5 commits

Author	SHA1	Message	Date
ZdenekSrotyr	1074d5ec49	feat: implement data access control — table-level permissions ... Schema v3: add is_public column to table_registry (default true). src/rbac.py: can_access_table() checks admin bypass, public flag, explicit permissions, wildcard bucket permissions. API enforcement: - manifest: filters tables by user access - download: 403 if no access - catalog: filters table list - query: validates referenced tables against allowed list New admin permissions API (/api/admin/permissions) for grant/revoke. 28 access control tests + 733 total tests passing.	2026-03-31 12:33:31 +02:00
ZdenekSrotyr	18e5f0b6e8	feat: implement extract.duckdb contract — orchestrator + extractors ... Phase 0: extend table_registry schema (v1→v2 migration), add source_type/bucket/source_table/query_mode columns. Phase 1: SyncOrchestrator ATTACHes extract.duckdb files into master analytics.duckdb. Keboola extractor uses DuckDB extension with legacy client fallback. BigQuery extractor is remote-only via DuckDB BQ extension (no data download). 62 tests passing.	2026-03-30 20:12:56 +02:00
ZdenekSrotyr	0b9720d090	docs: rewrite core refactoring spec v2 — simplified extract.duckdb contract	2026-03-30 19:24:19 +02:00
ZdenekSrotyr	9ee7b3bd09	docs: add core refactoring design spec — DuckDB-centric extract architecture	2026-03-30 18:15:52 +02:00
ZdenekSrotyr	07b396bfe2	docs: add refactoring plan, design spec, and gitignore updates	2026-03-27 15:42:57 +01:00