Skip to content

chore(query-runs): clarify user_public_id documentation #153

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
hotdata-automation wants to merge 1 commit into from
Closed

chore(query-runs): clarify user_public_id documentation #153

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

### Changed

- chore(query-runs): clarify user_public_id documentation

@claude claude Bot Jul 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: the changelog entry only covers the doc-string change, but this PR also removes the SessionId / X-Session-Id API-key auth scheme from Configuration.auth_settings() and from the query, get_result, and list_results operations. That is a user-facing breaking change and warrants its own entry under ### Removed, alongside the existing uploads note. (not blocking on its own — but it needs to happen as part of resolving the session_id issue in hotdata/configuration.py)

- feat(databases): add search parameter to list endpoint
- chore(databases): make pagination fields nullable

Expand Down
9 changes: 1 addition & 8 deletions docs/QueryApi.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,6 @@ Set `async: true` to execute asynchronously — returns a query run ID for polli
### Example

* Api Key Authentication (WorkspaceId):
* Api Key Authentication (SessionId):
* Bearer Authentication (BearerAuth):

```python
Expand All @@ -46,12 +45,6 @@ configuration.api_key['WorkspaceId'] = os.environ["API_KEY"]
# Uncomment below to setup prefix (e.g. Bearer) for API key, if needed
# configuration.api_key_prefix['WorkspaceId'] = 'Bearer'

# Configure API key authorization: SessionId
configuration.api_key['SessionId'] = os.environ["API_KEY"]

# Uncomment below to setup prefix (e.g. Bearer) for API key, if needed
# configuration.api_key_prefix['SessionId'] = 'Bearer'

# Configure Bearer authorization: BearerAuth
configuration = hotdata.Configuration(
access_token = os.environ["BEARER_TOKEN"]
Expand Down Expand Up @@ -89,7 +82,7 @@ Name | Type | Description | Notes

### Authorization

[WorkspaceId](../README.md#WorkspaceId), [SessionId](../README.md#SessionId), [BearerAuth](../README.md#BearerAuth)
[WorkspaceId](../README.md#WorkspaceId), [BearerAuth](../README.md#BearerAuth)

### HTTP request headers

Expand Down
2 changes: 1 addition & 1 deletion docs/QueryRunInfo.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ Name | Type | Description | Notes
**sql_text** | **str** | |
**status** | **str** | |
**trace_id** | **str** | | [optional]
**user_public_id** | **str** | Caller identity derived from the Authorization Bearer token (SHA-256 hash). Format: `user_{first_10_hex_chars}`. | [optional]
**user_public_id** | **str** | Who ran this query: the account id from the access token the request was made with. Use it to group a caller's query history. Requests made with a credential that identifies no account instead record an opaque `user_`-prefixed identifier, which is stable for that credential but cannot be resolved to an account. | [optional]
**warning_message** | **str** | | [optional]

## Example
Expand Down
18 changes: 2 additions & 16 deletions docs/ResultsApi.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,6 @@ IEEE special floats (`±Inf`, `NaN`) have no canonical JSON representation. For
### Example

* Api Key Authentication (WorkspaceId):
* Api Key Authentication (SessionId):
* Bearer Authentication (BearerAuth):

```python
Expand All @@ -62,12 +61,6 @@ configuration.api_key['WorkspaceId'] = os.environ["API_KEY"]
# Uncomment below to setup prefix (e.g. Bearer) for API key, if needed
# configuration.api_key_prefix['WorkspaceId'] = 'Bearer'

# Configure API key authorization: SessionId
configuration.api_key['SessionId'] = os.environ["API_KEY"]

# Uncomment below to setup prefix (e.g. Bearer) for API key, if needed
# configuration.api_key_prefix['SessionId'] = 'Bearer'

# Configure Bearer authorization: BearerAuth
configuration = hotdata.Configuration(
access_token = os.environ["BEARER_TOKEN"]
Expand Down Expand Up @@ -111,7 +104,7 @@ Name | Type | Description | Notes

### Authorization

[WorkspaceId](../README.md#WorkspaceId), [SessionId](../README.md#SessionId), [BearerAuth](../README.md#BearerAuth)
[WorkspaceId](../README.md#WorkspaceId), [BearerAuth](../README.md#BearerAuth)

### HTTP request headers

Expand Down Expand Up @@ -140,7 +133,6 @@ List stored results for the database named by the required X-Database-Id header.
### Example

* Api Key Authentication (WorkspaceId):
* Api Key Authentication (SessionId):
* Bearer Authentication (BearerAuth):

```python
Expand All @@ -166,12 +158,6 @@ configuration.api_key['WorkspaceId'] = os.environ["API_KEY"]
# Uncomment below to setup prefix (e.g. Bearer) for API key, if needed
# configuration.api_key_prefix['WorkspaceId'] = 'Bearer'

# Configure API key authorization: SessionId
configuration.api_key['SessionId'] = os.environ["API_KEY"]

# Uncomment below to setup prefix (e.g. Bearer) for API key, if needed
# configuration.api_key_prefix['SessionId'] = 'Bearer'

# Configure Bearer authorization: BearerAuth
configuration = hotdata.Configuration(
access_token = os.environ["BEARER_TOKEN"]
Expand Down Expand Up @@ -211,7 +197,7 @@ Name | Type | Description | Notes

### Authorization

[WorkspaceId](../README.md#WorkspaceId), [SessionId](../README.md#SessionId), [BearerAuth](../README.md#BearerAuth)
[WorkspaceId](../README.md#WorkspaceId), [BearerAuth](../README.md#BearerAuth)

### HTTP request headers

Expand Down
1 change: 0 additions & 1 deletion hotdata/api/query_api.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -327,7 +327,6 @@ def _query_serialize(
# authentication setting
_auth_settings: List[str] = [
'WorkspaceId',
'SessionId',
'BearerAuth'
]

Expand Down
2 changes: 0 additions & 2 deletions hotdata/api/results_api.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -364,7 +364,6 @@ def _get_result_serialize(
# authentication setting
_auth_settings: List[str] = [
'WorkspaceId',
'SessionId',
'BearerAuth'
]

Expand Down Expand Up @@ -667,7 +666,6 @@ def _list_results_serialize(
# authentication setting
_auth_settings: List[str] = [
'WorkspaceId',
'SessionId',
'BearerAuth'
]

Expand Down
10 changes: 0 additions & 10 deletions hotdata/configuration.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,7 +115,6 @@
{
"BearerAuth": BearerAuthSetting,
"WorkspaceId": APIKeyAuthSetting,
"SessionId": APIKeyAuthSetting,
},
total=False,
)
Expand Down Expand Up @@ -599,15 +598,6 @@ def auth_settings(self)-> AuthSettings:
'WorkspaceId',
),
}
if 'SessionId' in self.api_keys:
auth['SessionId'] = {
'type': 'api_key',
'in': 'header',
'key': 'X-Session-Id',
'value': self.get_api_key_with_prefix(
'SessionId',
),
}
return auth

@claude claude Bot Jul 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Blocking: dropping the SessionId scheme here turns the hand-maintained session_id kwarg/property into a silent no-op.

hotdata/configuration.py still ships (from .openapi-generator-templates/configuration.mustache, which is not regenerated by this PR):

  • line 145 docstring: :param session_id: Public id of an active sandbox, sent as `X-Session-Id`.
  • lines 240–241: if session_id is not None: self.api_keys["SessionId"] = session_id
  • lines 543–557: the session_id property/setter, documented as "sent as X-Session-Id"

With SessionId gone from auth_settings() and from every operation's _auth_settings list, Configuration(session_id="sb_xyz") still accepts the value and config.session_id still reads it back, but no X-Session-Id header is ever sent. Callers relying on sandbox scoping lose isolation with no error and no type failure — reads/writes silently hit unscoped data. The AuthSettings TypedDict no longer declares the key either, so nothing catches it statically.

Pick one:

  1. If SessionId was intentionally removed from the spec, also remove session_id (kwarg, api_keys wiring, property, docstrings, the :Example: block at line 180) from .openapi-generator-templates/configuration.mustache and regenerate, and record the removal under ### Removed in CHANGELOG.md.
  2. If the removal is unintentional spec drift, restore the SessionId security scheme in the OpenAPI source and regenerate.

Either way this should not merge as-is, since the current state is "documented parameter that quietly does nothing."


def to_debug_report(self) -> str:
Expand Down
2 changes: 1 addition & 1 deletion hotdata/models/query_run_info.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ class QueryRunInfo(BaseModel):
sql_text: StrictStr
status: StrictStr
trace_id: Optional[StrictStr] = None
user_public_id: Optional[StrictStr] = Field(default=None, description="Caller identity derived from the Authorization Bearer token (SHA-256 hash). Format: `user_{first_10_hex_chars}`.")
user_public_id: Optional[StrictStr] = Field(default=None, description="Who ran this query: the account id from the access token the request was made with. Use it to group a caller's query history. Requests made with a credential that identifies no account instead record an opaque `user_`-prefixed identifier, which is stable for that credential but cannot be resolved to an account.")
warning_message: Optional[StrictStr] = None
__properties: ClassVar[List[str]] = ["bytes_scanned", "completed_at", "created_at", "error_message", "execution_time_ms", "id", "result_id", "row_count", "rows_scanned", "saved_query_id", "saved_query_version", "server_processing_ms", "snapshot_id", "sql_hash", "sql_text", "status", "trace_id", "user_public_id", "warning_message"]

Expand Down