@deepnote/database-integrations 1.7.1 → 2.1.0

package/dist/index.js

@@ -1,6 +1,6 @@
 import z, { z as z$1 } from "zod";
+import { convertToEnvironmentVariableName, parseYaml } from "@deepnote/blocks";
 import { isMap, isSeq, parseDocument } from "yaml";
-import { parseYaml } from "@deepnote/blocks";
 //#region src/sql-integration-auth-methods.ts
 const AwsAuthMethods = {
 	AccessKeys: "access-keys",
@@ -404,6 +404,73 @@ const databaseIntegrationConfigSchema = z.discriminatedUnion("type", [
 	})
 ]);
 //#endregion
+//#region src/secret-field-paths.ts
+/**
+* All secret fields for each integration type.
+* This includes all possible secret fields regardless of auth method.
+*
+* Note: For integrations with multiple auth methods (e.g., snowflake, bigquery),
+* this includes all secret fields from all auth variants.
+*/
+const SECRET_PATHS = {
+	alloydb: ["password", "caCertificateText"],
+	mariadb: ["password", "caCertificateText"],
+	materialize: ["password", "caCertificateText"],
+	mindsdb: ["password", "caCertificateText"],
+	mysql: ["password", "caCertificateText"],
+	pgsql: ["password", "caCertificateText"],
+	"sql-server": ["password"],
+	clickhouse: ["password", "caCertificateText"],
+	databricks: ["token"],
+	dremio: ["token"],
+	athena: ["secret_access_key"],
+	spanner: ["service_account"],
+	"cloud-sql": ["service_account"],
+	mongodb: [
+		"password",
+		"connection_string",
+		"rawConnectionString",
+		"caCertificateText"
+	],
+	"pandas-dataframe": [],
+	"big-query": ["service_account", "clientSecret"],
+	snowflake: [
+		"password",
+		"clientSecret",
+		"privateKey",
+		"privateKeyPassphrase",
+		"dbtServiceToken"
+	],
+	redshift: ["password", "caCertificateText"],
+	trino: [
+		"password",
+		"clientSecret",
+		"caCertificateText"
+	]
+};
+/**
+* Get the list of secret field paths for a given integration type.
+*
+* @param type - The integration type (e.g., 'pgsql', 'snowflake')
+* @returns Array of field names that contain secrets
+*
+* @example
+* getSecretFieldPaths('pgsql') // => ['password', 'caCertificateText']
+* getSecretFieldPaths('snowflake') // => ['password', 'clientSecret', 'privateKey', 'privateKeyPassphrase', 'dbtServiceToken']
+*/
+function getSecretFieldPaths(type) {
+	return SECRET_PATHS[type] ?? [];
+}
+/**
+* Whether `key` is a secret field of an integration whose `metadata.authMethod` is federated.
+* Such integrations authenticate each user with their own identity, so the value never needs
+* to reach notebook code.
+*/
+function isFederatedAuthSecretField(type, metadata, key) {
+	const { authMethod } = metadata;
+	return typeof authMethod === "string" && isFederatedAuthMethod(authMethod) && getSecretFieldPaths(type).includes(key);
+}
+//#endregion
 //#region src/snowflake-integration-env-vars.ts
 /**
 * Build a URL with path and query parameters using native URL API
@@ -476,7 +543,7 @@ function getEnvironmentVariablesForIntegrations(integrations, params) {
 	integrations.forEach((integration) => {
 		const namePrefix = convertToEnvironmentVariableName(integration.name);
 		const envVarsForThisIntegration = Object.entries(integration.metadata).filter(([key]) => {
-			return key !== "caCertificateText";
+			return key !== "caCertificateText" && !isFederatedAuthSecretField(integration.type, integration.metadata, key);
 		}).map(([key, rawValue]) => {
 			const name = `${namePrefix}_${key.toUpperCase()}`;
 			const value = String(rawValue);
@@ -774,6 +841,21 @@ const getBigQuerySqlAlchemyInput = (metadata) => {
 		throw new BigQueryServiceAccountParseError("Failed to parse bigquery service account, returning empty environment variable.", { cause: error instanceof Error ? error : new Error(String(error)) });
 	}
 };
+/**
+* @returns sql alchemy input for a BigQuery integration authenticated via Google OAuth, given an
+* access token minted by the caller. `user_supplied_client=true` tells the runtime to build its
+* BigQuery client from `access_token` / `project` instead of a service account.
+*/
+function getBigQueryOAuthSqlAlchemyInput(metadata, accessToken) {
+	return {
+		url: "bigquery://?user_supplied_client=true",
+		params: {
+			access_token: accessToken,
+			project: metadata.project
+		},
+		param_style: "pyformat"
+	};
+}
 var SpannerServiceAccountParseError = class extends Error {
 	cause;
 	constructor(message, params) {
@@ -823,9 +905,6 @@ const getMySqlSqlAlchemyInput = (integrationId, projectRootDirectory, { user, pa
 function getCACertificatePath({ projectRoot, integrationId, caCertificateName }) {
 	return `${projectRoot}/.deepnote/${integrationId}/${caCertificateName}`;
 }
-function convertToEnvironmentVariableName(str) {
-	return (/^\d/.test(str) ? `_${str}` : str).toUpperCase().replace(/[^\w]/g, "_");
-}
 function getSqlEnvVarName(integrationId) {
 	return convertToEnvironmentVariableName(`SQL_${integrationId}`);
 }
@@ -994,7 +1073,7 @@ const apiIntegrationSchema = z$1.object({
 	id: z$1.string(),
 	name: z$1.string(),
 	type: z$1.string(),
-	metadata: z$1.unknown(),
+	metadata: z$1.unknown().optional(),
 	is_public: z$1.boolean().nullish(),
 	created_at: z$1.string().nullish(),
 	updated_at: z$1.string().nullish(),
@@ -1103,67 +1182,9 @@ function serializeIntegrationsDocument(doc) {
 *       ...
 * ```
 */
-const baseIntegrationsFileSchema = z$1.object({ integrations: z$1.array(z$1.record(z$1.unknown())).optional().default([]) });
+const baseIntegrationsFileSchema = z$1.object({ integrations: z$1.array(z$1.record(z$1.string(), z$1.unknown())).optional().default([]) });
 const integrationsFileSchema = z$1.object({ integrations: z$1.array(databaseIntegrationConfigSchema) });
 //#endregion
-//#region src/secret-field-paths.ts
-/**
-* All secret fields for each integration type.
-* This includes all possible secret fields regardless of auth method.
-*
-* Note: For integrations with multiple auth methods (e.g., snowflake, bigquery),
-* this includes all secret fields from all auth variants.
-*/
-const SECRET_PATHS = {
-	alloydb: ["password", "caCertificateText"],
-	mariadb: ["password", "caCertificateText"],
-	materialize: ["password", "caCertificateText"],
-	mindsdb: ["password", "caCertificateText"],
-	mysql: ["password", "caCertificateText"],
-	pgsql: ["password", "caCertificateText"],
-	"sql-server": ["password"],
-	clickhouse: ["password", "caCertificateText"],
-	databricks: ["token"],
-	dremio: ["token"],
-	athena: ["secret_access_key"],
-	spanner: ["service_account"],
-	"cloud-sql": ["service_account"],
-	mongodb: [
-		"password",
-		"connection_string",
-		"rawConnectionString",
-		"caCertificateText"
-	],
-	"pandas-dataframe": [],
-	"big-query": ["service_account", "clientSecret"],
-	snowflake: [
-		"password",
-		"clientSecret",
-		"privateKey",
-		"privateKeyPassphrase",
-		"dbtServiceToken"
-	],
-	redshift: ["password", "caCertificateText"],
-	trino: [
-		"password",
-		"clientSecret",
-		"caCertificateText"
-	]
-};
-/**
-* Get the list of secret field paths for a given integration type.
-*
-* @param type - The integration type (e.g., 'pgsql', 'snowflake')
-* @returns Array of field names that contain secrets
-*
-* @example
-* getSecretFieldPaths('pgsql') // => ['password', 'caCertificateText']
-* getSecretFieldPaths('snowflake') // => ['password', 'clientSecret', 'privateKey', 'privateKeyPassphrase', 'dbtServiceToken']
-*/
-function getSecretFieldPaths(type) {
-	return SECRET_PATHS[type] ?? [];
-}
-//#endregion
 //#region src/loading/merge-integrations.ts
 /**
 * JSON schema URL for the integrations file.
@@ -1504,4 +1525,4 @@ function parseIntegrations({ yaml, env = {} }) {
 	};
 }
 //#endregion
-export { ApiError, AwsAuthMethods, BUILTIN_INTEGRATIONS, BigQueryAuthMethods, BigQueryServiceAccountParseError, DEFAULT_API_URL, DEFAULT_ENV_FILE, DEFAULT_INTEGRATIONS_FILE, DatabaseAuthMethods, ENV_VAR_REF_PREFIX, EnvVarResolutionError, IntegrationsYamlParseError, InvalidIntegrationError, InvalidIntegrationsTypeError, JSON_SCHEMA_URL, SCHEMA_COMMENT, SnowflakeAuthMethods, SpannerServiceAccountParseError, TrinoAuthMethods, addIntegrationToSeq, apiIntegrationSchema, apiResponseSchema, baseIntegrationsFileSchema, convertApiIntegrations, createEnvVarRef, createNewDocument, databaseIntegrationConfigSchema, databaseIntegrationTypes, databaseIntegrationTypesWithSslSupport, databaseMetadataSchemasByType, extractEnvVarName, federatedAuthMethods, fetchIntegrations, generateEnvVarName, getEnvironmentVariablesForIntegrations, getOrCreateIntegrationMetadata, getOrCreateIntegrationsFromDocument, getSecretFieldPaths, getSnowflakeFederatedAuthSqlAlchemyInput, getSqlAlchemyInput, getSqlEnvVarName, integrationsFileSchema, isBuiltinIntegration, isDatabaseIntegrationType, isDatabaseIntegrationTypeWithSslSupport, isEnvVarRef, isFederatedAuthMetadata, isFederatedAuthMethod, isSqlIntegrationType, mergeApiIntegrationsIntoDocument, mergeApiIntegrationsIntoYaml, mergeProcessedIntegrations, parseEnvVarRef, parseIntegrations, parseIntegrationsDocument, resolveEnvVarRefsFromMap, serializeIntegrationsDocument, sqlIntegrationTypes, updateIntegrationInDocument, updateIntegrationMetadataMap };
+export { ApiError, AwsAuthMethods, BUILTIN_INTEGRATIONS, BigQueryAuthMethods, BigQueryServiceAccountParseError, DEFAULT_API_URL, DEFAULT_ENV_FILE, DEFAULT_INTEGRATIONS_FILE, DatabaseAuthMethods, ENV_VAR_REF_PREFIX, EnvVarResolutionError, IntegrationsYamlParseError, InvalidIntegrationError, InvalidIntegrationsTypeError, JSON_SCHEMA_URL, SCHEMA_COMMENT, SnowflakeAuthMethods, SpannerServiceAccountParseError, TrinoAuthMethods, addIntegrationToSeq, apiIntegrationSchema, apiResponseSchema, baseIntegrationsFileSchema, convertApiIntegrations, createEnvVarRef, createNewDocument, databaseIntegrationConfigSchema, databaseIntegrationTypes, databaseIntegrationTypesWithSslSupport, databaseMetadataSchemasByType, extractEnvVarName, federatedAuthMethods, fetchIntegrations, generateEnvVarName, getBigQueryOAuthSqlAlchemyInput, getEnvironmentVariablesForIntegrations, getOrCreateIntegrationMetadata, getOrCreateIntegrationsFromDocument, getSecretFieldPaths, getSnowflakeFederatedAuthSqlAlchemyInput, getSqlAlchemyInput, getSqlEnvVarName, integrationsFileSchema, isBuiltinIntegration, isDatabaseIntegrationType, isDatabaseIntegrationTypeWithSslSupport, isEnvVarRef, isFederatedAuthMetadata, isFederatedAuthMethod, isFederatedAuthSecretField, isSqlIntegrationType, mergeApiIntegrationsIntoDocument, mergeApiIntegrationsIntoYaml, mergeProcessedIntegrations, parseEnvVarRef, parseIntegrations, parseIntegrationsDocument, resolveEnvVarRefsFromMap, serializeIntegrationsDocument, sqlIntegrationTypes, updateIntegrationInDocument, updateIntegrationMetadataMap };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deepnote/database-integrations",
-  "version": "1.7.1",
+  "version": "2.1.0",
   "description": "Deepnote database integration definitions",
   "keywords": [],
   "repository": {
@@ -28,8 +28,8 @@
   ],
   "dependencies": {
     "yaml": "^2.9.0",
-    "zod": "3.25.76",
-    "@deepnote/blocks": "4.8.1"
+    "zod": "^4.6.7",
+    "@deepnote/blocks": "5.0.0"
   },
   "publishConfig": {
     "access": "public",