@owox/backend 0.37.0 → 0.39.0

package/dist/src/data-marts/credentials/use-cases/create-credential.service.js

@@ -26,6 +26,7 @@ const credential_context_entity_1 = require("../entities/credential-context.enti
 const credential_owner_entity_1 = require("../entities/credential-owner.entity");
 const credential_definition_service_1 = require("../services/credential-definition.service");
 const credential_service_1 = require("../services/credential.service");
+const google_service_account_key_1 = require("../services/google-service-account-key");
 const credential_view_service_1 = require("../services/credential-view.service");
 const credential_validation_probe_service_1 = require("../services/credential-validation-probe.service");
 const credential_types_1 = require("../credential.types");
@@ -51,10 +52,16 @@ let CreateCredentialService = class CreateCredentialService {
     async run(context, input) {
         const definition = await this.definitions.get(input.definitionId);
         const aiConfiguration = normalizeAiConfiguration(input.aiModelMappings, input.aiModelMappingModes, definition.contract.ai);
+        const publicMetadata = definition.contract.auth.type === 'google-service-account'
+            ? (0, google_service_account_key_1.parseGoogleServiceAccountKey)(input.secret.value).metadata
+            : null;
         const validation = await this.validationProbe.run(definition, { value: input.secret.value });
         if (validation.state === 'rejected') {
             throw new common_1.BadRequestException(validation.message);
         }
+        return this.persist(context, input, definition, aiConfiguration, publicMetadata, validation);
+    }
+    async persist(context, input, definition, aiConfiguration, publicMetadata, validation) {
         const credential = await this.credentials.save(this.credentials.create({
             projectId: context.projectId,
             title: input.title.trim(),
@@ -71,6 +78,7 @@ let CreateCredentialService = class CreateCredentialService {
             validationState: validation.state,
             validationMessage: validation.message,
             validatedAt: validation.validatedAt,
+            publicMetadata,
             createdById: context.userId,
         }));
         const ownerIds = [...new Set([context.userId, ...(input.ownerIds ?? [])])];
@@ -90,9 +98,9 @@ exports.CreateCredentialService = CreateCredentialService;
 __decorate([
     (0, typeorm_transactional_1.Transactional)(),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object, Function]),
+    __metadata("design:paramtypes", [Object, Function, Object, void 0, Object, Object]),
     __metadata("design:returntype", Promise)
-], CreateCredentialService.prototype, "run", null);
+], CreateCredentialService.prototype, "persist", null);
 exports.CreateCredentialService = CreateCredentialService = __decorate([
     (0, common_1.Injectable)(),
     __param(6, (0, typeorm_1.InjectRepository)(credential_owner_entity_1.CredentialOwner)),

package/dist/src/data-marts/credentials/use-cases/update-credential.service.d.ts

@@ -21,5 +21,6 @@ export declare class UpdateCredentialService {
     private readonly owners;
     constructor(credentials: CredentialService, definitions: CredentialDefinitionService, access: AccessDecisionService, contextAccess: ContextAccessService, view: CredentialViewService, validationProbe: CredentialValidationProbeService, idpProjections: IdpProjectionsFacade, owners: Repository<CredentialOwner>);
     run(id: string, context: AuthorizationContext, input: UpdateCredentialApiDto): Promise<CredentialDto>;
+    private apply;
     private assertAccess;
 }

package/dist/src/data-marts/credentials/use-cases/update-credential.service.js

@@ -24,6 +24,7 @@ const sync_owners_1 = require("../../utils/sync-owners");
 const credential_owner_entity_1 = require("../entities/credential-owner.entity");
 const credential_definition_service_1 = require("../services/credential-definition.service");
 const credential_service_1 = require("../services/credential.service");
+const google_service_account_key_1 = require("../services/google-service-account-key");
 const credential_view_service_1 = require("../services/credential-view.service");
 const credential_validation_probe_service_1 = require("../services/credential-validation-probe.service");
 const create_credential_service_1 = require("./create-credential.service");
@@ -65,14 +66,29 @@ let UpdateCredentialService = class UpdateCredentialService {
             ? await this.definitions.getForCredential(credential)
             : await this.definitions.getForView(credential);
         let validation;
-        if (input.title !== undefined)
-            credential.title = input.title.trim();
+        let publicMetadata = credential.publicMetadata;
         if (input.secret !== undefined) {
+            if (definition.contract.auth.type === 'google-service-account') {
+                publicMetadata = (0, google_service_account_key_1.parseGoogleServiceAccountKey)(input.secret.value).metadata;
+                const savedEmail = credential.publicMetadata?.clientEmail ?? storedClientEmail(credential.secret.value);
+                if (savedEmail && publicMetadata.clientEmail.toLowerCase() !== savedEmail.toLowerCase()) {
+                    throw new common_1.BadRequestException(`The replacement key must belong to ${savedEmail}. Create another Credential for a different service account.`);
+                }
+            }
             validation = await this.validationProbe.run(definition, { value: input.secret.value });
             if (validation.state === 'rejected') {
                 throw new common_1.BadRequestException(validation.message);
             }
+        }
+        return this.apply(id, context, input, definition, validation, publicMetadata);
+    }
+    async apply(id, context, input, definition, validation, publicMetadata) {
+        const credential = await this.credentials.getByIdAndProjectId(id, context.projectId);
+        if (input.title !== undefined)
+            credential.title = input.title.trim();
+        if (input.secret !== undefined && validation) {
             credential.secret = { value: input.secret.value };
+            credential.publicMetadata = publicMetadata;
             credential.validationState = validation.state;
             credential.validationMessage = validation.message;
             credential.validatedAt = validation.validatedAt;
@@ -113,9 +129,9 @@ exports.UpdateCredentialService = UpdateCredentialService;
 __decorate([
     (0, typeorm_transactional_1.Transactional)(),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, Object, Function]),
+    __metadata("design:paramtypes", [String, Object, Function, Object, Object, Object]),
     __metadata("design:returntype", Promise)
-], UpdateCredentialService.prototype, "run", null);
+], UpdateCredentialService.prototype, "apply", null);
 exports.UpdateCredentialService = UpdateCredentialService = __decorate([
     (0, common_1.Injectable)(),
     __param(7, (0, typeorm_1.InjectRepository)(credential_owner_entity_1.CredentialOwner)),
@@ -128,4 +144,12 @@ exports.UpdateCredentialService = UpdateCredentialService = __decorate([
         idp_projections_facade_1.IdpProjectionsFacade,
         typeorm_2.Repository])
 ], UpdateCredentialService);
+function storedClientEmail(secretValue) {
+    try {
+        return (0, google_service_account_key_1.parseGoogleServiceAccountKey)(secretValue).metadata.clientEmail;
+    }
+    catch {
+        return undefined;
+    }
+}
 //# sourceMappingURL=update-credential.service.js.map

package/dist/src/data-marts/credentials/use-cases/validate-credential.service.js

@@ -36,11 +36,8 @@ let ValidateCredentialService = class ValidateCredentialService {
         }
         const definition = await this.definitions.getForCredential(credential);
         const validation = await this.validationProbe.run(definition, credential.secret);
-        credential.validationState = validation.state;
-        credential.validationMessage = validation.message;
-        credential.validatedAt = validation.validatedAt;
-        await this.credentials.save(credential);
-        return this.view.build(credential);
+        await this.credentials.writeValidation(id, credential.secret, validation);
+        return this.view.build(await this.credentials.getByIdAndProjectId(id, context.projectId));
     }
 };
 exports.ValidateCredentialService = ValidateCredentialService;

package/dist/src/data-marts/data-destination-types/ee/email/services/email-credentials-validator.js

@@ -17,9 +17,7 @@ class BaseEmailCredentialsValidator {
         const credentialsOpt = email_credentials_schema_1.EmailCredentialsSchema.safeParse(credentials);
         if (!credentialsOpt.success) {
             this.logger.warn('Invalid credentials format', credentialsOpt.error);
-            return new data_destination_credentials_validator_interface_1.ValidationResult(false, 'Invalid credentials', {
-                errors: credentialsOpt.error.errors,
-            });
+            return data_destination_credentials_validator_interface_1.ValidationResult.invalidCredentials(credentialsOpt.error);
         }
         return new data_destination_credentials_validator_interface_1.ValidationResult(true);
     }

package/dist/src/data-marts/data-destination-types/ee/google-chat/services/google-chat-credentials-validator.js

@@ -22,9 +22,7 @@ let GoogleChatCredentialsValidator = GoogleChatCredentialsValidator_1 = class Go
             : google_chat_credentials_schema_1.GoogleChatCredentialsSchema.safeParse(credentials);
         if (!credentialsValidation.success) {
             this.logger.warn('Invalid Google Chat credentials format', credentialsValidation.error);
-            return new data_destination_credentials_validator_interface_1.ValidationResult(false, 'Invalid Google Chat credentials', {
-                errors: credentialsValidation.error.errors,
-            });
+            return data_destination_credentials_validator_interface_1.ValidationResult.invalidCredentials(credentialsValidation.error);
         }
         return new data_destination_credentials_validator_interface_1.ValidationResult(true);
     }

package/dist/src/data-marts/data-destination-types/google-sheets/services/google-sheets-credentials-validator.js

@@ -20,9 +20,7 @@ let GoogleSheetsCredentialsValidator = GoogleSheetsCredentialsValidator_1 = clas
         const credentialsOpt = google_sheets_credentials_schema_1.GoogleSheetsCredentialsSchema.safeParse(credentials);
         if (!credentialsOpt.success) {
             this.logger.warn('Invalid credentials format', credentialsOpt.error);
-            return new data_destination_credentials_validator_interface_1.ValidationResult(false, 'Invalid credentials', {
-                errors: credentialsOpt.error.errors,
-            });
+            return data_destination_credentials_validator_interface_1.ValidationResult.invalidCredentials(credentialsOpt.error);
         }
         try {
             const isValid = await google_sheets_api_adapter_1.GoogleSheetsApiAdapter.validateCredentials(credentialsOpt.data);

package/dist/src/data-marts/data-destination-types/google-sheets/services/google-sheets-report-writer.d.ts

@@ -59,4 +59,5 @@ export declare class GoogleSheetsReportWriter implements DataDestinationReportWr
     private reorderRowsToFinalLayout;
     private buildFillDownRequests;
     private executeWithErrorHandling;
+    private describeGoogleApiError;
 }

package/dist/src/data-marts/data-destination-types/google-sheets/services/google-sheets-report-writer.js

@@ -26,6 +26,7 @@ const sheets_report_run_event_1 = require("../../../events/sheets-report-run.eve
 const owox_event_dispatcher_1 = require("../../../../common/event-dispatcher/owox-event-dispatcher");
 const google_sheet_not_found_error_1 = require("../../../errors/google-sheet-not-found.error");
 const business_violation_exception_1 = require("../../../../common/exceptions/business-violation.exception");
+const google_sheets_api_call_error_1 = require("../../../errors/google-sheets-api-call.error");
 const app_edition_config_service_1 = require("../../../../common/config/app-edition-config.service");
 const public_origin_service_1 = require("../../../../common/config/public-origin.service");
 const data_mart_url_helper_1 = require("../../../../common/helpers/data-mart-url.helper");
@@ -538,9 +539,20 @@ let GoogleSheetsReportWriter = GoogleSheetsReportWriter_1 = class GoogleSheetsRe
             else {
                 this.logger.error(`${operationName} failed: ${error.message}`, error.stack);
             }
-            throw error;
+            throw this.describeGoogleApiError(error, operationName) ?? error;
         }
     }
+    describeGoogleApiError(error, operationName) {
+        if (error instanceof google_sheets_api_call_error_1.GoogleSheetsApiCallError || error instanceof business_violation_exception_1.BusinessViolationException) {
+            return undefined;
+        }
+        const status = google_sheets_api_adapter_1.GoogleSheetsApiAdapter.httpStatusOf(error);
+        if (status === undefined || status < 400) {
+            return undefined;
+        }
+        const googleMessage = error instanceof Error ? error.message : String(error);
+        return new google_sheets_api_call_error_1.GoogleSheetsApiCallError((0, google_sheets_api_call_error_1.googleSheetsApiCallMessage)(operationName, status, googleMessage), status, error);
+    }
 };
 exports.GoogleSheetsReportWriter = GoogleSheetsReportWriter;
 exports.GoogleSheetsReportWriter = GoogleSheetsReportWriter = GoogleSheetsReportWriter_1 = __decorate([

package/dist/src/data-marts/data-destination-types/interfaces/data-destination-credentials-validator.interface.d.ts

@@ -1,3 +1,4 @@
+import { ZodError } from 'zod';
 import { TypedComponent } from '../../../common/resolver/typed-component.resolver';
 import { DataDestinationType } from '../enums/data-destination-type.enum';
 import { DataDestinationCredentials } from '../data-destination-credentials.type';
@@ -9,4 +10,5 @@ export declare class ValidationResult {
     readonly errorMessage?: string | undefined;
     readonly reason?: Record<string, unknown> | undefined;
     constructor(valid: boolean, errorMessage?: string | undefined, reason?: Record<string, unknown> | undefined);
+    static invalidCredentials(error: ZodError): ValidationResult;
 }

package/dist/src/data-marts/data-destination-types/interfaces/data-destination-credentials-validator.interface.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ValidationResult = void 0;
+const field_errors_utils_1 = require("../../utils/field-errors.utils");
 class ValidationResult {
     valid;
     errorMessage;
@@ -10,6 +11,12 @@ class ValidationResult {
         this.errorMessage = errorMessage;
         this.reason = reason;
     }
+    static invalidCredentials(error) {
+        return new ValidationResult(false, (0, field_errors_utils_1.describeInvalidInput)('credentials', error), {
+            errors: (0, field_errors_utils_1.sanitizeIssues)(error.errors),
+            fieldErrors: (0, field_errors_utils_1.toFieldErrors)('credentials', error),
+        });
+    }
 }
 exports.ValidationResult = ValidationResult;
 //# sourceMappingURL=data-destination-credentials-validator.interface.js.map

package/dist/src/data-marts/data-destination-types/looker-studio-connector/services/looker-studio-connector-credentials-validator.js

@@ -19,9 +19,7 @@ let LookerStudioConnectorCredentialsValidator = LookerStudioConnectorCredentials
         const credentialsOpt = looker_studio_connector_credentials_schema_1.LookerStudioConnectorCredentialsSchema.safeParse(credentials);
         if (!credentialsOpt.success) {
             this.logger.warn('Invalid credentials format', credentialsOpt.error);
-            return new data_destination_credentials_validator_interface_1.ValidationResult(false, 'Invalid credentials', {
-                errors: credentialsOpt.error.errors,
-            });
+            return data_destination_credentials_validator_interface_1.ValidationResult.invalidCredentials(credentialsOpt.error);
         }
         return new data_destination_credentials_validator_interface_1.ValidationResult(true);
     }

package/dist/src/data-marts/data-marts.module.js

@@ -63,6 +63,8 @@ const preview_data_mart_service_1 = require("./use-cases/preview-data-mart.servi
 const data_mart_preview_controller_1 = require("./controllers/data-mart-preview.controller");
 const summarize_mcp_data_catalog_service_1 = require("./use-cases/summarize-mcp-data-catalog.service");
 const mcp_data_marts_facade_1 = require("./facades/mcp-data-marts.facade");
+const mcp_contexts_facade_1 = require("./facades/mcp-contexts.facade");
+const mcp_contexts_facade_impl_1 = require("./facades/mcp-contexts.facade.impl");
 const mcp_data_marts_facade_impl_1 = require("./facades/mcp-data-marts.facade.impl");
 const mcp_data_destinations_facade_1 = require("./facades/mcp-data-destinations.facade");
 const mcp_data_destinations_facade_impl_1 = require("./facades/mcp-data-destinations.facade.impl");
@@ -263,6 +265,7 @@ const update_insight_template_source_service_1 = require("./use-cases/update-ins
 const delete_insight_template_source_service_1 = require("./use-cases/delete-insight-template-source.service");
 const delete_insight_template_service_1 = require("./use-cases/delete-insight-template.service");
 const retry_interrupted_connector_runs_processor_1 = require("./system-triggers/processors/retry-interrupted-connector-runs-processor");
+const repair_backfill_chains_processor_1 = require("./system-triggers/processors/repair-backfill-chains-processor");
 const sql_run_service_1 = require("./use-cases/sql-run.service");
 const create_view_service_1 = require("./use-cases/create-view.service");
 const ai_insights_providers_1 = require("./ai-insights/ai-insights-providers");
@@ -475,6 +478,7 @@ const validate_credential_service_1 = require("./credentials/use-cases/validate-
 const credential_consumer_binding_facade_1 = require("./credentials/facades/credential-consumer-binding.facade");
 const credential_consumer_binding_facade_impl_1 = require("./credentials/facades/credential-consumer-binding.facade.impl");
 const credential_fetch_service_1 = require("./credentials/services/credential-fetch.service");
+const google_service_account_token_service_1 = require("./credentials/services/google-service-account-token.service");
 const credential_ai_service_1 = require("./credentials/services/credential-ai.service");
 const credential_validation_probe_service_1 = require("./credentials/services/credential-validation-probe.service");
 const credential_external_definition_registry_service_1 = require("./credentials/services/credential-external-definition-registry.service");
@@ -642,6 +646,7 @@ exports.DataMartsModule = DataMartsModule = __decorate([
             data_quality_api_service_1.DataQualityApiService,
             data_quality_summary_service_1.DataQualitySummaryService,
             mcp_data_catalog_summary_service_1.McpDataCatalogSummaryService,
+            { provide: mcp_contexts_facade_1.MCP_CONTEXTS_FACADE, useClass: mcp_contexts_facade_impl_1.McpContextsFacadeImpl },
             create_data_mart_service_1.CreateDataMartService,
             list_data_marts_service_1.ListDataMartsService,
             get_model_canvas_data_marts_service_1.GetModelCanvasDataMartsService,
@@ -815,6 +820,7 @@ exports.DataMartsModule = DataMartsModule = __decorate([
             ai_helper_trigger_service_1.AiHelperTriggerService,
             ai_helper_trigger_handler_service_1.AiHelperTriggerHandlerService,
             retry_interrupted_connector_runs_processor_1.RetryInterruptedConnectorRunsProcessor,
+            repair_backfill_chains_processor_1.RepairBackfillChainsProcessor,
             scheduled_trigger_service_1.ScheduledTriggerService,
             scheduled_trigger_mapper_1.ScheduledTriggerMapper,
             create_scheduled_trigger_service_1.CreateScheduledTriggerService,
@@ -991,12 +997,14 @@ exports.DataMartsModule = DataMartsModule = __decorate([
             delete_credential_service_1.DeleteCredentialService,
             validate_credential_service_1.ValidateCredentialService,
             credential_fetch_service_1.CredentialFetchService,
+            google_service_account_token_service_1.GoogleServiceAccountTokenService,
             credential_ai_service_1.CredentialAiService,
             credential_validation_probe_service_1.CredentialValidationProbeService,
             credential_external_definition_registry_service_1.CredentialExternalDefinitionRegistryService,
             consent_credential_definition_service_1.ConsentCredentialDefinitionService,
         ],
         exports: [
+            mcp_contexts_facade_1.MCP_CONTEXTS_FACADE,
             credential_consumer_binding_facade_1.CREDENTIAL_CONSUMER_BINDING_FACADE,
             credential_fetch_service_1.CredentialFetchService,
             credential_ai_service_1.CredentialAiService,

package/dist/src/data-marts/data-storage-types/athena/adapters/athena-api.adapter.js

@@ -4,6 +4,7 @@ exports.AthenaApiAdapter = void 0;
 const common_1 = require("@nestjs/common");
 const client_athena_1 = require("@aws-sdk/client-athena");
 const athena_execution_parameters_utils_1 = require("./athena-execution-parameters.utils");
+const athena_output_location_util_1 = require("../utils/athena-output-location.util");
 class AthenaApiAdapter {
     static ATHENA_QUERY_ERROR_PREFIX = 'Query execution failed:';
     static DEFAULT_POLL_INTERVAL_MS = 1000;
@@ -23,7 +24,7 @@ class AthenaApiAdapter {
         const startQueryCommand = new client_athena_1.StartQueryExecutionCommand({
             QueryString: query,
             ResultConfiguration: {
-                OutputLocation: `s3://${outputBucket}/${outputPrefix}`,
+                OutputLocation: (0, athena_output_location_util_1.athenaOutputLocation)(outputBucket, outputPrefix).uri,
             },
             ExecutionParameters: (0, athena_execution_parameters_utils_1.toAthenaExecutionParameters)(params),
         });

package/dist/src/data-marts/data-storage-types/athena/adapters/s3-api.adapter.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.S3ApiAdapter = void 0;
 const common_1 = require("@nestjs/common");
 const client_s3_1 = require("@aws-sdk/client-s3");
+const athena_output_location_util_1 = require("../utils/athena-output-location.util");
 class S3ApiAdapter {
     logger = new common_1.Logger(S3ApiAdapter.name);
     s3Client;
@@ -21,10 +22,11 @@ class S3ApiAdapter {
             this.logger.debug('No output location to clean up');
             return;
         }
+        const { bucket, keyPrefix } = (0, athena_output_location_util_1.athenaOutputLocation)(outputBucket, outputPrefix);
         try {
             const listCommand = new client_s3_1.ListObjectsV2Command({
-                Bucket: outputBucket,
-                Prefix: outputPrefix,
+                Bucket: bucket,
+                Prefix: keyPrefix,
             });
             const listedObjects = await this.s3Client.send(listCommand);
             if (!listedObjects.Contents || listedObjects.Contents.length === 0) {
@@ -35,7 +37,7 @@ class S3ApiAdapter {
                 if (!object.Key)
                     continue;
                 const deleteCommand = new client_s3_1.DeleteObjectCommand({
-                    Bucket: outputBucket,
+                    Bucket: bucket,
                     Key: object.Key,
                 });
                 await this.s3Client.send(deleteCommand);

package/dist/src/data-marts/data-storage-types/athena/services/athena-access.validator.js

@@ -28,14 +28,12 @@ let AthenaAccessValidator = AthenaAccessValidator_1 = class AthenaAccessValidato
         const configOpt = athena_config_schema_1.AthenaConfigSchema.safeParse(config);
         if (!configOpt.success) {
             this.logger.warn('Invalid config', configOpt.error);
-            return new data_storage_access_validator_interface_1.ValidationResult(false, 'Invalid config', { errors: configOpt.error.errors });
+            return data_storage_access_validator_interface_1.ValidationResult.invalidInput('config', configOpt.error);
         }
         const credentialsOpt = athena_credentials_schema_1.AthenaCredentialsSchema.safeParse(credentials);
         if (!credentialsOpt.success) {
             this.logger.warn('Invalid credentials', credentialsOpt.error);
-            return new data_storage_access_validator_interface_1.ValidationResult(false, 'Invalid credentials', {
-                errors: credentialsOpt.error.errors,
-            });
+            return data_storage_access_validator_interface_1.ValidationResult.invalidInput('credentials', credentialsOpt.error);
         }
         const athenaConfig = configOpt.data;
         const apiAdapter = this.adapterFactory.create(credentialsOpt.data, athenaConfig);

package/dist/src/data-marts/data-storage-types/athena/utils/athena-output-location.util.d.ts

@@ -0,0 +1,5 @@
+export declare function athenaOutputLocation(outputBucket: string, outputPrefix: string): {
+    uri: string;
+    bucket: string;
+    keyPrefix: string;
+};

package/dist/src/data-marts/data-storage-types/athena/utils/athena-output-location.util.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.athenaOutputLocation = athenaOutputLocation;
+function athenaOutputLocation(outputBucket, outputPrefix) {
+    const location = `${outputBucket}/${outputPrefix}`;
+    const slash = location.indexOf('/');
+    return {
+        uri: `s3://${location}`,
+        bucket: location.slice(0, slash),
+        keyPrefix: location.slice(slash + 1),
+    };
+}
+//# sourceMappingURL=athena-output-location.util.js.map

package/dist/src/data-marts/data-storage-types/bigquery/services/bigquery-access.validator.js

@@ -37,7 +37,7 @@ let BigQueryAccessValidator = BigQueryAccessValidator_1 = class BigQueryAccessVa
         const configOpt = bigquery_config_schema_1.BigQueryConfigSchema.safeParse(config);
         if (!configOpt.success) {
             this.logger.warn('Invalid config', configOpt.error);
-            return new data_storage_access_validator_interface_1.ValidationResult(false, 'Invalid config', { errors: configOpt.error.errors });
+            return data_storage_access_validator_interface_1.ValidationResult.invalidInput('config', configOpt.error);
         }
         const bigQueryConfig = configOpt.data;
         if (credentials.type === bigquery_credentials_schema_1.BIGQUERY_OAUTH_TYPE) {
@@ -58,9 +58,7 @@ let BigQueryAccessValidator = BigQueryAccessValidator_1 = class BigQueryAccessVa
         const credentialsOpt = bigquery_credentials_schema_1.BigQueryServiceAccountCredentialsSchema.safeParse(credentials);
         if (!credentialsOpt.success) {
             this.logger.warn('Invalid credentials', credentialsOpt.error);
-            return new data_storage_access_validator_interface_1.ValidationResult(false, 'Invalid credentials', {
-                errors: credentialsOpt.error.errors,
-            });
+            return data_storage_access_validator_interface_1.ValidationResult.invalidInput('credentials', credentialsOpt.error);
         }
         const apiAdapter = new bigquery_api_adapter_1.BigQueryApiAdapter(credentialsOpt.data, bigQueryConfig);
         try {

package/dist/src/data-marts/data-storage-types/bigquery/services/bigquery-resource-location.util.d.ts

@@ -0,0 +1,3 @@
+import type { StorageResourceLeaf } from '../../interfaces/storage-resource-browser.interface';
+export declare function isOutsideStorageLocation(resourceLocation: string | undefined, storageLocation: string | undefined): boolean | undefined;
+export declare function flagLocationMismatches(leaves: StorageResourceLeaf[], storageLocation: string | undefined): StorageResourceLeaf[];

package/dist/src/data-marts/data-storage-types/bigquery/services/bigquery-resource-location.util.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isOutsideStorageLocation = isOutsideStorageLocation;
+exports.flagLocationMismatches = flagLocationMismatches;
+function isOutsideStorageLocation(resourceLocation, storageLocation) {
+    if (!resourceLocation || !storageLocation)
+        return undefined;
+    return resourceLocation.toLowerCase() !== storageLocation.toLowerCase();
+}
+function flagLocationMismatches(leaves, storageLocation) {
+    if (!storageLocation)
+        return leaves;
+    return leaves.map(leaf => {
+        const locationMismatch = isOutsideStorageLocation(leaf.location, storageLocation);
+        return locationMismatch === undefined ? leaf : { ...leaf, locationMismatch };
+    });
+}
+//# sourceMappingURL=bigquery-resource-location.util.js.map

package/dist/src/data-marts/data-storage-types/bigquery/services/bigquery-sharded-tables.util.d.ts

@@ -4,6 +4,7 @@ export interface RawTableListing {
     datasetId: string;
     type: 'TABLE' | 'VIEW';
     fullyQualifiedName: string;
+    location?: string;
 }
 export declare const GBQ_SHARD_SUFFIX_MIN_DIGITS = 4;
 export declare const GBQ_SHARD_SUFFIX_MAX_DIGITS = 8;

package/dist/src/data-marts/data-storage-types/bigquery/services/bigquery-sharded-tables.util.js

@@ -28,12 +28,13 @@ function buildWildcardRollups(rawTables, projectId) {
             groups.set(key, {
                 datasetId: t.datasetId,
                 prefix,
+                location: t.location,
                 shardIds: [shardKey],
             });
         }
     }
     const rollups = [];
-    for (const { datasetId, prefix, shardIds } of groups.values()) {
+    for (const { datasetId, prefix, location, shardIds } of groups.values()) {
         if (shardIds.length < exports.GBQ_MIN_SHARDS_FOR_WILDCARD)
             continue;
         const wildcardId = `${prefix}_*`;
@@ -43,6 +44,7 @@ function buildWildcardRollups(rawTables, projectId) {
                 groupId: datasetId,
                 type: 'TABLE',
                 fullyQualifiedName: `${projectId}.${datasetId}.${wildcardId}`,
+                ...(location ? { location } : {}),
             },
             shardIds,
         });
@@ -63,6 +65,7 @@ function applyResourceFilter(rawTables, projectId, filter) {
             groupId: t.datasetId,
             type: t.type,
             fullyQualifiedName: t.fullyQualifiedName,
+            ...(t.location ? { location: t.location } : {}),
         };
         if (t.type === 'VIEW') {
             viewLeaves.push(leaf);

package/dist/src/data-marts/data-storage-types/bigquery/services/bigquery-storage-resource-browser.service.js

@@ -20,6 +20,7 @@ const data_storage_credentials_resolver_service_1 = require("../../data-storage-
 const data_storage_type_enum_1 = require("../../enums/data-storage-type.enum");
 const bigquery_config_schema_1 = require("../schemas/bigquery-config.schema");
 const bigquery_credentials_schema_1 = require("../schemas/bigquery-credentials.schema");
+const bigquery_resource_location_util_1 = require("./bigquery-resource-location.util");
 const bigquery_sharded_tables_util_1 = require("./bigquery-sharded-tables.util");
 const GBQ_LIST_PAGE_SIZE = 500;
 const GBQ_LIST_RESULT_CAP = 2000;
@@ -48,7 +49,7 @@ let BigQueryStorageResourceBrowser = BigQueryStorageResourceBrowser_1 = class Bi
         const rawTables = await this.listTablesInProject(clients, namespaceId);
         this.logger.debug?.(`listLeafResources(${namespaceId}, ${filter ?? 'unfiltered'}): ` +
             `${rawTables.length} raw rows from BQ`);
-        const result = (0, bigquery_sharded_tables_util_1.applyResourceFilter)(rawTables, namespaceId, filter);
+        const result = (0, bigquery_resource_location_util_1.flagLocationMismatches)((0, bigquery_sharded_tables_util_1.applyResourceFilter)(rawTables, namespaceId, filter), clients.location);
         this.logger.debug?.(`listLeafResources(${namespaceId}, ${filter ?? 'unfiltered'}): ` +
             `${result.length} leaves after wildcard collapsing`);
         return result;
@@ -144,11 +145,11 @@ let BigQueryStorageResourceBrowser = BigQueryStorageResourceBrowser_1 = class Bi
             .map(dataset => {
             const metadata = (dataset.metadata ?? {});
             const id = dataset.id ?? metadata.datasetReference?.datasetId ?? '';
-            return { id, location: dataset.location ?? metadata.location };
+            return { id, location: metadata.location };
         })
             .filter(dataset => dataset.id);
     }
-    async listTables(clients, projectId, datasetId) {
+    async listTables(clients, projectId, { id: datasetId, location }) {
         const bq = this.cloneForProject(clients, projectId);
         const [tables] = await bq
             .dataset(datasetId, { projectId })
@@ -160,7 +161,13 @@ let BigQueryStorageResourceBrowser = BigQueryStorageResourceBrowser_1 = class Bi
             const id = table.id ?? metadata.tableReference?.tableId ?? '';
             const rawType = metadata.type;
             const type = rawType === 'VIEW' || rawType === 'MATERIALIZED_VIEW' ? 'VIEW' : 'TABLE';
-            return { id, datasetId, type, fullyQualifiedName: `${projectId}.${datasetId}.${id}` };
+            return {
+                id,
+                datasetId,
+                type,
+                fullyQualifiedName: `${projectId}.${datasetId}.${id}`,
+                location,
+            };
         })
             .filter(table => table.id);
     }
@@ -179,7 +186,7 @@ let BigQueryStorageResourceBrowser = BigQueryStorageResourceBrowser_1 = class Bi
                 break;
             }
             const batch = datasets.slice(i, i + GBQ_PROJECT_FANOUT_CONCURRENCY);
-            const settled = await Promise.allSettled(batch.map(dataset => (0, promise_util_1.raceWithTimeout)(this.listTables(clients, projectId, dataset.id), GBQ_PROJECT_TABLES_PER_DATASET_TIMEOUT_MS, `listTables ${projectId}.${dataset.id}`)));
+            const settled = await Promise.allSettled(batch.map(dataset => (0, promise_util_1.raceWithTimeout)(this.listTables(clients, projectId, dataset), GBQ_PROJECT_TABLES_PER_DATASET_TIMEOUT_MS, `listTables ${projectId}.${dataset.id}`)));
             for (const outcome of settled) {
                 if (outcome.status === 'fulfilled') {
                     for (const table of outcome.value) {

package/dist/src/data-marts/data-storage-types/databricks/services/databricks-access.validator.js

@@ -28,14 +28,12 @@ let DatabricksAccessValidator = DatabricksAccessValidator_1 = class DatabricksAc
         const configOpt = databricks_config_schema_1.DatabricksConfigSchema.safeParse(config);
         if (!configOpt.success) {
             this.logger.log('Invalid config', configOpt.error);
-            return new data_storage_access_validator_interface_1.ValidationResult(false, 'Invalid config', { errors: configOpt.error.errors });
+            return data_storage_access_validator_interface_1.ValidationResult.invalidInput('config', configOpt.error);
         }
         const credentialsOpt = databricks_credentials_schema_1.DatabricksCredentialsSchema.safeParse(credentials);
         if (!credentialsOpt.success) {
             this.logger.log('Invalid credentials', credentialsOpt.error);
-            return new data_storage_access_validator_interface_1.ValidationResult(false, 'Invalid credentials', {
-                errors: credentialsOpt.error.errors,
-            });
+            return data_storage_access_validator_interface_1.ValidationResult.invalidInput('credentials', credentialsOpt.error);
         }
         const apiAdapter = this.adapterFactory.create(credentialsOpt.data, configOpt.data);
         try {

package/dist/src/data-marts/data-storage-types/interfaces/data-storage-access-validator.interface.d.ts

@@ -1,4 +1,6 @@
+import { ZodError } from 'zod';
 import { TypedComponent } from '../../../common/resolver/typed-component.resolver';
+import { FieldErrorScope } from '../../utils/field-errors.utils';
 import { DataStorageType } from '../enums/data-storage-type.enum';
 import { DataStorageConfig } from '../data-storage-config.type';
 import { DataStorageCredentials } from '../data-storage-credentials.type';
@@ -17,6 +19,7 @@ export declare class ValidationResult {
     constructor(valid: boolean, errorMessage?: string | undefined, reason?: Record<string, unknown> | undefined, code?: ValidationResultCode | undefined);
     static success(): ValidationResult;
     static failure(errorMessage?: string, reason?: Record<string, unknown>): ValidationResult;
+    static invalidInput(scope: FieldErrorScope, error: ZodError): ValidationResult;
     static unconfigured(errorMessage: string): ValidationResult;
     static oauthReauthRequired(errorMessage: string): ValidationResult;
 }

package/dist/src/data-marts/data-storage-types/interfaces/data-storage-access-validator.interface.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ValidationResult = exports.ValidationResultCode = void 0;
+const field_errors_utils_1 = require("../../utils/field-errors.utils");
 var ValidationResultCode;
 (function (ValidationResultCode) {
     ValidationResultCode["UNCONFIGURED"] = "UNCONFIGURED";
@@ -23,6 +24,12 @@ class ValidationResult {
     static failure(errorMessage, reason) {
         return new ValidationResult(false, errorMessage, reason);
     }
+    static invalidInput(scope, error) {
+        return new ValidationResult(false, (0, field_errors_utils_1.describeInvalidInput)(scope, error), {
+            errors: (0, field_errors_utils_1.sanitizeIssues)(error.errors),
+            fieldErrors: (0, field_errors_utils_1.toFieldErrors)(scope, error),
+        });
+    }
     static unconfigured(errorMessage) {
         return new ValidationResult(false, errorMessage, undefined, ValidationResultCode.UNCONFIGURED);
     }

package/dist/src/data-marts/data-storage-types/interfaces/storage-resource-browser.interface.d.ts

@@ -9,6 +9,8 @@ export interface StorageResourceLeaf extends StorageResourceNode {
     groupId: string;
     type: 'TABLE' | 'VIEW';
     fullyQualifiedName: string;
+    location?: string;
+    locationMismatch?: boolean;
 }
 export type StorageResourceFilter = 'TABLE' | 'VIEW' | 'TABLE_PATTERN';
 export interface IStorageResourceBrowserProvider extends TypedComponent<DataStorageType> {

package/dist/src/data-marts/data-storage-types/redshift/services/redshift-access.validator.js

@@ -25,15 +25,11 @@ let RedshiftAccessValidator = class RedshiftAccessValidator {
     async validate(config, credentials) {
         const configResult = redshift_config_schema_1.RedshiftConfigSchema.safeParse(config);
         if (!configResult.success) {
-            return new data_storage_access_validator_interface_1.ValidationResult(false, 'Invalid config', {
-                errors: configResult.error.errors,
-            });
+            return data_storage_access_validator_interface_1.ValidationResult.invalidInput('config', configResult.error);
         }
         const credentialsResult = redshift_credentials_schema_1.RedshiftCredentialsSchema.safeParse(credentials);
         if (!credentialsResult.success) {
-            return new data_storage_access_validator_interface_1.ValidationResult(false, 'Invalid credentials', {
-                errors: credentialsResult.error.errors,
-            });
+            return data_storage_access_validator_interface_1.ValidationResult.invalidInput('credentials', credentialsResult.error);
         }
         const adapter = this.adapterFactory.create(credentialsResult.data, configResult.data);
         try {