queryapigate 0.34.1__tar.gz → 0.34.2__tar.gz

{queryapigate-0.34.1/queryapigate.egg-info → queryapigate-0.34.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: queryapigate
-Version: 0.34.1
+Version: 0.34.2
 Summary: Turn SQL into governed REST APIs over MySQL, PostgreSQL, ClickHouse, SQLite, DuckDB, H2, MongoDB, and Parquet/CSV/JSON files - JSON, CSV, Parquet or Excel out, with scoped keys, an admin Console and MCP for AI agents.
 Author-email: Anantha Raju C <arcswdev@gmail.com>
 License-Expression: FSL-1.1-MIT

{queryapigate-0.34.1 → queryapigate-0.34.2}/queryapigate/__init__.py

@@ -1,5 +1,5 @@
 """QueryAPIGate - expose SQL databases as a REST API."""
-__version__ = "0.34.1"
+__version__ = "0.34.2"
 
 from .app import create_app  # noqa: E402  (app imports __version__)
 

{queryapigate-0.34.1 → queryapigate-0.34.2}/queryapigate/definitions.py

@@ -150,6 +150,7 @@ def validate_definition(data):
         for extra in ('mongo_projection', 'mongo_sort'):
             if data.get(extra) is not None:
                 fields[extra] = as_object(data.get(extra), extra)
+        mongotools.validate_options(fields.get('mongo_projection'), fields.get('mongo_sort'))
     else:
         fields['sql_query'] = data['sql_query']
     return fields, collection

{queryapigate-0.34.1 → queryapigate-0.34.2}/queryapigate/engine.py

@@ -151,6 +151,7 @@ def execute_mongo(collection, filter_doc, connection_name, limit, offset, params
     if details['db'] != 'mongo':
         raise ApiError(f"'{connection_name}' is not a mongo connection", code='wrong_connection_type')
     filter_doc = mongotools.validate_filter(filter_doc or {})
+    mongotools.validate_options(projection, sort)
     timeout, limit = limits.timeout(timeout), limits.rows(limit)
     if params:
         filter_doc = mongotools.fill_placeholders(filter_doc, params)

{queryapigate-0.34.1 → queryapigate-0.34.2}/queryapigate/mongotools.py

@@ -55,10 +55,20 @@ def fill_placeholders(filter_doc, values):
 
     Unlike sqltools.fill_placeholders, this never produces text to re-parse - the substituted value becomes
     a real value in the returned document, so it can be a number, bool or null, not just safe text.
+
+    A value is a scalar, or a list of them - never a document. An object there is an operator the query's author
+    didn't write: `{"name": ":u"}` given `{"$ne": null}` matches every document, and `{"$function": ...}` runs
+    JavaScript on the server, past validate_filter(), which saw only the placeholder.
     """
-    missing = sorted(set(placeholder_names(filter_doc)) - set(values))
+    used = set(placeholder_names(filter_doc))
+    missing = sorted(used - set(values))
     if missing:
         raise ApiError(f"No value provided for placeholder(s): {', '.join(missing)}", code='param_required')
+    for name in sorted(used):
+        value = values[name]
+        if isinstance(value, dict) or (isinstance(value, list) and any(isinstance(v, (dict, list)) for v in value)):
+            raise ApiError(f"'{name}' must be a value or a list of values, not a document - it would be read as "
+                           'query operators', code='param_invalid')
     return _substitute(filter_doc, values)
 
 
@@ -81,3 +91,11 @@ def validate_filter(filter_doc):
         raise ApiError('filter must be a JSON object', code='invalid_filter')
     _check_forbidden(filter_doc)
     return filter_doc
+
+
+def validate_options(projection, sort):
+    """The same check over a find()'s projection and sort: MongoDB 4.4+ evaluates aggregation expressions in a
+    projection, so `{"x": {"$function": ...}}` there runs JavaScript on the server as surely as in the filter."""
+    for document in (projection, sort):
+        if document is not None:
+            _check_forbidden(document)

{queryapigate-0.34.1 → queryapigate-0.34.2/queryapigate.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: queryapigate
-Version: 0.34.1
+Version: 0.34.2
 Summary: Turn SQL into governed REST APIs over MySQL, PostgreSQL, ClickHouse, SQLite, DuckDB, H2, MongoDB, and Parquet/CSV/JSON files - JSON, CSV, Parquet or Excel out, with scoped keys, an admin Console and MCP for AI agents.
 Author-email: Anantha Raju C <arcswdev@gmail.com>
 License-Expression: FSL-1.1-MIT

{queryapigate-0.34.1 → queryapigate-0.34.2}/tests/test_events_server.py

@@ -119,7 +119,9 @@ class EventServerTestCase(unittest.TestCase):
             asyncio.run_coroutine_threadsafe(server.stop(), loop).result(10)
             # Wait for the loop's worker threads too (asyncio.to_thread - checking a key opens a store connection):
             # one still connecting when the test's patched environment is restored reads os.environ while it is
-            # being changed, which libpq does in C - and that crashes the interpreter, not just the test.
+            # being changed, which libpq does in C - and that crashes the interpreter, not just the test. For the
+            # same reason a test never changes os.environ while the server runs: it patches the config function that
+            # reads the setting instead (CI on a PostgreSQL store, 2026-10-14: a segfault in the metrics test).
             asyncio.run_coroutine_threadsafe(loop.shutdown_default_executor(), loop).result(10)
             loop.call_soon_threadsafe(loop.stop)
             thread.join(5)
@@ -312,7 +314,7 @@ class EventLogTests(EventServerTestCase):
 
     def test_a_run_sampled_out_of_history_is_still_an_event(self):
         stream = self.open('admin')
-        with mock.patch.dict(os.environ, {'QUERYAPIGATE_HISTORY_SAMPLE_RATE': '0.000001'}):
+        with mock.patch.object(config, 'history_sample_rate', return_value=0.000001):  # see start_server()
             self.run_query(self.alice)
         (_, payload), = stream.events(1)
         self.assertEqual(payload['query'], 'q')
@@ -332,7 +334,7 @@ class EventLogTests(EventServerTestCase):
         with db.transaction() as conn:
             for occurred_at in ('2026-01-01 00:00:00', '2026-01-02 11:00:00', '2026-01-02 13:00:00'):
                 conn.execute(events.INSERT, events.run_columns('q', 1, {'executed_at': occurred_at}))
-        with mock.patch.dict(os.environ, {'QUERYAPIGATE_EVENTS_RETENTION_HOURS': '12'}):
+        with mock.patch.object(config, 'events_retention_hours', return_value=12):
             self.assertEqual(events.sweep(now=datetime(2026, 1, 3, 0, 0)), 2)
         self.assertEqual([row[0] for row in db.connection().execute('SELECT occurred_at FROM events')],
                          ['2026-01-02 13:00:00'])
@@ -415,7 +417,7 @@ class MetricsTests(EventServerTestCase):
         self.assertIn('queryapigate_events_lag_seconds_count 1\n', text)
 
     def test_the_metrics_token_applies(self):
-        with mock.patch.dict(os.environ, {'QUERYAPIGATE_METRICS_TOKEN': 'sesame'}):
+        with mock.patch.object(config, 'metrics_token', return_value='sesame'):
             self.assertEqual(self.metrics().status, 401)
             self.assertEqual(self.metrics(Authorization='Bearer sesame').status, 200)
 
@@ -447,7 +449,7 @@ class LimitTests(EventServerTestCase):
         self.assertEqual((refused.status, refused.headers['retry-after']), (503, '5'))
 
     def test_the_server_wide_rate_limit_applies_to_connection_attempts(self):
-        with mock.patch.dict(os.environ, {'QUERYAPIGATE_RATE_LIMIT': '2/minute'}):
+        with mock.patch.object(config, 'rate_limit', return_value=config.parse_rate_limit('2/minute')):
             statuses = [self.open('admin').status for _ in range(3)]
         self.assertEqual(statuses, [200, 200, 429])
 
@@ -470,7 +472,7 @@ class LimitTests(EventServerTestCase):
 
 class CorsTests(EventServerTestCase):
     def test_an_allowed_origin_gets_cors_headers_and_a_preflight(self):
-        with mock.patch.dict(os.environ, {'QUERYAPIGATE_CORS_ORIGINS': 'https://app.example.com'}):
+        with mock.patch.object(config, 'cors_origins', return_value=frozenset({'https://app.example.com'})):
             preflight = Stream(self.server.port, method='OPTIONS', headers={
                 'Origin': 'https://app.example.com', 'Access-Control-Request-Method': 'GET'})
             self.assertEqual(preflight.status, 204)

{queryapigate-0.34.1 → queryapigate-0.34.2}/tests/test_jwt.py

@@ -371,6 +371,11 @@ class EventsServerTests(JwtTestCase):
         from queryapigate import events
         from tests.test_events_server import Stream
         self.events, self.Stream = events, Stream
+        # Before the server starts, and undone after it stops: its worker threads open store connections, and
+        # libpq reads os.environ from C - changing it meanwhile crashes the interpreter (see test_events_server).
+        patcher = mock.patch.dict(os.environ, {'QUERYAPIGATE_HISTORY_FLUSH_INTERVAL': '0'})
+        patcher.start()
+        self.addCleanup(patcher.stop)
         loop = asyncio.new_event_loop()
         thread = threading.Thread(target=loop.run_forever, daemon=True)
         thread.start()
@@ -380,13 +385,11 @@ class EventsServerTests(JwtTestCase):
 
         def stop():
             asyncio.run_coroutine_threadsafe(server.stop(), loop).result(10)
+            asyncio.run_coroutine_threadsafe(loop.shutdown_default_executor(), loop).result(10)
             loop.call_soon_threadsafe(loop.stop)
             thread.join(5)
             loop.close()
         self.addCleanup(stop)
-        patcher = mock.patch.dict(os.environ, {'QUERYAPIGATE_HISTORY_FLUSH_INTERVAL': '0'})
-        patcher.start()
-        self.addCleanup(patcher.stop)
 
     def open(self, value):
         stream = self.Stream(self.server.port, headers=bearer(value))

{queryapigate-0.34.1 → queryapigate-0.34.2}/tests/test_mongotools.py

@@ -35,6 +35,17 @@ class FillPlaceholdersTests(unittest.TestCase):
         self.assertEqual(result['age']['$gte'], 21)
         self.assertIsInstance(result['age']['$gte'], int)
 
+    def test_a_document_is_never_a_value(self):
+        # Until 0.34.2 an undeclared placeholder took whatever JSON was sent: {"$ne": null} matched every document,
+        # and {"$function": ...} ran server-side JavaScript past validate_filter(), which saw only ':u'.
+        for value in ({'$ne': None}, {'$function': {'body': 'function() {}', 'args': [], 'lang': 'js'}},
+                      [{'$gt': ''}], [['nested']]):
+            with self.subTest(value=value), self.assertRaises(ApiError) as caught:
+                mongotools.fill_placeholders({'name': ':u'}, {'u': value})
+            self.assertEqual(caught.exception.code, 'param_invalid')
+        self.assertEqual(mongotools.fill_placeholders({'name': {'$in': ':u'}}, {'u': ['a', 2, None]}),
+                         {'name': {'$in': ['a', 2, None]}})  # a list of values is still a value
+
     def test_substitutes_inside_a_list(self):
         result = mongotools.fill_placeholders({'status': {'$in': [':a', ':b']}}, {'a': 'x', 'b': 'y'})
         self.assertEqual(result['status']['$in'], ['x', 'y'])

{queryapigate-0.34.1 → queryapigate-0.34.2}/tests/test_queryapigate.py

@@ -1780,6 +1780,35 @@ class MongoQueryTests(ApiTestCase):
             'collection': 'users', 'filter': {'$where': 'true'}, 'connection_name': 'mg'})
         self.assertEqual(res.status_code, 403)
 
+    def test_server_side_javascript_is_refused_in_a_projection_and_a_sort_too(self):
+        # Until 0.34.2 only the filter was checked: MongoDB 4.4+ evaluates aggregation expressions in a find()
+        # projection, so {"x": {"$function": ...}} there ran JavaScript on the database server.
+        js = {'$function': {'body': 'function() { return 1; }', 'args': [], 'lang': 'js'}}
+        for field in ('projection', 'sort'):
+            with self.subTest(field=field), mock.patch('pymongo.MongoClient') as connect:
+                res = self.client.post('/execute_mongo', json={
+                    'collection': 'users', 'connection_name': 'mg', field: {'x': js}})
+                self.assertEqual((res.status_code, res.get_json()['code']), (403, 'mongo_operator_forbidden'))
+                self.assertFalse(connect.called)
+        saved = save_query(self.client, {
+            'filename': 'js', 'author': 'a', 'description': 'd', 'query_type': 'mongo', 'mongo_collection': 'users',
+            'mongo_filter': {}, 'mongo_projection': {'x': {'$accumulator': {}}}, 'connection_name': 'mg'})
+        self.assertEqual((saved.status_code, saved.get_json()['code']), (403, 'mongo_operator_forbidden'))
+
+    def test_a_caller_cant_turn_a_parameter_into_operators(self):
+        # Until 0.34.2: a saved query's undeclared placeholder, given {"$ne": null}, matched every document.
+        self.assertEqual(save_query(self.client, {
+            'filename': 'by_name', 'author': 'a', 'description': 'd', 'query_type': 'mongo',
+            'mongo_collection': 'users', 'mongo_filter': {'name': ':u'}, 'connection_name': 'mg'}).status_code, 201)
+        with mock.patch('pymongo.MongoClient') as connect:
+            saved = self.client.post('/q/by_name', json={'params': {'u': {'$ne': None}}})
+            adhoc = self.client.post('/execute_mongo', json={
+                'collection': 'users', 'connection_name': 'mg', 'filter': {'$expr': ':p'},
+                'params': {'p': {'$function': {'body': 'function() { return true; }', 'args': [], 'lang': 'js'}}}})
+        for res in (saved, adhoc):
+            self.assertEqual((res.status_code, res.get_json()['code']), (400, 'param_invalid'))
+        self.assertFalse(connect.called)
+
     def test_collection_is_required(self):
         res = self.client.post('/execute_mongo', json={'filter': {}, 'connection_name': 'mg'})
         self.assertEqual(res.status_code, 400)