Merged
Conversation
Introduces DDL guard helpers to centralize authorization and system namespace modification checks, refactors privilege checks in SQL handlers, and blocks DDL on system tables. Adds detailed system and cache metrics to AppContext. Implements a GitHub Actions CI workflow for formatting, linting, and testing. Refactors table creation logic for better cache priming and catalog persistence. Adds live queries index definitions and related tests. Updates dependencies and documentation, and introduces new UI components for SQL Studio.
Added MAX_SQL_QUERY_LENGTH constant and enforced a 1MB SQL query length limit to prevent DoS attacks. Introduced ANONYMOUS_USER_ID and ExecutionContext::is_anonymous(), and added block_anonymous_write() guard to block all DDL/DML write operations for anonymous users. Centralized reserved namespace and column name validation, expanded reserved lists, and improved error handling in health_monitor and flush_table handlers. Updated docs/Notes.md to reflect completed and verified security and validation tasks.
Refactored live query SQL parsing in query_parser.rs to use sqlparser-rs AST for extracting table names, WHERE clauses, and projections, improving security and correctness. Added file handle diagnostics module to kalamdb-filestore with atomic counters, logging, and leak detection; integrated tracking into remote_materializer. Updated flush executor to use spawn_blocking for RocksDB and Parquet I/O to avoid blocking the async runtime. Updated documentation to reflect completed tasks.
Table names, namespace IDs, and column names are now normalized to lowercase for case-insensitive behavior, with updated constructors and tests. Documentation links and references were updated to reflect the new docs structure. The live connections manager now uses bounded channels for notifications and events, adds DoS protection with a max connections limit, and improves notification delivery with backpressure handling. Various code comments, error messages, and test cases were improved for clarity and correctness.
Adds strict validation for user IDs, namespace IDs, and table names to prevent path traversal and injection attacks. Introduces SQL redaction utilities to mask sensitive data in logs. Secures storage path handling against traversal and sensitive directory access. Updates authentication to enforce role consistency between JWT claims and database. Improves test coverage for security edge cases and adjusts job manager shutdown to use atomic operations for performance.
Removes total_batches from BatchControl and updates status logic for batch pagination. Adds schema information to the subscription_ack WebSocket message, propagates schema through backend and CLI, and updates protocol documentation. Improves JWT secret configuration consistency and enhances CLI/test coverage for batch control. Updates TypeScript SDK example to use JWT authentication and reflect new protocol fields.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.