Repository navigation
spec 020: ACL CLUSTER read by rules on duckdb's tokens - #21
Merged
Merged
Conversation
duckdb-acl re-pinned to 8d8bb59 (its spec 150 3g-3a: a module's management statements as rules). The CLUSTER forms - INSTALL | UPDATE | REMOVE EXTENSION, ATTACH, DETACH, SET, RESET - are rules now (RegisterClusterRules, MgmtCall), read on duckdb's tokens like acl's own: option lists and DEPENDS ON item by item, a comment anywhere, a quoted value one plain literal, each clause once; a statement the rules do not read is told its form's usage. The calls are the same acl_cluster_* calls; ParseCluster on the scanner goes. Tests: test/sql/cluster/cluster_grammar.test; the expectations of acl's own forms follow the re-pin (its 3f resource group rules, schema v23). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LdLs2iBQygBKtsApdH9Sxi
- ENCRYPTION_KEY is a credential key: an option holding a database's key was stored in the profile
- a source whose path names its type ('postgres:...', no TYPE) needs a SECRET and keeps its extension in
the profile (SourceTypeOf: the TYPE, else the path's prefix) - it skipped both
- SHA256 refused in spec 103's words whatever follows it; REMOVE ... COMMENT refused; a DETACH flag and a
DEPENDS ON source written once, an empty one refused
- the unused acl_admin_sql.hpp include gone; spec and docs say what changed
- tests: the two gaps (acl_cluster_profile.test, test_acl_cluster_install.cpp), SET ... TO, a negative
value, RESET / REMOVE usage, an option value's plain literal
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LdLs2iBQygBKtsApdH9Sxi
… names no type - acl_cluster_attach refuses TYPE / SECRET among its options JSON (the function and platform route): there they skipped the SECRET requirement - SourceTypeOf reads a path's prefix as duckdb does: a scheme's '://' names a filesystem, no type - a depends_on CSV with an empty or a repeated name is refused by the function as by the grammar - the negative value's test is memory_limit = -1 (a value duckdb takes) - spec 020's follow-ups: the profile's credential checks beyond keys (spec 021) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LdLs2iBQygBKtsApdH9Sxi
acl's old module seam (RegisterMgmtGrammar) and its compiler are gone; hugr-node reads CLUSTER by rules since this spec, so the re-pin builds and the suite passes (14 files, 1043 assertions; make test-cpp). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LdLs2iBQygBKtsApdH9Sxi
make vcpkg-setup cloned vcpkg's head: postgres_scanner's overlay vcpkg-tool-meson 1.9.0 includes the checkout's own port, which at the head is 1.12.1's - it downloaded 1.9.0 against 1.12.1's hash. The checkout is now the commit duckdb's merged manifest names as its builtin-baseline, as duckdb-acl's make vcpkg-setup does since 2026-10-23. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LdLs2iBQygBKtsApdH9Sxi
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is the hugr-node side of duckdb-acl spec 150 stage 3g-3b. The CLUSTER forms move from the hand scanner (
ParseClusteron acl'sAdminScanner) to PEG rules on acl's 3g-3a seam (RegisterMgmtRules/MgmtCall, duckdb-acl #277).Re-pin
The rules
'CLUSTER'with its own transform and usage text: INSTALL / UPDATE / REMOVE EXTENSION, ATTACH, DETACH, SET and RESET.acl_cluster_*calls as before.DEPENDS ONare read item by item;Found by the reviews and fixed here. None of these was introduced by the rules; they were already there.
ENCRYPTION_KEYwas not a credential key, so an option holding a database's key was stored in the profile.'postgres:…', noTYPE) skipped the SECRET requirement and did not keep its extension in the profile.SourceTypeOfnow reads the type as duckdb does.TYPEorSECRETplaced amongacl_cluster_attach's options (through the function or the platform route) skipped the requirement too. Both are now refused there.Follow-up. Spec 020 lists a wider gap in the profile's credential checks: option values, DuckLake's
META_keys, azure settings,motherduck_token, and extension aliases. That becomes spec 021.Reviews: equivalence, security plus code, and a re-review of the fixes.
Tests
test/sql/cluster/cluster_grammar.testacl_cluster_profile.test: the credential casestest_acl_cluster_install.cpp: a prefix-typed source keeps its extensionThe suite passes (14 files, 1043 assertions), and so does
make test-cpp.🤖 Generated with Claude Code
https://claude.ai/code/session_01LdLs2iBQygBKtsApdH9Sxi