Repository navigation
feat(influxdb): read InfluxDB 1.x, 2.x and 3.x as two connection types, InfluxQL and InfluxDB 3 SQL - #1309
Merged
Conversation
️✅ There are no secrets present in this pull request anymore.If these secrets were true positive and are still valid, we highly recommend you to revoke them. 🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request. |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…core, seed data and the evidence harness's statement plan Adds the influxdb1, influxdb2 and influxdb3 services, the influxdb3-filelimit fixture behind its profile and the influxdb-seed one-shot, with docker/influxdb/seed.sh as the only writer. The evidence plan builds every request the hand-run harness sends, and its unit test holds E22: corpus entries end in SHOW DATABASES, name only a database that does not exist, are bound to the read principal on 1.x and 2.x, and no entry names a write or admin route.
… when the body ends before its terminating chunk NodeRequest gains form, serialised with URLSearchParams under application/x-www-form-urlencoded with its byte length; a request with both body and form is refused before any socket. TransportError gains a readonly truncated flag and an options argument. Once the response callback has run and before the body ends, a runtime failure that is not the signal's abort is kind network, truncated true, with the message "The server ended the response before it was complete". The redirect and encoding refusals, the deadline, the cancel and the byte cap keep their kinds with truncated false.
…er reads it A browser-safe lexer for the InfluxQL read policy, the editor and the generators: newline normalisation, the scanner's comments, strings, quoted identifiers and regexes, the operand rule for / (R13), the keyword list pinned to token.go at v1.4.1, and a resumable line tokenizer whose joined tokens equal the whole-text reading.
…sources quoteInfluxqlIdentifier and quoteInfluxqlString write only the scanner's four escapes and refuse every other C0 control and DEL without echoing the value; influxqlSource writes the default retention policy source.
…s a statement names evaluateInfluxql allows exactly one SELECT, SHOW or EXPLAIN statement with no bare INTO at any depth, and refuses Flux, a text that does not lex, a bound parameter and a text over 65,536 bytes before any request. An allowed statement reports the databases it names, read as parseSources and parseSegmentedIdents of influxql v1.4.1 read a source (R17, R31), for the run-database rule.
…w, and the InfluxDB 3 read policy
… plaintext consent and the read-only seed stage buildInfluxConnectionOptions maps a connection of either type-id to the client's options: the validated origin and far end, AUTHORIZATION_BY_TYPE (Basic or Token on influxdb, Bearer on influxdb3), the plaintext refusal that allowInsecureAuth lifts, the database field, the read-only seed stage and the bounds of spec 5.5. CREDENTIAL_WARNINGS gains a no-secret row for influxdb and influxdb3, which the seed stage reads. The typecheck reports errors naming influxdb and influxdb3 until the two ids join DatabaseType at registration.
…ersion read from /ping and /health INFLUXQL_ROUTES and SQL_ROUTES are the only paths and keys either type can send, deeply frozen. The client fills only declared keys, hands a form route's fields to the transport as NodeRequest.form and a body route's keys as JSON, and refuses an undeclared, fixed or missing key before the transport is called. readPing reads the 3.x /ping body or, after a bodiless /ping, the 1.x and 2.x /health version; GENERATION_TRAITS holds the per-line differences. K4: chunk_size stays 1,000. Reading 1,000,000 points of bench.bulk on 1.13.1 and 2.9.1, the server's memory grew 0 to 9 MiB at 1,000 against 12 to 19 MiB at 10,000, with the same parse time.
…e the run by its own policy influxdb joins NON_SQL_DIALECTS and NON_SQL_DESTRUCTIVE_VOCABULARY with a row that decides alone, refuses through the browser-safe InfluxQL policy before the run, keeps statements out of the AI safety analysis and bounds the text at 65,536 bytes. influxdb3 stays out of both: its text is SQL.
… InfluxDB 3, and the labels
…erate Query text influxqlTableQuery writes the SPEC 6.6 preview (a one-hour window, newest first, LIMIT 50 per series) and influxqlSelectQuery adds the example lines as comments, every name through the quoter, so the whole text passes the read policy naming only the clicked database. browser-modules.test.ts holds the browser-safe set of four modules: imports only each other and types, and no Buffer in code. K1 kept the window at 1h and K16 kept the InfluxDB 3 WHERE time > 0 hint (both measured on 3.12.0 Core).
…0-core and hold the InfluxQL policy against it The hand-run harness tests/live/influxdb-evidence.ts sends the statement plan to the pinned compose services and writes one capture per request under tests/fixtures/influxdb/<version>/, with the image digest, the request with its credential replaced by the scheme, the status, the content type and the body. It runs each text's policy before the first request, binds the corpus to the read principal on 1.x and 2.x, checks after the run that the database that does not exist holds no series, and refuses to write a file holding any secret form. The differential test reads each corpus capture for the server's parse error or statements and holds evaluateInfluxql to refusing every entry the server read as more than one statement or a first statement that is not a read. The plan test asserts every non-corpus text passes its type's policy (E22). The fixtures and recording transport helpers are what later integration tests replay captures through. Also: the plan gains the R33 infinity capture per line and the settled K10 recipe; versions.test.ts reads the ping and health captures instead of inline copies; seed.sh bench removes its temporary directory and clears its EXIT trap, which fired after the function returned under set -u.
…he seam guard errors.ts maps every answer of spec 5.9 for both types, the T08 mis-pick row for a 2xx /api/v3 answer that is not JSON, and the R33 infinity row, to a repository error class and a sentence, through serverText and a 500-character cut. Rows are tables tried in order; line differences come from GENERATION_TRAITS or the measured text, type differences from one record. K11: the cloud suffixes .cloud2.influxdata.com and .influxdb.io, from influxdata/docs-v2 data/influxdb_urls.yml. monitoring.ts gives the health and the overview of spec 7. seam-guard.test.ts holds the five rules of spec 3.5 and the layer value-import rule of contract section 1, each proven by planted violations.
… databases, measurements and columns influxql-results.ts splits a chunked /query body into its JSON documents (newline-separated on 1.x and 2.x, back to back on 3.x), keeps integers beyond 2^53 exact, refuses an answer holding any result other than statement 0 as a lexer disagreement (C5) before reading a statement's own error, flattens the series into one grid and applies the row cut and the cell budget after the whole body is in. influxql-objects.ts reads databases, measurements and their columns through the quoter, the policy and the run-database rule, so _internal is never read on a generation that hides it.
…s the session database's tables
…modules return InfluxShapeLimits and ShapedResult were declared twice, once in each results module, because an sql-* module may not import an influxql-* one. They now live in connection-options.ts beside INFLUX_ROW_CUT and INFLUX_CELL_BUDGET, which both modules already read for the same reason.
…I, with its integration test over the captures
The two declared styles, "double" and "backtick", quote only a name that would not round-trip bare, and the "double" rule lets a `$` through bare. InfluxDB 3 needs every table and column quoted: its read policy refuses a bare `$`, so a generated Count of a table named `a$b` would be refused by Studio itself, and its preview names "time" quoted. "double-always" quotes every name and doubles an embedded double quote; no existing provider changes.
K3 measured the bounds in the image runtime under its heap flag and the chart's 512Mi limit: four runs at the 32 MiB response cap fit on the InfluxQL 1.x line and eight are killed for memory, while the bounds allowed sixteen per engine. The two type-ids' engines add up in one process, so each now keeps two calls in flight, and one provider two, its Agent's sockets with them. The cap stays 32 MiB. The permit and socket tests read the constants instead of repeating them.
…ds without a semicolon InfluxDB 3.12.0 runs statements separated by whitespace or a comment alone as separate statements, so a semicolon count let `SHOW DATABASES DROP MEASUREMENT "x"` and `SHOW DATABASES SELECT * FROM (SELECT * FROM "_internal".."x")` through. Fixes R42 (EARLY-R1 F1): a SELECT, SHOW or EXPLAIN is allowed only where a statement of this one begins, the write keywords are refused anywhere outside quotes, comments and regex literals, and the source reader reads past any parenthesis. The differential corpus gains five space, tab, newline and comment separated entries on all three lines, recorded by the harness.
…e call one deadline EARLY-R1 F2 (R43): a catalog answer is read as its expected columns straight from each series, refusing any other column before a row is read, so a hostile SHOW answer costs linear time instead of building a quadratic grid. EARLY-R1 F3 (R43): the database listing keeps at most INFLUX_LIST_CAP names and makes the overview a floor when cut; every read of a surface call shares one surface deadline. EARLY-R1 F4 (R44): one _internal refusal sentence true on every line. EARLY-R1 F5 (R44): the server-wide SHOW forms 1.13.1 answers with no db are sent with no db.
…th the preview time window and its integration test over the captures InfluxDB3Provider extends SQLBaseProvider by composition: the connect sequence of spec 6.2 (a 1.x or 2.x server refused from /ping and /health before any /api/v3 call, a /ping 403 read as a resource token, the SELECT 1 check when the listing is refused), one session database per connection, the query pipeline of spec 5.2 and the object surface with no container level. ProviderCapabilities gains previewTimeWindow, and the SQL arms of generateTableQuery and generateSelectQuery write the windowed preview and its example lines from it, with no LIMIT in the text, so the limiter's LIMIT and OFFSET page it (K17).
…as Qdrant does InfluxDB 3 declares no containerPathShapes (R16: one session database, no container level), so its provider must not call assertContainerPathShape: the census in container-path-shapes-capability.test.ts holds the callers equal to the declarers. The check is now a plain length test with the same sentence.
…ore records, the factory and the census
…Database the listing does not hold R46 (EARLY-R2 F1): shapeJsonlBody walks the body with indexOf and slice and stops at the row cut, instead of splitting the whole answer first. A 32 MiB answer of short lines grew RSS by 50 MiB instead of 238 MiB. R47 (EARLY-R2 F2): a jsonl line nested deeper than 64 levels is refused as not-json, so a later JSON.stringify of the result cannot overflow the stack. R48 (EARLY-R2 F3): connect refuses a Database that a readable listing does not hold, with the database-not-found sentence, and getOverview throws the database-not-found 404 instead of counting it as zero tables.
K3 measured again after the line-by-line shaper, now with the worst case the limiter admits: both engines kept full at the response cap, refilled as calls finish. At 32 MiB that case peaks between 404 and 478 MiB in the image runtime under its heap flag, and with the idle server's own memory it passes the chart's 512Mi limit; the excess is response buffers released lazily, off the V8 heap. At 16 MiB it peaks between 230 and 271 MiB, with two calls in flight per engine kept. The row cut still keeps 10,000 rows of a smaller answer.
… and showcase ranks for both types Both InfluxDB types get their DB_UI_CONFIG rows (fields, labels, hints, the consent box, the read-only hint and the Host box addresses), one generic InfluxDBIcon, and a slot in the picker and the showcase directly after Prometheus. The consent box under SSL mode disable now draws the type's own declared hint, Db2's sentence moved verbatim into its entry, and a test holds every type that takes the field to declaring one. influxdb takes text-hue-purple-alt; influxdb3 takes text-hue-violet-alt, the first candidate hue whose -alt step clears the separation tests (K-D4), declared in theme.css for both palettes.
…d backlog entries Re-derive every count the two type-ids move (twenty-five external engines, twenty-six type-ids, thirty always-on compose services), add both types to the provider lists, the providers index and compose table, the seed recipes, and file D196-D204, U79-U81 and B94 with B94 cited in docs/AGENT.md.
… every cited file exists
… twenty-fifth engines Every storefront listing and package description now counts twenty-five external engines and names InfluxDB (InfluxQL) and InfluxDB 3 (SQL) after Prometheus wherever it lists them all. Room inside the size budgets comes from generic prose only: DOCKERHUB.md is 22998 of 23000 bytes, the PCSC body is 1488 of 1494, CapRover's description 191 of 200, and the Azure short description becomes an abridged 210 of 256. The desktop entries gain InfluxDB and InfluxQL keywords, the metainfo lists gain both types as read-only, and .SRCINFO is regenerated by makepkg --printsrcinfo in the pinned Arch container. NUMERAL_WORDS gains twenty-six so the next provider does not trip the copy gate.
…ts, hooks and machine surfaces, and regenerate the dialect golden Every hand list that enumerates query languages or engines gains an influxql row, and an influxdb3 row where the list is SQL-specific: the row-menu and export gates, the toolbar, the tab bar, the embedded workspace, the tab manager, the import dialog and the generator registry. A refused InfluxQL statement is never posted and never written to history; an allowed one goes to /api/db/query whole, and InfluxDB 3 text is split under the DataFusion row. The confirmation gate reads an InfluxQL regex and backslash escape without asking, and refuses DROP DATABASE and 65,537 bytes before the run. Plan prompts give influxdb the non-SQL contract and influxdb3 the SQL one, each with its own language sentence and fence tag. The profile route refuses InfluxQL and profiles an InfluxDB 3 table on its session database, failing past the Core file limit with the file-limit sentence. machine-surfaces.test.ts holds that plan mode's inventory and MCP inspect_schema never see _internal on 3.x, through either type, while 1.x lists it. The dialect golden is regenerated and adds exactly the influxdb and influxdb3 keys; no other answer moved.
…run paths The embedded surface refuses through use-query-adapter.ts, and only the qdrant row pinned that the host's fetch is never called. The influxdb row's refusal is now held the same way on executeQuery, forceExecuteQuery, the unlimited run and Load More; with the row's refuse removed, all four fail.
…oc test docs/providers/influxdb.md documents the influxdb type-id in the 15-section shape, with the Flux translation section the Flux refusal points to and the TLS recipes the plaintext refusal points to. tests/unit/db/influxdb/provider-doc-influxdb.test.ts reads every label, hint, sentence, route, bound, capability, generated preview, tested image and seed field the doc states back from the code.
…test docs/providers/influxdb3.md is the triad's doc for the influxdb3 type-id, in the fifteen-section shape with Qdrant's numbering. Its doc test reads every label, hint, route, keyword, bound, refusal, error sentence and generated preview back from the code, and the tested version and digest from the capture manifest.
…ht server One spec for both type-ids (gate 5): the shared icon in two colours, each type's fields, ports and hints, the TLS, SSH and Read-only controls, the consent box under SSL mode disable only, and one pre-socket refusal per type through Test Connection to a .invalid host. A chromium-influxdb project runs it on the second server, which SECOND_SERVER_SPECS now pins.
container-path-renderer.test.ts holds that only assertContainerPathShape words
"<engine> container path is ...": the InfluxDB 3 provider, which declares no
container level, now refuses a path in Qdrant's words ("has no container
level"), and the InfluxQL provider's descriptor takes the name the guard reads
and joins its engine list. The security page names both InfluxDB providers
after the sentence the Qdrant and Milvus doc tests quote, instead of inside it.
…ery dialect does StudioModals keeps the test data modal mounted with the empty path until an object is chosen, and the modal quotes that path while it renders. The InfluxQL arm of quoteObjectPath refused anything but [database, measurement], so every influxdb connection took the whole Studio down to its error page, and the embedded StudioWorkspace unmounted the host's page. The arm now writes the empty path as the empty string, as the other dialects do, and still refuses any other length.
…e it writes Plan mode named every inventory entry by its dotted path, so an InfluxQL measurement read home.home, and three runs on 1.13.1 wrote FROM "home"."home", which InfluxQL reads as retention policy home and refuses. A [database, measurement] path on an InfluxQL connection is now named "home".."home" in the snapshot and in the context the run is handed; every other path, and every other engine, keeps the dotted spelling.
…dioModals passes The closed-modal case omitted the required tableSchema prop, which the typecheck and next build refuse; it now passes null, as objectAtPath answers for no object.
CodeQL read BEHAVIOURS[path](socket) as a method call named by network input (js/unvalidated-dynamic-method-call); a Map lookup is not, and a path with no behaviour now fails the test loudly.
…mparator SonarCloud reads a bare sort() of strings as a bug (typescript:S2871). The order is the same code-unit order the default gave; a locale comparison would make it depend on the runtime's locale.
The login hero test built a pattern from every engine label without escaping it, so the parentheses of "InfluxDB (InfluxQL)" and "InfluxDB 3 (SQL)" became groups and the list never matched (the E2E job on #1309). Each label is now escaped into the pattern.
…ng and columns as the SQL side does R53 (HASIM H1): 1.13.1 and 2.9.1 answer a chunked SHOW over several measurements with one complete statement_id 0 document per measurement, which C5 refused as a second statement. A second closed route row, query-unchunked (POST /query, form db and q only), now carries every SHOW and EXPLAIN and the catalog reads; SELECT keeps the chunked row and C5 is unchanged. New captures of SHOW TAG KEYS and SHOW TAG VALUES WITH KEY, chunked and unchunked, on all three lines. R54 (HASIM L1 to L4): server notices pass serverText before they become warnings; a /query document nested deeper than 64 levels is not JSON; the grid keeps at most the cell budget's columns and marks the result cut; the choose-a-database sentence names actions that exist.
cevheri
force-pushed
the
feat/influxdb-provider
branch
from
October 4, 2026 07:16
50e20e7 to
54e92fc
Compare
…g paths CodeQL still read the Map lookup as a call named by network input (js/unvalidated-dynamic-method-call, alert 617); the behaviour is now found by comparing the request's path with each known one.
|
cevheri
added a commit
that referenced
this pull request
Oct 4, 2026
Oxia joins as a read-only engine: oxia client get, list and range-scan in the editor, shards in the tree and every key in the Keys panel, over Oxia's gRPC client API, tested on 0.16.10 and 0.17.1. A dial policy sends the token to no address the connection does not name, and a cluster lists its data servers in a new Data servers field. Shared changes: a server-streaming call with a received-byte limit on the gRPC transport, KeyScan totalScope "none", an engine-neutral shell-word reader, and the consent box's hint declared per type. Put on main after InfluxDB (#1309): every engine count, census and order re-derived (26 external engines, 54 connectable), and the backlog entries filed as D205 to D218.
cevheri
added a commit
that referenced
this pull request
Oct 4, 2026
…1310) * feat(oxia): Oxia provider, read-only, over the shared gRPC transport Oxia joins as a read-only engine: oxia client get, list and range-scan in the editor, shards in the tree and every key in the Keys panel, over Oxia's gRPC client API, tested on 0.16.10 and 0.17.1. A dial policy sends the token to no address the connection does not name, and a cluster lists its data servers in a new Data servers field. Shared changes: a server-streaming call with a received-byte limit on the gRPC transport, KeyScan totalScope "none", an engine-neutral shell-word reader, and the consent box's hint declared per type. Put on main after InfluxDB (#1309): every engine count, census and order re-derived (26 external engines, 54 connectable), and the backlog entries filed as D205 to D218. * fix(oxia): count no table in the monitoring overview The shared overview card that draws tableCount is titled Tables, so the shard count read there as three tables beside a Tables tab saying it had no statistics. The overview now counts no table and no index; the shard map is still read so a server that serves none fails the panel, and the Tables tab draws Oxia's own caption (ruling R34). * fix(oxia): show default as the Namespace placeholder and say when the consent box matters The Namespace box showed the dialog's "db" though an empty Namespace means default; an engine may now declare a field placeholder, read through connectionFieldPlaceholder, and Oxia declares default. The consent box's hint said the connection is refused unless ticked, which is untrue for a loopback or tokenless connection; it now says a token sent without TLS to a host that is not this machine is refused (ruling R34). * fix(oxia): drop the Markdown backticks from the -n refusal The result panel shows the sentence as plain text, so the namespace read with literal backticks around it (ruling R34). * fix(oxia): tell a loopback endpoint to type the server's own loopback name With Host 127.0.0.1 against a server that calls itself localhost:6648, the refusal called localhost a host this machine cannot be assumed to reach. Without a tunnel, one refused leader that is a loopback name on the endpoint's port now gets the type-it-in-Host sentence (ruling R35, HASIM-B F4). * fix(oxia): name the trust store when no CA is pasted and the chain is untrusted verify-full with an empty CA field checks the chain against this machine's roots, yet the refusal blamed "the CA under SSL / TLS". The error view now carries whether a CA is pasted, and without one the sentence says the certificate is not signed by a CA this machine trusts (ruling R35, HASIM-B F5). * fix(oxia): give the console run-budget list test its own timeout Measured at 1.4 s alone with coverage, the one test of execute.test.ts over 1 s; provider.test.ts's only such test (4.1 s, the 1,024-shard limiter case) already carries 30 s (ruling R36). * fix(oxia): file the three shared-UI defects of the browser pass in BACKLOG D219 control characters printed raw in Keys rows and tab titles, D220 an empty value headed as a failed read, D221 the Keys panel's empty state under a prefix; each is the shared UI's, for every engine (rulings R34, R36). * fix(oxia): address review of FB File D222: etcd and Milvus name a pasted CA for an untrusted chain when none was pasted, the case ruling R35 rewords for Oxia. * fix(oxia): type the Tables tab caption assertion tableStatsCaption is optional on ProviderLabels, so the assertion compares against a string and checks Oxia declares its caption. * fix(oxia): read a key the walk saw on the shard that listed or answered it A record written with a partition key lives on that key's shard, so routing it by its own hash misses it (ruling R32, HASIM-B F1 to F3). The order probe lists the decisive key on the shard that answered it, kept keys carry their listing shard into the values phase, and the extra gets of the children page and the band walk ask every shard of the walk. The three captures whose calls changed are recorded again by tests/live/oxia-evidence.ts. * fix(oxia): open a partition-keyed key in the Source tab On a miss on the shard its own hash names, the Source tab asks every other shard whether it holds the key, asking no value, and reads the value on the one shard that does; a key held by more than one shard under different partition keys is refused with get -p (ruling R33, HASIM-B F2). The conformance capture, whose calls changed, is recorded again by tests/live/oxia-evidence.ts. * fix(oxia): point the withheld value's sentence at the Metadata part The Source tab shows the version in the Metadata part, not below the value, so the withheld sentence now ends "Its version is under Metadata." (ruling R34, browser pass step 6). * fix(oxia): give every walks test over 1 s with coverage a 30 s timeout Measured twice under bun test --coverage: four tests ran over 1 s on the default 5 s timeout or a 10 s one, and CI failed two walks tests at 5.27 s and 5.46 s (ruling R36). Tests that already carried a longer timeout keep it. * fix(oxia): address review of FA Pin the order probe's sample, first-message and read-on paths over a partition-keyed key with /: each test fails when the decisive List goes to the key's hash shard. Read a key stored on two shards under different partition keys in a range-scan, each record from its own shard. * fix(oxia): write Oxia sentences without Markdown backticks No component renders Markdown in a warning or an error, so the backticks showed literally. The missed-get and empty-namespace sentences now write the namespace as quoteShellWord writes it, and the N6 and N7 notices write the range bound and the --prefix fragment plainly (ruling R37). The four captures that hold these sentences were recorded again by the evidence harness. The hex dump's JSON caption comes from the shared sourceCaption, so it is filed as BACKLOG D223. * fix(oxia): answer a key several shards hold once in every key walk A key written under two partition keys is stored on two shards. The merge answered it once per shard, so the Keys panel showed it once or twice depending on the page size. The merge now answers each key once and takes every copy off its heap, the Keys panel pages, list and the key phase of range-scan and prefixScanPage included, and a record walk reads such a key on the lowest shard id that listed it (ruling R38). BACKLOG D224 records that a record walk then shows one record for it, and the provider doc says so in its known limitations. * fix(oxia): address review of FC The provider doc and BACKLOG D224 said a key several shards hold is one key in every walk, but an --index walk lists the shards one after another and shows each shard's copy, as measured over the fake. Both now name the --index walk, a walks test pins that it answers the key once per holding shard, and provider-doc P15 quotes the corrected sentence. The mergeShards docblock is rewrapped to the file's width. * fix(oxia): name the root as the root in the natural-order idiom notice list / // on a natural namespace named the empty parent as an empty quoted word ("'''s children"); it now reads "the root's children" (ruling R39). The one capture that holds the notice was recorded again through the evidence harness, and its README re-rendered by the harness. * docs: name both InfluxDB types and Oxia where the merge left one out The seed schema's allowInsecureAuth comment, the QueryTab union example of the provider guide, and DOCKERHUB.md's read-only list, measured by the merge critics. * test: keep the Oxia evidence harness's provenance in the fixtures README CodeQL js/insecure-temporary-file flagged tests/live/oxia-evidence.ts for writing its provenance to a fixed path under the system's temporary directory. The fixtures README's set table is now the provenance store: a full-set run writes its set's row and keeps the others, an --only run renews the digests, and --readme renders from the README's own rows and the captures on disk. The --provenance option is gone, and a rule in live-environment.test.ts holds every tests/live/oxia-*.ts file to no temporary-directory state (ruling R40). * fix(oxia): word the -n refusal as "a namespace other than" and quote the namespace The refusal now reads "-n names a namespace other than this connection's <namespace>: ...", with the namespace as quoteShellWord writes it, so a name holding a space reads back as one word. The provider doc and both tests that quote it follow (ruling R40). * docs(backlog): file four shared-UI defects from the Oxia final browser pass U82 the cleartext consent box says "password" on token engines, U83 a read-only engine's Source tab calls a key's value a definition, U84 the Keys panel keeps Scan all enabled after a complete walk, U85 the agent rail reports a reload after in-app navigation (ruling R40). * fix(oxia): address review of FE Rule 34 now also finds a literal /tmp or /var/tmp path, which a planted writeFileSync("/tmp/...") passed before. The evidence harness resolves --out, so the fixtures directory spelled relative re-renders the README instead of leaving its digests stale. docs/providers/oxia.md says how a single quote in the namespace is written in the -n refusal, pinned by a commands test. * fix(oxia): word the -a refusal as "an address other than" The -n refusal was reworded in fa82740; the -a refusal had the same construction.
cevheri
added a commit
that referenced
this pull request
Oct 5, 2026
…d three security fixes (#1531) Carries eight connection types for seven engines: etcd (#1228), IBM Db2 LUW (#1238), Neo4j with the Graph tab (#1239, #1289), Qdrant (#1270), Milvus (#1283), InfluxDB and InfluxDB 3 (#1309) and Oxia (#1310). Also CapRover and DigitalOcean discovery (#1502, #1378, #1528), launch sign-in for hosting platforms (#1516), and any number of local accounts with passkeys (#1122, #1195). Three security fixes: the OIDC state cookie is no longer accepted as a session (#1380), a non-admin role's DuckDB connection opens with file and network access off (#1519), and SQLite, DuckDB and LibreDB connections refuse Studio's own storage and credential files, with SQLite open to admins only in the editor, agent runs and MCP alike (#1523, #1529). Chart 0.1.78 is flagged containsSecurityUpdates, and its description calls Trino by its own name, the rename #1158 left for this bump.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds InfluxDB as two read-only connection types:
influxdb, "InfluxDB (InfluxQL)": 1.x, 2.x through its v1 API, and 3.x, overPOST /query.influxdb3, "InfluxDB 3 (SQL)": 3.x overPOST /api/v3/query_sql, reading one session database.No new dependency: both use the shared node transport, which gains a form body and a
truncatedflag. Flux is not offered. Each type refuses anything but a read before any request, under a policy measured against the servers' own parsers on 1.13.1, 2.9.1 and 3.12.0. One answer is capped at 16 MiB and each type runs two calls at a time, so the worst case fits the chart's 512Mi.Published types that widen, for the release note:
DatabaseType(influxdb,influxdb3),QueryTab["type"]andProviderCapabilities.queryLanguage(influxql),ProviderCapabilities.identifierQuoting(double-always). Chart 0.1.76.Verified locally: all gates with 100% coverage, build:lib and attw, helm lint; a browser pass on a production build against all three versions, standalone and embedded; plan mode on both types; SQLite, PostgreSQL and SQL Server unchanged against main.
The diff is large (about 420 files, mostly captures, tests and docs). I can split it into three PRs if you prefer: the shared transport and grammar changes, the two providers, then registration and docs.