@lightdash/warehouses 2.228.0 → 2.229.0

package/dist/warehouseClients/pgProtocolGuard.integration.test.js

@@ -1,93 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-require("./pgProtocolGuard");
-const net = __importStar(require("net"));
-const pg_1 = require("pg");
-// Builds a full AuthenticationResponse wire message with the given sub-code.
-// Byte layout: 'R' (0x52) + Int32 length (includes length bytes, excludes
-// code) + Int32 sub-code. Mirrors what the Redshift server sends for IAM
-// Identity Center auth (sub-code 13) before pg-protocol's Parser throws.
-const buildAuthTypeMessage = (subCode) => {
-    const buffer = Buffer.alloc(9);
-    buffer.writeUInt8(0x52, 0); // 'R'
-    buffer.writeUInt32BE(8, 1); // length
-    buffer.writeInt32BE(subCode, 5);
-    return buffer;
-};
-const startFakePostgresServer = (subCode) => new Promise((resolve) => {
-    const server = net.createServer((socket) => {
-        // Swallow the client's startup packet, then send the bad auth
-        // message. We only need one data event to kick it off.
-        socket.once('data', () => {
-            socket.write(buildAuthTypeMessage(subCode));
-        });
-        socket.on('error', () => {
-            /* ignore — client may RST after we send garbage */
-        });
-    });
-    server.listen(0, '127.0.0.1', () => resolve(server));
-});
-describe('pgProtocolGuard (integration)', () => {
-    // End-to-end regression for https://github.com/lightdash/lightdash/issues/22098.
-    // Without the guard, pg-protocol throws synchronously inside the socket's
-    // 'data' listener, which becomes an uncaught exception and crashes the
-    // Node process. With the guard, the same scenario rejects pg.Client's
-    // connect() promise cleanly.
-    it('rejects pg.Client.connect() instead of crashing the process', async () => {
-        const server = await startFakePostgresServer(13);
-        const address = server.address();
-        if (!address || typeof address === 'string') {
-            throw new Error('fake server did not bind to a TCP address');
-        }
-        const client = new pg_1.Client({
-            host: '127.0.0.1',
-            port: address.port,
-            user: 'anything',
-            password: 'anything',
-            database: 'anything',
-            ssl: false,
-        });
-        try {
-            await expect(client.connect()).rejects.toThrow(/unsupported authentication method \(code 13\).*Identity Center/);
-        }
-        finally {
-            await client.end().catch(() => { });
-            await new Promise((resolve) => {
-                server.close(() => resolve());
-            });
-        }
-    });
-});

package/dist/warehouseClients/pgProtocolGuard.test.d.ts

@@ -1,2 +0,0 @@
-import './pgProtocolGuard';
-//# sourceMappingURL=pgProtocolGuard.test.d.ts.map

package/dist/warehouseClients/pgProtocolGuard.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"pgProtocolGuard.test.d.ts","sourceRoot":"","sources":["../../src/warehouseClients/pgProtocolGuard.test.ts"],"names":[],"mappings":"AAAA,OAAO,mBAAmB,CAAC"}

package/dist/warehouseClients/pgProtocolGuard.test.js

@@ -1,48 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-require("./pgProtocolGuard");
-const messages_1 = require("pg-protocol/dist/messages");
-const parser_1 = require("pg-protocol/dist/parser");
-// Build a single pg message: 1 byte code + UInt32BE length (incl. length
-// bytes, excl. code) + payload.
-const buildAuthenticationMessage = (authCode) => {
-    const codeByte = 82; // 'R' — AuthenticationResponse
-    const payload = Buffer.alloc(4);
-    payload.writeInt32BE(authCode, 0);
-    const length = 4 + payload.length; // length field itself + payload
-    const buffer = Buffer.alloc(1 + length);
-    buffer.writeUInt8(codeByte, 0);
-    buffer.writeUInt32BE(length, 1);
-    payload.copy(buffer, 5);
-    return buffer;
-};
-describe('pgProtocolGuard', () => {
-    // Regression for https://github.com/lightdash/lightdash/issues/22098
-    // Redshift IAM / Identity Center auth sends an unknown authentication
-    // message code (e.g. 13). Without the guard, pg-protocol's Parser
-    // throws synchronously from the TLSSocket 'data' listener, which
-    // becomes an uncaught exception and crashes the backend process.
-    it('converts synchronous parser errors into a DatabaseError callback', () => {
-        const parser = new parser_1.Parser();
-        const buffer = buildAuthenticationMessage(13);
-        const received = [];
-        expect(() => {
-            parser.parse(buffer, (msg) => received.push(msg));
-        }).not.toThrow();
-        expect(received).toHaveLength(1);
-        const [msg] = received;
-        expect(msg).toBeInstanceOf(messages_1.DatabaseError);
-        expect(msg.name).toBe('error');
-        expect(msg.message).toMatch(/unsupported authentication method \(code 13\)/);
-        expect(msg.message).toMatch(/Identity Center/);
-    });
-    it('passes known messages through unchanged', () => {
-        const parser = new parser_1.Parser();
-        // Auth code 0 — AuthenticationOk
-        const buffer = buildAuthenticationMessage(0);
-        const received = [];
-        parser.parse(buffer, (msg) => received.push(msg));
-        expect(received).toHaveLength(1);
-        expect(received[0].name).toBe('authenticationOk');
-    });
-});

package/dist/warehouseClients/redshiftIamCredentials.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=redshiftIamCredentials.test.d.ts.map

package/dist/warehouseClients/redshiftIamCredentials.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"redshiftIamCredentials.test.d.ts","sourceRoot":"","sources":["../../src/warehouseClients/redshiftIamCredentials.test.ts"],"names":[],"mappings":""}

package/dist/warehouseClients/redshiftIamCredentials.test.js

@@ -1,210 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-/* eslint-disable prefer-arrow-callback, func-names */
-const common_1 = require("@lightdash/common");
-const mockClusterSend = vi.fn();
-const mockServerlessSend = vi.fn();
-vi.mock('@aws-sdk/client-redshift', () => ({
-    RedshiftClient: vi.fn(function () {
-        return { send: mockClusterSend };
-    }),
-    GetClusterCredentialsCommand: vi.fn(function (input) {
-        return { __command: 'cluster', input };
-    }),
-    GetClusterCredentialsWithIAMCommand: vi.fn(function (input) {
-        return { __command: 'cluster-with-iam', input };
-    }),
-}));
-vi.mock('@aws-sdk/client-redshift-serverless', () => ({
-    RedshiftServerlessClient: vi.fn(function () {
-        return { send: mockServerlessSend };
-    }),
-    GetCredentialsCommand: vi.fn(function (input) {
-        return { __command: 'serverless', input };
-    }),
-}));
-const { mockFromTemporaryCredentials } = vi.hoisted(() => ({
-    mockFromTemporaryCredentials: vi.fn(() => 'sts-credentials'),
-}));
-vi.mock('@aws-sdk/credential-providers', () => ({
-    fromTemporaryCredentials: mockFromTemporaryCredentials,
-}));
-// eslint-disable-next-line import/first -- Must import after mocks are set up
-const redshiftIamCredentials_1 = require("./redshiftIamCredentials");
-const provisionedCredentials = {
-    type: common_1.WarehouseTypes.REDSHIFT,
-    host: 'my-cluster.abc123.us-east-1.redshift.amazonaws.com',
-    user: 'analytics',
-    port: 5439,
-    dbname: 'dev',
-    schema: 'public',
-    authenticationType: common_1.RedshiftAuthenticationType.IAM,
-    region: 'us-east-1',
-    clusterIdentifier: 'my-cluster',
-    accessKeyId: 'AKID',
-    secretAccessKey: 'SECRET',
-};
-const serverlessCredentials = {
-    type: common_1.WarehouseTypes.REDSHIFT,
-    host: 'my-wg.123.us-east-1.redshift-serverless.amazonaws.com',
-    user: '',
-    port: 5439,
-    dbname: 'dev',
-    schema: 'public',
-    authenticationType: common_1.RedshiftAuthenticationType.IAM,
-    region: 'us-east-1',
-    isServerless: true,
-    workgroupName: 'my-workgroup',
-    accessKeyId: 'AKID',
-    secretAccessKey: 'SECRET',
-};
-describe('getRedshiftAwsCredentials', () => {
-    beforeEach(() => {
-        vi.clearAllMocks();
-    });
-    test('returns static credentials when access keys are provided', () => {
-        const result = (0, redshiftIamCredentials_1.getRedshiftAwsCredentials)(provisionedCredentials);
-        expect(result).toEqual({
-            accessKeyId: 'AKID',
-            secretAccessKey: 'SECRET',
-            sessionToken: undefined,
-        });
-        expect(mockFromTemporaryCredentials).not.toHaveBeenCalled();
-    });
-    test('returns undefined (default chain) when no access keys are provided', () => {
-        const result = (0, redshiftIamCredentials_1.getRedshiftAwsCredentials)({
-            ...provisionedCredentials,
-            accessKeyId: undefined,
-            secretAccessKey: undefined,
-        });
-        expect(result).toBeUndefined();
-    });
-    test('wraps with assume-role when assumeRoleArn is set', () => {
-        (0, redshiftIamCredentials_1.getRedshiftAwsCredentials)({
-            ...provisionedCredentials,
-            assumeRoleArn: 'arn:aws:iam::123456789012:role/redshift',
-            assumeRoleExternalId: 'ext-1',
-        });
-        expect(mockFromTemporaryCredentials).toHaveBeenCalledWith({
-            masterCredentials: {
-                accessKeyId: 'AKID',
-                secretAccessKey: 'SECRET',
-                sessionToken: undefined,
-            },
-            params: {
-                RoleArn: 'arn:aws:iam::123456789012:role/redshift',
-                RoleSessionName: 'lightdash-redshift-session',
-                ExternalId: 'ext-1',
-            },
-        });
-    });
-    test('does not re-assume when a session token is already present', () => {
-        const result = (0, redshiftIamCredentials_1.getRedshiftAwsCredentials)({
-            ...provisionedCredentials,
-            sessionToken: 'TEMP_TOKEN',
-            assumeRoleArn: 'arn:aws:iam::123456789012:role/redshift',
-        });
-        expect(mockFromTemporaryCredentials).not.toHaveBeenCalled();
-        expect(result).toEqual({
-            accessKeyId: 'AKID',
-            secretAccessKey: 'SECRET',
-            sessionToken: 'TEMP_TOKEN',
-        });
-    });
-});
-describe('mintRedshiftIamCredentials', () => {
-    beforeEach(() => {
-        vi.clearAllMocks();
-    });
-    test('mints credentials for a provisioned cluster', async () => {
-        const expiration = new Date('2026-01-01T00:00:00Z');
-        mockClusterSend.mockResolvedValue({
-            DbUser: 'IAM:analytics',
-            DbPassword: 'temp-password',
-            Expiration: expiration,
-        });
-        const result = await (0, redshiftIamCredentials_1.mintRedshiftIamCredentials)(provisionedCredentials);
-        expect(result).toEqual({
-            dbUser: 'IAM:analytics',
-            dbPassword: 'temp-password',
-            expiration,
-        });
-        expect(mockClusterSend).toHaveBeenCalledTimes(1);
-        expect(mockServerlessSend).not.toHaveBeenCalled();
-    });
-    test('mints credentials from the IAM identity when no database user is provided', async () => {
-        const expiration = new Date('2026-01-01T00:00:00Z');
-        mockClusterSend.mockResolvedValue({
-            DbUser: 'IAMR:user-role',
-            DbPassword: 'temp-password',
-            Expiration: expiration,
-        });
-        const result = await (0, redshiftIamCredentials_1.mintRedshiftIamCredentials)({
-            ...provisionedCredentials,
-            user: '',
-            assumeRoleArn: 'arn:aws:iam::123456789012:role/user-role',
-        });
-        expect(result).toEqual({
-            dbUser: 'IAMR:user-role',
-            dbPassword: 'temp-password',
-            expiration,
-        });
-        expect(mockClusterSend).toHaveBeenCalledWith({
-            __command: 'cluster-with-iam',
-            input: {
-                ClusterIdentifier: 'my-cluster',
-                DbName: 'dev',
-                DurationSeconds: 3600,
-            },
-        });
-        expect(mockServerlessSend).not.toHaveBeenCalled();
-    });
-    test('mints credentials for a serverless workgroup', async () => {
-        const expiration = new Date('2026-01-01T00:00:00Z');
-        mockServerlessSend.mockResolvedValue({
-            dbUser: 'IAMR:role',
-            dbPassword: 'temp-password',
-            expiration,
-        });
-        const result = await (0, redshiftIamCredentials_1.mintRedshiftIamCredentials)(serverlessCredentials);
-        expect(result).toEqual({
-            dbUser: 'IAMR:role',
-            dbPassword: 'temp-password',
-            expiration,
-        });
-        expect(mockServerlessSend).toHaveBeenCalledTimes(1);
-        expect(mockClusterSend).not.toHaveBeenCalled();
-    });
-    test('throws when the region is missing', async () => {
-        await expect((0, redshiftIamCredentials_1.mintRedshiftIamCredentials)({
-            ...provisionedCredentials,
-            region: undefined,
-        })).rejects.toThrow(common_1.WarehouseConnectionError);
-    });
-    test('throws when a provisioned cluster identifier is missing', async () => {
-        await expect((0, redshiftIamCredentials_1.mintRedshiftIamCredentials)({
-            ...provisionedCredentials,
-            clusterIdentifier: undefined,
-        })).rejects.toThrow(common_1.WarehouseConnectionError);
-    });
-    test('throws when a serverless workgroup name is missing', async () => {
-        await expect((0, redshiftIamCredentials_1.mintRedshiftIamCredentials)({
-            ...serverlessCredentials,
-            workgroupName: undefined,
-        })).rejects.toThrow(common_1.WarehouseConnectionError);
-    });
-    test('throws RedshiftIamTokenError when the AWS session token has expired', async () => {
-        mockClusterSend.mockRejectedValue({
-            name: 'ExpiredTokenException',
-            message: 'The security token included in the request is expired',
-        });
-        await expect((0, redshiftIamCredentials_1.mintRedshiftIamCredentials)(provisionedCredentials)).rejects.toThrow(common_1.RedshiftIamTokenError);
-    });
-});
-describe('isExpiredAwsTokenError', () => {
-    test('detects expired AWS tokens by name or message', () => {
-        expect((0, redshiftIamCredentials_1.isExpiredAwsTokenError)({ name: 'ExpiredToken' })).toBe(true);
-        expect((0, redshiftIamCredentials_1.isExpiredAwsTokenError)(new Error('The security token included in the request is expired'))).toBe(true);
-        expect((0, redshiftIamCredentials_1.isExpiredAwsTokenError)(new Error('Access denied'))).toBe(false);
-    });
-});

package/dist/warehouseClients/timestampDomain.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=timestampDomain.test.d.ts.map

package/dist/warehouseClients/timestampDomain.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"timestampDomain.test.d.ts","sourceRoot":"","sources":["../../src/warehouseClients/timestampDomain.test.ts"],"names":[],"mappings":""}

package/dist/warehouseClients/timestampDomain.test.js

@@ -1,101 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const AthenaWarehouseClient_1 = require("./AthenaWarehouseClient");
-const BigqueryWarehouseClient_1 = require("./BigqueryWarehouseClient");
-const ClickhouseWarehouseClient_1 = require("./ClickhouseWarehouseClient");
-const DatabricksWarehouseClient_1 = require("./DatabricksWarehouseClient");
-const DuckdbWarehouseClient_1 = require("./DuckdbWarehouseClient");
-const PostgresWarehouseClient_1 = require("./PostgresWarehouseClient");
-const SnowflakeWarehouseClient_1 = require("./SnowflakeWarehouseClient");
-const TrinoWarehouseClient_1 = require("./TrinoWarehouseClient");
-describe('postgres timestamp domain', () => {
-    it('classifies naive types', () => {
-        expect((0, PostgresWarehouseClient_1.getPostgresTimestampDomain)('timestamp')).toEqual('naive');
-        expect((0, PostgresWarehouseClient_1.getPostgresTimestampDomain)('timestamp without time zone')).toEqual('naive');
-    });
-    it('classifies aware types', () => {
-        expect((0, PostgresWarehouseClient_1.getPostgresTimestampDomain)('timestamptz')).toEqual('aware');
-        expect((0, PostgresWarehouseClient_1.getPostgresTimestampDomain)('timestamp with time zone')).toEqual('aware');
-    });
-    it('leaves non-timestamp types unclassified', () => {
-        expect((0, PostgresWarehouseClient_1.getPostgresTimestampDomain)('integer')).toBeUndefined();
-        expect((0, PostgresWarehouseClient_1.getPostgresTimestampDomain)('date')).toBeUndefined();
-        expect((0, PostgresWarehouseClient_1.getPostgresTimestampDomain)('time')).toBeUndefined();
-    });
-});
-describe('bigquery timestamp domain', () => {
-    it('classifies DATETIME as naive and TIMESTAMP as aware', () => {
-        expect((0, BigqueryWarehouseClient_1.getBigqueryTimestampDomain)('DATETIME')).toEqual('naive');
-        expect((0, BigqueryWarehouseClient_1.getBigqueryTimestampDomain)('TIMESTAMP')).toEqual('aware');
-    });
-    it('leaves TIME and non-timestamp types unclassified', () => {
-        expect((0, BigqueryWarehouseClient_1.getBigqueryTimestampDomain)('TIME')).toBeUndefined();
-        expect((0, BigqueryWarehouseClient_1.getBigqueryTimestampDomain)('STRING')).toBeUndefined();
-    });
-});
-describe('snowflake timestamp domain', () => {
-    it('classifies NTZ as naive, including parameterised types', () => {
-        expect((0, SnowflakeWarehouseClient_1.getSnowflakeTimestampDomain)('TIMESTAMP_NTZ')).toEqual('naive');
-        expect((0, SnowflakeWarehouseClient_1.getSnowflakeTimestampDomain)('TIMESTAMP_NTZ(9)')).toEqual('naive');
-    });
-    it('classifies TZ and LTZ as aware', () => {
-        expect((0, SnowflakeWarehouseClient_1.getSnowflakeTimestampDomain)('TIMESTAMP_TZ')).toEqual('aware');
-        expect((0, SnowflakeWarehouseClient_1.getSnowflakeTimestampDomain)('TIMESTAMP_LTZ(9)')).toEqual('aware');
-    });
-    it('leaves bare TIMESTAMP unclassified (account-level alias)', () => {
-        expect((0, SnowflakeWarehouseClient_1.getSnowflakeTimestampDomain)('TIMESTAMP')).toBeUndefined();
-    });
-});
-describe('databricks timestamp domain', () => {
-    it('classifies TIMESTAMP_NTZ as naive despite type normalization truncating it', () => {
-        expect((0, DatabricksWarehouseClient_1.getDatabricksTimestampDomain)('TIMESTAMP_NTZ')).toEqual('naive');
-    });
-    it('classifies bare TIMESTAMP as aware (stores an instant)', () => {
-        expect((0, DatabricksWarehouseClient_1.getDatabricksTimestampDomain)('TIMESTAMP')).toEqual('aware');
-    });
-    it('leaves non-timestamp types unclassified', () => {
-        expect((0, DatabricksWarehouseClient_1.getDatabricksTimestampDomain)('DECIMAL(10,2)')).toBeUndefined();
-    });
-});
-describe('trino timestamp domain', () => {
-    it('classifies bare timestamp as naive, stripping any precision', () => {
-        expect((0, TrinoWarehouseClient_1.getTrinoTimestampDomain)('timestamp')).toEqual('naive');
-        expect((0, TrinoWarehouseClient_1.getTrinoTimestampDomain)('timestamp(3)')).toEqual('naive');
-        expect((0, TrinoWarehouseClient_1.getTrinoTimestampDomain)('timestamp(6)')).toEqual('naive');
-    });
-    it('classifies timestamp with time zone as aware', () => {
-        expect((0, TrinoWarehouseClient_1.getTrinoTimestampDomain)('timestamp with time zone')).toEqual('aware');
-        expect((0, TrinoWarehouseClient_1.getTrinoTimestampDomain)('timestamp(3) with time zone')).toEqual('aware');
-    });
-    it('leaves non-timestamp types unclassified', () => {
-        expect((0, TrinoWarehouseClient_1.getTrinoTimestampDomain)('varchar')).toBeUndefined();
-    });
-});
-describe('clickhouse timestamp domain', () => {
-    it('classifies DateTime types as always aware', () => {
-        expect((0, ClickhouseWarehouseClient_1.getClickhouseTimestampDomain)('DateTime')).toEqual('aware');
-        expect((0, ClickhouseWarehouseClient_1.getClickhouseTimestampDomain)("DateTime64(3, 'UTC')")).toEqual('aware');
-        expect((0, ClickhouseWarehouseClient_1.getClickhouseTimestampDomain)('Nullable(DateTime)')).toEqual('aware');
-    });
-    it('leaves non-timestamp types unclassified', () => {
-        expect((0, ClickhouseWarehouseClient_1.getClickhouseTimestampDomain)('Date')).toBeUndefined();
-    });
-});
-describe('athena timestamp domain', () => {
-    it('classifies bare timestamp as naive and with time zone as aware', () => {
-        expect((0, AthenaWarehouseClient_1.getAthenaTimestampDomain)('timestamp')).toEqual('naive');
-        expect((0, AthenaWarehouseClient_1.getAthenaTimestampDomain)('timestamp(3)')).toEqual('naive');
-        expect((0, AthenaWarehouseClient_1.getAthenaTimestampDomain)('timestamp with time zone')).toEqual('aware');
-    });
-    it('leaves non-timestamp types unclassified', () => {
-        expect((0, AthenaWarehouseClient_1.getAthenaTimestampDomain)('varchar')).toBeUndefined();
-    });
-});
-describe('duckdb timestamp domain', () => {
-    it('classifies type name strings', () => {
-        expect((0, DuckdbWarehouseClient_1.getDuckdbTimestampDomainFromString)('TIMESTAMP')).toEqual('naive');
-        expect((0, DuckdbWarehouseClient_1.getDuckdbTimestampDomainFromString)('TIMESTAMP WITH TIME ZONE')).toEqual('aware');
-        expect((0, DuckdbWarehouseClient_1.getDuckdbTimestampDomainFromString)('TIMESTAMPTZ')).toEqual('aware');
-        expect((0, DuckdbWarehouseClient_1.getDuckdbTimestampDomainFromString)('BOOLEAN')).toBeUndefined();
-    });
-});