Unexpected/not documented constraint operator used in case of LIMIT

Unexpected/not documented constraint operator used in case of LIMIT

What operating system and version are you using?

Windows 11, 10.0.22623.1095 - probably not relevant

What version of osquery are you using?

5.5.1

What steps did you take to reproduce the issue?

• Create an extension, exporting some custom table
• In the exported table serialize the ConstraintList with the given method:

 /**
   * @brief Serialize a ConstraintList into a property tree.
   *
   * The property tree will use the format:
   * {
   *   "affinity": affinity,
   *   "list": [
   *     {"op": op, "expr": expr}, ...
   *   ]
   * }
   */
 void serialize(JSON& doc, rapidjson::Value& obj) const;`

• Execute a query with LIMIT 10 on the table: SELECT * FROM myTable LIMIT 10;
  The LIMIT 10 constraint was serialized as: [{"op":73,"expr":"10"}]

What did you expect to see?

To find a list (maybe in a header file or documentation) with all possible (valid) op codes used.
The list of fully documented op codes could help to improve performance of implementations for (external) tables - in this case for using the LIMIT.

What did you see instead?

Found only in tables.h:

enum ConstraintOperator : unsigned char {
  EQUALS = 2,
  GREATER_THAN = 4,
  LESS_THAN_OR_EQUALS = 8,
  LESS_THAN = 16,
  GREATER_THAN_OR_EQUALS = 32,
  MATCH = 64,
  LIKE = 65,
  GLOB = 66,
  REGEXP = 67,
  UNIQUE = 1,
};

Start with the ConstraintOperator enum in tables.h and the ConstraintList serialization method described in the issue. Document the valid operator codes, including the LIMIT case that serializes as 73, and explain how external-table implementations can use this information. Confirm the documented list matches the behavior shown by the reproduction query.