FreeOnePlus opened a new pull request, #99: URL: https://github.com/apache/doris-mcp-server/pull/99
## Summary - replace the removed `mysql.user.Default_role` dependency with Doris public RBAC metadata commands - use `SHOW ALL GRANTS`, falling back to current-user `SHOW GRANTS` when elevated metadata access is unavailable - preserve SQL security validation while keeping fixed internal role metadata machine-readable instead of identity-masked - normalize host-qualified identities, multiple roles, and users without an explicit role ## Stack - Depends on #98 - Incremental commit: `6b3bae3` - This PR is intentionally stacked so `COMPAT-001` remains independently reviewable ## Verification - red tests reproduced the Doris 4.0 `Default_role` incompatibility over Streamable HTTP and actual STDIO - unit coverage includes multi-role parsing, empty roles, and the current-user fallback - connection-layer coverage proves that disabling control-data masking does not bypass SQL security validation - full pytest: 356 passed, 57 skipped - `uv lock --check` - Ruff on changed tests and severe runtime rules - `compileall` - `uv build` - `git diff --check` ## Real Doris verification Environment: `192.168.31.63`, Doris `4.0.5-rc01-59de8c4c524`, database `hhm_dt_sim`. - confirmed `mysql.user` has no `Default_role` - production role lookup returned `root -> operator` and `hhm_nl2sql_reader -> hhm_nl2sql_readonly` - Streamable HTTP modern and legacy returned `operator -> root` - actual STDIO modern and legacy returned the same role mapping - every transport path recovered with a real query returning `org_tenant=47040` - credentials were not stored in the repository, tests, or ledger -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
