Back built-in iceberg catalogs with foreign server objects

The three reserved short catalog names ('postgres', 'object_store',
'rest') previously had no backing pg_foreign_server row, which split
the resolution path in two (BuildRestCatalogOptionsFromGUCs for the
built-in REST, BuildRestCatalogOptionsFromServer for user-created
ones) and prevented us from recording pg_depend edges for tables that
use the short names.

Pre-create three iceberg_catalog servers at extension upgrade time:
pg_lake_postgres_catalog, pg_lake_object_store_catalog, and
pg_lake_rest_catalog.  The prefixed long names cannot collide with
names users may already have, notably the very common
'CREATE SERVER postgres FOREIGN DATA WRAPPER postgres_fdw'.

User-facing DDL stays identical: users keep writing
WITH (catalog='rest' / 'postgres' / 'object_store').  A new
ResolveCatalogServerName helper maps short -> long at server lookup
time, and opts->catalog continues to carry the short user-facing name
so error messages, the cross-catalog DML guard, and the token cache
key never expose the long names.

The built-in servers are pure structural anchors: ALTER OPTIONS,
ALTER OWNER, RENAME, and DROP are all blocked.  Configuration for
the built-in REST catalog continues to live in GUCs.  The resolution
path collapses to a single BuildRestCatalogOptionsFromServer that
applies GUC defaults first and then any server options (always empty
for the built-ins), so the built-in REST and user-created REST go
through one code path.

The long names are rejected as user-facing catalog= values by
IsRestCatalog, the default_catalog GUC check hook, and create_table.c
with a clear hint pointing to the short form.

Tables created with the short reserved names now record a pg_depend
edge against the corresponding built-in server, so DROP EXTENSION
CASCADE cleans them up via the standard dependency walker.

ValidateIcebergCatalogServerDDL now also rejects:
  - CREATE SERVER with one of the internal long names
  - ALTER SERVER ... RENAME TO one of the internal long names
  - ALTER SERVER OPTIONS on any built-in server (immutable anchors)
  - ALTER SERVER ... OWNER TO on any built-in server

Two small static helpers (RejectIfBuiltinCatalogServerName and
RejectIfModifyingBuiltinCatalogServer) collapse the repeating
"is built-in" + ereport patterns into single calls.

Upgrade safety: the --3.3--3.4 script does a pre-flight check that
errors with a clear hint if any of the three long names already
exists in the target database, so ALTER EXTENSION UPDATE fails
loudly rather than partway through.

Tests: 23 new cases in test_iceberg_catalog_server.py covering the
three servers exist and are extension-owned, CREATE / RENAME-TO /
ALTER OPTIONS / ALTER OWNER / DROP on the long names all blocked,
catalog= with a long name rejected at CREATE TABLE, the pg_depend
edge for the built-in postgres catalog, and -- the original collision
concern -- a pre-existing postgres_fdw server literally named
'postgres' coexists with pg_lake_postgres_catalog.

Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: sfc-gh-npuka <naisila.puka@snowflake.com>

Author: sfc-gh-npuka

pg_lake_engine/include/pg_lake/util/catalog_type.h

@@ -22,11 +22,29 @@
 
 /*
 * The allowed values for IcebergDefaultCatalog, case insensitive.
+*
+* These are the user-facing short names used as the catalog= option value
+* on CREATE TABLE ... USING iceberg.  Internally they map to the
+* prefixed built-in server names below; users never type the prefixed
+* names directly.
 */
 #define POSTGRES_CATALOG_NAME "postgres"
 #define OBJECT_STORE_CATALOG_NAME "object_store"
 #define REST_CATALOG_NAME "rest"
 
+/*
+ * Built-in iceberg_catalog server names.  Pre-created by the extension
+ * upgrade script and exist purely as anchors for pg_depend edges and the
+ * uniform server-lookup path.  All ALTER/DROP/RENAME on these names is
+ * blocked (configuration for the built-in catalogs lives in GUCs).
+ *
+ * The prefix keeps them clear of names users are likely to have already
+ * used (notably the very common "CREATE SERVER postgres FDW postgres_fdw").
+ */
+#define PG_LAKE_POSTGRES_CATALOG_SERVER_NAME     "pg_lake_postgres_catalog"
+#define PG_LAKE_OBJECT_STORE_CATALOG_SERVER_NAME "pg_lake_object_store_catalog"
+#define PG_LAKE_REST_CATALOG_SERVER_NAME         "pg_lake_rest_catalog"
+
 typedef enum IcebergCatalogType
 {
 	NONE_CATALOG = 0,
@@ -66,3 +84,5 @@ extern PGDLLEXPORT bool HasObjectStoreCatalogTableOption(List *options);
 extern PGDLLEXPORT bool HasReadOnlyOption(List *options);
 extern PGDLLEXPORT bool IsCatalogOwnedByExtension(const char *catalog);
 extern PGDLLEXPORT bool IsRestCatalog(const char *catalog);
+extern PGDLLEXPORT const char *ResolveCatalogServerName(const char *catalog);
+extern PGDLLEXPORT bool IsBuiltinCatalogServerName(const char *serverName);

pg_lake_engine/src/utils/catalog_type.c

@@ -125,6 +125,12 @@ IsCatalogOwnedByExtension(const char *catalog)
  * IsRestCatalog returns true if the catalog name identifies a REST catalog.
  * This includes the built-in 'rest' literal and any user-created
  * iceberg_catalog server whose TYPE is 'rest'.
+ *
+ * The internal built-in server names (e.g. "pg_lake_rest_catalog") are
+ * deliberately rejected: they are implementation details and must not be
+ * usable as catalog= option values on CREATE TABLE.  Users always type
+ * the short name "rest", which is mapped to the long server name only
+ * inside the resolution layer.
  */
 bool
 IsRestCatalog(const char *catalog)
@@ -135,6 +141,9 @@ IsRestCatalog(const char *catalog)
 	if (pg_strcasecmp(catalog, REST_CATALOG_NAME) == 0)
 		return true;
 
+	if (IsBuiltinCatalogServerName(catalog))
+		return false;
+
 	/* Try to look up a server with this name */
 	bool		missingOK = true;
 	ForeignServer *server = GetForeignServerByName(catalog, missingOK);
@@ -147,6 +156,68 @@ IsRestCatalog(const char *catalog)
 	if (strcmp(fdw->fdwname, ICEBERG_CATALOG_FDW_NAME) != 0)
 		return false;
 
+	/*
+	 * Any iceberg_catalog server reaching this point is user-created, and
+	 * ValidateIcebergCatalogServerDDL forces all user-created iceberg_catalog
+	 * servers to TYPE 'rest'.
+	 */
 	Assert(pg_strcasecmp(server->servertype, REST_CATALOG_NAME) == 0);
 	return true;
 }
+
+
+/*
+ * ResolveCatalogServerName maps a user-facing catalog identifier to the
+ * actual pg_foreign_server.srvname.
+ *
+ * For the three reserved short names ('postgres', 'object_store', 'rest')
+ * the result is the corresponding pre-created built-in server name.
+ * Any other input is returned unchanged (user-created server names match
+ * their catalog= option value verbatim).
+ *
+ * The returned pointer is either a string literal or the input pointer;
+ * callers must not free it.
+ */
+const char *
+ResolveCatalogServerName(const char *catalog)
+{
+	if (catalog == NULL)
+		return NULL;
+
+	if (pg_strcasecmp(catalog, REST_CATALOG_NAME) == 0)
+		return PG_LAKE_REST_CATALOG_SERVER_NAME;
+	if (pg_strcasecmp(catalog, POSTGRES_CATALOG_NAME) == 0)
+		return PG_LAKE_POSTGRES_CATALOG_SERVER_NAME;
+	if (pg_strcasecmp(catalog, OBJECT_STORE_CATALOG_NAME) == 0)
+		return PG_LAKE_OBJECT_STORE_CATALOG_SERVER_NAME;
+
+	return catalog;
+}
+
+
+/*
+ * IsBuiltinCatalogServerName returns true if the given name matches one
+ * of the three pre-created built-in iceberg_catalog servers.
+ *
+ * Comparison is case-insensitive: both PostgreSQL-parsed identifiers
+ * (already downcased by the parser unless quoted) and free-form string
+ * literals supplied as catalog= option values flow through this helper,
+ * and we want to reject typos like 'PG_LAKE_REST_CATALOG' just as
+ * firmly as the canonical form.
+ *
+ * This is the long-name counterpart to IsCatalogOwnedByExtension, which
+ * operates on the user-facing short names.  Used by the DDL protection
+ * hook to lock down ALTER/RENAME/OWNER on the extension's structural
+ * anchors and by create_table.c to reject the long names as catalog=
+ * option values.
+ */
+bool
+IsBuiltinCatalogServerName(const char *serverName)
+{
+	if (serverName == NULL)
+		return false;
+
+	return pg_strcasecmp(serverName, PG_LAKE_REST_CATALOG_SERVER_NAME) == 0 ||
+		pg_strcasecmp(serverName, PG_LAKE_POSTGRES_CATALOG_SERVER_NAME) == 0 ||
+		pg_strcasecmp(serverName, PG_LAKE_OBJECT_STORE_CATALOG_SERVER_NAME) == 0;
+}

pg_lake_iceberg/pg_lake_iceberg--3.3--3.4.sql

@@ -25,3 +25,58 @@ CREATE FOREIGN DATA WRAPPER iceberg_catalog
   VALIDATOR lake_iceberg.iceberg_catalog_validator;
 
 GRANT USAGE ON FOREIGN DATA WRAPPER iceberg_catalog TO lake_write;
+
+/*
+ * Built-in catalog servers.
+ *
+ * These three servers are pre-created as structural anchors for the
+ * pg_depend dependency edges that iceberg tables record against their
+ * catalog server.  They are extension-owned and immutable: ALTER, DROP,
+ * RENAME, and OWNER changes on them are all blocked.  Configuration
+ * for the built-in catalogs lives in GUCs, not in server options.
+ *
+ * Users keep typing the short names ('postgres', 'object_store', 'rest')
+ * as the catalog= option value on CREATE TABLE; ResolveCatalogServerName
+ * maps short -> long at server lookup time.  The long names are prefixed
+ * so they cannot collide with names users may already have in their
+ * databases (e.g. a postgres_fdw server literally named 'postgres').
+ *
+ * Pre-flight: error early with a clear hint if any of the long names is
+ * already in use.  This prevents a confusing "server already exists"
+ * mid-upgrade.
+ */
+DO $do$
+DECLARE
+  conflicting text;
+BEGIN
+  SELECT srvname INTO conflicting
+  FROM pg_foreign_server
+  WHERE srvname IN ('pg_lake_postgres_catalog',
+                    'pg_lake_object_store_catalog',
+                    'pg_lake_rest_catalog')
+  LIMIT 1;
+
+  IF conflicting IS NOT NULL THEN
+    RAISE EXCEPTION
+      'pg_lake_iceberg upgrade conflicts with existing foreign server %', conflicting
+      USING HINT = 'Drop or rename the server and re-run ALTER EXTENSION pg_lake_iceberg UPDATE. '
+                   'pg_lake_iceberg reserves the names pg_lake_postgres_catalog, '
+                   'pg_lake_object_store_catalog, and pg_lake_rest_catalog for internal use.';
+  END IF;
+END $do$;
+
+CREATE SERVER pg_lake_postgres_catalog
+  TYPE 'postgres'
+  FOREIGN DATA WRAPPER iceberg_catalog;
+
+CREATE SERVER pg_lake_object_store_catalog
+  TYPE 'object_store'
+  FOREIGN DATA WRAPPER iceberg_catalog;
+
+CREATE SERVER pg_lake_rest_catalog
+  TYPE 'rest'
+  FOREIGN DATA WRAPPER iceberg_catalog;
+
+GRANT USAGE ON FOREIGN SERVER pg_lake_postgres_catalog TO lake_write;
+GRANT USAGE ON FOREIGN SERVER pg_lake_object_store_catalog TO lake_write;
+GRANT USAGE ON FOREIGN SERVER pg_lake_rest_catalog TO lake_write;