@malloydata/db-bigquery 0.0.430 → 0.0.431

package/dist/bigquery_connection.d.ts

@@ -37,6 +37,8 @@ interface BigQueryConnectionOptions extends ConnectionConfig {
     serviceAccountKey?: {
         [key: string]: ConnectionParameterValue;
     };
+    /** The key file's contents, as a JSON string or base64-encoded JSON. */
+    serviceAccountKeyJson?: string;
     location?: string;
     maximumBytesBilled?: string;
     timeoutMs?: string;

package/dist/bigquery_connection.js

@@ -44,6 +44,74 @@ const googleCommon = __importStar(require("@google-cloud/common"));
 const gaxios_1 = require("gaxios");
 const malloy_1 = require("@malloydata/malloy");
 const connection_1 = require("@malloydata/malloy/connection");
+function isJsonObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * The two credential shapes the SDK's `credentials` option accepts: a service
+ * account key, and an external account (workload identity federation) config,
+ * which carries no key of its own. Anything else — `{}`, a config file, half a
+ * key — is rejected here rather than at the first query, where it arrives as
+ * "the incoming JSON object does not contain a client_email field" and names
+ * nothing that would lead back to this property.
+ */
+function isCredentialObject(value) {
+    return ((typeof value['client_email'] === 'string' &&
+        typeof value['private_key'] === 'string') ||
+        value['type'] === 'external_account');
+}
+function isProbablyBase64(text) {
+    // `{` is not in the base64 alphabet, so JSON can never be mistaken for an
+    // encoding of itself. Everything else is treated as base64 and allowed to
+    // fail the parse below, which keeps the check to the one thing it can be
+    // certain about.
+    return !text.startsWith('{');
+}
+/**
+ * A service account key that arrives as a *string* rather than as structured
+ * config, in either of the two encodings a deployment can produce.
+ *
+ * `serviceAccountKey` is a `json`-typed property, and a json-typed slot takes
+ * its value literally: an `{env: "..."}` reference is never resolved in one,
+ * because reference indirection into structured config is exactly what the
+ * config compiler refuses. A deployment whose credentials live in an
+ * environment variable — the normal shape for a server — therefore cannot
+ * reach that slot at all, and the literal `{env: "..."}` object it does reach
+ * the SDK with fails as "the incoming JSON object does not contain a
+ * client_email field". This is a string slot, so a reference resolves and the
+ * value arrives here to be parsed.
+ *
+ * Base64 is accepted because a JSON object full of quotes and braces survives
+ * a shell, a CI secret editor, and a `.env` file poorly; base64 is one token
+ * that survives all three. Which one arrived is detected rather than declared,
+ * so a deployment that switches encodings doesn't also have to edit config.
+ *
+ * Nothing from `text` reaches the error message. It is a private key, and
+ * JSON.parse's own SyntaxError quotes the input it choked on.
+ */
+function credentialsFromJson(text) {
+    // Buffer's base64 decoder drops characters outside the alphabet rather than
+    // rejecting them, so a mangled value decodes to garbage instead of throwing.
+    // The parse below is what catches that, which is why one message has to
+    // cover both encodings: at this point either could have been intended.
+    const json = isProbablyBase64(text)
+        ? Buffer.from(text, 'base64').toString('utf8')
+        : text;
+    let parsed;
+    try {
+        parsed = JSON.parse(json);
+    }
+    catch {
+        throw new Error('serviceAccountKeyJson is neither JSON nor base64-encoded JSON. It ' +
+            'must hold the entire service account key file.');
+    }
+    if (!isJsonObject(parsed) || !isCredentialObject(parsed)) {
+        throw new Error('serviceAccountKeyJson parsed but is not a service account key: it ' +
+            'has no client_email and private_key. It must hold the entire key ' +
+            'file, not a fragment of one.');
+    }
+    return parsed;
+}
 // BigQuery label grammar: keys and values are lowercase, <=63 chars, and
 // [a-z0-9_-]; keys must start with a lowercase letter. Values are transformed
 // to fit (lowercase, disallowed chars -> '_', truncate); a key that can't be
@@ -294,12 +362,23 @@ class BigQueryConnection extends connection_1.BaseConnection {
             this.name = arg;
         }
         else {
-            const { name, client_email, private_key, serviceAccountKey, ...args } = arg;
+            // Every key-bearing property is destructured out of `args`, so a key
+            // never lands in `this.config` — only the credentials object the SDK
+            // needs does.
+            const { name, client_email, private_key, serviceAccountKey, serviceAccountKeyJson, ...args } = arg;
             this.name = name;
             config = args;
+            // Trimmed before it is looked at: a value that came through a here-doc,
+            // a `$(cat key.json)`, or a secret-store copy tends to carry a trailing
+            // newline, and both the encoding sniff and the emptiness check below
+            // would otherwise read it as content.
+            const keyJson = serviceAccountKeyJson === null || serviceAccountKeyJson === void 0 ? void 0 : serviceAccountKeyJson.trim();
             if (serviceAccountKey) {
                 config.credentials = serviceAccountKey;
             }
+            else if (keyJson) {
+                config.credentials = credentialsFromJson(keyJson);
+            }
             else if (client_email || private_key) {
                 config.credentials = {
                     client_email,

package/dist/index.js

@@ -34,6 +34,20 @@ const bigquery_connection_2 = require("./bigquery_connection");
             type: 'json',
             optional: true,
         },
+        // The string-typed twin of `serviceAccountKey`. A `json` slot holds its
+        // value literally — an `{env: "..."}` reference is never resolved in one —
+        // so a deployment holding its key in an environment variable has no way to
+        // use the slot above. This is a `secret` string, where references do
+        // resolve, and the connection parses what arrives.
+        {
+            name: 'serviceAccountKeyJson',
+            displayName: 'Service Account Key (JSON)',
+            type: 'secret',
+            optional: true,
+            description: 'The entire service account key file, as JSON or base64-encoded ' +
+                'JSON (detected automatically), for supplying the key from an ' +
+                'environment variable or secret manager rather than from disk.',
+        },
         {
             name: 'location',
             displayName: 'Location',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@malloydata/db-bigquery",
-  "version": "0.0.430",
+  "version": "0.0.431",
   "license": "MIT",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -26,7 +26,7 @@
     "@google-cloud/bigquery": "7.9.4",
     "@google-cloud/common": "5.0.2",
     "@google-cloud/paginator": "5.0.2",
-    "@malloydata/malloy": "0.0.430",
+    "@malloydata/malloy": "0.0.431",
     "gaxios": "^4.2.0"
   }
 }