Summary
There is no way to specify a creator_role when creating sessions, so consumers cannot use Fine-Grained Access Control (FGAC) with gcloud-spanner.
The Go client implements this as ClientConfig.DatabaseRole, which flows through to BatchCreateSessionsRequest.session_template.creator_role. gcloud-spanner should add an equivalent database_role field to ClientConfig.
Note
Adding a field to ClientConfig breaks consumers not using ..Default::default(). See related issue about #[non_exhaustive] for config structs.
Reference
Summary
There is no way to specify a
creator_rolewhen creating sessions, so consumers cannot use Fine-Grained Access Control (FGAC) with gcloud-spanner.The Go client implements this as
ClientConfig.DatabaseRole, which flows through toBatchCreateSessionsRequest.session_template.creator_role. gcloud-spanner should add an equivalentdatabase_rolefield toClientConfig.Note
Adding a field to
ClientConfigbreaks consumers not using..Default::default(). See related issue about#[non_exhaustive]for config structs.Reference
ClientConfig.DatabaseRole,sessionclient.go:167