server: fix OK session-track suffix and validate SetCapability

[nzin-alayacare]

Summary

• P1 — OK packet session track: When CLIENT_SESSION_TRACK is negotiated but SERVER_SESSION_STATE_CHANGED is not set, writeOK no longer appends a zero-length session-state block after the info string. The packet now ends after the length-encoded info string, matching the MySQL OK-packet format expected by strict clients (auth OK, normal OK).
• P2 — SetCapability safety: Server.SetCapability / UnsetCapability now return an error unless the flag is one of CLIENT_LOCAL_FILES, CLIENT_MULTI_RESULTS, or CLIENT_PS_MULTI_RESULTS. Flags such as CLIENT_SSL remain tied to server construction (tlsConfig) and cannot be enabled independently.

Motivation

Follow-up to #1163: the new capability setter API and session-track OK encoding had two correctness issues reported in review.

Changes

• mysql/result.go — AppendOKSessionTrackSuffix only appends the session-state block when SERVER_SESSION_STATE_CHANGED is set in r.Status.
• server/resp.go — simplified writeOK to delegate to AppendOKSessionTrackSuffix.
• server/server_conf.go — whitelist validation for SetCapability / UnsetCapability; methods now return error.

Test plan

• TestAppendOKSessionTrackSuffixWithoutStateChange — info string only, no session block
• TestConnWriteOKStatusMessageWithoutStateChange — updated expected packet (no trailing 0x00 session block)
• TestConnWriteOKSessionTrackWithoutStateChangeOrInfo — auth-style OK with empty info
• TestSetCapabilityRejectsUnsafeFlags — CLIENT_SSL and CLIENT_PROTOCOL_41 rejected; whitelisted flags work

Made with Cursor

[gemini-code-assist]

Code Review

This pull request refactors OK-packet session tracking by conditionally appending the session track block based on the SERVER_SESSION_STATE_CHANGED status flag. It also restricts SetCapability and UnsetCapability to only allow toggling of user-configurable capabilities (CLIENT_LOCAL_FILES, CLIENT_MULTI_RESULTS, and CLIENT_PS_MULTI_RESULTS), returning an error for unsafe flags. The feedback suggests improving the capability validation error message to isolate and report the specific invalid flags when a bitmask with multiple flags is provided.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[nzin-alayacare]

Hi @lance6716 ,

I dont have other channel to interact with you, but thanks for your responsiveness, and your follow ups.
When this one will be resolved, do you have an ETA for a new release of go-mysql? ;-)

[lance6716]

You can contact me through email. But GitHub activities also notify me by email, so a manual email won't change much :P
I'm a Chinese developer, so I guess we don't have common daily IM apps.

Releases are mostly done by @dveeden. If he's busy these days, I can do the release as well. There's no fixed schedule. We just release new versions according to requests.

For this PR I will take a look later.

[dveeden]

I'll try to prepare a new release by early next week