sql-dialect-master 1.1.5__tar.gz → 1.1.7__tar.gz

{sql_dialect_master-1.1.5/sql_dialect_master.egg-info → sql_dialect_master-1.1.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sql-dialect-master
-Version: 1.1.5
+Version: 1.1.7
 Summary: SQL Dialect Master - Multi-database SQL conversion engine
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -35,7 +35,7 @@ Dynamic: license-file
 
 Enterprise-grade multi-database SQL conversion engine supporting 12 database dialects.
 
-Current release: 1.1.5
+Current release: 1.1.7
 
 [![Python 3.11+](https://img.shields.io/badge/python-3.11+-blue.svg)](https://www.python.org/downloads/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
@@ -359,3 +359,16 @@ Rate limiting is on by default. The two backends are:
 - `SDM_RATE_LIMIT_BACKEND=redis` — shared, atomic limits across all workers. Set `SDM_REDIS_URL` when using this backend. The store connects and pings Redis at startup and fails fast if it is unreachable; the `redis` package is required (install with `pip install redis`).
 
 `SDM_RATE_LIMIT_ENABLED=false` disables enforcement entirely. Use the in-memory backend for local development and the Redis backend for any deployment with more than one worker or instance that must enforce a single global limit.
+
+By default, the API does not trust `X-Forwarded-For`; rate limiting and logs
+use the direct peer address. Set `SDM_TRUSTED_PROXIES` to the proxy IPs/CIDRs
+only when the direct peer is a trusted proxy, after which the rightmost
+non-trusted address in the XFF chain is used. Deployments behind a proxy must
+also configure `SDM_HEALTH_PROBE_TOKEN` for readiness probes; readiness never
+uses XFF for authorization.
+
+SQL-bearing POST responses and health probes use `Cache-Control: no-store`;
+public catalog responses use short `private` caching. Full deployment details
+will be documented in `docs/deployment.md`.
+
+See [`docs/deployment.md`](docs/deployment.md) for production deployment guidance.

{sql_dialect_master-1.1.5 → sql_dialect_master-1.1.7}/README.md

@@ -2,7 +2,7 @@
 
 Enterprise-grade multi-database SQL conversion engine supporting 12 database dialects.
 
-Current release: 1.1.5
+Current release: 1.1.7
 
 [![Python 3.11+](https://img.shields.io/badge/python-3.11+-blue.svg)](https://www.python.org/downloads/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
@@ -326,3 +326,16 @@ Rate limiting is on by default. The two backends are:
 - `SDM_RATE_LIMIT_BACKEND=redis` — shared, atomic limits across all workers. Set `SDM_REDIS_URL` when using this backend. The store connects and pings Redis at startup and fails fast if it is unreachable; the `redis` package is required (install with `pip install redis`).
 
 `SDM_RATE_LIMIT_ENABLED=false` disables enforcement entirely. Use the in-memory backend for local development and the Redis backend for any deployment with more than one worker or instance that must enforce a single global limit.
+
+By default, the API does not trust `X-Forwarded-For`; rate limiting and logs
+use the direct peer address. Set `SDM_TRUSTED_PROXIES` to the proxy IPs/CIDRs
+only when the direct peer is a trusted proxy, after which the rightmost
+non-trusted address in the XFF chain is used. Deployments behind a proxy must
+also configure `SDM_HEALTH_PROBE_TOKEN` for readiness probes; readiness never
+uses XFF for authorization.
+
+SQL-bearing POST responses and health probes use `Cache-Control: no-store`;
+public catalog responses use short `private` caching. Full deployment details
+will be documented in `docs/deployment.md`.
+
+See [`docs/deployment.md`](docs/deployment.md) for production deployment guidance.

sql_dialect_master-1.1.7/backend/api/client_identity.py

@@ -0,0 +1,57 @@
+"""Resolve client IPs without trusting spoofable forwarding headers."""
+
+from __future__ import annotations
+
+import ipaddress
+import re
+from collections.abc import Iterable
+
+from fastapi import Request
+
+_BRACKETED_IPV6 = re.compile(r"^\[([^\]]+)\](?::\d+)?$")
+
+
+def _parse_ip(value: str) -> ipaddress.IPv4Address | ipaddress.IPv6Address | None:
+    candidate = value.strip()
+    if not candidate or "%" in candidate:
+        return None
+    bracketed = _BRACKETED_IPV6.fullmatch(candidate)
+    if bracketed:
+        candidate = bracketed.group(1)
+    elif candidate.count(":") == 1:
+        host, port = candidate.rsplit(":", 1)
+        if port.isdigit():
+            candidate = host
+    try:
+        return ipaddress.ip_address(candidate)
+    except ValueError:
+        return None
+
+
+def _is_trusted(
+    address: ipaddress.IPv4Address | ipaddress.IPv6Address,
+    trusted_networks: Iterable,
+) -> bool:
+    return any(
+        address.version == network.version and address in network
+        for network in trusted_networks
+    )
+
+
+def resolve_client_ip(request: Request, trusted_networks: tuple = ()) -> str:
+    """Resolve the client address, trusting XFF only behind trusted peers."""
+    peer = request.client.host if request.client else "unknown"
+    if not trusted_networks or peer == "unknown":
+        return peer
+
+    peer_address = _parse_ip(peer)
+    if peer_address is None or not _is_trusted(peer_address, trusted_networks):
+        return peer
+
+    forwarded_for = request.headers.get("X-Forwarded-For", "")
+    for value in reversed(forwarded_for.split(",")):
+        address = _parse_ip(value)
+        if address is None or _is_trusted(address, trusted_networks):
+            continue
+        return str(address)
+    return peer

{sql_dialect_master-1.1.5 → sql_dialect_master-1.1.7}/backend/api/main.py

@@ -235,6 +235,7 @@ app = FastAPI(
 
 # Import middleware
 from backend.api.middleware import (
+    CacheControlMiddleware,
     RateLimiter,
     RateLimitMiddleware,
     SecurityHeadersMiddleware,
@@ -244,6 +245,7 @@ from backend.core.exceptions import SDMException, UnsupportedDialectError, Error
 
 # Configure CORS from the centralized Pydantic settings source.
 ALLOWED_ORIGINS = [origin.strip() for origin in settings.allowed_origins.split(",") if origin.strip()]
+TRUSTED_PROXY_NETWORKS = settings.trusted_proxy_networks
 
 app.add_middleware(
     CORSMiddleware,
@@ -285,10 +287,15 @@ app.add_middleware(
     RateLimitMiddleware,
     limiter=rate_limiter,
     enabled=settings.rate_limit_enabled,
+    trusted_proxies=TRUSTED_PROXY_NETWORKS,
 )
 
 # Structured request logging must wrap rate limiting so rejected requests also get IDs.
-app.add_middleware(StructuredLoggingMiddleware)
+app.add_middleware(
+    StructuredLoggingMiddleware,
+    trusted_proxies=TRUSTED_PROXY_NETWORKS,
+)
+app.add_middleware(CacheControlMiddleware)
 
 # Initialize services
 transpiler = SQLTranspiler()

{sql_dialect_master-1.1.5 → sql_dialect_master-1.1.7}/backend/api/middleware.py

@@ -19,6 +19,7 @@ from starlette.concurrency import run_in_threadpool
 
 from backend.core.exceptions import ErrorCode
 
+from .client_identity import resolve_client_ip
 from .rate_limit_store import InMemoryRateLimitStore, RateLimitStore, create_rate_limit_store
 from .readiness import health_probe_response
 
@@ -35,7 +36,7 @@ def _sanitize_log_value(value: str, max_length: int = 500) -> str:
 class RateLimitEntry:
     """Legacy compatibility entry."""
     requests: int = 0
-    window_start: float = field(default_factory=time.time)
+    window_start: float = field(default_factory=time.monotonic)
 
 
 class RateLimiter:
@@ -67,13 +68,14 @@ class RateLimiter:
 class RateLimitMiddleware(BaseHTTPMiddleware):
     """Rate limiting middleware with a bounded request-body guard."""
 
-    def __init__(self, app, limiter: RateLimiter = None, enabled: bool = True, max_body_bytes: int = DEFAULT_MAX_REQUEST_BODY_BYTES):
+    def __init__(self, app, limiter: RateLimiter = None, enabled: bool = True, max_body_bytes: int = DEFAULT_MAX_REQUEST_BODY_BYTES, trusted_proxies: tuple = ()):
         super().__init__(app)
         if max_body_bytes <= 0:
             raise ValueError("max_body_bytes must be positive")
         self.limiter = limiter or RateLimiter(store=None if enabled else InMemoryRateLimitStore())
         self.enabled = enabled
         self.max_body_bytes = max_body_bytes
+        self.trusted_proxies = trusted_proxies
 
     async def _read_bounded_body(self, request: Request) -> Response | None:
         """Consume and cache request bodies without trusting Content-Length."""
@@ -171,15 +173,16 @@ class RateLimitMiddleware(BaseHTTPMiddleware):
         return response
 
     def _get_client_id(self, request: Request) -> str:
-        return request.client.host if request.client else "unknown"
+        return resolve_client_ip(request, self.trusted_proxies)
 
 
 class StructuredLoggingMiddleware(BaseHTTPMiddleware):
     """Structured request logging and request-id propagation."""
 
-    def __init__(self, app, log_body: bool = False):
+    def __init__(self, app, log_body: bool = False, trusted_proxies: tuple = ()):
         super().__init__(app)
         self.log_body = log_body
+        self.trusted_proxies = trusted_proxies
 
     @staticmethod
     def _get_request_id(request: Request) -> str:
@@ -346,7 +349,7 @@ class StructuredLoggingMiddleware(BaseHTTPMiddleware):
         request.state.request_id = request_id
         status_code = 500
         error = None
-        log_data = {"event": "request_start", "request_id": request_id, "method": _sanitize_log_value(request.method), "path": _sanitize_log_value(request.url.path), "query": _sanitize_log_value(str(request.query_params)), "client": _sanitize_log_value(request.client.host if request.client else "unknown"), "timestamp": datetime.now().isoformat()}
+        log_data = {"event": "request_start", "request_id": request_id, "method": _sanitize_log_value(request.method), "path": _sanitize_log_value(request.url.path), "query": _sanitize_log_value(str(request.query_params)), "client": _sanitize_log_value(resolve_client_ip(request, self.trusted_proxies)), "timestamp": datetime.now().isoformat()}
         logger.info(json.dumps(log_data))
         try:
             response = await call_next(request)
@@ -370,6 +373,40 @@ class SecurityHeadersMiddleware(BaseHTTPMiddleware):
         response = await call_next(request)
         response.headers["X-Content-Type-Options"] = "nosniff"
         response.headers["X-Frame-Options"] = "DENY"
-        response.headers["X-XSS-Protection"] = "1; mode=block"
+        response.headers["X-XSS-Protection"] = "0"
         response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
         return response
+
+
+class CacheControlMiddleware(BaseHTTPMiddleware):
+    """Apply explicit browser/proxy caching policy to API responses."""
+
+    @staticmethod
+    def _policy(request: Request) -> str | None:
+        if request.method == "OPTIONS":
+            return None
+        path = request.url.path
+        if path in {"/docs", "/redoc", "/openapi.json"}:
+            return None
+        if request.method == "POST" and path.startswith("/api/"):
+            return "no-store"
+        if request.method in {"GET", "HEAD"}:
+            if path in {"/health", "/ready", "/health/deep"}:
+                return "no-store"
+            if path == "/api/dialects":
+                return "private, max-age=60"
+            if path == "/api/functions" or path.startswith("/api/functions/"):
+                return "private, max-age=60"
+            if path == "/api/types" or path.startswith("/api/types/"):
+                return "private, max-age=60"
+            if path in {"/", "/api/stats"}:
+                return "private, max-age=15"
+        return None
+
+    async def dispatch(self, request: Request, call_next) -> Response:
+        response = await call_next(request)
+        if not response.headers.get("Cache-Control"):
+            policy = self._policy(request)
+            if policy:
+                response.headers["Cache-Control"] = policy
+        return response

{sql_dialect_master-1.1.5 → sql_dialect_master-1.1.7}/backend/api/rate_limit_store.py

@@ -44,7 +44,7 @@ class InMemoryRateLimitStore:
 
     def check(self, key: str, limit: int, window_seconds: int) -> tuple[bool, int, int]:
         with self._lock:
-            now = time.time()
+            now = time.monotonic()
             self._prune_expired(now)
             count, window_start = self._entries.get(key, (0, now))
             if now - window_start >= window_seconds:
@@ -58,7 +58,7 @@ class InMemoryRateLimitStore:
 
     def stats(self) -> dict:
         with self._lock:
-            self._prune_expired(time.time())
+            self._prune_expired(time.monotonic())
             return {"backend": "memory", "active_clients": len(self._entries)}
 
 

{sql_dialect_master-1.1.5 → sql_dialect_master-1.1.7}/backend/core/config.py

@@ -10,6 +10,7 @@ Supports configuration via:
 - Default values
 """
 import logging
+import ipaddress
 import sys
 from enum import Enum
 from typing import Any, Dict, List, Literal, Optional, TypedDict
@@ -225,6 +226,7 @@ class AppSettings(BaseSettings):
         "http://localhost:5174,http://127.0.0.1:5174,"
         "http://localhost:4174,http://127.0.0.1:4174"
     )
+    trusted_proxies: str = ""
     max_batch_size: int = Field(100, gt=0)
     request_timeout: int = Field(30, gt=0)
     
@@ -299,6 +301,40 @@ class AppSettings(BaseSettings):
                 "log_level must be one of DEBUG, INFO, WARNING, ERROR, CRITICAL"
             )
         return normalized
+
+    @field_validator("trusted_proxies", mode="before")
+    @classmethod
+    def _normalize_trusted_proxies(cls, value: str) -> str:
+        if value is None:
+            return ""
+        if not isinstance(value, str):
+            raise ValueError("trusted_proxies must be a comma-separated string")
+        normalized = []
+        for raw_value in value.split(","):
+            candidate = raw_value.strip()
+            if not candidate:
+                continue
+            try:
+                network = ipaddress.ip_network(candidate, strict=False)
+            except ValueError as exc:
+                raise ValueError(
+                    f"trusted_proxies contains an invalid IP/CIDR: {candidate!r}"
+                ) from exc
+            if network.prefixlen == 0:
+                raise ValueError("trusted_proxies must not contain a catch-all network")
+            normalized.append(str(network))
+        return ",".join(normalized)
+
+    @property
+    def trusted_proxy_networks(self) -> tuple:
+        """Return parsed trusted proxy networks for request identity checks."""
+        if not self.trusted_proxies:
+            return ()
+        return tuple(
+            ipaddress.ip_network(value, strict=False)
+            for value in self.trusted_proxies.split(",")
+            if value
+        )
     
     def to_dict(self) -> Dict[str, Any]:
         """Convert settings to dictionary."""

{sql_dialect_master-1.1.5 → sql_dialect_master-1.1.7}/backend/core/functions_lookup.py

@@ -2,7 +2,7 @@
 """Function Encyclopedia - Search and compare SQL functions across dialects.
 
 Provides comprehensive SQL function lookup with:
-- 50+ SQL functions across 11 categories
+- Function count defined by functions_db.json (currently 298) across 11 categories
 - Cross-database syntax comparison for 12 dialects
 - Fuzzy search with relevance scoring
 - Category-based filtering
@@ -37,7 +37,7 @@ class FunctionEncyclopedia:
     """SQL Function Encyclopedia with multi-dialect comparison.
     
     Features:
-    - 50+ SQL functions
+    - Function count defined by functions_db.json (currently 298)
     - 11 categories: string, date, math, aggregate, window, conditional, conversion, json, array, system, geo
     - 12 database dialects support
     - Fuzzy search with relevance scoring

{sql_dialect_master-1.1.5 → sql_dialect_master-1.1.7}/backend/core/metadata.py

@@ -17,8 +17,8 @@ Design rules:
 from __future__ import annotations
 
 # ── Release version facts (sole source of truth) ────────────────────────
-PROJECT_VERSION = "1.1.5"
-API_VERSION = "1.1.5"
+PROJECT_VERSION = "1.1.7"
+API_VERSION = "1.1.7"
 # Frontend v2 architecture — independent of the product release version.
 FRONTEND_ARCHITECTURE_VERSION = 2
 

{sql_dialect_master-1.1.5 → sql_dialect_master-1.1.7}/backend/core/transpiler.py

@@ -214,6 +214,32 @@ def _executable_upper(sql: str, dialect: str | None = None) -> str:
     return mask_non_executable(sql, dialect=dialect).upper()
 
 
+@dataclass
+class _ConstructEvidence:
+    """Lazily parse one SQL view for one compatibility-notes call.
+
+    The AST is deliberately private to the evidence context.  The main
+    transpilation AST is never shared with this object, so evidence checks
+    cannot observe or mutate the AST used to generate the target SQL.
+    """
+
+    sql: str
+    dialect: str
+    masked_upper: str
+    _parsed: bool = field(default=False, init=False, repr=False)
+    _tree: Optional[exp.Expression] = field(default=None, init=False, repr=False)
+
+    def parse_one(self) -> Optional[exp.Expression]:
+        """Return the evidence AST, parsing at most once and failing closed."""
+        if not self._parsed:
+            self._parsed = True
+            try:
+                self._tree = sqlglot.parse_one(self.sql, read=self.dialect)
+            except Exception:
+                self._tree = None
+        return self._tree
+
+
 # Constructs whose evidence requires a FUNCTION-CALL form: the name
 # immediately followed by ``(``, with an identifier boundary before it.
 # A column named ``STRING_AGG_backup`` therefore never counts as a
@@ -291,7 +317,12 @@ _IDENT_END = r"(?![\w$])"
 _IDENT_OR_DOT_START = r"(?<![\w$.])"
 
 
-def _contains_type_construct(sql: str, dialect: str, construct: str) -> bool:
+def _contains_type_construct(
+    sql: str,
+    dialect: str,
+    construct: str,
+    evidence: Optional[_ConstructEvidence] = None,
+) -> bool:
     """AST evidence that ``sql`` (in ``dialect``) contains the TYPE construct.
 
     ARRAY/MAP/JSON/VARRAY claims describe type conversions, so a
@@ -304,9 +335,29 @@ def _contains_type_construct(sql: str, dialect: str, construct: str) -> bool:
     * VARRAY — a USERDEFINED DataType with ``kind == "VARRAY"``.
     Parse failures yield no evidence (fail closed).
     """
-    try:
-        tree = sqlglot.parse_one(sql, read=dialect)
-    except Exception:
+    masked_upper = evidence.masked_upper if evidence is not None else _executable_upper(sql, dialect)
+    token_present = re.search(
+        _IDENT_START + re.escape(construct) + _IDENT_END, masked_upper
+    ) is not None
+    # PostgreSQL array types use ``INTEGER[]`` rather than the ARRAY keyword.
+    # The shared masker treats square brackets as quoted-identifier syntax, so
+    # retain a narrow raw-text candidate as a prefilter; the AST check below
+    # still decides whether the brackets are an actual type declaration.
+    if construct == "ARRAY" and not token_present:
+        bracket_safe_sql = sql.translate(str.maketrans({"[": "{", "]": "}"}))
+        bracket_safe_upper = mask_non_executable(
+            bracket_safe_sql, dialect=dialect
+        ).upper()
+        token_present = re.search(
+            r"\b[A-Z_][A-Z0-9_$]*\s*(?:\{\s*\d*\s*\})+",
+            bracket_safe_upper,
+        ) is not None
+    if not token_present:
+        return False
+    if evidence is None:
+        evidence = _ConstructEvidence(sql, dialect, masked_upper)
+    tree = evidence.parse_one()
+    if tree is None:
         return False
     for node in tree.walk():
         if not isinstance(node, exp.DataType):
@@ -320,7 +371,11 @@ def _contains_type_construct(sql: str, dialect: str, construct: str) -> bool:
 
 
 def _contains_clause_construct(
-    sql: str, dialect: str, construct: str, masked_upper: str = ""
+    sql: str,
+    dialect: str,
+    construct: str,
+    masked_upper: str = "",
+    evidence: Optional[_ConstructEvidence] = None,
 ) -> bool:
     """AST evidence that ``sql`` (in ``dialect``) contains the clause keyword.
 
@@ -348,9 +403,17 @@ def _contains_clause_construct(
       (DDL column constraint).
     Parse failures yield no evidence (fail closed).
     """
-    try:
-        tree = sqlglot.parse_one(sql, read=dialect)
-    except Exception:
+    executable_upper = (
+        evidence.masked_upper
+        if evidence is not None
+        else masked_upper or _executable_upper(sql, dialect)
+    )
+    if re.search(_IDENT_START + re.escape(construct) + _IDENT_END, executable_upper) is None:
+        return False
+    if evidence is None:
+        evidence = _ConstructEvidence(sql, dialect, executable_upper)
+    tree = evidence.parse_one()
+    if tree is None:
         return False
     if construct in ("LIMIT", "TOP"):
         limit_nodes = list(tree.find_all(exp.Limit))
@@ -404,7 +467,11 @@ def _contains_clause_construct(
 
 
 def _contains_construct(
-    masked_upper: str, sql: str, dialect: str, construct: str
+    masked_upper: str,
+    sql: str,
+    dialect: str,
+    construct: str,
+    evidence: Optional[_ConstructEvidence] = None,
 ) -> bool:
     """Boundary-aware construct detection on executable-masked text.
 
@@ -441,9 +508,9 @@ def _contains_construct(
         return re.search(pattern, masked_upper) is not None
     name = words[0].rstrip("()")
     if name in _TYPE_CONSTRUCTS:
-        return _contains_type_construct(sql, dialect, name)
+        return _contains_type_construct(sql, dialect, name, evidence)
     if name in _CLAUSE_AST_CONSTRUCTS:
-        return _contains_clause_construct(sql, dialect, name, masked_upper)
+        return _contains_clause_construct(sql, dialect, name, masked_upper, evidence)
     if name == "APPLY":
         return re.search(_APPLY_PATTERN, masked_upper) is not None
     if name in _FUNCTION_FORM_CONSTRUCTS or construct.endswith("()"):
@@ -687,20 +754,65 @@ class SQLTranspiler:
                 ast_notes.extend(list_notes)
                 transpiled = ast.sql(dialect=target, pretty=pretty)
             elif source == "mysql":
-                ast = sqlglot.parse_one(parser_sql, read="mysql")
-                if target == "oracle":
-                    ast, now_notes = self._ast_mysql_now_to_sysdate(ast, target)
-                    ast_notes.extend(now_notes)
-                ast, normalization_notes, blockers = self._ast_mysql_target_normalizations(ast, target)
-                ast_notes.extend(normalization_notes)
-                semantic_blockers.extend(blockers)
-                if ast_notes or blockers:
-                    transpiled = ast.sql(dialect=target, pretty=pretty)
+                if target == "mysql":
+                    needs_mysql_ast = False
+                else:
+                    # Reuse the security mask when available.  If security
+                    # checks are disabled, create exactly one executable view
+                    # for this branch so comments and literals cannot trigger
+                    # an AST-only normalization pass.
+                    mysql_executable = (
+                        executable_sql
+                        if executable_sql is not None
+                        else mask_non_executable(sql, dialect=source)
+                    )
+                    # Reuse the same executable view for warning generation
+                    # later in this call when security checks were disabled.
+                    executable_sql = mysql_executable
+                    mysql_upper = mysql_executable.upper()
+                    candidate_tokens = {
+                        "DATE_SUB",
+                        "DATEDIFF",
+                        "CONCAT",
+                        "JSON_OBJECT",
+                        "JSON_ARRAYAGG",
+                        "ROLLUP",
+                    }
+                    if target == "snowflake":
+                        candidate_tokens.add("DATE_FORMAT")
+                    if target == "postgres":
+                        candidate_tokens.add("ROUND")
+                    if target == "oracle":
+                        candidate_tokens.add("NOW")
+                    needs_mysql_ast = any(
+                        re.search(
+                            _IDENT_START + re.escape(token) + _IDENT_END,
+                            mysql_upper,
+                        )
+                        for token in candidate_tokens
+                    )
+
+                if needs_mysql_ast:
+                    ast = sqlglot.parse_one(parser_sql, read="mysql")
+                    if target == "oracle":
+                        ast, now_notes = self._ast_mysql_now_to_sysdate(ast, target)
+                        ast_notes.extend(now_notes)
+                    ast, normalization_notes, blockers = self._ast_mysql_target_normalizations(
+                        ast, target
+                    )
+                    ast_notes.extend(normalization_notes)
+                    semantic_blockers.extend(blockers)
+                    if ast_notes or blockers:
+                        transpiled = ast.sql(dialect=target, pretty=pretty)
+                    else:
+                        # Keep the canonical sqlglot path for candidate
+                        # expressions that do not need a custom rewrite. This
+                        # preserves the public error taxonomy for callers that
+                        # replace/monitor sqlglot.transpile.
+                        transpiled = sqlglot.transpile(
+                            parser_sql, read=source, write=target, pretty=pretty
+                        )[0]
                 else:
-                    # Keep the canonical sqlglot path for ordinary MySQL
-                    # conversions. This preserves the public error taxonomy
-                    # for callers that replace/monitor sqlglot.transpile,
-                    # while custom AST rewrites avoid a second serialization.
                     transpiled = sqlglot.transpile(
                         parser_sql, read=source, write=target, pretty=pretty
                     )[0]
@@ -1500,8 +1612,18 @@ class SQLTranspiler:
         if not source_sql and not final_sql:
             return notes
 
-        source_upper = _executable_upper(source_sql, source)
-        final_upper = _executable_upper(final_sql, target)
+        source_evidence = _ConstructEvidence(
+            source_sql, source, _executable_upper(source_sql, source)
+        )
+        final_evidence = (
+            source_evidence
+            if (final_sql, target) == (source_sql, source)
+            else _ConstructEvidence(
+                final_sql, target, _executable_upper(final_sql, target)
+            )
+        )
+        source_upper = source_evidence.masked_upper
+        final_upper = final_evidence.masked_upper
 
         # Class B (static table): notes that claim a conversion happened.
         # Marker identifies the note; the claim survives only with source
@@ -1514,7 +1636,9 @@ class SQLTranspiler:
             for marker, source_constructs, target_constructs in _CONVERSION_NOTE_EVIDENCE:
                 if marker.upper() in upper_note:
                     if not any(
-                        _contains_construct(source_upper, source_sql, source, c)
+                        _contains_construct(
+                            source_upper, source_sql, source, c, source_evidence
+                        )
                         for c in source_constructs
                     ):
                         dropped = True
@@ -1522,7 +1646,9 @@ class SQLTranspiler:
                     # An empty target tuple marks a source-construct
                     # advisory: no final-SQL evidence required.
                     if target_constructs and not any(
-                        _contains_construct(final_upper, final_sql, target, c)
+                        _contains_construct(
+                            final_upper, final_sql, target, c, final_evidence
+                        )
                         for c in target_constructs
                     ):
                         dropped = True
@@ -1534,21 +1660,42 @@ class SQLTranspiler:
 
         # Class A: source-construct advisories (generic, not claims of a
         # completed conversion).
-        if _contains_construct(source_upper, source_sql, source, "LIMIT") and target == "oracle":
+        if (
+            _contains_construct(source_upper, source_sql, source, "LIMIT", source_evidence)
+            and target == "oracle"
+        ):
             notes.append("Oracle uses FETCH FIRST n ROWS ONLY (12c+) or ROWNUM for LIMIT")
-        if _contains_construct(source_upper, source_sql, source, "AUTO_INCREMENT") and target != "mysql":
+        if (
+            _contains_construct(
+                source_upper, source_sql, source, "AUTO_INCREMENT", source_evidence
+            )
+            and target != "mysql"
+        ):
             notes.append("AUTO_INCREMENT syntax varies by database")
-        if _contains_construct(source_upper, source_sql, source, "MERGE"):
+        if _contains_construct(source_upper, source_sql, source, "MERGE", source_evidence):
             notes.append("MERGE syntax varies significantly between databases")
-        if _contains_construct(source_upper, source_sql, source, "PIVOT") or _contains_construct(source_upper, source_sql, source, "UNPIVOT"):
+        if _contains_construct(source_upper, source_sql, source, "PIVOT", source_evidence) or _contains_construct(
+            source_upper, source_sql, source, "UNPIVOT", source_evidence
+        ):
             notes.append("PIVOT/UNPIVOT syntax varies by database")
 
         # Class B (dynamic): conversion claims, verified by the final SQL.
-        if _contains_construct(source_upper, source_sql, source, "LATERAL VIEW") and target not in ["hive", "spark", "databricks"]:
-            if _contains_construct(final_upper, final_sql, target, "UNNEST") or _contains_construct(final_upper, final_sql, target, "JSON_TABLE"):
+        if _contains_construct(
+            source_upper, source_sql, source, "LATERAL VIEW", source_evidence
+        ) and target not in ["hive", "spark", "databricks"]:
+            if _contains_construct(
+                final_upper, final_sql, target, "UNNEST", final_evidence
+            ) or _contains_construct(
+                final_upper, final_sql, target, "JSON_TABLE", final_evidence
+            ):
                 notes.append("LATERAL VIEW is Hive/Spark specific, converted to UNNEST/JSON_TABLE")
-        if _contains_construct(source_upper, source_sql, source, "CONNECT BY") and target != "oracle":
-            if _contains_construct(final_upper, final_sql, target, "WITH RECURSIVE"):
+        if (
+            _contains_construct(source_upper, source_sql, source, "CONNECT BY", source_evidence)
+            and target != "oracle"
+        ):
+            if _contains_construct(
+                final_upper, final_sql, target, "WITH RECURSIVE", final_evidence
+            ):
                 notes.append("CONNECT BY is Oracle specific, converted to WITH RECURSIVE")
         return notes
 
@@ -1594,6 +1741,9 @@ class SQLTranspiler:
         evidence the output is executable MySQL.  Used only when
         ``target == "mysql"`` as a fail-closed guard.
         """
+        masked_upper = mask_non_executable(sql, dialect="mysql").upper()
+        if re.search(_IDENT_START + r"GROUP_CONCAT" + _IDENT_END, masked_upper) is None:
+            return False
         try:
             tree = sqlglot.parse_one(sql, read="mysql")
         except Exception:
@@ -1660,21 +1810,42 @@ class SQLTranspiler:
         result = {"blocked": False, "reason": None, "warnings": [], "executable_sql": None}
         executable_sql = mask_non_executable(sql, dialect=dialect)
         result["executable_sql"] = executable_sql
+
+        # Keep raw and prepared parse results local to this validation call.
+        # The read dialect is part of the cache key because the DML check has
+        # historically used sqlglot's generic parser while dangerous/system
+        # checks use the request dialect.
+        parsed_cache: Dict[Tuple[str, Optional[str]], Optional[list]] = {}
+
+        def parse_cached(statement: str, read: str | None) -> Optional[list]:
+            key = (statement, read)
+            if key not in parsed_cache:
+                try:
+                    parsed_cache[key] = (
+                        sqlglot.parse(statement, read=read)
+                        if read
+                        else sqlglot.parse(statement)
+                    )
+                except Exception:
+                    parsed_cache[key] = None
+            return parsed_cache[key]
+
         dangerous_operation = _DANGEROUS_OPERATION_PATTERN.search(executable_sql)
         if dangerous_operation:
             # A keyword can also be a perfectly legal column/alias (for
             # example ``SELECT create FROM audit``).  Parse only when the
             # cheap lexical candidate is present and block only an actual DDL
             # root node.  If parsing fails, retain fail-closed behavior.
-            try:
-                parsed = sqlglot.parse(sql, read=dialect) if dialect else sqlglot.parse(sql)
-                actual_operation = any(
+            parsed = parse_cached(sql, dialect)
+            actual_operation = (
+                True
+                if parsed is None
+                else any(
                     isinstance(statement, _DANGEROUS_OPERATION_TYPES)
                     for statement in parsed
                     if statement is not None
                 )
-            except Exception:
-                actual_operation = True
+            )
             if actual_operation:
                 message = f"Dangerous SQL operation detected: {dangerous_operation.group(1).upper()}"
                 if block:
@@ -1685,8 +1856,9 @@ class SQLTranspiler:
         if ";" not in sql or ";" not in executable_sql:
             result["multiple_statements"] = False
         else:
-            try:
-                parsed_statements = sqlglot.parse(prepare_sql_for_parser(sql, dialect), read=dialect) if dialect else sqlglot.parse(sql)
+            prepared_sql = prepare_sql_for_parser(sql, dialect)
+            parsed_statements = parse_cached(prepared_sql, dialect)
+            if parsed_statements is not None:
                 result["multiple_statements"] = (
                     len(parsed_statements) > 1
                     and not _is_single_statement_stream(parsed_statements)
@@ -1698,17 +1870,19 @@ class SQLTranspiler:
                         result["reason"] = message
                         return result
                     result["warnings"].append(f"🔒 Security: {message}")
-            except Exception as exc:
-                logger.debug("SQL statement parsing failed during security validation: %s", exc)
+            else:
+                logger.debug("SQL statement parsing failed during security validation")
         for pattern, message in DANGEROUS_SQL_PATTERNS:
             if pattern.search(executable_sql):
                 if message == "System table access detected":
                     # Catalog words in a selected column or alias are not a
                     # catalog access.  Inspect parsed table references and
                     # preserve fail-closed behavior only on parse failure.
-                    try:
-                        parsed = sqlglot.parse(sql, read=dialect) if dialect else sqlglot.parse(sql)
-                        system_table = any(
+                    parsed = parse_cached(sql, dialect)
+                    system_table = (
+                        True
+                        if parsed is None
+                        else any(
                             isinstance(table, exp.Table)
                             and (
                                 table.name.lower() in _SYSTEM_CATALOG_NAMES
@@ -1719,8 +1893,7 @@ class SQLTranspiler:
                             if statement is not None
                             for table in statement.find_all(exp.Table)
                         )
-                    except Exception:
-                        system_table = True
+                    )
                     if not system_table:
                         continue
                 if block:
@@ -1732,11 +1905,9 @@ class SQLTranspiler:
         needs_dml_ast = bool(re.search(r"\b(?:UPDATE|DELETE)\b", masked_upper))
         dml_parsed = None
         if needs_dml_ast and result.get("multiple_statements") is False:
-            try:
-                dml_parsed = sqlglot.parse(sql)
-            except Exception as exc:
-                logger.debug("DML security AST parse unavailable: %s", exc)
-                dml_parsed = None
+            dml_parsed = parse_cached(sql, None)
+            if dml_parsed is None:
+                logger.debug("DML security AST parse unavailable")
         if dml_parsed is not None:
             dml_without_where = set(_dml_without_where(sql, dml_parsed))
             for op in sorted(dml_without_where):

{sql_dialect_master-1.1.5 → sql_dialect_master-1.1.7}/backend/core/type_mapping.py

@@ -2,7 +2,7 @@
 """Type Mapper - Map SQL data types between different database dialects.
 
 Provides comprehensive data type mapping with:
-- 36 data types across 7 categories
+- Type count defined by type_mapping.json (currently 39) across 7 categories
 - 12 database dialects support
 - Precision and compatibility warnings
 - Type conversion suggestions
@@ -23,11 +23,11 @@ logger = logging.getLogger(__name__)
 
 
 class TypeMapper:
-    """SQL Type Mapper with 36 types × 12 dialects matrix support.
+    """SQL Type Mapper backed by the type_mapping.json data file.
     
     Features:
-    - 36 data types (STRING, VARCHAR, INT, DECIMAL, DATE, ARRAY, JSON, etc.)
-    - 12 database dialects
+    - Type count defined by type_mapping.json (currently 39)
+    - Database dialect support follows the configured dialect list
     - Precision warnings for DECIMAL, TIMESTAMP, VARCHAR
     - Type conversion suggestions
     """

{sql_dialect_master-1.1.5 → sql_dialect_master-1.1.7}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sql-dialect-master"
-version = "1.1.5"
+version = "1.1.7"
 description = "SQL Dialect Master - Multi-database SQL conversion engine"
 readme = "README.md"
 requires-python = ">=3.11"

{sql_dialect_master-1.1.5 → sql_dialect_master-1.1.7/sql_dialect_master.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sql-dialect-master
-Version: 1.1.5
+Version: 1.1.7
 Summary: SQL Dialect Master - Multi-database SQL conversion engine
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -35,7 +35,7 @@ Dynamic: license-file
 
 Enterprise-grade multi-database SQL conversion engine supporting 12 database dialects.
 
-Current release: 1.1.5
+Current release: 1.1.7
 
 [![Python 3.11+](https://img.shields.io/badge/python-3.11+-blue.svg)](https://www.python.org/downloads/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
@@ -359,3 +359,16 @@ Rate limiting is on by default. The two backends are:
 - `SDM_RATE_LIMIT_BACKEND=redis` — shared, atomic limits across all workers. Set `SDM_REDIS_URL` when using this backend. The store connects and pings Redis at startup and fails fast if it is unreachable; the `redis` package is required (install with `pip install redis`).
 
 `SDM_RATE_LIMIT_ENABLED=false` disables enforcement entirely. Use the in-memory backend for local development and the Redis backend for any deployment with more than one worker or instance that must enforce a single global limit.
+
+By default, the API does not trust `X-Forwarded-For`; rate limiting and logs
+use the direct peer address. Set `SDM_TRUSTED_PROXIES` to the proxy IPs/CIDRs
+only when the direct peer is a trusted proxy, after which the rightmost
+non-trusted address in the XFF chain is used. Deployments behind a proxy must
+also configure `SDM_HEALTH_PROBE_TOKEN` for readiness probes; readiness never
+uses XFF for authorization.
+
+SQL-bearing POST responses and health probes use `Cache-Control: no-store`;
+public catalog responses use short `private` caching. Full deployment details
+will be documented in `docs/deployment.md`.
+
+See [`docs/deployment.md`](docs/deployment.md) for production deployment guidance.

{sql_dialect_master-1.1.5 → sql_dialect_master-1.1.7}/sql_dialect_master.egg-info/SOURCES.txt

@@ -4,6 +4,7 @@ pyproject.toml
 backend/__init__.py
 backend/api/__init__.py
 backend/api/auth.py
+backend/api/client_identity.py
 backend/api/main.py
 backend/api/middleware.py
 backend/api/rate_limit_store.py