feat: add Dataset ACL support (#1763)

* feat: add Dataset ACL support

* some lint updates

* add back interface that was causing IDE issues

* fix recursive import issue

* debug

* update code based on pending discovery doc changes (cl/421673680)

* update code to reflect more changes (target_types should be List<String>) based on pending discovery doc changes (cl/421673680)

* 🦉 Updates from OwlBot

See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md

* rename to address feedback

Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com>

Author: stephaniewang526

google-cloud-bigquery/src/main/java/com/google/cloud/bigquery/Acl.java

@@ -20,9 +20,11 @@
 
 import com.google.api.core.ApiFunction;
 import com.google.api.services.bigquery.model.Dataset.Access;
+import com.google.api.services.bigquery.model.DatasetAccessEntry;
 import com.google.cloud.StringEnumType;
 import com.google.cloud.StringEnumValue;
 import java.io.Serializable;
+import java.util.List;
 import java.util.Objects;
 
 /**
@@ -105,7 +107,8 @@ public enum Type {
       USER,
       VIEW,
       IAM_MEMBER,
-      ROUTINE
+      ROUTINE,
+      DATASET
     }
 
     Entity(Type type) {
@@ -119,6 +122,11 @@ public Type getType() {
     abstract Access toPb();
 
     static Entity fromPb(Access access) {
+      if (access.getDataset() != null) {
+        return new DatasetAclEntity(
+            DatasetId.fromPb(access.getDataset().getDataset()),
+            access.getDataset().getTargetTypes());
+      }
       if (access.getDomain() != null) {
         return new Domain(access.getDomain());
       }
@@ -146,6 +154,65 @@ static Entity fromPb(Access access) {
     }
   }
 
+  /**
+   * Class for a BigQuery DatasetAclEntity ACL entity. Objects of this class represent a
+   * DatasetAclEntity from a different DatasetAclEntity to grant access to. Only views are supported
+   * for now. The role field is not required when this field is set. If that DatasetAclEntity is
+   * deleted and re-created, its access needs to be granted again via an update operation.
+   */
+  public static final class DatasetAclEntity extends Entity {
+
+    private static final long serialVersionUID = -8392885851733136526L;
+
+    private final DatasetId id;
+    private final List<String> targetTypes;
+
+    /** Creates a DatasetAclEntity given the DatasetAclEntity's id. */
+    public DatasetAclEntity(DatasetId id, List<String> targetTypes) {
+      super(Type.DATASET);
+      this.id = id;
+      this.targetTypes = targetTypes;
+    }
+
+    /** Returns DatasetAclEntity's identity. */
+    public DatasetId getId() {
+      return id;
+    }
+
+    public List<String> getTargetTypes() {
+      return targetTypes;
+    }
+
+    @Override
+    public boolean equals(Object obj) {
+      if (this == obj) {
+        return true;
+      }
+      if (obj == null || getClass() != obj.getClass()) {
+        return false;
+      }
+      DatasetAclEntity datasetAclEntity = (DatasetAclEntity) obj;
+      return Objects.equals(getType(), datasetAclEntity.getType())
+          && Objects.equals(id, datasetAclEntity.id);
+    }
+
+    @Override
+    public int hashCode() {
+      return Objects.hash(getType(), id);
+    }
+
+    @Override
+    public String toString() {
+      return toPb().toString();
+    }
+
+    @Override
+    Access toPb() {
+      return new Access()
+          .setDataset(new DatasetAccessEntry().setDataset(id.toPb()).setTargetTypes(targetTypes));
+    }
+  }
+
   /**
    * Class for a BigQuery Domain entity. Objects of this class represent a domain to grant access
    * to. Any users signed in with the domain specified will be granted the specified access.
@@ -342,9 +409,10 @@ Access toPb() {
 
   /**
    * Class for a BigQuery View entity. Objects of this class represent a view from a different
-   * dataset to grant access to. Queries executed against that view will have read access to tables
-   * in this dataset. The role field is not required when this field is set. If that view is updated
-   * by any user, access to the view needs to be granted again via an update operation.
+   * datasetAclEntity to grant access to. Queries executed against that view will have read access
+   * to tables in this datasetAclEntity. The role field is not required when this field is set. If
+   * that view is updated by any user, access to the view needs to be granted again via an update
+   * operation.
    */
   public static final class View extends Entity {
 
@@ -393,10 +461,10 @@ Access toPb() {
 
   /**
    * Class for a BigQuery Routine entity. Objects of this class represent a routine from a different
-   * dataset to grant access to. Queries executed against that routine will have read access to
-   * views/tables/routines in this dataset. Only UDF is supported for now. The role field is not
-   * required when this field is set. If that routine is updated by any user, access to the routine
-   * needs to be granted again via an update operation.
+   * datasetAclEntity to grant access to. Queries executed against that routine will have read
+   * access to views/tables/routines in this datasetAclEntity. Only UDF is supported for now. The
+   * role field is not required when this field is set. If that routine is updated by any user,
+   * access to the routine needs to be granted again via an update operation.
    */
   public static final class Routine extends Entity {
 
@@ -516,6 +584,11 @@ public static Acl of(Entity entity, Role role) {
     return new Acl(entity, role);
   }
 
+  /** Returns an Acl object for a datasetAclEntity. */
+  public static Acl of(DatasetAclEntity datasetAclEntity) {
+    return new Acl(datasetAclEntity, null);
+  }
+
   /** Returns an Acl object for a view entity. */
   public static Acl of(View view) {
     return new Acl(view, null);

google-cloud-bigquery/src/test/java/com/google/cloud/bigquery/AclTest.java

@@ -19,6 +19,7 @@
 import static org.junit.Assert.assertEquals;
 
 import com.google.api.services.bigquery.model.Dataset;
+import com.google.cloud.bigquery.Acl.DatasetAclEntity;
 import com.google.cloud.bigquery.Acl.Domain;
 import com.google.cloud.bigquery.Acl.Entity;
 import com.google.cloud.bigquery.Acl.Entity.Type;
@@ -27,10 +28,23 @@
 import com.google.cloud.bigquery.Acl.Role;
 import com.google.cloud.bigquery.Acl.User;
 import com.google.cloud.bigquery.Acl.View;
+import com.google.common.collect.ImmutableList;
+import java.util.List;
 import org.junit.Test;
 
 public class AclTest {
 
+  @Test
+  public void testDatasetEntity() {
+    DatasetId datasetId = DatasetId.of("dataset");
+    List<String> targetTypes = ImmutableList.of("VIEWS");
+    DatasetAclEntity entity = new DatasetAclEntity(datasetId, targetTypes);
+    assertEquals(datasetId, entity.getId());
+    assertEquals(targetTypes, entity.getTargetTypes());
+    Dataset.Access pb = entity.toPb();
+    assertEquals(entity, Entity.fromPb(pb));
+  }
+
   @Test
   public void testDomainEntity() {
     Domain entity = new Domain("d1");

google-cloud-bigquery/src/test/java/com/google/cloud/bigquery/SerializationTest.java

@@ -20,6 +20,7 @@
 import com.google.cloud.NoCredentials;
 import com.google.cloud.PageImpl;
 import com.google.cloud.Restorable;
+import com.google.cloud.bigquery.Acl.DatasetAclEntity;
 import com.google.cloud.bigquery.StandardTableDefinition.StreamingBuffer;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
@@ -38,8 +39,6 @@ public class SerializationTest extends BaseSerializationTest {
       Acl.of(new Acl.View(TableId.of("project", "dataset", "table")), Acl.Role.WRITER);
   private static final Acl ROUTINE_ACCESS =
       Acl.of(new Acl.Routine(RoutineId.of("project", "dataset", "routine")), Acl.Role.WRITER);
-  private static final List<Acl> ACCESS_RULES =
-      ImmutableList.of(DOMAIN_ACCESS, GROUP_ACCESS, VIEW_ACCESS, ROUTINE_ACCESS, USER_ACCESS);
   private static final Long CREATION_TIME = System.currentTimeMillis() - 10;
   private static final Long DEFAULT_TABLE_EXPIRATION = 100L;
   private static final String DESCRIPTION = "Description";
@@ -50,6 +49,11 @@ public class SerializationTest extends BaseSerializationTest {
   private static final String LOCATION = "";
   private static final String SELF_LINK = "http://bigquery/p/d";
   private static final DatasetId DATASET_ID = DatasetId.of("project", "dataset");
+  private static final List<String> TARGET_TYPES = ImmutableList.of("VIEWS");
+  private static final Acl DATASET_ACCESS = Acl.of(new DatasetAclEntity(DATASET_ID, TARGET_TYPES));
+  private static final List<Acl> ACCESS_RULES =
+      ImmutableList.of(
+          DOMAIN_ACCESS, GROUP_ACCESS, VIEW_ACCESS, ROUTINE_ACCESS, USER_ACCESS, DATASET_ACCESS);
   private static final DatasetInfo DATASET_INFO =
       DatasetInfo.newBuilder(DATASET_ID)
           .setAcl(ACCESS_RULES)
@@ -228,6 +232,7 @@ protected Serializable[] serializableObjects() {
       USER_ACCESS,
       VIEW_ACCESS,
       ROUTINE_ACCESS,
+      DATASET_ACCESS,
       DATASET_ID,
       DATASET_INFO,
       TABLE_ID,

google-cloud-bigquery/src/test/java/com/google/cloud/bigquery/it/ITBigQueryTest.java

@@ -38,6 +38,7 @@
 import com.google.cloud.Role;
 import com.google.cloud.ServiceOptions;
 import com.google.cloud.bigquery.Acl;
+import com.google.cloud.bigquery.Acl.DatasetAclEntity;
 import com.google.cloud.bigquery.BigQuery;
 import com.google.cloud.bigquery.BigQuery.DatasetDeleteOption;
 import com.google.cloud.bigquery.BigQuery.DatasetField;
@@ -1897,6 +1898,47 @@ public void testAuthorizeRoutine() {
     assertEquals(routineAcl, routineDataset.getAcl());
   }
 
+  @Test
+  public void testAuthorizeDataset() {
+    String datasetName = RemoteBigQueryHelper.generateDatasetName();
+    DatasetId datasetId = DatasetId.of(PROJECT_ID, datasetName);
+    List<String> targetTypes = ImmutableList.of("VIEWS");
+    // Specify the acl which will be shared to the authorized dataset
+    List<Acl> acl =
+        ImmutableList.of(
+            Acl.of(new Acl.Group("projectOwners"), Acl.Role.OWNER),
+            Acl.of(new Acl.IamMember("allUsers"), Acl.Role.READER));
+    DatasetInfo datasetInfo =
+        DatasetInfo.newBuilder(datasetId).setAcl(acl).setDescription("shared Dataset").build();
+    Dataset sharedDataset = bigquery.create(datasetInfo);
+    assertNotNull(sharedDataset);
+    assertEquals(sharedDataset.getDescription(), "shared Dataset");
+    // Get the current metadata for the dataset you want to share by calling the datasets.get method
+    List<Acl> sharedDatasetAcl = new ArrayList<>(sharedDataset.getAcl());
+
+    // Create a new dataset to be authorized
+    String authorizedDatasetName = RemoteBigQueryHelper.generateDatasetName();
+    DatasetId authorizedDatasetId = DatasetId.of(PROJECT_ID, authorizedDatasetName);
+    DatasetInfo authorizedDatasetInfo =
+        DatasetInfo.newBuilder(authorizedDatasetId)
+            .setDescription("new Dataset to be authorized by the sharedDataset")
+            .build();
+    Dataset authorizedDataset = bigquery.create(authorizedDatasetInfo);
+    assertNotNull(authorizedDataset);
+    assertEquals(
+        authorizedDataset.getDescription(), "new Dataset to be authorized by the sharedDataset");
+
+    // Add the new DatasetAccessEntry object to the existing sharedDatasetAcl list
+    DatasetAclEntity datasetEntity = new DatasetAclEntity(authorizedDatasetId, targetTypes);
+    sharedDatasetAcl.add(Acl.of(datasetEntity));
+
+    // Update the dataset with the added authorization
+    Dataset updatedDataset = sharedDataset.toBuilder().setAcl(sharedDatasetAcl).build().update();
+
+    // Verify that the authorized dataset has been added
+    assertEquals(sharedDatasetAcl, updatedDataset.getAcl());
+  }
+
   @Test
   public void testSingleStatementsQueryException() throws InterruptedException {
     String invalidQuery =