egutierrez
5a4f82cf76
- python/functions/bigquery/bq_auth.md - python/functions/bigquery/bq_load_from_file.md - python/functions/bigquery/bq_load_from_gcs.md - python/functions/bigquery/client.py - python/functions/bigquery/queries.py - python/functions/datascience/__init__.py - python/functions/datascience/decode_qr_image.py - python/functions/datascience/load_bq_table_to_duckdb.md - python/functions/datascience/load_bq_table_to_duckdb.py - python/functions/pipelines/profile_bq_table.md - ... Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
67 lines
2.9 KiB
Markdown
67 lines
2.9 KiB
Markdown
---
|
|
name: bq_auth
|
|
kind: function
|
|
lang: py
|
|
domain: infra
|
|
version: "1.1.0"
|
|
purity: impure
|
|
signature: "def bq_auth(project_id: str = '', credentials_path: str = '', drop_quota_project: bool = False) -> BQClient"
|
|
description: "Autentica contra Google BigQuery con ADC o service account JSON. Retorna un BQClient listo para usar con todas las funciones CRUD. Con drop_quota_project=True descarta el quota project del ADC del usuario (creds.with_quota_project(None)) para evitar el 403 USER_PROJECT_DENIED cuando el ADC lleva un quota_project_id ajeno."
|
|
tags: [bigquery, gcp, auth, google-cloud, python, forecast, pendiente-usar]
|
|
uses_functions: []
|
|
uses_types: []
|
|
returns: []
|
|
returns_optional: false
|
|
error_type: "error_go_core"
|
|
imports: [google-cloud-bigquery]
|
|
params:
|
|
- name: project_id
|
|
desc: "ID del proyecto GCP (vacio = detectar de credenciales/entorno)"
|
|
- name: credentials_path
|
|
desc: "ruta a archivo JSON de service account (vacio = Application Default Credentials)"
|
|
- name: drop_quota_project
|
|
desc: "si True y sin credentials_path, resuelve ADC via google.auth.default y descarta el quota project del ADC (with_quota_project(None)); evita el 403 USER_PROJECT_DENIED cuando el ADC del usuario lleva un quota_project_id ajeno. Default False = comportamiento original"
|
|
output: "BQClient: cliente autenticado con proyecto resuelto"
|
|
tested: false
|
|
tests: []
|
|
test_file_path: ""
|
|
file_path: "python/functions/bigquery/client.py"
|
|
---
|
|
|
|
## Ejemplo
|
|
|
|
```python
|
|
from bigquery import bq_auth
|
|
|
|
# ADC (gcloud auth application-default login)
|
|
client = bq_auth()
|
|
|
|
# Proyecto explicito
|
|
client = bq_auth("my-project-id")
|
|
|
|
# Service account
|
|
client = bq_auth(credentials_path="/path/to/service-account.json")
|
|
|
|
# Sin quota project (evita 403 USER_PROJECT_DENIED con ADC de usuario)
|
|
client = bq_auth("autingo-159109", drop_quota_project=True)
|
|
|
|
# Context manager
|
|
with bq_auth() as client:
|
|
# client se cierra automaticamente
|
|
pass
|
|
```
|
|
|
|
## Notas
|
|
|
|
Modos de autenticacion:
|
|
- Sin argumentos: usa Application Default Credentials (ADC) — requiere `gcloud auth application-default login`
|
|
- Con project_id: usa ADC pero fuerza el proyecto
|
|
- Con credentials_path: lee el JSON de service account directamente
|
|
- Con drop_quota_project=True (y sin credentials_path): resuelve ADC via `google.auth.default(scopes=[".../bigquery"])`, aplica `creds.with_quota_project(None)` si el atributo existe y construye el cliente con ese creds. Es el fix del gotcha conocido: el ADC del usuario (`egutierrez`) lleva `quota_project_id=autingo` ajeno y BigQuery devuelve `403 USER_PROJECT_DENIED`; descartar el quota project lo resuelve.
|
|
|
|
El BQClient wrappea `google.cloud.bigquery.Client` y expone `_client` para que las funciones del modulo lo usen internamente.
|
|
|
|
## Capability growth log
|
|
|
|
- v1.1.0 (2026-07-02) — anade `drop_quota_project` para descartar el quota project del ADC del usuario (`creds.with_quota_project(None)`) y evitar el 403 USER_PROJECT_DENIED. Default False = comportamiento identico al anterior.
|