Tencent/WeKnora · error

opensearch: feature not enabled in this build

Error message

opensearch: feature not enabled in this build

What it means

When checkSchemaAccess is enabled, function calls qualified with more than one name part (schema.function) are only allowed from pg_catalog. A call like `myschema.my_func(...)` or `admin.exec(...)` is rejected to prevent invoking attacker-controlled or extension functions installed in non-catalog schemas.

Source

Thrown at internal/application/repository/retriever/opensearch/errors.go:43

	// ErrTransport — network / 5xx / opaque cluster error. Classified as
	// transient: ensureReady does NOT persist this in initErr, so the next
	// caller will retry.
	ErrTransport = errors.New("opensearch: transport error")

	// ErrVersionUnsupported — cluster is not OpenSearch, is OS 1.x, or is
	// OS 2.0~2.3 (pre-Lucene-HNSW-GA). probeVersion enforces.
	ErrVersionUnsupported = errors.New("opensearch: cluster version unsupported")

	// ErrConfigInvalid — IndexConfig / storeID / sanitizeIndexName guard
	// failed, or the k-NN plugin is missing on one or more cluster nodes.
	ErrConfigInvalid = errors.New("opensearch: invalid index config")

	// ErrFeatureNotEnabled — stubs.go returns this from methods whose real
	// implementation has not landed yet (CopyIndices / BatchUpdateChunk* /
	// swapToVersion, plus the read/write methods that a follow-up commit
	// will replace with production code).
	ErrFeatureNotEnabled = errors.New("opensearch: feature not enabled in this build")

	// ErrBatchTooLarge — Save / Delete batch exceeded the driver's sync
	// cap. Distinct from ErrFeatureNotEnabled so the service layer can
	// chunk + retry rather than treat the failure as "waiting on a future
	// implementation."
	ErrBatchTooLarge = errors.New("opensearch: batch size exceeds driver cap")

	// ErrCircuitBreaker — OpenSearch k-NN circuit breaker returned 429
	// (knn_circuit_breaker_exception). Classified as transient so the
	// caller can retry after the operator scales the cluster.
	ErrCircuitBreaker = errors.New("opensearch: knn circuit breaker open")
)

// isTransientErr classifies sentinel errors. Transient errors do not get
// persisted in ensureReady's initErr cache — they can be retried by the
// next caller after the underlying cause clears.
func isTransientErr(err error) bool {
	return errors.Is(err, ErrTransport) || errors.Is(err, ErrCircuitBreaker)

View on GitHub (pinned to 988cbb0330)

Solutions

  1. Call unqualified function names (rely on search_path) or move/alias the function into pg_catalog if it must remain qualified.
  2. Rewrite the logic as an in-query expression or compute it in application code instead of calling a custom-schema function.
  3. If the schema's functions are trusted, relax the check by allowing the specific schema in the validator's schema-access logic or disabling checkSchemaAccess (trusted input only).

Example fix

// before
SELECT myschema.my_func(user_id) FROM users;

// after
SELECT my_func(user_id) FROM users; -- search_path resolves to allowed schema
Defensive patterns

Strategy: validation

Validate before calling

var qualFunc = regexp.MustCompile(`(?i)\b([a-z_][a-z0-9_]*)\.[a-z_][a-z0-9_]*\s*\(`)
func usesNonCatalogQualifiedFunc(sql string) bool {
	for _, m := range qualFunc.FindAllStringSubmatch(sql, -1) {
		s := strings.ToLower(m[1])
		if s != "pg_catalog" && s != "public" {
			return true
		}
	}
	return false
}

Try / catch

if err := validator.ValidateQuery(sql); err != nil {
	if strings.Contains(err.Error(), "schema-qualified function calls") {
		return fmt.Errorf("call functions unqualified or install them in pg_catalog: %w", err)
	}
}

Prevention

When it happens

Trigger: Validating `SELECT myschema.my_func(1)`, `SELECT public.my_helper(x)`, or `SELECT dblink_exec('...')` qualified by its extension schema, while schema access checking is on.

Common situations: Applications calling their own stored functions installed in an app-specific schema; extension functions that live in non-pg_catalog schemas (dblink, pgcrypto in some installs); generated code that fully qualifies every function name.

Related errors

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/fc4f8a3acd20b0a7. Report an issue: GitHub.