@malloy-publisher/server 0.0.207 → 0.0.209

package/src/service/connection_config.ts

@@ -336,6 +336,60 @@ function validateConnectionShape(connection: ApiConnection): void {
          }
          break;
       }
+      case "publisher": {
+         // SSRF gate (default-deny / fail-closed). A `publisher` connection
+         // makes THIS server issue outbound HTTP to a tenant-controlled
+         // `connectionUri` (both the query path in db-publisher's
+         // PublisherConnection and the introspection path in db_utils). That is
+         // the intended behavior for local `--watch-env` authoring, but in a
+         // hosted multi-tenant deployment (e.g. Credible running this server) it
+         // is an SSRF surface. Require an explicit opt-in so the type is refused
+         // unless the operator deliberately enabled it. This is the single
+         // choke point — every connection passes validateConnectionShape before
+         // it can be assembled, queried, or introspected — so denying here shuts
+         // off all three at once.
+         if (process.env.PUBLISHER_ALLOW_PROXY_CONNECTIONS !== "true") {
+            throw new Error(
+               `Publisher proxy connection '${connection.name}' is disabled in this deployment. ` +
+                  `'publisher' connections make the server issue outbound requests to a configured connectionUri, ` +
+                  `which is only appropriate for local --watch-env authoring. ` +
+                  `Fix: set the environment variable PUBLISHER_ALLOW_PROXY_CONNECTIONS=true to enable them.`,
+            );
+         }
+         const publisher = connection.publisherConnection;
+         if (!publisher?.connectionUri) {
+            throw new Error(
+               `Invalid publisher connection '${connection.name}': missing connectionUri. ` +
+                  `Fix: { "name": "${connection.name}", "type": "publisher", ` +
+                  `"publisherConnection": { "connectionUri": "https://…/connections/${connection.name}", "accessToken": "<jwt>" } }`,
+            );
+         }
+         // Reject a malformed connectionUri here, at config-load, rather than
+         // letting it fail deep in the request path — where the thrown error can
+         // echo the raw value back, leaking any credentials embedded in it
+         // (`redactUrlCredentials` returns the URI unchanged when it can't parse
+         // it). Never include the raw connectionUri in these messages; the
+         // scheme is safe to name.
+         let parsedUri: URL;
+         try {
+            parsedUri = new URL(publisher.connectionUri);
+         } catch {
+            throw new Error(
+               `Invalid publisher connection '${connection.name}': connectionUri is not a valid URL. ` +
+                  `Fix: set connectionUri to an absolute https URL like "https://…/connections/${connection.name}".`,
+            );
+         }
+         if (
+            parsedUri.protocol !== "http:" &&
+            parsedUri.protocol !== "https:"
+         ) {
+            throw new Error(
+               `Invalid publisher connection '${connection.name}': connectionUri must use http or https (got '${parsedUri.protocol}'). ` +
+                  `Fix: set connectionUri to an absolute https URL like "https://…/connections/${connection.name}".`,
+            );
+         }
+         break;
+      }
    }
 }
 
@@ -546,6 +600,22 @@ export function assembleEnvironmentConnections(
             break;
          }
 
+         case "publisher": {
+            // connectionUri presence is validated by validateConnectionShape
+            // above. The proxied dataplane owns auth and read-only enforcement;
+            // PublisherConnection itself does not reject writes. The real
+            // dialect is the remote connection's and is resolved at runtime by
+            // the live connection, so getStaticConnectionAttributes returns
+            // undefined for publisher (falls through to its default).
+            const publisher = connection.publisherConnection!;
+            pojo.connections[connection.name] = {
+               is: "publisher",
+               connectionUri: publisher.connectionUri,
+               accessToken: publisher.accessToken,
+            };
+            break;
+         }
+
          default: {
             throw new Error(`Unsupported connection type: ${connection.type}`);
          }

package/src/service/db_utils.spec.ts

@@ -1,4 +1,4 @@
-import { describe, expect, it, mock } from "bun:test";
+import { afterEach, describe, expect, it, mock } from "bun:test";
 
 // Stub the missing optional dependency so db_utils.ts can be imported
 mock.module("@azure/identity", () => ({
@@ -873,3 +873,161 @@ describe("extractErrorDataFromError", () => {
       expect(result.task).toEqual({ id: 1 });
    });
 });
+
+// ---------------------------------------------------------------------------
+// publisher proxy introspection
+//
+// The remote dataplane is the oracle for introspection correctness and is not
+// simulated here. These tests cover only this server's own logic: the request
+// URL it builds, the auth header, the bare-name table filter, and how it
+// surfaces a non-ok / unreachable dataplane (credentials redacted from errors).
+// ---------------------------------------------------------------------------
+describe("publisher proxy introspection", () => {
+   const realFetch = globalThis.fetch;
+   let lastRequest:
+      | { url: string; headers: Record<string, string> }
+      | undefined;
+
+   function stubFetch(
+      payload: unknown,
+      init: { ok?: boolean; status?: number; body?: string } = {},
+   ) {
+      lastRequest = undefined;
+      const ok = init.ok ?? true;
+      globalThis.fetch = (async (url: unknown, opts?: RequestInit) => {
+         lastRequest = {
+            url: String(url),
+            headers: (opts?.headers as Record<string, string>) ?? {},
+         };
+         return {
+            ok,
+            status: init.status ?? (ok ? 200 : 500),
+            json: async () => payload,
+            text: async () => init.body ?? "",
+         } as Response;
+      }) as typeof fetch;
+   }
+
+   afterEach(() => {
+      globalThis.fetch = realFetch;
+   });
+
+   const conn: ApiConnection = {
+      name: "analytics",
+      type: "publisher",
+      publisherConnection: {
+         connectionUri:
+            "https://org.data.example.com/api/v0/environments/proj/connections/analytics",
+         accessToken: "jwt-token",
+      },
+   };
+   // No malloyConnection is used for the publisher path.
+   const noConn = undefined as unknown as Connection;
+
+   it("forwards GET /schemas to the connectionUri with a bearer token", async () => {
+      const schemas = [{ name: "main", isHidden: false, isDefault: true }];
+      stubFetch(schemas);
+      const result = await getSchemasForConnection(conn, noConn);
+
+      expect(lastRequest?.url).toBe(
+         "https://org.data.example.com/api/v0/environments/proj/connections/analytics/schemas",
+      );
+      expect(lastRequest?.headers["Authorization"]).toBe("Bearer jwt-token");
+      expect(result).toEqual(schemas);
+   });
+
+   it("omits the Authorization header when no accessToken is configured", async () => {
+      const tokenless: ApiConnection = {
+         name: "analytics",
+         type: "publisher",
+         publisherConnection: {
+            connectionUri:
+               "https://org.data.example.com/api/v0/environments/proj/connections/analytics",
+         },
+      };
+      stubFetch([]);
+      await getSchemasForConnection(tokenless, noConn);
+      expect(lastRequest?.headers["Authorization"]).toBeUndefined();
+   });
+
+   it("forwards GET /schemas/<schema>/tables and returns all tables when unfiltered", async () => {
+      const tables = [
+         { resource: "main.orders" },
+         { resource: "main.customers" },
+      ];
+      stubFetch(tables);
+      const result = await listTablesForSchema(conn, "main", noConn);
+
+      expect(lastRequest?.url).toBe(
+         "https://org.data.example.com/api/v0/environments/proj/connections/analytics/schemas/main/tables",
+      );
+      expect(result).toEqual(tables);
+   });
+
+   it("URL-encodes the schema name in the tables path", async () => {
+      stubFetch([]);
+      await listTablesForSchema(conn, "weird schema/name", noConn);
+      expect(lastRequest?.url).toContain(
+         "/schemas/weird%20schema%2Fname/tables",
+      );
+   });
+
+   it("filters by bare table name across schema- and catalog-qualified resources", async () => {
+      const tables = [
+         { resource: "main.orders" }, // "<schema>.<table>"
+         { resource: "cat.main.customers" }, // "<catalog>.<schema>.<table>"
+         { resource: "main.events" },
+      ];
+      stubFetch(tables);
+      const result = await listTablesForSchema(conn, "main", noConn, [
+         "orders",
+         "customers",
+      ]);
+      expect(result.map((t) => t.resource)).toEqual([
+         "main.orders",
+         "cat.main.customers",
+      ]);
+   });
+
+   it("returns an empty list when the filter matches nothing (not all rows)", async () => {
+      stubFetch([{ resource: "main.orders" }]);
+      const result = await listTablesForSchema(conn, "main", noConn, [
+         "nonexistent",
+      ]);
+      expect(result).toEqual([]);
+   });
+
+   it("throws an actionable error on a non-ok dataplane response", async () => {
+      stubFetch(null, { ok: false, status: 403, body: "forbidden" });
+      await expect(getSchemasForConnection(conn, noConn)).rejects.toThrow(
+         "failed (403): forbidden",
+      );
+   });
+
+   it("redacts URL-embedded credentials from error messages", async () => {
+      const withCreds: ApiConnection = {
+         name: "analytics",
+         type: "publisher",
+         publisherConnection: {
+            connectionUri:
+               "https://user:secret@org.data.example.com/api/v0/environments/proj/connections/analytics",
+         },
+      };
+      stubFetch(null, { ok: false, status: 500, body: "boom" });
+      await expect(getSchemasForConnection(withCreds, noConn)).rejects.toThrow(
+         /Publisher dataplane request to https:\/\/org\.data\.example\.com.*failed \(500\)/,
+      );
+      await expect(
+         getSchemasForConnection(withCreds, noConn),
+      ).rejects.not.toThrow(/secret/);
+   });
+
+   it("surfaces a network-level failure with the connection name and no token", async () => {
+      globalThis.fetch = (async () => {
+         throw new Error("ECONNREFUSED");
+      }) as unknown as typeof fetch;
+      await expect(getSchemasForConnection(conn, noConn)).rejects.toThrow(
+         'failed for connection "analytics": ECONNREFUSED',
+      );
+   });
+});

package/src/service/db_utils.ts

@@ -594,6 +594,133 @@ async function getSchemasForDuckLake(
    }
 }
 
+/** Abort introspection requests that hang instead of holding the slot open. */
+const PUBLISHER_INTROSPECTION_TIMEOUT_MS = 60_000;
+
+/**
+ * Strip any userinfo (`user:pass@`) from a URL before it reaches a log or error
+ * message. `connectionUri` comes from a config file and may legitimately carry
+ * embedded credentials; the bearer token always travels in the header, never
+ * the URL, but this keeps any URL-embedded secret out of thrown messages too.
+ */
+function redactUrlCredentials(url: string): string {
+   try {
+      const parsed = new URL(url);
+      parsed.username = "";
+      parsed.password = "";
+      return parsed.toString();
+   } catch {
+      // Non-absolute / unparseable: nothing to redact, return as-is.
+      return url;
+   }
+}
+
+/**
+ * Publisher proxy connections introspect against the remote dataplane, which
+ * exposes the same connection API as this server. Schema/table discovery is a
+ * GET passthrough — the remote owns the dialect-specific introspection and
+ * returns the same Schema/Table shapes, so we forward the response verbatim
+ * (no Malloy connection involved).
+ *
+ * URL contract: the request is the configured `connectionUri` with the
+ * introspection `pathSuffix` appended verbatim. `connectionUri` must point at
+ * the connection resource itself (`.../connections/<name>`), so this path and
+ * the data path (db-publisher's `PublisherConnection`) resolve against the same
+ * remote connection. Note the two halves derive their URL differently: the
+ * db-publisher client re-parses `connectionUri` and rebuilds it through its
+ * generated client, while this introspection path appends to it verbatim — the
+ * remote must serve both forms for a given `connectionUri`. Keep them pointed at
+ * the same connection resource so they stay in agreement.
+ */
+async function fetchFromPublisherDataplane<T>(
+   connection: ApiConnection,
+   pathSuffix: string,
+): Promise<T> {
+   const publisher = connection.publisherConnection;
+   // Type-narrowing guard only — the user-facing validation (with the
+   // actionable `Fix:` message) lives in validateConnectionShape, which every
+   // connection passes before it can be assembled and introspected here.
+   if (!publisher?.connectionUri) {
+      throw new Error(
+         `Publisher connection "${connection.name}" is missing connectionUri`,
+      );
+   }
+   const url = `${publisher.connectionUri.replace(/\/+$/, "")}${pathSuffix}`;
+   const headers: Record<string, string> = {};
+   if (publisher.accessToken) {
+      headers["Authorization"] = `Bearer ${publisher.accessToken}`;
+   }
+
+   let response: Response;
+   try {
+      response = await fetch(url, {
+         headers,
+         signal: AbortSignal.timeout(PUBLISHER_INTROSPECTION_TIMEOUT_MS),
+      });
+   } catch (error) {
+      // Network-level failure (DNS, connection refused, timeout) — no HTTP
+      // status. Surface it with the connection name, like the other
+      // introspectors, and never echo the token-bearing header.
+      const reason =
+         (error as Error)?.name === "TimeoutError"
+            ? `timed out after ${PUBLISHER_INTROSPECTION_TIMEOUT_MS}ms`
+            : (error as Error).message;
+      throw new Error(
+         `Publisher dataplane request to ${redactUrlCredentials(url)} failed ` +
+            `for connection "${connection.name}": ${reason}`,
+      );
+   }
+
+   if (!response.ok) {
+      const body = await response.text().catch(() => "");
+      throw new Error(
+         `Publisher dataplane request to ${redactUrlCredentials(url)} failed ` +
+            `(${response.status}): ${body.slice(0, 200)}`,
+      );
+   }
+   return (await response.json()) as T;
+}
+
+async function getSchemasForPublisher(
+   connection: ApiConnection,
+): Promise<ApiSchema[]> {
+   return fetchFromPublisherDataplane<ApiSchema[]>(connection, "/schemas");
+}
+
+async function listTablesForPublisher(
+   connection: ApiConnection,
+   schemaName: string,
+   tableNames?: string[],
+): Promise<ApiTable[]> {
+   const tables = await fetchFromPublisherDataplane<ApiTable[]>(
+      connection,
+      `/schemas/${encodeURIComponent(schemaName)}/tables`,
+   );
+   if (!tableNames) {
+      return tables;
+   }
+   // `tableNames` is a bare-table-name filter (see listTablesForBigQuery). The
+   // remote's `resource` is dotted and its qualification depends on the remote
+   // dialect ("<schema>.<table>" or "<catalog>.<schema>.<table>"), so match the
+   // bare name (last segment) as well as the schema-stripped and full forms. An
+   // unrecognized shape still matches on the full resource rather than being
+   // silently dropped.
+   const allowed = new Set(tableNames);
+   const prefix = `${schemaName}.`;
+   return tables.filter((table) => {
+      const resource = table.resource ?? "";
+      const schemaStripped = resource.startsWith(prefix)
+         ? resource.slice(prefix.length)
+         : resource;
+      const bareName = resource.slice(resource.lastIndexOf(".") + 1);
+      return (
+         allowed.has(bareName) ||
+         allowed.has(schemaStripped) ||
+         allowed.has(resource)
+      );
+   });
+}
+
 export async function getSchemasForConnection(
    connection: ApiConnection,
    malloyConnection: Connection,
@@ -617,6 +744,8 @@ export async function getSchemasForConnection(
          return getSchemasForMotherDuck(connection, malloyConnection);
       case "ducklake":
          return getSchemasForDuckLake(connection, malloyConnection);
+      case "publisher":
+         return getSchemasForPublisher(connection);
       default:
          throw new Error(`Unsupported connection type: ${connection.type}`);
    }
@@ -929,6 +1058,8 @@ export async function listTablesForSchema(
             malloyConnection,
             tableNames,
          );
+      case "publisher":
+         return listTablesForPublisher(connection, schemaName, tableNames);
       default:
          throw new Error(`Unsupported connection type: ${connection.type}`);
    }