Skip to content

Commit edab26d

Browse files
hivanalejandrohivanalejandro
committed
chore(bigquery): testing, stylistic update
1 parent 3d5dde6 commit edab26d

File tree

4 files changed

+198
-287
lines changed

4 files changed

+198
-287
lines changed

‎bigquery/cloud-client/revokeDatasetAccess.js‎

Lines changed: 33 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -14,78 +14,54 @@
1414

1515
'use strict';
1616

17-
/**
18-
* Revokes access to a dataset for a specified entity.
19-
*
20-
* @param {string} datasetId ID of the dataset to revoke access to.
21-
* @param {string} entityId ID of the user or group from whom you are revoking access.
22-
* Alternatively, the JSON REST API representation of the entity,
23-
* such as a view's table reference.
24-
* @returns {Promise<Array>} A promise that resolves to the updated access entries.
25-
*/
26-
async function revokeDatasetAccess(datasetId, entityId) {
17+
async function main(datasetId, entityId) {
2718
// [START bigquery_revoke_dataset_access]
28-
const {BigQuery} = require('@google-cloud/bigquery');
29-
30-
// Define enum for HTTP codes.
31-
const HTTP_STATUS = {
32-
PRECONDITION_FAILED: 412,
33-
};
3419

35-
// TODO (developer): Update and un-comment below lines.
20+
/**
21+
* TODO(developer): Update and un-comment below lines
22+
*/
3623

37-
// ID of the dataset to revoke access to.
38-
// datasetId = "my_project.my_dataset"
24+
// const datasetId = "my_project_id.my_dataset"
3925

4026
// ID of the user or group from whom you are revoking access.
41-
// Alternatively, the JSON REST API representation of the entity,
42-
// such as a view's table reference.
43-
// entityId = "[email protected]"
27+
// const entityId = "[email protected]"
28+
29+
const {BigQuery} = require('@google-cloud/bigquery');
4430

4531
// Instantiate a client.
4632
const bigquery = new BigQuery();
4733

48-
// Get a reference to the dataset.
49-
const [dataset] = await bigquery.dataset(datasetId).get();
34+
async function revokeDatasetAccess() {
35+
const [dataset] = await bigquery.dataset(datasetId).get();
5036

51-
// To revoke access to a dataset, remove elements from the access array.
52-
//
53-
// See the BigQuery client library documentation for more details on access entries:
54-
// https://cloud.google.com/nodejs/docs/reference/secret-manager/4.1.4
37+
// To revoke access to a dataset, remove elements from the access list.
38+
//
39+
// See the BigQuery client library documentation for more details on access entries:
40+
// https://cloud.google.com/nodejs/docs/reference/bigquery/latest
5541

56-
// Filter access entries to exclude entries matching the specified entity_id
57-
// and assign a new array back to the access array.
58-
dataset.metadata.access = dataset.metadata.access.filter(entry => {
59-
// Return false (remove entry) if any of these fields match entityId.
60-
return !(
61-
entry.entity_id === entityId ||
62-
entry.userByEmail === entityId ||
63-
entry.groupByEmail === entityId
64-
);
65-
});
42+
// Filter access entries to exclude entries matching the specified entity_id
43+
// and assign a new list back to the access list.
44+
dataset.metadata.access = dataset.metadata.access.filter(entry => {
45+
return !(
46+
entry.entity_id === entityId ||
47+
entry.userByEmail === entityId ||
48+
entry.groupByEmail === entityId
49+
);
50+
});
6651

67-
// Update will only succeed if the dataset
68-
// has not been modified externally since retrieval.
52+
// Update will only succeed if the dataset
53+
// has not been modified externally since retrieval.
54+
//
55+
// See the BigQuery client library documentation for more details on metadata updates:
56+
// https://cloud.google.com/bigquery/docs/updating-datasets
6957

70-
try {
71-
// Update just the access entries property of the dataset.
72-
const [updatedDataset] = await dataset.setMetadata(dataset.metadata);
58+
// Update just the 'access entries' property of the dataset.
59+
await dataset.setMetadata(dataset.metadata);
7360

74-
return updatedDataset.access;
75-
} catch (error) {
76-
// Check if it's a precondition failed error (a read-modify-write error).
77-
if (error.code === HTTP_STATUS.PRECONDITION_FAILED) {
78-
console.log(
79-
`Dataset '${dataset.id}' was modified remotely before this update. ` +
80-
'Fetch the latest version and retry.'
81-
);
82-
} else {
83-
throw error;
84-
}
61+
console.log(`Revoked access to '${entityId}' from '${datasetId}'.`);
8562
}
8663
// [END bigquery_revoke_dataset_access]
64+
await revokeDatasetAccess();
8765
}
8866

89-
module.exports = {
90-
revokeDatasetAccess,
91-
};
67+
exports.revokeDatasetAccess = main;

‎bigquery/cloud-client/revokeTableOrViewAccess.js‎

Lines changed: 67 additions & 77 deletions
Original file line numberDiff line numberDiff line change
@@ -14,106 +14,96 @@
1414

1515
'use strict';
1616

17-
/**
18-
* Revokes access to a BigQuery table or view.
19-
* @param {string} projectId The ID of the Google Cloud project.
20-
* @param {string} datasetId The ID of the dataset containing the table/view.
21-
* @param {string} resourceName The ID of the table or view.
22-
* @param {string} [roleToRemove=null] Optional. Specific role to revoke.
23-
* @param {string} [principalToRemove=null] Optional. Specific principal to revoke access from.
24-
* @returns {Promise<Array>} The updated IAM policy.
25-
*/
26-
async function revokeAccessToTableOrView(
17+
async function main(
2718
projectId,
2819
datasetId,
29-
resourceName,
20+
tableId,
3021
roleToRemove = null,
3122
principalToRemove = null
3223
) {
3324
// [START bigquery_revoke_access_to_table_or_view]
34-
const {BigQuery} = require('@google-cloud/bigquery');
35-
36-
// TODO (developer): Update and un-comment below lines.
37-
38-
// Google Cloud Platform project.
39-
// projectId = "my_project_id"
40-
41-
// Dataset where the table or view is.
42-
// datasetId = "my_dataset_id"
43-
44-
// Table or view name to get the access policy.
45-
// resourceName = "my_table_id"
4625

47-
// (Optional) Role to remove from the table or view.
48-
// roleToRemove = "roles/bigquery.dataViewer"
26+
/**
27+
* TODO(developer): Update and un-comment below lines
28+
*/
29+
// const projectId = "YOUR_PROJECT_ID"
30+
// const datasetId = "YOUR_DATASET_ID"
31+
// const tableId = "YOUR_TABLE_ID"
32+
// const roleToRemove = "YOUR_ROLE"
33+
// const principalToRemove = "YOUR_PRINCIPAL_ID"
4934

50-
// (Optional) Principal to remove from the table or view.
51-
// principalToRemove = "user:[email protected]"
52-
53-
// Find more information about roles and principals (refered as members) here:
54-
// https://cloud.google.com/security-command-center/docs/reference/rest/Shared.Types/Binding
35+
const {BigQuery} = require('@google-cloud/bigquery');
5536

5637
// Instantiate a client.
5738
const client = new BigQuery();
5839

59-
// Get a reference to the dataset by datasetId.
60-
const dataset = client.dataset(datasetId);
61-
// Get a reference to the table by tableName.
62-
const table = dataset.table(resourceName);
63-
64-
// Get the IAM access policy for the table or view.
65-
const [policy] = await table.getIamPolicy();
66-
67-
// Initialize bindings array.
68-
if (!policy.bindings) {
69-
policy.bindings = [];
70-
}
71-
72-
// To revoke access to a table or view,
73-
// remove bindings from the Table or View policy.
74-
//
75-
// Find more details about Policy objects here:
76-
// https://cloud.google.com/security-command-center/docs/reference/rest/Shared.Types/Policy
40+
async function revokeAccessToTableOrView() {
41+
const dataset = client.dataset(datasetId);
42+
const table = dataset.table(tableId);
7743

78-
if (roleToRemove) {
79-
// Filter out all bindings with the `roleToRemove`
80-
// and assign a new array back to the policy bindings.
81-
policy.bindings = policy.bindings.filter(b => b.role !== roleToRemove);
82-
}
44+
// Get the IAM access policy for the table or view.
45+
const [policy] = await table.getIamPolicy();
8346

84-
if (principalToRemove) {
85-
// The `bindings` array is immutable. Create a copy for modifications.
86-
const bindings = [...policy.bindings];
47+
// Initialize bindings array.
48+
if (!policy.bindings) {
49+
policy.bindings = [];
50+
}
8751

88-
// Filter out the principal from each binding.
89-
for (const binding of bindings) {
90-
if (binding.members) {
91-
binding.members = binding.members.filter(m => m !== principalToRemove);
52+
// To revoke access to a table or view,
53+
// remove bindings from the Table or View policy.
54+
//
55+
// Find more details about Policy objects here:
56+
// https://cloud.google.com/security-command-center/docs/reference/rest/Shared.Types/Policy
57+
58+
if (principalToRemove) {
59+
// Create a copy of bindings for modifications.
60+
const bindings = [...policy.bindings];
61+
62+
// Filter out the principal from each binding.
63+
for (const binding of bindings) {
64+
if (binding.members) {
65+
binding.members = binding.members.filter(
66+
m => m !== principalToRemove
67+
);
68+
}
9269
}
70+
71+
// Filter out bindings with empty members.
72+
policy.bindings = bindings.filter(
73+
binding => binding.members && binding.members.length > 0
74+
);
9375
}
9476

95-
// Filter out bindings with empty members.
96-
policy.bindings = bindings.filter(
97-
binding => binding.members && binding.members.length > 0
98-
);
99-
}
77+
if (roleToRemove) {
78+
// Filter out all bindings with the roleToRemove
79+
// and assign a new list back to the policy bindings.
80+
policy.bindings = policy.bindings.filter(b => b.role !== roleToRemove);
81+
}
10082

101-
try {
10283
// Set the IAM access policy with updated bindings.
10384
await table.setIamPolicy(policy);
10485

105-
// Get the policy again to confirm it's set correctly.
106-
const [verifiedPolicy] = await table.getIamPolicy();
107-
108-
// Return the updated policy bindings.
109-
return verifiedPolicy && verifiedPolicy.bindings
110-
? verifiedPolicy.bindings
111-
: [];
112-
} catch (error) {
113-
console.error('Error settings IAM policy:', error);
114-
throw error;
86+
// Create a descriptive message based on what was actually removed
87+
if (roleToRemove && principalToRemove) {
88+
console.log(
89+
`Role '${roleToRemove}' revoked for principal '${principalToRemove}' on resource '${datasetId}.${tableId}'.`
90+
);
91+
} else if (roleToRemove) {
92+
console.log(
93+
`Role '${roleToRemove}' revoked for all principals on resource '${datasetId}.${tableId}'.`
94+
);
95+
} else if (principalToRemove) {
96+
console.log(
97+
`Access revoked for principal '${principalToRemove}' on resource '${datasetId}.${tableId}'.`
98+
);
99+
} else {
100+
console.log(
101+
`No changes made to access policy for '${datasetId}.${tableId}'.`
102+
);
103+
}
115104
}
116105
// [END bigquery_revoke_access_to_table_or_view]
106+
await revokeAccessToTableOrView();
117107
}
118108

119-
module.exports = {revokeAccessToTableOrView};
109+
exports.revokeAccessToTableOrView = main;

0 commit comments

Comments
 (0)