From e8ddedb3188f26fd9e7cc7365811e6f988e606a1 Mon Sep 17 00:00:00 2001 From: "hotdata-automation[bot]" <267177015+hotdata-automation[bot]@users.noreply.github.com> Date: Thu, 30 Jul 2026 01:44:08 +0000 Subject: [PATCH 1/2] chore(query-runs): clarify user_public_id documentation --- CHANGELOG.md | 1 + docs/QueryApi.md | 2 +- docs/QueryRunInfo.md | 2 +- docs/ResultsApi.md | 4 ++-- src/apis/query_api.rs | 8 -------- src/apis/results_api.rs | 16 ---------------- src/models/query_run_info.rs | 2 +- 7 files changed, 6 insertions(+), 29 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 384071a..b620e13 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Changed +- chore(query-runs): clarify user_public_id documentation - feat(databases): add search parameter to list endpoint ## [0.10.0] - 2026-07-23 diff --git a/docs/QueryApi.md b/docs/QueryApi.md index 7075a0c..ec7e9ab 100644 --- a/docs/QueryApi.md +++ b/docs/QueryApi.md @@ -29,7 +29,7 @@ Name | Type | Description | Required | Notes ### Authorization -[WorkspaceId](../README.md#WorkspaceId), [SessionId](../README.md#SessionId), [BearerAuth](../README.md#BearerAuth) +[WorkspaceId](../README.md#WorkspaceId), [BearerAuth](../README.md#BearerAuth) ### HTTP request headers diff --git a/docs/QueryRunInfo.md b/docs/QueryRunInfo.md index 567c426..1b925a4 100644 --- a/docs/QueryRunInfo.md +++ b/docs/QueryRunInfo.md @@ -21,7 +21,7 @@ Name | Type | Description | Notes **sql_text** | **String** | | **status** | **String** | | **trace_id** | Option<**String**> | | [optional] -**user_public_id** | Option<**String**> | Caller identity derived from the Authorization Bearer token (SHA-256 hash). Format: `user_{first_10_hex_chars}`. | [optional] +**user_public_id** | Option<**String**> | Who ran this query: the account id from the access token the request was made with. Use it to group a caller's query history. Requests made with a credential that identifies no account instead record an opaque `user_`-prefixed identifier, which is stable for that credential but cannot be resolved to an account. | [optional] **warning_message** | Option<**String**> | | [optional] [[Back to Model list]](../README.md#documentation-for-models) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to README]](../README.md) diff --git a/docs/ResultsApi.md b/docs/ResultsApi.md index aadf961..ec449a3 100644 --- a/docs/ResultsApi.md +++ b/docs/ResultsApi.md @@ -33,7 +33,7 @@ Name | Type | Description | Required | Notes ### Authorization -[WorkspaceId](../README.md#WorkspaceId), [SessionId](../README.md#SessionId), [BearerAuth](../README.md#BearerAuth) +[WorkspaceId](../README.md#WorkspaceId), [BearerAuth](../README.md#BearerAuth) ### HTTP request headers @@ -65,7 +65,7 @@ Name | Type | Description | Required | Notes ### Authorization -[WorkspaceId](../README.md#WorkspaceId), [SessionId](../README.md#SessionId), [BearerAuth](../README.md#BearerAuth) +[WorkspaceId](../README.md#WorkspaceId), [BearerAuth](../README.md#BearerAuth) ### HTTP request headers diff --git a/src/apis/query_api.rs b/src/apis/query_api.rs index 6196aa5..03437e3 100644 --- a/src/apis/query_api.rs +++ b/src/apis/query_api.rs @@ -54,14 +54,6 @@ pub async fn query( }; req_builder = req_builder.header("X-Workspace-Id", value); }; - if let Some(apikey) = configuration.api_keys.get("X-Session-Id") { - let key = apikey.key.clone(); - let value = match apikey.prefix { - Some(ref prefix) => format!("{} {}", prefix, key), - None => key, - }; - req_builder = req_builder.header("X-Session-Id", value); - }; if let Some(token) = configuration.resolve_bearer_token().await { req_builder = req_builder.bearer_auth(token); }; diff --git a/src/apis/results_api.rs b/src/apis/results_api.rs index 1442c3d..db33452 100644 --- a/src/apis/results_api.rs +++ b/src/apis/results_api.rs @@ -76,14 +76,6 @@ pub async fn get_result( }; req_builder = req_builder.header("X-Workspace-Id", value); }; - if let Some(apikey) = configuration.api_keys.get("X-Session-Id") { - let key = apikey.key.clone(); - let value = match apikey.prefix { - Some(ref prefix) => format!("{} {}", prefix, key), - None => key, - }; - req_builder = req_builder.header("X-Session-Id", value); - }; if let Some(token) = configuration.resolve_bearer_token().await { req_builder = req_builder.bearer_auth(token); }; @@ -158,14 +150,6 @@ pub async fn list_results( }; req_builder = req_builder.header("X-Workspace-Id", value); }; - if let Some(apikey) = configuration.api_keys.get("X-Session-Id") { - let key = apikey.key.clone(); - let value = match apikey.prefix { - Some(ref prefix) => format!("{} {}", prefix, key), - None => key, - }; - req_builder = req_builder.header("X-Session-Id", value); - }; if let Some(token) = configuration.resolve_bearer_token().await { req_builder = req_builder.bearer_auth(token); }; diff --git a/src/models/query_run_info.rs b/src/models/query_run_info.rs index 1562301..80d7c73 100644 --- a/src/models/query_run_info.rs +++ b/src/models/query_run_info.rs @@ -106,7 +106,7 @@ pub struct QueryRunInfo { skip_serializing_if = "Option::is_none" )] pub trace_id: Option>, - /// Caller identity derived from the Authorization Bearer token (SHA-256 hash). Format: `user_{first_10_hex_chars}`. + /// Who ran this query: the account id from the access token the request was made with. Use it to group a caller's query history. Requests made with a credential that identifies no account instead record an opaque `user_`-prefixed identifier, which is stable for that credential but cannot be resolved to an account. #[serde( rename = "user_public_id", default, From a3ad306ba02b7889ed603f55db2aa927a7aa703b Mon Sep 17 00:00:00 2001 From: Zac Farrell Date: Wed, 29 Jul 2026 19:14:40 -0700 Subject: [PATCH 2/2] docs(changelog): describe user_public_id change for callers --- CHANGELOG.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index b620e13..5256c7e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,7 +9,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Changed -- chore(query-runs): clarify user_public_id documentation +- `QueryRunInfo::user_public_id` now reports the caller's stable account id (the + access token's subject) instead of a fingerprint of the bearer token, which + churned every few minutes as short-lived JWTs were reminted. Grouping a + caller's query history by this field now holds across token refreshes. A + request that carries no verified subject still records an opaque + `user_`-prefixed fingerprint — stable for that credential, but not resolvable + to an account. This is a server-side change; the SDK only carries the field. - feat(databases): add search parameter to list endpoint ## [0.10.0] - 2026-07-23