api-dock 0.5.0__tar.gz → 0.7.0__tar.gz

{api_dock-0.5.0 → api_dock-0.7.0}/PKG-INFO

@@ -1,9 +1,9 @@
 Metadata-Version: 2.4
 Name: api_dock
-Version: 0.5.0
+Version: 0.7.0
 Summary: A flexible API gateway that allows you to proxy requests to multiple remote APIs and Databases
 Author-email: Brookie Guzder-Williams <bguzder-williams@berkeley.edu>
-License: BSd 3-clause
+License-Expression: BSD-3-Clause
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
 Classifier: Programming Language :: Python :: 3
@@ -26,7 +26,7 @@ Requires-Dist: pyyaml<7,>=6.0.3
 Requires-Dist: httpx<0.29,>=0.28.1
 Requires-Dist: duckdb<2,>=1.1.3
 Requires-Dist: flask
-Requires-Dist: cryptography<47,>=46.0.5
+Requires-Dist: cryptography<49.0.0,>=48.0.0
 Requires-Dist: boto3<2,>=1.42.59
 Provides-Extra: dev
 Requires-Dist: pycodestyle<3,>=2.14.0; extra == "dev"
@@ -218,6 +218,7 @@ remotes:
 settings:
   add_trailing_slash: true              # Auto-add trailing slash to paths (default: true)
   follow_protocol_downgrades: false     # Allow HTTPS->HTTP redirects (default: false)
+  timeout: 10                           # Upstream request timeout in seconds (default: 10)
 ```
 
 ### HTTP behavior Settings
@@ -228,6 +229,8 @@ The optional `settings` section controls HTTP behavior:
 
 - **`follow_protocol_downgrades`** (default: `false`): Control how HTTP redirects are handled. When `false` (recommended), HTTPS→HTTP redirects are blocked for security. When `true`, allows following redirects that downgrade from HTTPS to HTTP (not recommended for production).
 
+- **`timeout`** (default: `10`): Upstream request timeout in seconds, applied to both the streaming and buffered proxy paths. Raise it for slow upstreams (e.g. large aggregation queries) that would otherwise return a 502 on timeout. Set to `null` or `false` to disable the timeout entirely (not recommended — a stalled upstream can hold the connection open indefinitely).
+
 ---
 
 ## Remote Configurations
@@ -349,7 +352,7 @@ For now only parquet support is working but we will be adding other Databases in
 
 ### Database Configuration
 
-Database configurations are stored in `config/databases/` directory. Each database defines:
+Database configurations are stored in `api_dock_config/databases/` directory. Each database defines:
 - **tables**: Mapping of table names to file paths (supports S3, GCS, HTTPS, local paths)
 - **queries**: Named SQL queries for reuse
 - **routes**: REST endpoints mapped to SQL queries
@@ -463,6 +466,34 @@ GET /db/users
 # SQL: SELECT * FROM users WHERE height < 200
 ```
 
+### Repeated Parameters with `multivalue_sql`
+
+A query parameter key can appear more than once in the URL (e.g. `?recording_id=1&recording_id=4`). Add a `multivalue_sql` template alongside `sql` to handle this: when **more than one** value is passed for the key, `multivalue_sql` is used instead of `sql`, and `{{param}}` expands to a parenthesized, quote-escaped SQL value list suitable for an `IN` clause.
+
+Behavior is unchanged when `multivalue_sql` is absent, and when only a single value is passed the normal `sql` template is used.
+
+```yaml
+routes:
+  - route: detections
+    sql: SELECT [[detections]].* FROM [[detections]]
+    query_params:
+      - recording_id:
+          sql: "[[detections]].recording_id = {{recording_id}}"            # single value
+          multivalue_sql: "[[detections]].recording_id IN {{recording_id}}"  # 2+ values
+      - scientific_name:
+          sql: "[[detections]].scientific_name = '{{scientific_name}}'"
+```
+
+```bash
+GET /db/detections?recording_id=4&scientific_name=Gryllus%20fultoni
+# SQL: SELECT detections.* FROM detections
+#      WHERE detections.recording_id = '4' AND detections.scientific_name = 'Gryllus fultoni'
+
+GET /db/detections?recording_id=4&recording_id=1&scientific_name=Gryllus%20fultoni
+# SQL: SELECT detections.* FROM detections
+#      WHERE detections.recording_id IN ('4', '1') AND detections.scientific_name = 'Gryllus fultoni'
+```
+
 ### Sorting and Pagination with `sql_append`
 
 Use `sql_append` to append clauses *after* the WHERE clause — for `ORDER BY`, `LIMIT`, `OFFSET`, etc. Fragments are appended in the order they appear in the YAML config, so **the YAML order must match valid SQL order** (ORDER BY before LIMIT before OFFSET).
@@ -702,30 +733,79 @@ API Dock supports cookie extraction and authentication for both remote APIs and
 
 ## Cookie Configuration
 
-Configure cookies to extract from incoming requests and make them available as template variables:
+### Forwarding client cookies
+
+Configure which cookies to extract from incoming requests and forward to the upstream API (or make available as template variables in SQL routes):
 
 ```yaml
-# Enable all cookies (default: false)
+# Forward all cookies from the client request
 cookies: true
 
-# Or specify specific cookies to extract
+# Forward only specific cookies
 cookies: [session_id, auth_token, user_preferences]
 
-# Disable all cookies (default behavior)
+# Forward no cookies (default behavior)
 cookies: false
 ```
 
-When `cookies: true`, all cookies are accepted and available. When `cookies: false` (default), no cookies are processed except authentication cookies when authentication is configured. When providing a list, only specified cookies are extracted.
+When `cookies: true`, all cookies are accepted and available. When `cookies: false` (default), no cookies are processed except authentication cookies when authentication is configured. When providing a list, only the named cookies are forwarded.
 
-Cookies can then be accessed in SQL queries using `{{cookies.cookie_name}}`:
+Forwarded cookies are accessible in SQL queries using `{{cookies.cookie_name}}`:
 
 ```yaml
-# Database route using cookies
 routes:
   - route: user/profile
     sql: SELECT * FROM [[users]] WHERE session_id = '{{cookies.session_id}}'
 ```
 
+### Injecting cookies from the server environment
+
+The `cookies` list also accepts dict entries to inject cookies into every outgoing upstream request, regardless of what the client sent. This is useful when the upstream API requires a server-side credential (e.g. a session token stored in an environment variable) rather than a cookie from the end user.
+
+Dict entries and string entries can be mixed freely in the same list.
+
+```yaml
+cookies:
+  - session_id                            # forward this cookie from the client request
+  - key: __Secure-authjs.session-token    # inject from environment variable
+    value: "env:SOUNDHUB_SESSION_TOKEN"
+```
+
+#### Dict entry forms
+
+| Form | Behaviour |
+|---|---|
+| `{key: NAME, value: "literal"}` | Inject cookie `NAME` with the literal string `"literal"` |
+| `{key: NAME, value: "env:MY_VAR"}` | Inject cookie `NAME` with the value of env var `MY_VAR`; empty string if unset |
+| `{key: MY_VAR}` | Shorthand — equivalent to `{key: MY_VAR, value: "env:MY_VAR"}` |
+
+The shorthand form uses the key as both the cookie name **and** the env var name. Use the explicit `value: "env:..."` form when the cookie name and the env var name differ (which is common — cookie names often contain characters that aren't valid env var names).
+
+#### Example: proxying an API that requires a session cookie
+
+```yaml
+# api_dock_config/remotes/my_service/1.0.yaml
+name: my_service
+url: https://api.example.com
+
+cookies:
+  - key: __Secure-authjs.session-token
+    value: "env:MY_SERVICE_SESSION_TOKEN"
+```
+
+Set the env var before starting api-dock:
+
+```bash
+export MY_SERVICE_SESSION_TOKEN="your-session-token-here"
+pixi run api-dock start
+```
+
+Every request proxied to `my_service` will include the `__Secure-authjs.session-token` cookie, even if the client did not send one.
+
+#### Injection precedence
+
+If an injected cookie has the same name as a forwarded client cookie, the injected value takes precedence. This ensures the server-side credential is always used, regardless of what the client sends.
+
 ## Authentication Configuration
 
 Configure authentication to validate requests before processing. Multiple authentication methods are supported:
@@ -1119,6 +1199,54 @@ pixi run jupyter lab .
 pixi run python scripts/hello_world.py
 ```
 
+---
+
+# Development
+
+## Publishing a Release
+
+```bash
+# 0. Make sure you are on `main` and merged with any changes
+
+# 1. Bump version in pyproject.toml
+
+# 2. Commit everything
+git add -A
+git commit -m "v0.6.1: stream proxy responses (fix large-response 502 + content-encoding)"
+
+# 3. Tag and push
+git tag v0.6.1
+git push origin main v0.6.1
+
+# 4. Build the wheel (requires the `dev` pixi environment)
+rm -rf dist/
+find . -name "__pycache__" -type d -exec rm -rf {} +
+find . -name "*.pyc" -delete
+pixi run -e dev python -m build --wheel
+ls dist/*.whl
+
+# 5. Create GitHub release with the wheel attached
+gh release create v0.6.1 dist/api_dock-0.6.1-py3-none-any.whl \
+    --title "v0.6.1" --notes "$(cat <<'EOF'
+* new features
+    - Remote proxy responses are now streamed (FastAPI) — upstream bytes are piped to the client as they arrive instead of being buffered fully in memory
+    - New `timeout` setting (default 10s) for the upstream request; set to `null`/`false` to disable
+* bug fixes
+    - Large upstream responses no longer return 502 — streamed via `StreamingResponse` instead of reading the whole body into memory
+    - `Content-Encoding` (gzip/br/deflate) is now preserved on compressed responses — raw bytes are streamed via `aiter_raw()` so the header stays valid and the client can decompress
+    - Slow upstreams (e.g. large aggregation queries) no longer 502 at httpx's hardcoded 5s default — the timeout is now configurable via the `timeout` setting
+* cleanup / other improvements
+    - Added `PreparedRequest` dataclass and split route validation/resolution into `RouteMapper.prepare_remote_request()`; the FastAPI adapter issues the streaming HTTP call
+    - `map_route()` (buffered) retained for the Flask/sync path
+    - Added streaming test coverage (`TestStreamUpstream`, plus `prepare_remote_request` and streaming-header tests) — 53 tests total
+EOF
+)"
+
+# 6. Publish to PyPI
+pixi run -e dev python -m twine upload dist/*.whl
+```
+
+
 ---
 
 # License

{api_dock-0.5.0 → api_dock-0.7.0}/README.md

@@ -179,6 +179,7 @@ remotes:
 settings:
   add_trailing_slash: true              # Auto-add trailing slash to paths (default: true)
   follow_protocol_downgrades: false     # Allow HTTPS->HTTP redirects (default: false)
+  timeout: 10                           # Upstream request timeout in seconds (default: 10)
 ```
 
 ### HTTP behavior Settings
@@ -189,6 +190,8 @@ The optional `settings` section controls HTTP behavior:
 
 - **`follow_protocol_downgrades`** (default: `false`): Control how HTTP redirects are handled. When `false` (recommended), HTTPS→HTTP redirects are blocked for security. When `true`, allows following redirects that downgrade from HTTPS to HTTP (not recommended for production).
 
+- **`timeout`** (default: `10`): Upstream request timeout in seconds, applied to both the streaming and buffered proxy paths. Raise it for slow upstreams (e.g. large aggregation queries) that would otherwise return a 502 on timeout. Set to `null` or `false` to disable the timeout entirely (not recommended — a stalled upstream can hold the connection open indefinitely).
+
 ---
 
 ## Remote Configurations
@@ -310,7 +313,7 @@ For now only parquet support is working but we will be adding other Databases in
 
 ### Database Configuration
 
-Database configurations are stored in `config/databases/` directory. Each database defines:
+Database configurations are stored in `api_dock_config/databases/` directory. Each database defines:
 - **tables**: Mapping of table names to file paths (supports S3, GCS, HTTPS, local paths)
 - **queries**: Named SQL queries for reuse
 - **routes**: REST endpoints mapped to SQL queries
@@ -424,6 +427,34 @@ GET /db/users
 # SQL: SELECT * FROM users WHERE height < 200
 ```
 
+### Repeated Parameters with `multivalue_sql`
+
+A query parameter key can appear more than once in the URL (e.g. `?recording_id=1&recording_id=4`). Add a `multivalue_sql` template alongside `sql` to handle this: when **more than one** value is passed for the key, `multivalue_sql` is used instead of `sql`, and `{{param}}` expands to a parenthesized, quote-escaped SQL value list suitable for an `IN` clause.
+
+Behavior is unchanged when `multivalue_sql` is absent, and when only a single value is passed the normal `sql` template is used.
+
+```yaml
+routes:
+  - route: detections
+    sql: SELECT [[detections]].* FROM [[detections]]
+    query_params:
+      - recording_id:
+          sql: "[[detections]].recording_id = {{recording_id}}"            # single value
+          multivalue_sql: "[[detections]].recording_id IN {{recording_id}}"  # 2+ values
+      - scientific_name:
+          sql: "[[detections]].scientific_name = '{{scientific_name}}'"
+```
+
+```bash
+GET /db/detections?recording_id=4&scientific_name=Gryllus%20fultoni
+# SQL: SELECT detections.* FROM detections
+#      WHERE detections.recording_id = '4' AND detections.scientific_name = 'Gryllus fultoni'
+
+GET /db/detections?recording_id=4&recording_id=1&scientific_name=Gryllus%20fultoni
+# SQL: SELECT detections.* FROM detections
+#      WHERE detections.recording_id IN ('4', '1') AND detections.scientific_name = 'Gryllus fultoni'
+```
+
 ### Sorting and Pagination with `sql_append`
 
 Use `sql_append` to append clauses *after* the WHERE clause — for `ORDER BY`, `LIMIT`, `OFFSET`, etc. Fragments are appended in the order they appear in the YAML config, so **the YAML order must match valid SQL order** (ORDER BY before LIMIT before OFFSET).
@@ -663,30 +694,79 @@ API Dock supports cookie extraction and authentication for both remote APIs and
 
 ## Cookie Configuration
 
-Configure cookies to extract from incoming requests and make them available as template variables:
+### Forwarding client cookies
+
+Configure which cookies to extract from incoming requests and forward to the upstream API (or make available as template variables in SQL routes):
 
 ```yaml
-# Enable all cookies (default: false)
+# Forward all cookies from the client request
 cookies: true
 
-# Or specify specific cookies to extract
+# Forward only specific cookies
 cookies: [session_id, auth_token, user_preferences]
 
-# Disable all cookies (default behavior)
+# Forward no cookies (default behavior)
 cookies: false
 ```
 
-When `cookies: true`, all cookies are accepted and available. When `cookies: false` (default), no cookies are processed except authentication cookies when authentication is configured. When providing a list, only specified cookies are extracted.
+When `cookies: true`, all cookies are accepted and available. When `cookies: false` (default), no cookies are processed except authentication cookies when authentication is configured. When providing a list, only the named cookies are forwarded.
 
-Cookies can then be accessed in SQL queries using `{{cookies.cookie_name}}`:
+Forwarded cookies are accessible in SQL queries using `{{cookies.cookie_name}}`:
 
 ```yaml
-# Database route using cookies
 routes:
   - route: user/profile
     sql: SELECT * FROM [[users]] WHERE session_id = '{{cookies.session_id}}'
 ```
 
+### Injecting cookies from the server environment
+
+The `cookies` list also accepts dict entries to inject cookies into every outgoing upstream request, regardless of what the client sent. This is useful when the upstream API requires a server-side credential (e.g. a session token stored in an environment variable) rather than a cookie from the end user.
+
+Dict entries and string entries can be mixed freely in the same list.
+
+```yaml
+cookies:
+  - session_id                            # forward this cookie from the client request
+  - key: __Secure-authjs.session-token    # inject from environment variable
+    value: "env:SOUNDHUB_SESSION_TOKEN"
+```
+
+#### Dict entry forms
+
+| Form | Behaviour |
+|---|---|
+| `{key: NAME, value: "literal"}` | Inject cookie `NAME` with the literal string `"literal"` |
+| `{key: NAME, value: "env:MY_VAR"}` | Inject cookie `NAME` with the value of env var `MY_VAR`; empty string if unset |
+| `{key: MY_VAR}` | Shorthand — equivalent to `{key: MY_VAR, value: "env:MY_VAR"}` |
+
+The shorthand form uses the key as both the cookie name **and** the env var name. Use the explicit `value: "env:..."` form when the cookie name and the env var name differ (which is common — cookie names often contain characters that aren't valid env var names).
+
+#### Example: proxying an API that requires a session cookie
+
+```yaml
+# api_dock_config/remotes/my_service/1.0.yaml
+name: my_service
+url: https://api.example.com
+
+cookies:
+  - key: __Secure-authjs.session-token
+    value: "env:MY_SERVICE_SESSION_TOKEN"
+```
+
+Set the env var before starting api-dock:
+
+```bash
+export MY_SERVICE_SESSION_TOKEN="your-session-token-here"
+pixi run api-dock start
+```
+
+Every request proxied to `my_service` will include the `__Secure-authjs.session-token` cookie, even if the client did not send one.
+
+#### Injection precedence
+
+If an injected cookie has the same name as a forwarded client cookie, the injected value takes precedence. This ensures the server-side credential is always used, regardless of what the client sends.
+
 ## Authentication Configuration
 
 Configure authentication to validate requests before processing. Multiple authentication methods are supported:
@@ -1080,6 +1160,54 @@ pixi run jupyter lab .
 pixi run python scripts/hello_world.py
 ```
 
+---
+
+# Development
+
+## Publishing a Release
+
+```bash
+# 0. Make sure you are on `main` and merged with any changes
+
+# 1. Bump version in pyproject.toml
+
+# 2. Commit everything
+git add -A
+git commit -m "v0.6.1: stream proxy responses (fix large-response 502 + content-encoding)"
+
+# 3. Tag and push
+git tag v0.6.1
+git push origin main v0.6.1
+
+# 4. Build the wheel (requires the `dev` pixi environment)
+rm -rf dist/
+find . -name "__pycache__" -type d -exec rm -rf {} +
+find . -name "*.pyc" -delete
+pixi run -e dev python -m build --wheel
+ls dist/*.whl
+
+# 5. Create GitHub release with the wheel attached
+gh release create v0.6.1 dist/api_dock-0.6.1-py3-none-any.whl \
+    --title "v0.6.1" --notes "$(cat <<'EOF'
+* new features
+    - Remote proxy responses are now streamed (FastAPI) — upstream bytes are piped to the client as they arrive instead of being buffered fully in memory
+    - New `timeout` setting (default 10s) for the upstream request; set to `null`/`false` to disable
+* bug fixes
+    - Large upstream responses no longer return 502 — streamed via `StreamingResponse` instead of reading the whole body into memory
+    - `Content-Encoding` (gzip/br/deflate) is now preserved on compressed responses — raw bytes are streamed via `aiter_raw()` so the header stays valid and the client can decompress
+    - Slow upstreams (e.g. large aggregation queries) no longer 502 at httpx's hardcoded 5s default — the timeout is now configurable via the `timeout` setting
+* cleanup / other improvements
+    - Added `PreparedRequest` dataclass and split route validation/resolution into `RouteMapper.prepare_remote_request()`; the FastAPI adapter issues the streaming HTTP call
+    - `map_route()` (buffered) retained for the Flask/sync path
+    - Added streaming test coverage (`TestStreamUpstream`, plus `prepare_remote_request` and streaming-header tests) — 53 tests total
+EOF
+)"
+
+# 6. Publish to PyPI
+pixi run -e dev python -m twine upload dist/*.whl
+```
+
+
 ---
 
 # License

{api_dock-0.5.0 → api_dock-0.7.0}/api_dock/cli.py

@@ -459,15 +459,12 @@ def _list_configs() -> None:
 
     # Check for local configs
     local_dir = Path("api_dock_config")
-    config_dir = Path("config")
-
     local_configs = list(local_dir.glob("*.yaml")) if local_dir.exists() else []
-    config_configs = list(config_dir.glob("*.yaml")) if config_dir.exists() else []
 
-    # Check for package configs
+    # Check for bundled example configs
     try:
         import importlib.resources as pkg_resources
-        package_dir = Path(pkg_resources.files("api_dock") / "config")
+        package_dir = Path(pkg_resources.files("api_dock") / "example_api_dock_config")
         package_configs = list(package_dir.glob("*.yaml")) if package_dir.exists() else []
     except Exception:
         package_configs = []
@@ -478,17 +475,11 @@ def _list_configs() -> None:
             click.echo(f"  {config_file.stem}")
         click.echo()
     else:
-        click.echo("📁 Local configurations (api_dock_config/): None")
-        click.echo()
-
-    if config_configs:
-        click.echo("📁 Project configurations (config/):")
-        for config_file in sorted(config_configs):
-            click.echo(f"  {config_file.stem}")
+        click.echo("📁 Local configurations (api_dock_config/): None — run 'api-dock init' to create")
         click.echo()
 
     if package_configs:
-        click.echo("📦 Package configurations:")
+        click.echo("📦 Example configurations (run 'api-dock init' to copy to api_dock_config/):")
         for config_file in sorted(package_configs):
             click.echo(f"  {config_file.stem}")
         click.echo()

{api_dock-0.5.0 → api_dock-0.7.0}/api_dock/config.py

@@ -242,7 +242,10 @@ def get_settings(config: Dict[str, Any]) -> Dict[str, Any]:
 
 
 def get_cookies_config(config: Dict[str, Any]) -> List[str]:
-    """Extract cookie configuration from config.
+    """Extract cookie names to forward from incoming requests.
+
+    Only string entries in the ``cookies`` list are returned here. Dict entries
+    (cookie injection) are handled separately by ``resolve_inject_cookies``.
 
     Args:
         config: Configuration dictionary (main, remote, or database).
@@ -254,9 +257,7 @@ def get_cookies_config(config: Dict[str, Any]) -> List[str]:
     if not isinstance(cookies, list):
         return []
 
-    # Ensure all cookie names are strings
-    cookie_list = [str(cookie) for cookie in cookies if cookie]
-    return cookie_list
+    return [str(c) for c in cookies if c and isinstance(c, str)]
 
 
 def filter_cookies_by_config(cookies: Dict[str, str], config: Dict[str, Any]) -> Dict[str, str]:
@@ -288,23 +289,26 @@ def filter_cookies_by_config(cookies: Dict[str, str], config: Dict[str, Any]) ->
             else:
                 return {}
 
-    # Handle list of cookie names (existing behavior)
+    # Handle list — may contain string names (forward from client) and/or
+    # dict entries (inject from config/env var).
     elif isinstance(cookies_setting, list):
+        injected = resolve_inject_cookies(config)
         allowed_cookies = get_cookies_config(config)
+
         if not allowed_cookies:
-            # Empty list means no cookies allowed except authentication key
+            # No string entries — only auth key forwarded from client, plus injected.
+            result: Dict[str, str] = {}
             if auth_key and auth_key in cookies:
-                auth_only = {auth_key: cookies[auth_key]}
-                return auth_only
-            else:
-                return {}
+                result[auth_key] = cookies[auth_key]
+            result.update(injected)
+            return result
 
-        # Always include authentication key in allowed cookies
+        # Always include authentication key in forwarded set.
         if auth_key and auth_key not in allowed_cookies:
             allowed_cookies = allowed_cookies + [auth_key]
 
-        # Filter cookies to only include allowed ones
         filtered = {k: v for k, v in cookies.items() if k in allowed_cookies}
+        filtered.update(injected)
         return filtered
 
     # Default: no cookie configuration means only authentication key passed
@@ -316,6 +320,56 @@ def filter_cookies_by_config(cookies: Dict[str, str], config: Dict[str, Any]) ->
             return {}
 
 
+def resolve_inject_cookies(config: Dict[str, Any]) -> Dict[str, str]:
+    """Resolve dict entries in the ``cookies`` list into ready-to-send cookie values.
+
+    The ``cookies`` list accepts a mix of strings (names of client cookies to forward)
+    and dicts (cookies to inject into the outgoing request regardless of what the
+    client sent). This function handles the dict entries only.
+
+    Dict entry forms:
+
+    - ``{key: COOKIE_NAME, value: "literal-value"}`` — inject with a literal string.
+    - ``{key: COOKIE_NAME, value: "env:MY_ENV_VAR"}`` — inject with the value of
+      environment variable ``MY_ENV_VAR``; resolves to empty string if unset.
+    - ``{key: MY_ENV_VAR}`` — shorthand: no ``value`` means look up an env var whose
+      name equals the key (equivalent to ``{key: MY_ENV_VAR, value: "env:MY_ENV_VAR"}``).
+
+    Example YAML::
+
+        cookies:
+          - session_id                           # forward from client request
+          - key: __Secure-authjs.session-token
+            value: "env:SOUNDHUB_SESSION_TOKEN"  # inject from env var
+
+    Args:
+        config: Configuration dictionary (main, remote, or database).
+
+    Returns:
+        Dictionary mapping cookie names to their resolved string values.
+    """
+    cookies_setting = config.get("cookies", [])
+    if not isinstance(cookies_setting, list):
+        return {}
+
+    result: Dict[str, str] = {}
+    for entry in cookies_setting:
+        if not isinstance(entry, dict):
+            continue
+        key = entry.get("key")
+        if not key or not isinstance(key, str):
+            continue
+        raw_value = entry.get("value")
+        if raw_value is None:
+            value = os.environ.get(key, "")
+        elif isinstance(raw_value, str) and raw_value.startswith("env:"):
+            value = os.environ.get(raw_value[4:], "")
+        else:
+            value = str(raw_value)
+        result[key] = value
+    return result
+
+
 def get_authentication_config(config: Dict[str, Any]) -> Optional[Dict[str, Any]]:
     """Extract authentication configuration from config.
 
@@ -337,8 +391,6 @@ def get_authentication_config(config: Dict[str, Any]) -> Optional[Dict[str, Any]
     if "encrypted" not in auth_config:
         auth_config["encrypted"] = DEFAULT_AUTH_SETTINGS["encrypted"]
 
-    auth_key = auth_config.get("key", "UNKNOWN")
-    auth_method = auth_config.get("method", "UNKNOWN")
     return auth_config
 
 
@@ -618,25 +670,29 @@ def find_route_mapping(full_route: str, method: str, remote_config: Dict[str, An
 
 
 def filter_remote_query_params(
-    query_params: Dict[str, str],
+    query_params: Dict[str, Any],
     route: str,
     method: str,
     remote_config: Dict[str, Any]
-) -> Dict[str, str]:
+) -> Dict[str, Any]:
     """Filter query parameters based on remote config settings.
 
     Checks for a route-level query_params setting first, then falls back
     to the top-level remote config query_params. If neither exists, all
     params are passed through unchanged (backward compatible).
 
+    Filtering is by key only, so values may be strings or lists of strings
+    (the latter forwarding repeated keys such as ?id=1&id=2 intact).
+
     Args:
-        query_params: Original query parameters from the request.
+        query_params: Original query parameters from the request. Values may be
+            strings or lists of strings.
         route: The actual route path (e.g., "users/123").
         method: HTTP method (e.g., "GET", "POST").
         remote_config: Remote configuration dictionary.
 
     Returns:
-        Filtered query parameters dictionary.
+        Filtered query parameters dictionary (value types preserved).
     """
     routes = remote_config.get("routes", [])