queryapigate 0.46.0__tar.gz → 0.47.0__tar.gz

{queryapigate-0.46.0/queryapigate.egg-info → queryapigate-0.47.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: queryapigate
-Version: 0.46.0
+Version: 0.47.0
 Summary: Turn SQL into governed REST APIs over MySQL, PostgreSQL, ClickHouse, SQLite, DuckDB, H2, MongoDB, and Parquet/CSV/JSON files - JSON, CSV, Parquet or Excel out, with scoped keys, an admin Console and MCP for AI agents.
 Author-email: Anantha Raju C <arcswdev@gmail.com>
 License-Expression: Apache-2.0

{queryapigate-0.46.0 → queryapigate-0.47.0}/queryapigate/__init__.py

@@ -1,5 +1,5 @@
 """QueryAPIGate - expose SQL databases as a REST API."""
-__version__ = "0.46.0"
+__version__ = "0.47.0"
 
 from .app import create_app  # noqa: E402  (app imports __version__)
 

{queryapigate-0.46.0 → queryapigate-0.47.0}/queryapigate/app.py

@@ -1,5 +1,4 @@
 """The Flask application: HTTP routes on top of the store, engine and formatters."""
-import ipaddress
 import json
 import logging
 import math
@@ -178,8 +177,9 @@ class _CapturePeer:
     Behind a data plane (dataplane.py, ADR 0028) every request comes from it, over loopback: one that carries its
     secret names the client's own socket address in X-QAG-Peer, and that address is taken as the real one - so this
     server sees the request as if the client had connected directly, ProxyFix and QUERYAPIGATE_TRUST_PROXY included.
-    A peer that isn't an IP address counts as remote, as a Unix socket does. Both headers are removed here, so
-    nothing after this layer reads, logs or passes on the secret."""
+    A peer that isn't an IP address counts as remote, as a Unix socket does. A data plane from another release
+    (X-QAG-Dataplane-Version) is still the data plane, but is given no plan (dataplane.paired()). Its headers are
+    removed here, so nothing after this layer reads, logs or passes on the secret."""
 
     def __init__(self, app):
         self.app = app
@@ -188,21 +188,20 @@ class _CapturePeer:
         supplied = environ.pop(dataplane.SECRET_ENVIRON, None)
         peer = environ.pop(dataplane.PEER_ENVIRON, None)
         wanted = environ.pop(dataplane.WANTED_ENVIRON, None)
+        version = environ.pop(dataplane.VERSION_ENVIRON, None)
         if supplied is not None and dataplane.matches(supplied):
-            environ['queryapigate.dataplane'] = 'plan' if wanted == '1' else True
+            is_paired = dataplane.paired(version)
+            environ['queryapigate.dataplane'] = 'plan' if wanted == '1' and is_paired else True
+            environ['queryapigate.dataplane_paired'] = is_paired
             environ['REMOTE_ADDR'] = peer if dataplane.is_address(peer) else ''
         environ['queryapigate.peer_addr'] = environ.get('REMOTE_ADDR')
         return self.app(environ, start_response)
 
 
 def _peer_is_local():
-    """Whether the request's real socket peer is a loopback address. Fails closed: an address that can't be parsed,
-    or none at all (e.g. a Unix socket), counts as remote - in open-access mode the caller must then configure a key."""
-    peer = request.environ.get('queryapigate.peer_addr') or ''
-    try:
-        return ipaddress.ip_address(peer).is_loopback
-    except ValueError:
-        return False
+    """Whether the request's real socket peer is a loopback address (governance.is_loopback(), the MCP server's rule
+    too). Fails closed: in open-access mode a caller it can't place must configure a key."""
+    return governance.is_loopback(request.environ.get('queryapigate.peer_addr'))
 
 
 def create_app():
@@ -362,8 +361,7 @@ def create_app():
         # could reach the port would otherwise be an unrestricted admin. The real socket peer decides, never a
         # forgeable header. The public endpoints (health, docs, the Console shell) are reachable either way.
         if g.permission is apikeys.OPEN and request.endpoint not in PUBLIC_ENDPOINTS and not _peer_is_local():
-            raise ApiError('This server has no API key set, so it answers only local clients. Set '
-                           'QUERYAPIGATE_API_KEY to allow access from other hosts.', 403, code='open_access_remote')
+            raise ApiError(governance.OPEN_ACCESS_REMOTE, 403, code='open_access_remote')
         if g.permission is not None:
             g.permission = settle_workspace(g.permission, named)
         limited = check_key_rate_limit()
@@ -1282,6 +1280,8 @@ def dataplane_lease():
     there. 404 without a run store."""
     if not runstore.enabled():
         return jsonify(error_body('No run store is configured', 404)), 404
+    if not request.environ.get('queryapigate.dataplane_paired'):
+        return jsonify(error_body(dataplane.UNPAIRED, 409)), 409
     body = request.get_json(silent=True) or {}
     holder = body.get('holder')
     if not isinstance(holder, str) or not 0 < len(holder) <= 200:

{queryapigate-0.46.0 → queryapigate-0.47.0}/queryapigate/config.py

@@ -244,6 +244,13 @@ def threads():
     return int(raw) if raw.isdigit() and 1 <= int(raw) <= MAX_THREADS else DEFAULT_THREADS
 
 
+def bind():
+    """QUERYAPIGATE_BIND: the address the Docker image's gunicorn listens on (gunicorn_conf.py) - the image sets
+    0.0.0.0:5000, and behind the Rust data plane, which then takes that port, 127.0.0.1:5001 (ADR 0030). None when
+    unset: gunicorn's own default, or its --bind."""
+    return os.environ.get('QUERYAPIGATE_BIND', '').strip() or None
+
+
 def access_log():
     """QUERYAPIGATE_ACCESS_LOG: the image's gunicorn writes an access line per request to stdout (on by default). Off
     for a server whose proxy or load balancer already logs requests - what a line costs, with no one reading it."""
@@ -1500,6 +1507,8 @@ def describe_settings():
          'description': 'Requests served at once, and idle connections kept open per distinct connection.', 'rows': [
             row('Threads', "Requests one server process serves at once - the Docker image's gunicorn. Read at "
                 'startup.', 'QUERYAPIGATE_THREADS', str(threads())),
+            row('Listen address', "Where the Docker image's gunicorn listens: 127.0.0.1:5001 behind the data plane, "
+                'which takes the public port. Read at startup.', 'QUERYAPIGATE_BIND', bind() or "gunicorn's own"),
             row('Pool size', 'Idle connections kept per connection - by default, one per thread. 0 disables pooling.',
                 'QUERYAPIGATE_POOL_SIZE', str(pool_size())),
             row('Idle timeout', 'How long an idle pooled connection is kept before it is closed.',

{queryapigate-0.46.0 → queryapigate-0.47.0}/queryapigate/dataplane.py

@@ -15,6 +15,10 @@ the rows it was computed from (the key, the saved query, the connection), so the
 whose rows digest the same, and a masked plan expires with the schema its trace was made from. The data plane never
 decides anything of its own: it applies a plan, or it forwards.
 
+A data plane from another release gets no plan, and no run store lease (app.py): the protocol between the two is
+internal, so they must come from one release (X-QAG-Dataplane-Version, ADR 0030 section 1). It then forwards every call,
+which is slower but answers as Python does.
+
 Saved queries with `{name}` text placeholders never get a plan: their values are part of the SQL text, so the verdict
 can change from one call to the next.
 """
@@ -22,12 +26,16 @@ import base64
 import hmac
 import ipaddress
 import json
+import logging
+
+from . import __version__, config, runners, sqltools
 
-from . import config, runners, sqltools
+log = logging.getLogger('queryapigate')
 
 SECRET_HEADER = 'X-QAG-Dataplane'
 PEER_HEADER = 'X-QAG-Peer'
 WANTED_HEADER = 'X-QAG-Plan-Wanted'
+VERSION_HEADER = 'X-QAG-Dataplane-Version'  # the data plane's release, sent with its secret
 PLAN_HEADER = 'X-QAG-Plan'
 VERSION = 1
 DIALECTS = ('postgres', 'mysql')  # the two the prototype serves - every other connection is forwarded
@@ -38,6 +46,10 @@ SECRET_ENVIRON = 'HTTP_X_QAG_DATAPLANE'  # the two headers as WSGI names them -
 PEER_ENVIRON = 'HTTP_X_QAG_PEER'
 # The data plane asks for a plan only when it would keep one: other calls it forwards keep the metadata cache
 WANTED_ENVIRON = 'HTTP_X_QAG_PLAN_WANTED'
+VERSION_ENVIRON = 'HTTP_X_QAG_DATAPLANE_VERSION'
+UNPAIRED = ('This data plane is from another release than this server: it gets no plans and no run store lease '
+            'until both are the same release')
+_unpaired_seen: set = set()
 
 
 def matches(supplied):
@@ -47,6 +59,16 @@ def matches(supplied):
     return bool(secret and supplied) and hmac.compare_digest(supplied.encode('utf-8', 'replace'), secret.encode())
 
 
+def paired(version):
+    """Whether a data plane that sent `version` is from this server's release - logged once per other version."""
+    if version == __version__:
+        return True
+    if version not in _unpaired_seen:
+        _unpaired_seen.add(version)
+        log.warning('%s (data plane %s, this server %s).', UNPAIRED, version or 'unknown', __version__)
+    return False
+
+
 def is_address(peer):
     """Whether X-QAG-Peer names an IP address - the client's socket address, as the data plane saw it."""
     try:

{queryapigate-0.46.0 → queryapigate-0.47.0}/queryapigate/experimental.py

@@ -70,10 +70,10 @@ FEATURES: dict[str, dict[str, Any]] = {
     },
     'dataplane': {
         'name': 'The Rust data plane in front of /q/',
-        'why': 'a prototype (ADR 0028, decided go in 0.44): built from the repository, not in the image or the chart; '
-               'what it serves, its settings and its headers may change before the ADR that ships it',
+        'why': 'decided go in 0.44 (ADR 0028) and shipped in the image and the chart (ADR 0030); what it serves, its '
+               'settings and its headers may change before it graduates',
         'settings': ('QUERYAPIGATE_DATAPLANE_SECRET',),
-        'docs': ('documentation/DEPLOYMENT.md', 'A Rust data plane in front of /q/ (prototype)'),
+        'docs': ('documentation/DEPLOYMENT.md', 'A Rust data plane in front of /q/'),
     },
     'run_store': {
         'name': 'A ClickHouse run store for history, the event log and usage',

{queryapigate-0.46.0 → queryapigate-0.47.0}/queryapigate/governance.py

@@ -10,10 +10,14 @@ The limiters are held on the Flask app. With QUERYAPIGATE_REDIS_URL set they cou
 process - `queryapigate serve`, `queryapigate mcp`, `queryapigate events` - shares one budget per client and per key
 (BACKLOG #55); without it each process counts on its own.
 """
+import ipaddress
 from dataclasses import dataclass
 
 from . import admins, alerts, apikeys, config, jwtauth, metrics
 
+OPEN_ACCESS_REMOTE = ('This server has no API key set, so it answers only local clients. Set QUERYAPIGATE_API_KEY '
+                      'to allow access from other hosts.')
+
 
 @dataclass(frozen=True)
 class Verdict:
@@ -24,6 +28,15 @@ class Verdict:
     retry_after: int
 
 
+def is_loopback(peer):
+    """Whether a connection's real peer is a loopback address - the one caller open-access mode answers. Fails closed:
+    an address that can't be parsed, or none at all (a Unix socket, a test client's name), counts as remote."""
+    try:
+        return ipaddress.ip_address(peer or '').is_loopback
+    except ValueError:
+        return False
+
+
 def authenticate(api_key, authorization, client_ip):
     """The caller's Permission: a matched key (admin or scoped), a signed-in user's verified bearer token
     (jwtauth.py), the unrestricted OPEN default when no key is configured anywhere, or None when a key is required
@@ -42,13 +55,20 @@ def authenticate(api_key, authorization, client_ip):
     return None if apikeys.auth_required() else apikeys.OPEN
 
 
-def authenticate_mcp(api_key, authorization, client_ip):
+def authenticate_mcp(api_key, authorization, client_ip, peer=None):
     """(Permission, None) for a caller the MCP server lets in, else (None, refusal) - a jwtauth.McpRefusal saying
     401 or 403 and why. An API key is judged as everywhere. A bearer token, with OAuth on for the MCP server
     (ADR 0006), must be one issued for it - a REST token isn't, however valid; with OAuth off, REST's JWT settings
-    apply, as before."""
+    apply, as before. Open access is for a local caller only: `client_ip` (the client a trusted proxy names, if one
+    does) and the connection's own `peer`, when it's known, must both be loopback - so neither a remote client sent
+    on by a proxy on this host, nor a forged X-Forwarded-For that a too-wide FORWARDED_ALLOW_IPS would honour, gets
+    in."""
     if api_key or not authorization or not config.mcp_oauth_enabled():
         permission = authenticate(api_key, authorization, client_ip)
+        if permission is apikeys.OPEN and not (is_loopback(client_ip) and (peer is None or is_loopback(peer))):
+            # No key, administrator, JWT or OAuth configured anywhere: the unrestricted OPEN caller, which only a local
+            # client may be - as REST's gate refuses it (app.py). Before 0.47 the MCP server let any client in as it.
+            return None, jwtauth.McpRefusal(403, 'open_access_remote', OPEN_ACCESS_REMOTE)
         if permission is not None:
             return permission, None
         return None, jwtauth.McpRefusal(401, 'unauthorized', 'Unauthorized: missing or invalid X-API-Key or bearer '

{queryapigate-0.46.0 → queryapigate-0.47.0}/queryapigate/gunicorn_conf.py

@@ -2,12 +2,26 @@
 (QUERYAPIGATE_THREADS, default 8), whether there is an access log at all (QUERYAPIGATE_ACCESS_LOG, on by default, to
 stdout), and its format - paths without their query strings, unless QUERYAPIGATE_ACCESS_LOG_QUERY=1 (accesslog.py, ADR
 0016). The image uses it; so can any gunicorn command running QueryAPIGate. A value given on gunicorn's command line,
-or in GUNICORN_CMD_ARGS, overrides the one here, as gunicorn reads a config file first."""
+or in GUNICORN_CMD_ARGS, overrides the one here, as gunicorn reads a config file first.
+
+Where it listens: QUERYAPIGATE_BIND, which the image sets to 0.0.0.0:5000 and the Helm chart to 127.0.0.1:5001 behind
+the data plane; unset, gunicorn's own default.
+
+Behind the Rust data plane (QUERYAPIGATE_DATAPLANE_SECRET set, ADR 0030) every request reaches gunicorn over loopback,
+which gunicorn trusts by default to set the scheme (X-Forwarded-Proto, -Ssl, -Protocol) and SCRIPT_NAME from headers -
+a client's own, passed on. So it trusts no peer's then, unless FORWARDED_ALLOW_IPS says otherwise: Python reads the
+client's forwarding headers through ProxyFix, as QUERYAPIGATE_TRUST_PROXY says, as it does without the data plane."""
 # Every name at the top of this file is read as a gunicorn setting of that name, and `config` is one (the config file's
 # own path): imported under it, gunicorn refuses to start. Hence the underscores.
+import os as _os
+
 from queryapigate import config as _settings
 from queryapigate.accesslog import gunicorn_format as _gunicorn_format
 
 threads = _settings.threads()
 accesslog = '-' if _settings.access_log() else None  # None: no access log - not one written to /dev/null
 access_log_format = _gunicorn_format()
+if _settings.bind():
+    bind = _settings.bind()
+if _settings.dataplane_secret() and 'FORWARDED_ALLOW_IPS' not in _os.environ:
+    forwarded_allow_ips = ''

{queryapigate-0.46.0 → queryapigate-0.47.0}/queryapigate/mcp_server.py

@@ -20,6 +20,7 @@ package isn't."""
 import functools
 import json
 import logging
+import os
 import re
 import time
 import urllib.parse
@@ -604,6 +605,17 @@ def permission_for_listing(flask_app, api_key, authorization, client_ip):
 
 
 PERMISSION_STATE = 'queryapigate_permission'  # where the gate leaves the caller, in the ASGI scope's state
+SOCKET_PEER = 'queryapigate.socket_peer'  # the connection's own address, kept before X-Forwarded-For can replace it
+
+
+def keep_socket_peer(app):
+    """Record each request's real socket peer in its scope, for the gate's open-access rule, before the proxy-header
+    middleware inside it rewrites `client` from X-Forwarded-For (run())."""
+    async def wrapped(scope, receive, send):
+        if scope['type'] == 'http' and scope.get('client'):
+            scope[SOCKET_PEER] = scope['client'][0]
+        return await app(scope, receive, send)
+    return wrapped
 
 
 def resource_metadata_url():
@@ -659,7 +671,8 @@ def gate(flask_app, inner):
                                     headers={'Retry-After': str(verdict.retry_after), 'X-Request-Id': request_id})
         else:
             api_key, authorization = headers.get('x-api-key', ''), headers.get('authorization', '')
-            permission, refusal = governance.authenticate_mcp(api_key, authorization, client_ip)
+            permission, refusal = governance.authenticate_mcp(api_key, authorization, client_ip,
+                                                              peer=scope.get(SOCKET_PEER))
             if permission is not None:
                 scope.setdefault('state', {})[PERMISSION_STATE] = permission
                 return await inner(scope, receive, send)
@@ -784,7 +797,11 @@ def build_asgi_app(flask_app):
 
 
 def run(flask_app, host, port):
-    """Serves build_asgi_app() until interrupted."""
+    """Serves build_asgi_app() until interrupted. Uvicorn's own proxy-header handling is applied here instead, with
+    the same trusted hosts (FORWARDED_ALLOW_IPS, else loopback), so the socket peer can be kept before it."""
     import uvicorn
+    from uvicorn.middleware.proxy_headers import ProxyHeadersMiddleware
 
-    uvicorn.run(build_asgi_app(flask_app), host=host, port=port, server_header=False)  # no version banner
+    trusted = os.environ.get('FORWARDED_ALLOW_IPS', '127.0.0.1,::1')  # uvicorn.Config's own default
+    app = keep_socket_peer(ProxyHeadersMiddleware(build_asgi_app(flask_app), trusted_hosts=trusted))
+    uvicorn.run(app, host=host, port=port, server_header=False, proxy_headers=False)  # no version banner

{queryapigate-0.46.0 → queryapigate-0.47.0/queryapigate.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: queryapigate
-Version: 0.46.0
+Version: 0.47.0
 Summary: Turn SQL into governed REST APIs over MySQL, PostgreSQL, ClickHouse, SQLite, DuckDB, H2, MongoDB, and Parquet/CSV/JSON files - JSON, CSV, Parquet or Excel out, with scoped keys, an admin Console and MCP for AI agents.
 Author-email: Anantha Raju C <arcswdev@gmail.com>
 License-Expression: Apache-2.0

{queryapigate-0.46.0 → queryapigate-0.47.0}/tests/test_dataplane.py

@@ -3,17 +3,19 @@ spec the data plane is built to - that a plan, applied as the data plane applies
 sends. The PostgreSQL and MySQL runners are replaced by recording fakes, so no database is needed."""
 import json
 import os
+import re
 import sqlite3
 import tempfile
 import unittest
 from unittest import mock
 
-from queryapigate import apikeys, create_app, dataplane, db, runners, runstore, schema, sqltools
+from queryapigate import __version__, apikeys, create_app, dataplane, db, runners, runstore, schema, sqltools
 from tests.helpers import save_query, write_connections
 
 ADMIN = {'X-API-Key': 'admin-key'}
 SECRET = 'dp-secret-0123456789'
 WANTED = 'X-QAG-Plan-Wanted'
+PAIRED = {'X-QAG-Dataplane-Version': __version__}  # a data plane of this release
 COLUMNS = ['id', 'email', 'name']
 TABLES = {'tables': [{'name': 'customers', 'columns': [{'name': c} for c in COLUMNS]}]}
 
@@ -68,7 +70,7 @@ class PlanTestCase(unittest.TestCase):
         return COLUMNS, [(1, 'a@example.com', 'A')]
 
     def call(self, path, key, secret=SECRET):
-        headers = {'X-API-Key': key, **({dataplane.SECRET_HEADER: secret, WANTED: '1'} if secret else {})}
+        headers = {'X-API-Key': key, **({dataplane.SECRET_HEADER: secret, WANTED: '1', **PAIRED} if secret else {})}
         res = self.client.get(path, headers=headers)
         self.assertEqual(res.status_code, 200, res.get_data(as_text=True))
         value = res.headers.get(dataplane.PLAN_HEADER)
@@ -109,7 +111,8 @@ class WhoGetsAPlanTests(PlanTestCase):
         self.assertIn('at least 16 characters', str(caught.exception))
 
     def test_never_for_an_administrator(self):
-        res = self.client.get('/q/by_id?id=1', headers={**ADMIN, dataplane.SECRET_HEADER: SECRET, WANTED: '1'})
+        res = self.client.get('/q/by_id?id=1', headers={**ADMIN, dataplane.SECRET_HEADER: SECRET, WANTED: '1',
+                                                         **PAIRED})
         self.assertIsNone(res.headers.get(dataplane.PLAN_HEADER))
 
     def test_never_for_a_key_with_a_rate_limit(self):
@@ -131,7 +134,7 @@ class WhoGetsAPlanTests(PlanTestCase):
 
     def test_a_refusal_gets_none(self):
         res = self.client.get('/q/by_id?id=x', headers={'X-API-Key': self.plain, dataplane.SECRET_HEADER: SECRET,
-                                                         WANTED: '1'})
+                                                         WANTED: '1', **PAIRED})
         self.assertEqual(res.status_code, 400)
         self.assertIsNone(res.headers.get(dataplane.PLAN_HEADER))
 
@@ -142,6 +145,49 @@ class WhoGetsAPlanTests(PlanTestCase):
         self.assertNotEqual(before['api_key'], after['api_key'])
         self.assertEqual(before['saved_query'], after['saved_query'])
 
+    def test_never_to_a_data_plane_from_another_release(self):
+        # The protocol between the two is internal: a pair from two releases forwards every call instead (ADR 0030)
+        for version in (None, '0.1.0', __version__ + '.1', ''):
+            with self.subTest(version=version):
+                headers = {'X-API-Key': self.plain, dataplane.SECRET_HEADER: SECRET, WANTED: '1'}
+                if version is not None:
+                    headers[dataplane.VERSION_HEADER] = version
+                dataplane._unpaired_seen.discard(version)
+                with self.assertLogs('queryapigate', 'WARNING') as logged:  # once for each version it meets
+                    res = self.client.get('/q/by_id?id=1', headers=headers)
+                    self.client.get('/q/by_id?id=1', headers=headers)
+                self.assertEqual(sum('another release' in line for line in logged.output), 1)
+                self.assertEqual(res.status_code, 200)  # answered all the same
+                self.assertIsNone(res.headers.get(dataplane.PLAN_HEADER))
+
+    def test_the_data_plane_is_built_as_this_release(self):
+        root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+        with open(os.path.join(root, 'dataplane', 'Cargo.toml')) as f:
+            crate = re.search(r'^version = "([^"]+)"', f.read(), re.M).group(1)
+        with open(os.path.join(root, 'dataplane', 'Cargo.lock')) as f:
+            locked = re.search(r'name = "queryapigate-dataplane"\nversion = "([^"]+)"', f.read()).group(1)
+        self.assertEqual((crate, locked), (__version__, __version__),
+                         'set dataplane/Cargo.toml\'s version to the release, then build it to update Cargo.lock')
+
+    def test_the_image_builds_it_with_the_pinned_toolchain(self):
+        # rust-toolchain.toml isn't copied into the image's build, so rustup doesn't fetch one there: the stage's
+        # image must be that toolchain, on the Debian release the Python image is on (the same glibc)
+        root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+        with open(os.path.join(root, 'dataplane', 'rust-toolchain.toml')) as f:
+            channel = re.search(r'^channel = "([^"]+)"', f.read(), re.M).group(1)
+        with open(os.path.join(root, 'Dockerfile')) as f:
+            dockerfile = f.read()
+        rust = re.search(r'^FROM --platform=\$BUILDPLATFORM rust:([\d.]+)-slim-(\w+)@sha256:\w+ AS dataplane$',
+                         dockerfile, re.M)
+        python = re.search(r'^FROM python:[\d.]+-slim@sha256:\w+$', dockerfile, re.M)
+        self.assertIsNotNone(rust, 'the data plane stage: rust:<channel>-slim-<debian>@sha256:..., by digest')
+        self.assertIsNotNone(python)
+        self.assertEqual(rust.group(1), channel)
+        self.assertEqual(rust.group(2), 'trixie', 'the Debian release python:3.12-slim is on')
+        self.assertNotIn('COPY dataplane/ ', dockerfile)
+        self.assertIn('COPY --from=dataplane /queryapigate-dataplane /usr/local/bin/queryapigate-dataplane',
+                      dockerfile)
+
     def test_never_unless_the_data_plane_asks_for_one(self):
         res = self.client.get('/q/by_id?id=1', headers={'X-API-Key': self.plain, dataplane.SECRET_HEADER: SECRET})
         self.assertEqual(res.status_code, 200)
@@ -161,7 +207,7 @@ class WhoGetsAPlanTests(PlanTestCase):
             db.connection().execute("UPDATE api_keys SET details_json = ? WHERE name = 'restricted'",
                                     (json.dumps(details),))
             self.assertEqual(self.client.get('/q/by_id?id=1', headers=forwarded).status_code, 200)  # cached
-            wanting = {**forwarded, WANTED: '1'}
+            wanting = {**forwarded, WANTED: '1', **PAIRED}
             self.assertEqual(self.client.get('/q/by_id?id=1', headers=wanting).status_code, 403)  # read fresh
 
     def test_the_metadata_cache_is_bypassed_for_the_data_plane(self):
@@ -169,7 +215,7 @@ class WhoGetsAPlanTests(PlanTestCase):
             self.call('/q/by_id?id=1', self.restricted)  # cached for ordinary calls, from here on
             apikeys.update_key('restricted', allowed_tables=['orders'])
             res = self.client.get('/q/by_id?id=1', headers={'X-API-Key': self.restricted,
-                                                             dataplane.SECRET_HEADER: SECRET, WANTED: '1'})
+                                                             dataplane.SECRET_HEADER: SECRET, WANTED: '1', **PAIRED})
         self.assertEqual(res.status_code, 403)  # the fresh grant, not the cached one
 
 

{queryapigate-0.46.0 → queryapigate-0.47.0}/tests/test_helm.py

@@ -181,6 +181,51 @@ class ShapeTests(unittest.TestCase):
         self.assertFalse(any(e['name'] == 'QUERYAPIGATE_METRICS_TOKEN' for d in by_kind(off, 'Deployment')
                              for e in container(d)['env']))
 
+    def test_the_data_plane_in_front_of_each_api_server_pod(self):
+        """dataplane (ADR 0030): a second container from the same image takes the pod's port, Python moves to its
+        loopback, and the two share a secret the chart makes and keeps - the events and MCP pods are left as they
+        are."""
+        docs = render(*POSTGRES, '--set', 'dataplane.enabled=true', '--set', 'ingress.enabled=true',
+                      '--set', 'events.enabled=true', '--set', 'mcp.enabled=true')
+        [secret] = by_kind(docs, 'Secret', 'qag-queryapigate-dataplane')
+        self.assertGreaterEqual(len(secret['data']['secret']), 48)
+        server = by_kind(docs, 'Deployment', 'qag-queryapigate')[0]
+        python, dataplane = server['spec']['template']['spec']['containers']
+        self.assertEqual((python['name'], dataplane['name']), ('queryapigate', 'dataplane'))
+        self.assertEqual((dataplane['image'], dataplane['command']), (python['image'], ['queryapigate-dataplane']))
+        shared = {'secretKeyRef': {'name': 'qag-queryapigate-dataplane', 'key': 'secret'}}
+        python_env = {e['name']: e for e in python['env']}
+        dataplane_env = {e['name']: e for e in dataplane['env']}
+        for env in (python_env, dataplane_env):
+            self.assertEqual(env['QUERYAPIGATE_DATAPLANE_SECRET']['valueFrom'], shared)
+            self.assertEqual(env['QUERYAPIGATE_TRUST_PROXY']['value'], '1')  # the ingress: read by both now
+        self.assertEqual(python_env['QUERYAPIGATE_BIND']['value'], '127.0.0.1:5001')
+        self.assertEqual(dataplane_env['QUERYAPIGATE_DATAPLANE_LISTEN']['value'], '0.0.0.0:5000')
+        self.assertEqual(dataplane_env['QUERYAPIGATE_DATAPLANE_UPSTREAM']['value'], 'http://127.0.0.1:5001')
+        # the Service's port is the data plane's; Python's, on loopback, is checked from inside its container
+        self.assertEqual(dataplane['ports'], [{'name': 'http', 'containerPort': 5000}])
+        self.assertNotIn('ports', python)
+        self.assertIn('127.0.0.1:5001/health', ' '.join(python['livenessProbe']['exec']['command']))
+        self.assertEqual(dataplane['readinessProbe']['httpGet']['path'], '/health')
+        self.assertIn('tcpSocket', dataplane['livenessProbe'])
+        self.assertEqual(sorted(m['mountPath'] for m in dataplane['volumeMounts']), ['/data', '/tmp'])
+        self.assertEqual(dataplane['resources']['limits'], {'memory': '256Mi'})
+        for name in ('qag-queryapigate-events', 'qag-queryapigate-mcp'):
+            other = by_kind(docs, 'Deployment', name)[0]['spec']['template']['spec']['containers']
+            self.assertEqual(len(other), 1)
+            self.assertNotIn('QUERYAPIGATE_DATAPLANE_SECRET', {e['name'] for e in other[0]['env']})
+        mine = render(*POSTGRES, '--set', 'dataplane.enabled=true', '--set', 'dataplane.existingSecret=mine',
+                      '--set', 'dataplane.key=s')
+        self.assertEqual(by_kind(mine, 'Secret', 'qag-queryapigate-dataplane'), [])
+        python = by_kind(mine, 'Deployment')[0]['spec']['template']['spec']['containers'][0]
+        self.assertEqual({e['name']: e for e in python['env']}['QUERYAPIGATE_DATAPLANE_SECRET']['valueFrom'],
+                         {'secretKeyRef': {'name': 'mine', 'key': 's'}})
+        off = render(*POSTGRES)
+        self.assertEqual(by_kind(off, 'Secret', 'qag-queryapigate-dataplane'), [])
+        [python] = by_kind(off, 'Deployment')[0]['spec']['template']['spec']['containers']
+        self.assertEqual(python['ports'], [{'name': 'http', 'containerPort': 5000}])
+        self.assertNotIn('QUERYAPIGATE_BIND', {e['name'] for e in python['env']})  # the image's own: 0.0.0.0:5000
+
     def test_the_optional_parts(self):
         docs = render(*POSTGRES, '--set', 'serviceMonitor.enabled=true', '--set', 'networkPolicy.enabled=true',
                       '--set', 'autoscaling.enabled=true')
@@ -210,6 +255,11 @@ class HardeningTests(unittest.TestCase):
             self.assertEqual(sorted(m['mountPath'] for m in ctr['volumeMounts']), ['/data', '/tmp'])
             self.assertIn('limits', ctr['resources'])
             self.assertEqual(ctr['readinessProbe']['httpGet']['path'], '/health')
+        # the data plane's container is held to the same
+        server = by_kind(render(*POSTGRES, '--set', 'dataplane.enabled=true'), 'Deployment')[0]
+        dataplane = server['spec']['template']['spec']['containers'][1]
+        self.assertEqual(dataplane['securityContext'], container(deployments[0])['securityContext'])
+        self.assertIn('limits', dataplane['resources'])
 
 
 @unittest.skipUnless(HELM, 'set QUERYAPIGATE_TEST_HELM, or put helm on PATH')
@@ -240,7 +290,13 @@ class RefusalTests(unittest.TestCase):
                   '--set', 'configAsCode.existingConfigMap=y'), 'choose one'),
                 ((*SECRET, '--set', 'config.QUERYAPIGATE_CONFIG_FILE=/x'), 'through configAsCode'),
                 ((*SECRET, '--set', 'config.QUERYAPIGATE_METRICS_TOKEN=x'), 'comes from metricsAuth'),
-                ((*SECRET, '--set', 'secret.values.QUERYAPIGATE_METRICS_TOKEN=x'), 'comes from metricsAuth')):
+                ((*SECRET, '--set', 'secret.values.QUERYAPIGATE_METRICS_TOKEN=x'), 'comes from metricsAuth'),
+                ((*SECRET, '--set', 'config.QUERYAPIGATE_DATAPLANE_SECRET=x'),
+                 'QUERYAPIGATE_DATAPLANE_SECRET is a secret'),
+                ((*SECRET, '--set', 'dataplane.enabled=true', '--set', 'secret.values.QUERYAPIGATE_DATAPLANE_SECRET=x'),
+                 'comes from dataplane'),
+                ((*SECRET, '--set', 'config.QUERYAPIGATE_BIND=0.0.0.0:8080'), "is the chart's to set"),
+                ((*SECRET, '--set', 'dataplane.threads=4'), 'threads')):  # not a value: config has its settings
             failed, stderr = refused(*args)
             self.assertTrue(failed, args)
             self.assertIn(words, stderr, args)

{queryapigate-0.46.0 → queryapigate-0.47.0}/tests/test_integration.py

@@ -342,8 +342,8 @@ class IntegrationBase:
             return self.client.post('/api/v1/queries', json={'name': name, 'description': 'd', 'sql': sql,
                                                              'connection_name': 'it', 'publish': True, **fields})
 
-        def call(tool, **arguments):
-            return mcp_server.handle_call(self.client.application, '', '', '10.0.0.1', tool,
+        def call(tool, **arguments):  # with no key set, as a local client: open access answers no other
+            return mcp_server.handle_call(self.client.application, '', '', '127.0.0.1', tool,
                                           arguments)['structuredContent']
 
         def names():

{queryapigate-0.46.0 → queryapigate-0.47.0}/tests/test_mcp.py

@@ -59,6 +59,82 @@ class McpTestCase(unittest.TestCase):
         return res.get_json()['secret']
 
 
+@unittest.skipUnless(HAVE_MCP_SDK, 'the mcp package is not installed')
+class OpenAccessTests(McpTestCase):
+    """With no key, administrator, JWT or OAuth configured, the MCP server answers only local clients - as REST's gate
+    does (open_access_remote) - however a client reaches it. Before 0.47 it let any client in as the unrestricted OPEN
+    caller: every saved query, ad-hoc SQL on every connection, an agent's writes."""
+
+    def setUp(self):
+        super().setUp()
+        self.save('q1')
+        os.environ.pop('QUERYAPIGATE_API_KEY')  # the patch.dict in McpTestCase restores it
+        self.assertFalse(apikeys.auth_required())
+
+    def http(self, peer):
+        from starlette.testclient import TestClient
+        client = TestClient(mcp_server.build_asgi_app(self.app), client=(peer, 50000))
+        client.__enter__()
+        self.addCleanup(client.__exit__, None, None, None)
+        return client
+
+    def initialize(self, client, headers=None):
+        return client.post('/mcp/', headers={'Accept': 'application/json, text/event-stream', **(headers or {})},
+                           json={'jsonrpc': '2.0', 'id': 1, 'method': 'initialize',
+                                 'params': {'protocolVersion': '2025-06-18', 'capabilities': {},
+                                            'clientInfo': {'name': 'test', 'version': '1'}}})
+
+    def test_a_remote_client_is_refused_before_anything_is_answered(self):
+        # 172.17.0.1 is how a client reaching `docker run -p` looks from inside the container, even from the host
+        for peer in ('203.0.113.9', '172.17.0.1', '10.0.0.5', '::ffff:10.0.0.5', 'testclient'):
+            with self.subTest(peer=peer):
+                res = self.initialize(self.http(peer))
+                self.assertEqual((res.status_code, res.json()['code']), (403, 'open_access_remote'))
+                self.assertIn('QUERYAPIGATE_API_KEY', res.json()['error'])
+
+    def test_a_local_client_is_answered_as_before(self):
+        for peer in ('127.0.0.1', '::1'):
+            with self.subTest(peer=peer):
+                self.assertEqual(self.initialize(self.http(peer)).status_code, 200)
+
+    def test_a_tool_call_and_the_tool_listing_judge_the_peer_too(self):
+        refused = mcp_server.handle_call(self.app, '', '', '203.0.113.9', 'q1', {})
+        self.assertTrue(refused['isError'])
+        self.assertEqual(refused['structuredContent']['code'], 'open_access_remote')
+        self.assertFalse(mcp_server.handle_call(self.app, '', '', '127.0.0.1', 'q1', {}).get('isError'))
+        self.assertIsNone(mcp_server.permission_for_listing(self.app, '', '', '203.0.113.9'))
+        self.assertIsNone(mcp_server.permission_for_listing(self.app, '', '', None))  # no address: remote
+        self.assertIs(mcp_server.permission_for_listing(self.app, '', '', '127.0.0.1'), apikeys.OPEN)
+
+    def served(self, peer, trusted):
+        """A client as run() serves it: the socket peer kept, then Uvicorn's proxy headers with `trusted` hosts."""
+        from starlette.testclient import TestClient
+        from uvicorn.middleware.proxy_headers import ProxyHeadersMiddleware
+        app = mcp_server.keep_socket_peer(ProxyHeadersMiddleware(mcp_server.build_asgi_app(self.app),
+                                                                 trusted_hosts=trusted))
+        client = TestClient(app, client=(peer, 50000))
+        client.__enter__()
+        self.addCleanup(client.__exit__, None, None, None)
+        return client
+
+    def test_a_forged_x_forwarded_for_doesn_t_make_a_remote_client_local(self):
+        # FORWARDED_ALLOW_IPS=* trusts every peer's X-Forwarded-For: the connection's own address still decides
+        res = self.initialize(self.served('203.0.113.9', '*'), {'X-Forwarded-For': '127.0.0.1'})
+        self.assertEqual((res.status_code, res.json()['code']), (403, 'open_access_remote'))
+
+    def test_a_remote_client_sent_on_by_a_proxy_on_this_host_is_refused(self):
+        proxy = self.served('127.0.0.1', '127.0.0.1')
+        res = self.initialize(proxy, {'X-Forwarded-For': '203.0.113.9'})
+        self.assertEqual((res.status_code, res.json()['code']), (403, 'open_access_remote'))
+        self.assertEqual(self.initialize(proxy).status_code, 200)  # the proxy's own call, or a local one, is answered
+
+    def test_with_a_key_configured_a_remote_client_with_it_is_let_in(self):
+        os.environ['QUERYAPIGATE_API_KEY'] = 'admin-key'
+        client = self.http('203.0.113.9')
+        self.assertEqual(self.initialize(client, {'X-API-Key': 'admin-key'}).status_code, 200)
+        self.assertEqual(self.initialize(client).json()['code'], 'unauthorized')  # and without it, the usual 401
+
+
 class IsReadOnlyTests(unittest.TestCase):
     def test_select_is_read_only(self):
         self.assertTrue(mcp_server.is_read_only({'sql_query': 'SELECT * FROM t'}))