googleapis / googleapis/google-cloud-python

google-cloud-bigquery: support column-level data policies (dataPolicies) in SchemaField

未关闭
#17,617 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
主要语言
Python
星标
5.4k
派生
1.8k
平均合并
3 天 4 小时
30 天内合并 PR
122

描述

## Feature request

`SchemaField` supports `policy_tags` (Data Catalog column-level security) but has no equivalent for **column-level data policies** (`dataPolicies`), the v2 data-masking / raw-data-access policies bound directly to a column. This makes it impossible to read, set, or modify a column's data policies through the ergonomic client — callers must drop down to the raw REST API (`tables.get` / `tables.patch`) plus DDL.

## Background

The BigQuery REST API exposes `dataPolicies` on `TableFieldSchema` — `IList`, *"Optional. Data policies attached to this field, used for field-level access control"* (see the [`tables` resource reference](https://cloud.google.com/bigquery/docs/reference/rest/v2/tables)). This is distinct from `policyTags`. The separate `bigquery-datapolicies` client manages the *policy resources*, but not the *binding* of a policy to a column, which is a table-schema operation.

## What's missing in `SchemaField`

In `packages/google-cloud-bigquery/google/cloud/bigquery/schema.py`:

- `__init__` accepts `policy_tags` but has no `data_policies` parameter.
- There is a `policy_tags` property getter but no `data_policies` getter.
- `_key()` does not account for data policies.

`from_api_repr` stores the whole API dict in `_properties`, so a pure read round-trip retains `dataPolicies` as an opaque key — but there is no supported way to *read* it (no getter) or to *set/modify* it (no constructor param / setter) without reaching into the private `_properties`.

## Repro

```python
from google.cloud import bigquery # 3.38.0

f = bigquery.SchemaField("ssn", "STRING")
# No way to attach a data policy:
# bigquery.SchemaField("ssn", "STRING", data_policies=[...]) # unsupported
# f.data_policies # AttributeError

# Reading an existing field:
table = client.get_table("proj.ds.tbl") # column has a data policy bound out-of-band
field = table.schema[0]
# field.data_policies -> no such attribute; only field._properties.get("dataPolicies") (private)
```

## Requested

Add `data_policies` to `SchemaField` mirroring `policy_tags`:
- constructor param + property getter,
- serialized into `_properties["dataPolicies"]`,
- included in `_key()` for equality/hashing,
- unit coverage in `packages/google-cloud-bigquery/tests/unit/test_schema.py`.

## Related gotcha (worth documenting either way)

When manipulating `dataPolicies` via `tables.patch`/`tables.update`, an **empty** `dataPolicies` array is silently ignored (treated as "no change"), so a column's **last** data policy cannot be removed through the schema API — only DDL (`ALTER TABLE ... ALTER COLUMN SET OPTIONS (data_policies=[])`) clears it. Non-empty updates (add / reduce to ≥1) do work via patch.

## Environment

- `google-cloud-bigquery==3.38.0` (also confirmed against the latest reference docs, which list the same `SchemaField` params — no `data_policies`).

贡献指南

打开贡献指南

调研方向

Start in packages/google-cloud-bigquery/google/cloud/bigquery/schema.py by tracing how SchemaField handles policy_tags, then inspect the related unit coverage in packages/google-cloud-bigquery/tests/unit/test_schema.py. Add coverage for constructing, reading, serializing, and comparing data_policies, and run test_schema.py to verify the requested behavior.

由索引模型根据 Issue 内容生成。

评估

技术栈
python
领域
api, databases
Issue 类型
功能
难度
3/5
预计耗时
1-2 天
活跃度
冷清
描述清晰度
描述清楚
新手友好度
82/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。