feat(pam): clickhouse by lb-vn · Pull Request #402 · Infisical/cli

lb-vn · 2026-09-17T00:35:44Z

Description 📣

Clickhouse

Type ✨

Tests 🛠️

# Here's some code block to paste some code snippets

I have read the contributing guide, agreed and acknowledged the code of conduct. 📝

gitguardian · 2026-09-17T00:35:50Z

⚠️ GitGuardian has uncovered 3 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
37371931	Triggered	Base64 Basic Authentication	`6865c3e`	packages/pam/handlers/clickhouse/proxy_test.go	View secret
37371932	Triggered	Username Password	`6865c3e`	packages/pam/handlers/clickhouse/proxy_test.go	View secret
37409076	Triggered	Generic High Entropy Secret	`bda0fe8`	packages/pam/session/masking/masking_test.go	View secret

🛠 Guidelines to remediate hardcoded secrets

Understand the implications of revoking this secret by investigating where it is used in your code.
Replace and store your secrets safely. Learn here the best practices.
Revoke and rotate these secrets.
If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

following these best practices for managing and storing secrets including API keys and other credentials
install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

linear · 2026-09-17T00:35:54Z

PAM-466

veria-ai · 2026-09-17T00:43:21Z

PR overview

All previously flagged issues have been addressed. No open security concerns remain on this pull request.

Security review

No open security issues remain on this pull request.

Fixed/addressed: 6 · PR risk: 0/10

greptile-apps · 2026-09-17T00:43:27Z

Confidence Score: 5/5

The PR appears safe to merge; the latest changes correctly close the ClickHouse quota-selection override without introducing a new actionable defect.

Summary

This PR adds ClickHouse HTTP-interface support to PAM, including connection testing, credential and execution-scope replacement, command-policy inspection, session auditing, local connection guidance, and capability advertisement. Since the previous review, it also closes the remaining quota override channels by stripping the correct ClickHouse quota header and query parameter.

Routes ClickHouse PAM sessions through a purpose-built HTTP reverse proxy.
Replaces client credentials, database, role, and quota selection with account-controlled settings.
Inspects supported request encodings for blocked commands and records completed outcomes.
Adds ClickHouse connection testing, local CLI guidance, resource registration, and tests.

_{Reviews (5) · Last reviewed commit: "fix header key"}

# Conflicts: # packages/gateway-v2/capabilities.go

greptile-apps · 2026-09-22T21:57:43Z

Want your agent to iterate on Greptile's feedback? Try greploops.

feat(pam): clickhouse

6865c3e

lb-vn requested a review from bernie-g September 17, 2026 00:35

veria-ai Bot reviewed Sep 17, 2026

View reviewed changes

Comment thread packages/pam/handlers/clickhouse/proxy.go Outdated

greptile-apps Bot reviewed Sep 17, 2026

View reviewed changes

Comment thread packages/pam/handlers/clickhouse/proxy.go Outdated

Comment thread packages/pam/handlers/clickhouse/proxy.go Outdated

Comment thread packages/pam/handlers/clickhouse/proxy.go

Comment thread packages/pam/handlers/clickhouse/proxy.go Outdated

address bot reviews

847eb2f

veria-ai Bot reviewed Sep 17, 2026

View reviewed changes