Method checkDataSource

backend/api/v1/instance_service.go:414–443

(ctx context.Context, instance *store.InstanceMessage, dataSource *storepb.DataSource)

}

func (s *InstanceService) checkDataSource(ctx context.Context, instance *store.InstanceMessage, dataSource *storepb.DataSource) error {
	if dataSource.GetId() == "" {
		return connect.NewError(connect.CodeInvalidArgument, errors.New("data source id is required"))
	}

	// Validate IAM credential restrictions in SaaS mode
	if err := s.validateIAMCredentialForSaaS(dataSource); err != nil {
		return err
	}

	// Validate external secret restrictions in SaaS mode
	if err := s.validateExternalSecretForSaaS(dataSource); err != nil {
		return err
	}

	if err := s.licenseService.IsFeatureEnabledForInstance(ctx, common.GetWorkspaceIDFromContext(ctx), v1pb.PlanFeature_FEATURE_EXTERNAL_SECRET_MANAGER, instance); err != nil {
		missingFeatureError := connect.NewError(connect.CodePermissionDenied, err)
		if dataSource.GetExternalSecret() != nil {
			return missingFeatureError
		}
		return nil
	}

	// Validate extra connection parameters for MySQL-compatible engines
	if err := validateExtraConnectionParameters(instance.Metadata.GetEngine(), dataSource.GetExtraConnectionParameters()); err != nil {
		return connect.NewError(connect.CodeInvalidArgument, err)
	}

	return nil
}

func (s *InstanceService) validateIAMCredentialForSaaS(dataSource *storepb.DataSource) error {
	if !s.profile.SaaS {