supabase / etl / 29976461051

74%

Build Type

push

github

Committed by web-flow

Commit Message

clickhouse: Prevent unsafe schema rewind during CDC replay (#925)

* fix(clickhouse): Prevent unsafe schema rewind during CDC replay

A restart can replay a relation event that has an old schema
snapshot. Before this change, the destination applied the reverse
schema diff. The reverse diff dropped new columns and deleted their
data.

Reject relation events that have a snapshot older than the applied
snapshot. Use the new error kind DestinationSchemaRewind for this
condition. Tell the operator to resynchronize the table. Also reject
stale snapshots on the interrupted-recovery path. Do not execute
reverse DDL in these conditions.

Pin wait_for_async_insert=1 on the ClickHouse client. This setting
makes each insert acknowledgement durable. A schema change cannot
overtake acknowledged rows.

Add integration tests for stale relation replay on both engines. Add
a test for the recovery guard. Update the schema-changes
documentation.

* docs(clickhouse): Document crash window for schema-rewind errors

The schema-rewind limitation read like it only applied to unusual
replays. Name the concrete trigger: one crash after a schema change is
applied at the destination but before replication progress is
confirmed replays the stream from before the change and fails the
pipeline with the same error.

* fix(clickhouse): Use previous replication mask when recovering schema changes

ClickHouse schema-change recovery built the previous schema with
metadata.replication_mask, which records the target mask. Any
interrupted change that added or dropped columns paired an old schema
with a mask of the wrong width and panicked on the mask-length
assertion in ReplicatedTableSchema::from_mask, so recovery after a
crash mid-DDL could never complete.

DuckLake already solved this by projecting target mask bits back onto
the previous schema by ordinal position. Move that helper to a shared
recovery module and use it in the ClickHouse recovery path.

* test(clickhouse): Cover successf... (continued)

Coverage Stats

95 of 102 new or added lines in 4 files covered. (93.14%)

17 existing lines in 5 files now uncovered.

43805 of 59250 relevant lines covered (73.93%)

9066.89 hits per line