Skip to content

Commit f6e9731

Browse files
committed
Authorizer: allow REINDEX/ANALYZE (fixes CREATE INDEX denial)
The last failing test, ordinarySQLIsAllowed, ran `CREATE INDEX`. SQLite reports the index build to the authorizer as SQLITE_REINDEX, which the default-deny branch rejected -> SQLITE_AUTH. REINDEX and ANALYZE are safe maintenance operations on the single authorized DB file (and remain readOnly-gated), so allow them. https://claude.ai/code/session_01AdvNtQ7wCMVy8etacVQbjg
1 parent 090603c commit f6e9731

1 file changed

Lines changed: 5 additions & 1 deletion

File tree

Sources/SwiftSQLiteKit/EngineContext.swift

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,11 @@ final class EngineContext: @unchecked Sendable {
8282
SQLITE_DROP_INDEX, SQLITE_DROP_TEMP_INDEX,
8383
SQLITE_DROP_VIEW, SQLITE_DROP_TEMP_VIEW,
8484
SQLITE_DROP_TRIGGER, SQLITE_DROP_TEMP_TRIGGER,
85-
SQLITE_ALTER_TABLE:
85+
SQLITE_ALTER_TABLE,
86+
// REINDEX/ANALYZE are safe maintenance on the one DB file —
87+
// and CREATE INDEX reports the index build to the authorizer as
88+
// SQLITE_REINDEX, so denying it breaks CREATE INDEX.
89+
SQLITE_REINDEX, SQLITE_ANALYZE:
8690
if readOnly { return SQLITE_DENY }
8791
// `sqlite_schema` writes are deliberately NOT denied here:
8892
// legitimate DDL (CREATE/DROP/ALTER) is reported to the

0 commit comments

Comments
 (0)