fix(parser): allow TABLE/PARTITION/TABLES as identifiers in ClickHouse (#480) (#481)

* feat(parser): add SQL Server PIVOT/UNPIVOT clause parsing (#456)

Add support for SQL Server and Oracle PIVOT/UNPIVOT operators in FROM
clauses. PIVOT transforms rows to columns via an aggregate function,
while UNPIVOT performs the reverse column-to-row transformation.

- Add PivotClause and UnpivotClause AST node types
- Add Pivot/Unpivot fields to TableReference struct
- Implement parsePivotClause/parseUnpivotClause in new pivot.go
- Wire parsing into parseFromTableReference and parseJoinedTableRef
- Add PIVOT/UNPIVOT to tokenizer keyword map for correct token typing
- Update formatter to render PIVOT/UNPIVOT clauses
- Enable testdata/mssql/11_pivot.sql and 12_unpivot.sql
- Add 4 dedicated tests covering subquery+alias, plain table, AS alias

Closes #456

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* security: add CVE-2026-32285 to .trivyignore

CVE-2026-32285 affects github.com/buger/jsonparser v1.1.1, which is a
transitive dependency via mark3labs/mcp-go → invopop/jsonschema →
wk8/go-ordered-map → buger/jsonparser.

No fixed version is available upstream. The package is not called
directly by any GoSQLX code and risk is scoped to MCP JSON schema
generation. Added to .trivyignore until a patched version is released.

Fixes Trivy Repository Scan CI failures in PR #475 and #477.

* fix(parser): scope PIVOT/UNPIVOT to SQL Server/Oracle dialects

PIVOT and UNPIVOT were registered in the global tokenizer keyword map,
which made them reserved words across every dialect. Queries like
`SELECT pivot FROM users` then failed in PostgreSQL/MySQL/SQLite/
ClickHouse where these identifiers are perfectly legal.

Changes:
- Remove PIVOT/UNPIVOT from tokenizer keywordTokenTypes (they are now
  tokenized as identifiers in all dialects).
- Gate isPivotKeyword/isUnpivotKeyword on the parser dialect (TSQL/
  Oracle only) and accept identifier-typed tokens by value match.
- Skip alias consumption in parseFromTableReference / parseJoinedTableRef
  when the upcoming identifier is a contextual PIVOT/UNPIVOT keyword,
  so the pivot-clause parser can claim it.
- Fix unsafe single-value type assertion in TestTSQL_PivotWithASAlias
  to comply with the project's mandatory two-value form.
- Add TestPivotIdentifierInNonTSQLDialects regression covering pivot/
  unpivot as identifiers in PostgreSQL, MySQL, and SQLite.

All parser/tokenizer/formatter tests pass with -race.

* fix(parser): polish PIVOT/UNPIVOT round-trip and validation

- Formatter emits AS before PIVOT/UNPIVOT aliases for clean round-trip.
- Tokenizer records Quote='[' on SQL Server bracket-quoted identifiers;
  pivot parser uses renderQuotedIdent to preserve [North] etc. in
  PivotClause.InValues and UnpivotClause.InColumns.
- Reject empty IN lists for both PIVOT and UNPIVOT.
- Extract parsePivotAlias helper, collapsing four duplicated alias
  blocks in select_subquery.go.
- Add TestPivotNegativeCases (missing parens, missing FOR/IN, empty IN)
  and TestPivotBracketedInValuesPreserved.

Full test suite passes with -race.

* fix(parser): escape embedded delimiters and fix empty-IN error order

- renderQuotedIdent now doubles embedded `]`, `"`, and `` ` ``
  per dialect convention so identifiers like [foo]bar] round-trip
  unambiguously.
- Empty PIVOT/UNPIVOT IN list check now runs before the closing-`)`
  check so the user-facing error is "at least one value/column..."
  instead of the misleading ") to close ... IN list".
- Clarify renderQuotedIdent comment to reference Token.Quote and
  Word.QuoteStyle as the actual sources.

* refactor(formatter): thread nodeFormatter through tableRefSQL and joinSQL

Previously these package-level renderers hardcoded keyword literals
(PIVOT, UNPIVOT, FOR, IN, LATERAL, JOIN, ON) which bypassed the
caller's case policy (f.kw). Thread *nodeFormatter into both
functions and route every keyword through f.kw so uppercase/lowercase
options apply uniformly across FROM, JOIN, MERGE, DELETE USING, and
UPDATE FROM paths.

Addresses claude-review feedback on PR #477. All formatter, parser,
and tokenizer tests pass with -race.

* fix(parser): allow TABLE/PARTITION/TABLES as identifiers in ClickHouse (#480)

ClickHouse system tables (system.replicas, system.parts, system.tables) expose
columns named `table` and `partition`, and queries commonly reference
`system.tables`. The parser previously rejected these because TABLE, PARTITION,
and TABLES tokenize as keywords and the non-reserved-keyword-as-identifier path
was gated to SQL Server only.

- Extend the gate in parsePrimaryExpression to also enable for ClickHouse.
- Add TokenTypePartition and the "TABLES" keyword value to isNonReservedKeyword
  so they can serve as identifiers in expression position and after qualifiers.

Closes #480

* fix(parser): allow ROWS as identifier in ClickHouse (#480, #482)

Extend the non-reserved-keyword allowlist to also accept ROWS as a column
identifier. ClickHouse exposes a `rows` column in system.tables and other
system tables; ROWS is otherwise reserved for window-frame syntax
(ROWS BETWEEN ...) but is unambiguous in expression position.

Part of #482 (ClickHouse parser gaps from QA sweep).

---------

Co-authored-by: Ajit Pratap Singh <ajitpratapsingh@Ajits-Mac-mini-2655.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: 3 people

pkg/sql/parser/clickhouse_table_identifier_test.go

@@ -0,0 +1,116 @@
+// Copyright 2026 GoSQLX Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+
+package parser_test
+
+import (
+	"testing"
+
+	"github.com/ajitpratap0/GoSQLX/pkg/gosqlx"
+	"github.com/ajitpratap0/GoSQLX/pkg/sql/keywords"
+)
+
+// TestClickHouseTableAsIdentifier verifies that the ClickHouse dialect accepts
+// `table` as a column identifier in SELECT lists, function arguments, and
+// GROUP BY clauses. ClickHouse system tables (system.replicas, system.tables,
+// system.parts) all expose a `table` column, so this is a common real-world
+// pattern. Regression test for issue #480.
+func TestClickHouseTableAsIdentifier(t *testing.T) {
+	queries := map[string]string{
+		"replicas_with_table_column": `SELECT
+    database,
+    table,
+    is_leader,
+    is_readonly,
+    is_session_expired,
+    parts_to_check,
+    queue_size,
+    inserts_in_queue,
+    merges_in_queue,
+    absolute_delay,
+    last_queue_update,
+    zookeeper_path
+FROM system.replicas
+ORDER BY absolute_delay DESC`,
+
+		"tables_with_bytes_on_disk": `SELECT
+    database,
+    table,
+    engine,
+    formatReadableSize(bytes_on_disk) AS size,
+    parts,
+    active_parts
+FROM system.tables
+WHERE engine LIKE '%MergeTree%'
+  AND is_temporary = 0
+ORDER BY bytes_on_disk DESC
+LIMIT 10`,
+
+		"tables_with_total_bytes": `SELECT
+    database,
+    table,
+    engine,
+    formatReadableSize(total_bytes) AS size,
+    parts,
+    active_parts
+FROM system.tables
+WHERE engine LIKE '%MergeTree%'
+  AND is_temporary = 0
+ORDER BY total_bytes DESC
+LIMIT 10`,
+
+		"parts_with_concat_table": `SELECT
+    concat(database, '.' ,table) AS table_name,
+    count() AS part_count,
+    max(partition) AS latest_partition,
+    formatReadableSize(sum(bytes_on_disk)) AS total_size
+FROM system.parts
+WHERE active = 1
+  AND database NOT IN ('system')
+GROUP BY database, table
+ORDER BY part_count DESC
+LIMIT 10`,
+
+		"parts_having_count": `SELECT
+    database,
+    table,
+    count() AS parts,
+    formatReadableSize(sum(bytes_on_disk)) AS size
+FROM system.parts
+WHERE active = 1
+  AND database NOT IN ('system')
+GROUP BY database, table
+HAVING parts > 300
+ORDER BY parts DESC`,
+
+		// system.tables exposes a `rows` column. ROWS is a reserved keyword
+		// (used in window frames: ROWS BETWEEN ...), but in ClickHouse it is
+		// a valid column name in system tables.
+		"tables_with_rows_column": `SELECT
+    database,
+    table,
+    rows,
+    total_bytes
+FROM system.tables
+WHERE database = 'default'
+ORDER BY rows DESC`,
+	}
+
+	for name, query := range queries {
+		query := query
+		t.Run(name, func(t *testing.T) {
+			parsed, err := gosqlx.ParseWithDialect(query, keywords.DialectClickHouse)
+			if err != nil {
+				t.Fatalf("ParseWithDialect failed: %v", err)
+			}
+			if parsed == nil {
+				t.Fatal("expected non-nil AST")
+			}
+		})
+	}
+}

pkg/sql/parser/expressions_literal.go

@@ -103,7 +103,7 @@ func (p *Parser) parsePrimaryExpression() (ast.Expression, error) {
 		return funcCall, nil
 	}
 
-	if p.isType(models.TokenTypeIdentifier) || p.isType(models.TokenTypeDoubleQuotedString) || (p.dialect == string(keywords.DialectSQLServer) && p.isNonReservedKeyword()) {
+	if p.isType(models.TokenTypeIdentifier) || p.isType(models.TokenTypeDoubleQuotedString) || ((p.dialect == string(keywords.DialectSQLServer) || p.dialect == string(keywords.DialectClickHouse)) && p.isNonReservedKeyword()) {
 		// Handle identifiers and function calls
 		// Double-quoted strings are treated as identifiers in SQL (e.g., "column_name")
 		// Non-reserved keywords (TARGET, SOURCE, etc.) can also be used as identifiers

pkg/sql/parser/parser.go

@@ -958,14 +958,18 @@ func (p *Parser) isNonReservedKeyword() bool {
 	case models.TokenTypeTarget, models.TokenTypeSource, models.TokenTypeMatched:
 		return true
 	case models.TokenTypeTable, models.TokenTypeIndex, models.TokenTypeView,
-		models.TokenTypeKey, models.TokenTypeColumn, models.TokenTypeDatabase:
+		models.TokenTypeKey, models.TokenTypeColumn, models.TokenTypeDatabase,
+		models.TokenTypePartition, models.TokenTypeRows:
 		// DDL keywords that are commonly used as quoted identifiers in MySQL (backtick)
-		// and SQL Server (bracket) dialects.
+		// and SQL Server (bracket) dialects, and as plain column names in ClickHouse
+		// system tables (system.parts.partition, system.replicas.table,
+		// system.tables.rows, etc).
 		return true
 	case models.TokenTypeKeyword:
 		// Token may have generic Type; check value for specific keywords
 		switch strings.ToUpper(p.currentToken.Token.Value) {
-		case "TARGET", "SOURCE", "MATCHED", "VALUE", "NAME", "TYPE", "STATUS":
+		case "TARGET", "SOURCE", "MATCHED", "VALUE", "NAME", "TYPE", "STATUS",
+			"TABLES":
 			return true
 		}
 	}