[zvonand]

Changelog category (leave one):

• Improvement

Changelog entry (a user-readable short description of the changes that goes to CHANGELOG.md):

Added profiles_mapping to the token user directory to map OAuth groups to settings profiles, which take precedence over profiles from roles.

CI/CD Options

Exclude tests:

• Fast test
• Integration Tests
• Stateless tests
• Stateful tests
• Unit tests
• Performance tests
• Aarch64 tests
• All with ASAN
• All with TSAN
• All with MSAN
• All with UBSAN
• All with Coverage
• All Regression
• Disable CI Cache

Regression jobs to run:

• Fast suites (mostly <1h)
• Aggregate Functions (2h)
• Alter (1.5h)
• Benchmark (30m)
• CAS (content-addressed storage; Antalya only)
• ClickHouse Keeper (1h)
• Iceberg (2h)
• LDAP (1h)
• OAuth (5m)
• Parquet (1.5h)
• RBAC (1.5h)
• SSL Server (1h)
• S3 (2h)
• S3 Export (2h)
• Swarms (30m)
• Tiered Storage (2h)

[github-actions]

Workflow [PR], commit [7da0019]

[zvonand]

@blau-ai

[zvonand]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T09:33:43.956705Z	e62d0c3	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[blau-ai]

CI triage

Verdict: 2 failing checks, both pre-existing on antalya-26.8 — neither is caused by this PR. Everything else in the run is skipping/green (this run only executed the two regression suites below; builds, stateless and integration were skipped/cached, so the new test_token_profiles_mapping integration test did not run here).

Check	Classification	PR-caused?
Regression release oauth / RegressionTestsRelease / OAuth / oauth	Regression-suite expectation bug (pre-existing)	No
Regression release swarms / RegressionTestsRelease / Swarms / swarms	Flaky/infra, distributed (pre-existing)	No

---

1. OAuth regression — pre-existing suite bug (500 vs 403)

All OAuth failures (/oauth, /oauth/access control, /oauth/groups) share one root cause. The suite asserts a denied query returns HTTP 500, but the server correctly returns HTTP 403:

Expected HTTP status code 500, but got 403. Response body:
Code: 497. DB::Exception: a_977c6e: Not enough privileges. To execute this query,
it's necessary to have the grant CREATE TEMPORARY TABLE ON *.*. (ACCESS_DENIED)

The query is correctly denied — this is the right, secure behavior. ACCESS_DENIED (497) maps to HTTP_FORBIDDEN (403) in core ClickHouse (src/Server/HTTP/exceptionCodeToHTTPStatus.cpp:83-85), which this PR does not touch. The failing scenarios (missing_default_profile_does_not_grant_unrestricted_access, group_name_matches_clickhouse_role) exercise RBAC denial, not profile assignment.

Evidence it is not this PR: the base branch antalya-26.8 (MasterCI run 39839856866, head ab9c4003, 2026-10-22 — before this PR) fails the identical scenarios with the same Expected HTTP status code 500, but got 403 message. So the mismatch exists without your change.

Suggested fix (not in this repo): the fix belongs in the clickhouse-regression suite — oauth/tests/steps/common.py::assert_query_denied and the access-control step in oauth/tests/steps/clikhouse.py should expect status_code=403 for ACCESS_DENIED (or accept both 403 and 500). I can't push that from here (it lives in the regression repo, not Altinity/ClickHouse). It is worth filing/pinging the QA owners so the OAuth suite goes green again on the branch.

2. Swarms regression — flaky/infra (pre-existing)

Failures are in cluster discovery/check cluster discovery with wrong cluster name, node failure/cpu overload, and cpu overload all swarm nodes — distributed/connection behavior under CPU load, e.g.:

Code: 279. DB::Exception: ... Cannot connect to any replica for query execution.
(ALL_CONNECTION_TRIES_FAILED)

This suite tests S3 swarm cluster discovery and node-failure resilience. This PR touches only src/Access/TokenAccessStorage.{cpp,h} and docs — zero swarm code — so it cannot be the cause. The same Swarms / swarms job also fails on the base-branch run above. Classify as pre-existing flaky/infra; safe to re-run, though it will likely stay red until the swarm-suite flakiness is addressed separately.

---

PR health check

The code change itself (profiles_mapping on the token user directory) looks self-contained: roles_mapping/profiles_mapping now share one parseGroupMapping parser, profiles are rebuilt from scratch on each login (so a profile of a left group is dropped), and default_profile is applied before mapped profiles with documented precedence. CI as run here surfaces no PR-attributable failure. The gap is that this run did not execute the new tests/integration/test_token_profiles_mapping — a full CI run (or re-trigger of the stateless/integration jobs) would be worth confirming before merge, since that's the test that actually covers this change.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e62d0c3eb2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".