fix(hide-internal-tables): filter sqlite_master in CREATE VIEW and CTAS bodies

[erans]

Closes #86.

Problem

--hide-internal-tables rewrote client sqlite_master references only in Statement::Query and Insert sources. A view or CTAS built over the catalog was stored unfiltered, and every later read went through it:

CREATE VIEW v AS SELECT name FROM sqlite_master;
SELECT * FROM v;  -- unfiltered catalog, including __pgsqlite_* rows

The second statement never mentions sqlite_master, so nothing filtered it.

Change

Two arms added to the match in SqliteMasterFilter::translate — CreateView's query and CreateTable's AS SELECT source. The visitor, predicate, alias handling, fail-open behavior, and both wire hook points are unchanged.

The rewrite stays an allowlist over statement kinds. UPDATE/DELETE remain wholly untouched, subqueries included: filtering there would change which rows a write touches rather than what a user sees. A denylist was rejected because Statement::Merge's target is itself a TableFactor, so a wholesale visit would emit invalid SQL whose error text pastes __pgsqlite_ back to the client — the regression #85 fixed.

Also fixed, found in review

• CREATE TABLE t (cols) AS SELECT ... — the rewritten body defeated CreateTableTranslator's greedy \((.*)\) regex, producing invalid SQL that leaked the internal prefix into the client-facing error. The arm now skips statements carrying an explicit column list.
• CREATE VIEW IF NOT EXISTS — unparseable by PostgreSqlDialect (PostgreSQL has no such form; SQLite does), so translate failed open and stored the view unfiltered. Now retries with SQLiteDialect.
• temp.sqlite_master — accepted as a qualifier but dropped from the generated relation, so temp-catalog queries silently returned main's catalog. temp. is now left alone, as otherdb. already was.

Known trade-off

SQLite persists literal CREATE VIEW text, so a filtered view's stored DDL contains the predicate — visible in sqlite_master.sql and information_schema.views.view_definition. Documented in docs/configuration.md and asserted in the test suite. The alternative, an internal __pgsqlite_visible_master view, was rejected because it would make a pgsqlite-managed object load-bearing for user schema. CTAS is unaffected: SQLite stores the expanded column list, not the select.

Testing

• 12 unit tests in src/translator/sqlite_master_filter.rs covering view/CTAS/materialized-view rewrites, the column-list guard, the dialect fallback, the temp. and attached-db qualifiers, and the MERGE allowlist boundary.
• Wire-level tests in both flag states over both the simple and extended protocols, reproducing the issue verbatim.
• Full suite: 191 test groups, 0 failures.

Follow-ups, not addressed here

• CreateTableTranslator's greedy regex silently drops the AS SELECT from CREATE TABLE t (cols) AS SELECT ..., creating an empty table. Pre-existing and independent of this flag.
• Positional test-name filters abort the integration test binaries, because config::CONFIG runs Config::parse() against the harness argv.
• test_batch_delete_edge_cases is flaky under parallel load.

🤖 Generated with Claude Code