Fix: Babelfish: Connection with -U/-d flags fails for truncated identifiers (#4837)

Fix TDS login and database context handling for identifiers that exceed
PostgreSQL NAMEDATALEN (64 chars). TSQL allows up to 128 character login
and database names which are truncated using clip + MD5 hash.

Add JDBC test coverage for long login names (lowercase, mixed case,
multibyte, boundary), long database names, and combined scenarios.
Each database is created and dropped individually to avoid connection
conflicts. Use terminate-tsql-conn to properly release connections.

Issues Resolved
BABEL-6457

Authored-by: Anju Bharti <abanju@amazon.com>

Author: anju15bharti

contrib/babelfishpg_tds/src/backend/tds/tdslogin.c

@@ -1162,6 +1162,46 @@ TdsResetLoginFlags()
  * Returns STATUS_OK or STATUS_ERROR, or might call ereport(FATAL) and
  * not return at all.
  */
+
+/*
+ * tds_truncate_identifier_md5
+ *
+ * Truncate an identifier exceeding NAMEDATALEN using clip + MD5 hash,
+ * matching the behavior of pltsql_truncate_identifier for CI_AS collations.
+ * Used for pre-auth user name truncation (where the tsql hook is unavailable)
+ * and for database name truncation (for consistency with the stored form).
+ */
+#define MD5_HASH_LEN 32
+
+static void
+tds_truncate_identifier_md5(char *ident, int len)
+{
+	char		md5[MD5_HASH_LEN + 1];
+	char		buf[NAMEDATALEN];
+	const char *errstr = NULL;
+	char	   *downcased;
+
+	Assert(len >= NAMEDATALEN);
+
+	downcased = downcase_identifier(ident, len, false, false);
+
+	if (!pg_md5_hash(downcased, strlen(downcased), md5, &errstr))
+		ereport(FATAL,
+				(errcode(ERRCODE_INTERNAL_ERROR),
+				 errmsg("could not compute %s hash: %s", "MD5", errstr)));
+
+	len = pg_mbcliplen(ident, len, NAMEDATALEN - MD5_HASH_LEN - 1);
+	Assert(len + MD5_HASH_LEN < NAMEDATALEN);
+	memcpy(buf, ident, len);
+	memcpy(buf + len, md5, MD5_HASH_LEN);
+	buf[len + MD5_HASH_LEN] = '\0';
+
+	pfree(downcased);
+	memcpy(ident, buf, len + MD5_HASH_LEN + 1);
+}
+
+#undef MD5_HASH_LEN
+
 static int
 ProcessLoginInternal(Port *port)
 {
@@ -1251,13 +1291,19 @@ ProcessLoginInternal(Port *port)
 	loginInfo = request;
 
 	/*
-	 * Truncate given database and user names to length of a Postgres name.
-	 * This avoids lookup failures when overlength names are given.
+	 * Truncate user name to fit Postgres NAMEDATALEN using TSQL-aware
+	 * truncation (clip + MD5 hash) so the result matches the role name
+	 * stored in the pg catalog. We cannot use truncate_identifier_hook here
+	 * because babelfishpg_tsql is not yet loaded at this stage.
+	 * Database name truncation is handled similarly in TdsSetDbContext().
 	 */
-	if (strlen(port->database_name) >= NAMEDATALEN)
-		port->database_name[NAMEDATALEN - 1] = '\0';
 	if (strlen(port->user_name) >= NAMEDATALEN)
-		port->user_name[NAMEDATALEN - 1] = '\0';
+	{
+		tds_truncate_identifier_md5(port->user_name, strlen(port->user_name));
+
+		pfree(loginInfo->username);
+		loginInfo->username = pstrdup(port->user_name);
+	}
 
 	/*
 	 * Done putting stuff in TopMemoryContext.
@@ -2043,6 +2089,9 @@ TdsSetDbContext()
 			 * SQL injection.
 			 */
 			StartTransactionCommand();
+			if (strlen(loginInfo->database) >= NAMEDATALEN)
+				tds_truncate_identifier_md5(loginInfo->database,
+											strlen(loginInfo->database));
 			db_id = pltsql_plugin_handler_ptr->pltsql_get_database_oid(loginInfo->database);
 			CommitTransactionCommand();
 			MemoryContextSwitchTo(oldContext);

test/JDBC/expected/BABEL-login-db-long-identifiers-vu-cleanup.out

@@ -0,0 +1,27 @@
+-- tsql
+
+-- Cleanup: drop all logins and databases created for long identifier tests
+-- Drop long logins
+DROP LOGIN long_identifier_login_test_user_abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqr;
+GO
+
+DROP LOGIN Mixed_Case_Login_Test_XyZaBcDeFgHiJkLmNoPqRsTuVwXyZaBcDeFgHiJkLmNoPqRsTuVwXyZaBcDeFgHiJkLmNoPqRsTuVwXyZaBcDeFgHiJkLmNoPqRsTuVwXy;
+GO
+
+DROP LOGIN Lögïn_Tëst_Üsér_àáâãäåæçèéêëìíîïðñòóôõöøùúûüýþÿàáâãäåæçèéêëìíîïðñòóôõöøùúûüýþÿàáâãäåæçèéêëìíîïðñòóôõöøùúûüýþÿàáâãäåæçèéêëìíîïðñò;
+GO
+
+-- Drop boundary login
+DROP LOGIN boundary_test_login_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa;
+GO
+
+-- Drop case-insensitive test login
+DROP LOGIN Case_Insensitive_Long_Login_Test_AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZzAaBbCcDdEeFfGgHhIiJjKkLlMmNn;
+GO
+
+-- Drop bracketed long logins
+DROP LOGIN [long_bracket_login_test_user_abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstu];
+GO
+
+DROP LOGIN [Bracketed_Mixed_Case_Login_XyZaBcDeFgHiJkLmNoPqRsTuVwXyZaBcDeFgHiJkLmNoPqRsTuVwXyZaBcDeFgHiJkLmNoPqRsTuVwXyZaBcDeFgHiJkLmNoPqRsT];
+GO

test/JDBC/expected/BABEL-login-db-long-identifiers-vu-prepare.out

@@ -0,0 +1,39 @@
+-- tsql
+
+-- Test TSQL-aware identifier truncation for login and database names
+-- that exceed Postgres NAMEDATALEN (64 chars). TSQL allows up to 128 chars.
+-- The truncation uses clip + MD5 hash to produce a unique name that fits
+-- within NAMEDATALEN while preserving uniqueness.
+-- Scenario 1: Long login with 128 lowercase chars
+CREATE LOGIN long_identifier_login_test_user_abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqr WITH PASSWORD = '123';
+GO
+
+-- Scenario 2: Long login with 128 mixed-case chars (different name from Scenario 1)
+-- Verifies that MD5 hash is computed on the downcased version (case-insensitive)
+CREATE LOGIN Mixed_Case_Login_Test_XyZaBcDeFgHiJkLmNoPqRsTuVwXyZaBcDeFgHiJkLmNoPqRsTuVwXyZaBcDeFgHiJkLmNoPqRsTuVwXyZaBcDeFgHiJkLmNoPqRsTuVwXy WITH PASSWORD = '123';
+GO
+
+-- Scenario 3: Long login with 128 multibyte chars
+-- Verifies that pg_mbcliplen handles multibyte characters correctly
+CREATE LOGIN Lögïn_Tëst_Üsér_àáâãäåæçèéêëìíîïðñòóôõöøùúûüýþÿàáâãäåæçèéêëìíîïðñòóôõöøùúûüýþÿàáâãäåæçèéêëìíîïðñòóôõöøùúûüýþÿàáâãäåæçèéêëìíîïðñò WITH PASSWORD = '123';
+GO
+
+-- Scenario 4: Boundary - login with exactly 64 chars (minimum that triggers truncation)
+CREATE LOGIN boundary_test_login_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa WITH PASSWORD = '123';
+GO
+
+-- Scenario 5: Case-insensitive authentication test
+-- Create with mixed case, will authenticate with different cases to verify
+-- that the MD5 hash computed during login matches regardless of input case
+CREATE LOGIN Case_Insensitive_Long_Login_Test_AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZzAaBbCcDdEeFfGgHhIiJjKkLlMmNn WITH PASSWORD = '123';
+GO
+
+
+
+-- Scenario 6: Bracketed long login with 128 chars (should pass)
+CREATE LOGIN [long_bracket_login_test_user_abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstu] WITH PASSWORD = '123';
+GO
+
+-- Scenario 7: Bracketed long login with mixed case (128 chars, should pass)
+CREATE LOGIN [Bracketed_Mixed_Case_Login_XyZaBcDeFgHiJkLmNoPqRsTuVwXyZaBcDeFgHiJkLmNoPqRsTuVwXyZaBcDeFgHiJkLmNoPqRsTuVwXyZaBcDeFgHiJkLmNoPqRsT] WITH PASSWORD = '123';
+GO