queryapigate 0.7.0__tar.gz → 0.8.0__tar.gz

{queryapigate-0.7.0/queryapigate.egg-info → queryapigate-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: queryapigate
-Version: 0.7.0
+Version: 0.8.0
 Summary: Turn SQL into a REST API: run queries against MySQL, PostgreSQL, ClickHouse, SQLite or H2 over HTTP and get JSON, CSV, XML, YAML or XLSX back.
 Author-email: Anantha Raju C <arcswdev@gmail.com>
 License-Expression: FSL-1.1-MIT
@@ -73,6 +73,12 @@ Dynamic: license-file
 
 [**Full documentation**](https://AnanthaRajuC.github.io/QueryAPIGate/)
 
+<p align="center">
+  <a href="https://www.youtube.com/watch?v=WWImFj4m95o">
+    <img src="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/demo-thumbnail.png" alt="Watch the demo: saved SQL queries as REST endpoints, scoped API keys, and the Move preview showing which keys gain or lose access" width="640">
+  </a>
+</p>
+
 **QueryAPIGate** is a self-hosted, single Flask service that runs SQL against your databases and returns the results as
 JSON, NDJSON, XML, YAML, CSV, TSV or Excel. Save a query once and it becomes a versioned endpoint with typed,
 injection-safe parameters and run history - without writing a controller, a repository layer, pagination, auth or
@@ -103,7 +109,7 @@ Crimson Garden,Comedy,PG-13,631,2
 <tr>
 <td width="25%">
 <a href="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/connections.png">
-<img src="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/connections.png" alt="Connections tab listing ClickHouse, MySQL, PostgreSQL and SQLite connections with active/inactive status and each connection's live usage: queries run, failures and average latency">
+<img src="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/connections.png" alt="Connections screen with a sidebar and All/Active/Inactive tabs, listing ClickHouse, MySQL, PostgreSQL and SQLite connections with active/inactive status and each connection's live usage: queries run, failures and average latency">
 </a>
 <br><sub>Manage connections across every supported database, with live usage per connection</sub>
 </td>
@@ -115,13 +121,13 @@ Crimson Garden,Comedy,PG-13,631,2
 </td>
 <td width="25%">
 <a href="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/api-keys.png">
-<img src="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/api-keys.png" alt="API keys tab showing keys created from roles and scoped to a collection (shown as a dashed name/ tag), an expiring partner key, per-key rate limits, and each key's last-used time and live usage">
+<img src="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/api-keys.png" alt="API keys screen showing keys created from roles and scoped to a collection (shown as a dashed name/ tag), an expiring partner key, per-key rate limits, and each key's last-used time and live usage">
 </a>
 <br><sub>Per-key permissions: connections, specific saved queries, expiry, rate limits - and what each key has actually done</sub>
 </td>
 <td width="25%">
 <a href="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/roles.png">
-<img src="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/roles.png" alt="Roles tab listing reusable permission templates - connections, read/write access, rate limit and IP allowlisting - with a New key from this shortcut">
+<img src="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/roles.png" alt="Roles screen listing reusable permission templates - connections, read/write access, rate limit and IP allowlisting - with a New key from this shortcut">
 </a>
 <br><sub>Named roles: a reusable grant template, copied onto a key once at creation</sub>
 </td>
@@ -132,19 +138,19 @@ Crimson Garden,Comedy,PG-13,631,2
 <tr>
 <td width="33%">
 <a href="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/saved-query-history.png">
-<img src="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/saved-query-history.png" alt="A saved query's History tab: every run with its time, connection, calling API key, rows, duration and request ID, with a status filter and search box">
+<img src="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/saved-query-history.png" alt="A saved query's History tab: every run with its time, calling API key, rows, duration and request ID, with a status filter and search box">
 </a>
 <br><sub>Run history per saved query: who called it, how long it took, and the request ID to find it in the logs</sub>
 </td>
 <td width="33%">
 <a href="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/audit-log.png">
-<img src="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/audit-log.png" alt="Audit Log tab listing every administrative change - saved queries, roles and API keys created or updated - with an action filter and search box">
+<img src="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/audit-log.png" alt="Audit log screen listing every administrative change - saved queries, roles and API keys created or updated - with an action filter and search box">
 </a>
 <br><sub>A durable audit log of every configuration change, filterable by action, actor and target</sub>
 </td>
 <td width="33%">
 <a href="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/metrics.png">
-<img src="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/metrics.png" alt="Metrics tab with stat tiles for requests, error rate, active queries, pool and rate limiting, bar charts of requests by status and queries by connection, and a per-connection latency table">
+<img src="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/metrics.png" alt="Metrics screen with stat tiles for requests, error rate, active queries, pool and rate limiting, bars for requests by status and queries by connection, and a per-connection latency table">
 </a>
 <br><sub>Live metrics with no Prometheus required - or import the bundled Grafana dashboard for history</sub>
 </td>
@@ -335,6 +341,11 @@ version management, API key management, an audit log of administrative changes,
 response inspection with a collapsible JSON tree for non-tabular results, a quick bar chart of any numeric
 result, and one-click "copy as curl" / "copy as TSV" for any result.
 
+The UI has a collapsible sidebar (Data, Access, Observability; `Ctrl`+`B` toggles it) and a read-only **Settings**
+screen that shows every environment variable, its effective value and whether it was set or is the default (secrets are
+reported as configured or not, never shown), with a "Copy as .env" button. Theme, table density and the default
+result format are per-browser preferences.
+
 ```text
 Connect Database
        |
@@ -610,7 +621,7 @@ instead of it - a request has to pass both. See [Per-key rate limiting](document
 Every release is published to GitHub Container Registry for `linux/amd64` and `linux/arm64`:
 
 ~~~bash
-docker run -p 5000:5000 -v "$PWD/data:/data" -e QUERYAPIGATE_API_KEY=change-me ghcr.io/anantharajuc/queryapigate:latest
+docker run -p 5000:5000 -v queryapigate-data:/data -e QUERYAPIGATE_API_KEY=change-me ghcr.io/anantharajuc/queryapigate:latest
 ~~~
 
 | Tag | Contents |
@@ -619,7 +630,10 @@ docker run -p 5000:5000 -v "$PWD/data:/data" -e QUERYAPIGATE_API_KEY=change-me g
 | `X.Y.Z-h2`, `latest-h2` | The same plus Java and the H2 driver - also the variant to use for a generic `jdbc` connection (mount your vendor's jar) |
 
 The container keeps `db_connections.json` and `saved_sql/` in `/data` (create a starter with
-`docker run --rm -v "$PWD/data:/data" ghcr.io/anantharajuc/queryapigate queryapigate init`). It runs as a non-root user under
+`docker run --rm -v queryapigate-data:/data ghcr.io/anantharajuc/queryapigate queryapigate init`). The named volume above works
+out of the box. To use a folder on the host instead (`-v "$PWD/data:/data"`), create it yourself first (`mkdir data`) and make sure
+it is writable by uid 1000, the container's user - a folder that Docker creates for you is owned by root, which the container
+cannot write to (or run with `--user "$(id -u):$(id -g)"`). It runs as a non-root user under
 gunicorn with one worker (the files are protected by an in-process lock) and a health check on `/health`. Behind a
 reverse proxy or load balancer, set `QUERYAPIGATE_TRUST_PROXY=1`. To build it yourself:
 `docker build -t queryapigate .` (add `--build-arg WITH_H2=true` for H2).
@@ -657,6 +671,7 @@ Clean up with `docker compose down -v`.
 | `/api_keys` | GET, POST | List / create scoped API keys (admin only). |
 | `/api_keys/<name>` | PATCH, DELETE | Update / revoke a scoped API key (admin only). |
 | `/audit_log` | GET | Durable record of administrative changes - keys, connections, saved queries (admin only). |
+| `/settings` | GET | The server's own configuration - each setting's effective value and whether it comes from the environment or the default; read-only, secrets never returned (admin only). |
 | `/health`, `/docs`, `/openapi.json` | GET | Liveness, Swagger UI, OpenAPI spec. |
 | `/metrics` | GET | Prometheus text-format metrics: request/query counts and latencies, pool occupancy, rate-limit rejections. |
 | `/ui` | GET | A small admin UI: manage connections and saved queries, run ad-hoc SQL. |
@@ -734,9 +749,8 @@ In plain terms - the [LICENSE](https://github.com/AnanthaRajuC/QueryAPIGate/blob
 - **You may not** make it available to others in a commercial product or service that substitutes for QueryAPIGate or
   offers the same or substantially similar functionality (for example, selling it, or hosting it as a paid service).
 - **Each version becomes MIT** on the second anniversary of the date it was released, and can then be used under MIT terms.
-- **Versions up to and including 0.6.1** were released under the MIT license and remain available under it (the
-  releases on PyPI: [`queryapigate`](https://pypi.org/project/queryapigate/) 0.5.0-0.6.1 and
-  [`sql2api`](https://pypi.org/project/sql2api/) 0.1.0-0.4.0).
+- **Versions up to and including 0.6.1** were released under the MIT license. They are no longer distributed (and the
+  repository history was reset in 0.7.0), but a copy you already obtained under MIT remains yours under those terms.
 
 Need something the license does not cover, such as offering it as part of a hosted service? Get in touch - commercial
 licensing may be available. This is a summary, not legal advice.

{queryapigate-0.7.0 → queryapigate-0.8.0}/README.md

@@ -13,6 +13,12 @@
 
 [**Full documentation**](https://AnanthaRajuC.github.io/QueryAPIGate/)
 
+<p align="center">
+  <a href="https://www.youtube.com/watch?v=WWImFj4m95o">
+    <img src="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/demo-thumbnail.png" alt="Watch the demo: saved SQL queries as REST endpoints, scoped API keys, and the Move preview showing which keys gain or lose access" width="640">
+  </a>
+</p>
+
 **QueryAPIGate** is a self-hosted, single Flask service that runs SQL against your databases and returns the results as
 JSON, NDJSON, XML, YAML, CSV, TSV or Excel. Save a query once and it becomes a versioned endpoint with typed,
 injection-safe parameters and run history - without writing a controller, a repository layer, pagination, auth or
@@ -43,7 +49,7 @@ Crimson Garden,Comedy,PG-13,631,2
 <tr>
 <td width="25%">
 <a href="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/connections.png">
-<img src="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/connections.png" alt="Connections tab listing ClickHouse, MySQL, PostgreSQL and SQLite connections with active/inactive status and each connection's live usage: queries run, failures and average latency">
+<img src="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/connections.png" alt="Connections screen with a sidebar and All/Active/Inactive tabs, listing ClickHouse, MySQL, PostgreSQL and SQLite connections with active/inactive status and each connection's live usage: queries run, failures and average latency">
 </a>
 <br><sub>Manage connections across every supported database, with live usage per connection</sub>
 </td>
@@ -55,13 +61,13 @@ Crimson Garden,Comedy,PG-13,631,2
 </td>
 <td width="25%">
 <a href="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/api-keys.png">
-<img src="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/api-keys.png" alt="API keys tab showing keys created from roles and scoped to a collection (shown as a dashed name/ tag), an expiring partner key, per-key rate limits, and each key's last-used time and live usage">
+<img src="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/api-keys.png" alt="API keys screen showing keys created from roles and scoped to a collection (shown as a dashed name/ tag), an expiring partner key, per-key rate limits, and each key's last-used time and live usage">
 </a>
 <br><sub>Per-key permissions: connections, specific saved queries, expiry, rate limits - and what each key has actually done</sub>
 </td>
 <td width="25%">
 <a href="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/roles.png">
-<img src="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/roles.png" alt="Roles tab listing reusable permission templates - connections, read/write access, rate limit and IP allowlisting - with a New key from this shortcut">
+<img src="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/roles.png" alt="Roles screen listing reusable permission templates - connections, read/write access, rate limit and IP allowlisting - with a New key from this shortcut">
 </a>
 <br><sub>Named roles: a reusable grant template, copied onto a key once at creation</sub>
 </td>
@@ -72,19 +78,19 @@ Crimson Garden,Comedy,PG-13,631,2
 <tr>
 <td width="33%">
 <a href="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/saved-query-history.png">
-<img src="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/saved-query-history.png" alt="A saved query's History tab: every run with its time, connection, calling API key, rows, duration and request ID, with a status filter and search box">
+<img src="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/saved-query-history.png" alt="A saved query's History tab: every run with its time, calling API key, rows, duration and request ID, with a status filter and search box">
 </a>
 <br><sub>Run history per saved query: who called it, how long it took, and the request ID to find it in the logs</sub>
 </td>
 <td width="33%">
 <a href="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/audit-log.png">
-<img src="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/audit-log.png" alt="Audit Log tab listing every administrative change - saved queries, roles and API keys created or updated - with an action filter and search box">
+<img src="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/audit-log.png" alt="Audit log screen listing every administrative change - saved queries, roles and API keys created or updated - with an action filter and search box">
 </a>
 <br><sub>A durable audit log of every configuration change, filterable by action, actor and target</sub>
 </td>
 <td width="33%">
 <a href="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/metrics.png">
-<img src="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/metrics.png" alt="Metrics tab with stat tiles for requests, error rate, active queries, pool and rate limiting, bar charts of requests by status and queries by connection, and a per-connection latency table">
+<img src="https://raw.githubusercontent.com/AnanthaRajuC/QueryAPIGate/main/documentation/screenshots/metrics.png" alt="Metrics screen with stat tiles for requests, error rate, active queries, pool and rate limiting, bars for requests by status and queries by connection, and a per-connection latency table">
 </a>
 <br><sub>Live metrics with no Prometheus required - or import the bundled Grafana dashboard for history</sub>
 </td>
@@ -275,6 +281,11 @@ version management, API key management, an audit log of administrative changes,
 response inspection with a collapsible JSON tree for non-tabular results, a quick bar chart of any numeric
 result, and one-click "copy as curl" / "copy as TSV" for any result.
 
+The UI has a collapsible sidebar (Data, Access, Observability; `Ctrl`+`B` toggles it) and a read-only **Settings**
+screen that shows every environment variable, its effective value and whether it was set or is the default (secrets are
+reported as configured or not, never shown), with a "Copy as .env" button. Theme, table density and the default
+result format are per-browser preferences.
+
 ```text
 Connect Database
        |
@@ -550,7 +561,7 @@ instead of it - a request has to pass both. See [Per-key rate limiting](document
 Every release is published to GitHub Container Registry for `linux/amd64` and `linux/arm64`:
 
 ~~~bash
-docker run -p 5000:5000 -v "$PWD/data:/data" -e QUERYAPIGATE_API_KEY=change-me ghcr.io/anantharajuc/queryapigate:latest
+docker run -p 5000:5000 -v queryapigate-data:/data -e QUERYAPIGATE_API_KEY=change-me ghcr.io/anantharajuc/queryapigate:latest
 ~~~
 
 | Tag | Contents |
@@ -559,7 +570,10 @@ docker run -p 5000:5000 -v "$PWD/data:/data" -e QUERYAPIGATE_API_KEY=change-me g
 | `X.Y.Z-h2`, `latest-h2` | The same plus Java and the H2 driver - also the variant to use for a generic `jdbc` connection (mount your vendor's jar) |
 
 The container keeps `db_connections.json` and `saved_sql/` in `/data` (create a starter with
-`docker run --rm -v "$PWD/data:/data" ghcr.io/anantharajuc/queryapigate queryapigate init`). It runs as a non-root user under
+`docker run --rm -v queryapigate-data:/data ghcr.io/anantharajuc/queryapigate queryapigate init`). The named volume above works
+out of the box. To use a folder on the host instead (`-v "$PWD/data:/data"`), create it yourself first (`mkdir data`) and make sure
+it is writable by uid 1000, the container's user - a folder that Docker creates for you is owned by root, which the container
+cannot write to (or run with `--user "$(id -u):$(id -g)"`). It runs as a non-root user under
 gunicorn with one worker (the files are protected by an in-process lock) and a health check on `/health`. Behind a
 reverse proxy or load balancer, set `QUERYAPIGATE_TRUST_PROXY=1`. To build it yourself:
 `docker build -t queryapigate .` (add `--build-arg WITH_H2=true` for H2).
@@ -597,6 +611,7 @@ Clean up with `docker compose down -v`.
 | `/api_keys` | GET, POST | List / create scoped API keys (admin only). |
 | `/api_keys/<name>` | PATCH, DELETE | Update / revoke a scoped API key (admin only). |
 | `/audit_log` | GET | Durable record of administrative changes - keys, connections, saved queries (admin only). |
+| `/settings` | GET | The server's own configuration - each setting's effective value and whether it comes from the environment or the default; read-only, secrets never returned (admin only). |
 | `/health`, `/docs`, `/openapi.json` | GET | Liveness, Swagger UI, OpenAPI spec. |
 | `/metrics` | GET | Prometheus text-format metrics: request/query counts and latencies, pool occupancy, rate-limit rejections. |
 | `/ui` | GET | A small admin UI: manage connections and saved queries, run ad-hoc SQL. |
@@ -674,9 +689,8 @@ In plain terms - the [LICENSE](https://github.com/AnanthaRajuC/QueryAPIGate/blob
 - **You may not** make it available to others in a commercial product or service that substitutes for QueryAPIGate or
   offers the same or substantially similar functionality (for example, selling it, or hosting it as a paid service).
 - **Each version becomes MIT** on the second anniversary of the date it was released, and can then be used under MIT terms.
-- **Versions up to and including 0.6.1** were released under the MIT license and remain available under it (the
-  releases on PyPI: [`queryapigate`](https://pypi.org/project/queryapigate/) 0.5.0-0.6.1 and
-  [`sql2api`](https://pypi.org/project/sql2api/) 0.1.0-0.4.0).
+- **Versions up to and including 0.6.1** were released under the MIT license. They are no longer distributed (and the
+  repository history was reset in 0.7.0), but a copy you already obtained under MIT remains yours under those terms.
 
 Need something the license does not cover, such as offering it as part of a hosted service? Get in touch - commercial
 licensing may be available. This is a summary, not legal advice.

{queryapigate-0.7.0 → queryapigate-0.8.0}/queryapigate/__init__.py

@@ -1,5 +1,5 @@
 """QueryAPIGate - expose SQL databases as a REST API."""
-__version__ = '0.7.0'
+__version__ = '0.8.0'
 
 from .app import create_app  # noqa: E402  (app imports __version__)
 

{queryapigate-0.7.0 → queryapigate-0.8.0}/queryapigate/app.py

@@ -76,6 +76,10 @@ def load_examples_at_startup():
         log.warning('QUERYAPIGATE_LOAD_EXAMPLES is set but the examples could not be loaded: %s',
                     getattr(error, 'message', error))
         return
+    except Exception as error:  # a convenience must never take the server down, whatever went wrong
+        log.warning('QUERYAPIGATE_LOAD_EXAMPLES is set but the examples could not be loaded (unexpected error: %s)',
+                    error, exc_info=True)
+        return
     if added['connection'] or added['queries'] or added['roles']:
         store.record_audit('startup', 'load_examples', 'examples', added)
         log.info('Loaded the example APIs: %d queries, %d roles', len(added['queries']), len(added['roles']))
@@ -842,6 +846,16 @@ def audit_log_endpoint():
     return jsonify({'entries': list(reversed(store.read_audit_log()))}), 200
 
 
+@bp.route('/settings', methods=['GET'])
+def settings_endpoint():
+    """The server's own configuration as the admin UI's Settings screen shows it: every environment variable
+    that matters, its effective value and whether it was set or is the default. Read-only, and admin only
+    like the rest of what reveals the server's configuration. Secrets are reported as configured or not,
+    never returned."""
+    require_admin()
+    return jsonify({'sections': config.describe_settings()}), 200
+
+
 # --------------------------------------------------------------------------------------
 # Service endpoints
 # --------------------------------------------------------------------------------------

{queryapigate-0.7.0 → queryapigate-0.8.0}/queryapigate/config.py

@@ -278,3 +278,80 @@ def slow_query_threshold():
     if value == 0:
         return None
     return value if value > 0 else DEFAULT_SLOW_QUERY_THRESHOLD
+
+
+def _seconds(value):
+    return None if value is None else f'{value:g} s'
+
+
+def describe_settings():
+    """Every server setting the admin UI's Settings screen shows, grouped: [{id, title, description, rows}].
+
+    Each row is {label, description, env, value, source, env_value}. ``value`` is what to display (secrets are
+    reduced to "configured" / "enabled" - never the secret itself), ``source`` is "env" when the variable is set
+    and "default" when the built-in default applies, and ``env_value`` is the raw value for a "copy as .env"
+    export, or None for a secret so that export can never leak one. Read-only: settings are environment
+    variables, changed by restarting the server, not through the API."""
+    def row(label, description, env, value, secret=False):
+        raw = os.environ.get(env, '').strip()
+        return {'label': label, 'description': description, 'env': env, 'value': value,
+                'source': 'env' if raw else 'default', 'env_value': None if secret or not raw else raw}
+
+    def on_off(flag):
+        return 'on' if flag else 'off'
+
+    stream = stream_max_rows()
+    timeout, slow = query_timeout(), slow_query_threshold()
+    limit, export = rate_limit(), audit_log_export_file()
+    cors = cors_origins()
+    return [
+        {'id': 'general', 'title': 'General',
+         'description': 'Where this server keeps its files and what it loads at startup.', 'rows': [
+            row('Home directory', 'Folder holding db_connections.json, api_keys.json, roles.json and saved_sql/.',
+                'QUERYAPIGATE_HOME', str(home())),
+            row('Load examples', 'Load the example APIs at startup. Idempotent.',
+                'QUERYAPIGATE_LOAD_EXAMPLES', on_off(load_examples())),
+            row('H2 driver', 'JAR used for h2 connections.', 'QUERYAPIGATE_H2_JAR',
+                Path(h2_jar()).name + ('' if os.environ.get('QUERYAPIGATE_H2_JAR') else ' (bundled)'))]},
+        {'id': 'security', 'title': 'Security',
+         'description': 'Admin access, write protection and secrets at rest.', 'rows': [
+            row('Admin API key', 'Key with full access to this UI and the admin API. Unset means open access.',
+                'QUERYAPIGATE_API_KEY', 'configured' if api_key() else 'not set - open access', secret=True),
+            row('Allow writes', 'When off, statements that modify data are rejected.',
+                'QUERYAPIGATE_ALLOW_WRITES', on_off(allow_writes())),
+            row('Encryption at rest', 'Fernet key used to encrypt connection passwords on disk.',
+                'QUERYAPIGATE_SECRET_KEY', 'enabled' if secret_key() else 'off', secret=True),
+            row('Trusted proxy hops', 'Reverse proxies whose X-Forwarded-* headers are trusted.',
+                'QUERYAPIGATE_TRUST_PROXY', str(proxy_hops()))]},
+        {'id': 'execution', 'title': 'Query execution',
+         'description': 'Limits applied to every statement this server runs.', 'rows': [
+            row('Query timeout', 'Server-wide statement limit. A request may ask for less, never more. '
+                '0 disables it.', 'QUERYAPIGATE_QUERY_TIMEOUT', _seconds(timeout) or 'off'),
+            row('Max page size', 'Largest page_size a caller may request.', 'QUERYAPIGATE_MAX_PAGE_SIZE',
+                f'{max_page_size()} rows'),
+            row('Stream row cap', 'Row cap for ?stream=true exports.', 'QUERYAPIGATE_STREAM_MAX_ROWS',
+                'unbounded' if stream is None else f'{stream} rows'),
+            row('Slow query threshold', 'Queries slower than this are logged as warnings. 0 disables it.',
+                'QUERYAPIGATE_SLOW_QUERY_THRESHOLD', _seconds(slow) or 'off')]},
+        {'id': 'pool', 'title': 'Connection pool',
+         'description': 'Idle connections kept open per distinct connection.', 'rows': [
+            row('Pool size', 'Idle connections kept per connection. 0 disables pooling.',
+                'QUERYAPIGATE_POOL_SIZE', str(pool_size())),
+            row('Idle timeout', 'How long an idle pooled connection is kept before it is closed.',
+                'QUERYAPIGATE_POOL_IDLE_TIMEOUT', _seconds(pool_idle_timeout()))]},
+        {'id': 'traffic', 'title': 'Rate limits & CORS',
+         'description': 'Per-client throttling and browser origins allowed to call the API.', 'rows': [
+            row('Rate limit', 'Requests allowed per client. API keys and roles can set their own.',
+                'QUERYAPIGATE_RATE_LIMIT', format_rate_limit(limit) or 'off'),
+            row('CORS origins', 'Comma-separated origins, or * for any. Unset turns CORS off.',
+                'QUERYAPIGATE_CORS_ORIGINS',
+                'off' if cors is None else '*' if cors == '*' else ', '.join(sorted(cors)))]},
+        {'id': 'audit', 'title': 'Audit & logging',
+         'description': 'Retention of administrative actions and log format.', 'rows': [
+            row('Audit log limit', 'Entries kept in audit_log.json.', 'QUERYAPIGATE_AUDIT_LOG_LIMIT',
+                str(audit_log_limit())),
+            row('Audit export file', 'Append-only JSON-lines copy of every audit entry, never rolled off.',
+                'QUERYAPIGATE_AUDIT_LOG_EXPORT_FILE', 'not set' if export is None else str(export)),
+            row('JSON logs', 'One JSON object per line instead of plain text.', 'QUERYAPIGATE_JSON_LOGS',
+                on_off(json_logs()))]},
+    ]

{queryapigate-0.7.0 → queryapigate-0.8.0}/queryapigate/examples.py

@@ -19,6 +19,7 @@ walkthrough in ``documentation/EXAMPLES.md`` shows how to create one from the ex
 """
 import os
 import random
+import sqlite3
 from datetime import datetime, timedelta, timezone
 from typing import Any
 
@@ -78,7 +79,6 @@ CREATE INDEX rental_film_idx ON rental(film_id);
 def build_database(path, now=None, seed=42):
     """Create the example SQLite database at ``path`` (which must not exist). Deterministic for a given ``now`` and
     ``seed``. Dates are UTC, to match SQLite's own ``'now'`` that the example queries compare against."""
-    import sqlite3
     rng = random.Random(seed)
     now = now or datetime.now(timezone.utc).replace(tzinfo=None)
     titles = [f'{a} {n}' for a in _ADJECTIVES for n in _NOUNS]
@@ -274,7 +274,11 @@ def load(now=None):
         db_path = config.home() / DB_FILE
         if _marked_connection() is None:
             if not db_path.exists():
-                build_database(str(db_path), now)
+                try:
+                    build_database(str(db_path), now)
+                except sqlite3.Error as error:  # SQLite's own error type - not an OSError, so callers would miss it
+                    raise ApiError(f'Could not create the example database in {config.home()} ({error}). Is the data '
+                                   'folder writable by the user QueryAPIGate runs as?', 500) from None
             store.update_connections({CONNECTION: {'db': 'sqlite', 'database': DB_FILE, 'active': True,
                                                    'example': True}})
             added['connection'] = True

{queryapigate-0.7.0 → queryapigate-0.8.0}/queryapigate/openapi.py

@@ -400,6 +400,11 @@ def build_spec(version, saved_queries=None):
                 'summary': 'A durable record of administrative changes - API keys, roles, connections and '
                            'saved queries created, changed or removed (admin only)', 'tags': ['API keys'],
                 'responses': {'200': {'description': 'Newest entry first, capped at 500 entries'}, **_ERRORS}}},
+            '/settings': {'get': {
+                'summary': "The server's own configuration: each setting's effective value and whether it comes "
+                           'from the environment or is the default (admin only, read-only; secrets are reported '
+                           'as configured or not, never returned)', 'tags': ['Service'],
+                'responses': {'200': {'description': 'Settings grouped into sections'}, **_ERRORS}}},
             '/catalog': {'get': {
                 'summary': 'Every saved query this caller can reach, and the terms it is offered under',
                 'tags': ['Saved queries'],