@malloy-publisher/server 0.0.241 → 0.0.242

package/dist/server.mjs

@@ -269317,7 +269317,7 @@ class QueryController {
   constructor(environmentStore) {
     this.environmentStore = environmentStore;
   }
-  async getQuery(environmentName, packageName, modelPath, sourceName, queryName, query, compactJson = false, filterParams, bypassFilters, givens, metadata) {
+  async getQuery(environmentName, packageName, modelPath, sourceName, queryName, query, compactJson = false, filterParams, bypassFilters, givens, metadata, bypassAuthorize) {
     let requestMetadata;
     let queryClass;
     try {
@@ -269357,7 +269357,7 @@ class QueryController {
             return null;
           }
         }
-      }, compactJson ? "compact" : "full"), getQueryTimeoutMs());
+      }, compactJson ? "compact" : "full", bypassAuthorize), getQueryTimeoutMs());
       const renderLogs = import_render_validator.validateRenderTags(result);
       return {
         result: serializedResult,
@@ -277169,12 +277169,19 @@ function unwrapQuotedExpression(body) {
 
 // src/authorize_metrics.ts
 var guardRejectionCounter = null;
+var bypassCounter = null;
 function recordAuthorizeGuardRejection(field) {
   guardRejectionCounter ??= publisherMeter().createCounter("publisher_authorize_guard_rejected_total", {
     description: "Requests rejected with 400 for declaring an `#(authorize)` annotation in caller-submitted Malloy text. Label: field ('query'|'source_name'|'query_name'|'compile_source')."
   });
   guardRejectionCounter.add(1, { field });
 }
+function recordAuthorizeBypass(entryPoint) {
+  bypassCounter ??= publisherMeter().createCounter("publisher_authorize_bypass_total", {
+    description: "Gate evaluations skipped because the request carried an authorize bypass (private data-management path). Label: entry_point ('source'|'runnable'). Any nonzero value on a path that should not use the bypass is a finding — see the paired `authorize bypass` audit log line for org/package/model/source."
+  });
+  bypassCounter.add(1, { entry_point: entryPoint });
+}
 
 // src/service/environment.ts
 init_logger();
@@ -278733,7 +278740,11 @@ class Model {
     }
     return this.fileLevelAuthorize;
   }
-  async assertAuthorized(sourceName, givens) {
+  async assertAuthorized(sourceName, givens, bypassAuthorize = false) {
+    if (bypassAuthorize) {
+      this.noteAuthorizeBypass("source", sourceName);
+      return;
+    }
     const gates = sourceName ? this.entryPointGatesBySource.get(sourceName) : undefined;
     if (gates) {
       for (const { label, exprs, selfContained, ambientPrefix } of gates) {
@@ -278743,6 +278754,15 @@ class Model {
     }
     await this.assertAuthorizedExprs(sourceName ?? "(query)", this.effectiveAuthorizeFor(sourceName), givens);
   }
+  noteAuthorizeBypass(entryPoint, sourceName) {
+    recordAuthorizeBypass(entryPoint);
+    logger.info("authorize bypass", {
+      entryPoint,
+      sourceName: sourceName ?? "(query)",
+      modelPath: this.modelPath,
+      packageName: this.packageName
+    });
+  }
   async assertAuthorizedExprs(label, exprs, givens, selfContainedFirst = false, ambientPrefix = 0) {
     if (exprs.length === 0)
       return;
@@ -278765,7 +278785,11 @@ class Model {
     if (!passed)
       deny();
   }
-  async assertAuthorizedForAllSources(runnable, givens) {
+  async assertAuthorizedForAllSources(runnable, givens, bypassAuthorize = false) {
+    if (bypassAuthorize) {
+      this.noteAuthorizeBypass("runnable", await this.resolveAuthorizeSourceFromRunnable(runnable));
+      return;
+    }
     const ownSourceName = await this.resolveAuthorizeSourceFromRunnable(runnable);
     await this.assertAuthorized(ownSourceName, givens);
     const { struct, modelDef, compositeResolvedSourceDef } = await this.resolveRunTargetStruct(runnable);
@@ -279342,7 +279366,7 @@ class Model {
       return { ...b, schema, refinements };
     }).filter((b) => b.schema.length > 0);
   }
-  async getQueryResults(sourceName, queryName, query, filterParams, bypassFilters, givens, abortSignal, queryMetadataInput, responseShape = "full") {
+  async getQueryResults(sourceName, queryName, query, filterParams, bypassFilters, givens, abortSignal, queryMetadataInput, responseShape = "full", bypassAuthorize = false) {
     const startTime = performance.now();
     if (this.compilationError) {
       if (this.compilationError instanceof MalloyError2 || this.compilationError instanceof ModelCompilationError) {
@@ -279361,7 +279385,7 @@ class Model {
     const surfaceName = extractRunTargetSourceName(query);
     const earlySource = sourceName || (queryName ? this.queries?.find((q) => q.name === queryName)?.sourceName : undefined) || (surfaceName && !this.sources?.some((s) => s.name === surfaceName) ? this.queries?.find((q) => q.name === surfaceName)?.sourceName : undefined) || surfaceName;
     if (earlySource) {
-      await this.assertAuthorized(earlySource, givens ?? {});
+      await this.assertAuthorized(earlySource, givens ?? {}, bypassAuthorize);
     }
     try {
       for (const [field, callerText] of [
@@ -279456,7 +279480,7 @@ run: ${sourceName ? `${quoteMalloyIdentifier(sourceName)} -> ` : ""}${quoteMallo
     if (boundary === "deferred") {
       this.assertQueryBoundaryCompiled(compiledSource, query);
     }
-    await this.assertAuthorizedForAllSources(runnable, givens ?? {});
+    await this.assertAuthorizedForAllSources(runnable, givens ?? {}, bypassAuthorize);
     const maxRows = getMaxQueryRows();
     const maxBytes = getMaxResponseBytes();
     const buildManifest = this.resolveFreshBuildManifest();
@@ -284408,6 +284432,13 @@ class WatchModeController {
 init_errors();
 init_logger();
 
+// src/authorize_bypass_header.ts
+var BYPASS_AUTHORIZE_HEADER = "x-publisher-bypass-authorize";
+var readBypassAuthorize = (req) => {
+  const raw = req.headers[BYPASS_AUTHORIZE_HEADER];
+  return typeof raw === "string" && raw.trim().toLowerCase() === "true" ? true : undefined;
+};
+
 // src/filter_deprecation.ts
 var setFilterDeprecationHeaders = (res, options) => {
   const hasFilterParams = options.filterParams !== undefined && options.filterParams !== null && !(typeof options.filterParams === "object" && !Array.isArray(options.filterParams) && Object.keys(options.filterParams).length === 0);
@@ -295580,7 +295611,7 @@ app.post(`${API_PREFIX2}/environments/:environmentName/packages/:packageName/mod
       queryMetadata: req.body?.queryMetadata,
       queryClass: req.body?.queryClass,
       versionId: req.body?.versionId
-    });
+    }, readBypassAuthorize(req));
     setFilterDeprecationHeaders(res, {
       filterParams: req.body.filterParams ?? req.body.sourceFilters,
       bypassFilters: req.body.bypassFilters === true ? true : undefined

package/package.json

@@ -1,7 +1,7 @@
 {
    "name": "@malloy-publisher/server",
    "description": "Malloy Publisher Server",
-   "version": "0.0.241",
+   "version": "0.0.242",
    "main": "dist/server.mjs",
    "bin": {
       "malloy-publisher": "dist/server.mjs"