fix(redshift-alpha): align qualified table names

[ozelalisen]

Reason for this change

Since 2.262.0, Table treats a dotted tableName as one identifier, but grants treat it as schema.table. A grant can then address a different table.

Description of changes

• Quote each component of a dotted tableName separately in every table statement.
• Complete the rollback of a rejected qualifier change or empty-component name without running statements, for tables created after 2.114.1 that:
  • keep their created qualifier;
  • have no empty component in their created or current name;
  • had no colon in their name, cluster or database at creation.
• Those rollbacks still run as ordinary updates for other tables, and can fail again.
• An update back to a table's original qualifier can be treated as a rollback and apply nothing, if an earlier release renamed the table without keeping its qualifier. For example, renaming analytics.orders to orders2 left it as analytics.orders2. This change doesn't repair such tables.

Describe any new or updated permissions being added

Production permissions are unchanged. In integ.database, a test function can run and read a Redshift Data API query with the administrator secret and write logs, and the assertion can invoke it.

Description of how you validated changes

• Build, lint and 358 unit tests pass.
• Regenerated the six integ snapshots that embed the query provider; outside integ.database, their templates change only in its asset hash. integ.database now uses public.IntegTable and asserts the user's privileges on it.
• On a development account, builds with this change:
  • completed both rollbacks without running statements;
  • deployed and passed five of the six integ tests, including the integ.database assertion. integ.cluster-distkey could not finish, because it needs more Elastic IP addresses than the account allows.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

BREAKING CHANGE: Table now interprets dots in tableName as schema.table or database.schema.table for every table operation, as grants already did. Tables created with 2.262.0 or later from a dotted tableName exist as one identifier (for example "analytics.orders" in the default schema); after upgrading, updates and RemovalPolicy.DESTROY deletion address analytics.orders instead. Names with empty components now fail at synthesis, and renames cannot add, remove or change the qualifier.

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[github-actions]

⚠️ This pull request description does not follow the correct template structure.

PRs without a linked issue will receive lower priority for review and merging. Please update the description to follow the PR template and include a line like Closes #123 in the Issue section. If no existing issue matches your change, create one first.

[github-actions]

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
This security report is NOT a review blocker. Please try merge from main to avoid findings unrelated to the PR.
To suppress a specific rule, see Suppressing Rules.

---

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results	192 ran	192 passed

Test	Result
No test annotations available

• View Security Guardian Results

[github-actions]

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
This security report is NOT a review blocker. Please try merge from main to avoid findings unrelated to the PR.
To suppress a specific rule, see Suppressing Rules.

---

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results with resolved templates	192 ran	192 passed

Test	Result
No test annotations available

• View Security Guardian Results with resolved templates

[maintainer-for-aws]

Automated review

A maintainer will still review this — treat the notes below as a starting point.

📌 Commit 045592a

This PR (fix(redshift-alpha): align qualified table names) fixes a divergence in the experimental @aws-cdk/aws-redshift-alpha module where the custom-resource table handler quoted a dotted tableName as a single identifier ("public.orders") while the sibling privileges handler already treated it as the schema-qualified relation public.orders. As a result a table and its grant could resolve to different relations. The change switches the table handler to quoteQualifiedIdentifier across create/drop/comment/all ALTER variants, makes renames operate on the leaf only (with a guard rejecting cross-qualifier moves), rejects empty dotted components at synth and runtime, and adds a conservative rollback no-op path for CloudFormation's auto-rollback of a rejected update. Supporting changes add schema-qualified doc notes on tableName, a README note and comma fix, an eslint-suppression count bump, extensive unit coverage, and an IntegTest-based deploy-time assertion proving the grant and table now resolve to the same relation.

This is a deliberate breaking change, confined to an experimental module and carrying an explicit BREAKING CHANGE: callout, so it is permitted. The empty-component rejection and new rename guards are documented parts of that break rather than false positives, the synth-time check is correctly gated by token resolution, and the rollback heuristic only short-circuits a path that would otherwise fail. The public surface stays string-typed and idiomatic to Redshift's own schema.table notation, the test coverage exercises each new behavior with assertions that would turn red on regression, and no new security exposure is introduced. No issues found on this change.

🔴 0 blocking · 🟡 0 recommended · ⚪ 0 optional

---

Generated automatically. React 👍 or 👎 to tell us whether this review helped, so we can improve these reviews.