[pull] master from cube-js:master

CHANGELOG.md

@@ -3,6 +3,20 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.3.38](https://github.com/cube-js/cube/compare/v1.3.37...v1.3.38) (2025-07-16)
+
+### Bug Fixes
+
+- **cubesql:** Propagate errors from SqlAuthService to the user ([#9665](https://github.com/cube-js/cube/issues/9665)) ([3037ada](https://github.com/cube-js/cube/commit/3037adaa55dcb20ac6a3b3064de4292fc454fdc2))
+- **docs:** fix AWS deployment doc redirect ([#9786](https://github.com/cube-js/cube/issues/9786)) ([93c83f8](https://github.com/cube-js/cube/commit/93c83f889c147d28c2bd7ea276572687be61777e))
+- **schema-compiler:** Fix BigQuery convertTz implementation ([#9782](https://github.com/cube-js/cube/issues/9782)) ([75f4813](https://github.com/cube-js/cube/commit/75f48139abccc341398980c7b9abfd78bc7d21aa))
+
+### Features
+
+- **cubesql:** Push Limit-Sort down Projection ([#9776](https://github.com/cube-js/cube/issues/9776)) ([72e6059](https://github.com/cube-js/cube/commit/72e605966100bb24d44b715d96cfb2cc4d8d793d))
+- **schema-compiler,api-gateway:** Nested folders support ([#9659](https://github.com/cube-js/cube/issues/9659)) ([720f048](https://github.com/cube-js/cube/commit/720f0485c8b11f16eb99490259a881c21b845c73))
+- **tesseract:** Allow named calendar timeshifts for common intervals ([#9777](https://github.com/cube-js/cube/issues/9777)) ([a5f8a2e](https://github.com/cube-js/cube/commit/a5f8a2e0d93bf5de0291389d846660f6491651fe))
+
 ## [1.3.37](https://github.com/cube-js/cube/compare/v1.3.36...v1.3.37) (2025-07-14)
 
 ### Bug Fixes

docs/pages/product/deployment/cloud/byoc/_meta.js

@@ -1,4 +1,5 @@
 module.exports = {
   "aws": "AWS",
+  "aws-privatelink": "AWS PrivateLink",
   "azure": "Azure",
 }

docs/pages/product/deployment/cloud/byoc/aws/_meta.js

@@ -0,0 +1,4 @@
+module.exports = {
+  deployment: "Deployment",
+  privatelink: "Private Connectivity",
+};

docs/pages/product/deployment/cloud/byoc/aws/privatelink.mdx

@@ -0,0 +1,140 @@
+# Private Connectivity with AWS PrivateLink
+
+Cube Cloud BYOC deployments on AWS support private connectivity for Cube API endpoints using AWS PrivateLink. This enables secure, private access to your Cube deployment without exposing endpoints to the public internet.
+
+<SuccessBox>
+
+Private connectivity via AWS PrivateLink is available in Cube Cloud on the
+[Enterprise Premier](https://cube.dev/pricing) product tier with BYOC deployments.
+[Contact us](https://cube.dev/contact) for details.
+
+</SuccessBox>
+
+## Overview
+
+In a private setup, Cube Cloud BYOC deployments can be configured to:
+- Keep HTTP and SQL load balancers private within the BYOC VPC
+- Expose API endpoints through AWS PrivateLink services
+- Enable secure connectivity from your VPCs and corporate networks
+
+This approach ensures that all traffic between your applications and Cube Cloud remains within the AWS network backbone, never traversing the public internet.
+
+## Architecture
+
+With private connectivity enabled, Cube Cloud exposes two AWS PrivateLink services:
+- **HTTP API Service**: For REST API and GraphQL endpoints
+- **SQL API Service**: For PostgreSQL-compatible SQL interface connections
+
+Your Cube deployment APIs are available on dedicated hostnames following this pattern:
+- HTTP API: `<deployment-id>.<byoc-region>.cubecloudapp.dev`
+- SQL API: `<deployment-id>.sql.<byoc-region>.cubecloudapp.dev`
+
+<Screenshot src="https://ucarecdn.com/98e38433-3bb8-4f37-afea-7986170c63be/" />
+
+## Setting up PrivateLink connections
+
+### Step 1: Obtain PrivateLink service details
+
+Contact Cube Cloud support to obtain the PrivateLink service details for your BYOC deployment. You'll receive:
+- HTTP NLB PrivateLink service name
+- SQL NLB PrivateLink service name
+- Your deployment ID and infrastructure region
+
+### Step 2: Create VPC endpoints
+
+In your AWS account, create two VPC endpoints for the Cube Cloud services:
+
+1. Navigate to **AWS Console** → **VPC** → **Endpoints**
+2. Click **Create Endpoint**
+3. For the HTTP API endpoint:
+   - **Service category**: Other endpoint services
+   - **Service name**: Enter the HTTP NLB service name provided by Cube support
+   - **VPC**: Select your target VPC
+   - **Subnets**: Select appropriate subnets
+   - **Security Group**: Create or select a security group allowing HTTPS traffic (port 443)
+4. Repeat for the SQL API endpoint:
+   - Use the SQL NLB service name
+   - Configure security group to allow PostgreSQL traffic (port 5432)
+
+### Step 3: Configure DNS resolution
+
+To enable proper hostname resolution, create a private Route 53 hosted zone:
+
+1. Navigate to **AWS Console** → **Route 53** → **Hosted zones**
+2. Click **Create hosted zone**
+3. Configure the zone:
+   - **Domain name**: `<byoc-region>.cubecloudapp.dev`
+   - **Type**: Private hosted zone
+   - **VPCs**: Associate with your target VPC(s)
+4. Create the following DNS records in the zone:
+
+   | Record Name | Type | Value |
+   |------------|------|--------|
+   | `*.<byoc-region>.cubecloudapp.dev` | A | Alias to HTTP VPC endpoint |
+   | `*.sql.<byoc-region>.cubecloudapp.dev` | A | Alias to SQL VPC endpoint |
+   | `sql.<byoc-region>.cubecloudapp.dev` | A | Alias to SQL VPC endpoint |
+
+### Step 4: Verify connectivity
+
+To test the connection from within your VPC, obtain the test connection commands from the Cube Cloud UI:
+1. Navigate to your deployment in Cube Cloud
+2. Access the connection details section
+3. Use the provided commands to verify HTTP API and SQL connectivity
+
+## Enabling Cube Cloud UI access
+
+The Cube Cloud web interface requires access to live Cube APIs to function properly. In a private setup, these APIs aren't accessible from user browsers by default, which would limit Cube Cloud functionality.
+
+### Solution: Corporate network integration
+
+To enable full Cube Cloud UI functionality, you need to establish PrivateLink endpoints within your corporate network:
+
+1. **Create PrivateLink endpoints in your corporate VPC**: Follow the same process as above, but create the endpoints in a VPC that's accessible from your corporate network
+2. **Configure DNS resolution**: Choose one of these approaches:
+   - **Cube-hosted DNS**: We can host the PrivateLink endpoint IPs in our public DNS records (contact Cube support)
+   - **Corporate DNS override**: If you control DNS resolution within your corporate network, create private DNS overrides similar to the Route 53 configuration
+
+<Screenshot src="https://ucarecdn.com/186b888f-ca1a-487b-aa41-968714ebce2f/" />
+
+## Limitations
+
+### No custom ___domain support
+
+Cube Cloud's [custom domains feature][custom-domains] is not compatible with PrivateLink connectivity. This limitation exists because:
+
+- Custom domains require automatic SSL certificate provisioning via Let's Encrypt
+- Let's Encrypt uses HTTP-01 challenges that require public internet accessibility
+- PrivateLink endpoints are not accessible from the public internet
+
+If you require custom domains, consider using Cube Cloud's standard public endpoints with appropriate security controls.
+
+## Troubleshooting
+
+### Common issues
+
+**DNS resolution failures**
+- Verify Route 53 hosted zone is associated with the correct VPC
+- Check that DNS records point to the correct VPC endpoints
+- Test resolution using `nslookup` or `dig` from within the VPC
+
+**Connection timeouts**
+- Verify security groups allow traffic on required ports (443 for HTTP, 5432 for SQL)
+- Check that VPC endpoints are in "Available" state
+- Ensure network ACLs aren't blocking traffic
+
+**Certificate errors**
+- Cube Cloud uses valid SSL certificates for `*.cubecloudapp.dev` domains
+- Ensure your client trusts standard certificate authorities
+- For SQL connections, configure your client to use SSL/TLS
+
+### Getting help
+
+For assistance with PrivateLink setup:
+1. Gather the following information:
+   - VPC endpoint IDs
+   - Security group configurations
+   - DNS test results (`nslookup` output)
+   - Any error messages from connection attempts
+2. Contact Cube Cloud support with your deployment ID and collected information
+
+[custom-domains]: /product/deployment/cloud/custom-domains

docs/redirects.json

@@ -1,4 +1,9 @@
 [
+  {
+    "source": "/product/deployment/cloud/byoc/aws",
+    "destination": "/product/deployment/cloud/byoc/aws/deployment",
+    "permanent": true
+  },
   {
     "source": "/product/apis-integrations/rest-api/real-time-data-fetch",
     "destination": "/product/apis-integrations/recipes/real-time-data-fetch",

lerna.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.3.37",
+  "version": "1.3.38",
   "npmClient": "yarn",
   "command": {
     "bootstrap": {

packages/cubejs-api-gateway/CHANGELOG.md

@@ -3,6 +3,16 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.3.38](https://github.com/cube-js/cube/compare/v1.3.37...v1.3.38) (2025-07-16)
+
+### Bug Fixes
+
+- **cubesql:** Propagate errors from SqlAuthService to the user ([#9665](https://github.com/cube-js/cube/issues/9665)) ([3037ada](https://github.com/cube-js/cube/commit/3037adaa55dcb20ac6a3b3064de4292fc454fdc2))
+
+### Features
+
+- **schema-compiler,api-gateway:** Nested folders support ([#9659](https://github.com/cube-js/cube/issues/9659)) ([720f048](https://github.com/cube-js/cube/commit/720f0485c8b11f16eb99490259a881c21b845c73))
+
 ## [1.3.37](https://github.com/cube-js/cube/compare/v1.3.36...v1.3.37) (2025-07-14)
 
 **Note:** Version bump only for package @cubejs-backend/api-gateway

packages/cubejs-api-gateway/package.json

@@ -2,7 +2,7 @@
   "name": "@cubejs-backend/api-gateway",
   "description": "Cube.js API Gateway",
   "author": "Cube Dev, Inc.",
-  "version": "1.3.37",
+  "version": "1.3.38",
   "repository": {
     "type": "git",
     "url": "https://github.com/cube-js/cube.git",
@@ -27,8 +27,8 @@
     "dist/src/*"
   ],
   "dependencies": {
-    "@cubejs-backend/native": "1.3.37",
-    "@cubejs-backend/shared": "1.3.37",
+    "@cubejs-backend/native": "1.3.38",
+    "@cubejs-backend/shared": "1.3.38",
     "@ungap/structured-clone": "^0.3.4",
     "assert-never": "^1.4.0",
     "body-parser": "^1.19.0",
@@ -51,7 +51,7 @@
     "uuid": "^8.3.2"
   },
   "devDependencies": {
-    "@cubejs-backend/linter": "1.3.37",
+    "@cubejs-backend/linter": "1.3.38",
     "@types/express": "^4.17.21",
     "@types/jest": "^29",
     "@types/jsonwebtoken": "^9.0.2",

packages/cubejs-api-gateway/src/sql-server.ts

@@ -128,14 +128,25 @@ export class SQLServer {
         };
       },
       checkSqlAuth: async ({ request, user, password }) => {
-        const { password: returnedPassword, superuser, securityContext, skipPasswordCheck } = await checkSqlAuth(request, user, password);
-
-        return {
-          password: returnedPassword,
-          superuser: superuser || false,
-          securityContext,
-          skipPasswordCheck,
-        };
+        try {
+          const { password: returnedPassword, superuser, securityContext, skipPasswordCheck } = await checkSqlAuth(request, user, password);
+
+          return {
+            password: returnedPassword,
+            superuser: superuser || false,
+            securityContext,
+            skipPasswordCheck,
+          };
+        } catch (e) {
+          this.apiGateway.log({
+            type: 'Auth Error',
+            protocol: (request as any).protocol,
+            method: (request as any).method,
+            apiType: 'sql',
+            error: (e as Error).stack || (e as Error).toString(),
+          });
+          throw e;
+        }
       },
       meta: async ({ request, session, onlyCompilerId }) => {
         const context = await this.apiGateway.contextByReq(<any> request, session.securityContext, request.id);

packages/cubejs-athena-driver/CHANGELOG.md

@@ -3,6 +3,10 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.3.38](https://github.com/cube-js/cube/compare/v1.3.37...v1.3.38) (2025-07-16)
+
+**Note:** Version bump only for package @cubejs-backend/athena-driver
+
 ## [1.3.37](https://github.com/cube-js/cube/compare/v1.3.36...v1.3.37) (2025-07-14)
 
 **Note:** Version bump only for package @cubejs-backend/athena-driver

packages/cubejs-athena-driver/package.json

@@ -2,7 +2,7 @@
   "name": "@cubejs-backend/athena-driver",
   "description": "Cube.js Athena database driver",
   "author": "Cube Dev, Inc.",
-  "version": "1.3.37",
+  "version": "1.3.38",
   "repository": {
     "type": "git",
     "url": "https://github.com/cube-js/cube.git",
@@ -29,13 +29,13 @@
   "types": "dist/src/index.d.ts",
   "dependencies": {
     "@aws-sdk/client-athena": "^3.22.0",
-    "@cubejs-backend/base-driver": "1.3.37",
-    "@cubejs-backend/shared": "1.3.37",
+    "@cubejs-backend/base-driver": "1.3.38",
+    "@cubejs-backend/shared": "1.3.38",
     "sqlstring": "^2.3.1"
   },
   "devDependencies": {
-    "@cubejs-backend/linter": "1.3.37",
-    "@cubejs-backend/testing-shared": "1.3.37",
+    "@cubejs-backend/linter": "1.3.38",
+    "@cubejs-backend/testing-shared": "1.3.38",
     "@types/ramda": "^0.27.40",
     "typescript": "~5.2.2"
   },

packages/cubejs-backend-cloud/CHANGELOG.md

@@ -3,6 +3,10 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.3.38](https://github.com/cube-js/cube/compare/v1.3.37...v1.3.38) (2025-07-16)
+
+**Note:** Version bump only for package @cubejs-backend/cloud
+
 ## [1.3.37](https://github.com/cube-js/cube/compare/v1.3.36...v1.3.37) (2025-07-14)
 
 **Note:** Version bump only for package @cubejs-backend/cloud

packages/cubejs-backend-cloud/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cubejs-backend/cloud",
-  "version": "1.3.37",
+  "version": "1.3.38",
   "description": "Cube Cloud package",
   "main": "dist/src/index.js",
   "typings": "dist/src/index.d.ts",
@@ -25,15 +25,15 @@
   "devDependencies": {
     "@babel/core": "^7.24.5",
     "@babel/preset-env": "^7.24.5",
-    "@cubejs-backend/linter": "1.3.37",
+    "@cubejs-backend/linter": "1.3.38",
     "@types/fs-extra": "^9.0.8",
     "@types/jest": "^29",
     "jest": "^29",
     "typescript": "~5.2.2"
   },
   "dependencies": {
     "@cubejs-backend/dotenv": "^9.0.2",
-    "@cubejs-backend/shared": "1.3.37",
+    "@cubejs-backend/shared": "1.3.38",
     "chokidar": "^3.5.1",
     "env-var": "^6.3.0",
     "form-data": "^4.0.0",

packages/cubejs-backend-maven/CHANGELOG.md

@@ -3,6 +3,10 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.3.38](https://github.com/cube-js/cube/compare/v1.3.37...v1.3.38) (2025-07-16)
+
+**Note:** Version bump only for package @cubejs-backend/maven
+
 ## [1.3.37](https://github.com/cube-js/cube/compare/v1.3.36...v1.3.37) (2025-07-14)
 
 **Note:** Version bump only for package @cubejs-backend/maven

packages/cubejs-backend-maven/package.json

@@ -2,7 +2,7 @@
   "name": "@cubejs-backend/maven",
   "description": "Cube.js Maven Wrapper for java dependencies downloading",
   "author": "Cube Dev, Inc.",
-  "version": "1.3.37",
+  "version": "1.3.38",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -31,12 +31,12 @@
     "dist/src/*"
   ],
   "dependencies": {
-    "@cubejs-backend/shared": "1.3.37",
+    "@cubejs-backend/shared": "1.3.38",
     "source-map-support": "^0.5.19",
     "xmlbuilder2": "^2.4.0"
   },
   "devDependencies": {
-    "@cubejs-backend/linter": "1.3.37",
+    "@cubejs-backend/linter": "1.3.38",
     "@types/jest": "^29",
     "@types/node": "^20",
     "jest": "^29",

packages/cubejs-backend-native/CHANGELOG.md

@@ -3,6 +3,10 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.3.38](https://github.com/cube-js/cube/compare/v1.3.37...v1.3.38) (2025-07-16)
+
+**Note:** Version bump only for package @cubejs-backend/native
+
 ## [1.3.37](https://github.com/cube-js/cube/compare/v1.3.36...v1.3.37) (2025-07-14)
 
 **Note:** Version bump only for package @cubejs-backend/native