datatug / datatug-cli / 41460412426

100%

push

github

feat(security): restrict a local SQLite source to permitted tables (#549)

Add the opt-in `exact-table-readonly-v1` profile for one registered local SQLite source. It binds project/environment/catalog, source identity, principal and mandatory policies to a read-only session. Allowed exact tables remain readable; denied tables, case aliases, unsupported native objects, raw SQL, writes and unsupported execution ports fail closed. Legacy sessions retain their existing local policy modes only after successful startup validation; the intentional compatibility limits below apply.

Authorization remains in shared DALgo, now pinned to published v0.99.0 (tag/Go module Origin d4b8161fb; provider PR dal-go/dalgo#233). The CLI verifies ordinary physical table identity and exact spelling on its fixed native connection; the optional shared namespace constraint preserves original decisions and adds canonical assessments from the same policy snapshot. Every static, bound, dynamic context and provider policy remains mandatory. Bound data reads and metadata admission use the same constraint.

The batch closes the qualified-name + opaque-grant denial bypass, confines semantic schema metadata through existing Executor.Authorize before native schema discovery, redacts native metadata errors while preserving error causes, and explicitly refuses native transaction entrypoints. It also fixes the four Cobra flag error branches previously missed by CI coverage.

Validation completed locally on the actual released dependency graph with GOWORK=off and no overlays/replacements: named native/endpoint tests with race detection; both namespace setter failure paths; original and opaque-grant identity matrices; mixed joins and true TableScope positive/negative controls; allowed metadata positive and denied/alias/context-policy metadata refusals; native metadata error redaction and unsupported transactions; opener inventory; focused static checks (zero fi... (continued)

873 of 873 new or added lines in 33 files covered. (100.0%)

89086 of 89087 relevant lines covered (100.0%)

1.01 hits per line