[lvrach]

Adds tests for ClickHouse users whose SELECT on the customer database is narrow: a table-level grant or a prefix grant such as db.search_*, with no db.* SELECT and no system grants (ACT2-1269).

Why

A pilot customer grants SELECT on a subset of tables by prefix. Our tests covered only db.*. These tests pin the behaviour the customer depends on: validation passes with the check_database_select warning, only granted tables are visible, and other reads fail with CH_PERMISSION (server code 497).

How to verify

• go test -count=1 -run '^TestValidation_NarrowSelectWarning$' ./sqlconnect/internal/clickhouse/
• go test -count=1 -run '^TestValidation_NarrowCustomerGrants$' ./sqlconnect/internal/clickhouse/ (ClickHouse 26.3 container through rudder-go-kit)
• Each test fails under a mutation that makes narrow SELECT a hard error, adds a CHECK GRANT on the customer database, or rejects narrow SELECT when the grant tables are readable.

Not covered

• Test files only. No product change.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.12%. Comparing base (63b214a) to head (d4cd371).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #596      +/-   ##
==========================================
+ Coverage   91.09%   91.12%   +0.02%     
==========================================
  Files         140      140              
  Lines        7130     7130              
==========================================
+ Hits         6495     6497       +2     
+ Misses        633      631       -2     
  Partials        2        2              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

🟢 Approval recommended

Static review found no blocking issues in these focused test-only changes; tests were not executed.

No open issues 🎉

What changed in this PR

Adds regression tests for ClickHouse validation with table-level or prefix SELECT grants, without changing production code.

Changes:

• Tests warning-only validation for narrow SELECT grants and optional grant inspection.
• Verifies table visibility, permitted reads, and permission errors for denied reads.
• Extends the validation stub with configurable read responses.

File	Description
sqlconnect/​internal/​clickhouse/​validation_test.go	Adds scripted narrow-grant scenarios and stub support.
sqlconnect/​internal/​clickhouse/​validation_integration_test.go	Tests table-level and prefix grants against ClickHouse 26.3.

_{Review effort: Balanced}