feat(bq_driver): add AllowedProjects DSN option to scope SQLTables metadata enumeration

[Rigbyfab4]

Add AllowedProjects DSN option to scope SQLTables metadata enumeration

Problem

Power Query for Excel opens a connection and immediately calls SQLTables with
wildcard catalog/schema arguments to populate its Navigator tree. Today
GetFilteredProjectIds answers that by enumerating every project the
authenticated principal can reach via the projects.list REST API, then calling
datasets.list for each one.

In a large organization a principal can typically see far more projects than it
holds BigQuery permissions on. Since #1241 that is no longer fatal — inaccessible
projects are skipped rather than failing the whole call — but the driver still:

• calls projects.list, which has no server-side filter and returns every
  project the principal can see;
• fans datasets.list out across all of them, including the ones that will
  return 403/404 and be discarded;
• offers the user no way to say which projects they actually care about.

So the Navigator tree is slow and quota-heavy to build, and lists every
BigQuery-accessible project the principal can see, when the user wanted a
handful.

Neither existing mechanism helps:

• AdditionalProjects only adds projects on top of the full enumeration.
• ListProjectsParent restricts via the Cloud Resource Manager hierarchy, which
  requires cloudresourcemanager.googleapis.com access and has no UI.

Neither is an explicit allowlist, and neither prevents the broad call.

Change

Add an AllowedProjects DSN option naming the projects to expose. When set,
GetFilteredProjectIds filters that list and skips projects.list entirely,
so no unwanted project is ever contacted.

Existing filter semantics are preserved: entries are matched against the catalog
argument using the same ODBC LIKE-pattern / SQL_ATTR_METADATA_ID rules used
elsewhere in the file, with surrounding whitespace trimmed and blank entries
ignored.

AllowedProjects and AdditionalProjects remain orthogonal and composable: if
both are set, enumeration starts from the allowlist and still appends the
AdditionalProjects ids.

The DSN key is fully usable headlessly for automation. For non-technical users
there is also a pick list in the Advanced Options dialog: a Load Projects
button populates a checkbox list via the existing
DriverForm::GetCatalogAndDataset path, preserving ticks across reloads and
retaining saved ids the account no longer reports.

SQLColumns is unaffected — its catalog argument is always a single resolved
project, so it never triggers account-wide enumeration.

Relationship to recent changes on main

This branch has been rebased onto current main and is written to compose with,
not duplicate, two changes that landed while it was open:

• fix(bq_driver): Prevent crash when listing datasets for invalid projects #1241 (skip 403/404 projects instead of failing the whole call) is
  complementary. It makes broad enumeration survivable; AllowedProjects makes
  it unnecessary. The original version of this PR argued from the hard failure
  that fix(bq_driver): Prevent crash when listing datasets for invalid projects #1241 fixed; that argument has been dropped and the case above rests on
  enumeration cost and user control instead.
• improve(bq_driver): SQLTables perf improvement #1627 added LiteralFromOdbcPattern. This PR previously carried a narrower
  SQL_ATTR_METADATA_ID-only fast path in GetResultSetForTables; that has been
  removed in favour of improve(bq_driver): SQLTables perf improvement #1627's more general version, which also handles the
  no-wildcard LIKE case. AllowedProjects covers the case improve(bq_driver): SQLTables perf improvement #1627 cannot: Power
  Query's opening SQLTables call passes SQL_ALL_CATALOGS, a genuine search
  pattern that must still be expanded by listing — which is exactly where the
  cost is.

Commits

1. feat(bq_driver): add AllowedProjects DSN option to scope SQLTables
2. fix(bq_driver): keep the Advanced Options dialog within the screen
3. fix(bq_driver): stop empty dialog areas acting as a documentation link

Commits 2 and 3 fix pre-existing defects, not regressions from this feature.
They are separated so they can be reviewed or dropped independently. See
"Pre-existing issues" below for why they surfaced now.

Testing

Unit tests (all passing):

• FilterAllowedProjects — 8 cases: wildcard, LIKE patterns, _
  single-character wildcard, non-matching pattern, blank/whitespace entries,
  empty allowlist, SQL_ATTR_METADATA_ID exact match, and % treated as a
  literal under SQL_ATTR_METADATA_ID.
• ConnectionHandle — ALLOWEDPROJECTS parsing, set and unset, including that
  it stays independent of AdditionalProjects.
• AdvanceOptions — SetValues / ResetToDefaults round-trip, and a pick-list
  test that ticks two saved ids, unticks one, clicks OK and asserts only the
  remaining id is saved.

Integration test CatalogTest.SQLTables_AllowedProjects: enumerates every
reachable project, then re-connects with AllowedProjects set to a subset and
asserts the returned catalog set is exactly that subset — so a project the
principal can reach but did not allow-list must be absent. This is what proves
the enumeration was skipped rather than merely filtered.

Manual verification on Windows against a real BigQuery account:

• Advanced Options → Load Projects populated the checkbox list from the
  account; ticking a subset and pressing OK persisted AllowedProjects to the
  DSN and re-opening the dialog restored the ticks.
• Excel Power Query Navigator built its tree showing only the allow-listed
  project. A second project the principal could reach, but had not allow-listed,
  was correctly absent, and a table loaded successfully through Power Query.

Note: the Win32 unit tests are not built by CI (see below), so the dialog tests
above were run locally with a temporary build workaround.

Pre-existing issues encountered

All of the following sit in Win32 dialog code that no CI path compiles:
ci/gha/builds/windows-cmake-integration.sh sets -DODBC_UNIT_TESTING=OFF
(required, because fuzztest fails to configure under MSVC with
Compiler MSVC is not supported), while the Linux builds that do compile unit
tests exclude these files via the if (WIN32) guard in bq_driver.cmake. That
single gap is likely why the following accumulated unnoticed, and may be worth
addressing on its own.

Fixed here (commits 2 and 3):

1. Advanced Options opened taller than the screen. The dialog used a fixed
   720px height centred on raw screen metrics. On a 1280x720 display at 150%
   scaling only 672px of work area is available, leaving the OK and Cancel
   buttons unreachable below the screen edge. Now clamped to the work area with
   a vertical scrollbar.
2. Blank dialog areas acted as a hyperlink. Both dialogs hit-test
   WM_LBUTTONDOWN against the documentation hyperlink's rectangle, but the
   CreateHyperlinkLabel calls are commented out. GetDlgItem returns NULL,
   GetClientRect(NULL, &rect) fails leaving rect uninitialised, and
   PtInRect then matches arbitrary clicks — launching a browser from empty
   parts of the dialog.

Not fixed, reported for triage (all re-confirmed against current main):

3. driver_form_test.cc does not compile. It calls
   DriverForm::TestODBCConnection(section) with one argument at lines 172, 181
   and 191; the declaration in driver_form.h takes two
   (section, logging_section). Error C2660.

4. ConvertLogLevel.ValidateLogLevelConversion fails.
   odbc_windows_test.cc expects "" for an invalid log level;
   ConvertLogLevel in odbc_windows.cc falls through to kLogOff and returns
   "0".

5. Two dialog tests hang indefinitely. AdvanceOptionsTest.ShowWindow and a
   case in ProxyOptionsTest call a form's Show(), whose modal GetMessage
   loop never receives WM_QUIT. (The new pick-list test avoids this by posting
   WM_QUIT before calling Show().)

6. User DSNs cannot be used to connect. GetSectionWin
   (internal/utils.cc) hardcodes RegOpenKeyEx(HKEY_LOCAL_MACHINE, ...), so a
   DSN under HKEY_CURRENT_USER is invisible when connecting — a DSN created via
   the User DSN tab of the ODBC administrator cannot be used at all.

   This looks like an oversight rather than a design decision, since the driver
   is otherwise scope-aware: the write path uses SQLWriteDSNToIni /
   SQLWritePrivateProfileString, and the config-dialog read path uses
   SQLGetPrivateProfileString. Only the connect path hardcodes the hive, so the
   driver can create and re-edit a User DSN that it then cannot connect with.

   The failure is also misleading rather than merely inconvenient: with no values
   found, stoi("") throws in CreateAuth and its catch block silently defaults
   to kServiceAccount, so the user is told
   "The path to the file can't be empty" — an error about credentials — when the
   real problem is that the DSN was never read.

   Suggested fix: have the DSN read path consult HKEY_CURRENT_USER before
   HKEY_LOCAL_MACHINE, matching the precedence ODBC itself uses, or switch it
   to SQLGetPrivateProfileString as the config dialog already does. Worth
   noting for whoever picks this up: GetSectionWin is also used to read the
   trace/logging configuration, so changing it in place affects more than DSN
   lookups — adding a DSN-specific reader may be the safer shape. Deliberately
   left out of this PR as it is unrelated to this feature and deserves its own
   review.

Checklist

• Contributor License Agreement signed
• Code formatted with the project's clang-format and the top-level
  .clang-format
• ci/cloudbuild/build.sh -t checkers-pr --docker — not run locally (no
  Docker available on the development machine); checkers-pr passes in CI
• Unit tests run locally
• Integration tests requiring a multi-project GCP account — the new
  SQLTables_AllowedProjects test compiles but was not run in CI conditions

---

🤖 Generated with Claude Code

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[Rigbyfab4]

Hi Google Cloud team - I wanted to ask if you could advise on next steps for this feature? I am confirming I have completed the CLA.

[sachinpro]

/gcbrun

[sachinpro]

/gcbrun

[Rigbyfab4]

Hello GCP team - I rebased to main this evening so that this branch would be merge-able if you so desire. Let me know any comments, etc. Thanks for your consideration.