queryapigate 0.22.0__tar.gz → 0.22.1__tar.gz

{queryapigate-0.22.0/queryapigate.egg-info → queryapigate-0.22.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: queryapigate
-Version: 0.22.0
+Version: 0.22.1
 Summary: Turn SQL into governed REST APIs over MySQL, PostgreSQL, ClickHouse, SQLite, DuckDB, H2, MongoDB, and Parquet/CSV/JSON files - JSON, CSV, Parquet or Excel out, with scoped keys, an admin Console and MCP for AI agents.
 Author-email: Anantha Raju C <arcswdev@gmail.com>
 License-Expression: FSL-1.1-MIT

{queryapigate-0.22.0 → queryapigate-0.22.1}/queryapigate/__init__.py

@@ -1,5 +1,5 @@
 """QueryAPIGate - expose SQL databases as a REST API."""
-__version__ = '0.22.0'
+__version__ = '0.22.1'
 
 from .app import create_app  # noqa: E402  (app imports __version__)
 

{queryapigate-0.22.0 → queryapigate-0.22.1}/queryapigate/app.py

@@ -607,6 +607,14 @@ def execute_mongo_endpoint():
     return render(result, output_format, page, limit)
 
 
+def _client_cache_control(ttl):
+    """How long the *caller* may keep a cached response - `private`, so only the caller's own client may: a request
+    authenticates with X-API-Key, not Authorization, so HTTP's rule keeping authenticated responses out of shared
+    caches (RFC 9111 3.5) doesn't apply, and a CDN or caching proxy in front would otherwise keep one caller's rows -
+    masked for its key - and serve them to the next caller of that URL, with any key or none."""
+    return f'private, max-age={ttl}'
+
+
 def cache_lookup(cache_key, ttl):
     """A live entry rendered as a response (304 if the client already has it), or None on a cache miss."""
     hit = current_app.extensions['queryapigate_cache'].get(cache_key)
@@ -621,7 +629,7 @@ def cache_lookup(cache_key, ttl):
         for name, value in headers:
             response.headers[name] = value
     response.headers['ETag'] = quoted
-    response.headers['Cache-Control'] = f'max-age={ttl}'
+    response.headers['Cache-Control'] = _client_cache_control(ttl)
     response.headers['X-Cache'] = 'HIT'
     return response
 
@@ -635,7 +643,7 @@ def cache_store(cache_key, response, ttl, meta=None):
     etag = current_app.extensions['queryapigate_cache'].set(cache_key, response.get_data(), response.content_type,
                                                        replay_headers, ttl, meta)
     response.headers['ETag'] = f'"{etag}"'
-    response.headers['Cache-Control'] = f'max-age={ttl}'
+    response.headers['Cache-Control'] = _client_cache_control(ttl)
     response.headers['X-Cache'] = 'MISS'
     return response
 

{queryapigate-0.22.0 → queryapigate-0.22.1/queryapigate.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: queryapigate
-Version: 0.22.0
+Version: 0.22.1
 Summary: Turn SQL into governed REST APIs over MySQL, PostgreSQL, ClickHouse, SQLite, DuckDB, H2, MongoDB, and Parquet/CSV/JSON files - JSON, CSV, Parquet or Excel out, with scoped keys, an admin Console and MCP for AI agents.
 Author-email: Anantha Raju C <arcswdev@gmail.com>
 License-Expression: FSL-1.1-MIT

{queryapigate-0.22.0 → queryapigate-0.22.1}/tests/test_response_cache.py

@@ -371,9 +371,13 @@ class CacheHeaderTests(AppTestCase):
         first = self.client.get('/q/q?id=1')
         self.assertEqual(first.headers['X-Cache'], 'MISS')
         self.assertIn('ETag', first.headers)
-        self.assertEqual(first.headers['Cache-Control'], 'max-age=60')
+        self.assertEqual(first.headers['Cache-Control'], 'private, max-age=60')
         second = self.client.get('/q/q?id=1')
         self.assertEqual(second.headers['X-Cache'], 'HIT')
+        # private on a hit and a 304 too: no shared cache in front may keep one caller's rows for the next caller
+        self.assertEqual(second.headers['Cache-Control'], 'private, max-age=60')
+        unchanged = self.client.get('/q/q?id=1', headers={'If-None-Match': first.headers['ETag']})
+        self.assertEqual((unchanged.status_code, unchanged.headers['Cache-Control']), (304, 'private, max-age=60'))
         self.assertEqual(second.get_data(), first.get_data())
         self.assertEqual(second.headers['ETag'], first.headers['ETag'])