@deepnote/database-integrations 2.0.0 → 2.1.0

package/dist/index.cjs

@@ -428,6 +428,73 @@ const databaseIntegrationConfigSchema = zod.default.discriminatedUnion("type", [
 	})
 ]);
 //#endregion
+//#region src/secret-field-paths.ts
+/**
+* All secret fields for each integration type.
+* This includes all possible secret fields regardless of auth method.
+*
+* Note: For integrations with multiple auth methods (e.g., snowflake, bigquery),
+* this includes all secret fields from all auth variants.
+*/
+const SECRET_PATHS = {
+	alloydb: ["password", "caCertificateText"],
+	mariadb: ["password", "caCertificateText"],
+	materialize: ["password", "caCertificateText"],
+	mindsdb: ["password", "caCertificateText"],
+	mysql: ["password", "caCertificateText"],
+	pgsql: ["password", "caCertificateText"],
+	"sql-server": ["password"],
+	clickhouse: ["password", "caCertificateText"],
+	databricks: ["token"],
+	dremio: ["token"],
+	athena: ["secret_access_key"],
+	spanner: ["service_account"],
+	"cloud-sql": ["service_account"],
+	mongodb: [
+		"password",
+		"connection_string",
+		"rawConnectionString",
+		"caCertificateText"
+	],
+	"pandas-dataframe": [],
+	"big-query": ["service_account", "clientSecret"],
+	snowflake: [
+		"password",
+		"clientSecret",
+		"privateKey",
+		"privateKeyPassphrase",
+		"dbtServiceToken"
+	],
+	redshift: ["password", "caCertificateText"],
+	trino: [
+		"password",
+		"clientSecret",
+		"caCertificateText"
+	]
+};
+/**
+* Get the list of secret field paths for a given integration type.
+*
+* @param type - The integration type (e.g., 'pgsql', 'snowflake')
+* @returns Array of field names that contain secrets
+*
+* @example
+* getSecretFieldPaths('pgsql') // => ['password', 'caCertificateText']
+* getSecretFieldPaths('snowflake') // => ['password', 'clientSecret', 'privateKey', 'privateKeyPassphrase', 'dbtServiceToken']
+*/
+function getSecretFieldPaths(type) {
+	return SECRET_PATHS[type] ?? [];
+}
+/**
+* Whether `key` is a secret field of an integration whose `metadata.authMethod` is federated.
+* Such integrations authenticate each user with their own identity, so the value never needs
+* to reach notebook code.
+*/
+function isFederatedAuthSecretField(type, metadata, key) {
+	const { authMethod } = metadata;
+	return typeof authMethod === "string" && isFederatedAuthMethod(authMethod) && getSecretFieldPaths(type).includes(key);
+}
+//#endregion
 //#region src/snowflake-integration-env-vars.ts
 /**
 * Build a URL with path and query parameters using native URL API
@@ -500,7 +567,7 @@ function getEnvironmentVariablesForIntegrations(integrations, params) {
 	integrations.forEach((integration) => {
 		const namePrefix = (0, _deepnote_blocks.convertToEnvironmentVariableName)(integration.name);
 		const envVarsForThisIntegration = Object.entries(integration.metadata).filter(([key]) => {
-			return key !== "caCertificateText";
+			return key !== "caCertificateText" && !isFederatedAuthSecretField(integration.type, integration.metadata, key);
 		}).map(([key, rawValue]) => {
 			const name = `${namePrefix}_${key.toUpperCase()}`;
 			const value = String(rawValue);
@@ -798,6 +865,21 @@ const getBigQuerySqlAlchemyInput = (metadata) => {
 		throw new BigQueryServiceAccountParseError("Failed to parse bigquery service account, returning empty environment variable.", { cause: error instanceof Error ? error : new Error(String(error)) });
 	}
 };
+/**
+* @returns sql alchemy input for a BigQuery integration authenticated via Google OAuth, given an
+* access token minted by the caller. `user_supplied_client=true` tells the runtime to build its
+* BigQuery client from `access_token` / `project` instead of a service account.
+*/
+function getBigQueryOAuthSqlAlchemyInput(metadata, accessToken) {
+	return {
+		url: "bigquery://?user_supplied_client=true",
+		params: {
+			access_token: accessToken,
+			project: metadata.project
+		},
+		param_style: "pyformat"
+	};
+}
 var SpannerServiceAccountParseError = class extends Error {
 	cause;
 	constructor(message, params) {
@@ -1127,64 +1209,6 @@ function serializeIntegrationsDocument(doc) {
 const baseIntegrationsFileSchema = zod.z.object({ integrations: zod.z.array(zod.z.record(zod.z.string(), zod.z.unknown())).optional().default([]) });
 const integrationsFileSchema = zod.z.object({ integrations: zod.z.array(databaseIntegrationConfigSchema) });
 //#endregion
-//#region src/secret-field-paths.ts
-/**
-* All secret fields for each integration type.
-* This includes all possible secret fields regardless of auth method.
-*
-* Note: For integrations with multiple auth methods (e.g., snowflake, bigquery),
-* this includes all secret fields from all auth variants.
-*/
-const SECRET_PATHS = {
-	alloydb: ["password", "caCertificateText"],
-	mariadb: ["password", "caCertificateText"],
-	materialize: ["password", "caCertificateText"],
-	mindsdb: ["password", "caCertificateText"],
-	mysql: ["password", "caCertificateText"],
-	pgsql: ["password", "caCertificateText"],
-	"sql-server": ["password"],
-	clickhouse: ["password", "caCertificateText"],
-	databricks: ["token"],
-	dremio: ["token"],
-	athena: ["secret_access_key"],
-	spanner: ["service_account"],
-	"cloud-sql": ["service_account"],
-	mongodb: [
-		"password",
-		"connection_string",
-		"rawConnectionString",
-		"caCertificateText"
-	],
-	"pandas-dataframe": [],
-	"big-query": ["service_account", "clientSecret"],
-	snowflake: [
-		"password",
-		"clientSecret",
-		"privateKey",
-		"privateKeyPassphrase",
-		"dbtServiceToken"
-	],
-	redshift: ["password", "caCertificateText"],
-	trino: [
-		"password",
-		"clientSecret",
-		"caCertificateText"
-	]
-};
-/**
-* Get the list of secret field paths for a given integration type.
-*
-* @param type - The integration type (e.g., 'pgsql', 'snowflake')
-* @returns Array of field names that contain secrets
-*
-* @example
-* getSecretFieldPaths('pgsql') // => ['password', 'caCertificateText']
-* getSecretFieldPaths('snowflake') // => ['password', 'clientSecret', 'privateKey', 'privateKeyPassphrase', 'dbtServiceToken']
-*/
-function getSecretFieldPaths(type) {
-	return SECRET_PATHS[type] ?? [];
-}
-//#endregion
 //#region src/loading/merge-integrations.ts
 /**
 * JSON schema URL for the integrations file.
@@ -1559,6 +1583,7 @@ exports.extractEnvVarName = extractEnvVarName;
 exports.federatedAuthMethods = federatedAuthMethods;
 exports.fetchIntegrations = fetchIntegrations;
 exports.generateEnvVarName = generateEnvVarName;
+exports.getBigQueryOAuthSqlAlchemyInput = getBigQueryOAuthSqlAlchemyInput;
 exports.getEnvironmentVariablesForIntegrations = getEnvironmentVariablesForIntegrations;
 exports.getOrCreateIntegrationMetadata = getOrCreateIntegrationMetadata;
 exports.getOrCreateIntegrationsFromDocument = getOrCreateIntegrationsFromDocument;
@@ -1573,6 +1598,7 @@ exports.isDatabaseIntegrationTypeWithSslSupport = isDatabaseIntegrationTypeWithS
 exports.isEnvVarRef = isEnvVarRef;
 exports.isFederatedAuthMetadata = isFederatedAuthMetadata;
 exports.isFederatedAuthMethod = isFederatedAuthMethod;
+exports.isFederatedAuthSecretField = isFederatedAuthSecretField;
 exports.isSqlIntegrationType = isSqlIntegrationType;
 exports.mergeApiIntegrationsIntoDocument = mergeApiIntegrationsIntoDocument;
 exports.mergeApiIntegrationsIntoYaml = mergeApiIntegrationsIntoYaml;

package/dist/index.d.cts

@@ -842,6 +842,14 @@ declare class BigQueryServiceAccountParseError extends Error {
     cause: Error;
   });
 }
+/**
+ * @returns sql alchemy input for a BigQuery integration authenticated via Google OAuth, given an
+ * access token minted by the caller. `user_supplied_client=true` tells the runtime to build its
+ * BigQuery client from `access_token` / `project` instead of a service account.
+ */
+declare function getBigQueryOAuthSqlAlchemyInput(metadata: Extract<DatabaseIntegrationMetadataByType['big-query'], {
+  authMethod: 'google-oauth';
+}>, accessToken: string): SqlAlchemyInput;
 declare class SpannerServiceAccountParseError extends Error {
   cause: Error;
   constructor(message: string, params: {
@@ -1671,6 +1679,12 @@ type MetadataKey<T extends DatabaseIntegrationType> = AllKeysOf<DatabaseIntegrat
  * getSecretFieldPaths('snowflake') // => ['password', 'clientSecret', 'privateKey', 'privateKeyPassphrase', 'dbtServiceToken']
  */
 declare function getSecretFieldPaths(type: DatabaseIntegrationType): readonly string[];
+/**
+ * Whether `key` is a secret field of an integration whose `metadata.authMethod` is federated.
+ * Such integrations authenticate each user with their own identity, so the value never needs
+ * to reach notebook code.
+ */
+declare function isFederatedAuthSecretField(type: DatabaseIntegrationType, metadata: Readonly<Record<string, unknown>>, key: string): boolean;
 //#endregion
 //#region src/sql-integration-auth-methods.d.ts
 declare const AwsAuthMethods: {
@@ -1728,4 +1742,4 @@ interface SnowflakeKeyPair {
   username: string;
 }
 //#endregion
-export { ApiError, ApiIntegration, ApiResponse, type AwsAuthMethod, AwsAuthMethods, BUILTIN_INTEGRATIONS, BaseIntegrationsFile, type BigQueryAuthMethod, BigQueryAuthMethods, BigQueryServiceAccountParseError, ConvertApiIntegrationsResult, DEFAULT_API_URL, DEFAULT_ENV_FILE, DEFAULT_INTEGRATIONS_FILE, type DatabaseAuthMethod, DatabaseAuthMethods, type DatabaseIntegrationConfig, type DatabaseIntegrationMetadataByType, type DatabaseIntegrationType, type DatabaseIntegrationTypeWithSslSupport, ENV_VAR_REF_PREFIX, type EnvVar, EnvVarResolutionError, type FederatedAuthMethod, IntegrationsDocumentMergeResult, IntegrationsFile, IntegrationsMergeResult, IntegrationsParseResult, IntegrationsYamlDocumentMergeResult, IntegrationsYamlParseError, InvalidIntegrationError, InvalidIntegrationsTypeError, JSON_SCHEMA_URL, type MetadataKey, ParseIntegrationsInput, ParsedEnvVarRef, SCHEMA_COMMENT, SkippedApiIntegration, type SnowflakeAuthMethod, SnowflakeAuthMethods, SpannerServiceAccountParseError, type SqlAlchemyInput, type SqlIntegrationConfig, type SqlIntegrationType, type TrinoAuthMethod, TrinoAuthMethods, ValidationIssue, addIntegrationToSeq, apiIntegrationSchema, apiResponseSchema, baseIntegrationsFileSchema, convertApiIntegrations, createEnvVarRef, createNewDocument, databaseIntegrationConfigSchema, databaseIntegrationTypes, databaseIntegrationTypesWithSslSupport, databaseMetadataSchemasByType, extractEnvVarName, federatedAuthMethods, fetchIntegrations, generateEnvVarName, getEnvironmentVariablesForIntegrations, getOrCreateIntegrationMetadata, getOrCreateIntegrationsFromDocument, getSecretFieldPaths, getSnowflakeFederatedAuthSqlAlchemyInput, getSqlAlchemyInput, getSqlEnvVarName, integrationsFileSchema, isBuiltinIntegration, isDatabaseIntegrationType, isDatabaseIntegrationTypeWithSslSupport, isEnvVarRef, isFederatedAuthMetadata, isFederatedAuthMethod, isSqlIntegrationType, mergeApiIntegrationsIntoDocument, mergeApiIntegrationsIntoYaml, mergeProcessedIntegrations, parseEnvVarRef, parseIntegrations, parseIntegrationsDocument, resolveEnvVarRefsFromMap, serializeIntegrationsDocument, sqlIntegrationTypes, updateIntegrationInDocument, updateIntegrationMetadataMap };
+export { ApiError, ApiIntegration, ApiResponse, type AwsAuthMethod, AwsAuthMethods, BUILTIN_INTEGRATIONS, BaseIntegrationsFile, type BigQueryAuthMethod, BigQueryAuthMethods, BigQueryServiceAccountParseError, ConvertApiIntegrationsResult, DEFAULT_API_URL, DEFAULT_ENV_FILE, DEFAULT_INTEGRATIONS_FILE, type DatabaseAuthMethod, DatabaseAuthMethods, type DatabaseIntegrationConfig, type DatabaseIntegrationMetadataByType, type DatabaseIntegrationType, type DatabaseIntegrationTypeWithSslSupport, ENV_VAR_REF_PREFIX, type EnvVar, EnvVarResolutionError, type FederatedAuthMethod, IntegrationsDocumentMergeResult, IntegrationsFile, IntegrationsMergeResult, IntegrationsParseResult, IntegrationsYamlDocumentMergeResult, IntegrationsYamlParseError, InvalidIntegrationError, InvalidIntegrationsTypeError, JSON_SCHEMA_URL, type MetadataKey, ParseIntegrationsInput, ParsedEnvVarRef, SCHEMA_COMMENT, SkippedApiIntegration, type SnowflakeAuthMethod, SnowflakeAuthMethods, SpannerServiceAccountParseError, type SqlAlchemyInput, type SqlIntegrationConfig, type SqlIntegrationType, type TrinoAuthMethod, TrinoAuthMethods, ValidationIssue, addIntegrationToSeq, apiIntegrationSchema, apiResponseSchema, baseIntegrationsFileSchema, convertApiIntegrations, createEnvVarRef, createNewDocument, databaseIntegrationConfigSchema, databaseIntegrationTypes, databaseIntegrationTypesWithSslSupport, databaseMetadataSchemasByType, extractEnvVarName, federatedAuthMethods, fetchIntegrations, generateEnvVarName, getBigQueryOAuthSqlAlchemyInput, getEnvironmentVariablesForIntegrations, getOrCreateIntegrationMetadata, getOrCreateIntegrationsFromDocument, getSecretFieldPaths, getSnowflakeFederatedAuthSqlAlchemyInput, getSqlAlchemyInput, getSqlEnvVarName, integrationsFileSchema, isBuiltinIntegration, isDatabaseIntegrationType, isDatabaseIntegrationTypeWithSslSupport, isEnvVarRef, isFederatedAuthMetadata, isFederatedAuthMethod, isFederatedAuthSecretField, isSqlIntegrationType, mergeApiIntegrationsIntoDocument, mergeApiIntegrationsIntoYaml, mergeProcessedIntegrations, parseEnvVarRef, parseIntegrations, parseIntegrationsDocument, resolveEnvVarRefsFromMap, serializeIntegrationsDocument, sqlIntegrationTypes, updateIntegrationInDocument, updateIntegrationMetadataMap };

package/dist/index.d.ts

@@ -842,6 +842,14 @@ declare class BigQueryServiceAccountParseError extends Error {
     cause: Error;
   });
 }
+/**
+ * @returns sql alchemy input for a BigQuery integration authenticated via Google OAuth, given an
+ * access token minted by the caller. `user_supplied_client=true` tells the runtime to build its
+ * BigQuery client from `access_token` / `project` instead of a service account.
+ */
+declare function getBigQueryOAuthSqlAlchemyInput(metadata: Extract<DatabaseIntegrationMetadataByType['big-query'], {
+  authMethod: 'google-oauth';
+}>, accessToken: string): SqlAlchemyInput;
 declare class SpannerServiceAccountParseError extends Error {
   cause: Error;
   constructor(message: string, params: {
@@ -1671,6 +1679,12 @@ type MetadataKey<T extends DatabaseIntegrationType> = AllKeysOf<DatabaseIntegrat
  * getSecretFieldPaths('snowflake') // => ['password', 'clientSecret', 'privateKey', 'privateKeyPassphrase', 'dbtServiceToken']
  */
 declare function getSecretFieldPaths(type: DatabaseIntegrationType): readonly string[];
+/**
+ * Whether `key` is a secret field of an integration whose `metadata.authMethod` is federated.
+ * Such integrations authenticate each user with their own identity, so the value never needs
+ * to reach notebook code.
+ */
+declare function isFederatedAuthSecretField(type: DatabaseIntegrationType, metadata: Readonly<Record<string, unknown>>, key: string): boolean;
 //#endregion
 //#region src/sql-integration-auth-methods.d.ts
 declare const AwsAuthMethods: {
@@ -1728,4 +1742,4 @@ interface SnowflakeKeyPair {
   username: string;
 }
 //#endregion
-export { ApiError, ApiIntegration, ApiResponse, type AwsAuthMethod, AwsAuthMethods, BUILTIN_INTEGRATIONS, BaseIntegrationsFile, type BigQueryAuthMethod, BigQueryAuthMethods, BigQueryServiceAccountParseError, ConvertApiIntegrationsResult, DEFAULT_API_URL, DEFAULT_ENV_FILE, DEFAULT_INTEGRATIONS_FILE, type DatabaseAuthMethod, DatabaseAuthMethods, type DatabaseIntegrationConfig, type DatabaseIntegrationMetadataByType, type DatabaseIntegrationType, type DatabaseIntegrationTypeWithSslSupport, ENV_VAR_REF_PREFIX, type EnvVar, EnvVarResolutionError, type FederatedAuthMethod, IntegrationsDocumentMergeResult, IntegrationsFile, IntegrationsMergeResult, IntegrationsParseResult, IntegrationsYamlDocumentMergeResult, IntegrationsYamlParseError, InvalidIntegrationError, InvalidIntegrationsTypeError, JSON_SCHEMA_URL, type MetadataKey, ParseIntegrationsInput, ParsedEnvVarRef, SCHEMA_COMMENT, SkippedApiIntegration, type SnowflakeAuthMethod, SnowflakeAuthMethods, SpannerServiceAccountParseError, type SqlAlchemyInput, type SqlIntegrationConfig, type SqlIntegrationType, type TrinoAuthMethod, TrinoAuthMethods, ValidationIssue, addIntegrationToSeq, apiIntegrationSchema, apiResponseSchema, baseIntegrationsFileSchema, convertApiIntegrations, createEnvVarRef, createNewDocument, databaseIntegrationConfigSchema, databaseIntegrationTypes, databaseIntegrationTypesWithSslSupport, databaseMetadataSchemasByType, extractEnvVarName, federatedAuthMethods, fetchIntegrations, generateEnvVarName, getEnvironmentVariablesForIntegrations, getOrCreateIntegrationMetadata, getOrCreateIntegrationsFromDocument, getSecretFieldPaths, getSnowflakeFederatedAuthSqlAlchemyInput, getSqlAlchemyInput, getSqlEnvVarName, integrationsFileSchema, isBuiltinIntegration, isDatabaseIntegrationType, isDatabaseIntegrationTypeWithSslSupport, isEnvVarRef, isFederatedAuthMetadata, isFederatedAuthMethod, isSqlIntegrationType, mergeApiIntegrationsIntoDocument, mergeApiIntegrationsIntoYaml, mergeProcessedIntegrations, parseEnvVarRef, parseIntegrations, parseIntegrationsDocument, resolveEnvVarRefsFromMap, serializeIntegrationsDocument, sqlIntegrationTypes, updateIntegrationInDocument, updateIntegrationMetadataMap };
+export { ApiError, ApiIntegration, ApiResponse, type AwsAuthMethod, AwsAuthMethods, BUILTIN_INTEGRATIONS, BaseIntegrationsFile, type BigQueryAuthMethod, BigQueryAuthMethods, BigQueryServiceAccountParseError, ConvertApiIntegrationsResult, DEFAULT_API_URL, DEFAULT_ENV_FILE, DEFAULT_INTEGRATIONS_FILE, type DatabaseAuthMethod, DatabaseAuthMethods, type DatabaseIntegrationConfig, type DatabaseIntegrationMetadataByType, type DatabaseIntegrationType, type DatabaseIntegrationTypeWithSslSupport, ENV_VAR_REF_PREFIX, type EnvVar, EnvVarResolutionError, type FederatedAuthMethod, IntegrationsDocumentMergeResult, IntegrationsFile, IntegrationsMergeResult, IntegrationsParseResult, IntegrationsYamlDocumentMergeResult, IntegrationsYamlParseError, InvalidIntegrationError, InvalidIntegrationsTypeError, JSON_SCHEMA_URL, type MetadataKey, ParseIntegrationsInput, ParsedEnvVarRef, SCHEMA_COMMENT, SkippedApiIntegration, type SnowflakeAuthMethod, SnowflakeAuthMethods, SpannerServiceAccountParseError, type SqlAlchemyInput, type SqlIntegrationConfig, type SqlIntegrationType, type TrinoAuthMethod, TrinoAuthMethods, ValidationIssue, addIntegrationToSeq, apiIntegrationSchema, apiResponseSchema, baseIntegrationsFileSchema, convertApiIntegrations, createEnvVarRef, createNewDocument, databaseIntegrationConfigSchema, databaseIntegrationTypes, databaseIntegrationTypesWithSslSupport, databaseMetadataSchemasByType, extractEnvVarName, federatedAuthMethods, fetchIntegrations, generateEnvVarName, getBigQueryOAuthSqlAlchemyInput, getEnvironmentVariablesForIntegrations, getOrCreateIntegrationMetadata, getOrCreateIntegrationsFromDocument, getSecretFieldPaths, getSnowflakeFederatedAuthSqlAlchemyInput, getSqlAlchemyInput, getSqlEnvVarName, integrationsFileSchema, isBuiltinIntegration, isDatabaseIntegrationType, isDatabaseIntegrationTypeWithSslSupport, isEnvVarRef, isFederatedAuthMetadata, isFederatedAuthMethod, isFederatedAuthSecretField, isSqlIntegrationType, mergeApiIntegrationsIntoDocument, mergeApiIntegrationsIntoYaml, mergeProcessedIntegrations, parseEnvVarRef, parseIntegrations, parseIntegrationsDocument, resolveEnvVarRefsFromMap, serializeIntegrationsDocument, sqlIntegrationTypes, updateIntegrationInDocument, updateIntegrationMetadataMap };

package/dist/index.js

@@ -404,6 +404,73 @@ const databaseIntegrationConfigSchema = z.discriminatedUnion("type", [
 	})
 ]);
 //#endregion
+//#region src/secret-field-paths.ts
+/**
+* All secret fields for each integration type.
+* This includes all possible secret fields regardless of auth method.
+*
+* Note: For integrations with multiple auth methods (e.g., snowflake, bigquery),
+* this includes all secret fields from all auth variants.
+*/
+const SECRET_PATHS = {
+	alloydb: ["password", "caCertificateText"],
+	mariadb: ["password", "caCertificateText"],
+	materialize: ["password", "caCertificateText"],
+	mindsdb: ["password", "caCertificateText"],
+	mysql: ["password", "caCertificateText"],
+	pgsql: ["password", "caCertificateText"],
+	"sql-server": ["password"],
+	clickhouse: ["password", "caCertificateText"],
+	databricks: ["token"],
+	dremio: ["token"],
+	athena: ["secret_access_key"],
+	spanner: ["service_account"],
+	"cloud-sql": ["service_account"],
+	mongodb: [
+		"password",
+		"connection_string",
+		"rawConnectionString",
+		"caCertificateText"
+	],
+	"pandas-dataframe": [],
+	"big-query": ["service_account", "clientSecret"],
+	snowflake: [
+		"password",
+		"clientSecret",
+		"privateKey",
+		"privateKeyPassphrase",
+		"dbtServiceToken"
+	],
+	redshift: ["password", "caCertificateText"],
+	trino: [
+		"password",
+		"clientSecret",
+		"caCertificateText"
+	]
+};
+/**
+* Get the list of secret field paths for a given integration type.
+*
+* @param type - The integration type (e.g., 'pgsql', 'snowflake')
+* @returns Array of field names that contain secrets
+*
+* @example
+* getSecretFieldPaths('pgsql') // => ['password', 'caCertificateText']
+* getSecretFieldPaths('snowflake') // => ['password', 'clientSecret', 'privateKey', 'privateKeyPassphrase', 'dbtServiceToken']
+*/
+function getSecretFieldPaths(type) {
+	return SECRET_PATHS[type] ?? [];
+}
+/**
+* Whether `key` is a secret field of an integration whose `metadata.authMethod` is federated.
+* Such integrations authenticate each user with their own identity, so the value never needs
+* to reach notebook code.
+*/
+function isFederatedAuthSecretField(type, metadata, key) {
+	const { authMethod } = metadata;
+	return typeof authMethod === "string" && isFederatedAuthMethod(authMethod) && getSecretFieldPaths(type).includes(key);
+}
+//#endregion
 //#region src/snowflake-integration-env-vars.ts
 /**
 * Build a URL with path and query parameters using native URL API
@@ -476,7 +543,7 @@ function getEnvironmentVariablesForIntegrations(integrations, params) {
 	integrations.forEach((integration) => {
 		const namePrefix = convertToEnvironmentVariableName(integration.name);
 		const envVarsForThisIntegration = Object.entries(integration.metadata).filter(([key]) => {
-			return key !== "caCertificateText";
+			return key !== "caCertificateText" && !isFederatedAuthSecretField(integration.type, integration.metadata, key);
 		}).map(([key, rawValue]) => {
 			const name = `${namePrefix}_${key.toUpperCase()}`;
 			const value = String(rawValue);
@@ -774,6 +841,21 @@ const getBigQuerySqlAlchemyInput = (metadata) => {
 		throw new BigQueryServiceAccountParseError("Failed to parse bigquery service account, returning empty environment variable.", { cause: error instanceof Error ? error : new Error(String(error)) });
 	}
 };
+/**
+* @returns sql alchemy input for a BigQuery integration authenticated via Google OAuth, given an
+* access token minted by the caller. `user_supplied_client=true` tells the runtime to build its
+* BigQuery client from `access_token` / `project` instead of a service account.
+*/
+function getBigQueryOAuthSqlAlchemyInput(metadata, accessToken) {
+	return {
+		url: "bigquery://?user_supplied_client=true",
+		params: {
+			access_token: accessToken,
+			project: metadata.project
+		},
+		param_style: "pyformat"
+	};
+}
 var SpannerServiceAccountParseError = class extends Error {
 	cause;
 	constructor(message, params) {
@@ -1103,64 +1185,6 @@ function serializeIntegrationsDocument(doc) {
 const baseIntegrationsFileSchema = z$1.object({ integrations: z$1.array(z$1.record(z$1.string(), z$1.unknown())).optional().default([]) });
 const integrationsFileSchema = z$1.object({ integrations: z$1.array(databaseIntegrationConfigSchema) });
 //#endregion
-//#region src/secret-field-paths.ts
-/**
-* All secret fields for each integration type.
-* This includes all possible secret fields regardless of auth method.
-*
-* Note: For integrations with multiple auth methods (e.g., snowflake, bigquery),
-* this includes all secret fields from all auth variants.
-*/
-const SECRET_PATHS = {
-	alloydb: ["password", "caCertificateText"],
-	mariadb: ["password", "caCertificateText"],
-	materialize: ["password", "caCertificateText"],
-	mindsdb: ["password", "caCertificateText"],
-	mysql: ["password", "caCertificateText"],
-	pgsql: ["password", "caCertificateText"],
-	"sql-server": ["password"],
-	clickhouse: ["password", "caCertificateText"],
-	databricks: ["token"],
-	dremio: ["token"],
-	athena: ["secret_access_key"],
-	spanner: ["service_account"],
-	"cloud-sql": ["service_account"],
-	mongodb: [
-		"password",
-		"connection_string",
-		"rawConnectionString",
-		"caCertificateText"
-	],
-	"pandas-dataframe": [],
-	"big-query": ["service_account", "clientSecret"],
-	snowflake: [
-		"password",
-		"clientSecret",
-		"privateKey",
-		"privateKeyPassphrase",
-		"dbtServiceToken"
-	],
-	redshift: ["password", "caCertificateText"],
-	trino: [
-		"password",
-		"clientSecret",
-		"caCertificateText"
-	]
-};
-/**
-* Get the list of secret field paths for a given integration type.
-*
-* @param type - The integration type (e.g., 'pgsql', 'snowflake')
-* @returns Array of field names that contain secrets
-*
-* @example
-* getSecretFieldPaths('pgsql') // => ['password', 'caCertificateText']
-* getSecretFieldPaths('snowflake') // => ['password', 'clientSecret', 'privateKey', 'privateKeyPassphrase', 'dbtServiceToken']
-*/
-function getSecretFieldPaths(type) {
-	return SECRET_PATHS[type] ?? [];
-}
-//#endregion
 //#region src/loading/merge-integrations.ts
 /**
 * JSON schema URL for the integrations file.
@@ -1501,4 +1525,4 @@ function parseIntegrations({ yaml, env = {} }) {
 	};
 }
 //#endregion
-export { ApiError, AwsAuthMethods, BUILTIN_INTEGRATIONS, BigQueryAuthMethods, BigQueryServiceAccountParseError, DEFAULT_API_URL, DEFAULT_ENV_FILE, DEFAULT_INTEGRATIONS_FILE, DatabaseAuthMethods, ENV_VAR_REF_PREFIX, EnvVarResolutionError, IntegrationsYamlParseError, InvalidIntegrationError, InvalidIntegrationsTypeError, JSON_SCHEMA_URL, SCHEMA_COMMENT, SnowflakeAuthMethods, SpannerServiceAccountParseError, TrinoAuthMethods, addIntegrationToSeq, apiIntegrationSchema, apiResponseSchema, baseIntegrationsFileSchema, convertApiIntegrations, createEnvVarRef, createNewDocument, databaseIntegrationConfigSchema, databaseIntegrationTypes, databaseIntegrationTypesWithSslSupport, databaseMetadataSchemasByType, extractEnvVarName, federatedAuthMethods, fetchIntegrations, generateEnvVarName, getEnvironmentVariablesForIntegrations, getOrCreateIntegrationMetadata, getOrCreateIntegrationsFromDocument, getSecretFieldPaths, getSnowflakeFederatedAuthSqlAlchemyInput, getSqlAlchemyInput, getSqlEnvVarName, integrationsFileSchema, isBuiltinIntegration, isDatabaseIntegrationType, isDatabaseIntegrationTypeWithSslSupport, isEnvVarRef, isFederatedAuthMetadata, isFederatedAuthMethod, isSqlIntegrationType, mergeApiIntegrationsIntoDocument, mergeApiIntegrationsIntoYaml, mergeProcessedIntegrations, parseEnvVarRef, parseIntegrations, parseIntegrationsDocument, resolveEnvVarRefsFromMap, serializeIntegrationsDocument, sqlIntegrationTypes, updateIntegrationInDocument, updateIntegrationMetadataMap };
+export { ApiError, AwsAuthMethods, BUILTIN_INTEGRATIONS, BigQueryAuthMethods, BigQueryServiceAccountParseError, DEFAULT_API_URL, DEFAULT_ENV_FILE, DEFAULT_INTEGRATIONS_FILE, DatabaseAuthMethods, ENV_VAR_REF_PREFIX, EnvVarResolutionError, IntegrationsYamlParseError, InvalidIntegrationError, InvalidIntegrationsTypeError, JSON_SCHEMA_URL, SCHEMA_COMMENT, SnowflakeAuthMethods, SpannerServiceAccountParseError, TrinoAuthMethods, addIntegrationToSeq, apiIntegrationSchema, apiResponseSchema, baseIntegrationsFileSchema, convertApiIntegrations, createEnvVarRef, createNewDocument, databaseIntegrationConfigSchema, databaseIntegrationTypes, databaseIntegrationTypesWithSslSupport, databaseMetadataSchemasByType, extractEnvVarName, federatedAuthMethods, fetchIntegrations, generateEnvVarName, getBigQueryOAuthSqlAlchemyInput, getEnvironmentVariablesForIntegrations, getOrCreateIntegrationMetadata, getOrCreateIntegrationsFromDocument, getSecretFieldPaths, getSnowflakeFederatedAuthSqlAlchemyInput, getSqlAlchemyInput, getSqlEnvVarName, integrationsFileSchema, isBuiltinIntegration, isDatabaseIntegrationType, isDatabaseIntegrationTypeWithSslSupport, isEnvVarRef, isFederatedAuthMetadata, isFederatedAuthMethod, isFederatedAuthSecretField, isSqlIntegrationType, mergeApiIntegrationsIntoDocument, mergeApiIntegrationsIntoYaml, mergeProcessedIntegrations, parseEnvVarRef, parseIntegrations, parseIntegrationsDocument, resolveEnvVarRefsFromMap, serializeIntegrationsDocument, sqlIntegrationTypes, updateIntegrationInDocument, updateIntegrationMetadataMap };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deepnote/database-integrations",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "Deepnote database integration definitions",
   "keywords": [],
   "repository": {