{"record":{"id":"81ef26b8bfa3416f","repo":"googleapis/mcp-toolbox","slug":"writemode-protected-cannot-be-used-with-useclien","errorCode":null,"errorMessage":"writeMode 'protected' cannot be used with useClientOAuth enabled","messagePattern":"writeMode 'protected' cannot be used with useClientOAuth enabled","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/bigquery/bigquery.go","lineNumber":170,"sourceCode":"\t\t// A writeMode is considered a read-only mode if it is Blocked or Protected.\n\t\tisReadOnlyMode := (r.WriteMode == WriteModeBlocked || r.WriteMode == WriteModeProtected)\n\n\t\t// The declared readOnly boolean must match the writeMode's behavior.\n\t\tif *r.ReadOnly != isReadOnlyMode {\n\t\t\treturn nil, fmt.Errorf(\"conflicting source configuration: readOnly is %v, but writeMode is %q\", *r.ReadOnly, r.WriteMode)\n\t\t}\n\t}\n\n\tif r.MaxQueryResultRows == 0 {\n\t\tr.MaxQueryResultRows = 50\n\t}\n\n\tif r.WriteMode == WriteModeProtected && strings.ToLower(r.UseClientOAuth) != \"false\" && r.UseClientOAuth != \"\" {\n\t\t// The protected mode only allows write operations to the session's temporary datasets.\n\t\t// when using client OAuth, a new session is created every\n\t\t// time a BigQuery tool is invoked. Therefore, no session data can\n\t\t// be preserved as needed by the protected mode.\n\t\treturn nil, fmt.Errorf(\"writeMode 'protected' cannot be used with useClientOAuth enabled\")\n\t}\n\n\tif strings.ToLower(r.UseClientOAuth) != \"false\" && r.UseClientOAuth != \"\" && r.ImpersonateServiceAccount != \"\" {\n\t\treturn nil, fmt.Errorf(\"useClientOAuth cannot be used with impersonateServiceAccount\")\n\t}\n\n\tendpoint := NormalizeEndpoint(r.APIEndpoint)\n\n\tvar client *bigqueryapi.Client\n\tvar restService *bigqueryrestapi.Service\n\tvar tokenSource oauth2.TokenSource\n\tvar clientCreator BigqueryClientCreator\n\tvar err error\n\n\ts := &Source{\n\t\tConfig:              r,\n\t\tClient:              client,\n\t\tRestService:         restService,","sourceCodeStart":152,"sourceCodeEnd":188,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/bigquery/bigquery.go#L152-L188","documentation":"The 'protected' write mode preserves session temporary datasets across tool invocations, which requires a single long-lived authenticated client. With useClientOAuth enabled, a fresh session/client is created per invocation, so temporary dataset state cannot survive; Initialize rejects this combination outright.","triggerScenarios":"BigQuery source config with writeMode: protected AND useClientOAuth set to anything other than \"false\" or empty (i.e. enabled, since it defaults to enabled unless explicitly \"false\").","commonSituations":"Enabling per-user client OAuth for multi-tenant setups while keeping protected mode from an earlier config; forgetting that useClientOAuth is on by default when omitted.","solutions":["Change writeMode to 'allowed' or 'blocked' if client OAuth must stay enabled.","Set useClientOAuth: \"false\" if protected mode is required and service-account auth is acceptable.","If per-session temp tables are needed with client OAuth, restructure the workflow to not depend on cross-invocation session state."],"exampleFix":"// before\nuseClientOAuth: \"true\"\nwriteMode: protected\n// after\nuseClientOAuth: \"false\"\nwriteMode: protected","handlingStrategy":"validation","validationCode":"func validateProtectedOAuth(writeMode, useClientOAuth string) error {\n\tclientOAuth := useClientOAuth != \"\" && strings.ToLower(useClientOAuth) != \"false\"\n\tif writeMode == \"protected\" && clientOAuth {\n\t\treturn fmt.Errorf(\"writeMode 'protected' is incompatible with useClientOAuth\")\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"src, err := sourceRegistry.Initialize(ctx, cfg)\nif err != nil {\n\tif strings.Contains(err.Error(), \"cannot be used with useClientOAuth\") {\n\t\treturn fmt.Errorf(\"choose either client OAuth or protected mode: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Remember useClientOAuth is enabled unless explicitly set to \"false\".","If sessions/temp datasets must persist, keep client OAuth off.","Test source initialization in CI with the production config."],"tags":["config","oauth","auth","bigquery"],"backgroundTag":"incompatible-config-combination","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}