queryapigate 0.34.2__tar.gz → 0.35.1__tar.gz

{queryapigate-0.34.2/queryapigate.egg-info → queryapigate-0.35.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: queryapigate
-Version: 0.34.2
+Version: 0.35.1
 Summary: Turn SQL into governed REST APIs over MySQL, PostgreSQL, ClickHouse, SQLite, DuckDB, H2, MongoDB, and Parquet/CSV/JSON files - JSON, CSV, Parquet or Excel out, with scoped keys, an admin Console and MCP for AI agents.
 Author-email: Anantha Raju C <arcswdev@gmail.com>
 License-Expression: FSL-1.1-MIT
@@ -84,6 +84,8 @@ Dynamic: license-file
 [![PyPI downloads](https://img.shields.io/pypi/dm/queryapigate.svg)](https://pypi.org/project/queryapigate/)
 [![License: FSL-1.1-MIT](https://img.shields.io/badge/license-FSL--1.1--MIT-blue.svg)](https://github.com/AnanthaRajuC/QueryAPIGate/blob/main/LICENSE)
 ![Python](https://img.shields.io/badge/python-3.11%2B-blue)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/AnanthaRajuC/QueryAPIGate/badge)](https://scorecard.dev/viewer/?uri=github.com/AnanthaRajuC/QueryAPIGate)
+[![SLSA 2](https://slsa.dev/images/gh-badge-level2.svg)](https://github.com/AnanthaRajuC/QueryAPIGate/blob/main/SECURITY.md#slsa-level)
 
 ### Turn SQL queries into secure, governed REST APIs.
 

{queryapigate-0.34.2 → queryapigate-0.35.1}/README.md

@@ -6,6 +6,8 @@
 [![PyPI downloads](https://img.shields.io/pypi/dm/queryapigate.svg)](https://pypi.org/project/queryapigate/)
 [![License: FSL-1.1-MIT](https://img.shields.io/badge/license-FSL--1.1--MIT-blue.svg)](https://github.com/AnanthaRajuC/QueryAPIGate/blob/main/LICENSE)
 ![Python](https://img.shields.io/badge/python-3.11%2B-blue)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/AnanthaRajuC/QueryAPIGate/badge)](https://scorecard.dev/viewer/?uri=github.com/AnanthaRajuC/QueryAPIGate)
+[![SLSA 2](https://slsa.dev/images/gh-badge-level2.svg)](https://github.com/AnanthaRajuC/QueryAPIGate/blob/main/SECURITY.md#slsa-level)
 
 ### Turn SQL queries into secure, governed REST APIs.
 

{queryapigate-0.34.2 → queryapigate-0.35.1}/queryapigate/__init__.py

@@ -1,5 +1,5 @@
 """QueryAPIGate - expose SQL databases as a REST API."""
-__version__ = "0.34.2"
+__version__ = "0.35.1"
 
 from .app import create_app  # noqa: E402  (app imports __version__)
 

{queryapigate-0.34.2 → queryapigate-0.35.1}/queryapigate/apikeys.py

@@ -450,8 +450,10 @@ def is_expired(entry):
         return False
     try:
         deadline = datetime.strptime(expires_at, '%Y-%m-%d').replace(hour=23, minute=59, second=59)
-    except ValueError:
-        return False  # a malformed stored value should not itself lock the key out
+    except (TypeError, ValueError):
+        # Every way in validates the date (_validate_expiry()), so this is a store edited by hand or damaged: an expiry
+        # nobody can read is treated as passed - fail closed - not as none (review, 2026-10-15)
+        return True
     return datetime.now() > deadline
 
 

{queryapigate-0.34.2 → queryapigate-0.35.1}/queryapigate/auditstream.py

@@ -191,6 +191,7 @@ class _Syslog:
         if parts.scheme != 'tls':
             return raw
         context = ssl.create_default_context(cafile=os.environ.get('QUERYAPIGATE_AUDIT_SYSLOG_CA', '').strip() or None)
+        context.minimum_version = ssl.TLSVersion.TLSv1_2  # the default; said, so nothing lowers it
         cert = os.environ.get('QUERYAPIGATE_AUDIT_SYSLOG_CERT', '').strip()
         if cert:
             context.load_cert_chain(cert, os.environ.get('QUERYAPIGATE_AUDIT_SYSLOG_KEY', '').strip())

{queryapigate-0.34.2 → queryapigate-0.35.1}/queryapigate/console.py

@@ -8,9 +8,11 @@ built it gets a short "not built" page instead of an error - backend work never
 The page itself is public and holds no data: everything it shows comes from the JSON API, called with the API key the
 user enters (kept in sessionStorage under the same name /docs uses).
 """
+import os
 from pathlib import Path
 
 from flask import Response, send_from_directory
+from werkzeug.security import safe_join
 
 DIST = Path(__file__).parent / 'console_dist'
 
@@ -59,7 +61,10 @@ def serve(path=''):
     asset reference fails visibly instead of loading HTML as a script."""
     if not built():
         return _secure(Response(NOT_BUILT_HTML, mimetype='text/html'))
-    if path and (DIST / path).is_file():
+    # Only what's inside the build is looked at: checking the raw path told a caller whether a file existed anywhere
+    # on the server - 404 for one that did, the index for one that didn't (CodeQL py/path-injection).
+    inside = safe_join(str(DIST), path) if path else None
+    if inside is not None and os.path.isfile(inside):
         response = send_from_directory(DIST, path, max_age=0)
         if path.startswith('assets/'):  # content-hashed file names: safe to cache forever
             response.headers['Cache-Control'] = 'public, max-age=31536000, immutable'

{queryapigate-0.34.2 → queryapigate-0.35.1}/queryapigate/databases.py

@@ -15,8 +15,8 @@ NAMES = {'postgres': 'PostgreSQL', 'mysql': 'MySQL', 'sqlite': 'SQLite', 'duckdb
 TIER_1 = tuple(t for t in TYPES if t not in experimental.DB_TYPES)
 
 # Run against a real server (or, for SQLite, a real file) on every CI push: tests/test_integration.py's classes, and
-# the main suite for SQLite. MongoDB has no such test yet - the main reason it is experimental.
-INTEGRATION_TESTED = frozenset({'postgres', 'mysql', 'clickhouse', 'duckdb', 'h2', 'jdbc', 'sqlite'})
+# the main suite for SQLite. CI fails if one skips.
+INTEGRATION_TESTED = frozenset({'postgres', 'mysql', 'clickhouse', 'duckdb', 'h2', 'jdbc', 'sqlite', 'mongo'})
 
 # Where the database itself refuses writes in a read-only session, beside QueryAPIGate's own SQL check (sqltools):
 # MySQL and PostgreSQL read-only transactions, ClickHouse readonly=1, SQLite mode=ro. DuckDB, H2 and JDBC rest on

{queryapigate-0.34.2 → queryapigate-0.35.1}/queryapigate/logging_setup.py

@@ -39,6 +39,20 @@ class _RequestContextFilter(logging.Filter):
         return True
 
 
+class _PlainFormatter(logging.Formatter):
+    """One event, one line: a line break in the message - a caller's SQL, a request path with %0A in it - is written
+    as \\n, so it can't start what reads as a log line of its own (CodeQL py/log-injection). A traceback keeps its
+    lines: it comes after the message, from the server, not a caller."""
+
+    def formatMessage(self, record):
+        message = record.message
+        record.message = message.replace('\\', '\\\\').replace('\r', '\\r').replace('\n', '\\n')
+        try:
+            return super().formatMessage(record)
+        finally:
+            record.message = message
+
+
 class _JsonFormatter(logging.Formatter):
     def format(self, record):
         payload = {
@@ -72,7 +86,7 @@ def configure(logger):
     handler = logging.StreamHandler()
     handler._queryapigate_managed = True
     handler.addFilter(_RequestContextFilter())
-    handler.setFormatter(_JsonFormatter() if config.json_logs() else logging.Formatter(_PLAIN_FORMAT))
+    handler.setFormatter(_JsonFormatter() if config.json_logs() else _PlainFormatter(_PLAIN_FORMAT))
     logger.addHandler(handler)
     logger.setLevel(logging.INFO)
     logger.propagate = False

{queryapigate-0.34.2 → queryapigate-0.35.1}/queryapigate/quotas.py

@@ -109,6 +109,10 @@ class _Counter:
 
 
 _counter = _Counter()
+# Held from taking the unwritten counts to storing them, and by forget(): a forget that ran while a write was in flight
+# found the counts in neither place - taken from _counter, not yet in the store - and the write then stored them after
+# the person was forgotten (CI, 2026-10-14). Reentrant: forget() writes first, under it.
+_writing = threading.RLock()
 
 
 class _Shared:
@@ -209,20 +213,21 @@ def _stored(caller, key):
 def write():
     """Add what's been counted to the store(s) it was counted against - the history writer's batch calls this (and
     tests). A failed write puts the counts back, to be written next time rather than lost."""
-    taken = _counter.take()
-    if not taken:
-        return
-    by_target = {}
-    for (target, caller, key), counts in taken.items():
-        by_target.setdefault(target, {})[(caller, key)] = counts
-    stamp = datetime.now().strftime(_TIME)
-    try:
-        for target, counted in by_target.items():
-            _write(target, counted, stamp)
-    except Exception:
-        _counter.put_back(taken)
-        raise
-    _counter.forget_reads()
+    with _writing:
+        taken = _counter.take()
+        if not taken:
+            return
+        by_target = {}
+        for (target, caller, key), counts in taken.items():
+            by_target.setdefault(target, {})[(caller, key)] = counts
+        stamp = datetime.now().strftime(_TIME)
+        try:
+            for target, counted in by_target.items():
+                _write(target, counted, stamp)
+        except Exception:
+            _counter.put_back(taken)
+            raise
+        _counter.forget_reads()
 
 
 def _write(target, counted, stamp):
@@ -249,13 +254,15 @@ def _ensure_written():
 def forget(caller):
     """Delete a caller's usage counts - unwritten, stored and in Redis (ADR 0016: forgetting a person). Their quota's
     count for the period starts again. Returns how many periods there were: what this process hadn't written yet is
-    written first, so the answer doesn't depend on whether a background write happened to come first."""
-    write()
-    with _counter.lock:
-        for slot in [s for s in _counter.read if s[0] == caller]:
-            del _counter.read[slot]
-    with db.transaction() as tx:
-        stored = tx.execute('DELETE FROM usage_counters WHERE caller = ?', (caller,)).rowcount
+    written first, so the answer doesn't depend on whether a background write happened to come first - or was in
+    flight: that one is waited for (_writing)."""
+    with _writing:
+        write()
+        with _counter.lock:
+            for slot in [s for s in _counter.read if s[0] == caller]:
+                del _counter.read[slot]
+        with db.transaction() as tx:
+            stored = tx.execute('DELETE FROM usage_counters WHERE caller = ?', (caller,)).rowcount
     shared = _redis()
     if shared is not None:
         try:

{queryapigate-0.34.2 → queryapigate-0.35.1}/queryapigate/runners.py

@@ -546,6 +546,10 @@ class _H2(_Driver):
 
     def connect(self, details, read_only):
         import jaydebeapi
+        if not os.path.isfile(config.h2_jar()):  # a source checkout: the driver is fetched, not committed
+            raise ApiError(f"H2's driver isn't installed ({config.h2_jar()}): in a source checkout run "
+                           'python .github/scripts/fetch_h2_jar.py, or set QUERYAPIGATE_H2_JAR', 500,
+                           code='driver_missing')
         _attach_thread_as_daemon()
         host = details.get('host') or 'localhost'
         if details.get('port') and ':' not in host:

{queryapigate-0.34.2 → queryapigate-0.35.1}/queryapigate/sqltools.py

@@ -96,6 +96,10 @@ def write_operations(sql, dialect=None):
     if keyword == 'explain':
         inner = _EXPLAIN_RE.sub('', masked, count=1)
         inner_keyword = first_keyword(inner, dialect)
+        if inner_keyword == 'explain':
+            # No database runs EXPLAIN EXPLAIN: refused as a write (fails closed) rather than looked into again - each
+            # level was a recursion re-scanning the whole text, so thousands of them raised RecursionError (fuzzing).
+            return {'explain'}
         if inner_keyword in READ_ONLY_STATEMENTS:
             return write_operations(inner, dialect)
         return {inner_keyword} if inner_keyword in _WRITE_KEYWORDS else set()
@@ -144,7 +148,11 @@ def validate_sql(sql, dialect=None, allow_writes=None, allowed_write_ops=None, a
     """
     if not isinstance(sql, str) or not sql.strip():
         raise ApiError('SQL query is missing', code='sql_required')
-    sql = re.sub(r'[\s;]+$', '', sql.strip())
+    sql = sql.strip()
+    end = len(sql)  # trailing whitespace and semicolons, from the end: `[\s;]+$` was quadratic in a long inner run
+    while end and (sql[end - 1] == ';' or sql[end - 1].isspace()):
+        end -= 1
+    sql = sql[:end]
     if ';' in _literals_re(dialect).sub(' ', sql):
         raise ApiError('Only a single SQL statement can be executed at a time', code='multiple_statements')
     # Every write the statement performs - including one hidden behind a read-only first keyword (a writable CTE,

{queryapigate-0.34.2 → queryapigate-0.35.1}/queryapigate/store.py

@@ -8,6 +8,7 @@ filesystem path.
 """
 import contextlib
 import json
+import logging
 import os
 import re
 import threading
@@ -119,7 +120,9 @@ def record_audit(actor, action, target, changes=None, via=None):
             # several instances still make one chain
             link = auditchain.append(conn, entry, config.audit_log_limit())
     except (OSError, *db.Error):
-        pass
+        # The action stands, but it has no entry: said loudly, never silently (review, 2026-10-15)
+        logging.getLogger('queryapigate').error('Audit log: %s on %s by %s happened, but its entry could not be '
+                                                'written', action, target, actor, exc_info=True)
 
     def deliver():
         from . import auditstream

{queryapigate-0.34.2 → queryapigate-0.35.1}/queryapigate/tableguard.py

@@ -3,12 +3,13 @@ dialects sqlglot can parse (see ``_DIALECT_MAP``). Unlike sqlflow.py's best-effo
 extraction for the Access tab's visualization, this one is a security check: a query whose tables can't be
 verified - an unsupported dialect, a parse failure - must be rejected, not silently let through.
 
-Extraction is ``parsed.find_all(exp.Table)`` minus any CTE names defined in the same query, not
-``sqlglot.optimizer.scope.build_scope()`` - the latter correctly excludes CTE names for SELECT/WITH but
-returns None entirely for DELETE/UPDATE/INSERT (verified directly against a real sqlglot install), which
-would silently miss a write statement's own target table. The simpler find_all()-minus-CTE-names approach
-was verified to give correct results uniformly across CTEs, subqueries, UNION, self-joins, and bare or
-CTE'd DELETE/UPDATE/INSERT - one code path for every statement type this guard needs to check, not two.
+Extraction walks the parsed statement keeping track of which CTEs are visible where (``_real_tables``), not
+``sqlglot.optimizer.scope.build_scope()`` - that returns None entirely for DELETE/UPDATE/INSERT (verified against a
+real sqlglot install), which would silently miss a write statement's own target table. A bare name refers to a CTE
+only where SQL says it does: in the statement after its WITH, in the CTEs defined after it - and in its own body
+only under WITH RECURSIVE. Anywhere else, and always when qualified (``public.secret``), it's the table: dropping
+every table that merely shared a CTE's name let `WITH secret AS (SELECT * FROM secret) SELECT * FROM secret` past a
+key allowed only `orders` (fixed 2026-10-15).
 
 Known, accepted limitations: a table name is extracted bare (``information_schema.tables`` -> ``'tables'``),
 not schema-qualified - matches allowed_write_ops's own bare-keyword-list style, but can't disambiguate two
@@ -48,8 +49,43 @@ def extract_tables(sql, dialect):
             name = function.sql_name().lower() if not isinstance(function, exp.Anonymous) else function.name.lower()
             raise ApiError(f'This API key may only query its allowed tables - a table function such as {name}() '
                            "reads data the allow-list can't see, so it isn't allowed", 403, code='table_not_allowed')
-    cte_names = {cte.alias_or_name for cte in parsed.find_all(exp.CTE)}
-    return {t.name.lower() for t in parsed.find_all(exp.Table) if t.name and t.name not in cte_names}
+    try:
+        return _real_tables(parsed, frozenset())
+    except RecursionError:  # nested deeper than can be walked: refused, never let through
+        raise ApiError('This query could not be analyzed to enforce its table access restrictions', 403,
+                       code='table_check_failed') from None
+
+
+def _real_tables(node, visible):
+    """The tables under ``node`` that aren't references to a CTE in ``visible`` (lower-case names) - see the
+    module docstring for the scoping rule."""
+    from sqlglot import exp
+    if isinstance(node, exp.Table):
+        name = node.name.lower()
+        if not name or (name in visible and not node.args.get('db') and not node.args.get('catalog')):
+            return set()
+        return {name} | _children(node, visible)
+    found = set()
+    with_ = node.args.get('with') if isinstance(node, exp.Expression) else None
+    if isinstance(with_, exp.With):
+        ctes = [(cte.alias_or_name.lower(), cte.this) for cte in with_.expressions]
+        if with_.args.get('recursive'):
+            visible = visible | {name for name, _ in ctes}
+            for _, body in ctes:
+                found |= _real_tables(body, visible)
+        else:
+            for name, body in ctes:  # each body sees the CTEs before it, not itself or those after
+                found |= _real_tables(body, visible)
+                visible = visible | {name}
+    return found | _children(node, visible, skip=with_)
+
+
+def _children(node, visible, skip=None):
+    found = set()
+    for child in node.iter_expressions():
+        if child is not skip:
+            found |= _real_tables(child, visible)
+    return found
 
 
 # Table functions that only generate values - no data to restrict - and so stay usable with allowed_tables.

{queryapigate-0.34.2 → queryapigate-0.35.1/queryapigate.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: queryapigate
-Version: 0.34.2
+Version: 0.35.1
 Summary: Turn SQL into governed REST APIs over MySQL, PostgreSQL, ClickHouse, SQLite, DuckDB, H2, MongoDB, and Parquet/CSV/JSON files - JSON, CSV, Parquet or Excel out, with scoped keys, an admin Console and MCP for AI agents.
 Author-email: Anantha Raju C <arcswdev@gmail.com>
 License-Expression: FSL-1.1-MIT
@@ -84,6 +84,8 @@ Dynamic: license-file
 [![PyPI downloads](https://img.shields.io/pypi/dm/queryapigate.svg)](https://pypi.org/project/queryapigate/)
 [![License: FSL-1.1-MIT](https://img.shields.io/badge/license-FSL--1.1--MIT-blue.svg)](https://github.com/AnanthaRajuC/QueryAPIGate/blob/main/LICENSE)
 ![Python](https://img.shields.io/badge/python-3.11%2B-blue)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/AnanthaRajuC/QueryAPIGate/badge)](https://scorecard.dev/viewer/?uri=github.com/AnanthaRajuC/QueryAPIGate)
+[![SLSA 2](https://slsa.dev/images/gh-badge-level2.svg)](https://github.com/AnanthaRajuC/QueryAPIGate/blob/main/SECURITY.md#slsa-level)
 
 ### Turn SQL queries into secure, governed REST APIs.
 

{queryapigate-0.34.2 → queryapigate-0.35.1}/tests/test_api_keys.py

@@ -949,6 +949,11 @@ class ApiKeysModuleTests(unittest.TestCase):
                                    rate_limit=None, allowed_write_ops=None)
         self.assertTrue(apikeys.can_write_query(admin, 'anything'))
 
+    def test_an_expiry_nobody_can_read_counts_as_passed(self):
+        for bad in ('not-a-date', '2026-13-40', 20261015):
+            with self.subTest(bad=bad):
+                self.assertTrue(apikeys.is_expired({'expires_at': bad}))
+
     def test_is_expired(self):
         yesterday = (datetime.now() - timedelta(days=1)).strftime('%Y-%m-%d')
         tomorrow = (datetime.now() + timedelta(days=1)).strftime('%Y-%m-%d')
@@ -1042,4 +1047,4 @@ class CatalogTests(AppTestCase):
     def test_requires_authentication_like_any_other_functional_endpoint(self):
         self.assertEqual(self.client.get('/catalog').status_code, 401)
         self.assertEqual(self.client.get('/catalog', headers={'X-API-Key': 'wrong'}).status_code, 401)
-        self.assertFalse(apikeys.is_expired({'expires_at': 'garbage'}))  # malformed shouldn't lock the key out
+        self.assertTrue(apikeys.is_expired({'expires_at': 'garbage'}))  # unreadable: fails closed (2026-10-15)

{queryapigate-0.34.2 → queryapigate-0.35.1}/tests/test_console.py

@@ -84,6 +84,13 @@ class BuiltTests(ConsoleTestCase):
             res = self.get(path)
             self.assertNotIn('do not serve', res.get_data(as_text=True), path)
 
+    def test_whether_a_file_outside_exists_isnt_told_either(self):
+        # CodeQL py/path-injection: the check before send_from_directory() looked outside the build, so a file that
+        # existed there answered 404 and one that didn't the Console's index - which file is on the server, told.
+        (Path(self.tmp.name) / 'LICENSE').write_text('outside')
+        there, missing = self.get('/console/%2e%2e/LICENSE'), self.get('/console/%2e%2e/NO_SUCH_FILE')
+        self.assertEqual((there.status_code, there.get_data()), (missing.status_code, missing.get_data()))
+
     def test_every_response_carries_a_strict_content_security_policy(self):
         for path in ('/console/', '/console/queries', '/console/assets/index-abc123.js',
                      '/console/assets/missing-999.js'):

{queryapigate-0.34.2 → queryapigate-0.35.1}/tests/test_data_protection.py

@@ -147,6 +147,27 @@ class ForgetTests(unittest.TestCase):
         quotas.write()  # what was still unwritten was forgotten too
         self.assertEqual(self.periods(self.PERSON), 0)
 
+    def test_a_write_in_flight_is_waited_for_not_missed(self):
+        # CI, 2026-10-14: the background writer had taken the unwritten month's count and was writing it when forget
+        # ran - forget found it in neither place, deleted the rest, and the writer then stored it after the person
+        # was forgotten. Forgetting now waits for a write in flight, and deletes what it wrote.
+        import threading
+        writing, release, original = threading.Event(), threading.Event(), quotas._write
+
+        def slow_write(target, counted, stamp):
+            writing.set()
+            release.wait(5)
+            original(target, counted, stamp)
+        with mock.patch.object(quotas, '_write', slow_write):
+            writer = threading.Thread(target=quotas.write)
+            writer.start()
+            self.assertTrue(writing.wait(5))
+            threading.Timer(0.3, release.set).start()
+            forgotten = history.forget(self.PERSON, 'owner')
+            writer.join(5)
+        self.assertEqual(forgotten['usage_periods'], 2)
+        self.assertEqual(self.periods(self.PERSON), 0)
+
     def test_the_record_of_it_keeps_nothing_of_who(self):
         history.forget(self.PERSON, 'owner')
         entry = self.audit()[-1]

{queryapigate-0.34.2 → queryapigate-0.35.1}/tests/test_dependency_floors.py

@@ -11,10 +11,11 @@ ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 
 # Each package whose floor CI tests, and the extra that declares it - None for a core dependency. Every core
 # dependency is here, and every extra a stable feature needs (ADR 0017); the experimental features' extras (otel,
-# aws, mongo, h2) join when they graduate.
+# aws, h2) join when they graduate - mongo's already has, tested against a real server.
 FLOORS = {'Flask': None, 'Werkzeug': None, 'PyYAML': None, 'openpyxl': None,
           'duckdb': 'duckdb', 'sqlglot': 'flow', 'mcp': 'mcp', 'PyJWT': 'jwt', 'redis': 'redis',
-          'psycopg2-binary': 'postgres'}  # the PostgreSQL store, and live events' notifications (ADR 0021)
+          'psycopg2-binary': 'postgres',  # the PostgreSQL store, and live events' notifications (ADR 0021)
+          'pymongo': 'mongo'}
 
 
 def _project():

{queryapigate-0.34.2 → queryapigate-0.35.1}/tests/test_integration.py

@@ -478,5 +478,97 @@ class DuckDBTests(IntegrationBase, unittest.TestCase):
         self.assertEqual(len(self.query('SELECT * FROM queryapigate_it', '?page_size=100').get_json()), 7)
 
 
+class MongoTests(unittest.TestCase):
+    """MongoDB against a real server (QUERYAPIGATE_IT_MONGO): find() through /execute_mongo and saved queries, the
+    time limit, allowed_tables as collections, and the refusals that keep a find() a find() - each sent to the real
+    server's parser, not a mock's. Not IntegrationBase: there is no SQL to run."""
+    db, env_var = 'mongo', 'QUERYAPIGATE_IT_MONGO'
+
+    @classmethod
+    def setUpClass(cls):
+        raw = os.environ.get(cls.env_var)
+        if not raw:
+            raise unittest.SkipTest(f'{cls.env_var} not set')
+        cls.details = {**json.loads(raw), 'db': cls.db, 'active': True}
+
+    def setUp(self):
+        import pymongo
+        self.tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.tmp.cleanup)
+        patcher = mock.patch.dict(os.environ, {'QUERYAPIGATE_HOME': self.tmp.name, 'QUERYAPIGATE_API_KEY': 'admin'})
+        patcher.start()
+        self.addCleanup(patcher.stop)
+        write_connections({'it': self.details})
+        self.client = create_app().test_client()
+        self.admin = {'X-API-Key': 'admin'}
+        server = pymongo.MongoClient(self.details['host'], int(self.details.get('port') or 27017))
+        self.addCleanup(server.close)
+        self.mongo = server[self.details['database']]
+        for name in ('queryapigate_it', 'queryapigate_it_secret', 'queryapigate_it_slow'):
+            self.mongo.drop_collection(name)
+            self.addCleanup(self.mongo.drop_collection, name)
+        self.mongo.queryapigate_it.insert_many([{'id': i, 'name': f'Item {i}', 'price': i + 0.5} for i in range(1, 8)])
+        self.mongo.queryapigate_it_secret.insert_one({'token': 'tok_live_123'})
+
+    def find(self, headers=None, query='', **body):
+        return self.client.post(f'/execute_mongo{query}', headers=headers or self.admin,
+                                json={'connection_name': 'it', 'collection': 'queryapigate_it', **body})
+
+    def key(self, **grants):
+        res = self.client.post('/api/v1/api-keys', headers=self.admin, json={'name': 'partner', **grants})
+        self.assertEqual(res.status_code, 201, res.get_data(as_text=True))
+        return {'X-API-Key': res.get_json()['secret']}
+
+    def test_a_find_filters_projects_sorts_and_pages(self):
+        res = self.find(query='?page_size=2', filter={'price': {'$gte': 3}}, projection={'_id': 0, 'id': 1},
+                        sort={'id': -1})
+        self.assertEqual(res.status_code, 200, res.get_data(as_text=True))
+        self.assertEqual(res.get_json(), [{'id': 7}, {'id': 6}])
+        self.assertEqual(res.headers['X-Has-More'], 'true')
+
+    def test_a_saved_query_binds_a_typed_parameter(self):
+        self.assertEqual(save_query(self.client, headers=self.admin, body={
+            'filename': 'by_id', 'author': 'a', 'description': 'd', 'query_type': 'mongo',
+            'mongo_collection': 'queryapigate_it', 'mongo_filter': {'id': ':id'},
+            'mongo_projection': {'_id': 0, 'name': 1}, 'query_parameters': {'id': 'int'},
+            'connection_name': 'it'}).status_code, 201)
+        res = self.client.get('/q/by_id?id=3', headers=self.admin)
+        self.assertEqual((res.status_code, res.get_json()), (200, [{'name': 'Item 3'}]))
+
+    def test_the_time_limit_cancels_a_find(self):
+        self.mongo.queryapigate_it_slow.insert_many([{'s': 'x' * 40 + str(i)} for i in range(100_000)])
+        res = self.find(collection='queryapigate_it_slow', filter={'s': {'$regex': 'y$'}}, timeout=0.001)
+        self.assertEqual((res.status_code, res.get_json()['code']), (504, 'query_timeout'))
+        unlimited = self.find(collection='queryapigate_it_slow', filter={'s': {'$regex': 'y$'}})
+        self.assertEqual(unlimited.status_code, 200)  # the same find, given its time, simply finds nothing
+
+    def test_allowed_tables_are_the_collections_a_key_may_read(self):
+        partner = self.key(connections=['it'], allowed_tables=['queryapigate_it'])
+        self.assertEqual(self.find(partner).status_code, 200)
+        refused = self.find(partner, collection='queryapigate_it_secret')
+        self.assertEqual((refused.status_code, refused.get_json()['code']), (403, 'table_not_allowed'))
+        self.assertNotIn('tok_live', refused.get_data(as_text=True))
+
+    def test_server_side_javascript_and_injected_operators_never_reach_the_server(self):
+        js = {'$function': {'body': 'function() { return true; }', 'args': [], 'lang': 'js'}}
+        for body in ({'filter': {'$where': 'true'}}, {'filter': {'$expr': js}}, {'projection': {'x': js}},
+                     {'sort': {'x': js}}):
+            with self.subTest(body=body):
+                res = self.find(**body)
+                self.assertEqual((res.status_code, res.get_json()['code']), (403, 'mongo_operator_forbidden'))
+        injected = self.find(filter={'name': ':u'}, params={'u': {'$ne': None}})
+        self.assertEqual((injected.status_code, injected.get_json()['code']), (400, 'param_invalid'))
+
+    def test_the_schema_lists_collections_and_the_server_its_databases(self):
+        res = self.client.get('/connections/it/schema', headers=self.admin)
+        self.assertEqual(res.status_code, 200, res.get_data(as_text=True))
+        self.assertIn('queryapigate_it', {t['name'] for t in res.get_json()['tables']})
+        listed = self.client.post('/api/v1/connections/databases', headers=self.admin, json=self.details)
+        self.assertEqual(listed.status_code, 200, listed.get_data(as_text=True))
+        self.assertIn(self.details['database'], json.dumps(listed.get_json()))
+        tested = self.client.post('/api/v1/connections/test', headers=self.admin, json=self.details)
+        self.assertEqual(tested.status_code, 200, tested.get_data(as_text=True))
+
+
 if __name__ == '__main__':
     unittest.main()

{queryapigate-0.34.2 → queryapigate-0.35.1}/tests/test_observability.py

@@ -153,6 +153,22 @@ class LoggingFormatTests(unittest.TestCase):
         _, handler = self._handler_for('queryapigate_test_plain', json_logs=False)
         self.assertNotIsInstance(handler.formatter, logging_setup._JsonFormatter)
 
+    def test_a_line_break_in_a_message_cant_forge_a_line_of_its_own(self):
+        # CodeQL py/log-injection: a caller's SQL (or a request path with %0A) is in the message; in plain text a line
+        # break there could start what reads as another event. A traceback keeps its own lines.
+        logger, handler = self._handler_for('queryapigate_test_inject', json_logs=False)
+        buf = io.StringIO()
+        handler.stream = buf
+        logger.warning('Executing: %s', "SELECT 1\n2026-10-15 07:00:00 INFO queryapigate [- key=admin]: forged\\n")
+        try:
+            raise ValueError('boom')
+        except ValueError:
+            logger.exception('failed')
+        lines = buf.getvalue().splitlines()
+        self.assertTrue(lines[0].endswith(r"SELECT 1\n2026-10-15 07:00:00 INFO queryapigate [- key=admin]: forged\\n"))
+        self.assertFalse(any(line.startswith('2026-10-15 07:00:00 INFO') for line in lines))
+        self.assertIn('Traceback (most recent call last):', lines)  # the server's own lines, as they were
+
     def test_json_when_enabled(self):
         logger, handler = self._handler_for('queryapigate_test_json', json_logs=True)
         self.assertIsInstance(handler.formatter, logging_setup._JsonFormatter)

{queryapigate-0.34.2 → queryapigate-0.35.1}/tests/test_queryapigate.py

@@ -794,6 +794,7 @@ class DriverWiringTests(unittest.TestCase):
 
     def test_h2_sets_query_timeout_and_maps_cancellation(self):
         import jaydebeapi
+        self.enterContext(mock.patch.object(config, 'h2_jar', return_value=__file__))  # any file: the JVM is mocked
         cursor = mock.MagicMock()
         cursor.description = [('C',)]
         cursor.execute.side_effect = [None, jaydebeapi.DatabaseError('Statement was canceled or the session timed out')]
@@ -1038,7 +1039,16 @@ class PooledDriverTests(unittest.TestCase):
         with mock.patch('jpype.isJVMStarted', return_value=False):  # nothing to attach to before the JVM starts
             runners._attach_thread_as_daemon()
 
+    def test_h2_without_its_driver_says_how_to_get_it(self):
+        with mock.patch.object(config, 'h2_jar', return_value='/nowhere/h2.jar'), \
+                mock.patch('jaydebeapi.connect') as connect, self.assertRaises(ApiError) as caught:
+            runners._H2().connect({'host': 'h', 'database': 'd'}, True)
+        self.assertEqual((caught.exception.status, caught.exception.code), (500, 'driver_missing'))
+        self.assertIn('fetch_h2_jar.py', caught.exception.message)
+        self.assertFalse(connect.called)
+
     def test_h2_dead_connection_is_replaced(self):
+        self.enterContext(mock.patch.object(config, 'h2_jar', return_value=__file__))  # any file: the JVM is mocked
         first, second = mock.MagicMock(), mock.MagicMock()
         for conn in (first, second):
             conn.cursor.return_value.description = [('C',)]

{queryapigate-0.34.2 → queryapigate-0.35.1}/tests/test_release_check.py

@@ -64,6 +64,18 @@ class ReleaseCheckTests(unittest.TestCase):
         (self.root / 'CHANGELOG.md').unlink()
         self.assertEqual(len(check_release.problems('v0.2.0', self.root)), 2)
 
+    def test_the_release_notes_are_the_versions_changelog_section(self):
+        (self.root / 'CHANGELOG.md').write_text(
+            '## [Unreleased]\n\n## [0.3.0] - 2026-10-14\n\nNewer.\n\n## [0.2.0] - 2026-09-21\n\nThe summary.\n\n'
+            '### Fixed\n- a thing\n\n[Unreleased]: https://example.com/compare\n')
+        self.assertEqual(check_release.notes('v0.2.0', self.root), 'The summary.\n\n### Fixed\n- a thing\n')
+        self.assertEqual(check_release.notes('v0.3.0', self.root), 'Newer.\n')
+        with self.assertRaises(SystemExit):
+            check_release.notes('v9.9.9', self.root)
+        out = subprocess.run(['python3', str(SCRIPT), '--notes', 'v0.3.0'], cwd=self.root, capture_output=True,
+                             text=True)
+        self.assertEqual((out.returncode, out.stdout), (0, 'Newer.\n'))
+
     def test_command_line_exit_codes(self):
         run = lambda tag: subprocess.run(['python3', str(SCRIPT), tag], cwd=self.root,  # noqa: E731
                                          capture_output=True, text=True)

{queryapigate-0.34.2 → queryapigate-0.35.1}/tests/test_sql_guard_fuzz.py

@@ -385,3 +385,22 @@ class PaginateFuzzTests(unittest.TestCase):
 
 if __name__ == '__main__':
     unittest.main()
+
+
+class LinearTimeTests(unittest.TestCase):
+    """CodeQL (py/polynomial-redos, 2026-10-15): validate_sql stripped trailing whitespace and semicolons with
+    `[\\s;]+$`, which a regex engine retries from every position of a long run that isn't at the end - 40,000 spaces
+    took three seconds, a few hundred thousand a minute, in any caller's ad-hoc SQL."""
+
+    def test_a_long_run_of_spaces_is_linear(self):
+        import time
+        started = time.monotonic()
+        sqltools.validate_sql('SELECT 1' + ' ' * 200_000 + 'AS x', 'postgres', allow_writes=False)
+        self.assertLess(time.monotonic() - started, 0.5)
+
+    def test_trailing_whitespace_and_semicolons_still_go(self):
+        for sql, expected in (('SELECT 1;', 'SELECT 1'), ('SELECT 1 ; ;\n\t ', 'SELECT 1'),
+                              ('SELECT 1 ;', 'SELECT 1'), ('  SELECT 1', 'SELECT 1'),
+                              ("SELECT ';'", "SELECT ';'")):
+            with self.subTest(sql=sql):
+                self.assertEqual(sqltools.validate_sql(sql, 'postgres', allow_writes=False), expected)