fix: Add missing distinct field to all Projection initializations

- Added distinct: false to all Projection struct creations across codebase
- Fixes compilation errors from RETURN DISTINCT feature implementation
- Files updated: analyzer (7 files), logical_plan (3 files), optimizer (2 files), render_plan
- Build now succeeds: cargo build --release completes successfully

Author: genezhang

.dockerignore

@@ -1,33 +1,66 @@
 # Rust/Cargo build artifacts
 target/
 **/target/
+Cargo.lock
 
 # Cargo-Chef recipe (caching layers)
 recipe.json
 
 # Docker build files
 Dockerfile
+Dockerfile.test
 .dockerignore
+docker-compose*.yaml
 
 # Git metadata
 .git
 .gitignore
+.gitattributes
 
 # CI/CD configs
 .github/
 
 # Environment files (secrets, creds)
 .env
+.env.*
 
 # IDE/editor settings
 .vscode/
 .idea/
 *.swp
+*.swo
+*~
 
 # OS files
 .DS_Store
+Thumbs.db
 
-# Local ClickHouse data
+# Development/test data
 clickhouse_data/
-
 test_data/
+neo4j_data/
+neo4j_logs/
+
+# Documentation (not needed in runtime image)
+docs/
+archive/
+notes/
+*.md
+!README.md
+
+# Scripts (development only)
+scripts/
+*.py
+*.sh
+*.bat
+*.ps1
+
+# Test files
+tests/
+benchmarks/
+examples/
+
+# Backup files
+*.backup
+*.bak
+*.tmp

.github/workflows/ci.yml

@@ -18,6 +18,11 @@ jobs:
     steps:
     - uses: actions/checkout@v4
 
+    - name: Setup Rust
+      uses: dtolnay/rust-toolchain@stable
+      with:
+        toolchain: 1.85
+
     - name: Code format check
       run: cargo fmt -- --check
 

CHANGELOG.md

@@ -1,30 +1,34 @@
-## [0.5.1] - 2025-11-21
+## [0.5.1] - 2025-11-20
 
 ### 🚀 Features
 
-- Add SQL Generation API (v0.5.1)
-- Implement RETURN DISTINCT for de-duplication
-- Add role-based connection pool for ClickHouse RBAC
+- **RETURN DISTINCT**: Add support for `RETURN DISTINCT` to de-duplicate query results
+  - Eliminates duplicate results in multi-path graph traversals
+  - Fully integrated: parser, AST, logical plan, SQL generation
+  - Generates `SELECT DISTINCT` in ClickHouse SQL
+- **Role-Based Connection Pool**: Implement per-role connection pooling for ClickHouse RBAC
+  - Maintains separate connection pools per role for performance
+  - Eliminates `SET ROLE` execution overhead on every query
+  - Prevents race conditions with concurrent role usage
+  - Uses ClickHouse HTTP `role` parameter for proper role context
+  - Works without role (uses default connection pool)
 
 ### 🐛 Bug Fixes
 
+- Fix WHERE filter application in complex graph patterns (addresses user-reported duplicate results)
 - Eliminate flaky cache LRU eviction test with millisecond timestamps
 
-### 📚 Documentation
-
-- Fix getting-started guide issues
-- Update STATUS.md with fixed flaky test achievement (423/423 passing)
-- Add /query/sql endpoint and RETURN DISTINCT documentation
-- Add /query/sql endpoint and RETURN DISTINCT to wiki
-
 ### 🧪 Testing
 
-- Add role-based connection pool integration tests
+- Add comprehensive role-based connection pool integration tests
+- Verify RETURN DISTINCT de-duplication behavior
+- SQL generation endpoint correctly returns `["SET ROLE role", "SELECT ..."]` array
 
-### ⚙️ Miscellaneous Tasks
+### 📊 Test Coverage
+
+- **423/423 integration tests passing** (100%)
+- Role-based query tests: 4/6 passing (2 require ClickHouse roles setup)
 
-- Update CHANGELOG.md [skip ci]
-- Release v0.5.1
 ## [0.5.0] - 2025-11-19
 
 ### 🚀 Features

Cargo.lock

@@ -1,26 +1,84 @@
+# ============================================================================
+# Stage 1: Planner - Generate dependency recipe for caching
+# ============================================================================
 FROM lukemathwalker/cargo-chef:latest-rust-1-bullseye AS chef
 WORKDIR /app
 
 FROM chef AS planner
 COPY . .
 RUN cargo chef prepare --recipe-path recipe.json
 
+# ============================================================================
+# Stage 2: Builder - Build the application
+# ============================================================================
 FROM chef AS builder 
+
+# Copy dependency recipe
 COPY --from=planner /app/recipe.json recipe.json
+
 # Build dependencies - this is the caching Docker layer!
+# This layer is only rebuilt when dependencies change
 RUN cargo chef cook --release --recipe-path recipe.json
-# Build application
+
+# Copy source code
 COPY . .
-RUN cargo build --release --bin clickgraph \
-    && cargo build --release -p clickgraph-client --bin clickgraph-client
 
-# We do not need the Rust toolchain to run the binary!
+# Build the application binaries
+RUN cargo build --release --bin clickgraph && \
+    cargo build --release -p clickgraph-client --bin clickgraph-client
+
+# Strip debug symbols to reduce binary size
+RUN strip /app/target/release/clickgraph && \
+    strip /app/target/release/clickgraph-client
+
+# ============================================================================
+# Stage 3: Runtime - Minimal production image
+# ============================================================================
 FROM debian:bullseye-slim AS runtime
+
+# Install runtime dependencies only
 RUN apt-get update && \
-    apt-get install -y libssl1.1 ca-certificates && \
-    rm -rf /var/lib/apt/lists/*
+    apt-get install -y --no-install-recommends \
+        ca-certificates \
+        libssl1.1 \
+        wget \
+    && rm -rf /var/lib/apt/lists/*
+
+# Create non-root user for security
+RUN useradd -m -u 1000 -s /bin/bash clickgraph
+
+# Set working directory
 WORKDIR /app
-# Copy binaries
-COPY --from=builder /app/target/release/clickgraph /usr/local/bin/
-COPY --from=builder /app/target/release/clickgraph-client /usr/local/bin/
-ENTRYPOINT ["/usr/local/bin/clickgraph"]
+
+# Copy binaries from builder
+COPY --from=builder /app/target/release/clickgraph /usr/local/bin/clickgraph
+COPY --from=builder /app/target/release/clickgraph-client /usr/local/bin/clickgraph-client
+
+# Set proper permissions
+RUN chown -R clickgraph:clickgraph /app && \
+    chmod +x /usr/local/bin/clickgraph /usr/local/bin/clickgraph-client
+
+# Switch to non-root user
+USER clickgraph
+
+# Expose ports
+EXPOSE 8080 7687
+
+# Health check using wget (smaller than curl)
+HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
+    CMD wget --no-verbose --tries=1 --spider http://localhost:8080/health || exit 1
+
+# Default environment variables (can be overridden)
+ENV CLICKGRAPH_HOST=0.0.0.0 \
+    CLICKGRAPH_PORT=8080 \
+    CLICKGRAPH_BOLT_HOST=0.0.0.0 \
+    CLICKGRAPH_BOLT_PORT=7687 \
+    CLICKGRAPH_BOLT_ENABLED=true \
+    CLICKGRAPH_MAX_CTE_DEPTH=100 \
+    RUST_LOG=info
+
+# Set entrypoint
+ENTRYPOINT ["/usr/local/bin/clickgraph"]
+
+# Default command (can be overridden)
+CMD []

Dockerfile

@@ -1,5 +1,5 @@
 # Multi-stage build for testing
-FROM rust:1.82 as builder
+FROM rust:1.85 as builder
 
 WORKDIR /build
 COPY . .