querysource 4.5.1__tar.gz → 4.5.4__tar.gz

{querysource-4.5.1 → querysource-4.5.4}/Makefile

@@ -10,6 +10,13 @@ PYTHON_VERSION := 3.11
 HAS_UV := $(shell command -v uv 2> /dev/null)
 HAS_PIP := $(shell command -v pip 2> /dev/null)
 
+# Run maturin via `uv run` so it resolves the project venv (.venv) regardless of
+# whether the venv is activated or on PATH. `--with maturin` ensures the tool is
+# available ephemerally, so no separate `uv pip install maturin` step is needed.
+# (Each Makefile recipe line runs in its own subshell, so installing maturin in
+# one line does not put it on PATH for the next.)
+MATURIN := uv run --with maturin maturin
+
 # Install uv for faster workflows
 install-uv:
 	curl -LsSf https://astral.sh/uv/install.sh | sh
@@ -45,8 +52,7 @@ develop: build-rust
 # avoiding the "build-backend not set to maturin" warning emitted when reading the
 # root pyproject.toml (which uses setuptools for the rest of the project).
 build-rust:
-	@command -v maturin >/dev/null 2>&1 || uv pip install maturin
-	maturin develop --release --manifest-path rust/Cargo.toml
+	$(MATURIN) develop --release --manifest-path rust/Cargo.toml
 
 # Stage the compiled Rust extension (.so) INTO the source tree so that
 # `uv build` (setuptools backend) bundles it into the wheel. setuptools only
@@ -56,8 +62,7 @@ build-rust:
 # tree, so the wheel would otherwise ship without the Rust extension.
 RUST_WHEEL_OUT := target/wheels
 stage-rust:
-	@command -v maturin >/dev/null 2>&1 || uv pip install maturin
-	maturin build --release -i python --manifest-path rust/Cargo.toml --out $(RUST_WHEEL_OUT)
+	$(MATURIN) build --release -i python --manifest-path rust/Cargo.toml --out $(RUST_WHEEL_OUT)
 	@whl=$$(ls -t $(RUST_WHEEL_OUT)/qs_parsers-*.whl | head -1); \
 	  test -n "$$whl" || { echo "ERROR: maturin produced no wheel in $(RUST_WHEEL_OUT)"; exit 1; }; \
 	  echo "Staging Rust extension from $$whl"; \

{querysource-4.5.1 → querysource-4.5.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: querysource
-Version: 4.5.1
+Version: 4.5.4
 Summary: Aiohttp web service for querying several databases easily
 Author-email: Jesus Lara <jesuslarag@gmail.com>
 License: BSD-3-Clause
@@ -20,12 +20,13 @@ Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
 Classifier: License :: OSI Approved :: BSD License
 Classifier: Framework :: AsyncIO
 Classifier: Environment :: Web Environment
 Classifier: Operating System :: OS Independent
 Classifier: Typing :: Typed
-Requires-Python: >=3.10.1
+Requires-Python: <3.14,>=3.10.1
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: LivePopularTimes==1.3
@@ -55,7 +56,7 @@ Requires-Dist: webdriver-manager>=4.0.2
 Requires-Dist: playwright==1.52.0
 Requires-Dist: proxylists>=0.14.0
 Requires-Dist: async-notify[all]>=1.4.0
-Requires-Dist: navconfig[default,uvloop]==2.1.3
+Requires-Dist: navconfig[default,uvloop]>=2.2.0
 Requires-Dist: navigator-api[locale,uvloop]>=2.12.22
 Requires-Dist: jsonschema>=4.22.0
 Requires-Dist: backoff==2.2.1
@@ -78,7 +79,6 @@ Requires-Dist: geopy==2.4.1
 Requires-Dist: polars==1.27.1
 Requires-Dist: contextily==1.6.2
 Requires-Dist: jenkspy==0.4.1
-Requires-Dist: timezonefinder==6.5.5
 Requires-Dist: ipyleaflet==0.19.2
 Requires-Dist: rapidfuzz==3.11.0
 Requires-Dist: nltk>=3.9.3
@@ -108,6 +108,8 @@ Requires-Dist: autoviz>=0.1.905; extra == "analytics"
 Requires-Dist: spacy>=3.8.6; extra == "analytics"
 Provides-Extra: vectors
 Requires-Dist: gensim>=4.4.0; extra == "vectors"
+Provides-Extra: geo
+Requires-Dist: timezonefinder; extra == "geo"
 Provides-Extra: sharepoint
 Requires-Dist: msgraph-sdk>=1.0; extra == "sharepoint"
 Requires-Dist: azure-identity>=1.0; extra == "sharepoint"

{querysource-4.5.1 → querysource-4.5.4}/policies/defaults.yaml

@@ -20,6 +20,7 @@ policies:
       - "slug:list"
       - "datasource:use"
       - "datasource:list"
+      - "datasource:read"
       - "driver:use"
       - "driver:list"
       - "raw_query:execute"

{querysource-4.5.1 → querysource-4.5.4}/pyproject.toml

@@ -16,7 +16,10 @@ authors = [
 ]
 readme = "README.md"
 license = {text = "BSD-3-Clause"}
-requires-python = ">=3.10.1"
+# Upper-bounded at <3.14: Python 3.14 only ships cryptography>=48 (cffi>=2).
+# Without this cap, downstream universal resolvers attempt 3.14 and fail to
+# find a solution.
+requires-python = ">=3.10.1,<3.14"
 keywords = ["querysource", "database", "query", "aiohttp", "web service"]
 
 classifiers = [
@@ -29,6 +32,7 @@ classifiers = [
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
     "License :: OSI Approved :: BSD License",
     "Framework :: AsyncIO",
     "Environment :: Web Environment",
@@ -68,7 +72,7 @@ dependencies = [
     # NAV libraries - using compatible versions
     "proxylists>=0.14.0",
     "async-notify[all]>=1.4.0",
-    "navconfig[default,uvloop]==2.1.3",
+    "navconfig[default,uvloop]>=2.2.0",
     "navigator-api[uvloop,locale]>=2.12.22",
     "jsonschema>=4.22.0",
     # Backoff Support
@@ -95,7 +99,9 @@ dependencies = [
     "polars==1.27.1",
     "contextily==1.6.2",
     "jenkspy==0.4.1",
-    "timezonefinder==6.5.5",
+    # timezonefinder lives in the optional [geo] extra: it is only used by the
+    # lazily-imported fn_get_timezone helper, so it is opt-in via
+    # `pip install querysource[geo]`. See the [geo] extra for its version floor.
     "ipyleaflet==0.19.2",
     # Text processing
     "rapidfuzz==3.11.0",
@@ -133,6 +139,16 @@ vectors = [
     "gensim>=4.4.0",
 ]
 
+geo = [
+    # timezonefinder is kept in this optional extra (used only by the
+    # lazily-imported fn_get_timezone helper). Left unpinned: navconfig>=2.2.0
+    # pulls cryptography>=46.0.7, which requires cffi>=2 on Python>=3.9, so the
+    # resolver is transitively forced to timezonefinder>=8.1.0 (the first
+    # version that relaxes its hard cffi<2 pin to cffi<3). Older versions pin
+    # cffi<2 and would conflict.
+    "timezonefinder",
+]
+
 sharepoint = [
     "msgraph-sdk>=1.0",
     "azure-identity>=1.0",
@@ -208,4 +224,4 @@ filterwarnings = [
 link-mode = "copy"
 
 [tool.uv.sources]
-# navigator-auth = { path = "../../navigator/navigator-auth", editable = true }
+navigator-auth = { path = "../../navigator/navigator-auth", editable = true }

{querysource-4.5.1 → querysource-4.5.4}/querysource/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.1.dev1+gf6d3cc545.d20260625'
-__version_tuple__ = version_tuple = (0, 1, 'dev1', 'gf6d3cc545.d20260625')
+__version__ = version = '4.5.5.dev0+ge5935df2b.d20260626'
+__version_tuple__ = version_tuple = (4, 5, 5, 'dev0', 'ge5935df2b.d20260626')
 
-__commit_id__ = commit_id = 'gf6d3cc545'
+__commit_id__ = commit_id = 'ge5935df2b'

{querysource-4.5.1 → querysource-4.5.4}/querysource/datasources/handlers/datasource.py

@@ -14,6 +14,7 @@ from asyncdb.exceptions import (
     StatementError
 )
 from navigator.views import BaseView
+from navigator_session import get_session
 from navigator_auth.decorators import (
     is_authenticated,
     user_session
@@ -104,11 +105,15 @@ async def _check_datasource_read(request: web.Request, logger=None) -> None:
         return  # PBAC disabled — fast-path no-op
 
     # Attempt to extract the user session.
+    # Use navigator_session.get_session() — the same proven path as
+    # AbstractHandler._get_user_session (handlers/abstract.py:301). The
+    # session storage object under ``app['session']`` is NOT the right
+    # API here and was silently failing, denying valid sessions.
     session = None
     try:
-        session = await request.app["session"].get_session(request)
-    except Exception:  # pylint: disable=broad-except
-        pass
+        session = await get_session(request, new=False)
+    except RuntimeError:
+        _log.error("QS: User Session system is not installed.")
 
     if session is None:
         _log.info(

{querysource-4.5.1 → querysource-4.5.4}/querysource/version.py

@@ -6,7 +6,7 @@ __description__ = (
     'QuerySource Query parser and generator.'
     'Supports SQL, NoSQL, MongoDB, Cassandra, Elasticsearch, etc.'
 )
-__version__ = '4.5.1'
+__version__ = '4.5.4'
 __url__ = 'https://github.com/phenobarbital/querysource'
 __copyright__ = 'Copyright (c) 2018-2025 Jesus Lara'
 __author__ = 'Jesus Lara'

{querysource-4.5.1 → querysource-4.5.4}/querysource.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: querysource
-Version: 4.5.1
+Version: 4.5.4
 Summary: Aiohttp web service for querying several databases easily
 Author-email: Jesus Lara <jesuslarag@gmail.com>
 License: BSD-3-Clause
@@ -20,12 +20,13 @@ Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
 Classifier: License :: OSI Approved :: BSD License
 Classifier: Framework :: AsyncIO
 Classifier: Environment :: Web Environment
 Classifier: Operating System :: OS Independent
 Classifier: Typing :: Typed
-Requires-Python: >=3.10.1
+Requires-Python: <3.14,>=3.10.1
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: LivePopularTimes==1.3
@@ -55,7 +56,7 @@ Requires-Dist: webdriver-manager>=4.0.2
 Requires-Dist: playwright==1.52.0
 Requires-Dist: proxylists>=0.14.0
 Requires-Dist: async-notify[all]>=1.4.0
-Requires-Dist: navconfig[default,uvloop]==2.1.3
+Requires-Dist: navconfig[default,uvloop]>=2.2.0
 Requires-Dist: navigator-api[locale,uvloop]>=2.12.22
 Requires-Dist: jsonschema>=4.22.0
 Requires-Dist: backoff==2.2.1
@@ -78,7 +79,6 @@ Requires-Dist: geopy==2.4.1
 Requires-Dist: polars==1.27.1
 Requires-Dist: contextily==1.6.2
 Requires-Dist: jenkspy==0.4.1
-Requires-Dist: timezonefinder==6.5.5
 Requires-Dist: ipyleaflet==0.19.2
 Requires-Dist: rapidfuzz==3.11.0
 Requires-Dist: nltk>=3.9.3
@@ -108,6 +108,8 @@ Requires-Dist: autoviz>=0.1.905; extra == "analytics"
 Requires-Dist: spacy>=3.8.6; extra == "analytics"
 Provides-Extra: vectors
 Requires-Dist: gensim>=4.4.0; extra == "vectors"
+Provides-Extra: geo
+Requires-Dist: timezonefinder; extra == "geo"
 Provides-Extra: sharepoint
 Requires-Dist: msgraph-sdk>=1.0; extra == "sharepoint"
 Requires-Dist: azure-identity>=1.0; extra == "sharepoint"

{querysource-4.5.1 → querysource-4.5.4}/querysource.egg-info/SOURCES.txt

@@ -589,6 +589,7 @@ tests/handlers/conftest.py
 tests/handlers/test_abstract_pbac_helpers.py
 tests/handlers/test_airtable_oauth.py
 tests/handlers/test_multiquery_pbac_smoke.py
+tests/handlers/test_query_param_exclusion.py
 tests/handlers/test_queryexecutor_pbac_smoke.py
 tests/handlers/test_querymanager_pagination.py
 tests/handlers/test_queryservice_pbac_smoke.py

{querysource-4.5.1 → querysource-4.5.4}/querysource.egg-info/requires.txt

@@ -25,7 +25,7 @@ webdriver-manager>=4.0.2
 playwright==1.52.0
 proxylists>=0.14.0
 async-notify[all]>=1.4.0
-navconfig[default,uvloop]==2.1.3
+navconfig[default,uvloop]>=2.2.0
 navigator-api[locale,uvloop]>=2.12.22
 jsonschema>=4.22.0
 backoff==2.2.1
@@ -48,7 +48,6 @@ geopy==2.4.1
 polars==1.27.1
 contextily==1.6.2
 jenkspy==0.4.1
-timezonefinder==6.5.5
 ipyleaflet==0.19.2
 rapidfuzz==3.11.0
 nltk>=3.9.3
@@ -86,6 +85,9 @@ pytest-xdist==3.3.1
 pytest-assume==2.4.3
 ruff>=0.6.0
 
+[geo]
+timezonefinder
+
 [s3]
 aioboto3>=12.0
 

{querysource-4.5.1 → querysource-4.5.4}/querysource.egg-info/scm_file_list.json

@@ -565,6 +565,7 @@
     "tests/handlers/test_queryexecutor_pbac_smoke.py",
     "tests/handlers/test_airtable_oauth.py",
     "tests/handlers/__init__.py",
+    "tests/handlers/test_query_param_exclusion.py",
     "tests/handlers/test_querymanager_pagination.py",
     "tests/handlers/conftest.py",
     "tests/handlers/test_queryservice_pbac_smoke.py",

querysource-4.5.4/querysource.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "4.5.4",
+  "distance": 0,
+  "node": "ge5935df2b20182f314e12bc46cf1bf75eb761db0",
+  "dirty": true,
+  "branch": "HEAD",
+  "node_date": "2026-06-26"
+}

querysource-4.5.4/tests/handlers/test_query_param_exclusion.py

@@ -0,0 +1,107 @@
+"""Unit tests for the auth/apikey query-parameter blocklist.
+
+Authentication/transport params (e.g. ``?auth=...``, ``?apikey=...``) get
+appended to QuerySource / MultiQuery API URLs by upstream gateways and clients.
+Before this fix they flowed straight into ``query_parameters`` / ``parse_qs`` and
+were interpreted as query conditions/filters. These tests assert they are
+stripped at the source for both ``QueryHandler`` and ``QueryView``.
+"""
+from __future__ import annotations
+
+from multidict import MultiDict
+
+from querysource.conf import EXCLUDED_QUERY_PARAMETERS
+from querysource.utils.handlers import (
+    QueryHandler,
+    _is_excluded_param,
+)
+
+
+class _FakeRelUrl:
+    def __init__(self, query: MultiDict) -> None:
+        self.query = query
+
+
+class _FakeRequest:
+    """Minimal stand-in for ``aiohttp.web.Request`` exposing only the query
+    surface used by ``query_parameters`` and ``parse_qs``.
+    """
+
+    def __init__(self, **params: str) -> None:
+        md = MultiDict(params)
+        self.query = md
+        self.rel_url = _FakeRelUrl(md)
+
+
+# ---------------------------------------------------------------------------
+# _is_excluded_param helper
+# ---------------------------------------------------------------------------
+
+
+class TestIsExcludedParam:
+    def test_default_blocklist_contains_auth_and_apikey(self) -> None:
+        assert "auth" in EXCLUDED_QUERY_PARAMETERS
+        assert "apikey" in EXCLUDED_QUERY_PARAMETERS
+
+    def test_matches_case_insensitively(self) -> None:
+        assert _is_excluded_param("auth")
+        assert _is_excluded_param("AUTH")
+        assert _is_excluded_param("ApiKey")
+        assert _is_excluded_param("API_KEY")
+
+    def test_regular_params_are_not_excluded(self) -> None:
+        assert not _is_excluded_param("store_id")
+        assert not _is_excluded_param("filter")
+        assert not _is_excluded_param("foo")
+
+
+# ---------------------------------------------------------------------------
+# QueryHandler.query_parameters / parse_qs
+# ---------------------------------------------------------------------------
+
+
+class TestQueryHandlerFiltering:
+    def test_query_parameters_strips_auth_params(self) -> None:
+        handler = QueryHandler()
+        req = _FakeRequest(
+            auth="secret-token",
+            apikey="abc123",
+            store_id="42",
+            program="walmart",
+        )
+        params = handler.query_parameters(req)
+        assert params == {"store_id": "42", "program": "walmart"}
+        assert "auth" not in params
+        assert "apikey" not in params
+
+    def test_query_parameters_case_insensitive(self) -> None:
+        handler = QueryHandler()
+        req = _FakeRequest(Auth="x", APIKEY="y", keep="z")
+        params = handler.query_parameters(req)
+        assert params == {"keep": "z"}
+
+    def test_parse_qs_strips_auth_params(self) -> None:
+        handler = QueryHandler()
+        req = _FakeRequest(
+            apikey="abc123",
+            store_id="42",
+        )
+        qry = handler.parse_qs(req)
+        assert "apikey" not in qry
+        assert qry["store_id"] == "42"
+
+    def test_parse_qs_still_parses_legit_values(self) -> None:
+        handler = QueryHandler()
+        req = _FakeRequest(auth="should-be-dropped", ids="[1,2,3]")
+        qry = handler.parse_qs(req)
+        assert "auth" not in qry
+        # parseqs turns a bracketed string into a list
+        assert qry["ids"] == ["1", "2", "3"]
+
+    def test_no_auth_params_is_unchanged(self) -> None:
+        handler = QueryHandler()
+        req = _FakeRequest(store_id="42", program="walmart")
+        assert handler.query_parameters(req) == {
+            "store_id": "42",
+            "program": "walmart",
+        }

querysource-4.5.1/querysource.egg-info/scm_version.json

@@ -1,8 +0,0 @@
-{
-  "tag": "0.0",
-  "distance": 1,
-  "node": "gf6d3cc545605f2aeacbfc9d404cf0a09a65a2c5d",
-  "dirty": true,
-  "branch": "HEAD",
-  "node_date": "2026-06-25"
-}