nao reads system.settings during ClickHouse connection setup. On Tinybird, that Service Data Source is restricted to ADMIN tokens, so any least-privilege read token fails and the connection never establishes — even when the token has read access to every datasource listed in include:.
HTTP driver received HTTP status 403, server response: Services Data Sources like
'system.settings' can't be directly accessed without an ADMIN token.
This forces analytics deployments to hand nao a workspace admin token, which is a much larger blast radius than a read-only BI connection warrants — the same credential can then create, modify and delete datasources and pipes.
Questions:
- Is the
system.settings read required at connect time, or could it be made lazy — or tolerant of a 403, falling back to defaults?
columns.md generation also reads system.columns and system.tables, and index metadata reads system.projections / system.data_skipping_indices. A documented minimum-privilege set for Tinybird would help, even if some templates degrade gracefully when those aren't readable.
Happy to test a patch against a real Tinybird workspace if that's useful.
Version: nao 0.3.1 (getnao/nao:0.3.1), ClickHouse connection against clickhouse.tinybird.co.
nao reads
system.settingsduring ClickHouse connection setup. On Tinybird, that Service Data Source is restricted to ADMIN tokens, so any least-privilege read token fails and the connection never establishes — even when the token has read access to every datasource listed ininclude:.This forces analytics deployments to hand nao a workspace admin token, which is a much larger blast radius than a read-only BI connection warrants — the same credential can then create, modify and delete datasources and pipes.
Questions:
system.settingsread required at connect time, or could it be made lazy — or tolerant of a 403, falling back to defaults?columns.mdgeneration also readssystem.columnsandsystem.tables, and index metadata readssystem.projections/system.data_skipping_indices. A documented minimum-privilege set for Tinybird would help, even if some templates degrade gracefully when those aren't readable.Happy to test a patch against a real Tinybird workspace if that's useful.
Version: nao 0.3.1 (
getnao/nao:0.3.1), ClickHouse connection againstclickhouse.tinybird.co.