empty?
-            indices = retry_entries statuses, indices
+
+            sleep delay if delay
+
+            indices, delay, cookies = retry_entries statuses, indices, cookies
           end
 
           statuses
@@ -80,13 +86,35 @@ module Google
         # Mutates rows.
         #
         # @param entries [Array<Google::Cloud::Bigtable::MutationEntry>]
-        # @return [Array<Google::Cloud::Bigtable::V2::MutateRowsResponse::Entry>]
+        # @param cookies [Hash]
+        # @return [Array<Google::Cloud::Bigtable::V2::MutateRowsResponse::Entry>, Float|nil, Hash]
         #
-        def mutate_rows entries
-          response = @table.service.mutate_rows @table.path, entries, app_profile_id: @table.app_profile_id
-          response.each_with_object [] do |res, statuses|
-            statuses.concat res.entries
+        def mutate_rows entries, cookies = {}
+          call_options = Gapic::CallOptions.new(metadata: cookies) unless cookies.empty?
+
+          response = @table.service.mutate_rows(
+            @table.path,
+            entries,
+            app_profile_id: @table.app_profile_id,
+            call_options: call_options
+          )
+          [response.flat_map(&:entries), nil, cookies]
+        rescue GRPC::BadStatus => e
+          info = e.status_details.find { |d| d.is_a? Google::Rpc::RetryInfo }
+          delay = if info&.retry_delay
+                    info.retry_delay.seconds + (info.retry_delay.nanos / 1_000_000_000.0)
+                  end
+
+          cookies.merge!(e.metadata.select { |k, _| k.start_with? COOKIE_KEY_PREFIX })
+
+          status = Google::Rpc::Status.new code: e.code, message: e.message
+          statuses = entries.map.with_index do |_, i|
+            Google::Cloud::Bigtable::V2::MutateRowsResponse::Entry.new(
+              index: i,
+              status: status
+            )
           end
+          [statuses, delay, cookies]
         end
 
         ##
@@ -94,18 +122,19 @@ module Google
         #
         # @param statuses [Array<Google::Cloud::Bigtable::V2::MutateRowsResponse::Entry>]
         # @param indices [Array<Integer>]
-        #   Retry entries position mapping list
-        # @return [Array<Integer>]
-        #   New list of failed entries positions
+        # @param cookies [Hash]
+        # @return [Array<Integer>, Float|nil, Hash]
         #
-        def retry_entries statuses, indices
+        def retry_entries statuses, indices, cookies
           entries = indices.map { |i| @req_entries[i] }
-          retry_statuses = mutate_rows entries
+          retry_statuses, delay, cookies = mutate_rows entries, cookies
 
-          retry_statuses.each_with_object [] do |e, next_indices|
-            next_indices << indices[e.index] if RETRYABLE_CODES[e.status.code]
-            statuses[indices[e.index]].status = e.status
+          next_indices = retry_statuses.each_with_object [] do |e, list|
+            next_index = indices[e.index]
+            statuses[next_index].status = e.status
+            list << next_index if RETRYABLE_CODES[e.status.code]
           end
+          [next_indices, delay, cookies]
         end
       end
     end

data/lib/google/cloud/bigtable/rows_reader.rb

@@ -92,6 +92,10 @@ module Google
               yield row
               @rows_count += 1
             end
+
+            if res.last_scanned_row_key && !res.last_scanned_row_key.empty?
+              @chunk_processor.last_key = res.last_scanned_row_key
+            end
           end
 
           @chunk_processor.validate_last_row_complete

data/lib/google/cloud/bigtable/service.rb

@@ -689,14 +689,13 @@ module Google
           )
         end
 
-        def mutate_rows table_name, entries, app_profile_id: nil
-          client(table_name, app_profile_id).mutate_rows(
-            **{
-              table_name:     table_name,
-              app_profile_id: app_profile_id,
-              entries:        entries
-            }.compact
-          )
+        def mutate_rows table_name, entries, app_profile_id: nil, call_options: nil
+          request = {
+            table_name:     table_name,
+            app_profile_id: app_profile_id,
+            entries:        entries
+          }.compact
+          client(table_name, app_profile_id).mutate_rows request, call_options
         end
 
         def check_and_mutate_row table_name,

data/lib/google/cloud/bigtable/version.rb

@@ -16,7 +16,7 @@
 module Google
   module Cloud
     module Bigtable
-      VERSION = "2.12.0".freeze
+      VERSION = "2.12.2".freeze
     end
   end
 end

data/lib/google/cloud/bigtable.rb

@@ -43,15 +43,14 @@ module Google
       #   be one of the following types:
       #   `Google::Auth::Credentials` uses the properties of its represented keyfile for
       #   authenticating requests made by this client.
-      #   `String` will be treated as the path to the keyfile to use to construct
-      #   credentials for this client.
-      #   `Hash` will be treated as the contents of a keyfile to use to construct
-      #   credentials for this client.
       #   `GRPC::Core::Channel` will be used to make calls through.
       #   `GRPC::Core::ChannelCredentials` for the setting up the gRPC client. The channel credentials
       #   should already be composed with a `GRPC::Core::CallCredentials` object.
       #   `Proc` will be used as an updater_proc for the gRPC channel. The proc transforms the
       #   metadata for requests, generally, to give OAuth credentials.
+      #   @note Warning: Passing a `String` to a keyfile path or a `Hash` of credentials
+      #     is deprecated. Providing an unvalidated credential configuration to
+      #     Google APIs can compromise the security of your systems and data.
       # @param universe_domain [String] Override of the universe domain. Optional.
       # @param endpoint [String] Override of the endpoint host name. Optional.
       #   If the param is nil, uses the default endpoint.

data/lib/google-cloud-bigtable.rb

@@ -40,29 +40,33 @@ module Google
     #   updater_proc is supplied.
     # @param timeout [Integer]
     #   The default timeout, in seconds, for calls made through this client.
-    # @param credentials [Google::Auth::Credentials, String, Hash, GRPC::Core::Channel,
+    # @param credentials [Google::Auth::Credentials, GRPC::Core::Channel,
     #   GRPC::Core::ChannelCredentials, Proc]
-    #   Provides the means for authenticating requests made by the client. This parameter can
+    #   The means for authenticating requests made by the client. This parameter can
     #   be one of the following types.
     #   `Google::Auth::Credentials` uses the properties of its represented keyfile for
     #   authenticating requests made by this client.
-    #   `String` will be treated as the path to the keyfile to use to construct
-    #   credentials for this client.
-    #   `Hash` will be treated as the contents of a keyfile to use to construct
-    #   credentials for this client.
     #   `GRPC::Core::Channel` will be used to make calls through.
     #   `GRPC::Core::ChannelCredentials` will be used to set up the gRPC client. The channel credentials
     #   should already be composed with a `GRPC::Core::CallCredentials` object.
     #   `Proc` will be used as an updater_proc for the gRPC channel. The proc transforms the
     #   metadata for requests, generally, to give OAuth credentials.
-    # @return [Google::Cloud::Bigtable::Project]
+    #   @note Warning: Passing a `String` to a keyfile path or a `Hash` of credentials
+    #     is deprecated. Providing an unvalidated credential configuration to
+    #     Google APIs can compromise the security of your systems and data.
     #
-    # @example
-    #   require "google/cloud/bigtable"
+    #   @example
+    #
+    #     # The recommended way to provide credentials is to use the `make_creds` method
+    #     # on the appropriate credentials class for your environment.
+    #
+    #     credentials = ::Google::Auth::ServiceAccountCredentials.make_creds(
+    #       json_key_io: ::File.open("/path/to/keyfile.json")
+    #     )
     #
-    #   gcloud  = Google::Cloud.new
+    #     gcloud = Google::Cloud.new
     #
-    #   bigtable = gcloud.bigtable
+    #     bigtable = gcloud.bigtable credentials: credentials
     #
     def bigtable scope: nil, timeout: nil, credentials: nil
       credentials ||= @keyfile
@@ -83,21 +87,32 @@ module Google
     #   Project identifier for the Bigtable service you
     #   are connecting to. If not present, the default project for the
     #   credentials is used.
-    # @param credentials [Google::Auth::Credentials, String, Hash, GRPC::Core::Channel,
+    # @param credentials [Google::Auth::Credentials, GRPC::Core::Channel,
     #   GRPC::Core::ChannelCredentials, Proc]
     #   The means for authenticating requests made by the client. This parameter can
     #   be one of the following types.
     #   `Google::Auth::Credentials` uses the properties of its represented keyfile for
     #   authenticating requests made by this client.
-    #   `String` will be treated as the path to the keyfile to use to construct
-    #   credentials for this client.
-    #   `Hash` will be treated as the contents of a keyfile to use to construct
-    #   credentials for this client.
     #   `GRPC::Core::Channel` will be used to make calls through.
     #   `GRPC::Core::ChannelCredentials` will be used to set up the gRPC client. The channel credentials
     #   should already be composed with a `GRPC::Core::CallCredentials` object.
     #   `Proc` will be used as an updater_proc for the gRPC channel. The proc transforms the
     #   metadata for requests, generally, to give OAuth credentials.
+    #   @note Warning: Passing a `String` to a keyfile path or a `Hash` of credentials
+    #     is deprecated. Providing an unvalidated credential configuration to
+    #     Google APIs can compromise the security of your systems and data.
+    #
+    #   @example
+    #
+    #     # The recommended way to provide credentials is to use the `make_creds` method
+    #     # on the appropriate credentials class for your environment.
+    #
+    #     credentials = ::Google::Auth::ServiceAccountCredentials.make_creds(
+    #       json_key_io: ::File.open("/path/to/keyfile.json")
+    #     )
+    #
+    #     client = Google::Cloud.bigtable credentials: credentials
+    #
     # @param scope [Array<String>]
     #   The OAuth 2.0 scopes controlling the set of resources and operations
     #   that the connection can access. See [Using OAuth 2.0 to Access Google

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: google-cloud-bigtable
 version: !ruby/object:Gem::Version
-  version: 2.12.0
+  version: 2.12.2
 platform: ruby
 authors:
 - Google LLC
 bindir: bin
 cert_chain: []
-date: 2025-02-25 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby
@@ -149,7 +149,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.5
+rubygems_version: 3.6.9
 specification_version: 4
 summary: API Client library for Cloud Bigtable API
 test_files: []