queryapigate 0.46.0__tar.gz → 0.48.0__tar.gz

{queryapigate-0.46.0/queryapigate.egg-info → queryapigate-0.48.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: queryapigate
-Version: 0.46.0
+Version: 0.48.0
 Summary: Turn SQL into governed REST APIs over MySQL, PostgreSQL, ClickHouse, SQLite, DuckDB, H2, MongoDB, and Parquet/CSV/JSON files - JSON, CSV, Parquet or Excel out, with scoped keys, an admin Console and MCP for AI agents.
 Author-email: Anantha Raju C <arcswdev@gmail.com>
 License-Expression: Apache-2.0

{queryapigate-0.46.0 → queryapigate-0.48.0}/queryapigate/__init__.py

@@ -1,5 +1,5 @@
 """QueryAPIGate - expose SQL databases as a REST API."""
-__version__ = "0.46.0"
+__version__ = "0.48.0"
 
 from .app import create_app  # noqa: E402  (app imports __version__)
 

{queryapigate-0.46.0 → queryapigate-0.48.0}/queryapigate/alerts.py

@@ -44,13 +44,13 @@ _lock = threading.Lock()
 _refusals: dict[tuple, deque] = {}  # ('key' | 'client', who) -> monotonic times of rate-limit refusals
 
 
-def note_rate_limited(kind, who):
-    """One rate-limit refusal, for the 'keeps hitting its limit' alert: kind 'key' (a key's own rate_limit) or
-    'client' (QUERYAPIGATE_RATE_LIMIT, by address - checked before the caller is known)."""
+def note_rate_limited(kind, who, count=1):
+    """A rate-limit refusal (`count` of them, now), for the 'keeps hitting its limit' alert: kind 'key' (a key's own
+    rate_limit) or 'client' (QUERYAPIGATE_RATE_LIMIT, by address - checked before the caller is known)."""
     now = time.monotonic()
     with _lock:
         times = _refusals.setdefault((kind, who or 'unknown'), deque(maxlen=1000))
-        times.append(now)
+        times.extend([now] * min(count, 1000))
 
 
 # Every kind of alert, the one list: the OpenAPI enum is built from it and tests/test_alerts.py checks API.md's table.

{queryapigate-0.46.0 → queryapigate-0.48.0}/queryapigate/app.py

@@ -1,5 +1,4 @@
 """The Flask application: HTTP routes on top of the store, engine and formatters."""
-import ipaddress
 import json
 import logging
 import math
@@ -178,8 +177,10 @@ class _CapturePeer:
     Behind a data plane (dataplane.py, ADR 0028) every request comes from it, over loopback: one that carries its
     secret names the client's own socket address in X-QAG-Peer, and that address is taken as the real one - so this
     server sees the request as if the client had connected directly, ProxyFix and QUERYAPIGATE_TRUST_PROXY included.
-    A peer that isn't an IP address counts as remote, as a Unix socket does. Both headers are removed here, so
-    nothing after this layer reads, logs or passes on the secret."""
+    A peer that isn't an IP address counts as remote, as a Unix socket does. A data plane from another release
+    (X-QAG-Dataplane-Version) is still the data plane, but is given no plan (dataplane.paired()). The rate-limit buckets
+    it counted a call in before forwarding it (X-QAG-Rate-Counted, ADR 0032) are taken from it alone. Its headers are
+    removed here, so nothing after this layer reads, logs or passes on the secret."""
 
     def __init__(self, app):
         self.app = app
@@ -188,21 +189,23 @@ class _CapturePeer:
         supplied = environ.pop(dataplane.SECRET_ENVIRON, None)
         peer = environ.pop(dataplane.PEER_ENVIRON, None)
         wanted = environ.pop(dataplane.WANTED_ENVIRON, None)
+        version = environ.pop(dataplane.VERSION_ENVIRON, None)
+        rate_counted = environ.pop(dataplane.COUNTED_ENVIRON, None)
         if supplied is not None and dataplane.matches(supplied):
-            environ['queryapigate.dataplane'] = 'plan' if wanted == '1' else True
+            is_paired = dataplane.paired(version)
+            environ['queryapigate.dataplane'] = 'plan' if wanted == '1' and is_paired else True
+            environ['queryapigate.dataplane_paired'] = is_paired
+            if rate_counted is not None and is_paired:
+                environ['queryapigate.rate_counted'] = dataplane.counted(rate_counted)
             environ['REMOTE_ADDR'] = peer if dataplane.is_address(peer) else ''
         environ['queryapigate.peer_addr'] = environ.get('REMOTE_ADDR')
         return self.app(environ, start_response)
 
 
 def _peer_is_local():
-    """Whether the request's real socket peer is a loopback address. Fails closed: an address that can't be parsed,
-    or none at all (e.g. a Unix socket), counts as remote - in open-access mode the caller must then configure a key."""
-    peer = request.environ.get('queryapigate.peer_addr') or ''
-    try:
-        return ipaddress.ip_address(peer).is_loopback
-    except ValueError:
-        return False
+    """Whether the request's real socket peer is a loopback address (governance.is_loopback(), the MCP server's rule
+    too). Fails closed: in open-access mode a caller it can't place must configure a key."""
+    return governance.is_loopback(request.environ.get('queryapigate.peer_addr'))
 
 
 def create_app():
@@ -362,8 +365,7 @@ def create_app():
         # could reach the port would otherwise be an unrestricted admin. The real socket peer decides, never a
         # forgeable header. The public endpoints (health, docs, the Console shell) are reachable either way.
         if g.permission is apikeys.OPEN and request.endpoint not in PUBLIC_ENDPOINTS and not _peer_is_local():
-            raise ApiError('This server has no API key set, so it answers only local clients. Set '
-                           'QUERYAPIGATE_API_KEY to allow access from other hosts.', 403, code='open_access_remote')
+            raise ApiError(governance.OPEN_ACCESS_REMOTE, 403, code='open_access_remote')
         if g.permission is not None:
             g.permission = settle_workspace(g.permission, named)
         limited = check_key_rate_limit()
@@ -477,6 +479,10 @@ def check_rate_limit():
     """Count this request against its client's quota (governance.py); returns a 429 response when it is over."""
     if request.method == 'OPTIONS' or request.endpoint in RATE_LIMIT_EXEMPT:
         return None
+    counted = request.environ.get('queryapigate.rate_counted', {}).get('client')
+    if counted is not None and config.rate_limit() is not None:  # by the data plane, which then forwarded the call
+        g.rate_limit = counted
+        return None
     verdict = governance.check_client_limit(current_app, request.remote_addr)
     if verdict is None:
         return None
@@ -490,6 +496,10 @@ def check_key_rate_limit():
     per-key identity to limit by before then; a no-op for the admin key and the open/no-key case."""
     if request.method == 'OPTIONS' or request.endpoint in RATE_LIMIT_EXEMPT:
         return None
+    counted = request.environ.get('queryapigate.rate_counted', {}).get('key')
+    if counted is not None and getattr(g.get('permission'), 'rate_limit', None) is not None:  # as the client's, above
+        g.key_rate_limit = counted
+        return None
     verdict = governance.check_key_limit(current_app, g.get('permission'))
     if verdict is None:
         return None
@@ -1238,9 +1248,15 @@ def dataplane_runs():
 
     Each run comes with its history entry already JSON (`entry`), and the labels and timings /metrics counts it by: at
     the data plane's rates Python's own work per run - encoding it, and its labels - is what it can't keep up with, so
-    a batch is queued at once (history.record_reported()) and counted once per set of labels."""
+    a batch is queued at once (history.record_reported()) and counted once per set of labels.
+
+    `rate_limited`: the calls it refused itself with a 429 (ADR 0032) - by bucket, caller and method, one duration
+    each - counted as gate()'s own refusals are: in the rejections, the alerts and the request counters. Not runs."""
     report = request.get_json(silent=True) or {}
     runs = report.get('runs') or []
+    for refused in report.get('rate_limited') or []:
+        governance.note_refused(refused['scope'], refused.get('client'), refused.get('workspace'), refused.get('key'),
+                                refused['method'], refused['seconds'])
     broadcaster = current_app.extensions['queryapigate_broadcaster']
     with scope.using(scope.current()):  # resolved once, not by each of a busy batch's few thousand label lookups
         if report.get('recorded'):  # in the run store already: written by the data plane itself (ADR 0029 §4)
@@ -1282,6 +1298,8 @@ def dataplane_lease():
     there. 404 without a run store."""
     if not runstore.enabled():
         return jsonify(error_body('No run store is configured', 404)), 404
+    if not request.environ.get('queryapigate.dataplane_paired'):
+        return jsonify(error_body(dataplane.UNPAIRED, 409)), 409
     body = request.get_json(silent=True) or {}
     holder = body.get('holder')
     if not isinstance(holder, str) or not 0 < len(holder) <= 200:

{queryapigate-0.46.0 → queryapigate-0.48.0}/queryapigate/cli.py

@@ -127,8 +127,6 @@ def _init(args):
     inactive) now that connections are SQLite-backed - no more db_connections.json/saved_sql/ for a new
     install. On a home whose store already has connections, this is a no-op - "already exists - left
     untouched"."""
-    home = config.home()
-    home.mkdir(parents=True, exist_ok=True)
     if db.connection().execute('SELECT 1 FROM connections LIMIT 1').fetchone() is not None:
         print(f'{db.describe()} already has connections - left untouched')
         return 0
@@ -903,7 +901,7 @@ def build_parser():
     collection_import.add_argument('--dry-run', action='store_true', help='report what would happen; write nothing')
     collection_import.set_defaults(func=_collection_import)
 
-    config_parser = commands.add_parser('config', help="the server's configuration as a file (ADR 0014, experimental): "
+    config_parser = commands.add_parser('config', help="the server's configuration as a file (ADR 0014): "
                                                        'export it, see what applying one would change, apply it')
     config_parser.set_defaults(func=lambda a: config_parser.print_help() or 2)
     config_actions = config_parser.add_subparsers(dest='action')
@@ -1041,6 +1039,8 @@ def main(argv=None):
         os.environ['QUERYAPIGATE_HOME'] = args.home
     if getattr(args, 'server', None) or getattr(args, 'func', None) is _config_new_key:
         return args.func(args)  # nothing of this home's: no store opened, so none made in a CI checkout
+    if getattr(args, 'func', None) is _init:  # the one command that makes a home: the store below opens inside it
+        config.home().mkdir(parents=True, exist_ok=True)
     try:
         config.check_database_url()
         db.init_schema()

{queryapigate-0.46.0 → queryapigate-0.48.0}/queryapigate/config.py

@@ -244,6 +244,13 @@ def threads():
     return int(raw) if raw.isdigit() and 1 <= int(raw) <= MAX_THREADS else DEFAULT_THREADS
 
 
+def bind():
+    """QUERYAPIGATE_BIND: the address the Docker image's gunicorn listens on (gunicorn_conf.py) - the image sets
+    0.0.0.0:5000, and behind the Rust data plane, which then takes that port, 127.0.0.1:5001 (ADR 0030). None when
+    unset: gunicorn's own default, or its --bind."""
+    return os.environ.get('QUERYAPIGATE_BIND', '').strip() or None
+
+
 def access_log():
     """QUERYAPIGATE_ACCESS_LOG: the image's gunicorn writes an access line per request to stdout (on by default). Off
     for a server whose proxy or load balancer already logs requests - what a line costs, with no one reading it."""
@@ -1500,6 +1507,8 @@ def describe_settings():
          'description': 'Requests served at once, and idle connections kept open per distinct connection.', 'rows': [
             row('Threads', "Requests one server process serves at once - the Docker image's gunicorn. Read at "
                 'startup.', 'QUERYAPIGATE_THREADS', str(threads())),
+            row('Listen address', "Where the Docker image's gunicorn listens: 127.0.0.1:5001 behind the data plane, "
+                'which takes the public port. Read at startup.', 'QUERYAPIGATE_BIND', bind() or "gunicorn's own"),
             row('Pool size', 'Idle connections kept per connection - by default, one per thread. 0 disables pooling.',
                 'QUERYAPIGATE_POOL_SIZE', str(pool_size())),
             row('Idle timeout', 'How long an idle pooled connection is kept before it is closed.',

{queryapigate-0.46.0 → queryapigate-0.48.0}/queryapigate/dataplane.py

@@ -15,20 +15,34 @@ the rows it was computed from (the key, the saved query, the connection), so the
 whose rows digest the same, and a masked plan expires with the schema its trace was made from. The data plane never
 decides anything of its own: it applies a plan, or it forwards.
 
+A data plane from another release gets no plan, and no run store lease (app.py): the protocol between the two is
+internal, so they must come from one release (X-QAG-Dataplane-Version, ADR 0030 section 1). It then forwards every call,
+which is slower but answers as Python does.
+
 Saved queries with `{name}` text placeholders never get a plan: their values are part of the SQL text, so the verdict
 can change from one call to the next.
+
+With Redis (QUERYAPIGATE_REDIS_URL), a key's rate limit and the server-wide QUERYAPIGATE_RATE_LIMIT are counted by the
+data plane too, in the same buckets (ADR 0032): the plan carries the key's limit, and the data plane counts a call
+only once it is going to serve it. A call it forwards after counting says so (X-QAG-Rate-Counted), and is not counted
+again here. Its refusals reach /metrics and the alerts with its runs report.
 """
 import base64
 import hmac
 import ipaddress
 import json
+import logging
 
-from . import config, runners, sqltools
+from . import __version__, config, runners, sqltools
+
+log = logging.getLogger('queryapigate')
 
 SECRET_HEADER = 'X-QAG-Dataplane'
 PEER_HEADER = 'X-QAG-Peer'
 WANTED_HEADER = 'X-QAG-Plan-Wanted'
+VERSION_HEADER = 'X-QAG-Dataplane-Version'  # the data plane's release, sent with its secret
 PLAN_HEADER = 'X-QAG-Plan'
+COUNTED_HEADER = 'X-QAG-Rate-Counted'  # the rate-limit buckets a call the data plane forwards was counted in already
 VERSION = 1
 DIALECTS = ('postgres', 'mysql')  # the two the prototype serves - every other connection is forwarded
 _ROWS = ('api_key', 'saved_query', 'connection')  # what a plan names the digests of, one row set each
@@ -38,6 +52,11 @@ SECRET_ENVIRON = 'HTTP_X_QAG_DATAPLANE'  # the two headers as WSGI names them -
 PEER_ENVIRON = 'HTTP_X_QAG_PEER'
 # The data plane asks for a plan only when it would keep one: other calls it forwards keep the metadata cache
 WANTED_ENVIRON = 'HTTP_X_QAG_PLAN_WANTED'
+VERSION_ENVIRON = 'HTTP_X_QAG_DATAPLANE_VERSION'
+COUNTED_ENVIRON = 'HTTP_X_QAG_RATE_COUNTED'
+UNPAIRED = ('This data plane is from another release than this server: it gets no plans and no run store lease '
+            'until both are the same release')
+_unpaired_seen: set = set()
 
 
 def matches(supplied):
@@ -47,6 +66,16 @@ def matches(supplied):
     return bool(secret and supplied) and hmac.compare_digest(supplied.encode('utf-8', 'replace'), secret.encode())
 
 
+def paired(version):
+    """Whether a data plane that sent `version` is from this server's release - logged once per other version."""
+    if version == __version__:
+        return True
+    if version not in _unpaired_seen:
+        _unpaired_seen.add(version)
+        log.warning('%s (data plane %s, this server %s).', UNPAIRED, version or 'unknown', __version__)
+    return False
+
+
 def is_address(peer):
     """Whether X-QAG-Peer names an IP address - the client's socket address, as the data plane saw it."""
     try:
@@ -58,11 +87,29 @@ def is_address(peer):
 
 def eligible_caller(permission):
     """A caller the data plane may serve: a scoped API key - not an administrator, a signed-in user or an open server -
-    in the default workspace, with none of the limits that keep their own state (rate limit, quota, ADR 0011's)."""
+    in the default workspace, without the limits that keep state: no quota or max_concurrent, and a rate limit only
+    when Redis holds its bucket, where the data plane counts it too (ADR 0032). Without Redis each process would count
+    its own budget. A query_timeout and max_rows keep none: the plan carries them, and the data plane applies each as
+    limits.py does."""
     return (permission is not None and not permission.admin and permission.claims is None and permission.role is None
             and not permission.claim_binding and permission.workspace == 'default'
-            and permission.rate_limit is None and permission.quota is None and permission.max_concurrent is None
-            and permission.query_timeout is None and permission.max_rows is None)
+            and (permission.rate_limit is None or config.redis_url() is not None)
+            and permission.quota is None and permission.max_concurrent is None)
+
+
+def counted(value):
+    """X-QAG-Rate-Counted (`client=<limit>,<remaining>; key=<limit>,<remaining>`, either or both) as
+    {'client' | 'key': (limit, remaining)}: the buckets the data plane counted this call in before forwarding it, and
+    what they said. {} for a value of any other shape."""
+    found = {}
+    for part in (value or '').split(';'):
+        bucket, _, numbers = part.strip().partition('=')
+        limit, _, remaining = numbers.partition(',')
+        if bucket not in ('client', 'key') or bucket in found or not (limit.isascii() and limit.isdigit()
+                                                                      and remaining.isascii() and remaining.isdigit()):
+            return {}
+        found[bucket] = (int(limit), int(remaining))
+    return found
 
 
 def digests(record):
@@ -139,6 +186,11 @@ def build(record, permission, query_name, number, saved, connection_name, result
             return None
         mask = {'columns': len(masked.traced), 'actions': masked.actions, 'fired': masked.fired}
     return {'v': VERSION, 'rows': rows, 'key': {'workspace': permission.workspace, 'name': permission.name},
+            # (count, period in seconds): counted by the data plane in Redis, in the bucket Python counts it in
+            'rate_limit': list(permission.rate_limit) if permission.rate_limit else None,
+            # the key's own limits (ADR 0011), applied as limits.timeout() and limits.rows() apply them; an int
+            # query_timeout stays one, as min() keeps it
+            'query_timeout': permission.query_timeout, 'max_rows': permission.max_rows,
             'query': {'name': query_name, 'version': number}, 'connection': {'name': connection_name,
             'dialect': dialect}, 'statement': sent, 'search_path': prepared['search_path'], 'mask': mask,
             'expires_in': expires_in,

{queryapigate-0.46.0 → queryapigate-0.48.0}/queryapigate/experimental.py

@@ -70,10 +70,10 @@ FEATURES: dict[str, dict[str, Any]] = {
     },
     'dataplane': {
         'name': 'The Rust data plane in front of /q/',
-        'why': 'a prototype (ADR 0028, decided go in 0.44): built from the repository, not in the image or the chart; '
-               'what it serves, its settings and its headers may change before the ADR that ships it',
+        'why': 'decided go in 0.44 (ADR 0028) and shipped in the image and the chart (ADR 0030); what it serves, its '
+               'settings and its headers may change before it graduates',
         'settings': ('QUERYAPIGATE_DATAPLANE_SECRET',),
-        'docs': ('documentation/DEPLOYMENT.md', 'A Rust data plane in front of /q/ (prototype)'),
+        'docs': ('documentation/DEPLOYMENT.md', 'A Rust data plane in front of /q/'),
     },
     'run_store': {
         'name': 'A ClickHouse run store for history, the event log and usage',

{queryapigate-0.46.0 → queryapigate-0.48.0}/queryapigate/governance.py

@@ -10,9 +10,13 @@ The limiters are held on the Flask app. With QUERYAPIGATE_REDIS_URL set they cou
 process - `queryapigate serve`, `queryapigate mcp`, `queryapigate events` - shares one budget per client and per key
 (BACKLOG #55); without it each process counts on its own.
 """
+import ipaddress
 from dataclasses import dataclass
 
-from . import admins, alerts, apikeys, config, jwtauth, metrics
+from . import admins, alerts, apikeys, config, jwtauth, metrics, ratelimit
+
+OPEN_ACCESS_REMOTE = ('This server has no API key set, so it answers only local clients. Set QUERYAPIGATE_API_KEY '
+                      'to allow access from other hosts.')
 
 
 @dataclass(frozen=True)
@@ -24,6 +28,15 @@ class Verdict:
     retry_after: int
 
 
+def is_loopback(peer):
+    """Whether a connection's real peer is a loopback address - the one caller open-access mode answers. Fails closed:
+    an address that can't be parsed, or none at all (a Unix socket, a test client's name), counts as remote."""
+    try:
+        return ipaddress.ip_address(peer or '').is_loopback
+    except ValueError:
+        return False
+
+
 def authenticate(api_key, authorization, client_ip):
     """The caller's Permission: a matched key (admin or scoped), a signed-in user's verified bearer token
     (jwtauth.py), the unrestricted OPEN default when no key is configured anywhere, or None when a key is required
@@ -42,13 +55,20 @@ def authenticate(api_key, authorization, client_ip):
     return None if apikeys.auth_required() else apikeys.OPEN
 
 
-def authenticate_mcp(api_key, authorization, client_ip):
+def authenticate_mcp(api_key, authorization, client_ip, peer=None):
     """(Permission, None) for a caller the MCP server lets in, else (None, refusal) - a jwtauth.McpRefusal saying
     401 or 403 and why. An API key is judged as everywhere. A bearer token, with OAuth on for the MCP server
     (ADR 0006), must be one issued for it - a REST token isn't, however valid; with OAuth off, REST's JWT settings
-    apply, as before."""
+    apply, as before. Open access is for a local caller only: `client_ip` (the client a trusted proxy names, if one
+    does) and the connection's own `peer`, when it's known, must both be loopback - so neither a remote client sent
+    on by a proxy on this host, nor a forged X-Forwarded-For that a too-wide FORWARDED_ALLOW_IPS would honour, gets
+    in."""
     if api_key or not authorization or not config.mcp_oauth_enabled():
         permission = authenticate(api_key, authorization, client_ip)
+        if permission is apikeys.OPEN and not (is_loopback(client_ip) and (peer is None or is_loopback(peer))):
+            # No key, administrator, JWT or OAuth configured anywhere: the unrestricted OPEN caller, which only a local
+            # client may be - as REST's gate refuses it (app.py). Before 0.47 the MCP server let any client in as it.
+            return None, jwtauth.McpRefusal(403, 'open_access_remote', OPEN_ACCESS_REMOTE)
         if permission is not None:
             return permission, None
         return None, jwtauth.McpRefusal(401, 'unauthorized', 'Unauthorized: missing or invalid X-API-Key or bearer '
@@ -78,13 +98,26 @@ def check_key_limit(flask_app, permission):
         return None
     count, period = permission.rate_limit
     allowed, remaining, retry_after = flask_app.extensions['queryapigate_key_limiter'].hit(
-        permission.name, count, period)
+        ratelimit.budget_name(permission), count, period)
     if not allowed:
         metrics.inc_rate_limit_rejection()
         alerts.note_rate_limited('key', (getattr(permission, 'workspace', 'default'), permission.name))
     return Verdict(allowed, count, remaining, retry_after)
 
 
+def note_refused(scope, client_ip, workspace, key, method, elapsed):
+    """429s the data plane answered itself (ADR 0032), one duration each: counted as check_client_limit() and
+    check_key_limit() count their own - the rejections and the alerts - and in the request counters, as the calls they
+    were. `scope` is 'client' (by `client_ip`, before the caller is known: no key label) or 'key'."""
+    if scope == 'client':
+        who, label = client_ip, '-'
+    else:
+        who, label = (workspace or 'default', key), key or '-'
+    metrics.inc_rate_limit_rejection(len(elapsed))
+    alerts.note_rate_limited(scope, who, len(elapsed))
+    metrics.observe_requests(method, 'api.run_named_query', '429', elapsed, label)
+
+
 def observe(method, endpoint, status, elapsed, key):
     """One finished call in /metrics' request counters and latency histograms. REST passes the HTTP method and its
     route's endpoint; MCP passes method 'MCP' and an 'mcp.*' endpoint, so the two can be told apart."""

{queryapigate-0.46.0 → queryapigate-0.48.0}/queryapigate/gunicorn_conf.py

@@ -2,12 +2,26 @@
 (QUERYAPIGATE_THREADS, default 8), whether there is an access log at all (QUERYAPIGATE_ACCESS_LOG, on by default, to
 stdout), and its format - paths without their query strings, unless QUERYAPIGATE_ACCESS_LOG_QUERY=1 (accesslog.py, ADR
 0016). The image uses it; so can any gunicorn command running QueryAPIGate. A value given on gunicorn's command line,
-or in GUNICORN_CMD_ARGS, overrides the one here, as gunicorn reads a config file first."""
+or in GUNICORN_CMD_ARGS, overrides the one here, as gunicorn reads a config file first.
+
+Where it listens: QUERYAPIGATE_BIND, which the image sets to 0.0.0.0:5000 and the Helm chart to 127.0.0.1:5001 behind
+the data plane; unset, gunicorn's own default.
+
+Behind the Rust data plane (QUERYAPIGATE_DATAPLANE_SECRET set, ADR 0030) every request reaches gunicorn over loopback,
+which gunicorn trusts by default to set the scheme (X-Forwarded-Proto, -Ssl, -Protocol) and SCRIPT_NAME from headers -
+a client's own, passed on. So it trusts no peer's then, unless FORWARDED_ALLOW_IPS says otherwise: Python reads the
+client's forwarding headers through ProxyFix, as QUERYAPIGATE_TRUST_PROXY says, as it does without the data plane."""
 # Every name at the top of this file is read as a gunicorn setting of that name, and `config` is one (the config file's
 # own path): imported under it, gunicorn refuses to start. Hence the underscores.
+import os as _os
+
 from queryapigate import config as _settings
 from queryapigate.accesslog import gunicorn_format as _gunicorn_format
 
 threads = _settings.threads()
 accesslog = '-' if _settings.access_log() else None  # None: no access log - not one written to /dev/null
 access_log_format = _gunicorn_format()
+if _settings.bind():
+    bind = _settings.bind()
+if _settings.dataplane_secret() and 'FORWARDED_ALLOW_IPS' not in _os.environ:
+    forwarded_allow_ips = ''

{queryapigate-0.46.0 → queryapigate-0.48.0}/queryapigate/limits.py

@@ -229,10 +229,11 @@ def acquire(query_timeout=None):
     lease = (query_timeout or LEASE_WITHOUT_TIMEOUT) + LEASE_MARGIN
     token = secrets.token_hex(8)
     store = counter()
-    if not store.acquire(permission.name, maximum, token, lease):
+    name = ratelimit.budget_name(permission)
+    if not store.acquire(name, maximum, token, lease):
         raise ApiError(f'This caller already has {maximum} queries running, its max_concurrent - retry when one '
                        'finishes', 429, code='too_many_concurrent', retry_after=1, max_concurrent=maximum)
-    return Slot(permission.name, token, lease, store)
+    return Slot(name, token, lease, store)
 
 
 def effective(grants):

{queryapigate-0.46.0 → queryapigate-0.48.0}/queryapigate/mcp_server.py

@@ -20,6 +20,7 @@ package isn't."""
 import functools
 import json
 import logging
+import os
 import re
 import time
 import urllib.parse
@@ -343,7 +344,9 @@ def call_tool_for(flask_app, permission, name, arguments):
             structured = g.agent_write_result
             return {'content': [{'type': 'text', 'text': json.dumps(structured, default=str)}],
                     'structuredContent': structured}
-        structured = {'rows': response.get_json(), 'truncated': response.headers.get('X-Has-More') == 'true'}
+        # REST answers no rows with {"message": "No results returned"}; a tool's rows are a list (its outputSchema)
+        rows = response.get_json() if response.headers.get('X-Row-Count') != '0' else []
+        structured = {'rows': rows, 'truncated': response.headers.get('X-Has-More') == 'true'}
         return _rows_result(structured)
 
 
@@ -604,6 +607,17 @@ def permission_for_listing(flask_app, api_key, authorization, client_ip):
 
 
 PERMISSION_STATE = 'queryapigate_permission'  # where the gate leaves the caller, in the ASGI scope's state
+SOCKET_PEER = 'queryapigate.socket_peer'  # the connection's own address, kept before X-Forwarded-For can replace it
+
+
+def keep_socket_peer(app):
+    """Record each request's real socket peer in its scope, for the gate's open-access rule, before the proxy-header
+    middleware inside it rewrites `client` from X-Forwarded-For (run())."""
+    async def wrapped(scope, receive, send):
+        if scope['type'] == 'http' and scope.get('client'):
+            scope[SOCKET_PEER] = scope['client'][0]
+        return await app(scope, receive, send)
+    return wrapped
 
 
 def resource_metadata_url():
@@ -659,7 +673,8 @@ def gate(flask_app, inner):
                                     headers={'Retry-After': str(verdict.retry_after), 'X-Request-Id': request_id})
         else:
             api_key, authorization = headers.get('x-api-key', ''), headers.get('authorization', '')
-            permission, refusal = governance.authenticate_mcp(api_key, authorization, client_ip)
+            permission, refusal = governance.authenticate_mcp(api_key, authorization, client_ip,
+                                                              peer=scope.get(SOCKET_PEER))
             if permission is not None:
                 scope.setdefault('state', {})[PERMISSION_STATE] = permission
                 return await inner(scope, receive, send)
@@ -784,7 +799,11 @@ def build_asgi_app(flask_app):
 
 
 def run(flask_app, host, port):
-    """Serves build_asgi_app() until interrupted."""
+    """Serves build_asgi_app() until interrupted. Uvicorn's own proxy-header handling is applied here instead, with
+    the same trusted hosts (FORWARDED_ALLOW_IPS, else loopback), so the socket peer can be kept before it."""
     import uvicorn
+    from uvicorn.middleware.proxy_headers import ProxyHeadersMiddleware
 
-    uvicorn.run(build_asgi_app(flask_app), host=host, port=port, server_header=False)  # no version banner
+    trusted = os.environ.get('FORWARDED_ALLOW_IPS', '127.0.0.1,::1')  # uvicorn.Config's own default
+    app = keep_socket_peer(ProxyHeadersMiddleware(build_asgi_app(flask_app), trusted_hosts=trusted))
+    uvicorn.run(app, host=host, port=port, server_header=False, proxy_headers=False)  # no version banner

{queryapigate-0.46.0 → queryapigate-0.48.0}/queryapigate/metrics.py

@@ -180,10 +180,10 @@ def dec_active_query():
         _active_queries -= 1
 
 
-def inc_rate_limit_rejection():
+def inc_rate_limit_rejection(count=1):
     global _rate_limit_rejections
     with _lock:
-        _rate_limit_rejections += 1
+        _rate_limit_rejections += count
 
 
 def inc_rate_limit_fallback():

{queryapigate-0.46.0 → queryapigate-0.48.0}/queryapigate/ratelimit.py

@@ -120,6 +120,15 @@ end
 return {allowed, math.floor(tokens), retry}
 """
 _PREFIX = 'qag:ratelimit:'
+
+
+def budget_name(permission):
+    """What a caller's own budgets - its rate limit's bucket, its max_concurrent slots (limits.py) - are counted
+    under: `<workspace>~<name>`, as quotas count theirs. A name is unique only within its workspace, so two workspaces'
+    keys of one name are two callers; no workspace name has a `~`."""
+    return f"{getattr(permission, 'workspace', None) or 'default'}~{permission.name}"
+
+
 _DEGRADED_FOR = 600  # seconds a Redis failure keeps the "limits are per instance right now" alert up
 _degraded_at = None
 _last_warned = 0.0

{queryapigate-0.46.0 → queryapigate-0.48.0}/queryapigate/sqltools.py

@@ -270,7 +270,11 @@ def paginate(sql, limit, offset, params=None, dialect=None):
 # Parameters
 # --------------------------------------------------------------------------------------
 
-def _check_value(name, value):
+def _check_value(name, value, dialect=None):
+    if isinstance(value, str) and dialect == 'postgres' and '\x00' in value:
+        # psycopg2 refuses it ("A string literal cannot contain NUL") - the caller's value, not the query, is wrong
+        raise ApiError(f"Parameter '{name}' contains a NUL character, which PostgreSQL text can't hold",
+                       code='param_invalid')
     if value is None or isinstance(value, (bool, str)):
         return
     if isinstance(value, (int, float)) and math.isfinite(value):
@@ -344,7 +348,7 @@ def bind_parameters(sql, params, style, dialect=None):
     if missing:
         raise ApiError(f"No value provided for parameter(s): {', '.join(missing)}", code='param_required')
     for name in set(names):
-        _check_value(name, params[name])
+        _check_value(name, params[name], dialect)
 
     escape = (lambda text: text.replace('%', '%%')) if style in ('format', 'pyformat') else (lambda text: text)
     pieces, position = [], 0

{queryapigate-0.46.0 → queryapigate-0.48.0/queryapigate.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: queryapigate
-Version: 0.46.0
+Version: 0.48.0
 Summary: Turn SQL into governed REST APIs over MySQL, PostgreSQL, ClickHouse, SQLite, DuckDB, H2, MongoDB, and Parquet/CSV/JSON files - JSON, CSV, Parquet or Excel out, with scoped keys, an admin Console and MCP for AI agents.
 Author-email: Anantha Raju C <arcswdev@gmail.com>
 License-Expression: Apache-2.0

{queryapigate-0.46.0 → queryapigate-0.48.0}/tests/test_cli.py

@@ -199,5 +199,18 @@ class LegacySettingsTests(unittest.TestCase):
             self.assertEqual(config.api_key(), 'secret')
 
 
+class InitTests(unittest.TestCase):
+    def test_init_makes_a_home_that_doesn_t_exist_yet(self):
+        tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(tmp.cleanup)
+        home = os.path.join(tmp.name, 'new', 'home')
+        out = io.StringIO()
+        with mock.patch.dict(os.environ, {'QUERYAPIGATE_HOME': home}), redirect_stdout(out):
+            self.assertEqual(cli.main(['init']), 0)
+            self.assertTrue(store.read_connections())  # the templates, in the store it made
+        self.assertTrue(os.path.isdir(home))
+        self.assertIn('Created', out.getvalue())
+
+
 if __name__ == '__main__':
     unittest.main()