ARCH-CAT-001 — Separate connection routing from catalog identity
| Field | Value |
|---|---|
| Status | Open finding; source and deployment configuration verified |
| Severity | High |
| Affected surface | Catalog landing, discovery tree, SQL Editor catalog selector, and query routing |
| Implementation issue | oqullus #527 |
| Code-change repository | sparqd/oqullus |
Where the problem appears
Open Catalog or SQL Editor and inspect the top-level entry labelled delta. The UI presents that entry as a catalog even though it originates from a Superset database connection.
Concrete observed case
The assessed deployment has one Superset Trino connection named delta, so the connection name happens to match its default Trino catalog. The product skips catalog discovery and requests schemas directly through the connection. A renamed connection, another catalog, or another Trino connection would break that accidental equivalence.
Expected condition
Keep the single Trino connection hidden while it is the only supported route. Populate the visible selector from the caller's authorized Trino catalogs, preserve the selected catalog independently from the internal connection ID, and pass both identities to schema and query operations.
Cause and evidence
- The top-level Catalog list is derived from Superset database registrations.
- Trino has catalog identities that do not correspond one-to-one with the displayed connection list.
- The current deployment masks the distinction because both names are delta.
Why it matters
Display authority and execution authority can drift. Users may see a connection they cannot browse, miss a catalog they can query, or execute against a different catalog from the one implied by the UI.
Existing controls and workarounds
Use a fully qualified catalog.schema.table name in SQL Editor when exact routing matters. Top-level Catalog visibility is not proof of catalog authorization.
Alternatives considered
- Recommended: hide the sole connection and show Ranger-filtered Trino catalogs.
- Show connection then catalog as two levels when multiple heterogeneous connections become supported.
- Keep using the connection name as catalog identity — rejected because it cannot represent multiple catalogs or stable routing.
Component involvement
- Oqullus owns displayed selection and identity preservation.
- BFF/Superset integration owns catalog-aware discovery through the selected connection.
- Ranger remains the authorization authority for the actual Trino catalog.
Reproduction and verification
Follow CAT-S001. Record the visible state, request outcome, effective identity, and recovery behavior relevant to this finding.
Resolution conditions
Close when connection ID and catalog name are distinct fields, authorized catalog discovery drives the UI, empty/error states are explicit, and Catalog and SQL Editor execute against the visibly selected catalog.
Validation and blockers
Oqullus and BFF owners must validate the contract. Restricted-user evidence in gj76anadpsc, workspace w-t5e2kcxjd, remains required.