@malloy-publisher/server 0.0.230 → 0.0.232

package/src/service/connection.ts

@@ -52,6 +52,7 @@ import {
 } from "./connection_config";
 import { CloudStorageCredentials } from "./gcs_s3_utils";
 import { openProxy, type ProxyEndpoint } from "./proxy";
+import { quoteIdentifier } from "./quoting";
 
 type AttachedDatabase = components["schemas"]["AttachedDatabase"];
 type ApiConnection = components["schemas"]["Connection"];
@@ -148,7 +149,7 @@ export async function applyExtensionSessionSettings(
    }
 }
 
-async function installAndLoadExtension(
+export async function installAndLoadExtension(
    connection: DuckDBConnection,
    extensionName: string,
    fromCommunity = false,
@@ -232,7 +233,7 @@ function sanitizeSecretName(name: string): string {
    return `secret_${name.replace(/[^a-zA-Z0-9_]/g, "_")}`;
 }
 
-function escapeSQL(value: string): string {
+export function escapeSQL(value: string): string {
    return value.replace(/'/g, "''");
 }
 
@@ -574,10 +575,21 @@ async function preflightDuckLakeCatalogFormat(
    );
 }
 
-async function attachDuckLake(
+/**
+ * Attach a DuckLake catalog in a given access mode. `readOnly: true` (the live
+ * user-facing connection path) attaches with `READ_ONLY true`; `readOnly: false`
+ * produces the read-WRITE build variant used only on a transient, build-scoped
+ * session so a materialization can `CREATE TABLE` into the catalog. Both keep
+ * `OVERRIDE_DATA_PATH true` and NEVER pass `AUTOMATIC_MIGRATION` — catalog-format
+ * migration is a coordinated fleet cutover, never an implicit side effect of a
+ * build attach. Both range-preflight the catalog format first (see
+ * {@link preflightDuckLakeCatalogFormat}).
+ */
+async function attachDuckLakeWithMode(
    connection: DuckDBConnection,
    dbName: string,
    ducklakeConfig: components["schemas"]["DucklakeConnection"],
+   options: { readOnly: boolean },
 ): Promise<void> {
    // Tier build/serve DuckLake sessions never implicitly auto-install (Publisher
    // installs the DuckLake stack explicitly below) — regardless of the policy.
@@ -618,8 +630,9 @@ async function attachDuckLake(
 
    const pg = ducklakeConfig.catalog.postgresConnection;
    const pgConnString: string = buildPgConnectionString(pg);
-   // Attach DuckLake with Postgres catalog and cloud storage data path in READ_ONLY mode
-   // The client manages metadata - we only read from the catalogs
+   const mode = options.readOnly ? "READ_ONLY" : "READ_WRITE";
+   // READ_ONLY: the client manages metadata, we only read the catalog.
+   // READ_WRITE (build only): a build-scoped session materializes into it.
    logger.info(`pgConnString: ${redactPgSecrets(pgConnString)}`);
    const escapedPgConnString = escapeSQL(pgConnString);
    logger.info(
@@ -630,14 +643,17 @@ async function attachDuckLake(
    // Range-preflight the catalog's recorded format version so an unsupported
    // catalog fails as a clean, actionable 422 rather than a deep DuckDB 500.
    await preflightDuckLakeCatalogFormat(connection, dbName, pgConnString);
-   const attachCommand = `ATTACH OR REPLACE 'ducklake:postgres:${escapedPgConnString}' AS ${dbName} (DATA_PATH '${escapedBucketUrl}', OVERRIDE_DATA_PATH true, READ_ONLY true);`;
+   // READ_ONLY is stated explicitly; read-write omits the flag (DuckLake's
+   // default is writable). AUTOMATIC_MIGRATION is never set in either mode.
+   const readOnlyClause = options.readOnly ? ", READ_ONLY true" : "";
+   const attachCommand = `ATTACH OR REPLACE 'ducklake:postgres:${escapedPgConnString}' AS ${dbName} (DATA_PATH '${escapedBucketUrl}', OVERRIDE_DATA_PATH true${readOnlyClause});`;
    logger.info(
       `Attaching DuckLake database using command: ${redactPgSecrets(attachCommand)}`,
    );
    try {
       await connection.runSQL(attachCommand);
       logger.info(
-         `Successfully attached DuckLake database in READ_ONLY mode: ${dbName}`,
+         `Successfully attached DuckLake database in ${mode} mode: ${dbName}`,
       );
    } catch (error) {
       // Handle case where DuckLake database is already attached
@@ -655,6 +671,246 @@ async function attachDuckLake(
    }
 }
 
+async function attachDuckLake(
+   connection: DuckDBConnection,
+   dbName: string,
+   ducklakeConfig: components["schemas"]["DucklakeConnection"],
+): Promise<void> {
+   await attachDuckLakeWithMode(connection, dbName, ducklakeConfig, {
+      readOnly: true,
+   });
+}
+
+/**
+ * Read-WRITE DuckLake attach for a materialization build. Identical to the
+ * read-only user-facing attach except the catalog is writable, so a build-scoped
+ * session can `CREATE TABLE ... AS` into it. Least privilege: this variant is
+ * only ever used on a transient build session (never the serve connection), for
+ * the duration of one build. Like the read-only attach it is lazy and never on
+ * the worker boot path.
+ */
+export async function attachDuckLakeReadWrite(
+   connection: DuckDBConnection,
+   dbName: string,
+   ducklakeConfig: components["schemas"]["DucklakeConnection"],
+): Promise<void> {
+   await attachDuckLakeWithMode(connection, dbName, ducklakeConfig, {
+      readOnly: false,
+   });
+}
+
+/** A source warehouse type that exposes a native DuckDB query-passthrough. */
+export type FederatedSourceType = "bigquery" | "snowflake" | "postgres";
+
+/**
+ * The result of federating a source connection onto a build session: the
+ * `handle` a passthrough table function needs to reach it —
+ *  - bigquery: the resolved project id (`bigquery_query('<project>', '<sql>')`),
+ *  - snowflake: the created secret name (`snowflake_query('<sql>', '<secret>')`),
+ *  - postgres: the ATTACH alias (`postgres_query('<alias>', '<sql>')`).
+ */
+export interface FederatedHandle {
+   handle: string;
+   sourceType: FederatedSourceType;
+}
+
+/**
+ * The source connection's configuration needed to federate it onto a build
+ * session. `name` is a caller-supplied, already-safe base for the secret/alias
+ * identifiers; the type-specific config carries the credentials.
+ */
+export interface FederationConfig {
+   name: string;
+   bigqueryConnection?: components["schemas"]["BigqueryConnection"];
+   snowflakeConnection?: components["schemas"]["SnowflakeConnection"];
+   postgresConnection?: components["schemas"]["PostgresConnection"];
+}
+
+/**
+ * Establish a SOURCE warehouse's credentials on a build-scoped DuckDB session so
+ * a native query-passthrough (`bigquery_query`/`snowflake_query`/`postgres_query`)
+ * can push the compiled SELECT to that warehouse and stream back result rows.
+ * This is the credential-federation half of the build path: it runs ONLY on the
+ * transient build session, on demand, for the build's duration — the source
+ * creds are never established on the serve connection and never persisted into a
+ * connection config. It mirrors the existing read-only attach handlers but
+ * targets the passthrough functions (bigquery/snowflake need only a SECRET, no
+ * ATTACH; postgres needs an ATTACH whose alias the function references).
+ *
+ * @returns the {@link FederatedHandle} the caller passes to `wrapPassthrough`.
+ * @throws for a source type without a native passthrough, or missing/invalid
+ *   credentials, so a build fails loud rather than producing a wrong table.
+ */
+export async function federateSourceForPassthrough(
+   connection: DuckDBConnection,
+   sourceType: FederatedSourceType,
+   config: FederationConfig,
+): Promise<FederatedHandle> {
+   switch (sourceType) {
+      case "bigquery":
+         return federateBigQuery(connection, config);
+      case "snowflake":
+         return federateSnowflake(connection, config);
+      case "postgres":
+         return federatePostgres(connection, config);
+      default: {
+         // Exhaustiveness guard: a new FederatedSourceType must add a branch.
+         const exhaustive: never = sourceType;
+         throw new Error(
+            `No native query-passthrough for source type '${String(exhaustive)}'`,
+         );
+      }
+   }
+}
+
+async function federateBigQuery(
+   connection: DuckDBConnection,
+   config: FederationConfig,
+): Promise<FederatedHandle> {
+   const bq = config.bigqueryConnection;
+   if (!bq) {
+      throw new Error(
+         `BigQuery connection configuration missing for: ${config.name}`,
+      );
+   }
+
+   let projectId = bq.defaultProjectId;
+   let serviceAccountJson: string | undefined;
+   if (bq.serviceAccountKeyJson) {
+      const keyData = JSON.parse(bq.serviceAccountKeyJson as string);
+      const requiredFields = [
+         "type",
+         "project_id",
+         "private_key",
+         "client_email",
+      ];
+      for (const field of requiredFields) {
+         if (!keyData[field]) {
+            throw new Error(
+               `Invalid service account key: missing "${field}" field`,
+            );
+         }
+      }
+      if (keyData.type !== "service_account") {
+         throw new Error('Invalid service account key: incorrect "type" field');
+      }
+      projectId = keyData.project_id || bq.defaultProjectId;
+      serviceAccountJson = bq.serviceAccountKeyJson as string;
+   }
+
+   if (!projectId || !serviceAccountJson) {
+      throw new Error(
+         `BigQuery project_id and service account key required for: ${config.name}`,
+      );
+   }
+
+   await installAndLoadExtension(connection, "bigquery", true);
+
+   const secretName = sanitizeSecretName(`bigquery_${config.name}`);
+   const escapedJson = escapeSQL(serviceAccountJson);
+   await connection.runSQL(`
+      CREATE OR REPLACE SECRET ${secretName} (
+         TYPE BIGQUERY,
+         SCOPE 'bq://${projectId}',
+         SERVICE_ACCOUNT_JSON '${escapedJson}'
+      );
+   `);
+   logger.info(
+      `Federated BigQuery source for passthrough: project ${projectId}`,
+   );
+   // bigquery_query resolves credentials from the secret scoped to bq://<project>
+   // — the project id is the passthrough handle; no ATTACH is needed.
+   return { handle: projectId, sourceType: "bigquery" };
+}
+
+async function federateSnowflake(
+   connection: DuckDBConnection,
+   config: FederationConfig,
+): Promise<FederatedHandle> {
+   const sf = config.snowflakeConnection;
+   if (!sf) {
+      throw new Error(
+         `Snowflake connection configuration missing for: ${config.name}`,
+      );
+   }
+   const required = {
+      account: sf.account,
+      username: sf.username,
+      password: sf.password,
+   };
+   for (const [field, value] of Object.entries(required)) {
+      if (!value) {
+         throw new Error(`Snowflake ${field} is required for: ${config.name}`);
+      }
+   }
+
+   await installAndLoadExtension(connection, "snowflake", true);
+
+   const params = {
+      account: escapeSQL(sf.account || ""),
+      user: escapeSQL(sf.username || ""),
+      password: escapeSQL(sf.password || ""),
+      database: sf.database ? escapeSQL(sf.database) : undefined,
+      warehouse: sf.warehouse ? escapeSQL(sf.warehouse) : undefined,
+   };
+   const secretName = sanitizeSecretName(`snowflake_${config.name}`);
+   // DATABASE/WAREHOUSE are optional — emit them only when supplied, so an
+   // absent one doesn't interpolate the literal string 'undefined' into the
+   // secret (which Snowflake would then try to use as a real db/warehouse name).
+   const secretLines = [
+      `   TYPE snowflake`,
+      `   ACCOUNT '${params.account}'`,
+      `   USER '${params.user}'`,
+      `   PASSWORD '${params.password}'`,
+      ...(params.database ? [`   DATABASE '${params.database}'`] : []),
+      ...(params.warehouse ? [`   WAREHOUSE '${params.warehouse}'`] : []),
+   ];
+   await connection.runSQL(
+      `CREATE OR REPLACE SECRET ${secretName} (\n${secretLines.join(",\n")}\n);`,
+   );
+   logger.info(`Federated Snowflake source for passthrough: ${secretName}`);
+   // snowflake_query takes the SQL first and the secret name second — the secret
+   // name is the passthrough handle; no ATTACH is needed.
+   return { handle: secretName, sourceType: "snowflake" };
+}
+
+async function federatePostgres(
+   connection: DuckDBConnection,
+   config: FederationConfig,
+): Promise<FederatedHandle> {
+   const pg = config.postgresConnection;
+   if (!pg) {
+      throw new Error(
+         `PostgreSQL connection configuration missing for: ${config.name}`,
+      );
+   }
+
+   await installAndLoadExtension(connection, "postgres");
+
+   const attachString = buildPgConnectionString(pg);
+   // `name` is the ATTACH alias AND (verbatim) the postgres_query handle, so the
+   // handle stays the raw name while the ATTACH identifier is dialect-quoted —
+   // a name needing quoting (e.g. a hyphen) would otherwise be a parser error.
+   const alias = config.name;
+   logger.info(
+      `Federating Postgres source for passthrough as alias '${alias}': ${redactPgSecrets(attachString)}`,
+   );
+   // OR REPLACE for within-session idempotency. The cross-build/cross-tenant
+   // alias-collision boundary is the build session's PRIVATE DuckDB instance
+   // (see createIsolatedBuildSession): each build runs on its own instance, so
+   // its postgres attach cannot collide with another build's or another tenant's
+   // on a shared instance. OR REPLACE is kept as belt-and-suspenders for a
+   // re-attach of the identical source within one session (the alias is the
+   // connection name, the config is that connection's, so replacing is a no-op
+   // rebind to the same source). (bigquery/snowflake federate via CREATE OR
+   // REPLACE SECRET with no ATTACH; secrets are instance-scoped, so isolation
+   // covers them too.)
+   await connection.runSQL(
+      `ATTACH OR REPLACE '${escapeSQL(attachString)}' AS ${quoteIdentifier(alias, "duckdb")} (TYPE postgres, READ_ONLY);`,
+   );
+   return { handle: alias, sourceType: "postgres" };
+}
+
 async function attachCloudStorage(
    connection: DuckDBConnection,
    attachedDb: AttachedDatabase,

package/src/service/connection_config.spec.ts

@@ -624,3 +624,51 @@ describe("SSH proxy validation", () => {
       );
    });
 });
+
+describe("ducklake shape validation", () => {
+   // A DuckLake destination is only attached at its first BUILD, so without an
+   // eager check a missing catalog or bucketUrl surfaced hours after the config
+   // change that caused it. Validated at load like its duckdb-family siblings.
+   const valid: ApiConnection = {
+      name: "lake",
+      type: "ducklake",
+      ducklakeConnection: {
+         catalog: {
+            postgresConnection: {
+               host: "127.0.0.1",
+               port: 5432,
+               databaseName: "catalog",
+               userName: "u",
+               password: "p",
+            },
+         },
+         storage: { bucketUrl: "/tmp/lake" },
+      },
+   };
+
+   it("accepts a fully configured destination", () => {
+      expect(() =>
+         assembleEnvironmentConnections([valid], "/tmp/env"),
+      ).not.toThrow();
+   });
+
+   it("rejects a missing catalog connection at load", () => {
+      const c = {
+         ...valid,
+         ducklakeConnection: { storage: { bucketUrl: "/tmp/lake" } },
+      } as ApiConnection;
+      expect(() => assembleEnvironmentConnections([c], "/tmp/env")).toThrow(
+         /PostgreSQL connection configuration is required for DuckLake catalog/i,
+      );
+   });
+
+   it("rejects a missing bucketUrl at load", () => {
+      const c = {
+         ...valid,
+         ducklakeConnection: { catalog: valid.ducklakeConnection!.catalog },
+      } as ApiConnection;
+      expect(() => assembleEnvironmentConnections([c], "/tmp/env")).toThrow(
+         /Storage bucketUrl is required for DuckLake/i,
+      );
+   });
+});

package/src/service/connection_config.ts

@@ -425,6 +425,26 @@ function validateConnectionShape(connection: ApiConnection): void {
             throw new Error("MotherDuck access token is required.");
          }
          break;
+      case "ducklake":
+         // Every field the ATTACH demands (see attachDuckLakeWithMode), checked
+         // together here rather than split between this validator and the pojo
+         // assembler below. `bucketUrl` was the one nobody checked: a destination
+         // is only attached at its first BUILD, so a missing bucket surfaced
+         // hours after the config change that caused it.
+         if (!connection.ducklakeConnection) {
+            throw new Error("DuckLake connection configuration is missing.");
+         }
+         if (!connection.ducklakeConnection.catalog?.postgresConnection) {
+            throw new Error(
+               `PostgreSQL connection configuration is required for DuckLake catalog: ${connection.name}`,
+            );
+         }
+         if (!connection.ducklakeConnection.storage?.bucketUrl) {
+            throw new Error(
+               `Storage bucketUrl is required for DuckLake: ${connection.name}`,
+            );
+         }
+         break;
       case "trino":
          if (!connection.trinoConnection) {
             throw new Error("Trino connection configuration is missing.");
@@ -725,14 +745,7 @@ export function assembleEnvironmentConnections(
          }
 
          case "ducklake": {
-            if (!connection.ducklakeConnection) {
-               throw new Error("DuckLake connection configuration is missing.");
-            }
-            if (!connection.ducklakeConnection.catalog?.postgresConnection) {
-               throw new Error(
-                  `PostgreSQL connection configuration is required for DuckLake catalog: ${connection.name}`,
-               );
-            }
+            // Shape is validated up front by validateConnectionShape.
             pojo.connections[connection.name] = buildDuckdbEntry(
                connection.name,
                environmentPath,

package/src/service/connection_federation.spec.ts

@@ -0,0 +1,184 @@
+// Unit contract for the build-scoped credential primitives: the SQL a build
+// session issues to (a) RW-attach a destination DuckLake and (b) federate a
+// source warehouse for a native query-passthrough. `runSQL` is stubbed so no
+// live warehouse / catalog is touched — this pins the SQL *shape* (handles,
+// secret scoping, read-only-ness, escaping); live behavior is the measured
+// spike's job.
+import { DuckDBConnection } from "@malloydata/db-duckdb";
+import { describe, expect, it } from "bun:test";
+import * as sinon from "sinon";
+import type { components } from "../api";
+import {
+   attachDuckLakeReadWrite,
+   federateSourceForPassthrough,
+} from "./connection";
+
+/** A real in-memory DuckDB connection with runSQL stubbed to capture SQL. */
+function stubbedConnection(): { conn: DuckDBConnection; sql: string[] } {
+   const conn = new DuckDBConnection("build", ":memory:");
+   const sql: string[] = [];
+   sinon.stub(conn, "runSQL").callsFake(async (q: string) => {
+      sql.push(q);
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      return { rows: [], totalRows: 0, runStats: {} } as any;
+   });
+   return { conn, sql };
+}
+
+const SERVICE_ACCOUNT = JSON.stringify({
+   type: "service_account",
+   project_id: "sa-project",
+   private_key: "-----BEGIN PRIVATE KEY-----\nabc\n-----END PRIVATE KEY-----",
+   client_email: "svc@sa-project.iam.gserviceaccount.com",
+});
+
+describe("federateSourceForPassthrough", () => {
+   it("bigquery: creates a project-scoped SECRET and returns the project id as handle", async () => {
+      const { conn, sql } = stubbedConnection();
+      const result = await federateSourceForPassthrough(conn, "bigquery", {
+         name: "src_bq",
+         bigqueryConnection: {
+            defaultProjectId: "cfg-project",
+            serviceAccountKeyJson: SERVICE_ACCOUNT,
+         } as components["schemas"]["BigqueryConnection"],
+      });
+      expect(result).toEqual({ handle: "sa-project", sourceType: "bigquery" });
+      const secret = sql.find((s) => s.includes("CREATE OR REPLACE SECRET"));
+      expect(secret).toBeDefined();
+      expect(secret).toContain("TYPE BIGQUERY");
+      expect(secret).toContain("SCOPE 'bq://sa-project'");
+      expect(secret).toContain("SERVICE_ACCOUNT_JSON");
+      // Never ATTACH for a bigquery passthrough.
+      expect(sql.some((s) => s.includes("ATTACH"))).toBe(false);
+   });
+
+   it("snowflake: creates a SECRET and returns the secret name as handle (no ATTACH)", async () => {
+      const { conn, sql } = stubbedConnection();
+      const result = await federateSourceForPassthrough(conn, "snowflake", {
+         name: "src_sf",
+         snowflakeConnection: {
+            account: "acct",
+            username: "user",
+            password: "p'wd",
+            database: "DB",
+            warehouse: "WH",
+         } as components["schemas"]["SnowflakeConnection"],
+      });
+      expect(result.sourceType).toBe("snowflake");
+      expect(result.handle).toBe("secret_snowflake_src_sf");
+      const secret = sql.find((s) => s.includes("CREATE OR REPLACE SECRET"));
+      expect(secret).toContain("TYPE snowflake");
+      expect(secret).toContain("ACCOUNT 'acct'");
+      // Single quotes in a value are doubled (escapeSQL).
+      expect(secret).toContain("PASSWORD 'p''wd'");
+      expect(sql.some((s) => s.includes("ATTACH"))).toBe(false);
+   });
+
+   it("postgres: ATTACHes READ_ONLY and returns the alias as handle", async () => {
+      const { conn, sql } = stubbedConnection();
+      const result = await federateSourceForPassthrough(conn, "postgres", {
+         name: "src_pg",
+         postgresConnection: {
+            host: "h",
+            port: 5432,
+            databaseName: "d",
+            userName: "u",
+            password: "pw",
+         } as components["schemas"]["PostgresConnection"],
+      });
+      expect(result).toEqual({ handle: "src_pg", sourceType: "postgres" });
+      const attach = sql.find((s) => s.startsWith("ATTACH"));
+      expect(attach).toBeDefined();
+      // OR REPLACE for within-session idempotency (a re-attach of the identical
+      // source on one session is a no-op rebind). Cross-build/cross-tenant alias
+      // collisions are prevented upstream by each build running on its OWN
+      // private DuckDB instance (createIsolatedBuildSession); this is just
+      // belt-and-suspenders.
+      expect(attach).toStartWith("ATTACH OR REPLACE ");
+      // The ATTACH alias is dialect-quoted; the handle stays the raw name (it
+      // becomes the postgres_query string literal, which matches the catalog).
+      expect(attach).toContain('AS "src_pg" (TYPE postgres, READ_ONLY)');
+   });
+
+   it("postgres: re-federating the same source on one session is idempotent (no 'already exists')", async () => {
+      // Within one session, federating the same source twice must not throw:
+      // both attaches use OR REPLACE (a no-op rebind to the identical source).
+      // (A real DuckDB would raise "database ... already exists" on a plain
+      // re-ATTACH; here runSQL is stubbed, so we pin the SQL contract.)
+      const { conn, sql } = stubbedConnection();
+      const cfg = {
+         name: "src_pg",
+         postgresConnection: {
+            host: "h",
+            port: 5432,
+            databaseName: "d",
+            userName: "u",
+            password: "pw",
+         } as components["schemas"]["PostgresConnection"],
+      };
+      await federateSourceForPassthrough(conn, "postgres", cfg);
+      await federateSourceForPassthrough(conn, "postgres", cfg);
+      const attaches = sql.filter((s) => s.startsWith("ATTACH"));
+      expect(attaches).toHaveLength(2);
+      for (const a of attaches) expect(a).toStartWith("ATTACH OR REPLACE ");
+   });
+
+   it("postgres: dialect-quotes an alias that needs quoting (e.g. a hyphen)", async () => {
+      const { conn, sql } = stubbedConnection();
+      const result = await federateSourceForPassthrough(conn, "postgres", {
+         name: "my-pg",
+         postgresConnection: {
+            host: "h",
+            port: 5432,
+            databaseName: "d",
+            userName: "u",
+            password: "pw",
+         } as components["schemas"]["PostgresConnection"],
+      });
+      expect(result.handle).toBe("my-pg");
+      const attach = sql.find((s) => s.startsWith("ATTACH"));
+      expect(attach).toContain('AS "my-pg" (TYPE postgres, READ_ONLY)');
+   });
+
+   it("rejects a source type with no native passthrough", async () => {
+      const { conn } = stubbedConnection();
+      await expect(
+         federateSourceForPassthrough(conn, "mysql" as unknown as "postgres", {
+            name: "x",
+         }),
+      ).rejects.toThrow(/no native query-passthrough/i);
+   });
+
+   it("fails loud when the configured credentials are missing", async () => {
+      const { conn } = stubbedConnection();
+      await expect(
+         federateSourceForPassthrough(conn, "bigquery", { name: "x" }),
+      ).rejects.toThrow(/BigQuery connection configuration missing/i);
+   });
+});
+
+describe("attachDuckLakeReadWrite", () => {
+   const ducklakeConfig = {
+      catalog: {
+         postgresConnection: {
+            host: "cat-host",
+            port: 5432,
+            databaseName: "ducklake",
+            userName: "ducklake",
+            password: "secret",
+         },
+      },
+      storage: { bucketUrl: "gs://org-env-ducklake/prefix" },
+   } as unknown as components["schemas"]["DucklakeConnection"];
+
+   it("attaches read-write: no READ_ONLY, no AUTOMATIC_MIGRATION, keeps OVERRIDE_DATA_PATH", async () => {
+      const { conn, sql } = stubbedConnection();
+      await attachDuckLakeReadWrite(conn, "lake", ducklakeConfig);
+      const attach = sql.find((s) => s.includes("ATTACH OR REPLACE"));
+      expect(attach).toBeDefined();
+      expect(attach).toContain("OVERRIDE_DATA_PATH true");
+      expect(attach).not.toContain("READ_ONLY");
+      expect(attach).not.toContain("AUTOMATIC_MIGRATION");
+      expect(attach).toContain("AS lake");
+   });
+});