Skip to content

feat(trino): support per-query user impersonation#3533

Open
nakulgan wants to merge 1 commit into
googleapis:mainfrom
nakulgan:feat/trino-user-impersonation
Open

feat(trino): support per-query user impersonation#3533
nakulgan wants to merge 1 commit into
googleapis:mainfrom
nakulgan:feat/trino-user-impersonation

Conversation

@nakulgan

Copy link
Copy Markdown

Description

Adds opt-in per-query user impersonation to the trino-sql and
trino-execute-sql tools.

When impersonateUser: true is set on the tool, it exposes an additional
optional trino_user input parameter. Its value is forwarded as the
X-Trino-User header for that statement only, so a single pooled connection can
run individual queries as different users. If trino_user is omitted or empty,
the query runs as the source's configured user — so existing configs are
unaffected (the field defaults to false).

Motivation / impact. Trino resource groups and access control are commonly
keyed on the request user. Without impersonation, every query a Toolbox instance
issues is attributed to one static identity, so they all share a single resource
group's concurrency/queue limits and lose per-user attribution. Forwarding the
end user lets each query carry that identity for scheduling isolation and
auditing.

Solution. The source gains a RunSQLAsUser method that attaches the user as
a sql.Named("X-Trino-User", ...) query argument. The trino-go-client
forwards any X-Trino--prefixed argument as a request header and excludes it
from positional ? placeholder binding, so the impersonation user never
consumes a parameter slot. The pool's configured principal still authenticates
the request, so it must be authorized to impersonate on the Trino side.

PR Checklist

  • Make sure you reviewed CONTRIBUTING.md
  • Make sure to open an issue as a bug/issue before writing your code — happy to file one if the maintainers prefer to discuss the design first
  • Ensure the tests and linter pass
  • Code coverage does not decrease — added unit tests for the routing in both tools and an integration test asserting current_user reflects the impersonated user
  • Appropriate docs were updated
  • Make sure to add ! if this involves a breaking change — not applicable; the field is opt-in and defaults to false

🛠️ Fixes #

@nakulgan nakulgan requested a review from a team as a code owner June 26, 2026 11:46
@google-cla

google-cla Bot commented Jun 26, 2026

Copy link
Copy Markdown

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces user impersonation support for the Trino 'trino-execute-sql' and 'trino-sql' tools by adding an optional 'impersonateUser' configuration option and forwarding the 'trino_user' parameter as the 'X-Trino-User' header. Feedback suggests refactoring the test 'mockSource' structs in both 'trinoexecutesql_test.go' and 'trinosql_test.go' to implement the 'sources.Source' interface methods directly rather than embedding the interface, which can lead to nil pointer dereferences if uninitialized.

Comment thread internal/tools/trino/trinoexecutesql/trinoexecutesql_test.go
Comment thread internal/tools/trino/trinosql/trinosql_test.go
Add an opt-in `impersonateUser` field to the `trino-sql` and
`trino-execute-sql` tools. When enabled, the tool exposes an additional
optional `trino_user` input parameter whose value is forwarded as the
`X-Trino-User` header for that statement only, letting a single pooled
connection run individual queries as different users. If `trino_user` is
omitted (or empty), the query runs as the source's configured user.

This is implemented on the source via a new `RunSQLAsUser` method that
attaches the user as a `sql.Named("X-Trino-User", ...)` query argument;
the trino-go-client forwards `X-Trino-`-prefixed arguments as request
headers and excludes them from positional placeholder binding, so the
impersonation user never consumes a `?` parameter. The pool's configured
principal still authenticates the request, so it must be authorized to
impersonate on the Trino side.
@nakulgan nakulgan force-pushed the feat/trino-user-impersonation branch from d935347 to 00192d6 Compare June 26, 2026 11:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants