Merge branch 'main' into new-library/health-l1quL

Author: jinseopkim0

.github/workflows/generated_files_sync.yaml

@@ -175,6 +175,7 @@ jobs:
             |grep --invert-match samples \
             |grep --invert-match benchmark \
             |grep --invert-match grafeas \
+            |grep --invert-match '/tools/' \
             |grep --invert-match 'cloud-build.*v2' \
             |grep --invert-match 'google/monitoring/v3/DroppedLabelsOuterClass.java' \
             |grep --invert-match 'google/cloud/policytroubleshooter/v1/Explanations.java')

.kokoro/common.sh

@@ -27,7 +27,7 @@ excluded_modules=(
   'sdk-platform-java'
   'sdk-platform-java/java-shared-dependencies/dependency-analyzer'
   'sdk-platform-java/java-shared-dependencies/dependency-convergence-check'
-  'sdk-platform-java/java-showcase'
+  'java-showcase'
   'sdk-platform-java/java-showcase-3.21.0'
   'sdk-platform-java/java-showcase-3.25.8'
   'java-spanner'

.kokoro/presubmit/java-pubsub-graalvm-native-presubmit.cfg

@@ -0,0 +1,42 @@
+# Format: //devtools/kokoro/config/proto/build.proto
+
+# Configure the docker image for kokoro-trampoline.
+env_vars: {
+  key: "TRAMPOLINE_IMAGE"
+  value: "gcr.io/cloud-devrel-public-resources/graalvm_sdk_platform_a:3.61.0" # {x-version-update:google-cloud-shared-dependencies:current}
+}
+
+env_vars: {
+  key: "JOB_TYPE"
+  value: "graalvm-single"
+}
+
+# TODO: remove this after we've migrated all tests and scripts
+env_vars: {
+  key: "GCLOUD_PROJECT"
+  value: "gcloud-devel"
+}
+
+env_vars: {
+  key: "GOOGLE_CLOUD_PROJECT"
+  value: "gcloud-devel"
+}
+
+env_vars: {
+  key: "GOOGLE_APPLICATION_CREDENTIALS"
+  value: "secret_manager/java-it-service-account"
+}
+
+env_vars: {
+  key: "SECRET_MANAGER_KEYS"
+  value: "java-it-service-account"
+}
+
+env_vars: {
+  key: "IT_SERVICE_ACCOUNT_EMAIL"
+  value: "it-service-account@gcloud-devel.iam.gserviceaccount.com"
+}
+env_vars: {
+  key: "BUILD_SUBDIR"
+  value: "java-pubsub"
+}

.kokoro/presubmit/java-pubsub-integration.cfg

@@ -0,0 +1,39 @@
+# Format: //devtools/kokoro/config/proto/build.proto
+
+# Configure the docker image for kokoro-trampoline.
+env_vars: {
+  key: "TRAMPOLINE_IMAGE"
+  value: "gcr.io/cloud-devrel-kokoro-resources/java8"
+}
+
+env_vars: {
+  key: "JOB_TYPE"
+  value: "integration-single"
+}
+
+# TODO: remove this after we've migrated all tests and scripts
+env_vars: {
+  key: "GCLOUD_PROJECT"
+  value: "gcloud-devel"
+}
+
+env_vars: {
+  key: "GOOGLE_CLOUD_PROJECT"
+  value: "gcloud-devel"
+}
+
+env_vars: {
+  key: "GOOGLE_APPLICATION_CREDENTIALS"
+  value: "secret_manager/java-it-service-account"
+}
+
+env_vars: {
+  key: "SECRET_MANAGER_KEYS"
+  value: "java-it-service-account"
+}
+
+
+env_vars: {
+  key: "BUILD_SUBDIR"
+  value: "java-pubsub"
+}

generation_config.yaml

@@ -3098,3 +3098,55 @@ libraries:
   GAPICs:
   - proto_path: google/cloud/workstations/v1
   - proto_path: google/cloud/workstations/v1beta
+<<<<<<< new-library/health-l1quL
+=======
+- api_shortname: common-protos
+  name_pretty: Common Protos
+  product_documentation: https://github.com/googleapis/api-common-protos
+  api_description: Protobuf classes for Google's common protos.
+  release_level: stable
+  client_documentation: https://cloud.google.com/java/docs/reference/proto-google-common-protos/latest/history
+  distribution_name: com.google.api.grpc:proto-google-common-protos
+  excluded_dependencies: proto-google-common-protos,grpc-google-common-protos,proto-google-common-protos-parent
+  excluded_poms: proto-google-common-protos-bom,proto-google-common-protos
+  library_type: OTHER
+
+  GAPICs:
+  - proto_path: google/api
+  - proto_path: google/apps/card/v1
+  - proto_path: google/cloud
+  - proto_path: google/cloud/audit
+  - proto_path: google/cloud/location
+  - proto_path: google/geo/type
+  - proto_path: google/logging/type
+  - proto_path: google/longrunning
+  - proto_path: google/rpc
+  - proto_path: google/rpc/context
+  - proto_path: google/shopping/type
+  - proto_path: google/type
+- api_shortname: showcase
+  excluded_poms: gapic-showcase-bom
+  name_pretty: Showcase
+  api_description: Showcase module
+  product_documentation: https://cloud.google.com/dummy
+  distribution_name: com.google.cloud:gapic-showcase
+  library_type: OTHER
+  GAPICs:
+  - proto_path: schema/google/showcase/v1beta1
+- api_shortname: iam
+  name_pretty: IAM
+  product_documentation: https://cloud.google.com/iam
+  api_description: Manages access control for Google Cloud Platform resources
+  release_level: stable
+  client_documentation: https://cloud.google.com/java/docs/reference/proto-google-iam-v1/latest/overview
+  distribution_name: com.google.api.grpc:proto-google-iam-v1
+  excluded_dependencies: "grpc-google-iam-v1"
+  excluded_poms: "proto-google-iam-v1-bom,google-iam-policy,proto-google-iam-v1"
+  library_type: OTHER
+  GAPICs:
+  - proto_path: google/iam/v1
+  - proto_path: google/iam/v2
+  - proto_path: google/iam/v2beta
+  - proto_path: google/iam/v3
+  - proto_path: google/iam/v3beta
+>>>>>>> main

java-bigquery/google-cloud-bigquery-jdbc/.gitignore

@@ -1,4 +1,7 @@
 drivers/**
 target-it/**
 *logs*/**
-**/ITBigQueryJDBCLocalTest.java
+**/ITBigQueryJDBCLocalTest.java
+
+tools/**/*.class
+tools/**/*.jfr

java-bigquery/google-cloud-bigquery-jdbc/pom.xml

@@ -307,6 +307,11 @@
       <artifactId>mockito-core</artifactId>
       <scope>test</scope>
     </dependency>
+    <dependency>
+      <groupId>org.mockito</groupId>
+      <artifactId>mockito-inline</artifactId>
+      <scope>test</scope>
+    </dependency>
     <dependency>
       <groupId>org.mockito</groupId>
       <artifactId>mockito-junit-jupiter</artifactId>

java-bigquery/google-cloud-bigquery-jdbc/src/main/java/com/google/cloud/bigquery/jdbc/BigQueryConnection.java

@@ -58,10 +58,10 @@
 import java.util.Map;
 import java.util.Properties;
 import java.util.Set;
+import java.util.UUID;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.Executor;
 import java.util.concurrent.TimeUnit;
-import java.util.concurrent.atomic.AtomicLong;
 
 /**
  * An implementation of {@link java.sql.Connection} for establishing a connection with BigQuery and
@@ -74,7 +74,6 @@ public class BigQueryConnection extends BigQueryNoOpsConnection {
   private final BigQueryJdbcCustomLogger LOG = new BigQueryJdbcCustomLogger(this.toString());
   String connectionClassName = this.toString();
   private final String connectionId;
-  private static final AtomicLong connectionIdCounter = new AtomicLong(1);
   private static final String DEFAULT_JDBC_TOKEN_VALUE = "Google-BigQuery-JDBC-Driver";
   private static final String DEFAULT_VERSION = "0.0.0";
   private HeaderProvider headerProvider;
@@ -143,13 +142,14 @@ public class BigQueryConnection extends BigQueryNoOpsConnection {
   String partnerToken;
   DatabaseMetaData databaseMetaData;
   Boolean reqGoogleDriveScope;
+  private boolean isReadOnlyTokenUsed = false;
 
   BigQueryConnection(String url) throws IOException {
     this(url, DataSource.fromUrl(url));
   }
 
   BigQueryConnection(String url, DataSource ds) throws IOException {
-    this.connectionId = String.valueOf(connectionIdCounter.getAndIncrement());
+    this.connectionId = UUID.randomUUID().toString();
     try (BigQueryJdbcMdc.MdcCloseable mdc =
         BigQueryJdbcMdc.registerInstance(this, this.connectionId)) {
       LOG.finest("++enter++");
@@ -172,6 +172,7 @@ public class BigQueryConnection extends BigQueryNoOpsConnection {
       this.jobTimeoutInSeconds = ds.getJobTimeout();
       this.authProperties =
           BigQueryJdbcOAuthUtility.parseOAuthProperties(ds, this.connectionClassName);
+      this.isReadOnlyTokenUsed = checkIsReadOnlyTokenUsed(this.authProperties);
       this.catalog = ds.getProjectId();
       this.universeDomain = ds.getUniverseDomain();
 
@@ -1193,4 +1194,18 @@ public CallableStatement prepareCall(
     }
     return prepareCall(sql);
   }
+
+  public boolean isReadOnlyTokenUsed() {
+    return this.isReadOnlyTokenUsed;
+  }
+
+  private boolean checkIsReadOnlyTokenUsed(Map<String, String> authProps) {
+    String readonlyValue =
+        authProps.get(BigQueryJdbcUrlUtility.OAUTH_ACCESS_TOKEN_READONLY_PROPERTY_NAME);
+    if (readonlyValue != null) {
+      return BigQueryJdbcUrlUtility.convertIntToBoolean(
+          readonlyValue, BigQueryJdbcUrlUtility.OAUTH_ACCESS_TOKEN_READONLY_PROPERTY_NAME);
+    }
+    return false;
+  }
 }

java-bigquery/google-cloud-bigquery-jdbc/src/main/java/com/google/cloud/bigquery/jdbc/BigQueryJdbcMdc.java

@@ -16,16 +16,15 @@
 
 package com.google.cloud.bigquery.jdbc;
 
+import java.util.UUID;
 import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.atomic.AtomicLong;
 
 /**
  * Lightweight MDC implementation for the BigQuery JDBC driver using InheritableThreadLocal.
  * Allocates a dedicated, independent InheritableThreadLocal object per concrete BigQueryConnection
  * instance.
  */
 class BigQueryJdbcMdc {
-  private static final AtomicLong nextId = new AtomicLong(1);
   private static final ConcurrentHashMap<BigQueryConnection, InheritableThreadLocal<String>>
       instanceLocals = new ConcurrentHashMap<>();
   private static final ConcurrentHashMap<BigQueryConnection, String> instanceIds =
@@ -41,9 +40,8 @@ static MdcCloseable registerInstance(BigQueryConnection connection, String id) {
           instanceIds.computeIfAbsent(
               connection,
               k -> {
-                String suffix =
-                    (id != null && !id.isEmpty()) ? id : String.valueOf(nextId.getAndIncrement());
-                return "JdbcConnection-" + suffix;
+                String baseId = (id != null && !id.isEmpty()) ? id : UUID.randomUUID().toString();
+                return baseId;
               });
 
       currentConnectionId.set(cleanId);

java-bigquery/google-cloud-bigquery-jdbc/src/main/java/com/google/cloud/bigquery/jdbc/BigQueryJdbcOAuthUtility.java

@@ -170,6 +170,9 @@ static Map<String, String> parseOAuthProperties(DataSource ds, String callerClas
         }
         oauthProperties.put(
             BigQueryJdbcUrlUtility.OAUTH_ACCESS_TOKEN_PROPERTY_NAME, ds.getOAuthAccessToken());
+        oauthProperties.put(
+            BigQueryJdbcUrlUtility.OAUTH_ACCESS_TOKEN_READONLY_PROPERTY_NAME,
+            String.valueOf(ds.getOAuthAccessTokenReadonly()));
         LOG.fine("OAuthAccessToken provided.");
         break;
       case APPLICATION_DEFAULT_CREDENTIALS:
@@ -230,26 +233,22 @@ static Map<String, String> parseOAuthProperties(DataSource ds, String callerClas
         break;
     }
 
-    if (authType == AuthType.GOOGLE_SERVICE_ACCOUNT
-        || authType == AuthType.GOOGLE_USER_ACCOUNT
-        || authType == AuthType.PRE_GENERATED_TOKEN) {
-      oauthProperties.put(
-          BigQueryJdbcUrlUtility.OAUTH_SA_IMPERSONATION_EMAIL_PROPERTY_NAME,
-          ds.getOAuthSAImpersonationEmail());
-      oauthProperties.put(
-          BigQueryJdbcUrlUtility.OAUTH_SA_IMPERSONATION_CHAIN_PROPERTY_NAME,
-          ds.getOAuthSAImpersonationChain());
-      oauthProperties.put(
-          BigQueryJdbcUrlUtility.OAUTH_SA_IMPERSONATION_SCOPES_PROPERTY_NAME,
-          ds.getOAuthSAImpersonationScopes() != null
-              ? ds.getOAuthSAImpersonationScopes()
-              : BIGQUERY_SCOPE);
-      oauthProperties.put(
-          BigQueryJdbcUrlUtility.OAUTH_SA_IMPERSONATION_TOKEN_LIFETIME_PROPERTY_NAME,
-          ds.getOAuthSAImpersonationTokenLifetime() != null
-              ? ds.getOAuthSAImpersonationTokenLifetime()
-              : BigQueryJdbcUrlUtility.DEFAULT_OAUTH_SA_IMPERSONATION_TOKEN_LIFETIME_VALUE);
-    }
+    oauthProperties.put(
+        BigQueryJdbcUrlUtility.OAUTH_SA_IMPERSONATION_EMAIL_PROPERTY_NAME,
+        ds.getOAuthSAImpersonationEmail());
+    oauthProperties.put(
+        BigQueryJdbcUrlUtility.OAUTH_SA_IMPERSONATION_CHAIN_PROPERTY_NAME,
+        ds.getOAuthSAImpersonationChain());
+    oauthProperties.put(
+        BigQueryJdbcUrlUtility.OAUTH_SA_IMPERSONATION_SCOPES_PROPERTY_NAME,
+        ds.getOAuthSAImpersonationScopes() != null
+            ? ds.getOAuthSAImpersonationScopes()
+            : BIGQUERY_SCOPE);
+    oauthProperties.put(
+        BigQueryJdbcUrlUtility.OAUTH_SA_IMPERSONATION_TOKEN_LIFETIME_PROPERTY_NAME,
+        ds.getOAuthSAImpersonationTokenLifetime() != null
+            ? ds.getOAuthSAImpersonationTokenLifetime()
+            : BigQueryJdbcUrlUtility.DEFAULT_OAUTH_SA_IMPERSONATION_TOKEN_LIFETIME_VALUE);
     return oauthProperties;
   }
 
@@ -284,12 +283,9 @@ static GoogleCredentials getCredentials(
             getPreGeneratedTokensCredentials(authProperties, overrideProperties, callerClassName);
         break;
       case APPLICATION_DEFAULT_CREDENTIALS:
-        // This auth method doesn't support service account impersonation
-
         credentials = getApplicationDefaultCredentials(callerClassName);
         break;
       case EXTERNAL_ACCOUNT_AUTH:
-        // This auth method doesn't support service account impersonation
         credentials = getExternalAccountAuthCredentials(authProperties, callerClassName);
         break;
       default: