@malloy-publisher/server 0.0.235 → 0.0.236

package/src/service/query_text.spec.ts

@@ -1,79 +0,0 @@
-import { describe, expect, it } from "bun:test";
-import { buildSourceAliasMap, extractRunTargetSourceName } from "./query_text";
-
-describe("service/query_text", () => {
-   describe("extractRunTargetSourceName", () => {
-      it("returns undefined for empty/absent text", () => {
-         expect(extractRunTargetSourceName(undefined)).toBeUndefined();
-         expect(extractRunTargetSourceName("")).toBeUndefined();
-      });
-
-      it("reads the source from a `run:` query", () => {
-         expect(extractRunTargetSourceName("run: flights -> { ... }")).toBe(
-            "flights",
-         );
-      });
-
-      it("reads the source from a bare `source -> view` query", () => {
-         expect(extractRunTargetSourceName("flights -> by_carrier")).toBe(
-            "flights",
-         );
-      });
-
-      it("unwraps a backtick-quoted (e.g. hyphenated) source name", () => {
-         expect(
-            extractRunTargetSourceName("run: `customer-orders` -> { ... }"),
-         ).toBe("customer-orders");
-         expect(extractRunTargetSourceName("`gated-source` -> view")).toBe(
-            "gated-source",
-         );
-      });
-
-      it("prefers the `run:` target over a leading arrow line", () => {
-         expect(
-            extractRunTargetSourceName("run: flights -> { aggregate: c }"),
-         ).toBe("flights");
-      });
-
-      it("returns undefined when there is no run target", () => {
-         expect(
-            extractRunTargetSourceName("source: x is y + { dimension: a }"),
-         ).toBeUndefined();
-      });
-   });
-
-   describe("buildSourceAliasMap", () => {
-      it("maps a single derivation declaration", () => {
-         expect(buildSourceAliasMap("source: a is b")).toEqual(
-            new Map([["a", "b"]]),
-         );
-      });
-
-      it("maps multiple declarations", () => {
-         const map = buildSourceAliasMap(
-            "source: a is b\nsource: c is d\nrun: a -> view",
-         );
-         expect(map.get("a")).toBe("b");
-         expect(map.get("c")).toBe("d");
-      });
-
-      it("unwraps backticks on either side of `is`", () => {
-         const map = buildSourceAliasMap(
-            "source: `my-alias` is `customer-orders`",
-         );
-         expect(map.get("my-alias")).toBe("customer-orders");
-      });
-
-      it("keeps the last declaration when an alias is redefined", () => {
-         expect(buildSourceAliasMap("source: a is b\nsource: a is c")).toEqual(
-            new Map([["a", "c"]]),
-         );
-      });
-
-      it("returns an empty map when no declarations are present", () => {
-         expect(buildSourceAliasMap("run: flights -> by_carrier")).toEqual(
-            new Map(),
-         );
-      });
-   });
-});

package/src/service/query_text.ts

@@ -1,43 +0,0 @@
-/**
- * Pure parsing of caller-authored Malloy query text.
- *
- * The authorization gate, filter inheritance, and the query boundary all need
- * to identify the run target and follow `source: NAME is BASE` derivation
- * chains *before* the query compiles — a denied caller must never reach
- * compilation. These helpers are deliberately side-effect free (no model
- * state) so the regexes that back those security checks can be unit tested in
- * isolation from the stateful `Model`.
- *
- * Both helpers recognize a bare `\w+` identifier and a backtick-quoted Malloy
- * identifier (e.g. `customer-orders`, which needs quoting for the hyphen), and
- * return the inner name without backticks so callers can key it the same way
- * sources are keyed.
- */
-
-/**
- * The top-level source a `run:` / `->` query targets, or undefined when the
- * text has no recognizable run target.
- */
-export function extractRunTargetSourceName(query?: string): string | undefined {
-   if (!query) return undefined;
-   const runMatch = query.match(/run\s*:\s*(?:`([^`]+)`|(\w+))\s*->/);
-   const arrowMatch = query.match(/^\s*(?:`([^`]+)`|(\w+))\s*->/m);
-   return runMatch?.[1] ?? runMatch?.[2] ?? arrowMatch?.[1] ?? arrowMatch?.[2];
-}
-
-/**
- * Map each ad-hoc source alias to the base it derives from
- * (`source: NAME is BASE …` → NAME → BASE). Used to walk derivation chains in
- * caller-authored text for both filter inheritance and the query boundary —
- * composition over a queryable source is itself queryable.
- */
-export function buildSourceAliasMap(query: string): Map<string, string> {
-   const aliasOf = new Map<string, string>();
-   const declRe =
-      /source\s*:\s*(?:`([^`]+)`|(\w+))\s+is\s+(?:`([^`]+)`|(\w+))/g;
-   let match: RegExpExecArray | null;
-   while ((match = declRe.exec(query)) !== null) {
-      aliasOf.set(match[1] ?? match[2], match[3] ?? match[4]);
-   }
-   return aliasOf;
-}

package/src/service/quoting.spec.ts

@@ -1,135 +0,0 @@
-import { describe, expect, it } from "bun:test";
-import {
-   bareTableName,
-   isQuotedIdentifierPath,
-   quoteIdentifier,
-   quoteManifestTablePath,
-   quoteTablePath,
-} from "./quoting";
-
-describe("bareTableName", () => {
-   it("returns the segment after the last dot for a qualified name", () => {
-      expect(bareTableName("my_schema.my_table")).toBe("my_table");
-   });
-
-   it("returns the name unchanged when it is unqualified", () => {
-      expect(bareTableName("my_table")).toBe("my_table");
-   });
-});
-
-describe("quoteIdentifier", () => {
-   it("backticks for backtick dialects (BigQuery / MySQL / Databricks)", () => {
-      expect(quoteIdentifier("my-table", "standardsql")).toBe("`my-table`");
-      expect(quoteIdentifier("t", "mysql")).toBe("`t`");
-      expect(quoteIdentifier("t", "databricks")).toBe("`t`");
-   });
-
-   it("double-quotes for everything else (Postgres / DuckDB / Snowflake)", () => {
-      expect(quoteIdentifier("my-table", "postgres")).toBe('"my-table"');
-      expect(quoteIdentifier("t", "duckdb")).toBe('"t"');
-      expect(quoteIdentifier("t", "snowflake")).toBe('"t"');
-   });
-
-   it("escapes an embedded quote char by doubling it", () => {
-      expect(quoteIdentifier("a`b", "standardsql")).toBe("`a``b`");
-      expect(quoteIdentifier('a"b', "postgres")).toBe('"a""b"');
-   });
-});
-
-// Cross-repo conformance (PR ms2data/service#5272 review item 1). The publisher
-// keys identifier quoting off the Malloy `dialectName`; the control plane keys
-// the SAME fact off the publisher *connection type* in
-// `PhysicalTableName.BACKTICK_TYPES` ({bigquery, mysql, databricks}). The two
-// must stay byte-compatible — a name the publisher CREATEs with backticks the CP
-// must DROP with backticks — but they live in different repos under different key
-// vocabularies (`standardsql` the dialect vs `bigquery` the connection type), so
-// drift produces malformed DDL with no compile error. This table pins the full
-// connection-type → dialect → quote-char correspondence; if it changes, update
-// `PhysicalTableName.BACKTICK_TYPES` in the control plane in lockstep.
-describe("dialect/connection-type quoting conformance", () => {
-   const QUOTING = [
-      { connectionType: "bigquery", dialect: "standardsql", quote: "`" },
-      { connectionType: "mysql", dialect: "mysql", quote: "`" },
-      { connectionType: "databricks", dialect: "databricks", quote: "`" },
-      { connectionType: "postgres", dialect: "postgres", quote: '"' },
-      { connectionType: "snowflake", dialect: "snowflake", quote: '"' },
-      { connectionType: "trino", dialect: "trino", quote: '"' },
-      { connectionType: "duckdb", dialect: "duckdb", quote: '"' },
-      { connectionType: "motherduck", dialect: "duckdb", quote: '"' },
-   ] as const;
-
-   for (const { connectionType, dialect, quote } of QUOTING) {
-      it(`${connectionType} (${dialect}) quotes with ${quote}`, () => {
-         expect(quoteIdentifier("x", dialect)).toBe(`${quote}x${quote}`);
-      });
-   }
-});
-
-describe("quoteTablePath", () => {
-   it("quotes each segment of a container path independently", () => {
-      expect(
-         quoteTablePath(
-            "my-proj.mydataset.engaged_events_ab12_v0",
-            "standardsql",
-         ),
-      ).toBe("`my-proj`.`mydataset`.`engaged_events_ab12_v0`");
-      expect(quoteTablePath("mydataset.t_ab12_v0", "postgres")).toBe(
-         '"mydataset"."t_ab12_v0"',
-      );
-   });
-
-   it("quotes a bare (unqualified) name", () => {
-      expect(quoteTablePath("t_ab12_v0", "standardsql")).toBe("`t_ab12_v0`");
-      expect(quoteTablePath("t_ab12_v0", "postgres")).toBe('"t_ab12_v0"');
-   });
-});
-
-describe("isQuotedIdentifierPath", () => {
-   it("is false for a logical, unquoted path (the control-plane form)", () => {
-      expect(isQuotedIdentifierPath("schema.order_summary__g0")).toBe(false);
-      expect(isQuotedIdentifierPath("order_summary")).toBe(false);
-   });
-
-   it("is true once any segment carries a dialect quote char", () => {
-      expect(isQuotedIdentifierPath('"schema"."order_summary"')).toBe(true);
-      expect(isQuotedIdentifierPath("`ds`.`events`")).toBe(true);
-   });
-});
-
-// quoteManifestTablePath is the single quoting authority both the serve-side
-// bind and the build-side manifest route through. It runs the real
-// quoteTablePath (not a re-implementation), so this pins the exact per-dialect
-// contract that keeps read (a Malloy FROM) byte-identical to write (the CREATE
-// DDL, which also quotes via quoteTablePath) on every dialect — case-folding or
-// not.
-describe("quoteManifestTablePath", () => {
-   it("double-quotes each segment on a case-folding double-quote dialect (Snowflake)", () => {
-      expect(
-         quoteManifestTablePath("schema.order_summary__g0", "snowflake"),
-      ).toBe('"schema"."order_summary__g0"');
-   });
-
-   it("double-quotes on Postgres and DuckDB (unchanged for lowercase names, correct for mixed case)", () => {
-      expect(quoteManifestTablePath("public.daily", "postgres")).toBe(
-         '"public"."daily"',
-      );
-      expect(quoteManifestTablePath("main.orders_mz", "duckdb")).toBe(
-         '"main"."orders_mz"',
-      );
-   });
-
-   it("backticks each segment on BigQuery (standardsql) — required for hyphenated ids", () => {
-      expect(quoteManifestTablePath("my-proj.ds.events", "standardsql")).toBe(
-         "`my-proj`.`ds`.`events`",
-      );
-   });
-
-   it("passes an already-quoted name through unchanged (any dialect)", () => {
-      expect(quoteManifestTablePath('"schema"."already"', "snowflake")).toBe(
-         '"schema"."already"',
-      );
-      expect(quoteManifestTablePath("`ds`.`events`", "standardsql")).toBe(
-         "`ds`.`events`",
-      );
-   });
-});

package/src/service/quoting.ts

@@ -1,78 +0,0 @@
-/**
- * The bare (unqualified) name of a possibly container-qualified table path:
- * the segment after the last dot, e.g. `my_schema.my_table` -> `my_table` and
- * `my_table` -> `my_table`. Used as the RENAME target, which names a table
- * within its existing schema rather than re-stating the full path.
- */
-export function bareTableName(tableName: string): string {
-   const lastDot = tableName.lastIndexOf(".");
-   return lastDot >= 0 ? tableName.substring(lastDot + 1) : tableName;
-}
-
-// Dialects whose identifier quote character is a backtick; everything else uses
-// the SQL-standard double quote. Keyed by Malloy `dialectName`. The control
-// plane encodes the same fact keyed by connection type
-// (`PhysicalTableName.BACKTICK_TYPES` = {bigquery, mysql, databricks}); the two
-// must stay byte-compatible. See the conformance table in quoting.spec.ts.
-const BACKTICK_DIALECTS = new Set(["standardsql", "mysql", "databricks"]);
-
-/**
- * Quote a single SQL identifier for {@code dialect}, escaping any embedded quote
- * character by doubling it.
- */
-export function quoteIdentifier(identifier: string, dialect: string): string {
-   if (BACKTICK_DIALECTS.has(dialect)) {
-      return "`" + identifier.replace(/`/g, "``") + "`";
-   }
-   return '"' + identifier.replace(/"/g, '""') + '"';
-}
-
-/**
- * Dialect-quote a (possibly container-qualified) table path so it can be inlined
- * into DDL. Each dot segment is quoted independently and rejoined with dots, so
- * a path like {@code my-proj.mydataset.engaged_events_v0} becomes
- * `` `my-proj`.`mydataset`.`engaged_events_v0` `` on BigQuery or
- * {@code "my-proj"."mydataset"."engaged_events_v0"} on Postgres — handling
- * container hierarchies and quote-requiring names (e.g. hyphenated BigQuery
- * project ids) uniformly. The control plane provides the logical (unquoted) path
- * in `physicalTableName`; quoting for the warehouse is the publisher's job.
- */
-export function quoteTablePath(tableName: string, dialect: string): string {
-   return tableName
-      .split(".")
-      .map((segment) => quoteIdentifier(segment, dialect))
-      .join(".");
-}
-
-/**
- * Whether a table path already carries a dialect quote character, in which case
- * it is treated as canonical SQL that must not be re-quoted. The single
- * definition of "already quoted" shared by every bind site.
- */
-export function isQuotedIdentifierPath(tableName: string): boolean {
-   return tableName.includes('"') || tableName.includes("`");
-}
-
-/**
- * Quote a physical table path for a manifest entry so a Malloy `FROM` resolves
- * it correctly, unless it is already canonical SQL (passed through unchanged).
- * This is the single quoting authority for the two places a physical name is
- * bound into a `FROM`: the serve-side bind ({@link Package.quoteBoundTableNames})
- * and the build-side manifest that stitches chained persist sources together
- * (materialization_service). Both must mirror the CREATE side's
- * {@link quoteTablePath} so a case-folding engine (Snowflake uppercases
- * unquoted identifiers) can resolve the case-preserved table the builder wrote.
- *
- * Passing an already-quoted name through is safe for the names this handles:
- * control-plane physical names are logical/unquoted (never contain a quote),
- * and a self-assigned `#@ persist name=` value is the author's own canonical
- * SQL (they own quoting it for the dialect).
- */
-export function quoteManifestTablePath(
-   tableName: string,
-   dialect: string,
-): string {
-   return isQuotedIdentifierPath(tableName)
-      ? tableName
-      : quoteTablePath(tableName, dialect);
-}

package/src/service/resolve_environment.ts

@@ -1,15 +0,0 @@
-import { EnvironmentNotFoundError } from "../errors";
-import { ResourceRepository } from "../storage/DatabaseInterface";
-
-export async function resolveEnvironmentId(
-   repository: ResourceRepository,
-   environmentName: string,
-): Promise<string> {
-   const dbEnvironment = await repository.getEnvironmentByName(environmentName);
-   if (!dbEnvironment) {
-      throw new EnvironmentNotFoundError(
-         `Environment '${environmentName}' not found`,
-      );
-   }
-   return dbEnvironment.id;
-}

package/src/service/restricted_mode.spec.ts

@@ -1,299 +0,0 @@
-/**
- * Restricted-mode containment for untrusted ad-hoc query text.
- *
- * The `query` text that reaches `execute_query` is authored by an untrusted
- * caller (an MCP/LLM client, a UI field, an HTTP body), but it runs against a
- * warehouse connection that can see far more than any one model curates.
- * Compiling that text with `loadRestrictedQuery` keeps the caller inside the
- * model's published surface — its sources, views, dimensions and measures —
- * and stops it from using Malloy as a general-purpose handle to the underlying
- * database or filesystem.
- *
- * These tests are written from the publisher's threat model: each is a way an
- * untrusted query could try to reach data or compute the model never exposed,
- * paired with the assertion that restricted mode blocks it. They are not a
- * re-test of Malloy's per-construct rejection logic — the point is the misuse
- * scenario, not the grammar.
- *
- * The setup: the connection holds a `secrets` table that the `catalog` model
- * never references. The model only exposes `widgets`. Any query that manages to
- * return a row of `secrets` has escaped the curated surface.
- */
-
-import { DuckDBConnection } from "@malloydata/db-duckdb";
-import { Connection } from "@malloydata/malloy";
-import { afterAll, beforeAll, describe, expect, it } from "bun:test";
-import fs from "fs/promises";
-import os from "os";
-import path from "path";
-import { Model } from "./model";
-
-const TEST_DIR = path.join(os.tmpdir(), "restricted-mode-tests");
-const TEST_DB_DIR = path.join(TEST_DIR, "db");
-const TEST_DB_PATH = path.join(TEST_DB_DIR, "test.duckdb");
-const TEST_PKG_DIR = path.join(TEST_DIR, "pkg");
-
-let duckdbConnection: DuckDBConnection;
-
-// `widgets` is the curated, model-exposed table. `secrets` lives in the same
-// connection but is never referenced by the model the caller queries — it
-// stands in for any table the deployment did not mean to publish.
-const SEED_SQL = `
-CREATE TABLE IF NOT EXISTS widgets (
-   region VARCHAR,
-   name VARCHAR
-);
-INSERT INTO widgets VALUES
-   ('US', 'Alpha'),
-   ('EU', 'Beta'),
-   ('APAC', 'Gamma');
-
-CREATE TABLE IF NOT EXISTS secrets (
-   id VARCHAR,
-   ssn VARCHAR
-);
-INSERT INTO secrets VALUES
-   ('1', '111-11-1111'),
-   ('2', '222-22-2222');
-`;
-
-// The model the ad-hoc queries are issued against. It publishes `widgets` and
-// nothing else — `secrets` is deliberately absent.
-const CATALOG_MODEL = `
-source: widgets is duckdb.table('widgets') extend {
-   measure: n is count()
-   view: by_region is {
-      group_by: region
-      aggregate: n
-   }
-}
-`;
-
-// A second model that DOES expose secrets. It is never loaded by the caller;
-// it exists only as the target of an `import` escalation attempt.
-const VAULT_MODEL = `
-source: vault is duckdb.table('secrets') extend {
-   measure: n is count()
-}
-`;
-
-beforeAll(async () => {
-   await fs.mkdir(TEST_DB_DIR, { recursive: true });
-   await fs.mkdir(TEST_PKG_DIR, { recursive: true });
-   duckdbConnection = new DuckDBConnection("duckdb", TEST_DB_PATH, TEST_DB_DIR);
-   for (const stmt of SEED_SQL.trim().split(";").filter(Boolean)) {
-      await duckdbConnection.runSQL(stmt.trim() + ";");
-   }
-   await fs.writeFile(
-      path.join(TEST_PKG_DIR, "catalog.malloy"),
-      CATALOG_MODEL,
-      "utf-8",
-   );
-   await fs.writeFile(
-      path.join(TEST_PKG_DIR, "vault.malloy"),
-      VAULT_MODEL,
-      "utf-8",
-   );
-});
-
-afterAll(async () => {
-   try {
-      await duckdbConnection.close();
-      await new Promise((resolve) => setTimeout(resolve, 100));
-      await fs.rm(TEST_DIR, { recursive: true, force: true });
-   } catch {
-      // Ignore cleanup errors
-   }
-});
-
-function getConnections(): Map<string, Connection> {
-   const map = new Map<string, Connection>();
-   map.set("duckdb", duckdbConnection);
-   return map;
-}
-
-type Row = Record<string, unknown>;
-
-function asRows(compactResult: unknown): Row[] {
-   return compactResult as Row[];
-}
-
-async function makeModel(modelPath: string): Promise<Model> {
-   return Model.create("test-pkg", TEST_PKG_DIR, modelPath, getConnections());
-}
-
-/** Run an ad-hoc query string and return the result rows. */
-async function runAdHoc(model: Model, query: string): Promise<Row[]> {
-   const { compactResult } = await model.getQueryResults(
-      undefined,
-      undefined,
-      query,
-   );
-   return asRows(compactResult);
-}
-
-/**
- * Restricted-mode rejections surface as a Malloy compile error: the message
- * quotes the offending source text and states the rule, and the underlying
- * `problems` carry `code: 'restricted-construct-forbidden'`. We accept either
- * signal so the assertion is robust to how `model.ts` re-wraps the error.
- */
-function looksRestricted(error: unknown): boolean {
-   const message = ((error as Error)?.message ?? String(error)).toLowerCase();
-   if (message.includes("restricted")) return true;
-   const problems = (error as { problems?: Array<{ code?: string }> })
-      ?.problems;
-   return (
-      Array.isArray(problems) &&
-      problems.some((p) => (p.code ?? "").includes("restricted"))
-   );
-}
-
-/**
- * Assert an untrusted ad-hoc query is blocked before it can reach unpublished
- * data. If it instead succeeds, report the row count — the caller escaped the
- * curated surface and that is the leak we are guarding against.
- */
-async function expectBlocked(model: Model, query: string): Promise<void> {
-   let leakedRows: number | undefined;
-   try {
-      const rows = await runAdHoc(model, query);
-      leakedRows = rows.length;
-   } catch (error) {
-      expect(looksRestricted(error)).toBe(true);
-      return;
-   }
-   throw new Error(
-      `Expected the query to be blocked by restricted mode, but it succeeded ` +
-         `and returned ${leakedRows} rows (escaped the curated surface).`,
-   );
-}
-
-/**
- * Same assertion as `expectBlocked`, but exercised through the named
- * `sourceName`/`queryName` request shape rather than the free-form `query`
- * field — those identifiers are concatenated into a `run: …` string and so are
- * just as caller-controlled.
- */
-async function expectNamedBlocked(
-   model: Model,
-   sourceName: string | undefined,
-   queryName: string,
-): Promise<void> {
-   let leakedRows: number | undefined;
-   try {
-      const { compactResult } = await model.getQueryResults(
-         sourceName,
-         queryName,
-      );
-      leakedRows = asRows(compactResult).length;
-   } catch (error) {
-      expect(looksRestricted(error)).toBe(true);
-      return;
-   }
-   throw new Error(
-      `Expected the named-path request to be blocked by restricted mode, but ` +
-         `it succeeded and returned ${leakedRows} rows (escaped the curated surface).`,
-   );
-}
-
-// ===========================================================================
-// The published surface stays fully usable — restriction must not break the
-// legitimate path it is wrapped around.
-// ===========================================================================
-
-describe("the curated model surface stays usable under restriction", () => {
-   it("runs an ad-hoc query over a published source", async () => {
-      const model = await makeModel("catalog.malloy");
-      const rows = await runAdHoc(
-         model,
-         "run: widgets -> { group_by: region; aggregate: n is count() }",
-      );
-      expect(rows.length).toBe(3); // US, EU, APAC
-   });
-
-   it("runs a published named view", async () => {
-      const model = await makeModel("catalog.malloy");
-      const rows = await runAdHoc(model, "run: widgets -> by_region");
-      expect(rows.length).toBe(3);
-   });
-});
-
-// ===========================================================================
-// Misuse vectors: an untrusted query trying to read `secrets`, which the
-// catalog model never published. Each must be blocked.
-// ===========================================================================
-
-describe("an untrusted query cannot reach data the model never published", () => {
-   // The connection can see every table; the model curated only `widgets`.
-   // Naming another table directly would turn the model into a handle on the
-   // whole warehouse.
-   it("cannot point a source at an arbitrary warehouse table", async () => {
-      const model = await makeModel("catalog.malloy");
-      await expectBlocked(
-         model,
-         "run: duckdb.table('secrets') -> { aggregate: c is count() }",
-      );
-   });
-
-   // Raw SQL would let the caller run anything the connection's credentials
-   // allow — arbitrary reads, cross-table joins, even writes on a writable role.
-   it("cannot execute arbitrary SQL against the connection", async () => {
-      const model = await makeModel("catalog.malloy");
-      await expectBlocked(
-         model,
-         'run: duckdb.sql("SELECT id, ssn FROM secrets") -> { group_by: ssn }',
-      );
-   });
-
-   // Importing another model would pull in surfaces the queried model chose not
-   // to expose (and the file path is caller-controlled).
-   it("cannot import another model to borrow its surface", async () => {
-      const model = await makeModel("catalog.malloy");
-      await expectBlocked(
-         model,
-         'import "vault.malloy"\n' +
-            "run: vault -> { aggregate: c is count() }",
-      );
-   });
-
-   // Combining the curated surface with a raw table — joining `secrets` onto the
-   // published `widgets` — must not slip a raw table past the restriction.
-   it("cannot smuggle a raw table in through a join on a published source", async () => {
-      const model = await makeModel("catalog.malloy");
-      await expectBlocked(
-         model,
-         "source: x is widgets extend {\n" +
-            "   join_cross: s is duckdb.table('secrets')\n" +
-            "}\n" +
-            "run: x -> { group_by: s.ssn }",
-      );
-   });
-});
-
-// ===========================================================================
-// The named `sourceName`/`queryName` request shape reaches the same compiler
-// path as ad-hoc text, so it must inherit the same restriction. A real name is
-// a bare identifier; anything that smuggles in a disallowed construct must be
-// blocked, while legitimate published names keep working.
-// ===========================================================================
-
-describe("the named source/view path is restricted too", () => {
-   it("blocks a disallowed construct supplied through the sourceName/queryName fields", async () => {
-      const model = await makeModel("catalog.malloy");
-      await expectNamedBlocked(
-         model,
-         "duckdb.table('secrets')",
-         "{ group_by: ssn }",
-      );
-   });
-
-   it("still runs a legitimate published source and view by name", async () => {
-      const model = await makeModel("catalog.malloy");
-      const { compactResult } = await model.getQueryResults(
-         "widgets",
-         "by_region",
-      );
-      expect(asRows(compactResult).length).toBe(3);
-   });
-});