Extract the BigQuery observer probe out of google.ts - #372
Draft
Maximo-Guk wants to merge 2 commits into
Draft
Conversation
Preview:
|
Maximo-Guk
force-pushed
the
restricted-data-followups
branch
from
August 28, 2026 01:52
0be8366 to
97da468
Compare
Maximo-Guk
force-pushed
the
restricted-data-bigquery
branch
from
August 28, 2026 02:01
27034aa to
50a5904
Compare
hasDatasetAccess passes on any 2xx from datasets.get, which requires only bigquery.datasets.get -- dataset *metadata* access (e.g. roles/bigquery.metadataViewer). It proves neither bigquery.tables.getData on the tables the workspace's queries actually read, nor row-level security, nor column policy tags, so an observer admitted by this probe may see query rows they could not query themselves. Decision: document only, no behavior change. Record the limitation and the tightening direction (per-table tracking via the dry-run's referencedTables, which is already in hand at both query call sites but currently reduced to dataset prefixes, plus a table-data probe) at the probe, in the observers decision table, and in the user-facing README. Full row/column-policy parity is unprovable via any Google API regardless: row-level security filters rows without ever denying access. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A table-free SELECT (`SELECT SESSION_USER()`, `@@project_id`) dry-runs with empty referencedTables, was allowed for project-only scope, tracked zero datasets, and executed with the owner's token -- returning owner/session context no dataset probe can verify an observer against. An empty tracked set admits any verifier without a single probe. INFORMATION_SCHEMA reads that dry-run with empty refs rode the same path. now refuses empty referencedTables on every binding shape, with a message pointing the agent at gadget code for table-free computations. The scalar-function-with-a-table variant (SELECT SESSION_USER() FROM t LIMIT 1) is unfixable at the referencedTables level and is documented as part of the existing metadata-class residual. BigQuerySessionImpl moves to its own module so Node vitest can construct it directly (google.ts imports workerd-only modules and bundled assets); the tests stub `cloudflare:workers` and `capnweb-validate`, the same pattern as mcp-shared. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Maximo-Guk
force-pushed
the
restricted-data-followups
branch
from
August 28, 2026 20:16
97da468 to
85082a7
Compare
Maximo-Guk
force-pushed
the
restricted-data-bigquery
branch
from
August 28, 2026 20:16
50a5904 to
8f18b17
Compare
|
LGTM! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
WIP