@dalgo/bigquery 0.2.0 → 0.3.1

package/README.md

@@ -179,6 +179,18 @@ Cancellation consent uses `googleAuthorizationScopes({ cancellation: true })`;
 it grants the broader BigQuery scope and requires an explicit product action.
 OAuth client setup and deployed-origin/CORS acceptance remain required.
 
+For a metadata pilot requiring only `openid` and BigQuery read-only, construct
+`new GoogleTokenIdentityProvider({ scopePolicy: "exact-readonly" })`. This opt-in
+rejects missing or extra grants (including email, writable BigQuery and
+cloud-platform) from the actual GIS callback before identity requests, and
+invalidates any earlier authorization. Pass `googleAuthorizationScopes()` and
+`include_granted_scopes: false` to GIS `initTokenClient`; never replace callback
+scope metadata with the requested scopes. The default `"compatible"` policy
+preserves the optional email and cancellation behavior above. Exact-scope mode
+retains the same-token UserInfo check, memory-only token and explicit expiry
+handling; client registration and a live browser acceptance receipt are separate.
+
+
 Google's [token model](https://developers.google.com/identity/oauth2/web/guides/use-token-model)
 defines user-triggered consent and expiry recovery; its [discovery document](https://accounts.google.com/.well-known/openid-configuration)
 pins the UserInfo endpoint used here.

package/dist/analytical/google-identity.d.ts

@@ -25,6 +25,8 @@ export interface GoogleIdentityConfig {
     readonly fetch?: SafeFetch;
     readonly now?: () => number;
     readonly timeoutMs?: number;
+    /** Metadata pilots may accept only the exact openid + BigQuery readonly grant set. */
+    readonly scopePolicy?: "compatible" | "exact-readonly";
 }
 /** Memory-only GIS token provider. It never prompts, refreshes, links Firebase
  * accounts or chooses a project. Connect only from the real GIS callback; call

package/dist/analytical/google-identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"google-identity.d.ts","sourceRoot":"","sources":["../../src/analytical/google-identity.ts"],"names":[],"mappings":"AACA,OAAO,EAAyB,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAa,KAAK,gBAAgB,EAAE,KAAK,SAAS,EAAE,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAQxG,wFAAwF;AACxF,wBAAgB,yBAAyB,CAAC,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,MAAM,CAE3G;AAED,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AACD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,iFAAiF;IACjF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AACD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,qBAAa,2BAA4B,YAAW,gBAAgB;;gBAO/C,MAAM,GAAE,oBAAyB;IAM7C,UAAU,IAAI,IAAI;IAMZ,OAAO,CAAC,QAAQ,EAAE,mBAAmB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAkF5F,SAAS,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC;CAOtE"}
+{"version":3,"file":"google-identity.d.ts","sourceRoot":"","sources":["../../src/analytical/google-identity.ts"],"names":[],"mappings":"AACA,OAAO,EAAyB,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAa,KAAK,gBAAgB,EAAE,KAAK,SAAS,EAAE,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAQxG,wFAAwF;AACxF,wBAAgB,yBAAyB,CAAC,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,MAAM,CAE3G;AAED,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AACD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,iFAAiF;IACjF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AACD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,sFAAsF;IACtF,QAAQ,CAAC,WAAW,CAAC,EAAE,YAAY,GAAG,gBAAgB,CAAC;CACxD;AAED;;;GAGG;AACH,qBAAa,2BAA4B,YAAW,gBAAgB;;gBAQ/C,MAAM,GAAE,oBAAyB;IAQ7C,UAAU,IAAI,IAAI;IAMZ,OAAO,CAAC,QAAQ,EAAE,mBAAmB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAoF5F,SAAS,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC;CAOtE"}

package/dist/analytical/google-identity.js

@@ -19,6 +19,7 @@ export class GoogleTokenIdentityProvider {
     #fetch;
     #now;
     #timeout;
+    #scopePolicy;
     #revision = 0;
     #identity;
     #pending;
@@ -26,6 +27,9 @@ export class GoogleTokenIdentityProvider {
         this.#fetch = config.fetch ?? ((url, init) => globalThis.fetch(url, init));
         this.#now = config.now ?? Date.now;
         this.#timeout = config.timeoutMs ?? 15000;
+        this.#scopePolicy = config.scopePolicy ?? "compatible";
+        if (this.#scopePolicy !== "compatible" && this.#scopePolicy !== "exact-readonly")
+            fail("invalid_input");
         if (!Number.isSafeInteger(this.#timeout) || this.#timeout < 1 || this.#timeout > 15000)
             fail("invalid_input");
     }
@@ -58,6 +62,9 @@ export class GoogleTokenIdentityProvider {
         const grants = new Set(response.scope.split(/\s+/u));
         if (!grants.has("openid") || !(grants.has(readonlyScope) || grants.has(cancelScope)))
             fail("scope_missing");
+        if (this.#scopePolicy === "exact-readonly" &&
+            (grants.size !== 2 || !grants.has(readonlyScope)))
+            fail("scope_missing");
         const controller = new AbortController();
         this.#pending = controller;
         const abort = () => controller.abort();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dalgo/bigquery",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "description": "BigQuery REST API adapter for DALgo TypeScript",
   "type": "module",
   "packageManager": "pnpm@11.20.0",
@@ -56,5 +56,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "7835008eb5272cba89f8c547e77f6bcd32354ea1"
+  "gitHead": "27aa1d2010b2efff50f1ae7f7151bdbdf76b5bf1"
 }