Skip to content
This repository was archived by the owner on Mar 4, 2026. It is now read-only.

Commit 0a394df

Browse files
asthamohtagcf-owl-bot[bot]surbhigarg92
authored
feat: fgac support and samples (#1751)
* ore: tag changes * changes * linting * fixing tests * fixing tests * skipping fgac tests for emulator * changes * changes * changes * changes * 🦉 Updates from OwlBot post-processor See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md * Update spanner.ts * Update database.ts Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com> Co-authored-by: surbhigarg92 <surbhigarg.92@gmail.com>
1 parent 844f57f commit 0a394df

13 files changed

Lines changed: 1316 additions & 12 deletions

‎README.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,7 @@ Samples are in the [`samples/`](https://github.com/googleapis/nodejs-spanner/tre
8989

9090
| Sample | Source Code | Try it |
9191
| --------------------------- | --------------------------------- | ------ |
92+
| Add and drop new database role | [source code](https://github.com/googleapis/nodejs-spanner/blob/main/samples/add-and-drop-new-database-role.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-spanner&page=editor&open_in_editor=samples/add-and-drop-new-database-role.js,samples/README.md) |
9293
| Backups-cancel | [source code](https://github.com/googleapis/nodejs-spanner/blob/main/samples/backups-cancel.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-spanner&page=editor&open_in_editor=samples/backups-cancel.js,samples/README.md) |
9394
| Copies a source backup | [source code](https://github.com/googleapis/nodejs-spanner/blob/main/samples/backups-copy.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-spanner&page=editor&open_in_editor=samples/backups-copy.js,samples/README.md) |
9495
| Backups-create-with-encryption-key | [source code](https://github.com/googleapis/nodejs-spanner/blob/main/samples/backups-create-with-encryption-key.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-spanner&page=editor&open_in_editor=samples/backups-create-with-encryption-key.js,samples/README.md) |
@@ -111,7 +112,9 @@ Samples are in the [`samples/`](https://github.com/googleapis/nodejs-spanner/tre
111112
| Updates the default leader of an existing database | [source code](https://github.com/googleapis/nodejs-spanner/blob/main/samples/database-update-default-leader.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-spanner&page=editor&open_in_editor=samples/database-update-default-leader.js,samples/README.md) |
112113
| Datatypes | [source code](https://github.com/googleapis/nodejs-spanner/blob/main/samples/datatypes.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-spanner&page=editor&open_in_editor=samples/datatypes.js,samples/README.md) |
113114
| DML | [source code](https://github.com/googleapis/nodejs-spanner/blob/main/samples/dml.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-spanner&page=editor&open_in_editor=samples/dml.js,samples/README.md) |
115+
| Enable fine grained access control | [source code](https://github.com/googleapis/nodejs-spanner/blob/main/samples/enable-fine-grained-access.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-spanner&page=editor&open_in_editor=samples/enable-fine-grained-access.js,samples/README.md) |
114116
| Get-commit-stats | [source code](https://github.com/googleapis/nodejs-spanner/blob/main/samples/get-commit-stats.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-spanner&page=editor&open_in_editor=samples/get-commit-stats.js,samples/README.md) |
117+
| List database roles | [source code](https://github.com/googleapis/nodejs-spanner/blob/main/samples/get-database-roles.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-spanner&page=editor&open_in_editor=samples/get-database-roles.js,samples/README.md) |
115118
| Gets the instance config metadata for the configuration nam6 | [source code](https://github.com/googleapis/nodejs-spanner/blob/main/samples/get-instance-config.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-spanner&page=editor&open_in_editor=samples/get-instance-config.js,samples/README.md) |
116119
| Creates a new value-storing index | [source code](https://github.com/googleapis/nodejs-spanner/blob/main/samples/index-create-storing.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-spanner&page=editor&open_in_editor=samples/index-create-storing.js,samples/README.md) |
117120
| Creates a new index | [source code](https://github.com/googleapis/nodejs-spanner/blob/main/samples/index-create.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-spanner&page=editor&open_in_editor=samples/index-create.js,samples/README.md) |
@@ -153,6 +156,7 @@ Samples are in the [`samples/`](https://github.com/googleapis/nodejs-spanner/tre
153156
| Query the information schema metadata in a Spanner PostgreSQL database. | [source code](https://github.com/googleapis/nodejs-spanner/blob/main/samples/pg-schema-information.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-spanner&page=editor&open_in_editor=samples/pg-schema-information.js,samples/README.md) |
154157
| Queryoptions | [source code](https://github.com/googleapis/nodejs-spanner/blob/main/samples/queryoptions.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-spanner&page=editor&open_in_editor=samples/queryoptions.js,samples/README.md) |
155158
| Quickstart | [source code](https://github.com/googleapis/nodejs-spanner/blob/main/samples/quickstart.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-spanner&page=editor&open_in_editor=samples/quickstart.js,samples/README.md) |
159+
| Read data with database role | [source code](https://github.com/googleapis/nodejs-spanner/blob/main/samples/read-data-with-database-role.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-spanner&page=editor&open_in_editor=samples/read-data-with-database-role.js,samples/README.md) |
156160
| Sets a request tag for a single query | [source code](https://github.com/googleapis/nodejs-spanner/blob/main/samples/request-tag.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-spanner&page=editor&open_in_editor=samples/request-tag.js,samples/README.md) |
157161
| Run Batch update with RPC priority | [source code](https://github.com/googleapis/nodejs-spanner/blob/main/samples/rpc-priority-batch-dml.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-spanner&page=editor&open_in_editor=samples/rpc-priority-batch-dml.js,samples/README.md) |
158162
| Run partitioned update with RPC priority | [source code](https://github.com/googleapis/nodejs-spanner/blob/main/samples/rpc-priority-partitioned-dml.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-spanner&page=editor&open_in_editor=samples/rpc-priority-partitioned-dml.js,samples/README.md) |

‎samples/README.md‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ and automatic, synchronous replication for high availability.
1414

1515
* [Before you begin](#before-you-begin)
1616
* [Samples](#samples)
17+
* [Add and drop new database role](#add-and-drop-new-database-role)
1718
* [Backups-cancel](#backups-cancel)
1819
* [Copies a source backup](#copies-a-source-backup)
1920
* [Backups-create-with-encryption-key](#backups-create-with-encryption-key)
@@ -36,7 +37,9 @@ and automatic, synchronous replication for high availability.
3637
* [Updates the default leader of an existing database](#updates-the-default-leader-of-an-existing-database)
3738
* [Datatypes](#datatypes)
3839
* [DML](#dml)
40+
* [Enable fine grained access control](#enable-fine-grained-access-control)
3941
* [Get-commit-stats](#get-commit-stats)
42+
* [List database roles](#list-database-roles)
4043
* [Gets the instance config metadata for the configuration nam6](#gets-the-instance-config-metadata-for-the-configuration-nam6)
4144
* [Creates a new value-storing index](#creates-a-new-value-storing-index)
4245
* [Creates a new index](#creates-a-new-index)
@@ -78,6 +81,7 @@ and automatic, synchronous replication for high availability.
7881
* [Query the information schema metadata in a Spanner PostgreSQL database.](#query-the-information-schema-metadata-in-a-spanner-postgresql-database.)
7982
* [Queryoptions](#queryoptions)
8083
* [Quickstart](#quickstart)
84+
* [Read data with database role](#read-data-with-database-role)
8185
* [Sets a request tag for a single query](#sets-a-request-tag-for-a-single-query)
8286
* [Run Batch update with RPC priority](#run-batch-update-with-rpc-priority)
8387
* [Run partitioned update with RPC priority](#run-partitioned-update-with-rpc-priority)
@@ -106,6 +110,23 @@ Before running the samples, make sure you've followed the steps outlined in
106110

107111

108112

113+
### Add and drop new database role
114+
115+
View the [source code](https://github.com/googleapis/nodejs-spanner/blob/main/samples/add-and-drop-new-database-role.js).
116+
117+
[![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-spanner&page=editor&open_in_editor=samples/add-and-drop-new-database-role.js,samples/README.md)
118+
119+
__Usage:__
120+
121+
122+
`node add-and-drop-new-database-role.js <INSTANCE_ID> <DATABASE_ID> <PROJECT_ID>`
123+
124+
125+
-----
126+
127+
128+
129+
109130
### Backups-cancel
110131

111132
View the [source code](https://github.com/googleapis/nodejs-spanner/blob/main/samples/backups-cancel.js).
@@ -480,6 +501,23 @@ __Usage:__
480501

481502

482503

504+
### Enable fine grained access control
505+
506+
View the [source code](https://github.com/googleapis/nodejs-spanner/blob/main/samples/enable-fine-grained-access.js).
507+
508+
[![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-spanner&page=editor&open_in_editor=samples/enable-fine-grained-access.js,samples/README.md)
509+
510+
__Usage:__
511+
512+
513+
`node enable-fine-grained-access.js <INSTANCE_ID> <DATABASE_ID> <PROJECT_ID>`
514+
515+
516+
-----
517+
518+
519+
520+
483521
### Get-commit-stats
484522

485523
View the [source code](https://github.com/googleapis/nodejs-spanner/blob/main/samples/get-commit-stats.js).
@@ -497,6 +535,23 @@ __Usage:__
497535

498536

499537

538+
### List database roles
539+
540+
View the [source code](https://github.com/googleapis/nodejs-spanner/blob/main/samples/get-database-roles.js).
541+
542+
[![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-spanner&page=editor&open_in_editor=samples/get-database-roles.js,samples/README.md)
543+
544+
__Usage:__
545+
546+
547+
`node get-database-roles.js <INSTANCE_ID> <DATABASE_ID> <PROJECT_ID>`
548+
549+
550+
-----
551+
552+
553+
554+
500555
### Gets the instance config metadata for the configuration nam6
501556

502557
View the [source code](https://github.com/googleapis/nodejs-spanner/blob/main/samples/get-instance-config.js).
@@ -1194,6 +1249,23 @@ __Usage:__
11941249

11951250

11961251

1252+
### Read data with database role
1253+
1254+
View the [source code](https://github.com/googleapis/nodejs-spanner/blob/main/samples/read-data-with-database-role.js).
1255+
1256+
[![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-spanner&page=editor&open_in_editor=samples/read-data-with-database-role.js,samples/README.md)
1257+
1258+
__Usage:__
1259+
1260+
1261+
`node read-data-with-database-role.js <INSTANCE_ID> <DATABASE_ID> <PROJECT_ID>`
1262+
1263+
1264+
-----
1265+
1266+
1267+
1268+
11971269
### Sets a request tag for a single query
11981270

11991271
View the [source code](https://github.com/googleapis/nodejs-spanner/blob/main/samples/request-tag.js).

‎samples/add-and-drop-new-database-role.js‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
// Copyright 2022 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
// sample-metadata:
16+
// title: Add and drop new database role
17+
// usage: node add-and-drop-new-database-role.js <INSTANCE_ID> <DATABASE_ID> <PROJECT_ID>
18+
19+
'use strict';
20+
21+
function main(
22+
instanceId = 'my-instance',
23+
databaseId = 'my-database',
24+
projectId = 'my-project-id'
25+
) {
26+
// [START spanner_add_and_drop_new_database]
27+
/**
28+
* TODO(developer): Uncomment these variables before running the sample.
29+
*/
30+
// const instanceId = 'my-instance';
31+
// const databaseId = 'my-database';
32+
// const projectId = 'my-project-id';
33+
// Imports the Google Cloud Spanner client library
34+
const {Spanner} = require('@google-cloud/spanner');
35+
36+
// Instantiates a client
37+
const spanner = new Spanner({
38+
projectId: projectId,
39+
});
40+
41+
async function addAndDropNewDatabaseRole() {
42+
// Gets a reference to a Cloud Spanner instance and database.
43+
const instance = spanner.instance(instanceId);
44+
const database = instance.database(databaseId);
45+
46+
// Creates a new user defined role and grant permissions
47+
try {
48+
const request = [
49+
'CREATE ROLE parent',
50+
'GRANT SELECT ON TABLE Singers TO ROLE parent',
51+
'CREATE ROLE child',
52+
'GRANT ROLE parent TO ROLE child',
53+
];
54+
const [operation] = await database.updateSchema(request);
55+
56+
console.log('Waiting for operation to complete...');
57+
await operation.promise();
58+
59+
console.log('Created roles child and parent and granted privileges');
60+
} catch (err) {
61+
console.error('ERROR:', err);
62+
}
63+
64+
// Revoke permissions and drop child role.
65+
// A role can't be dropped until all its permissions are revoked.
66+
try {
67+
const request = ['REVOKE ROLE parent FROM ROLE child', 'DROP ROLE child'];
68+
const [operation] = await database.updateSchema(request);
69+
70+
console.log('Waiting for operation to complete...');
71+
await operation.promise();
72+
73+
console.log('Revoked privileges and dropped role child');
74+
} catch (err) {
75+
console.error('ERROR:', err);
76+
} finally {
77+
// Close the database when finished.
78+
await database.close();
79+
}
80+
}
81+
addAndDropNewDatabaseRole();
82+
// [END spanner_add_and_drop_new_database]
83+
}
84+
85+
process.on('unhandledRejection', err => {
86+
console.error(err.message);
87+
process.exitCode = 1;
88+
});
89+
main(...process.argv.slice(2));

‎samples/enable-fine-grained-access.js‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
// Copyright 2022 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
// sample-metadata:
16+
// title: Enable fine grained access control
17+
// usage: node enable-fine-grained-access.js <INSTANCE_ID> <DATABASE_ID> <PROJECT_ID>
18+
19+
'use strict';
20+
21+
function main(
22+
instanceId = 'my-instance',
23+
databaseId = 'my-database',
24+
projectId = 'my-project-id',
25+
iamMember = 'user:alice@example.com',
26+
databaseRole = 'parent',
27+
title = 'condition title'
28+
) {
29+
// [START spanner_enable_fine_grained_access]
30+
/**
31+
* TODO(developer): Uncomment these variables before running the sample.
32+
*/
33+
// const instanceId = 'my-instance';
34+
// const databaseId = 'my-database';
35+
// const projectId = 'my-project-id';
36+
// iamMember = 'user:alice@example.com';
37+
// databaseRole = 'parent';
38+
// title = 'condition title';
39+
// Imports the Google Cloud Spanner client library
40+
const {Spanner} = require('@google-cloud/spanner');
41+
42+
// Instantiates a client
43+
const spanner = new Spanner({
44+
projectId: projectId,
45+
});
46+
47+
async function enableFineGrainedAccess() {
48+
// Gets a reference to a Cloud Spanner instance and database.
49+
const instance = spanner.instance(instanceId);
50+
const database = instance.database(databaseId);
51+
52+
const [policy] = await database.getIamPolicy({requestedPolicyVersion: 3});
53+
if (policy.version < 3) {
54+
policy.version = 3;
55+
}
56+
57+
const newBinding = {
58+
role: 'roles/spanner.fineGrainedAccessUser',
59+
members: [`user:${iamMember}`],
60+
condition: {
61+
title: title,
62+
expression: `resource.name.endsWith("/databaseRoles/${databaseRole}")`,
63+
},
64+
};
65+
policy.bindings.push(newBinding);
66+
await database.setIamPolicy({policy: policy});
67+
// Requested Policy Version is Optional. The maximum policy version that will be used to format the policy.
68+
// Valid values are 0, 1, and 3. Requests specifying an invalid value will be rejected.
69+
const newPolicy = await database.getIamPolicy({requestedPolicyVersion: 3});
70+
console.log(newPolicy);
71+
}
72+
enableFineGrainedAccess();
73+
// [END spanner_enable_fine_grained_access]
74+
}
75+
76+
process.on('unhandledRejection', err => {
77+
console.error(err.message);
78+
process.exitCode = 1;
79+
});
80+
main(...process.argv.slice(2));

‎samples/get-database-roles.js‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
// Copyright 2022 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
// sample-metadata:
16+
// title: List database roles
17+
// usage: node get-database-roles.js <INSTANCE_ID> <DATABASE_ID> <PROJECT_ID>
18+
19+
'use strict';
20+
21+
function main(
22+
instanceId = 'my-instance',
23+
databaseId = 'my-database',
24+
projectId = 'my-project-id'
25+
) {
26+
// [START spanner_list_database_roles]
27+
/**
28+
* TODO(developer): Uncomment these variables before running the sample.
29+
*/
30+
// const instanceId = 'my-instance';
31+
// const databaseId = 'my-database';
32+
// const projectId = 'my-project-id';
33+
// Imports the Google Cloud Spanner client library
34+
const {Spanner} = require('@google-cloud/spanner');
35+
36+
// Instantiates a client
37+
const spanner = new Spanner({
38+
projectId: projectId,
39+
});
40+
41+
async function getDatabaseRoles() {
42+
// Gets a reference to a Cloud Spanner instance and database.
43+
const instance = spanner.instance(instanceId);
44+
const database = instance.database(databaseId);
45+
46+
// Fetching database roles
47+
const [databaseRoles] = await database.getDatabaseRoles();
48+
console.log(`Roles for Database: ${database.formattedName_}`);
49+
databaseRoles.forEach(role => {
50+
console.log(`Role: ${role.name}`);
51+
});
52+
}
53+
getDatabaseRoles();
54+
// [END spanner_list_database_roles]
55+
}
56+
57+
process.on('unhandledRejection', err => {
58+
console.error(err.message);
59+
process.exitCode = 1;
60+
});
61+
main(...process.argv.slice(2));

0 commit comments

Comments
 (0)