Remove OAuth token from query params in API requests

src/main/java/net/starschema/clouddb/jdbc/BQSupportFuncts.java

@@ -648,6 +648,38 @@ static QueryResponse runSyncQuery(
       boolean useQueryCache,
       JobCreationMode jobCreationMode)
       throws IOException {
+    return getSyncQuery(
+            bigquery,
+            projectId,
+            querySql,
+            dataSet,
+            useLegacySql,
+            maxBillingBytes,
+            queryTimeoutMs,
+            maxResults,
+            labels,
+            useQueryCache,
+            jobCreationMode)
+        .execute();
+  }
+
+  /*
+   * Gets a query as specified, but does not execute it.
+   * Introduced for assertions on the property of the query.
+   * */
+  static Bigquery.Jobs.Query getSyncQuery(
+      Bigquery bigquery,
+      String projectId,
+      String querySql,
+      String dataSet,
+      Boolean useLegacySql,
+      Long maxBillingBytes,
+      Long queryTimeoutMs,
+      Long maxResults,
+      Map<String, String> labels,
+      boolean useQueryCache,
+      JobCreationMode jobCreationMode)
+      throws IOException {
     QueryRequest qr =
         new QueryRequest()
             .setLabels(labels)
@@ -666,7 +698,7 @@ static QueryResponse runSyncQuery(
       qr.setMaxResults(maxResults);
     }
 
-    return bigquery.jobs().query(projectId, qr).execute();
+    return bigquery.jobs().query(projectId, qr);
   }
 
   /**

src/main/java/net/starschema/clouddb/jdbc/Oauth2Bigquery.java

@@ -503,21 +503,22 @@ public boolean handleResponse(
     }
   }
 
-  private static class BigQueryRequestUserAgentInitializer extends BigqueryRequestInitializer {
+  static class BigQueryRequestUserAgentInitializer extends BigqueryRequestInitializer {
 
     String userAgent = null;
+
     String oauthToken = null;
 
     public void setUserAgent(String userAgent) {
       this.userAgent = userAgent;
     }
 
-    public void setOauthToken(String oauthToken) {
-      this.oauthToken = oauthToken;
+    public String getOauthToken() {
+      return oauthToken;
     }
 
-    public String getOauthToken() {
-      return this.oauthToken;
+    public void setOauthToken(String oauthToken) {
+      this.oauthToken = oauthToken;
     }
 
     @Override
@@ -529,9 +530,6 @@ public void initializeBigqueryRequest(BigqueryRequest<?> request) throws IOExcep
 
         request.setRequestHeaders(currentHeaders);
       }
-      if (oauthToken != null) {
-        request.setOauthToken(oauthToken);
-      }
     }
   }
 }

src/test/java/net/starschema/clouddb/jdbc/JdbcUrlTest.java

@@ -3,6 +3,7 @@
 import com.google.api.client.testing.http.MockHttpTransport;
 import com.google.api.client.testing.http.MockLowLevelHttpRequest;
 import com.google.api.client.testing.http.MockLowLevelHttpResponse;
+import com.google.api.services.bigquery.Bigquery.Jobs.Query;
 import com.google.common.collect.ImmutableMap;
 import java.io.IOException;
 import java.nio.file.Files;
@@ -173,6 +174,51 @@ public void canConnectWithOAuthAccessToken()
     stmt.executeQuery("SELECT * FROM orders limit 1");
   }
 
+  @Test
+  public void oAuthAccessTokenOnlyInHeader()
+      throws SQLException, IOException, GeneralSecurityException {
+    // generate access token from service account credentials
+    Properties serviceProps = getProperties("/protectedaccount.properties");
+    String accessToken =
+        Oauth2Bigquery.generateAccessToken(
+            serviceProps.getProperty("user"),
+            serviceProps.getProperty("path"),
+            serviceProps.getProperty("password"),
+            null);
+
+    Properties oauthProps = getProperties("/oauthaccount.properties");
+    oauthProps.setProperty("oauthaccesstoken", accessToken);
+    String url = BQSupportFuncts.constructUrlFromPropertiesFile(oauthProps, true, null);
+    BQConnection bqConn = new BQConnection(url, new Properties());
+
+    Oauth2Bigquery.BigQueryRequestUserAgentInitializer initializer =
+        (Oauth2Bigquery.BigQueryRequestUserAgentInitializer)
+            bqConn.getBigquery().getGoogleClientRequestInitializer();
+
+    Assertions.assertThat(initializer.getOauthToken())
+        .withFailMessage(
+            "BigQueryRequestUserAgentInitializer.getOauthToken private API required"
+                + " by Looker; token must be present")
+        .isNotNull();
+
+    BQStatement stmt = new BQStatement(oauthProps.getProperty("projectid"), bqConn);
+    Query query =
+        BQSupportFuncts.getSyncQuery(
+            bqConn.getBigquery(),
+            oauthProps.getProperty("projectid"),
+            "SELECT * FROM orders limit 1",
+            bqConn.getDataSet(),
+            bqConn.getUseLegacySql(),
+            null,
+            stmt.getSyncTimeoutMillis(),
+            (long) stmt.getMaxRows(),
+            stmt.getAllLabels(),
+            bqConn.getUseQueryCache(),
+            JobCreationMode.JOB_CREATION_MODE_UNSPECIFIED);
+    String oAuthToken = query.getOauthToken();
+    Assertions.assertThat(oAuthToken).isNull();
+  }
+
   @Test
   public void unauthorizedResponseForInvalidOAuthAccessToken()
       throws SQLException, IOException, GeneralSecurityException {

src/test/java/net/starschema/clouddb/jdbc/PreparedStatementTests.java

@@ -75,9 +75,8 @@ public void Connect() throws Exception {
       PreparedStatementTests.con =
           DriverManager.getConnection(
               BQSupportFuncts.constructUrlFromPropertiesFile(
-                  BQSupportFuncts.readFromPropFile(
-                      "src/test/resources/installedaccount1.properties")),
-              BQSupportFuncts.readFromPropFile("src/test/resources/installedaccount1.properties"));
+                  BQSupportFuncts.readFromPropFile("installedaccount1.properties")),
+              BQSupportFuncts.readFromPropFile("installedaccount1.properties"));
     } catch (Exception e) {
       e.printStackTrace();
     }