@teleporthq/teleport-plugin-next-data-source 0.44.14 → 0.44.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@teleporthq/teleport-plugin-next-data-source",
-  "version": "0.44.14",
+  "version": "0.44.17",
   "description": "A plugin for managing data sources for Next.js projects.",
   "author": "teleportHQ",
   "license": "MIT",
@@ -26,9 +26,9 @@
   "dependencies": {
     "@babel/parser": "^7.26.10",
     "@babel/types": "^7.5.5",
-    "@teleporthq/teleport-plugin-common": "^0.44.11",
-    "@teleporthq/teleport-shared": "^0.44.11",
-    "@teleporthq/teleport-types": "^0.44.11"
+    "@teleporthq/teleport-plugin-common": "^0.44.16",
+    "@teleporthq/teleport-shared": "^0.44.16",
+    "@teleporthq/teleport-types": "^0.44.16"
   },
-  "gitHead": "f3ba28c4d52283672ea6e04671756bf34c181955"
+  "gitHead": "cc3f4e64c87e23d1ca5650026a0753aeb6272691"
 }

package/src/count-fetchers.ts

@@ -62,7 +62,15 @@ async function getCount(req, res) {
     // handler gets the wrapper object rather than the records, which is not an
     // array — so the count below would report 0 for a list that clearly has rows.
     const { query, queryColumns, filters, collectionPath } = req.query
-    const fakeReq = { query: { query, queryColumns, filters, collectionPath }, method: 'GET' }
+    // The count route already let this request through (see
+    // external-read-guard.ts); counting re-reads every matching row as the
+    // route's own server-side call, never capped to a browser's window.
+    const fakeReq = {
+      query: { query, queryColumns, filters, collectionPath },
+      method: 'GET',
+      headers: req.headers || {},
+      __tqServerCall: true,
+    }
     let result = null
     let statusCode = 200
     
@@ -98,7 +106,7 @@ async function getCount(req, res) {
     console.error('Error getting count:', error)
     return res.status(500).json({
       success: false,
-      error: error.message || 'Failed to get count',
+      error: 'Failed to get count',
       timestamp: Date.now()
     })
   }

package/src/data-source-fetchers.ts

@@ -34,9 +34,14 @@ import {
 import { validateDatabaseConfig } from './validation'
 import { generateCountFetcher } from './count-fetchers'
 import type { EntityTransformOptions } from './transformations'
-import { DataCache, TableAccess } from '@teleporthq/teleport-shared'
+import { DataCache, DataExposure, TableAccess } from '@teleporthq/teleport-shared'
 import type { DataSourceServerCacheOptions } from './cache/types'
 import { isViewDependentTable } from './fetchers/utils/browser-row-policy'
+import {
+  guardExternalDriverCount,
+  guardExternalDriverModule,
+} from './fetchers/utils/external-read-guard'
+import { schemaOf } from './fetchers/utils/table-access-guard'
 
 /** `public."users"` → `users`: the table a spelling names. */
 const bareTableName = (tableName: string): string =>
@@ -92,10 +97,61 @@ export const getDataSourceDependencies = (
   return dependencyMap[type]
 }
 
+/**
+ * Whether the driver's read route carries the table-access guard inline (the
+ * TeleportHQ and Postgres-family fetchers); every other driver is wrapped by
+ * `guardExternalDriverModule`.
+ */
+const hasInlineReadGuard = (dataSource: UIDLDataSource): boolean =>
+  dataSource.type === 'teleport' ||
+  dataSource.type === 'postgresql' ||
+  dataSource.type === 'cockroachdb' ||
+  (dataSource.type === 'supabase' && isSupabaseConnectionStringFallback(dataSource.config))
+
+/**
+ * The read route of `tableName` over `dataSource`: its driver's fetcher, behind
+ * the read guard (see `fetchers/utils/table-access-guard.ts`).
+ */
 export function generateDataSourceFetcher(
   dataSource: UIDLDataSource,
   tableName: string,
   transformOptions: EntityTransformOptions = {}
+): string {
+  const routeExposure = routeExposureOf(dataSource, tableName, transformOptions)
+  const driverCode = generateDriverFetcher(dataSource, tableName, {
+    ...transformOptions,
+    routeExposure,
+  })
+  if (hasInlineReadGuard(dataSource)) {
+    return driverCode
+  }
+  return guardExternalDriverModule(driverCode, {
+    tableName,
+    dataSourceType: dataSource.type,
+    exposure: routeExposure,
+    trustedReaderRoles: transformOptions.trustedReaderRoles || [],
+    schema: schemaOf(dataSource.config, tableName),
+    reader: transformOptions,
+  })
+}
+
+/** The exposure of the route of `tableName` over `dataSource` (by source id and table). */
+const routeExposureOf = (
+  dataSource: UIDLDataSource,
+  tableName: string,
+  transformOptions: EntityTransformOptions
+) =>
+  transformOptions.routeExposure ||
+  DataExposure.readExposureFor(transformOptions.dataExposure, {
+    tableName,
+    dataSourceId: dataSource && dataSource.id,
+    dataSourceType: dataSource && dataSource.type,
+  })
+
+function generateDriverFetcher(
+  dataSource: UIDLDataSource,
+  tableName: string,
+  transformOptions: EntityTransformOptions = {}
 ): string {
   if (!dataSource || typeof dataSource !== 'object') {
     throw new Error('Invalid data source: data source must be a valid object')
@@ -119,7 +175,14 @@ export function generateDataSourceFetcher(
         if (!validation.isValid) {
           throw new Error(`PostgreSQL/CockroachDB config validation failed: ${validation.error}`)
         }
-        return generatePostgreSQLFetcher(config, tableName, transformOptions.trustedReaderRoles)
+        return generatePostgreSQLFetcher(
+          config,
+          tableName,
+          transformOptions.trustedReaderRoles,
+          transformOptions.dataExposure,
+          transformOptions.routeExposure,
+          transformOptions
+        )
       }
 
       case 'mysql':
@@ -196,7 +259,14 @@ export function generateDataSourceFetcher(
               `Supabase (PostgreSQL fallback) config validation failed: ${pgValidation.error}`
             )
           }
-          return generatePostgreSQLFetcher(config, tableName, transformOptions.trustedReaderRoles)
+          return generatePostgreSQLFetcher(
+            config,
+            tableName,
+            transformOptions.trustedReaderRoles,
+            transformOptions.dataExposure,
+            transformOptions.routeExposure,
+            transformOptions
+          )
         }
 
         const validation = validateSupabaseConfig(config)
@@ -275,6 +345,13 @@ export function generateDataSourceFetcherWithCore(
   transformOptions: EntityTransformOptions = {},
   cacheOptions?: DataSourceServerCacheOptions
 ): string {
+  // A row-owned page's read answers each session its own rows: nothing about
+  // it may be cached for another (see DataReadExposure.ownerRules).
+  const ownedExposure = routeExposureOf(dataSource, tableName, transformOptions)
+  const routeCacheOptions =
+    ownedExposure.public || ownedExposure.anySession || !(ownedExposure.ownerRules || []).length
+      ? cacheOptions
+      : undefined
   const apiHandler = generateDataSourceFetcher(dataSource, tableName, transformOptions)
 
   // Extract the handler function body from the API route
@@ -292,8 +369,12 @@ export function generateDataSourceFetcherWithCore(
   const imports = handlerCode.match(importRegex) || []
   const handlerWithoutImports = handlerCode.replace(importRegex, '').trim()
 
-  // Generate count fetcher code and extract its imports
-  const countFetcherCode = generateCountFetcher(dataSource, tableName)
+  // Generate count fetcher code and extract its imports. An external driver's
+  // count runs behind the same guard as its rows.
+  const driverCountCode = generateCountFetcher(dataSource, tableName)
+  const countFetcherCode = hasInlineReadGuard(dataSource)
+    ? driverCountCode
+    : guardExternalDriverCount(driverCountCode)
   const countImports = countFetcherCode.match(importRegex) || []
   const countFetcherWithoutImports = countFetcherCode.replace(importRegex, '').trim()
 
@@ -309,31 +390,38 @@ export function generateDataSourceFetcherWithCore(
   // The import depth differs by destination: this module is written to
   // `utils/data-sources/` normally, but the `isApiRoute` variant is inlined
   // straight into `pages/api/`.
-  const cachePreamble = cacheOptions
+  const cachePreamble = routeCacheOptions
     ? `import { tqWithCache } from '${isApiRoute ? '../../' : '../'}tq-cache/server'`
     : ''
   // A module carrying the browser row policy (the Postgres-family routes) keys
   // its cache by who is reading; see `__tqCacheByView` below.
   const splitsCacheByView = handlerCode.indexOf('function __brpSharesPublicView(') !== -1
-
-  const cacheWiring = cacheOptions
+  // Only a table every visitor may read can sit in a shared (CDN) cache, and a
+  // table only some sessions may read is checked BEFORE the cache: a cached
+  // answer never reaches a visitor the route itself would refuse.
+  const routeExposure = routeExposureOf(dataSource, tableName, transformOptions)
+  const routeIsPublic = routeExposure.public
+  const sharedCacheSeconds = (seconds: number | undefined): number =>
+    routeIsPublic ? seconds || 0 : 0
+
+  const cacheWiring = routeCacheOptions
     ? `
 const __tqDataCache = ${JSON.stringify({
-        scope: cacheOptions.scope,
-        ttl: cacheOptions.ttlSeconds,
-        sMaxAge: cacheOptions.sMaxAge || 0,
-        swr: cacheOptions.staleWhileRevalidate || 0,
+        scope: routeCacheOptions.scope,
+        ttl: routeCacheOptions.ttlSeconds,
+        sMaxAge: sharedCacheSeconds(routeCacheOptions.sMaxAge),
+        swr: sharedCacheSeconds(routeCacheOptions.staleWhileRevalidate),
       })}
 const __tqCountCache = ${JSON.stringify({
-        scope: DataCache.countScopeFor(cacheOptions.scope),
+        scope: DataCache.countScopeFor(routeCacheOptions.scope),
         // Its OWN keyspace, but the DATA scope's version row. A write bumps one
         // row; if the count kept a separate version nothing would ever bump it,
         // and the total would stay stale after every create and delete — the
         // grid showing one more row than the pager counts.
-        versionScope: cacheOptions.scope,
-        ttl: cacheOptions.ttlSeconds,
-        sMaxAge: cacheOptions.sMaxAge || 0,
-        swr: cacheOptions.staleWhileRevalidate || 0,
+        versionScope: routeCacheOptions.scope,
+        ttl: routeCacheOptions.ttlSeconds,
+        sMaxAge: sharedCacheSeconds(routeCacheOptions.sMaxAge),
+        swr: sharedCacheSeconds(routeCacheOptions.staleWhileRevalidate),
       })}
 
 ${
@@ -361,22 +449,55 @@ function __tqCacheByView(fn, opts) {
     sMaxAge: 0,
     swr: 0,
   }))
+  // The app's own server code reads whole tables; a browser's read is capped
+  // (__taReadWindow). Neither is ever served the other's answer.
+  const serverView = tqWithCache(fn, Object.assign({}, opts, {
+    scope: opts.scope + ':server',
+    versionScope: opts.versionScope || opts.scope,
+    sMaxAge: 0,
+    swr: 0,
+  }))
   return async function (req, res) {
+    if (__taIsInternalRequest(req)) return serverView(req, res)
     if (__tqProfileTable && __taIsVisitorView(req)) return fn(req, res)
     return (await __brpSharesPublicView(req, __tqViewDependent)) ? publicView(req, res) : trustedView(req, res)
   }
 }
-
-const cachedHandler = __tqCacheByView(handler, __tqDataCache)
-const cachedGetCount = __tqCacheByView(getCount, __tqCountCache)`
+${
+  routeIsPublic
+    ? ''
+    : `
+// Readable only by some sessions (see __TA_ROUTE_EXPOSURE): the session is
+// checked before any cached answer is handed out.
+function __tqExposureFirst(fn) {
+  return async function (req, res) {
+    const __denied = await __taGuardExposure(req)
+    if (__denied) {
+      return res.status(__denied.status).json({ success: false, error: __denied.message, timestamp: Date.now() })
+    }
+    return fn(req, res)
+  }
+}
+`
+}
+const cachedHandler = ${
+        routeIsPublic
+          ? '__tqCacheByView(handler, __tqDataCache)'
+          : '__tqExposureFirst(__tqCacheByView(handler, __tqDataCache))'
+      }
+const cachedGetCount = ${
+        routeIsPublic
+          ? '__tqCacheByView(getCount, __tqCountCache)'
+          : '__tqExposureFirst(__tqCacheByView(getCount, __tqCountCache))'
+      }`
     : `const cachedHandler = tqWithCache(handler, __tqDataCache)
 const cachedGetCount = tqWithCache(getCount, __tqCountCache)`
 }
 `
     : ''
 
-  const handlerExport = cacheOptions ? 'cachedHandler' : 'handler'
-  const countExport = cacheOptions ? 'cachedGetCount' : 'getCount'
+  const handlerExport = routeCacheOptions ? 'cachedHandler' : 'handler'
+  const countExport = routeCacheOptions ? 'cachedGetCount' : 'getCount'
 
   // For API routes, export just the handler function
   // For utils files, export the full object with all functions
@@ -384,7 +505,7 @@ const cachedGetCount = tqWithCache(getCount, __tqCountCache)`
   // The uncached branch is spelled out verbatim rather than interpolated, so an
   // uncached project keeps generating byte-identical output — `handler as
   // handler` would be harmless at runtime and still a diff in every snapshot.
-  const exports = !cacheOptions
+  const exports = !routeCacheOptions
     ? isApiRoute
       ? 'export default handler'
       : `export { fetchData, fetchCount, handler, getCount }

package/src/fetchers/postgresql.ts

@@ -9,7 +9,14 @@ import { generateSortFallbackFieldHelper, generateSortFieldSqlHelper } from '../
 import { SORT_NULLS_LAST_SQL } from '../list-sort-order'
 import { generateRowOrderTiebreakHelper, rowIdentityColumn } from '../row-order'
 import { generateProductFilterClauseHelper } from '../product-filter-fields'
-import { generateReadGuardCall, generateTableAccessPreamble } from './utils/table-access-guard'
+import type { DataReadExposure, ProjectDataExposure } from '@teleporthq/teleport-types'
+import { DataExposure } from '@teleporthq/teleport-shared'
+import {
+  generateReadGuardCall,
+  generateTableAccessPreamble,
+  SessionReaderPlacement,
+  sqlRouteFieldPolicy,
+} from './utils/table-access-guard'
 import { generateSearchSqlHelpersCode, PG_SEARCH_SQL } from '../search-relevance'
 import { generateRequestSqlGuardsCode } from './utils/request-sql-guards'
 import { generateArrayOverlapSqlCode } from '../array-overlap-sql'
@@ -31,7 +38,13 @@ interface PostgreSQLConfig {
 export const generatePostgreSQLFetcher = (
   config: Record<string, unknown>,
   tableName: string,
-  trustedReaderRoles: ReadonlyArray<string> = []
+  trustedReaderRoles: ReadonlyArray<string> = [],
+  // Who may read the table from a browser — see DataExposure.readExposureFor.
+  dataExposure?: ProjectDataExposure,
+  // The route's own exposure, already resolved for its data source (preferred).
+  routeExposure?: DataReadExposure,
+  // Where the route sits and whether its session reader checks revocation.
+  reader: SessionReaderPlacement = {}
 ): string => {
   const pgConfig = config as PostgreSQLConfig
   const schema = pgConfig.options?.schema
@@ -62,10 +75,20 @@ export const generatePostgreSQLFetcher = (
 
   return `${PG_CLIENT_IMPORT}
 
-${generateTableAccessPreamble(trustedReaderRoles)}
+${generateTableAccessPreamble(
+  trustedReaderRoles,
+  routeExposure || DataExposure.readExposureFor(dataExposure, { tableName }),
+  sqlRouteFieldPolicy(config, tableName),
+  tableName,
+  reader
+)}
 
+// No query waits on the database longer than this (enforced by the client:
+// a server-side statement_timeout does not survive a pooler).
 const getClient = () => {
-  return new Client(${clientConfig})
+  return new Client(Object.assign(${clientConfig}, { query_timeout: ${
+    DataExposure.READ_QUERY_TIMEOUT_MS
+  } }))
 }
 
 ${generateSafeJSONParseCode()}
@@ -136,7 +159,9 @@ const processFilters = (filters, conditions, queryParams, paramIndex) => {
       return null
     }
     
-    const validOps = ['=', '!=', '>', '<', '>=', '<=']
+    // 'like' reads a JSON-list cell for one member (a post's former slugs); the
+    // value is a bound parameter, so a pattern never reaches the SQL text.
+    const validOps = ['=', '!=', '>', '<', '>=', '<=', 'like']
     const sqlOperator = validOps.includes(operand) ? operand : '='
     const clause = \`\${field} \${sqlOperator} $\${paramIndex}\`
     queryParams.push(value)
@@ -201,7 +226,8 @@ ${generateReadGuardCall(tableName, null)}
             : [${JSON.stringify(tableName)}]
           
           const schemaResult = await client.query(schemaQuery, schemaParams)
-          columns = schemaResult.rows.map(row => row.column_name)
+          // A credential column is never searched: a search is an oracle for it.
+          columns = schemaResult.rows.map(row => row.column_name).filter((column) => !__taIsCredentialColumn(column))
         } catch (schemaError) {
           console.warn('Failed to fetch column names from information_schema:', schemaError.message)
           // Continue without search if we can't get columns
@@ -267,8 +293,10 @@ ${generateReadGuardCall(tableName, null)}
     }
     const usedRewrittenSort = orderBySql !== plainOrderBySql
 
-    const limitValue = requestRowCount(limit || perPage)
-    const offsetValue = offset !== undefined ? parseInt(offset) : (page && perPage ? (parseInt(page) - 1) * parseInt(perPage) : undefined)
+    // Whole numbers only, and a browser's read capped - see __taReadWindow.
+    const __window = __taReadWindow(req)
+    const limitValue = __window.limit || __window.perPage
+    const offsetValue = __window.offset !== undefined ? __window.offset : (__window.page && __window.perPage ? (__window.page - 1) * __window.perPage : undefined)
 
     let sqlTail = ''
     if (limitValue !== undefined) {
@@ -381,7 +409,8 @@ ${generateReadGuardCall(tableName, null)}
           }
           
           const schemaResult = await client.query(schemaQuery, schemaParams)
-          columns = schemaResult.rows.map(row => row.column_name)
+          // A credential column is never searched: a search is an oracle for it.
+          columns = schemaResult.rows.map(row => row.column_name).filter((column) => !__taIsCredentialColumn(column))
         } catch (schemaError) {
           console.warn('Failed to fetch column names from information_schema:', schemaError.message)
           // Continue without search if we can't get columns

package/src/fetchers/raw-query.ts

@@ -1,7 +1,36 @@
-import { SessionCookieResolver } from '@teleporthq/teleport-shared'
+import { DataExposure, SessionCookieResolver, TableAccess } from '@teleporthq/teleport-shared'
 import { replaceSecretReference } from '../utils'
 import { PG_CLIENT_IMPORT } from './pg-client-import'
 
+/**
+ * What a raw-query state route is behind: the protection of the page it
+ * serves (`PageAccess.resolvePageAccessPolicy`; null for a page every visitor
+ * may open, and for an app-wide global state), and the roles that may read the
+ * protected tables (`TableAccess.resolveTrustedReaderRoles`).
+ */
+export interface RawQueryRouteAccess {
+  pageAccess?: {
+    requiresAuth: boolean
+    allowedRoles: string[]
+    requiresSubscription?: boolean
+    subscriptionProductIds?: string[]
+  } | null
+  trustedReaderRoles?: string[]
+  /** The route's path back to the project root; absent, three folders (`pages/api/page-state/`, `pages/api/global-state/`). */
+  projectRoot?: string
+  /** The project has authentication: the session reader checks revocation (absent: it does). */
+  withRevocation?: boolean
+}
+
+/** The longest value a request may bind into the statement (a route param). */
+const MAX_REQUEST_PARAM_LENGTH = 256
+
+/** The largest row count the baked statement asks for itself (`LIMIT n` at its end), or 0. */
+const statementLimit = (query: string): number => {
+  const match = /\blimit\s+(\d+)\s*(?:offset\s+\d+\s*)?;?\s*$/i.exec(query)
+  return match ? parseInt(match[1], 10) : 0
+}
+
 interface PostgreSQLConfig {
   host?: string
   port?: number
@@ -45,14 +74,23 @@ const currentUserField = (param: string): string => {
 export const generateRawQueryFetcher = (
   config: Record<string, unknown>,
   query: string,
-  paramFields: string[]
+  paramFields: string[],
+  access: RawQueryRouteAccess = {}
 ): string => {
   const pgConfig = config as PostgreSQLConfig
   const userParams = paramFields.filter(isCurrentUserParam)
   const requestParams = paramFields.filter((param) => !isCurrentUserParam(param))
+  const pageAccess = access.pageAccess || null
+  const rowCap = Math.max(DataExposure.BROWSER_READ_MAX_LIMIT, statementLimit(query))
 
   const paramDestructure = [
-    requestParams.length > 0 ? `const { ${requestParams.join(', ')} } = req.query` : '',
+    requestParams.length > 0
+      ? `const { ${requestParams
+          .map((param) => `${param}: __raw_${param}`)
+          .join(', ')} } = req.query\n    ${requestParams
+          .map((param) => `const ${param} = requestParam(__raw_${param})`)
+          .join('\n    ')}`
+      : '',
     userParams.length > 0 ? 'const __sessionUser = await sessionUser(req)' : '',
     ...userParams.map(
       (param) =>
@@ -64,9 +102,21 @@ export const generateRawQueryFetcher = (
     .filter(Boolean)
     .join('\n    ')
 
-  const sessionHelpers =
-    userParams.length > 0
-      ? `${SessionCookieResolver.generateCommonJsSessionTokenResolverCode()}
+  // Every route carries the session resolver and the table-access helpers: the
+  // page's protection, the protected tables and the credential columns are
+  // checked here as on every other read route.
+  // The route lives in pages/api/page-state/ or pages/api/global-state/: three folders below the root.
+  const projectRoot = access.projectRoot || '../../..'
+  const sessionHelpers = `${SessionCookieResolver.generateCommonJsSessionTokenResolverCode(
+    projectRoot,
+    {
+      withRevocation: access.withRevocation !== false,
+    }
+  )}
+${TableAccess.generateTableAccessHelperCode({
+  trustedReaderRoles: access.trustedReaderRoles || [],
+  projectRoot,
+})}
 // The signed-in user this request's session names, or null.
 async function sessionUser(req) {
   try {
@@ -83,8 +133,60 @@ function sessionUserField(user, field) {
   var value = field === 'id' && user.id == null ? user.sub : user[field]
   return value == null || value === '' ? undefined : value
 }
+
+// A value the request binds into the statement (a details page's route param):
+// one short string, never a list or an object.
+function requestParam(value) {
+  if (Array.isArray(value)) value = value[0]
+  if (value === undefined || value === null) return undefined
+  var text = String(value)
+  return text.length > 0 && text.length <= ${MAX_REQUEST_PARAM_LENGTH} ? text : undefined
+}
+
+// Who may run this route's statement: the visitors the page it serves admits
+// (PAGE_ACCESS, null for every visitor), and — when the statement reads a
+// protected table — only the app's own server code, a trusted role, or a
+// session the statement itself is scoped to (a {{Current User.*}} value bound
+// from that session above). null when the request may proceed.
+var PAGE_ACCESS = ${JSON.stringify(
+    pageAccess
+      ? {
+          allowedRoles: pageAccess.allowedRoles || [],
+          requiresSubscription: pageAccess.requiresSubscription === true,
+          subscriptionProductIds: pageAccess.subscriptionProductIds || [],
+        }
+      : null
+  )}
+${pageAccess && pageAccess.requiresSubscription ? DataExposure.generateEntitlementCheckCode() : ''}
+var SESSION_SCOPED = ${JSON.stringify(userParams.length > 0)}
+var ROW_CAP = ${rowCap}
+// No query waits on the database longer than this (enforced by the client:
+// a server-side statement_timeout does not survive a pooler).
+var QUERY_TIMEOUT_MS = ${DataExposure.READ_QUERY_TIMEOUT_MS}
+async function guardStatement(req, query) {
+  // A retired table is reached by no caller, this app's own server code included.
+  if (__taRetiredTableNamed(null, query)) return { status: 403, message: 'Forbidden' }
+  if (__taIsInternalRequest(req)) return null
+  var token = await sessionUser(req)
+  var role = token ? __taRoleOf(token) : null
+  if (PAGE_ACCESS) {
+    if (!token) return { status: 401, message: 'Unauthenticated' }
+    if (PAGE_ACCESS.allowedRoles.length > 0 && (!role || PAGE_ACCESS.allowedRoles.indexOf(role) === -1)) {
+      return { status: 403, message: 'Forbidden' }
+    }
+    // A subscriber-only page: its states too need the entitlement.
+    if (PAGE_ACCESS.requiresSubscription && !(await __dxEntitled(token, PAGE_ACCESS.subscriptionProductIds))) {
+      return { status: 403, message: 'Forbidden' }
+    }
+  }
+  if (__taProtectedTablesRead(null, query).length === 0) return null
+  if (role && __TA_TRUSTED_READER_ROLES.indexOf(role) !== -1) return null
+  // Scoped to the session's own value: without a session the statement never
+  // runs (no value to bind), and the request is answered with no rows.
+  if (SESSION_SCOPED) return null
+  return token ? { status: 403, message: 'Forbidden' } : { status: 401, message: 'Unauthenticated' }
+}
 `
-      : ''
 
   const paramValidation =
     paramFields.length > 0
@@ -119,9 +221,10 @@ const getClient = () => {
   if (connStr) {
     const sslEnv = process.env.TELEPORT_DB_SSL
     const sslOpt = sslEnv === 'false' ? false : sslEnv === 'true' ? { rejectUnauthorized: false } : undefined
-    return new Client(Object.assign({ connectionString: connStr }, sslOpt !== undefined ? { ssl: sslOpt } : {}))
+    return new Client(Object.assign({ connectionString: connStr, query_timeout: QUERY_TIMEOUT_MS }, sslOpt !== undefined ? { ssl: sslOpt } : {}))
   }
   return new Client({
+    query_timeout: QUERY_TIMEOUT_MS,
     host: process.env.TELEPORT_DB_HOST || ${JSON.stringify(pgConfig.host ?? null)},
     port: parseInt(process.env.TELEPORT_DB_PORT || '${pgConfig.port || 5432}', 10),
     user: process.env.TELEPORT_DB_USER || ${JSON.stringify(
@@ -149,11 +252,14 @@ const validateQuery = (query) => {
 
 export default async function handler(req, res) {
   try {
+    const query = ${JSON.stringify(query)}
+    const __denied = await guardStatement(req, query)
+    if (__denied) {
+      return res.status(__denied.status).json({ success: false, error: __denied.message, timestamp: Date.now() })
+    }
     ${paramDestructure}
     ${paramValidation}
 
-    const query = ${JSON.stringify(query)}
-
     if (!validateQuery(query)) {
       return res.status(400).json({
         success: false,
@@ -167,21 +273,27 @@ export default async function handler(req, res) {
 
     try {
       const result = await client.query(query, ${paramArray})
+      const rows = Array.isArray(result && result.rows) ? result.rows : []
 
       return res.status(200).json({
         success: true,
-        data: result.rows,
+        // No credential column leaves in a row, and a browser gets at most
+        // ROW_CAP rows (the statement's own LIMIT when it asks for more).
+        data: __taWithoutCredentials(__taIsInternalRequest(req) ? rows : rows.slice(0, ROW_CAP), null),
         timestamp: Date.now()
       })
     } finally {
       await client.end()
     }
   } catch (error) {
-    // A database error names tables, columns and values: server log only.
-    console.error('Raw query fetch error:', error)
+    // A database error names tables, columns and values: server log only,
+    // under the reference the client gets.
+    const id = Math.floor(Math.random() * 0xffffffff).toString(16)
+    console.error('Raw query fetch error (' + id + '):', error)
     return res.status(500).json({
       success: false,
       error: 'Failed to fetch data',
+      id: id,
       timestamp: Date.now()
     })
   }

package/src/fetchers/redshift.ts

@@ -5,6 +5,7 @@ import {
   generateFilterTreeHelpersCode,
   generateSearchEscapeHelpersCode,
 } from '../utils'
+import { DataExposure } from '@teleporthq/teleport-shared'
 import { generateSearchSqlHelpersCode, REDSHIFT_SEARCH_SQL } from '../search-relevance'
 
 interface RedshiftConfig {
@@ -34,8 +35,10 @@ export const generateRedshiftFetcher = (
 
   return `import { Client } from 'pg'
 
+// No query waits on the database longer than this (enforced by the client).
 const getClient = () => {
   return new Client({
+    query_timeout: ${DataExposure.READ_QUERY_TIMEOUT_MS},
     host: ${JSON.stringify(host)},
     port: ${port || 5439},
     user: ${JSON.stringify(user)},