@deepnote/database-integrations 1.7.1 → 2.1.0

package/dist/index.cjs

@@ -23,8 +23,8 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 //#endregion
 let zod = require("zod");
 zod = __toESM(zod, 1);
-let yaml = require("yaml");
 let _deepnote_blocks = require("@deepnote/blocks");
+let yaml = require("yaml");
 //#region src/sql-integration-auth-methods.ts
 const AwsAuthMethods = {
 	AccessKeys: "access-keys",
@@ -428,6 +428,73 @@ const databaseIntegrationConfigSchema = zod.default.discriminatedUnion("type", [
 	})
 ]);
 //#endregion
+//#region src/secret-field-paths.ts
+/**
+* All secret fields for each integration type.
+* This includes all possible secret fields regardless of auth method.
+*
+* Note: For integrations with multiple auth methods (e.g., snowflake, bigquery),
+* this includes all secret fields from all auth variants.
+*/
+const SECRET_PATHS = {
+	alloydb: ["password", "caCertificateText"],
+	mariadb: ["password", "caCertificateText"],
+	materialize: ["password", "caCertificateText"],
+	mindsdb: ["password", "caCertificateText"],
+	mysql: ["password", "caCertificateText"],
+	pgsql: ["password", "caCertificateText"],
+	"sql-server": ["password"],
+	clickhouse: ["password", "caCertificateText"],
+	databricks: ["token"],
+	dremio: ["token"],
+	athena: ["secret_access_key"],
+	spanner: ["service_account"],
+	"cloud-sql": ["service_account"],
+	mongodb: [
+		"password",
+		"connection_string",
+		"rawConnectionString",
+		"caCertificateText"
+	],
+	"pandas-dataframe": [],
+	"big-query": ["service_account", "clientSecret"],
+	snowflake: [
+		"password",
+		"clientSecret",
+		"privateKey",
+		"privateKeyPassphrase",
+		"dbtServiceToken"
+	],
+	redshift: ["password", "caCertificateText"],
+	trino: [
+		"password",
+		"clientSecret",
+		"caCertificateText"
+	]
+};
+/**
+* Get the list of secret field paths for a given integration type.
+*
+* @param type - The integration type (e.g., 'pgsql', 'snowflake')
+* @returns Array of field names that contain secrets
+*
+* @example
+* getSecretFieldPaths('pgsql') // => ['password', 'caCertificateText']
+* getSecretFieldPaths('snowflake') // => ['password', 'clientSecret', 'privateKey', 'privateKeyPassphrase', 'dbtServiceToken']
+*/
+function getSecretFieldPaths(type) {
+	return SECRET_PATHS[type] ?? [];
+}
+/**
+* Whether `key` is a secret field of an integration whose `metadata.authMethod` is federated.
+* Such integrations authenticate each user with their own identity, so the value never needs
+* to reach notebook code.
+*/
+function isFederatedAuthSecretField(type, metadata, key) {
+	const { authMethod } = metadata;
+	return typeof authMethod === "string" && isFederatedAuthMethod(authMethod) && getSecretFieldPaths(type).includes(key);
+}
+//#endregion
 //#region src/snowflake-integration-env-vars.ts
 /**
 * Build a URL with path and query parameters using native URL API
@@ -498,9 +565,9 @@ function getEnvironmentVariablesForIntegrations(integrations, params) {
 	const envVars = [];
 	const errors = [];
 	integrations.forEach((integration) => {
-		const namePrefix = convertToEnvironmentVariableName(integration.name);
+		const namePrefix = (0, _deepnote_blocks.convertToEnvironmentVariableName)(integration.name);
 		const envVarsForThisIntegration = Object.entries(integration.metadata).filter(([key]) => {
-			return key !== "caCertificateText";
+			return key !== "caCertificateText" && !isFederatedAuthSecretField(integration.type, integration.metadata, key);
 		}).map(([key, rawValue]) => {
 			const name = `${namePrefix}_${key.toUpperCase()}`;
 			const value = String(rawValue);
@@ -798,6 +865,21 @@ const getBigQuerySqlAlchemyInput = (metadata) => {
 		throw new BigQueryServiceAccountParseError("Failed to parse bigquery service account, returning empty environment variable.", { cause: error instanceof Error ? error : new Error(String(error)) });
 	}
 };
+/**
+* @returns sql alchemy input for a BigQuery integration authenticated via Google OAuth, given an
+* access token minted by the caller. `user_supplied_client=true` tells the runtime to build its
+* BigQuery client from `access_token` / `project` instead of a service account.
+*/
+function getBigQueryOAuthSqlAlchemyInput(metadata, accessToken) {
+	return {
+		url: "bigquery://?user_supplied_client=true",
+		params: {
+			access_token: accessToken,
+			project: metadata.project
+		},
+		param_style: "pyformat"
+	};
+}
 var SpannerServiceAccountParseError = class extends Error {
 	cause;
 	constructor(message, params) {
@@ -847,11 +929,8 @@ const getMySqlSqlAlchemyInput = (integrationId, projectRootDirectory, { user, pa
 function getCACertificatePath({ projectRoot, integrationId, caCertificateName }) {
 	return `${projectRoot}/.deepnote/${integrationId}/${caCertificateName}`;
 }
-function convertToEnvironmentVariableName(str) {
-	return (/^\d/.test(str) ? `_${str}` : str).toUpperCase().replace(/[^\w]/g, "_");
-}
 function getSqlEnvVarName(integrationId) {
-	return convertToEnvironmentVariableName(`SQL_${integrationId}`);
+	return (0, _deepnote_blocks.convertToEnvironmentVariableName)(`SQL_${integrationId}`);
 }
 function assertNever(value) {
 	throw new Error(`Unexpected value: ${value}`);
@@ -1018,7 +1097,7 @@ const apiIntegrationSchema = zod.z.object({
 	id: zod.z.string(),
 	name: zod.z.string(),
 	type: zod.z.string(),
-	metadata: zod.z.unknown(),
+	metadata: zod.z.unknown().optional(),
 	is_public: zod.z.boolean().nullish(),
 	created_at: zod.z.string().nullish(),
 	updated_at: zod.z.string().nullish(),
@@ -1127,67 +1206,9 @@ function serializeIntegrationsDocument(doc) {
 *       ...
 * ```
 */
-const baseIntegrationsFileSchema = zod.z.object({ integrations: zod.z.array(zod.z.record(zod.z.unknown())).optional().default([]) });
+const baseIntegrationsFileSchema = zod.z.object({ integrations: zod.z.array(zod.z.record(zod.z.string(), zod.z.unknown())).optional().default([]) });
 const integrationsFileSchema = zod.z.object({ integrations: zod.z.array(databaseIntegrationConfigSchema) });
 //#endregion
-//#region src/secret-field-paths.ts
-/**
-* All secret fields for each integration type.
-* This includes all possible secret fields regardless of auth method.
-*
-* Note: For integrations with multiple auth methods (e.g., snowflake, bigquery),
-* this includes all secret fields from all auth variants.
-*/
-const SECRET_PATHS = {
-	alloydb: ["password", "caCertificateText"],
-	mariadb: ["password", "caCertificateText"],
-	materialize: ["password", "caCertificateText"],
-	mindsdb: ["password", "caCertificateText"],
-	mysql: ["password", "caCertificateText"],
-	pgsql: ["password", "caCertificateText"],
-	"sql-server": ["password"],
-	clickhouse: ["password", "caCertificateText"],
-	databricks: ["token"],
-	dremio: ["token"],
-	athena: ["secret_access_key"],
-	spanner: ["service_account"],
-	"cloud-sql": ["service_account"],
-	mongodb: [
-		"password",
-		"connection_string",
-		"rawConnectionString",
-		"caCertificateText"
-	],
-	"pandas-dataframe": [],
-	"big-query": ["service_account", "clientSecret"],
-	snowflake: [
-		"password",
-		"clientSecret",
-		"privateKey",
-		"privateKeyPassphrase",
-		"dbtServiceToken"
-	],
-	redshift: ["password", "caCertificateText"],
-	trino: [
-		"password",
-		"clientSecret",
-		"caCertificateText"
-	]
-};
-/**
-* Get the list of secret field paths for a given integration type.
-*
-* @param type - The integration type (e.g., 'pgsql', 'snowflake')
-* @returns Array of field names that contain secrets
-*
-* @example
-* getSecretFieldPaths('pgsql') // => ['password', 'caCertificateText']
-* getSecretFieldPaths('snowflake') // => ['password', 'clientSecret', 'privateKey', 'privateKeyPassphrase', 'dbtServiceToken']
-*/
-function getSecretFieldPaths(type) {
-	return SECRET_PATHS[type] ?? [];
-}
-//#endregion
 //#region src/loading/merge-integrations.ts
 /**
 * JSON schema URL for the integrations file.
@@ -1562,6 +1583,7 @@ exports.extractEnvVarName = extractEnvVarName;
 exports.federatedAuthMethods = federatedAuthMethods;
 exports.fetchIntegrations = fetchIntegrations;
 exports.generateEnvVarName = generateEnvVarName;
+exports.getBigQueryOAuthSqlAlchemyInput = getBigQueryOAuthSqlAlchemyInput;
 exports.getEnvironmentVariablesForIntegrations = getEnvironmentVariablesForIntegrations;
 exports.getOrCreateIntegrationMetadata = getOrCreateIntegrationMetadata;
 exports.getOrCreateIntegrationsFromDocument = getOrCreateIntegrationsFromDocument;
@@ -1576,6 +1598,7 @@ exports.isDatabaseIntegrationTypeWithSslSupport = isDatabaseIntegrationTypeWithS
 exports.isEnvVarRef = isEnvVarRef;
 exports.isFederatedAuthMetadata = isFederatedAuthMetadata;
 exports.isFederatedAuthMethod = isFederatedAuthMethod;
+exports.isFederatedAuthSecretField = isFederatedAuthSecretField;
 exports.isSqlIntegrationType = isSqlIntegrationType;
 exports.mergeApiIntegrationsIntoDocument = mergeApiIntegrationsIntoDocument;
 exports.mergeApiIntegrationsIntoYaml = mergeApiIntegrationsIntoYaml;