pg_reports 0.5.1 → 0.5.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 05027e6e3278a707d98301a3d4a44dbce9930d26e963359d1afb01b57626df0c
-  data.tar.gz: 0c03b76ef459a04fa4ea732e062fd73020d814c5f11bcc6e3f0a771d17e66976
+  metadata.gz: bbebda26a25f873ffa2bcaf1ec12864c8c191c23fa9b40bf926080638e3de262
+  data.tar.gz: 0431116a344855d38207e8b99a85f0d0bb1227fa15590259cbe8faace66befb3
 SHA512:
-  metadata.gz: a5e8a8eae451b10265dcbd3a9839f21d7c647d0876e7a41b7ac8e2a2219b87bbfbd45ec621f6ac552aba1c1cb8284005a114ca8758c3bd61e9cf3440ca6838d6
-  data.tar.gz: cf37e2c3458b8f24ca6bc548f7d58dea29af6547c14bf1c6db1468962fa1ec6e2095a9df8923045e5b8e86c6cf8c00e054e90e21cd803c7137d10db96e3f12de
+  metadata.gz: e8da95a415b18d646a5fa10a798c3a7291ff79ec03b62b6c491892359ca6bf5fbf45fd055b7537a81d9bb0453a2df1af33881f7fb246e52c1089ab9390604a1f
+  data.tar.gz: 8d92af6481357ccae7f01a7c4ea13ace7c827d5bdc1c745d69af8ef45365c343fd7146cafade39f3edcaf83c5976947cd079b3398924ce06b9db2b6047b6b62a

data/CHANGELOG.md

@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.2] - 2026-02-09
+
+### Fixed
+
+- **pg_stat_statements detection no longer requires `pg_read_all_settings` role**:
+  - Changed `pg_stat_statements_preloaded?` to query pg_stat_statements directly instead of checking `shared_preload_libraries`
+  - Fixes permission denied errors in environments like CloudnativePG where regular users lack access to `shared_preload_libraries` setting
+  - Works seamlessly with Kubernetes PostgreSQL operators and managed databases with restricted permissions
+  - Improved error messages in `enable_pg_stat_statements!` method
+
 ## [0.5.1] - 2026-02-09
 
 ### Added
@@ -15,23 +25,46 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - New config option `allow_raw_query_execution` (default: `false`)
   - Environment variable support: `PG_REPORTS_ALLOW_RAW_QUERY_EXECUTION`
   - Security documentation in README with examples and best practices
-  - Frontend UI: disabled buttons with tooltips when feature is off
-  - JavaScript validation in `executeQuery()` and `executeExplainAnalyze()` functions
   - Configuration tests for new security setting
+- **Hash-based Query Execution System** - prevents SQL injection and query tampering:
+  - Backend generates SHA256 hash for each query and stores in Rails.cache (1-hour TTL)
+  - Frontend sends only hash (not query text) to execution endpoints
+  - Backend retrieves and validates original query by hash
+  - Strict validation: only SELECT queries, no dangerous keywords, no multiple statements
+  - Cache failure handling with clear error messages
+  - Protection against nested SQL injection attempts
+- **Enhanced Error Handling** - improved user feedback:
+  - Active warning messages instead of disabled buttons when feature is off
+  - Toast notifications with configuration instructions
+  - Detailed error messages in modal with code examples
+  - Clear messaging when Redis/cache backend is unavailable
 
 ### Changed
 
 - **BREAKING CHANGE**: `execute_query` and `explain_analyze` endpoints now require explicit opt-in
   - Both endpoints return 403 Forbidden when `allow_raw_query_execution` is `false` (default)
-  - Dashboard "Execute Query" and "EXPLAIN ANALYZE" buttons disabled by default
   - To restore previous behavior, add to initializer: `config.allow_raw_query_execution = true`
   - **Migration path**: Users must explicitly enable this feature if they were using Query Analyzer
+- **UI/UX Improvements**:
+  - Query Analyzer modal size increased: width 600px→900px, height 80vh→90vh for better query visibility
+  - "EXPLAIN ANALYZE", "Execute Query", and "Create Migration" buttons now show active warnings when clicked (instead of being disabled)
+  - Warning messages include configuration instructions with code examples
+  - Better visual feedback for disabled features
+- **Query Execution Flow**:
+  - `execute_query` and `explain_analyze` endpoints now accept `query_hash` parameter (instead of `query`)
+  - New helper methods: `store_query_with_hash()` and `retrieve_query_by_hash()`
+  - Frontend stores `data-query-hash` attribute on EXPLAIN ANALYZE buttons
+  - JavaScript validation happens client-side before API calls
 
 ### Security
 
-- Raw SQL execution from dashboard is now **disabled by default** to prevent unauthorized data access
+- **Critical Security Enhancement**: Raw SQL execution from dashboard is now **disabled by default** to prevent unauthorized data access
+- **Query Tampering Prevention**: Frontend cannot modify queries - hash-based verification ensures query integrity
+- **SQL Injection Protection**: Strict validation on backend prevents any non-SELECT queries or dangerous keywords
+- **Multiple Statement Prevention**: Semicolon detection blocks SQL injection attempts with multiple statements
+- **Cache Dependency**: Query execution temporarily disabled if Redis/cache backend is unavailable (fail-secure)
 - Recommended setup: only enable in development/staging environments
-- Existing safety measures (SELECT/SHOW only, automatic LIMIT) still apply when enabled
+- Existing safety measures (automatic LIMIT) still apply when enabled
 
 ## [0.5.0] - 2026-02-07
 

data/README.md

@@ -277,6 +277,8 @@ For query analysis, you need to enable `pg_stat_statements`:
    PgReports.enable_pg_stat_statements!
    ```
 
+> **Note**: PgReports does **not** require the `pg_read_all_settings` role. It detects `pg_stat_statements` availability by directly querying the extension, making it compatible with CloudnativePG, managed databases, and other environments with restricted permissions.
+
 ## Report Object
 
 Every method returns a `PgReports::Report` object:

data/lib/pg_reports/modules/system.rb

@@ -25,14 +25,19 @@ module PgReports
         result.first&.fetch("available", false) || false
       end
 
-      # Check if pg_stat_statements is in shared_preload_libraries
+      # Check if pg_stat_statements is preloaded and functional
       # @return [Boolean] Whether pg_stat_statements is preloaded
+      # @note This method tries to query pg_stat_statements directly instead of
+      #       checking shared_preload_libraries, which requires pg_read_all_settings role
       def pg_stat_statements_preloaded?
-        result = executor.execute(<<~SQL)
-          SELECT setting FROM pg_settings WHERE name = 'shared_preload_libraries'
-        SQL
-        setting = result.first&.fetch("setting", "") || ""
-        setting.include?("pg_stat_statements")
+        # If extension is not installed, it can't be preloaded
+        return false unless pg_stat_statements_available?
+
+        # Try to query pg_stat_statements - if it works, it's properly preloaded
+        executor.execute("SELECT 1 FROM pg_stat_statements LIMIT 1")
+        true
+      rescue
+        false
       end
 
       # Get pg_stat_statements status details
@@ -94,14 +99,20 @@ module PgReports
           executor.execute("CREATE EXTENSION IF NOT EXISTS pg_stat_statements")
 
           # Verify it worked
-          if pg_stat_statements_available?
+          if pg_stat_statements_available? && pg_stat_statements_preloaded?
             {success: true, message: "pg_stat_statements extension created successfully"}
-          else
+          elsif pg_stat_statements_available?
             {
               success: false,
-              message: "Extension created but not working. Check shared_preload_libraries in postgresql.conf",
+              message: "Extension created but not preloaded. Add 'pg_stat_statements' to shared_preload_libraries in postgresql.conf and restart PostgreSQL.",
               requires_restart: true
             }
+          else
+            {
+              success: false,
+              message: "Failed to create extension. Check database permissions.",
+              requires_restart: false
+            }
           end
         rescue => e
           error_message = e.message

data/lib/pg_reports/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PgReports
-  VERSION = "0.5.1"
+  VERSION = "0.5.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pg_reports
 version: !ruby/object:Gem::Version
-  version: 0.5.1
+  version: 0.5.2
 platform: ruby
 authors:
 - Eldar Avatov