duckdb-kql 0.0.1.dev4__tar.gz → 0.0.1.dev5__tar.gz

{duckdb_kql-0.0.1.dev4 → duckdb_kql-0.0.1.dev5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: duckdb-kql
-Version: 0.0.1.dev4
+Version: 0.0.1.dev5
 Summary: Run Kusto KQL queries on DuckDB, from Python
 Project-URL: Homepage, https://github.com/mmaitre314/duckdb-kql
 Project-URL: Documentation, https://github.com/mmaitre314/duckdb-kql/blob/main/docs/getting-started.md
@@ -44,6 +44,7 @@ Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Database
 Classifier: Topic :: Database :: Front-Ends
 Classifier: Topic :: Scientific/Engineering :: Information Analysis

{duckdb_kql-0.0.1.dev4 → duckdb_kql-0.0.1.dev5}/docs/kusto-server.md

@@ -66,6 +66,13 @@ https://dataexplorer.azure.us
 `--allow-origin` replaces that list. Widening it is a decision about who may read
 this database from another browser tab, not a formatting preference.
 
+The **origin** is the whole check. Request *headers* are not: a preflight echoes
+back whatever `Access-Control-Request-Headers` asked for, because naming a header
+authorises nothing and a hand-written list is only a second place to be wrong
+about someone else's client. It was wrong once — the list said `x-ms-user` where
+the web UI sends `x-ms-user-id`, and the browser answered by failing the real
+POST with a bare `net::ERR_FAILED` after a preflight that returned 204.
+
 **Nothing it serves can write.** The translated surface is read-only: no
 supported KQL operator produces a statement that modifies the database, and
 control commands that would administer a cluster are refused rather than

{duckdb_kql-0.0.1.dev4 → duckdb_kql-0.0.1.dev5}/pyproject.toml

@@ -31,6 +31,7 @@ classifiers = [
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
     "Topic :: Database",
     "Topic :: Database :: Front-Ends",
     "Topic :: Software Development :: Compilers",
@@ -167,7 +168,7 @@ files = ["src/duckdb_kql"]
 # way, and the next dependency to adopt the syntax would do it again. Letting
 # each interpreter check against itself is more robust *and* better coverage:
 # CI runs the floor and the ceiling, so 3.10-incompatible code fails on the
-# 3.10 lane while the newest semantics are exercised on the 3.13 one.
+# 3.10 lane while the newest semantics are exercised on the newest one.
 disallow_untyped_defs = true
 disallow_incomplete_defs = true
 disallow_untyped_calls = true

{duckdb_kql-0.0.1.dev4 → duckdb_kql-0.0.1.dev5}/src/duckdb_kql/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.0.1.dev4'
-__version_tuple__ = version_tuple = (0, 0, 1, 'dev4')
+__version__ = version = '0.0.1.dev5'
+__version_tuple__ = version_tuple = (0, 0, 1, 'dev5')
 
 __commit_id__ = commit_id = None

{duckdb_kql-0.0.1.dev4 → duckdb_kql-0.0.1.dev5}/src/duckdb_kql/server.py

@@ -41,6 +41,7 @@ import uuid
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from typing import TYPE_CHECKING, Any, NamedTuple, cast
 
+from . import __version__
 from .control import SCHEMA, CommandColumn, is_control_command, split_command
 from .errors import KqlError
 from .types import kusto_type, rest_datatype
@@ -347,11 +348,18 @@ def error_response(message: str, *, code: str = "General_BadRequest") -> dict[st
 
 _LOOPBACK = re.compile(r"^(127\.\d+\.\d+\.\d+|::1)$")
 
+#: Only for a preflight that names no headers, which no browser sends — a
+#: preflight exists *because* there is something non-simple to declare. Kept so
+#: the header is never emitted empty.
+_DEFAULT_ALLOW_HEADERS = "Authorization, Content-Type, Accept"
+
 
 class _Handler(BaseHTTPRequestHandler):
     """One request. The connection and the allow-list come from the server."""
 
-    server_version = f"duckdb-kql/{CLUSTER_NAME}"
+    # `duckdb-kql/0.1.2`, not `duckdb-kql/duckdb-kql`: the slot after the slash
+    # is a version, and this used to interpolate the cluster name into it.
+    server_version = f"duckdb-kql/{__version__}"
     # Announce HTTP/1.1 so the web UI's keep-alive works; every response below
     # sets Content-Length, which is what makes that safe.
     protocol_version = "HTTP/1.1"
@@ -406,17 +414,37 @@ class _Handler(BaseHTTPRequestHandler):
         self.send_response(204)
         self.send_header("Access-Control-Allow-Origin", origin)
         self.send_header("Access-Control-Allow-Methods", "POST, GET, OPTIONS")
-        self.send_header(
-            "Access-Control-Allow-Headers",
-            "Authorization, Content-Type, x-ms-client-request-id, "
-            "x-ms-app, x-ms-user, x-ms-client-version, Accept, Connection",
-        )
+        self.send_header("Access-Control-Allow-Headers", self._allow_headers())
+        # Only when asked. Chrome gates requests from a public page to a private
+        # address behind this; answering unprompted would claim a policy the
+        # browser did not ask about.
+        if self.headers.get("Access-Control-Request-Private-Network") == "true":
+            self.send_header("Access-Control-Allow-Private-Network", "true")
         self.send_header("Access-Control-Allow-Credentials", "true")
         self.send_header("Access-Control-Max-Age", "600")
-        self.send_header("Vary", "Origin")
+        self.send_header("Vary", "Origin, Access-Control-Request-Headers")
         self.send_header("Content-Length", "0")
         self.end_headers()
 
+    def _allow_headers(self) -> str:
+        """The request headers the preflight permits: whatever was asked for.
+
+        Echoed rather than listed, because a hand-written list is a second place
+        to be wrong about someone else's client. It *was* wrong: the list said
+        `x-ms-user` where the Azure Data Explorer UI sends `x-ms-user-id`, CORS
+        matches header names exactly, and the browser answered by failing the
+        real POST with a bare `net::ERR_FAILED` — a preflight that returned 204
+        and still blocked the request. Every header the UI adds in future would
+        break it the same way.
+
+        This gives up nothing. Naming a header does not authorise anything; the
+        origin allow-list and the loopback bind are what decide who may talk to
+        this endpoint, and both are checked before we get here. `*` would be the
+        lazy version of this and is not equivalent — it is invalid alongside
+        `Allow-Credentials: true`, which is why the exact list is echoed back.
+        """
+        return self.headers.get("Access-Control-Request-Headers", _DEFAULT_ALLOW_HEADERS)
+
     def do_GET(self) -> None:  # noqa: N802 - BaseHTTPRequestHandler's interface
         """A human landing page. Anything else 404s."""
         if not self._is_local():

{duckdb_kql-0.0.1.dev4 → duckdb_kql-0.0.1.dev5}/tests/test_server.py

@@ -146,16 +146,110 @@ def test_an_unknown_route_is_a_404_not_a_crash(server) -> None:
 # ---------------------------------------------------------------------------
 
 
+#: What Chrome asks for on behalf of the Azure Data Explorer UI, captured
+#: verbatim from a `dataexplorer.azure.com` HAR against this server.
+ADX_REQUEST_HEADERS = "authorization,content-type,x-ms-app,x-ms-client-request-id,x-ms-user-id"
+
+
+def preflight(server: Any, requested: str = ADX_REQUEST_HEADERS, *, origin: str = ALLOWED_ORIGIN):
+    request = urllib.request.Request(server.url + "/v1/rest/mgmt", method="OPTIONS")
+    request.add_header("Origin", origin)
+    request.add_header("Access-Control-Request-Method", "POST")
+    request.add_header("Access-Control-Request-Headers", requested)
+    try:
+        with urllib.request.urlopen(request, timeout=10) as response:
+            return response.status, dict(response.headers)
+    except urllib.error.HTTPError as exc:
+        with exc:
+            return exc.status, dict(exc.headers)
+
+
 def test_a_preflight_from_the_web_ui_is_allowed(server) -> None:
-    status, headers, _ = call(server, "/v1/rest/mgmt", method="OPTIONS", origin=ALLOWED_ORIGIN)
+    status, headers = preflight(server)
     assert status == 204
     assert headers["Access-Control-Allow-Origin"] == ALLOWED_ORIGIN
     assert "POST" in headers["Access-Control-Allow-Methods"]
-    # The UI sends these; a preflight that does not list them fails in the
-    # browser before the real request is ever made.
-    permitted = headers["Access-Control-Allow-Headers"].lower()
-    assert "authorization" in permitted
-    assert "x-ms-client-request-id" in permitted
+
+
+def test_the_preflight_covers_every_header_the_web_ui_asks_for(server) -> None:
+    """The check a browser actually performs, done the way it performs it.
+
+    A preflight can return 204 and still block the request: the browser compares
+    `Access-Control-Request-Headers` against `Access-Control-Allow-Headers` and
+    fails the *real* call — as a bare `net::ERR_FAILED`, with nothing in the
+    response to point at. That happened, because the allow-list said `x-ms-user`
+    where the UI sends `x-ms-user-id`, and asserting "authorization is in the
+    string" did not catch it. Set coverage is the assertion that would have.
+    """
+    _, headers = preflight(server)
+    allowed = {h.strip().lower() for h in headers["Access-Control-Allow-Headers"].split(",")}
+    asked = [h.strip().lower() for h in ADX_REQUEST_HEADERS.split(",")]
+    assert not [h for h in asked if h not in allowed], (
+        f"preflight would block the request: {headers['Access-Control-Allow-Headers']}"
+    )
+
+
+def test_a_header_the_ui_adds_later_does_not_break_the_preflight(server) -> None:
+    """Echoing is the point: the previous list broke the moment the UI changed."""
+    _, headers = preflight(server, "content-type,x-ms-invented-tomorrow")
+    allowed = {h.strip().lower() for h in headers["Access-Control-Allow-Headers"].split(",")}
+    assert "x-ms-invented-tomorrow" in allowed
+
+
+def test_the_preflight_never_answers_with_a_wildcard(server) -> None:
+    """`*` is invalid next to `Allow-Credentials: true`, so it is not a shortcut.
+
+    Echoing the requested list is not a wildcard in disguise either — what
+    decides who may reach this endpoint is the origin allow-list and the
+    loopback bind, both checked before a header name is ever read.
+    """
+    _, headers = preflight(server)
+    assert headers["Access-Control-Allow-Headers"] != "*"
+    assert headers["Access-Control-Allow-Origin"] == ALLOWED_ORIGIN
+    assert "Access-Control-Request-Headers" in headers.get("Vary", "")
+
+
+def test_the_preflight_answers_the_private_network_question_only_when_asked(server) -> None:
+    """Chrome gates a public page reaching a private address behind this."""
+    request = urllib.request.Request(server.url + "/v1/rest/mgmt", method="OPTIONS")
+    request.add_header("Origin", ALLOWED_ORIGIN)
+    request.add_header("Access-Control-Request-Method", "POST")
+    request.add_header("Access-Control-Request-Private-Network", "true")
+    with urllib.request.urlopen(request, timeout=10) as response:
+        assert response.headers["Access-Control-Allow-Private-Network"] == "true"
+
+    _, headers = preflight(server)
+    assert "Access-Control-Allow-Private-Network" not in headers
+
+
+def test_the_post_the_web_ui_makes_after_the_preflight_succeeds(server) -> None:
+    """The request the browser blocked. End to end, with the UI's own headers."""
+    request = urllib.request.Request(
+        server.url + "/v1/rest/mgmt",
+        data=json.dumps({"csl": ".show version", "properties": None}).encode(),
+        headers={
+            "Content-Type": "application/json; charset=UTF-8",
+            "Accept": "application/json",
+            "Origin": ALLOWED_ORIGIN,
+            "x-ms-app": "Kusto.Web.KWE:2.259.0-5|embeddedIn:dataexplorer.azure.com",
+            "x-ms-client-request-id": "Kusto.Web.KWE.Query;29e3ba3d;740cd2cb",
+            "x-ms-user-id": "someone",
+            "Authorization": "Bearer ignored",
+        },
+    )
+    with urllib.request.urlopen(request, timeout=10) as response:
+        assert response.status == 200
+        assert response.headers["Access-Control-Allow-Origin"] == ALLOWED_ORIGIN
+        payload = json.loads(response.read())
+    assert payload["Tables"][0]["Columns"][0]["ColumnName"] == "BuildVersion"
+
+
+def test_the_server_header_reports_a_version(server) -> None:
+    """It read `duckdb-kql/duckdb-kql` — the cluster name in the version slot."""
+    from duckdb_kql import __version__  # noqa: PLC0415
+
+    _, headers, _ = call(server, "/", method="GET")
+    assert headers["Server"].startswith(f"duckdb-kql/{__version__} ")
 
 
 def test_a_preflight_from_anywhere_else_is_refused(server) -> None:

{duckdb_kql-0.0.1.dev4 → duckdb_kql-0.0.1.dev5}/tests/test_workflows.py

@@ -52,9 +52,10 @@ def test_ci_runs_on_pushes_to_main() -> None:
 def test_the_ci_matrix_spans_the_supported_range() -> None:
     """The lanes must be the floor and the ceiling of what we claim to support.
 
-    Claiming 3.10–3.13 and testing 3.10–3.11 is how a 3.13-only failure reaches
-    ``main``: numpy 2.5 ships stubs using PEP 695 syntax and only resolves on
-    the newer interpreters, so it broke a lane nobody had run locally.
+    Claiming a version and never running it is how a version-specific failure
+    reaches ``main``: numpy 2.5 ships stubs using PEP 695 syntax that only
+    resolves on the newer interpreters, and it broke a lane nobody had run
+    locally. So adding a classifier without adding the lane fails here.
     """
     from conftest import read_pyproject  # noqa: PLC0415