sql-dialect-master 1.1.6__tar.gz → 1.1.7__tar.gz

{sql_dialect_master-1.1.6/sql_dialect_master.egg-info → sql_dialect_master-1.1.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sql-dialect-master
-Version: 1.1.6
+Version: 1.1.7
 Summary: SQL Dialect Master - Multi-database SQL conversion engine
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -35,7 +35,7 @@ Dynamic: license-file
 
 Enterprise-grade multi-database SQL conversion engine supporting 12 database dialects.
 
-Current release: 1.1.6
+Current release: 1.1.7
 
 [![Python 3.11+](https://img.shields.io/badge/python-3.11+-blue.svg)](https://www.python.org/downloads/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
@@ -359,3 +359,16 @@ Rate limiting is on by default. The two backends are:
 - `SDM_RATE_LIMIT_BACKEND=redis` — shared, atomic limits across all workers. Set `SDM_REDIS_URL` when using this backend. The store connects and pings Redis at startup and fails fast if it is unreachable; the `redis` package is required (install with `pip install redis`).
 
 `SDM_RATE_LIMIT_ENABLED=false` disables enforcement entirely. Use the in-memory backend for local development and the Redis backend for any deployment with more than one worker or instance that must enforce a single global limit.
+
+By default, the API does not trust `X-Forwarded-For`; rate limiting and logs
+use the direct peer address. Set `SDM_TRUSTED_PROXIES` to the proxy IPs/CIDRs
+only when the direct peer is a trusted proxy, after which the rightmost
+non-trusted address in the XFF chain is used. Deployments behind a proxy must
+also configure `SDM_HEALTH_PROBE_TOKEN` for readiness probes; readiness never
+uses XFF for authorization.
+
+SQL-bearing POST responses and health probes use `Cache-Control: no-store`;
+public catalog responses use short `private` caching. Full deployment details
+will be documented in `docs/deployment.md`.
+
+See [`docs/deployment.md`](docs/deployment.md) for production deployment guidance.

{sql_dialect_master-1.1.6 → sql_dialect_master-1.1.7}/README.md

@@ -2,7 +2,7 @@
 
 Enterprise-grade multi-database SQL conversion engine supporting 12 database dialects.
 
-Current release: 1.1.6
+Current release: 1.1.7
 
 [![Python 3.11+](https://img.shields.io/badge/python-3.11+-blue.svg)](https://www.python.org/downloads/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
@@ -326,3 +326,16 @@ Rate limiting is on by default. The two backends are:
 - `SDM_RATE_LIMIT_BACKEND=redis` — shared, atomic limits across all workers. Set `SDM_REDIS_URL` when using this backend. The store connects and pings Redis at startup and fails fast if it is unreachable; the `redis` package is required (install with `pip install redis`).
 
 `SDM_RATE_LIMIT_ENABLED=false` disables enforcement entirely. Use the in-memory backend for local development and the Redis backend for any deployment with more than one worker or instance that must enforce a single global limit.
+
+By default, the API does not trust `X-Forwarded-For`; rate limiting and logs
+use the direct peer address. Set `SDM_TRUSTED_PROXIES` to the proxy IPs/CIDRs
+only when the direct peer is a trusted proxy, after which the rightmost
+non-trusted address in the XFF chain is used. Deployments behind a proxy must
+also configure `SDM_HEALTH_PROBE_TOKEN` for readiness probes; readiness never
+uses XFF for authorization.
+
+SQL-bearing POST responses and health probes use `Cache-Control: no-store`;
+public catalog responses use short `private` caching. Full deployment details
+will be documented in `docs/deployment.md`.
+
+See [`docs/deployment.md`](docs/deployment.md) for production deployment guidance.

sql_dialect_master-1.1.7/backend/api/client_identity.py

@@ -0,0 +1,57 @@
+"""Resolve client IPs without trusting spoofable forwarding headers."""
+
+from __future__ import annotations
+
+import ipaddress
+import re
+from collections.abc import Iterable
+
+from fastapi import Request
+
+_BRACKETED_IPV6 = re.compile(r"^\[([^\]]+)\](?::\d+)?$")
+
+
+def _parse_ip(value: str) -> ipaddress.IPv4Address | ipaddress.IPv6Address | None:
+    candidate = value.strip()
+    if not candidate or "%" in candidate:
+        return None
+    bracketed = _BRACKETED_IPV6.fullmatch(candidate)
+    if bracketed:
+        candidate = bracketed.group(1)
+    elif candidate.count(":") == 1:
+        host, port = candidate.rsplit(":", 1)
+        if port.isdigit():
+            candidate = host
+    try:
+        return ipaddress.ip_address(candidate)
+    except ValueError:
+        return None
+
+
+def _is_trusted(
+    address: ipaddress.IPv4Address | ipaddress.IPv6Address,
+    trusted_networks: Iterable,
+) -> bool:
+    return any(
+        address.version == network.version and address in network
+        for network in trusted_networks
+    )
+
+
+def resolve_client_ip(request: Request, trusted_networks: tuple = ()) -> str:
+    """Resolve the client address, trusting XFF only behind trusted peers."""
+    peer = request.client.host if request.client else "unknown"
+    if not trusted_networks or peer == "unknown":
+        return peer
+
+    peer_address = _parse_ip(peer)
+    if peer_address is None or not _is_trusted(peer_address, trusted_networks):
+        return peer
+
+    forwarded_for = request.headers.get("X-Forwarded-For", "")
+    for value in reversed(forwarded_for.split(",")):
+        address = _parse_ip(value)
+        if address is None or _is_trusted(address, trusted_networks):
+            continue
+        return str(address)
+    return peer

{sql_dialect_master-1.1.6 → sql_dialect_master-1.1.7}/backend/api/main.py

@@ -235,6 +235,7 @@ app = FastAPI(
 
 # Import middleware
 from backend.api.middleware import (
+    CacheControlMiddleware,
     RateLimiter,
     RateLimitMiddleware,
     SecurityHeadersMiddleware,
@@ -244,6 +245,7 @@ from backend.core.exceptions import SDMException, UnsupportedDialectError, Error
 
 # Configure CORS from the centralized Pydantic settings source.
 ALLOWED_ORIGINS = [origin.strip() for origin in settings.allowed_origins.split(",") if origin.strip()]
+TRUSTED_PROXY_NETWORKS = settings.trusted_proxy_networks
 
 app.add_middleware(
     CORSMiddleware,
@@ -285,10 +287,15 @@ app.add_middleware(
     RateLimitMiddleware,
     limiter=rate_limiter,
     enabled=settings.rate_limit_enabled,
+    trusted_proxies=TRUSTED_PROXY_NETWORKS,
 )
 
 # Structured request logging must wrap rate limiting so rejected requests also get IDs.
-app.add_middleware(StructuredLoggingMiddleware)
+app.add_middleware(
+    StructuredLoggingMiddleware,
+    trusted_proxies=TRUSTED_PROXY_NETWORKS,
+)
+app.add_middleware(CacheControlMiddleware)
 
 # Initialize services
 transpiler = SQLTranspiler()

{sql_dialect_master-1.1.6 → sql_dialect_master-1.1.7}/backend/api/middleware.py

@@ -19,6 +19,7 @@ from starlette.concurrency import run_in_threadpool
 
 from backend.core.exceptions import ErrorCode
 
+from .client_identity import resolve_client_ip
 from .rate_limit_store import InMemoryRateLimitStore, RateLimitStore, create_rate_limit_store
 from .readiness import health_probe_response
 
@@ -35,7 +36,7 @@ def _sanitize_log_value(value: str, max_length: int = 500) -> str:
 class RateLimitEntry:
     """Legacy compatibility entry."""
     requests: int = 0
-    window_start: float = field(default_factory=time.time)
+    window_start: float = field(default_factory=time.monotonic)
 
 
 class RateLimiter:
@@ -67,13 +68,14 @@ class RateLimiter:
 class RateLimitMiddleware(BaseHTTPMiddleware):
     """Rate limiting middleware with a bounded request-body guard."""
 
-    def __init__(self, app, limiter: RateLimiter = None, enabled: bool = True, max_body_bytes: int = DEFAULT_MAX_REQUEST_BODY_BYTES):
+    def __init__(self, app, limiter: RateLimiter = None, enabled: bool = True, max_body_bytes: int = DEFAULT_MAX_REQUEST_BODY_BYTES, trusted_proxies: tuple = ()):
         super().__init__(app)
         if max_body_bytes <= 0:
             raise ValueError("max_body_bytes must be positive")
         self.limiter = limiter or RateLimiter(store=None if enabled else InMemoryRateLimitStore())
         self.enabled = enabled
         self.max_body_bytes = max_body_bytes
+        self.trusted_proxies = trusted_proxies
 
     async def _read_bounded_body(self, request: Request) -> Response | None:
         """Consume and cache request bodies without trusting Content-Length."""
@@ -171,15 +173,16 @@ class RateLimitMiddleware(BaseHTTPMiddleware):
         return response
 
     def _get_client_id(self, request: Request) -> str:
-        return request.client.host if request.client else "unknown"
+        return resolve_client_ip(request, self.trusted_proxies)
 
 
 class StructuredLoggingMiddleware(BaseHTTPMiddleware):
     """Structured request logging and request-id propagation."""
 
-    def __init__(self, app, log_body: bool = False):
+    def __init__(self, app, log_body: bool = False, trusted_proxies: tuple = ()):
         super().__init__(app)
         self.log_body = log_body
+        self.trusted_proxies = trusted_proxies
 
     @staticmethod
     def _get_request_id(request: Request) -> str:
@@ -346,7 +349,7 @@ class StructuredLoggingMiddleware(BaseHTTPMiddleware):
         request.state.request_id = request_id
         status_code = 500
         error = None
-        log_data = {"event": "request_start", "request_id": request_id, "method": _sanitize_log_value(request.method), "path": _sanitize_log_value(request.url.path), "query": _sanitize_log_value(str(request.query_params)), "client": _sanitize_log_value(request.client.host if request.client else "unknown"), "timestamp": datetime.now().isoformat()}
+        log_data = {"event": "request_start", "request_id": request_id, "method": _sanitize_log_value(request.method), "path": _sanitize_log_value(request.url.path), "query": _sanitize_log_value(str(request.query_params)), "client": _sanitize_log_value(resolve_client_ip(request, self.trusted_proxies)), "timestamp": datetime.now().isoformat()}
         logger.info(json.dumps(log_data))
         try:
             response = await call_next(request)
@@ -370,6 +373,40 @@ class SecurityHeadersMiddleware(BaseHTTPMiddleware):
         response = await call_next(request)
         response.headers["X-Content-Type-Options"] = "nosniff"
         response.headers["X-Frame-Options"] = "DENY"
-        response.headers["X-XSS-Protection"] = "1; mode=block"
+        response.headers["X-XSS-Protection"] = "0"
         response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
         return response
+
+
+class CacheControlMiddleware(BaseHTTPMiddleware):
+    """Apply explicit browser/proxy caching policy to API responses."""
+
+    @staticmethod
+    def _policy(request: Request) -> str | None:
+        if request.method == "OPTIONS":
+            return None
+        path = request.url.path
+        if path in {"/docs", "/redoc", "/openapi.json"}:
+            return None
+        if request.method == "POST" and path.startswith("/api/"):
+            return "no-store"
+        if request.method in {"GET", "HEAD"}:
+            if path in {"/health", "/ready", "/health/deep"}:
+                return "no-store"
+            if path == "/api/dialects":
+                return "private, max-age=60"
+            if path == "/api/functions" or path.startswith("/api/functions/"):
+                return "private, max-age=60"
+            if path == "/api/types" or path.startswith("/api/types/"):
+                return "private, max-age=60"
+            if path in {"/", "/api/stats"}:
+                return "private, max-age=15"
+        return None
+
+    async def dispatch(self, request: Request, call_next) -> Response:
+        response = await call_next(request)
+        if not response.headers.get("Cache-Control"):
+            policy = self._policy(request)
+            if policy:
+                response.headers["Cache-Control"] = policy
+        return response

{sql_dialect_master-1.1.6 → sql_dialect_master-1.1.7}/backend/api/rate_limit_store.py

@@ -44,7 +44,7 @@ class InMemoryRateLimitStore:
 
     def check(self, key: str, limit: int, window_seconds: int) -> tuple[bool, int, int]:
         with self._lock:
-            now = time.time()
+            now = time.monotonic()
             self._prune_expired(now)
             count, window_start = self._entries.get(key, (0, now))
             if now - window_start >= window_seconds:
@@ -58,7 +58,7 @@ class InMemoryRateLimitStore:
 
     def stats(self) -> dict:
         with self._lock:
-            self._prune_expired(time.time())
+            self._prune_expired(time.monotonic())
             return {"backend": "memory", "active_clients": len(self._entries)}
 
 

{sql_dialect_master-1.1.6 → sql_dialect_master-1.1.7}/backend/core/config.py

@@ -10,6 +10,7 @@ Supports configuration via:
 - Default values
 """
 import logging
+import ipaddress
 import sys
 from enum import Enum
 from typing import Any, Dict, List, Literal, Optional, TypedDict
@@ -225,6 +226,7 @@ class AppSettings(BaseSettings):
         "http://localhost:5174,http://127.0.0.1:5174,"
         "http://localhost:4174,http://127.0.0.1:4174"
     )
+    trusted_proxies: str = ""
     max_batch_size: int = Field(100, gt=0)
     request_timeout: int = Field(30, gt=0)
     
@@ -299,6 +301,40 @@ class AppSettings(BaseSettings):
                 "log_level must be one of DEBUG, INFO, WARNING, ERROR, CRITICAL"
             )
         return normalized
+
+    @field_validator("trusted_proxies", mode="before")
+    @classmethod
+    def _normalize_trusted_proxies(cls, value: str) -> str:
+        if value is None:
+            return ""
+        if not isinstance(value, str):
+            raise ValueError("trusted_proxies must be a comma-separated string")
+        normalized = []
+        for raw_value in value.split(","):
+            candidate = raw_value.strip()
+            if not candidate:
+                continue
+            try:
+                network = ipaddress.ip_network(candidate, strict=False)
+            except ValueError as exc:
+                raise ValueError(
+                    f"trusted_proxies contains an invalid IP/CIDR: {candidate!r}"
+                ) from exc
+            if network.prefixlen == 0:
+                raise ValueError("trusted_proxies must not contain a catch-all network")
+            normalized.append(str(network))
+        return ",".join(normalized)
+
+    @property
+    def trusted_proxy_networks(self) -> tuple:
+        """Return parsed trusted proxy networks for request identity checks."""
+        if not self.trusted_proxies:
+            return ()
+        return tuple(
+            ipaddress.ip_network(value, strict=False)
+            for value in self.trusted_proxies.split(",")
+            if value
+        )
     
     def to_dict(self) -> Dict[str, Any]:
         """Convert settings to dictionary."""

{sql_dialect_master-1.1.6 → sql_dialect_master-1.1.7}/backend/core/metadata.py

@@ -17,8 +17,8 @@ Design rules:
 from __future__ import annotations
 
 # ── Release version facts (sole source of truth) ────────────────────────
-PROJECT_VERSION = "1.1.6"
-API_VERSION = "1.1.6"
+PROJECT_VERSION = "1.1.7"
+API_VERSION = "1.1.7"
 # Frontend v2 architecture — independent of the product release version.
 FRONTEND_ARCHITECTURE_VERSION = 2
 

{sql_dialect_master-1.1.6 → sql_dialect_master-1.1.7}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sql-dialect-master"
-version = "1.1.6"
+version = "1.1.7"
 description = "SQL Dialect Master - Multi-database SQL conversion engine"
 readme = "README.md"
 requires-python = ">=3.11"

{sql_dialect_master-1.1.6 → sql_dialect_master-1.1.7/sql_dialect_master.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sql-dialect-master
-Version: 1.1.6
+Version: 1.1.7
 Summary: SQL Dialect Master - Multi-database SQL conversion engine
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -35,7 +35,7 @@ Dynamic: license-file
 
 Enterprise-grade multi-database SQL conversion engine supporting 12 database dialects.
 
-Current release: 1.1.6
+Current release: 1.1.7
 
 [![Python 3.11+](https://img.shields.io/badge/python-3.11+-blue.svg)](https://www.python.org/downloads/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
@@ -359,3 +359,16 @@ Rate limiting is on by default. The two backends are:
 - `SDM_RATE_LIMIT_BACKEND=redis` — shared, atomic limits across all workers. Set `SDM_REDIS_URL` when using this backend. The store connects and pings Redis at startup and fails fast if it is unreachable; the `redis` package is required (install with `pip install redis`).
 
 `SDM_RATE_LIMIT_ENABLED=false` disables enforcement entirely. Use the in-memory backend for local development and the Redis backend for any deployment with more than one worker or instance that must enforce a single global limit.
+
+By default, the API does not trust `X-Forwarded-For`; rate limiting and logs
+use the direct peer address. Set `SDM_TRUSTED_PROXIES` to the proxy IPs/CIDRs
+only when the direct peer is a trusted proxy, after which the rightmost
+non-trusted address in the XFF chain is used. Deployments behind a proxy must
+also configure `SDM_HEALTH_PROBE_TOKEN` for readiness probes; readiness never
+uses XFF for authorization.
+
+SQL-bearing POST responses and health probes use `Cache-Control: no-store`;
+public catalog responses use short `private` caching. Full deployment details
+will be documented in `docs/deployment.md`.
+
+See [`docs/deployment.md`](docs/deployment.md) for production deployment guidance.

{sql_dialect_master-1.1.6 → sql_dialect_master-1.1.7}/sql_dialect_master.egg-info/SOURCES.txt

@@ -4,6 +4,7 @@ pyproject.toml
 backend/__init__.py
 backend/api/__init__.py
 backend/api/auth.py
+backend/api/client_identity.py
 backend/api/main.py
 backend/api/middleware.py
 backend/api/rate_limit_store.py