Method DestroySession

duckdbservice/service.go:1206–1339

DestroySession closes and removes a session.

(token string)

	// ConfigureMainDB sets these once at warmup, but in cluster mode the
	// per-session evictConnFromPool call discards the settings along with
	// the conn — so for every session after the first we need to re-apply.
	// DuckDB rejects `SET GLOBAL` for these keys, so this is the only path.
	server.ApplyProfilingSettings(context.Background(), conn)

	// Apply initial resource limits if provided (optimizes handshake by avoiding
	// roundtrips from control plane).
	if memoryLimit != "" {
		if _, err := conn.ExecContext(context.Background(), fmt.Sprintf("SET memory_limit = '%s'", memoryLimit)); err != nil {
			slog.Warn("Failed to set initial memory_limit.", "user", username, "error", err)
		}
	}
	if threads > 0 {
		if _, err := conn.ExecContext(context.Background(), fmt.Sprintf("SET threads = %d", threads)); err != nil {
			slog.Warn("Failed to set initial threads.", "user", username, "error", err)
		}
	}

	// User-secret hygiene + replay (shared-warm / k8s mode only). DuckDB
	// secrets are instance-global, so a hot-idle worker reused by a different
	// user of the same org would otherwise see the previous user's secrets —
	// both persistent ones and non-persistent (plain/TEMPORARY CREATE SECRET)
	// ones that pass through to the worker. Wipe ALL user secrets first
	// (mandatory — this is the cross-user isolation step), then replay this
	// user's secrets from the control plane. Replay failures degrade to
	// warnings; a wipe failure fails the session because handing user A's
	// secrets to user B is not acceptable.
	var secretWarnings []string
	switch {
	case p.sharedWarmMode && p.maxSessions != 1:
		// The wipe and replay below are only safe because exactly one session
		// runs at a time (DuckDB secrets are instance-global; k8s workers are
		// spawned with DUCKGRES_DUCKDB_MAX_SESSIONS=1). Assert that here, at
		// the point of reliance, instead of trusting a flag set two layers
		// away: with any other cap, wiping would delete a concurrent
		// session's secrets mid-query. Skip hygiene entirely and scream.
		slog.Error("User secret hygiene requires max_sessions=1 on shared-warm workers; skipping wipe+replay.",
			"max_sessions", p.maxSessions, "user", username, "secrets", len(secretStatements))
		if len(secretStatements) > 0 {
			secretWarnings = []string{"persistent secrets were NOT restored: worker session cap is misconfigured (requires max_sessions=1)"}
		}
	case p.sharedWarmMode:
		secretCtx, secretCancel := context.WithTimeout(context.Background(), userSecretOpTimeout)
		wiped, wipeErr := wipeUserSecrets(secretCtx, conn)
		if wipeErr != nil {
			secretCancel()
			_ = conn.Close()
			p.mu.Lock()
			p.reserved--
			p.mu.Unlock()
			return nil, nil, fmt.Errorf("wipe user secrets before session start: %w", wipeErr)
		}
		if len(wiped) > 0 {
			slog.Info("Wiped user secrets left by previous session.", "user", username, "count", len(wiped))
		}
		// Same isolation step for client-ATTACHed databases: they are
		// instance-global too, and an attached catalog keeps the credentials
		// it was built from even after the secret above is gone. Mandatory for
		// the same reason as the wipe — see detachUserCatalogs.