docs: add guides for access control and named pipes

[taitelee]

Summary

Adds two guides to the docs site (Guides section) covering how to set up policies, pipes, and roles — previously only the config knobs and raw endpoints were documented, with no task-oriented explanation of the model.

• Access Control (docs/src/content/docs/access-control.md): the full authorization model — roles (role_claim, default_role, admin_role), the policy document and every permission (column allow/deny, row-level filter with JWT claim templating, insert check, aggregation controls, max_rows/max_execution_time_ms), where each rule is enforced across endpoints, policy management, and the file-bootstrap/KV lifecycle.
• Named Pipes (docs/src/content/docs/pipes.md): pipe anatomy, declared and inline parameters and how values are bound/escaped, allowed_roles authorization, admin CRUD, execution/caching, and .sql directory bootstrap.
• Wired both into the Guides sidebar and renumbered the trailing pages' sidebar.order.
• Single-sourced the auth material: Access Control defers JWT/token plumbing to API Reference + Configuration instead of duplicating it.
• Fixed a stale line in the Architecture doc — pipe params are inlined as escaped literals, not positional driver parameters.

Test plan

None

Related Issues

N/A

[coderabbitai]

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Free

Run ID: 091473d4-2891-4b07-97dc-0089ef04d75c

📥 Commits

Reviewing files that changed from the base of the PR and between 08fc38c and 42ca449.

📒 Files selected for processing (10)

• docs/src/config/sidebar.ts
• docs/src/content/docs/access-control.md
• docs/src/content/docs/api.md
• docs/src/content/docs/architecture.md
• docs/src/content/docs/claude-code.md
• docs/src/content/docs/configuration.md
• docs/src/content/docs/deployment.md
• docs/src/content/docs/development.md
• docs/src/content/docs/pipes.md
• docs/src/content/docs/sdk.md

---

📝 Walkthrough

Summary by CodeRabbit

• Documentation
  • Added comprehensive Access Control guide covering authorization models, policy management, and security enforcement
  • Added Named Pipes guide explaining pre-defined parameterized SQL queries and their usage
  • Reorganized documentation sidebar structure

Walkthrough

This PR adds comprehensive documentation for two new WaveHouse features: Access Control (per-table/per-role authorization with JWT-driven evaluation, column and row-level security, and query limits) and Named Pipes (pre-defined parameterized SQL queries with role-based execution control). The sidebar navigation is updated to include both guides, existing documentation ordering is adjusted, and the architecture documentation is clarified to reflect NamedQuery parameter binding behavior.

Changes

Documentation: Access Control and Named Pipes

Layer / File(s)	Summary
Sidebar navigation configuration docs/src/config/sidebar.ts	Adds two new guide entries under "Guides": "Access Control" and "Named Pipes", each with its own slug, enabling navigation to the new documentation pages.
Access Control feature documentation docs/src/content/docs/access-control.md	Comprehensive guide covering WaveHouse's per-table/per-role policy model: JWT-driven identity flow with fail-closed evaluation, role semantics (default_role, admin_role, case-sensitive matching), policy structure (YAML/JSON with per-operation permissions), column permissions (allow/deny precedence, live-stream stripping), row-level security via claim-templated filters with multiple comparison operators, insert check constraints with auto-injection from JWT claims to prevent forgery, aggregation controls (allow/deny lists), query resource limits (max_rows, max_execution_time_ms), API surface enforcement matrix, admin policy management endpoints, bootstrapping from policy.file_path with NATS KV as source of truth, multi-tenant authorization example, and field reference table.
Named Pipes feature documentation docs/src/content/docs/pipes.md	Complete guide to pre-defined parameterized SQL queries exposed via /v1/pipes/{name}: pipe schema (name, sql, parameters with {{param}} and {{param:default}} syntax), parameter resolution order, SQL inlining with single-quote escaping, role-based execution authorization via allowlist with fail-closed semantics (admin always allowed, empty/omitted allowed_roles denies access), admin-only CRUD endpoints under /v1/admin/pipes, execution behavior (GET vs POST with body precedence), response/error contract (404/403/400 status mapping), X-Cache header, .sql directory bootstrap (seed-only, no overwrite, admin-only by default), end-to-end example, and cross-references.
Documentation structure reorganization and architecture note docs/src/content/docs/api.md, docs/src/content/docs/architecture.md, docs/src/content/docs/claude-code.md, docs/src/content/docs/configuration.md, docs/src/content/docs/deployment.md, docs/src/content/docs/development.md, docs/src/content/docs/sdk.md	Adjusts sidebar.order values across six existing documentation pages (incrementing api from 5→7, configuration from 7→9, sdk from 6→8, claude-code from 10→12, deployment from 8→10, development from 9→11) to accommodate the new Access Control and Named Pipes guides in the navigation hierarchy. Updates architecture.md to clarify that NamedQuery BindParams() inlines escaped literal values directly into SQL (with single-quote escaping for strings) rather than converting {{param}} placeholders to positional parameters.

🎯 2 (Simple) | ⏱️ ~10 minutes

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly expands the project's documentation by introducing detailed guides for Access Control and Named Pipes. These additions provide users with a clear understanding of how to secure their deployments, manage role-based access, and leverage parameterized SQL queries. Additionally, the sidebar has been reorganized to accommodate these new sections, ensuring a logical flow for developers and operators.

Highlights

• Documentation Expansion: Added comprehensive documentation for Access Control and Named Pipes, providing deep dives into policy enforcement, JWT claim templating, and pipe management.
• Sidebar Reorganization: Updated the documentation sidebar to include the new guides and adjusted the ordering of existing pages for better navigation.
• Architecture Clarification: Updated the architecture documentation to clarify how named pipe parameters are resolved and escaped.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request introduces comprehensive documentation for 'Access Control' and 'Named Pipes' to the WaveHouse guides, updating the sidebar configuration and adjusting the ordering of existing documentation pages. It also updates the architecture documentation to clarify how named query pipes bind parameters by inlining escaped literal values. No review comments were provided, and there is no feedback to address.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[EricAndrechek]

LGTM