{"record":{"id":"c0c6416897fb22c1","repo":"googleapis/mcp-toolbox","slug":"conflicting-source-configuration-readonly-is-v","errorCode":null,"errorMessage":"conflicting source configuration: readOnly is %v, but writeMode is %q","messagePattern":"conflicting source configuration: readOnly is (.+?), but writeMode is %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/bigquery/bigquery.go","lineNumber":157,"sourceCode":"func (r Config) Initialize(ctx context.Context, tracer trace.Tracer) (sources.Source, error) {\n\tif r.WriteMode == \"\" {\n\t\tr.WriteMode = WriteModeAllowed\n\t\tif r.ReadOnly != nil && *r.ReadOnly {\n\t\t\tr.WriteMode = WriteModeBlocked\n\t\t}\n\t}\n\n\tif r.WriteMode != WriteModeAllowed && r.WriteMode != WriteModeBlocked && r.WriteMode != WriteModeProtected {\n\t\treturn nil, fmt.Errorf(\"invalid writeMode %q: must be one of %q, %q, or %q\", r.WriteMode, WriteModeAllowed, WriteModeProtected, WriteModeBlocked)\n\t}\n\n\tif r.ReadOnly != nil {\n\t\t// A writeMode is considered a read-only mode if it is Blocked or Protected.\n\t\tisReadOnlyMode := (r.WriteMode == WriteModeBlocked || r.WriteMode == WriteModeProtected)\n\n\t\t// The declared readOnly boolean must match the writeMode's behavior.\n\t\tif *r.ReadOnly != isReadOnlyMode {\n\t\t\treturn nil, fmt.Errorf(\"conflicting source configuration: readOnly is %v, but writeMode is %q\", *r.ReadOnly, r.WriteMode)\n\t\t}\n\t}\n\n\tif r.MaxQueryResultRows == 0 {\n\t\tr.MaxQueryResultRows = 50\n\t}\n\n\tif r.WriteMode == WriteModeProtected && strings.ToLower(r.UseClientOAuth) != \"false\" && r.UseClientOAuth != \"\" {\n\t\t// The protected mode only allows write operations to the session's temporary datasets.\n\t\t// when using client OAuth, a new session is created every\n\t\t// time a BigQuery tool is invoked. Therefore, no session data can\n\t\t// be preserved as needed by the protected mode.\n\t\treturn nil, fmt.Errorf(\"writeMode 'protected' cannot be used with useClientOAuth enabled\")\n\t}\n\n\tif strings.ToLower(r.UseClientOAuth) != \"false\" && r.UseClientOAuth != \"\" && r.ImpersonateServiceAccount != \"\" {\n\t\treturn nil, fmt.Errorf(\"useClientOAuth cannot be used with impersonateServiceAccount\")\n\t}","sourceCodeStart":139,"sourceCodeEnd":175,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/bigquery/bigquery.go#L139-L175","documentation":"Initialize cross-checks the readOnly boolean against writeMode. A writeMode of 'blocked' or 'protected' implies read-only, and 'allowed' implies writable; if the explicit readOnly flag disagrees with what writeMode implies, initialization fails with this error rather than guessing intent.","triggerScenarios":"Configuring both readOnly and writeMode with contradictory values, e.g. readOnly: true with writeMode: allowed, or readOnly: false with writeMode: blocked/protected.","commonSituations":"Merging config fragments where one sets readOnly: true and another adds writeMode: allowed; misunderstanding that protected is a read-only mode; copy-pasting examples with both fields set.","solutions":["Make readOnly agree with writeMode: blocked/protected => readOnly: true; allowed => readOnly: false.","Remove the readOnly field and express intent purely via writeMode.","Remove writeMode and express intent purely via readOnly: true (auto-maps to blocked)."],"exampleFix":"// before\nreadOnly: true\nwriteMode: allowed\n// after\nreadOnly: true\nwriteMode: blocked","handlingStrategy":"validation","validationCode":"func validateReadOnlyWriteMode(readOnly *bool, writeMode string) error {\n\tif readOnly == nil { return nil }\n\tisRO := writeMode == \"blocked\" || writeMode == \"protected\"\n\tif *readOnly != isRO {\n\t\treturn fmt.Errorf(\"readOnly=%v conflicts with writeMode=%q\", *readOnly, writeMode)\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"src, err := sourceRegistry.Initialize(ctx, cfg)\nif err != nil {\n\tif strings.Contains(err.Error(), \"conflicting source configuration\") {\n\t\treturn fmt.Errorf(\"align readOnly and writeMode: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Express write intent with only ONE of readOnly or writeMode, never both.","Document that protected/blocked are read-only modes in your config templates.","Add a config review checklist item for these two fields."],"tags":["config","validation","conflict","bigquery"],"backgroundTag":"conflicting-config-values","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}