@intentius/chant-lexicon-sql 0.116.0 → 0.118.0

package/src/clickhouse/import/generator.ts

@@ -12,19 +12,29 @@ import { isTrivia, tokenizeText, type Token } from "../tokens";
 import { parseCreate, unquote, type CreateNode } from "../parser";
 import { CLICKHOUSE_ENTITY_TYPES } from "../entities";
 
-interface Item {
+/** One object a template is written for, or one a template may reference. */
+export interface ChTemplateItem {
   exportName: string;
   type: string;
   database?: string;
   name: string;
   ddl: string;
 }
+type Item = ChTemplateItem;
 
-const TAG: Record<string, "database" | "table" | "view"> = {
+/** A template's text: `parts` (template-literal safe) around one interpolation per entry of `refs`, an export name. */
+export interface TemplateBody {
+  parts: string[];
+  refs: string[];
+}
+
+export const CLICKHOUSE_TAG_OF: Readonly<Record<string, "database" | "table" | "view" | "dictionary" | "func">> = {
   [CLICKHOUSE_ENTITY_TYPES.database]: "database",
   [CLICKHOUSE_ENTITY_TYPES.table]: "table",
   [CLICKHOUSE_ENTITY_TYPES.view]: "view",
   [CLICKHOUSE_ENTITY_TYPES.materializedView]: "view",
+  [CLICKHOUSE_ENTITY_TYPES.dictionary]: "dictionary",
+  [CLICKHOUSE_ENTITY_TYPES.function]: "func",
 };
 
 /** A backquoted or double-quoted identifier, written bare when it can be and double-quoted otherwise. */
@@ -37,12 +47,16 @@ function identifierText(t: Token): string {
 /** Text that sits inside a template literal: a backquote and `${` escaped. */
 const templateSafe = (s: string) => s.replace(/\\(?=`|\$\{)/g, "\\\\").replace(/`/g, "\\`").replace(/\$\{/g, "\\${");
 
+/** Words after which a bare name is a relation: `FROM t`, `JOIN t`, a materialized view's `TO t`. */
+const RELATION_WORDS = new Set(["FROM", "JOIN", "TO"]);
+
 /**
  * The template body for one statement, and the exports it references. A
- * qualified name of another imported object becomes `${export}`; the database
- * part of the statement's own name becomes the database's export.
+ * qualified name of another object becomes `${export}`, and so does a bare
+ * name after `FROM`, `JOIN` or `TO` that an unqualified object has; the
+ * database part of the statement's own name becomes the database's export.
  */
-function templateBody(item: Item, byQualified: Map<string, Item>, dbExport: Map<string, string>): { body: string; refs: string[] } {
+function templateBody(item: Item, byQualified: Map<string, Item>, dbExport: Map<string, string>): TemplateBody {
   const tokens = tokenizeText(item.ddl, 0);
   let node: CreateNode | undefined;
   try {
@@ -56,41 +70,86 @@ function templateBody(item: Item, byQualified: Map<string, Item>, dbExport: Map<
     if (!isTrivia(t)) sig.push(i);
   });
   const isName = (t: Token | undefined) => t !== undefined && (t.kind === "ident" || t.kind === "qident");
-  const replace = new Map<number, { to: number; text: string; ref: string }>();
-  for (let k = 0; k + 2 < sig.length; k++) {
+  const isSelf = (target: Item) => target === item || target.exportName === item.exportName;
+  const replace = new Map<number, { to: number; ref: string }>();
+  for (let k = 0; k < sig.length; k++) {
     const a = tokens[sig[k]!]!;
-    const dot = tokens[sig[k + 1]!]!;
-    const b = tokens[sig[k + 2]!]!;
-    if (!isName(a) || dot.kind !== "punct" || dot.text !== "." || !isName(b)) continue;
+    const dot = tokens[sig[k + 1] ?? -1];
+    const b = tokens[sig[k + 2] ?? -1];
     const prev = tokens[sig[k - 1] ?? -1];
     if (prev?.kind === "punct" && prev.text === ".") continue;
+    if (!isName(a) || dot?.kind !== "punct" || dot.text !== "." || !isName(b)) {
+      const inOwnName = own !== undefined && sig[k]! >= own.from && sig[k]! < own.to;
+      const bare = isName(a) && !inOwnName && prev?.kind === "ident" && RELATION_WORDS.has(prev.text.toUpperCase());
+      const target = bare ? byQualified.get(unquote(a.text)) : undefined;
+      if (target && !isSelf(target)) replace.set(sig[k]!, { to: sig[k]! + 1, ref: target.exportName });
+      continue;
+    }
     const db = unquote(a.text);
-    const name = unquote(b.text);
+    const name = unquote(b!.text);
     const inOwnName = own !== undefined && sig[k]! >= own.from && sig[k]! < own.to;
     const target = byQualified.get(`${db}.${name}`);
-    if (!inOwnName && target && target !== item) {
-      replace.set(sig[k]!, { to: sig[k + 2]! + 1, text: `\${${target.exportName}}`, ref: target.exportName });
+    if (!inOwnName && target && !isSelf(target)) {
+      replace.set(sig[k]!, { to: sig[k + 2]! + 1, ref: target.exportName });
       k += 2;
     } else if (inOwnName && dbExport.has(db)) {
-      replace.set(sig[k]!, { to: sig[k]! + 1, text: `\${${dbExport.get(db)}}`, ref: dbExport.get(db)! });
+      replace.set(sig[k]!, { to: sig[k]! + 1, ref: dbExport.get(db)! });
       k += 2;
     }
   }
-  let body = "";
+  const parts: string[] = [""];
   const refs: string[] = [];
   for (let i = 0; i < tokens.length; ) {
     const r = replace.get(i);
     if (r) {
-      body += r.text;
       refs.push(r.ref);
+      parts.push("");
       i = r.to;
       continue;
     }
     const t = tokens[i]!;
-    body += t.kind === "qident" ? templateSafe(identifierText(t)) : templateSafe(t.text);
+    parts[parts.length - 1] += t.kind === "qident" ? templateSafe(identifierText(t)) : templateSafe(t.text);
     i++;
   }
-  return { body, refs };
+  return { parts, refs };
+}
+
+/** A template body as the text between the backquotes. */
+export const bodyText = (body: TemplateBody): string => body.parts.map((p, i) => (i === 0 ? p : `\${${body.refs[i - 1]}}${p}`)).join("");
+
+/**
+ * The template of each object in `items`, with the references to `targets`
+ * (the items themselves, and any object declared elsewhere that they may
+ * name) interpolated, and the items in the order a file declares them: each
+ * after what it references.
+ */
+export function clickhouseTemplates(items: readonly Item[], targets: readonly Item[] = items): { order: Item[]; bodies: Map<string, TemplateBody> } {
+  const byQualified = new Map<string, Item>();
+  const dbExport = new Map<string, string>();
+  for (const it of targets) {
+    if (it.type === CLICKHOUSE_ENTITY_TYPES.database) dbExport.set(it.name, it.exportName);
+    // A function is called, never named after FROM, JOIN or TO.
+    else if (it.type !== CLICKHOUSE_ENTITY_TYPES.function) byQualified.set(it.database ? `${it.database}.${it.name}` : it.name, it);
+  }
+  const bodies = new Map(items.map((it) => [it.exportName, templateBody(it, byQualified, dbExport)]));
+  // Declarations reference each other in one file, so each comes after what it references.
+  const order: Item[] = [];
+  const done = new Set<string>();
+  const visiting = new Set<string>();
+  const byExport = new Map(items.map((it) => [it.exportName, it]));
+  const visit = (it: Item) => {
+    if (done.has(it.exportName) || visiting.has(it.exportName)) return;
+    visiting.add(it.exportName);
+    for (const ref of bodies.get(it.exportName)!.refs) {
+      const dep = byExport.get(ref);
+      if (dep) visit(dep);
+    }
+    visiting.delete(it.exportName);
+    done.add(it.exportName);
+    order.push(it);
+  };
+  for (const it of items) visit(it);
+  return { order, bodies };
 }
 
 function indent(body: string): string {
@@ -105,7 +164,7 @@ export class ClickHouseGenerator implements TypeScriptGenerator {
 
   generate(ir: TemplateIR): GeneratedFile[] {
     const items: Item[] = ir.resources
-      .filter((r) => TAG[r.type])
+      .filter((r) => CLICKHOUSE_TAG_OF[r.type])
       .map((r) => ({
         exportName: r.logicalId,
         type: r.type,
@@ -115,38 +174,14 @@ export class ClickHouseGenerator implements TypeScriptGenerator {
       }));
     if (items.length === 0) return [];
 
-    const byQualified = new Map<string, Item>();
-    const dbExport = new Map<string, string>();
-    for (const it of items) {
-      if (it.type === CLICKHOUSE_ENTITY_TYPES.database) dbExport.set(it.name, it.exportName);
-      else if (it.database) byQualified.set(`${it.database}.${it.name}`, it);
-    }
+    const { order, bodies } = clickhouseTemplates(items);
 
-    const bodies = new Map(items.map((it) => [it.exportName, templateBody(it, byQualified, dbExport)]));
-    // Declarations reference each other in one file, so each comes after what it references.
-    const order: Item[] = [];
-    const done = new Set<string>();
-    const visiting = new Set<string>();
-    const byExport = new Map(items.map((it) => [it.exportName, it]));
-    const visit = (it: Item) => {
-      if (done.has(it.exportName) || visiting.has(it.exportName)) return;
-      visiting.add(it.exportName);
-      for (const ref of bodies.get(it.exportName)!.refs) {
-        const dep = byExport.get(ref);
-        if (dep) visit(dep);
-      }
-      visiting.delete(it.exportName);
-      done.add(it.exportName);
-      order.push(it);
-    };
-    for (const it of items) visit(it);
-
-    const tags = [...new Set(order.map((it) => TAG[it.type]!))].sort();
+    const tags = [...new Set(order.map((it) => CLICKHOUSE_TAG_OF[it.type]!))].sort();
     const lines: string[] = [];
     if (this.header) lines.push(...this.header.split("\n").map((l) => `// ${l}`), "");
     lines.push(`import { ${tags.join(", ")} } from "@intentius/chant-lexicon-sql/clickhouse";`, "");
     for (const it of order) {
-      lines.push(`export const ${it.exportName} = ${TAG[it.type]}\`\n  ${indent(bodies.get(it.exportName)!.body)}\`;`, "");
+      lines.push(`export const ${it.exportName} = ${CLICKHOUSE_TAG_OF[it.type]}\`\n  ${indent(bodyText(bodies.get(it.exportName)!))}\`;`, "");
     }
     return [{ path: "schema.ts", content: `${lines.join("\n").trimEnd()}\n` }];
   }

package/src/clickhouse/import/import.test.ts

@@ -38,15 +38,21 @@ describe("reading a file of statements", () => {
     ]);
   });
 
-  test("each statement becomes one resource of its type, a bad one a warning", () => {
-    const ir = new ClickHouseSqlParser().parse(`${SCHEMA}\nCREATE TABLE broken (a Strin g) ENGINE = Log;\nINSERT INTO t VALUES (1);`);
+  test("each statement becomes one resource of its type", () => {
+    const ir = new ClickHouseSqlParser().parse(SCHEMA);
     expect(ir.resources.map((r) => [r.logicalId, r.type])).toEqual([
       ["analyticsDb", "ClickHouse::Database"],
       ["events", "ClickHouse::Table"],
       ["counts", "ClickHouse::MaterializedView"],
       ["daily", "ClickHouse::Table"],
     ]);
-    expect(ir.warnings).toHaveLength(2);
+  });
+
+  test("a statement that does not parse or is not a CREATE stops the import, each named", () => {
+    const parse = () => new ClickHouseSqlParser().parse(`${SCHEMA}\nCREATE TABLE broken (a Strin g) ENGINE = Log;\nINSERT INTO t VALUES (1);`);
+    expect(parse).toThrow(/2 statements chant cannot read as declarations/);
+    expect(parse).toThrow(/does not parse \(.*\): CREATE TABLE broken/);
+    expect(parse).toThrow(/not a CREATE statement: INSERT INTO t VALUES \(1\)/);
   });
 });
 

package/src/clickhouse/import/ir.ts

@@ -96,7 +96,11 @@ const statementType = (node: CreateNode): ClickHouseEntityType =>
     ? CLICKHOUSE_ENTITY_TYPES.database
     : node.statement === "table"
       ? CLICKHOUSE_ENTITY_TYPES.table
-      : node.materialized
+      : node.statement === "dictionary"
+        ? CLICKHOUSE_ENTITY_TYPES.dictionary
+        : node.statement === "function"
+          ? CLICKHOUSE_ENTITY_TYPES.function
+          : node.materialized
         ? CLICKHOUSE_ENTITY_TYPES.materializedView
         : CLICKHOUSE_ENTITY_TYPES.view;
 
@@ -130,7 +134,7 @@ export function stripServerDefaults(ddl: string): string {
     return ddl;
   }
   const edits: Array<{ span: Span; text: string }> = [];
-  if (node.statement !== "database" && node.settings && node.settingsClause) {
+  if ((node.statement === "table" || node.statement === "view") && node.settings && node.settingsClause) {
     const text = (s: Span) => tokens.slice(s.from, s.to).map((t) => t.text).join("").trim();
     const kept = node.settings.filter((s) => {
       const def = (MERGE_TREE_SETTINGS as Record<string, { default: string } | undefined>)[s.key];

package/src/clickhouse/import/parser.ts

@@ -1,27 +1,19 @@
 /**
- * `chant import schema.sql`: a file of ClickHouse CREATE statements into the
- * import IR. Each statement must parse; one that does not is reported in the
- * IR's warnings and left out, with the parser's message.
+ * `chant import schema.sql` for ClickHouse: a file of CREATE statements into
+ * the import IR. A statement that is not a CREATE, or does not parse, is an
+ * error naming it (`../../files/clickhouse.ts`); none is left out.
  */
 
 import type { TemplateIR, TemplateParser } from "@intentius/chant/import/parser";
-import { describeStatement, objectsToIR, splitStatements, type ImportedObject } from "./ir";
+import { objectsToIR } from "./ir";
+import { readClickHouse } from "../../files/clickhouse";
+import { SqlFileError } from "../../files/common";
 
 export class ClickHouseSqlParser implements TemplateParser {
   parse(content: string): TemplateIR {
-    const objects: ImportedObject[] = [];
-    const warnings: string[] = [];
-    for (const stmt of splitStatements(content)) {
-      if (!/^\s*CREATE\b/i.test(stmt)) {
-        warnings.push(`not a CREATE statement, left out: ${stmt.split("\n")[0]!.slice(0, 80)}`);
-        continue;
-      }
-      try {
-        objects.push(describeStatement(stmt));
-      } catch (err) {
-        warnings.push(`does not parse, left out (${(err as Error).message}): ${stmt.split("\n")[0]!.slice(0, 80)}`);
-      }
-    }
-    return objectsToIR(objects, warnings);
+    const problems: string[] = [];
+    const objects = readClickHouse(content, { origin: "the DDL" }, problems);
+    if (problems.length > 0) throw new SqlFileError("the DDL", problems);
+    return objectsToIR(objects);
   }
 }

package/src/clickhouse/live/access.e2e.test.ts

@@ -0,0 +1,218 @@
+/**
+ * Access control against a server (#3682): a role, a user, a row policy and
+ * grants.
+ *
+ * On a single node:
+ *
+ * - a user declared with a password is the environment's to create, and is
+ *   not attempted until it exists; once it does, the apply makes the rest
+ *   of it as declared and leaves its password alone;
+ * - the role, the row policy and the grants are created; the plan is then
+ *   clean and the deep read reports no drift, although the server prints
+ *   the policy's condition and the grants its own way;
+ * - a privilege granted by hand to a declared grantee is SQLCH274 and is
+ *   revoked, a declared one revoked by hand is SQLCH273 and is granted
+ *   again, a changed role setting is SQLCH270, a changed policy SQLCH272;
+ * - the row policy filters rows for the user.
+ *
+ * Beside a Replicated database (two replicas of the pinned server in
+ * Docker): access control is in no database, so the database's log does not
+ * carry it; with no cluster named, each replica's apply makes it there.
+ *
+ * The single node: `CLICKHOUSE_URL` (with `CLICKHOUSE_USER` and
+ * `CLICKHOUSE_PASSWORD`) names a running one, such as the one
+ * `chant emulator up --lexicon sql` starts. Without it, a throwaway server
+ * at the pin, skipped cleanly when Docker is not available. Users and roles
+ * are global to the server, so the test names everything `chant_e2e_3682_access*`
+ * and drops it afterwards.
+ */
+
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterAll, beforeAll, describe, expect, test } from "vitest";
+import { dockerAvailable, startScratchCluster, startScratchServer, type ScratchCluster, type ScratchServer } from "../container";
+import { clickhouseQuery, type ClickHouseEndpoint } from "../http";
+import { clickhouseImage } from "../../spec/pin";
+import { database, grant, policy, role, table, user } from "../entities";
+import { planAgainstServer } from "../plan/commands";
+import { observeResourcesDeep, sqlDeepNormalizationHooks } from "../plan/deep";
+import { clickhouseApply } from "../../op/activities/clickhouse-apply";
+
+const DB = "chant_e2e_3682_access";
+const READER = `${DB}_reader`;
+const APP = `${DB}_app`;
+const fromEnv = process.env.CLICKHOUSE_URL;
+const docker = await dockerAvailable();
+const enabled = fromEnv !== undefined || docker;
+let server: ScratchServer | undefined;
+let endpoint: ClickHouseEndpoint;
+const dir = mkdtempSync(join(tmpdir(), "chant-sql-access-"));
+const q = <T = Record<string, unknown>>(sql: string, at: ClickHouseEndpoint = endpoint) => clickhouseQuery<T>(at, sql);
+const cleanup = async (at: ClickHouseEndpoint) => {
+  for (const sql of [`DROP ROW POLICY IF EXISTS ${DB}_tenant ON ${DB}.events`, `DROP USER IF EXISTS ${APP}`, `DROP ROLE IF EXISTS ${READER}`, `DROP DATABASE IF EXISTS ${DB} SYNC`]) {
+    await q(sql, at).catch(() => undefined);
+  }
+};
+
+beforeAll(async () => {
+  if (!enabled) return;
+  if (fromEnv !== undefined) {
+    endpoint = {
+      url: fromEnv,
+      ...(process.env.CLICKHOUSE_USER ? { user: process.env.CLICKHOUSE_USER } : {}),
+      ...(process.env.CLICKHOUSE_PASSWORD ? { password: process.env.CLICKHOUSE_PASSWORD } : {}),
+    };
+  } else {
+    server = await startScratchServer(clickhouseImage(), { namePrefix: "chant-sql-access" });
+    endpoint = server.endpoint;
+  }
+  await cleanup(endpoint);
+}, 600_000);
+
+afterAll(async () => {
+  if (enabled) await cleanup(endpoint);
+  await server?.stop();
+  rmSync(dir, { recursive: true, force: true });
+});
+
+const envOf = (at: ClickHouseEndpoint, topology?: string) => ({
+  CLICKHOUSE_URL: at.url,
+  ...(at.user ? { CLICKHOUSE_USER: at.user } : {}),
+  ...(at.password ? { CLICKHOUSE_PASSWORD: at.password } : {}),
+  ...(topology ? { CLICKHOUSE_TOPOLOGY: topology } : {}),
+});
+
+type Entity = { entityType: string; props: { ddl: string }; dependsOn?: unknown };
+function writeBuild(file: string, declared: Record<string, Entity>): string {
+  const path = join(dir, file);
+  const objects = Object.entries(declared).map(([k, e]) => ({ export: k, type: e.entityType, ddl: e.props.ddl, dependsOn: [] }));
+  writeFileSync(path, JSON.stringify({ dialect: "clickhouse", applyOrder: objects.map((o) => o.export), objects }));
+  return path;
+}
+
+async function apply(at: ClickHouseEndpoint, buildPath: string, topology?: string) {
+  const sent: string[] = [];
+  const outcome = await clickhouseApply({ buildPath, environment: "test" }, undefined, {
+    config: { ownership: { stack: "e2e3682", env: "test" } },
+    env: envOf(at, topology),
+    log: (l) => void (/^[A-Z]+ /.test(l) && sent.push(l)),
+  });
+  return { outcome, sent };
+}
+
+const compared = (props: object): Record<string, unknown> =>
+  Object.fromEntries(Object.entries(JSON.parse(JSON.stringify(props)) as Record<string, unknown>).filter(([k]) => !sqlDeepNormalizationHooks.prune!({ pattern: k } as never)));
+
+function declarations(opts: { memory?: string; tenant?: string } = {}) {
+  const shop = database([`CREATE DATABASE ${DB}`] as unknown as TemplateStringsArray);
+  const events = table([`CREATE TABLE ${DB}.events (id UInt64, tenant String) ENGINE = MergeTree ORDER BY id`] as unknown as TemplateStringsArray);
+  const reader = role([`CREATE ROLE ${READER} SETTINGS max_memory_usage = ${opts.memory ?? "1000000000"}`] as unknown as TemplateStringsArray);
+  const app = user([`CREATE USER ${APP} HOST ANY DEFAULT ROLE ${READER} DEFAULT DATABASE ${DB}`] as unknown as TemplateStringsArray);
+  const tenant = policy([`CREATE ROW POLICY ${DB}_tenant ON ${DB}.events USING tenant='${opts.tenant ?? "a"}' AND id+0>0 TO ${READER}`] as unknown as TemplateStringsArray);
+  const readEvents = grant([`GRANT SELECT(id, tenant) ON ${DB}.events TO ${READER}`] as unknown as TemplateStringsArray);
+  const readerToApp = grant([`GRANT ${READER} TO ${APP}`] as unknown as TemplateStringsArray);
+  return { shop, events, reader, app, tenant, readEvents, readerToApp };
+}
+
+describe.skipIf(!enabled)("access control on a single node (#3682)", () => {
+  test("a user with a password waits for the environment; the rest is created, planned clean, kept as declared", async () => {
+    const v1 = declarations();
+    const build = writeBuild("v1.json", v1);
+    const first = await apply(endpoint, build);
+    expect(first.outcome.failed).toEqual([]);
+    expect(first.outcome.notAttempted).toEqual([
+      expect.objectContaining({ name: `user ${APP}`, reason: "filtered", detail: expect.stringMatching(/password is the environment's/) }),
+      expect.objectContaining({ name: `grants ${APP}`, reason: "dependency-failed" }),
+    ]);
+    expect(first.outcome.applied.map((a) => [a.name, a.action])).toEqual([
+      [DB, "created"],
+      [`${DB}.events`, "created"],
+      [`role ${READER}`, "created"],
+      [`row policy ${DB}_tenant ON ${DB}.events`, "created"],
+      [`grants ${READER}`, "created"],
+    ]);
+
+    // The environment creates the user with its password; the next apply makes the rest of it as declared.
+    await q(`CREATE USER ${APP} IDENTIFIED WITH sha256_password BY 'chant-e2e'`);
+    const second = await apply(endpoint, build);
+    expect(second.outcome.failed).toEqual([]);
+    expect(second.sent).toEqual([
+      `ALTER USER \`${APP}\` DEFAULT DATABASE ${DB}`,
+      `GRANT \`${READER}\` TO \`${APP}\``,
+      // A default role must be held first.
+      `ALTER USER \`${APP}\` DEFAULT ROLE ${READER}`,
+    ]);
+    expect((await q<{ s: string }>(`SELECT auth_type[1] AS s FROM system.users WHERE name = '${APP}'`))[0]!.s).toBe("sha256_password");
+
+    // The server prints the policy's condition and the grants its own way: still the declarations.
+    const diff = await planAgainstServer("test", build, { config: {}, env: envOf(endpoint) });
+    expect(diff.changes).toEqual([]);
+    const entities = new Map(Object.entries(v1).map(([k, e]) => [k, { entityType: e.entityType, props: e.props as unknown as Record<string, unknown> }]));
+    const deep = await observeResourcesDeep({ environment: "test", entityNames: [...entities.keys()], entities, config: {}, env: envOf(endpoint) });
+    expect(Object.keys(deep.unobserved ?? {}).sort()).toEqual(["readEvents", "readerToApp"]);
+    for (const k of ["reader", "app", "tenant"] as const) expect(compared(deep.resources[k]!.properties), k).toEqual(compared(v1[k].props));
+
+    // The policy filters rows for the user.
+    await q(`INSERT INTO ${DB}.events VALUES (1, 'a'), (2, 'b'), (3, 'a')`);
+    const asApp = { ...endpoint, user: APP, password: "chant-e2e" };
+    expect(Number((await q<{ n: string }>(`SELECT count() AS n FROM ${DB}.events`, asApp))[0]!.n)).toBe(2);
+
+    // Changed by hand: a privilege granted, a declared one revoked. Changed in the declaration: a setting and the condition.
+    await q(`GRANT INSERT ON ${DB}.events TO ${READER}`);
+    await q(`REVOKE ${READER} FROM ${APP}`);
+    const v2 = declarations({ memory: "2000000000", tenant: "b" });
+    const planned = await planAgainstServer("test", writeBuild("v2.json", v2), { config: {}, env: envOf(endpoint) });
+    expect(planned.changes.map((c) => [c.object, c.field, c.rule])).toEqual([
+      [`reader (role ${READER})`, "settings", "SQLCH270"],
+      // Revoking the role took it off the user's default roles too.
+      [`app (user ${APP})`, "defaultRole", "SQLCH271"],
+      [`tenant (row policy ${DB}_tenant ON ${DB}.events)`, "using", "SQLCH272"],
+      [`grants ${READER}`, `grants.INSERT ON ${DB}.events`, "SQLCH274"],
+      [`grants ${APP}`, `grants.ROLE ${READER}`, "SQLCH273"],
+    ]);
+    const third = await apply(endpoint, writeBuild("v2.json", v2));
+    expect(third.outcome.failed).toEqual([]);
+    expect(third.sent).toEqual([
+      `ALTER ROLE \`${READER}\` SETTINGS max_memory_usage = 2000000000`,
+      `CREATE ROW POLICY OR REPLACE ${DB}_tenant ON ${DB}.events USING tenant='b' AND id+0>0 TO ${READER}`,
+      `REVOKE INSERT ON \`${DB}\`.\`events\` FROM \`${READER}\``,
+      `GRANT \`${READER}\` TO \`${APP}\``,
+      `ALTER USER \`${APP}\` DEFAULT ROLE ${READER}`,
+    ]);
+    expect((await planAgainstServer("test", writeBuild("v2.json", v2), { config: {}, env: envOf(endpoint) })).changes).toEqual([]);
+    expect(Number((await q<{ n: string }>(`SELECT count() AS n FROM ${DB}.events`, asApp))[0]!.n)).toBe(1);
+  }, 300_000);
+});
+
+describe.skipIf(!docker)("access control beside a Replicated database (#3682)", () => {
+  let cluster: ScratchCluster | undefined;
+  beforeAll(async () => {
+    cluster = await startScratchCluster(clickhouseImage(), { replicas: 2, namePrefix: "chant-sql-access-repl" });
+  }, 600_000);
+  afterAll(async () => {
+    await cluster?.stop();
+  });
+
+  test("each replica's apply makes it there, with no ON CLUSTER, and the next apply sends nothing", async () => {
+    const [r1, r2] = cluster!.replicas as [ClickHouseEndpoint, ClickHouseEndpoint];
+    const { shop, events, reader, tenant, readEvents } = declarations();
+    const build = writeBuild("repl.json", { shop, events, reader, tenant, readEvents });
+    const first = await apply(r1, build, "replicated");
+    expect(first.outcome.failed).toEqual([]);
+    expect(first.sent.join("\n")).not.toMatch(/ON CLUSTER/);
+    await q(first.sent[0]!, r2);
+    await q(`SYSTEM SYNC DATABASE REPLICA ${DB}`, r2);
+    const second = await apply(r2, build, "replicated");
+    expect(second.outcome.failed).toEqual([]);
+    expect(second.outcome.applied.filter((a) => a.action === "created").map((a) => a.name)).toEqual([
+      `role ${READER}`,
+      `row policy ${DB}_tenant ON ${DB}.events`,
+      `grants ${READER}`,
+    ]);
+    for (const at of [r1, r2]) {
+      expect(Number((await q<{ n: string }>(`SELECT count() AS n FROM system.row_policies WHERE short_name = '${DB}_tenant'`, at))[0]!.n)).toBe(1);
+      expect((await apply(at, build, "replicated")).sent).toEqual([]);
+    }
+  }, 300_000);
+});

package/src/clickhouse/live/bind.ts

@@ -8,6 +8,7 @@ import type { ChantConfig } from "@intentius/chant/config";
 import type { UnobservedReason } from "@intentius/chant/observation";
 import { ClickHouseQueryError, clickhouseQuery, type ClickHouseEndpoint } from "../http";
 import { parseTopology, toTopology, type Topology } from "../topology";
+import { credentialSource, POSTGRES_ONLY_TOKEN_SOURCES, TokenSourceError } from "../../token-source";
 
 export interface ClickHouseTarget {
   endpoint: ClickHouseEndpoint;
@@ -52,12 +53,21 @@ export function resolveClickHouseTarget(input: {
   if (profile) {
     const source = `sql.profiles.${input.environment}`;
     const endpoint: ClickHouseEndpoint = { url: profile.url.replace(/\/+$/, "") };
-    for (const key of ["user", "password"] as const) {
-      const ref = profile[key];
-      if (!ref) continue;
-      const value = env[ref.env];
-      if (value === undefined) return { reason: "no-credentials", detail: `${source}.${key} names ${ref.env}, which is not set` };
-      endpoint[key] = value;
+    if (profile.user) {
+      const value = env[profile.user.env];
+      if (value === undefined) return { reason: "no-credentials", detail: `${source}.user names ${profile.user.env}, which is not set` };
+      endpoint.user = value;
+    }
+    const password = profile.password;
+    if (password && "env" in password) {
+      const value = env[password.env];
+      if (value === undefined) return { reason: "no-credentials", detail: `${source}.password names ${password.env}, which is not set` };
+      endpoint.password = value;
+    } else if (password) {
+      if (POSTGRES_ONLY_TOKEN_SOURCES.has(password.token)) {
+        return { reason: "no-credentials", detail: `${source}.password is a ${password.token} token, which only a Postgres server takes; use a command source for ClickHouse` };
+      }
+      endpoint.token = credentialSource(password, { url: profile.url, ...(endpoint.user !== undefined ? { user: endpoint.user } : {}), env, source: `${source}.password` });
     }
     return {
       endpoint,
@@ -121,6 +131,7 @@ export async function bindClickHouse(options: BindOptions = {}): Promise<ClickHo
 /** What a failed bind or read means, in the observation vocabulary. */
 export function classifyClickHouseFailure(err: unknown): { reason: UnobservedReason; detail: string } {
   if (err instanceof ClickHouseBindingError) return { reason: err.unresolved.reason, detail: err.unresolved.detail };
+  if (err instanceof TokenSourceError) return { reason: "no-credentials", detail: err.message };
   if (err instanceof ClickHouseQueryError) {
     // 516 AUTHENTICATION_FAILED and 497 ACCESS_DENIED arrive as 401/403 or in the message.
     if (err.status === 401 || err.status === 403 || /AUTHENTICATION_FAILED|ACCESS_DENIED|Code: 516|Code: 497/.test(err.serverMessage)) {