sql2api 0.2.0__py3-none-any.whl → 0.3.0__py3-none-any.whl

sql2api/__init__.py

@@ -1,5 +1,5 @@
 """SQL2API - expose SQL databases as a REST API."""
-__version__ = '0.2.0'
+__version__ = '0.3.0'
 
 from .app import create_app  # noqa: E402  (app imports __version__)
 

sql2api/app.py

@@ -3,13 +3,16 @@ import hmac
 import logging
 import math
 
-from flask import Blueprint, Flask, Response, jsonify, redirect, request, url_for
+from flask import Blueprint, Flask, Response, current_app, g, jsonify, redirect, request, url_for
 from flask.json.provider import DefaultJSONProvider
 from werkzeug.exceptions import HTTPException
+from werkzeug.middleware.proxy_fix import ProxyFix
 
-from . import config, engine, openapi, pool, sqltools, store
+from . import config, cors, engine, openapi, pool, sqltools, store
+from . import params as param_rules
 from .errors import ApiError
 from .formats import FORMATTERS, json_default
+from .ratelimit import RateLimiter
 
 log = logging.getLogger('sql2api')
 bp = Blueprint('api', __name__)
@@ -17,6 +20,7 @@ bp = Blueprint('api', __name__)
 # Query-string arguments that control a request rather than supplying query parameters.
 RESERVED_ARGS = {'format', 'page', 'page_size', 'connection_name', 'version', 'timeout'}
 PUBLIC_ENDPOINTS = {'api.index', 'api.favicon', 'api.health', 'api.docs', 'api.openapi_spec'}
+RATE_LIMIT_EXEMPT = {'api.health'}  # so monitoring keeps working while a client is being throttled
 
 
 class JSONProvider(DefaultJSONProvider):
@@ -26,7 +30,15 @@ class JSONProvider(DefaultJSONProvider):
 
 def create_app():
     from . import __version__
+    config.check_settings()
     app = Flask(__name__)
+    hops = config.proxy_hops()
+    if hops:  # behind reverse proxies: take the client address and scheme from their X-Forwarded-* headers
+        app.wsgi_app = ProxyFix(app.wsgi_app, x_for=hops, x_proto=hops, x_host=hops)
+    app.extensions['sql2api_limiter'] = RateLimiter()
+    if config.cors_origins() == '*' and not config.api_key():
+        log.warning('SQL2API_CORS_ORIGINS=* without SQL2API_API_KEY: any website a user visits can call this API '
+                    'from their browser and reach every active connection. Set an API key or list the origins.')
     app.json = JSONProvider(app)
     app.config['SQL2API_VERSION'] = __version__
 
@@ -44,13 +56,25 @@ def create_app():
         return jsonify({'error': 'An error occurred'}), 500
 
     @app.before_request
-    def require_api_key():
-        expected = config.api_key()
-        if expected and request.endpoint not in PUBLIC_ENDPOINTS:
-            # compare_digest rejects non-ASCII str, so compare bytes
-            supplied = request.headers.get('X-API-Key', '').encode('utf-8', 'replace')
-            if not hmac.compare_digest(supplied, expected.encode('utf-8')):
-                return jsonify({'error': 'Unauthorized'}), 401
+    def gate():
+        # Order matters: a browser's preflight cannot carry the API key, and rate limiting comes before the key
+        # check so that guessing keys is throttled too.
+        if cors.is_preflight(request):
+            return cors.preflight_response(request.headers.get('Origin'))
+        limited = check_rate_limit()
+        if limited is not None:
+            return limited
+        if request.endpoint not in PUBLIC_ENDPOINTS and not has_valid_key():
+            return jsonify({'error': 'Unauthorized'}), 401
+
+    @app.after_request
+    def decorate(response):
+        cors.add_headers(response, request.headers.get('Origin'))
+        if g.get('rate_limit'):
+            limit, remaining = g.rate_limit
+            response.headers['X-RateLimit-Limit'] = str(limit)
+            response.headers['X-RateLimit-Remaining'] = str(remaining)
+        return response
 
     app.register_blueprint(bp)
     return app
@@ -60,6 +84,33 @@ def create_app():
 # Request helpers
 # --------------------------------------------------------------------------------------
 
+def check_rate_limit():
+    """Count this request against its client's quota; returns a 429 response when it is over the limit."""
+    limit = config.rate_limit()
+    if limit is None or request.method == 'OPTIONS' or request.endpoint in RATE_LIMIT_EXEMPT:
+        return None
+    count, period = limit
+    client = request.remote_addr or 'unknown'
+    allowed, remaining, retry_after = current_app.extensions['sql2api_limiter'].hit(client, count, period)
+    g.rate_limit = (count, remaining)
+    if allowed:
+        return None
+    response = jsonify({'error': 'Rate limit exceeded', 'retry_after': retry_after})
+    response.status_code = 429
+    response.headers['Retry-After'] = str(retry_after)
+    return response
+
+
+def has_valid_key():
+    """True when no API key is configured, or the request carries the right X-API-Key header."""
+    expected = config.api_key()
+    if not expected:
+        return True
+    # compare_digest rejects non-ASCII str, so compare bytes
+    supplied = request.headers.get('X-API-Key', '').encode('utf-8', 'replace')
+    return hmac.compare_digest(supplied, expected.encode('utf-8'))
+
+
 def get_json_body(required=True):
     data = request.get_json(silent=True)
     if data is None and not required:
@@ -161,15 +212,16 @@ def run_saved(ref, body, url_params):
 
     raw = {**url_params, **get_object(body.get('params'), 'params'),
            **get_object(body.get('placeholders'), 'placeholders')}
-    params = sqltools.coerce_params(saved.get('query_parameters'), raw)
-    sql = sqltools.fill_placeholders(saved['sql_query'], params)
+    used = set(sqltools.placeholder_names(saved['sql_query']))
+    values = param_rules.resolve(saved.get('query_parameters'), raw, used=used)
+    sql = sqltools.fill_placeholders(saved['sql_query'], values)
     output_format = get_output_format(body)
     timeout = get_timeout(body)
     limit, offset, page = get_pagination()
 
     entry = {'executed_at': store.now(), 'connection_name': connection_name}
     try:
-        result, elapsed_ms = engine.timed(engine.execute_sql, sql, connection_name, limit, offset, params, timeout)
+        result, elapsed_ms = engine.timed(engine.execute_sql, sql, connection_name, limit, offset, values, timeout)
     except ApiError as error:
         store.record_execution(path, number, {**entry, 'status': 'error', 'error': error.message})
         raise
@@ -214,6 +266,11 @@ def save_sql_to_file():
     if not isinstance(tags, (list, str)):
         raise ApiError('tags must be a string or a list')
     query_parameters = get_object(data.get('query_parameters'), 'query_parameters')
+    param_rules.parse_definitions(query_parameters)
+    unused = sorted(set(query_parameters) - set(sqltools.placeholder_names(data['sql_query'])))
+    if unused:
+        raise ApiError(f"query_parameters declares {', '.join(unused)}, which sql_query does not use "
+                       '(write :name in the SQL, or remove the declaration)')
     connection_name = data.get('connection_name')
     if connection_name is not None and not isinstance(connection_name, str):
         raise ApiError('connection_name must be a string')
@@ -304,10 +361,31 @@ def health():
     return jsonify({'status': 'ok', 'version': current_app.config['SQL2API_VERSION']})
 
 
+def describe_saved_queries():
+    """What the OpenAPI document needs to know about each saved query (never its SQL text)."""
+    described = []
+    for name, number, data in store.latest_versions():
+        sql = data.get('sql_query')
+        if not isinstance(sql, str):
+            continue
+        declared = param_rules.read_definitions(data.get('query_parameters'))
+        used = sqltools.placeholder_names(sql)
+        parameters = {}
+        for param in used:  # what the SQL needs, in order; undeclared ones are plain required text
+            parameters[param] = declared.get(param) or param_rules.read_definition({})
+        described.append({'name': name, 'version': number, 'description': data.get('description'),
+                          'tags': data.get('tags'), 'connection_name': data.get('connection_name'),
+                          'parameters': parameters})
+    return described
+
+
 @bp.route('/openapi.json', methods=['GET'])
 def openapi_spec():
     from flask import current_app
-    return jsonify(openapi.build_spec(current_app.config['SQL2API_VERSION']))
+    # The generic API description is public. The list of saved queries (names, descriptions, parameters) is only
+    # shown to callers who could list them anyway, so an API key protects it too.
+    saved = describe_saved_queries() if has_valid_key() else None
+    return jsonify(openapi.build_spec(current_app.config['SQL2API_VERSION'], saved))
 
 
 @bp.route('/docs', methods=['GET'])

sql2api/cli.py

@@ -2,6 +2,7 @@
 import argparse
 import logging
 import os
+import sys
 
 from . import __version__, config, store
 from .app import create_app
@@ -10,7 +11,11 @@ LOOPBACK_HOSTS = ('127.0.0.1', 'localhost', '::1')
 
 
 def _serve(args):
-    app = create_app()
+    try:
+        app = create_app()
+    except ValueError as error:  # a malformed setting, e.g. SQL2API_RATE_LIMIT
+        print(f'sql2api: {error}', file=sys.stderr)
+        return 2
     if args.host not in LOOPBACK_HOSTS and not config.api_key():
         logging.getLogger('sql2api').warning(
             'Listening on %s without SQL2API_API_KEY set: anyone who can reach this port can run SQL '

sql2api/config.py

@@ -1,5 +1,6 @@
 """Runtime configuration, read from environment variables at call time."""
 import os
+import re
 from pathlib import Path
 
 SUPPORTED_DB_TYPES = ('mysql', 'postgres', 'clickhouse', 'sqlite', 'h2')
@@ -94,6 +95,60 @@ def pool_idle_timeout():
     return value if value > 0 else DEFAULT_POOL_IDLE_TIMEOUT
 
 
+def cors_origins():
+    """Origins allowed to call the API from a browser (SQL2API_CORS_ORIGINS): None (off), '*' or a frozenset.
+
+    Entries are compared case-insensitively and without a trailing slash, e.g. https://app.example.com.
+    """
+    raw = os.environ.get('SQL2API_CORS_ORIGINS', '').strip()
+    if not raw:
+        return None
+    origins = [item.strip().rstrip('/').lower() for item in raw.split(',') if item.strip()]
+    if '*' in origins:
+        return '*'
+    return frozenset(origins) or None
+
+
+_RATE_PERIODS = {'second': 1, 'minute': 60, 'hour': 3600, 'day': 86400}
+_RATE_RE = re.compile(r'^\s*(\d+)\s*/\s*(second|minute|hour|day)s?\s*$', re.I)
+
+
+def parse_rate_limit(text):
+    """Parse '60/minute' (also second, hour, day) into (requests, seconds); raises ValueError when malformed."""
+    match = _RATE_RE.match(text or '')
+    if not match or int(match.group(1)) < 1:
+        raise ValueError(f"SQL2API_RATE_LIMIT must look like '60/minute' (a positive count, then second, minute, "
+                         f"hour or day), not {text!r}")
+    return int(match.group(1)), _RATE_PERIODS[match.group(2).lower()]
+
+
+def rate_limit():
+    """(requests, seconds) allowed per client (SQL2API_RATE_LIMIT), or None when limiting is off."""
+    raw = os.environ.get('SQL2API_RATE_LIMIT', '').strip()
+    if not raw:
+        return None
+    try:
+        return parse_rate_limit(raw)
+    except ValueError:
+        return None  # create_app() rejects a malformed value at startup; never limit by accident afterwards
+
+
+def proxy_hops():
+    """Reverse proxies in front of the app whose X-Forwarded-* headers can be trusted (SQL2API_TRUST_PROXY)."""
+    try:
+        return max(0, int(os.environ.get('SQL2API_TRUST_PROXY', 0)))
+    except ValueError:
+        return 0
+
+
+def check_settings():
+    """Raise ValueError for a malformed setting, so a typo fails at startup instead of silently switching off a
+    protection."""
+    raw = os.environ.get('SQL2API_RATE_LIMIT', '').strip()
+    if raw:
+        parse_rate_limit(raw)
+
+
 def max_page_size():
     try:
         return max(1, int(os.environ.get('SQL2API_MAX_PAGE_SIZE', 1000)))

sql2api/cors.py

@@ -0,0 +1,51 @@
+"""Cross-origin (CORS) support for browser clients, off unless SQL2API_CORS_ORIGINS is set.
+
+Without it a web page on another origin cannot call the API: browsers refuse to send the JSON requests and to read
+the answers. CORS only tells the *browser* which sites may call; it is not authentication (use SQL2API_API_KEY).
+"""
+from flask import Response
+
+from . import config
+
+ALLOWED_METHODS = 'GET, POST, PATCH, DELETE, OPTIONS'
+ALLOWED_HEADERS = 'Content-Type, X-API-Key'
+# Browsers hide response headers a page has not been told about, and pagination depends on these.
+EXPOSED_HEADERS = 'X-Page, X-Page-Size, X-Has-More, X-RateLimit-Limit, X-RateLimit-Remaining, Retry-After'
+PREFLIGHT_MAX_AGE = '600'
+
+
+def allow_origin_value(origin):
+    """The Access-Control-Allow-Origin value for a request from ``origin``, or None when it is not allowed."""
+    allowed = config.cors_origins()
+    if allowed is None or not origin:
+        return None
+    if allowed == '*':
+        return '*'
+    return origin if origin.rstrip('/').lower() in allowed else None
+
+
+def is_preflight(request):
+    return (request.method == 'OPTIONS' and 'Access-Control-Request-Method' in request.headers
+            and config.cors_origins() is not None)
+
+
+def preflight_response(origin):
+    """Answer a browser's permission check before it sends the real request (no auth: it carries no key)."""
+    response = Response(status=204)
+    value = allow_origin_value(origin)
+    if value:
+        response.headers['Access-Control-Allow-Methods'] = ALLOWED_METHODS
+        response.headers['Access-Control-Allow-Headers'] = ALLOWED_HEADERS
+        response.headers['Access-Control-Max-Age'] = PREFLIGHT_MAX_AGE
+        add_headers(response, origin)
+    return response
+
+
+def add_headers(response, origin):
+    value = allow_origin_value(origin)
+    if value:
+        response.headers['Access-Control-Allow-Origin'] = value
+        response.headers['Access-Control-Expose-Headers'] = EXPOSED_HEADERS
+        if value != '*':
+            response.headers.add('Vary', 'Origin')  # the answer depends on who asked
+    return response

sql2api/openapi.py

@@ -1,5 +1,9 @@
 """OpenAPI description of the API, served at /openapi.json and rendered at /docs."""
+import re
+from urllib.parse import quote
+
 from . import config
+from .params import json_schema
 
 _FORMAT_PARAM = {'name': 'format', 'in': 'query', 'schema': {
     'type': 'string', 'enum': ['json', 'ndjson', 'csv', 'tsv', 'xml', 'yaml', 'xlsx'], 'default': 'json'}}
@@ -7,7 +11,7 @@ _PAGE_PARAMS = [
     {'name': 'page', 'in': 'query', 'schema': {'type': 'integer', 'minimum': 1, 'default': 1}},
     {'name': 'page_size', 'in': 'query', 'schema': {'type': 'integer', 'minimum': 1, 'default': 10},
      'description': 'Upper limit is SQL2API_MAX_PAGE_SIZE (default 1000).'},
-    {'name': 'timeout', 'in': 'query', 'schema': {'type': 'number', 'exclusiveMinimum': 0},
+    {'name': 'timeout', 'in': 'query', 'schema': {'type': 'number', 'minimum': 0, 'exclusiveMinimum': True},
      'description': 'Seconds the query may run before it is cancelled (504). Can lower, never raise, the server '
                     'limit SQL2API_QUERY_TIMEOUT (default 30; 0 disables the server limit).'},
 ]
@@ -15,12 +19,19 @@ _ROWS = {'description': 'The requested page. Header X-Has-More says whether anot
          'headers': {'X-Page': {'schema': {'type': 'integer'}}, 'X-Page-Size': {'schema': {'type': 'integer'}},
                      'X-Has-More': {'schema': {'type': 'string', 'enum': ['true', 'false']}}},
          'content': {'application/json': {'schema': {'type': 'array', 'items': {'type': 'object'}}}}}
-_ERRORS = {c: {'$ref': '#/components/responses/Error'} for c in ('400', '401', '403', '404', '500', '504')}
+_ERRORS = {c: {'$ref': '#/components/responses/Error'} for c in ('400', '401', '403', '404', '429', '500', '504')}
+
+
+def _object_schema(properties, required=()):
+    """An object schema; OpenAPI 3.0 forbids an empty ``required`` list, so it is only included when non-empty."""
+    schema = {'type': 'object', 'properties': properties}
+    if required:
+        schema['required'] = list(required)
+    return schema
 
 
 def _body(properties, required):
-    return {'required': True, 'content': {'application/json': {'schema': {
-        'type': 'object', 'required': required, 'properties': properties}}}}
+    return {'required': True, 'content': {'application/json': {'schema': _object_schema(properties, required)}}}
 
 
 _EXEC_PROPS = {
@@ -32,10 +43,58 @@ _EXEC_PROPS = {
 }
 
 
-def build_spec(version):
+def _saved_query_paths(queries):
+    """One documented endpoint per saved query, with its declared parameters and rules."""
+    paths, seen = {}, set()
+    for query in queries:
+        name = query['name']
+        has_default_connection = bool(query.get('connection_name'))
+        properties, required, query_params = {}, [], []
+        for param, spec in query['parameters'].items():
+            schema = json_schema(spec)
+            entry = {'name': param, 'in': 'query', 'required': spec['required'], 'schema': schema}
+            if spec['description']:
+                entry['description'] = spec['description']
+            query_params.append(entry)
+            properties[param] = {**schema, **({'description': spec['description']} if spec['description'] else {})}
+            if spec['required']:
+                required.append(param)
+        connection = {'name': 'connection_name', 'in': 'query', 'required': not has_default_connection,
+                      'schema': {'type': 'string', **({'default': query['connection_name']}
+                                                      if has_default_connection else {})}}
+        common = [connection, {'name': 'version', 'in': 'query', 'schema': {'type': 'integer'},
+                               'description': f"Saved version to run (default: latest, currently {query['version']})."},
+                  _FORMAT_PARAM, *_PAGE_PARAMS]
+        summary = query.get('description') or f'Run the saved query {name}'
+        tags = query.get('tags')
+        detail = f"Runs version {query['version']} of the saved query '{name}'."
+        if tags:
+            detail += ' Tags: ' + (tags if isinstance(tags, str) else ', '.join(map(str, tags))) + '.'
+        operation_id = 'run_' + re.sub(r'\W', '_', name)
+        while operation_id in seen:
+            operation_id += '_'
+        seen.add(operation_id)
+        body_properties = {'params': _object_schema(properties, required),
+                           'connection_name': connection['schema'], 'version': {'type': 'integer'},
+                           'format': {'type': 'string'}, 'timeout': {'type': 'number'}}
+        paths['/q/' + quote(name, safe='')] = {
+            'get': {'summary': summary, 'description': detail, 'tags': ['Saved queries (live)'],
+                    'operationId': operation_id, 'parameters': [*query_params, *common],
+                    'responses': {'200': _ROWS, **_ERRORS}},
+            'post': {'summary': summary + ' (parameters in a JSON body)', 'description': detail,
+                     'tags': ['Saved queries (live)'], 'operationId': operation_id + '_post',
+                     'parameters': [_FORMAT_PARAM, *_PAGE_PARAMS],
+                     'requestBody': {'required': bool(required), 'content': {'application/json': {
+                         'schema': _object_schema(body_properties)}}},
+                     'responses': {'200': _ROWS, **_ERRORS}},
+        }
+    return paths
+
+
+def build_spec(version, saved_queries=None):
     saved = {'filepath': {'type': 'string', 'description': 'Saved query name or path inside saved_sql/.'},
              **_EXEC_PROPS}
-    return {
+    spec = {
         'openapi': '3.0.3',
         'info': {'title': 'SQL2API', 'version': version,
                  'description': 'Run SQL against configured databases and get the results back over HTTP.'},
@@ -119,12 +178,42 @@ def build_spec(version):
                                 'responses': {'200': {'description': 'OK'}}}},
         },
     }
+    if saved_queries:
+        spec['paths'].update(_saved_query_paths(saved_queries))
+        spec['tags'] = [{'name': 'Saved queries (live)',
+                         'description': 'One endpoint per saved query, generated from its latest version: its '
+                                        'declared parameters and their rules, and its default connection.'}]
+    return spec
 
 
 DOCS_HTML = """<!doctype html>
 <html><head><meta charset="utf-8"><title>SQL2API docs</title>
-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/swagger-ui-dist@5/swagger-ui.css"></head>
-<body><div id="ui"></div>
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/swagger-ui-dist@5/swagger-ui.css">
+<style>
+  body { margin: 0; font-family: sans-serif; }
+  #key-bar { padding: 8px 16px; background: #f4f4f4; border-bottom: 1px solid #ddd; font-size: 14px; }
+  #key-bar input { width: 260px; padding: 4px; }
+</style></head>
+<body>
+<div id="key-bar">
+  API key (only needed if the server sets SQL2API_API_KEY; it reveals your saved queries below and is
+  sent with "Try it out" requests; kept for this browser tab only):
+  <input id="key" type="password" autocomplete="off" placeholder="X-API-Key">
+  <button id="save-key">Apply</button>
+</div>
+<div id="ui"></div>
 <script src="https://cdn.jsdelivr.net/npm/swagger-ui-dist@5/swagger-ui-bundle.js"></script>
-<script>SwaggerUIBundle({url: 'openapi.json', dom_id: '#ui'});</script></body></html>
+<script>
+  var stored = '';
+  try { stored = sessionStorage.getItem('sql2api-key') || ''; } catch (e) {}
+  document.getElementById('key').value = stored;
+  document.getElementById('save-key').onclick = function () {
+    try { sessionStorage.setItem('sql2api-key', document.getElementById('key').value); } catch (e) {}
+    location.reload();
+  };
+  SwaggerUIBundle({
+    url: 'openapi.json', dom_id: '#ui',
+    requestInterceptor: function (req) { if (stored) { req.headers['X-API-Key'] = stored; } return req; }
+  });
+</script></body></html>
 """

sql2api/params.py

@@ -0,0 +1,275 @@
+"""Parameter definitions of a saved query: checking the definitions, and enforcing them on request values.
+
+A saved query declares its parameters in ``query_parameters``. The short form is just a type
+(``{"id": "int"}``); the full form adds rules::
+
+    {
+        "rating":     {"type": "str", "enum": ["G", "PG", "R"], "default": "PG", "description": "MPAA rating"},
+        "max_length": {"type": "int", "min": 1, "max": 600},
+        "title":      {"type": "str", "required": false, "min_length": 2, "pattern": "[A-Za-z ]+"}
+    }
+
+Rules: ``type`` (int, float, str, bool), ``required`` (default: true unless a ``default`` is given), ``default``,
+``enum``, ``min``/``max`` (numbers), ``min_length``/``max_length``/``pattern`` (text) and ``description``.
+An optional parameter that is neither supplied nor defaulted is bound as NULL.
+
+Definitions are validated strictly when a query is saved. At run time they are read leniently, so older saved
+files with unusual definitions keep working.
+"""
+import math
+import re
+
+from .errors import ApiError
+
+_TYPES = {'int': 'integer', 'integer': 'integer', 'float': 'number', 'number': 'number',
+          'str': 'string', 'string': 'string', 'bool': 'boolean', 'boolean': 'boolean'}
+_RULE_KEYS = {'type', 'required', 'default', 'enum', 'min', 'max', 'min_length', 'max_length', 'pattern',
+              'description'}
+_NAME_RE = re.compile(r'^[A-Za-z_]\w*$')
+_MAX_PATTERN_LENGTH = 500
+
+
+class _Invalid(Exception):
+    """A value or a definition that breaks a rule; the message completes the sentence '<name> ...'."""
+
+
+def _to_bool(text):
+    lowered = text.strip().lower()
+    if lowered in ('true', '1', 'yes'):
+        return True
+    if lowered in ('false', '0', 'no'):
+        return False
+    raise ValueError(text)
+
+
+def _is_number(value):
+    return isinstance(value, (int, float)) and not isinstance(value, bool) and math.isfinite(value)
+
+
+def _plain(spec):
+    return {'type': None, 'required': True, 'has_default': False, 'default': None, 'enum': None, 'min': None,
+            'max': None, 'min_length': None, 'max_length': None, 'pattern': None, 'description': None, **spec}
+
+
+def _coerce(type_name, value):
+    """Convert a value (usually a query-string text) to the declared type, or raise _Invalid."""
+    if type_name == 'integer':
+        if isinstance(value, str):
+            try:
+                return int(value)
+            except ValueError:
+                raise _Invalid('must be an integer') from None
+        if isinstance(value, int) and not isinstance(value, bool):
+            return value
+        raise _Invalid('must be an integer')
+    if type_name == 'number':
+        if isinstance(value, str):
+            try:
+                value = float(value)
+            except ValueError:
+                raise _Invalid('must be a number') from None
+        if _is_number(value):
+            return value
+        raise _Invalid('must be a number')
+    if type_name == 'boolean':
+        if isinstance(value, str):
+            try:
+                return _to_bool(value)
+            except ValueError:
+                raise _Invalid('must be true or false') from None
+        if isinstance(value, bool):
+            return value
+        raise _Invalid('must be true or false')
+    if type_name == 'string':
+        if isinstance(value, str):
+            return value
+        raise _Invalid('must be text')
+    if isinstance(value, (str, bool)) or _is_number(value):  # untyped: any scalar
+        return value
+    raise _Invalid('must be text, a number or true/false')
+
+
+def _check(spec, value):
+    """Return the value converted to the declared type after applying every rule, or raise _Invalid."""
+    value = _coerce(spec['type'], value)
+    if spec['enum'] is not None and value not in spec['enum']:
+        raise _Invalid('must be one of: ' + ', '.join(str(v) for v in spec['enum']))
+    if _is_number(value):
+        if spec['min'] is not None and value < spec['min']:
+            raise _Invalid(f"must be at least {spec['min']:g}")
+        if spec['max'] is not None and value > spec['max']:
+            raise _Invalid(f"must be at most {spec['max']:g}")
+    if isinstance(value, str):
+        if spec['min_length'] is not None and len(value) < spec['min_length']:
+            raise _Invalid(f"must be at least {spec['min_length']} characters long")
+        if spec['max_length'] is not None and len(value) > spec['max_length']:
+            raise _Invalid(f"must be at most {spec['max_length']} characters long")
+        if spec['pattern'] is not None and not re.fullmatch(spec['pattern'], value):
+            raise _Invalid(f"must match the pattern {spec['pattern']}")
+    return value
+
+
+# --------------------------------------------------------------------------------------
+# Definitions
+# --------------------------------------------------------------------------------------
+
+def _parse_strict(spec):
+    if isinstance(spec, str):
+        spec = {'type': spec}
+    if not isinstance(spec, dict):
+        raise _Invalid("must be a type name such as 'int' or an object of rules")
+    unknown = sorted(set(spec) - _RULE_KEYS)
+    if unknown:
+        raise _Invalid(f"has unknown rule(s): {', '.join(unknown)} (allowed: {', '.join(sorted(_RULE_KEYS))})")
+
+    type_name = None
+    if spec.get('type') is not None:
+        type_name = _TYPES.get(str(spec['type']).lower())
+        if type_name is None:
+            raise _Invalid(f"has unknown type '{spec['type']}' (use int, float, str or bool)")
+    parsed = _plain({'type': type_name})
+
+    if 'required' in spec:
+        if not isinstance(spec['required'], bool):
+            raise _Invalid("'required' must be true or false")
+        parsed['required'] = spec['required']
+    elif 'default' in spec:
+        parsed['required'] = False
+    if 'description' in spec:
+        if not isinstance(spec['description'], str):
+            raise _Invalid("'description' must be text")
+        parsed['description'] = spec['description']
+
+    numeric = type_name in (None, 'integer', 'number')
+    textual = type_name in (None, 'string')
+    for key in ('min', 'max'):
+        if key in spec:
+            if not numeric:
+                raise _Invalid(f"'{key}' only applies to numbers (use min_length/max_length for text)")
+            if not _is_number(spec[key]):
+                raise _Invalid(f"'{key}' must be a number")
+            parsed[key] = spec[key]
+    if parsed['min'] is not None and parsed['max'] is not None and parsed['min'] > parsed['max']:
+        raise _Invalid("'min' must not be greater than 'max'")
+    for key in ('min_length', 'max_length'):
+        if key in spec:
+            if not textual:
+                raise _Invalid(f"'{key}' only applies to text")
+            if not isinstance(spec[key], int) or isinstance(spec[key], bool) or spec[key] < 0:
+                raise _Invalid(f"'{key}' must be a non-negative integer")
+            parsed[key] = spec[key]
+    if (parsed['min_length'] is not None and parsed['max_length'] is not None
+            and parsed['min_length'] > parsed['max_length']):
+        raise _Invalid("'min_length' must not be greater than 'max_length'")
+    if 'pattern' in spec:
+        if not textual:
+            raise _Invalid("'pattern' only applies to text")
+        if not isinstance(spec['pattern'], str) or len(spec['pattern']) > _MAX_PATTERN_LENGTH:
+            raise _Invalid(f"'pattern' must be text of at most {_MAX_PATTERN_LENGTH} characters")
+        try:
+            re.compile(spec['pattern'])
+        except re.error as error:
+            raise _Invalid(f"'pattern' is not a valid regular expression ({error})") from None
+        parsed['pattern'] = spec['pattern']
+
+    if 'enum' in spec:
+        if not isinstance(spec['enum'], list) or not spec['enum']:
+            raise _Invalid("'enum' must be a non-empty list")
+        try:
+            parsed['enum'] = [_coerce(type_name, v) for v in spec['enum']]
+        except _Invalid as error:
+            raise _Invalid(f"has an 'enum' value that {error}") from None
+    if 'default' in spec:
+        if spec.get('required') is True:
+            raise _Invalid("cannot be both 'required' and have a 'default'")
+        try:
+            parsed['default'] = _check(parsed, spec['default'])
+        except _Invalid as error:
+            raise _Invalid(f"has a 'default' that {error}") from None
+        parsed['has_default'] = True
+    return parsed
+
+
+def parse_definitions(query_parameters):
+    """Validate the ``query_parameters`` of a query about to be saved; raises ApiError(400) listing every problem."""
+    if not isinstance(query_parameters, dict):
+        raise ApiError('query_parameters must be a JSON object')
+    errors = {}
+    for name, spec in query_parameters.items():
+        if not _NAME_RE.match(name):
+            errors[name] = 'is not a valid parameter name (letters, digits and underscores; not starting with a digit)'
+            continue
+        try:
+            _parse_strict(spec)
+        except _Invalid as error:
+            errors[name] = str(error)
+    if errors:
+        raise ApiError('Invalid query_parameters: ' + '; '.join(f'{n} {m}' for n, m in errors.items()), 400,
+                       errors=errors)
+
+
+def read_definition(spec):
+    """A definition as the normalised rule dict; anything unusable degrades to an untyped, required parameter."""
+    try:
+        return _parse_strict(spec)
+    except _Invalid:
+        if isinstance(spec, str):
+            return _plain({'type': _TYPES.get(spec.lower())})
+        return _plain({})
+
+
+def read_definitions(query_parameters):
+    if not isinstance(query_parameters, dict):
+        return {}
+    return {name: read_definition(spec) for name, spec in query_parameters.items()}
+
+
+# --------------------------------------------------------------------------------------
+# Values
+# --------------------------------------------------------------------------------------
+
+def resolve(declared, supplied, used=None):
+    """Apply a saved query's parameter definitions to the values a request supplied.
+
+    Returns every value to bind: supplied ones converted and checked, defaults filled in, optional ones without
+    a value set to None. Values for undeclared parameters pass through untouched. Declared parameters that the
+    SQL does not use (``used`` is the set of names it does use) are not enforced. Raises ApiError(400) listing
+    every violation.
+    """
+    values = dict(supplied)
+    errors = {}
+    for name, spec in read_definitions(declared).items():
+        if used is not None and name not in used:
+            continue
+        if name not in values:
+            if spec['has_default']:
+                values[name] = spec['default']
+            elif spec['required']:
+                errors[name] = 'is required'
+            else:
+                values[name] = None
+            continue
+        if values[name] is None:
+            if spec['required']:
+                errors[name] = 'must not be null'
+            continue
+        try:
+            values[name] = _check(spec, values[name])
+        except _Invalid as error:
+            errors[name] = str(error)
+    if errors:
+        raise ApiError('Invalid parameters: ' + '; '.join(f'{n} {m}' for n, m in errors.items()), 400,
+                       errors=errors)
+    return values
+
+
+def json_schema(spec):
+    """The OpenAPI/JSON-schema description of a parameter's type and rules."""
+    schema = {'type': spec['type'] or 'string'}
+    for rule, key in (('enum', 'enum'), ('min', 'minimum'), ('max', 'maximum'), ('min_length', 'minLength'),
+                      ('max_length', 'maxLength'), ('pattern', 'pattern')):
+        if spec[rule] is not None:
+            schema[key] = spec[rule]
+    if spec['has_default']:
+        schema['default'] = spec['default']
+    return schema

sql2api/ratelimit.py

@@ -0,0 +1,56 @@
+"""A small in-memory token-bucket rate limiter, off unless SQL2API_RATE_LIMIT is set (e.g. ``60/minute``).
+
+Each client (by IP address) has a bucket holding up to the full quota, refilled continuously, so short bursts are
+allowed but the sustained rate is capped. State lives in this process: with several worker processes each has its
+own buckets, so the effective limit is multiplied by the number of workers.
+"""
+import math
+import threading
+import time
+from collections import OrderedDict
+
+
+class RateLimiter:
+    MAX_CLIENTS = 100_000  # bounds memory; the least recently seen clients are forgotten first
+
+    def __init__(self, clock=time.monotonic):
+        self._clock = clock
+        self._lock = threading.Lock()
+        self._buckets = OrderedDict()  # client -> [tokens, last_seen]; least recently seen first
+        self._spec = None
+        self._last_sweep = clock()
+
+    def hit(self, client, count, period):
+        """Record a request. Returns (allowed, remaining, retry_after_seconds)."""
+        now = self._clock()
+        with self._lock:
+            if self._spec != (count, period):  # limit changed: start again rather than mix old and new rules
+                self._buckets.clear()
+                self._spec = (count, period)
+            self._sweep(now, period)
+            tokens, seen = self._buckets.pop(client, (float(count), now))
+            tokens = min(float(count), tokens + (now - seen) * count / period)
+            allowed = tokens >= 1
+            if allowed:
+                tokens -= 1
+            self._buckets[client] = (tokens, now)  # re-inserted last: most recently seen
+            if len(self._buckets) > self.MAX_CLIENTS:
+                self._buckets.popitem(last=False)
+            # round first: 20.000000000000004 seconds must not become a 21 second wait
+            retry_after = 0 if allowed else max(1, math.ceil(round((1 - tokens) * period / count, 6)))
+            return allowed, int(tokens), retry_after
+
+    def _sweep(self, now, period):
+        """Forget clients idle for a full period: their bucket has refilled, so they look brand new anyway."""
+        if now - self._last_sweep < period:
+            return
+        self._last_sweep = now
+        while self._buckets:
+            client, (_, seen) = next(iter(self._buckets.items()))
+            if now - seen < period:
+                break
+            del self._buckets[client]
+
+    def size(self):
+        with self._lock:
+            return len(self._buckets)

sql2api/sqltools.py

@@ -51,37 +51,6 @@ def paginate(sql, limit, offset):
 # Parameters
 # --------------------------------------------------------------------------------------
 
-def _to_bool(text):
-    lowered = text.strip().lower()
-    if lowered in ('true', '1', 'yes'):
-        return True
-    if lowered in ('false', '0', 'no'):
-        return False
-    raise ValueError(text)
-
-
-_COERCERS = {'int': int, 'integer': int, 'float': float, 'number': float, 'str': str, 'string': str,
-             'bool': _to_bool, 'boolean': _to_bool}
-
-
-def coerce_params(declared, params):
-    """Convert string values (e.g. from a query string) to the types a saved query declares.
-
-    ``declared`` is the saved version's ``query_parameters``: ``{"actor_id": "int"}`` or
-    ``{"actor_id": {"type": "int"}}``. Undeclared parameters are left untouched.
-    """
-    result = dict(params)
-    for name, spec in (declared or {}).items():
-        type_name = spec.get('type') if isinstance(spec, dict) else spec
-        coerce = _COERCERS.get(str(type_name).lower())
-        if coerce and isinstance(result.get(name), str):
-            try:
-                result[name] = coerce(result[name])
-            except ValueError:
-                raise ApiError(f"Parameter '{name}' must be of type {type_name}") from None
-    return result
-
-
 def _check_value(name, value):
     if value is None or isinstance(value, (bool, str)):
         return
@@ -125,6 +94,11 @@ def named_parameters(sql):
     return [m.group('name') for m in _PARAM_RE.finditer(sql) if m.group('name')]
 
 
+def placeholder_names(sql):
+    """Every parameter name ``sql`` uses - bound ``:name`` first, then ``{name}`` text placeholders - once each."""
+    return list(dict.fromkeys(named_parameters(sql) + _BRACE_RE.findall(sql)))
+
+
 _MARKERS = {'qmark': lambda name: '?', 'format': lambda name: '%s', 'pyformat': lambda name: f'%({name})s'}
 
 

sql2api/store.py

@@ -226,6 +226,24 @@ def record_execution(path, version, entry):
         pass
 
 
+def latest_versions():
+    """(name, version number, data) for the newest version of every saved query; unreadable files are skipped."""
+    saved_dir = str(config.saved_sql_dir())
+    if not os.path.isdir(saved_dir):
+        return []
+    found = []
+    for filename in sorted(os.listdir(saved_dir)):
+        path = os.path.join(saved_dir, filename)
+        if not (filename.endswith('.json') and os.path.isfile(path)):
+            continue
+        try:
+            number, data = select_version(load_versions(path))
+        except ApiError:
+            continue
+        found.append((filename[:-5], number, data))
+    return found
+
+
 def list_saved():
     """Return every saved query with its versions' metadata (SQL text is not included)."""
     saved_dir = str(config.saved_sql_dir())

{sql2api-0.2.0.dist-info → sql2api-0.3.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sql2api
-Version: 0.2.0
+Version: 0.3.0
 Summary: Turn SQL into a REST API: run queries against MySQL, PostgreSQL, ClickHouse, SQLite or H2 over HTTP and get JSON, CSV, XML, YAML or XLSX back.
 Author-email: Anantha Raju C <arcswdev@gmail.com>
 License: MIT
@@ -37,6 +37,7 @@ Requires-Dist: gunicorn>=21; extra == "server"
 Provides-Extra: dev
 Requires-Dist: sql2api[all]; extra == "dev"
 Requires-Dist: ruff>=0.5; extra == "dev"
+Requires-Dist: openapi-spec-validator>=0.7; extra == "dev"
 Dynamic: license-file
 
 # SQL2API
@@ -74,6 +75,10 @@ film_id,title,rating,length
   (or `?version=1`). Each run is recorded in the query's execution history.
 - **Bound parameters** - write `WHERE id = :id` and the value is sent to the database separately from the SQL, so it
   cannot inject anything. Declare types (`{"id": "int"}`) and query-string values are converted for you.
+- **Parameter rules** - saved queries can declare defaults, optional parameters, allowed values, numeric ranges and
+  text patterns. Bad input is rejected with a field-by-field `400` before it reaches the database.
+- **A live catalogue of your endpoints** - `/docs` lists every saved query as its own endpoint with its parameters and
+  rules. The SQL itself is never shown, and with an API key set the list is hidden from anonymous readers.
 - **Pagination** - `?page=2&page_size=50`, with `X-Has-More` telling you whether another page exists.
 - **Connection pooling** - MySQL, PostgreSQL, ClickHouse and H2 connections are reused between requests instead of
   opened for each one (about 30x lower per-request overhead on MySQL and H2 against a local server; more over a network).
@@ -120,14 +125,19 @@ every supported database) and `saved_sql/`. Edit the file, set `"active": true`,
 curl -X PATCH http://127.0.0.1:5000/save_sql_to_file -H 'Content-Type: application/json' -d '{
   "filename": "actor_by_id",
   "sql_query": "SELECT * FROM actor WHERE actor_id = :id",
-  "query_parameters": {"id": "int"},
+  "query_parameters": {"id": {"type": "int", "min": 1, "max": 200, "description": "Actor id"}},
   "connection_name": "sakila-sqlite",
   "author": "me", "description": "Look up an actor"
 }'
 
 curl 'http://127.0.0.1:5000/q/actor_by_id?id=7&format=yaml'
+curl 'http://127.0.0.1:5000/q/actor_by_id?id=0'
+# {"error": "Invalid parameters: id must be at least 1", "errors": {"id": "must be at least 1"}}
 ~~~
 
+Rules: `type` (`int`, `float`, `str`, `bool`), `default`, `required`, `enum`, `min`/`max`, `min_length`/`max_length`,
+`pattern` and `description` - see [the API reference](documentation/API.md#parameter-rules).
+
 Saving again under the same name adds version 2; `DELETE /saved_sql/actor_by_id?version=1` removes one version.
 
 ## Configuration
@@ -140,6 +150,9 @@ Everything is configured through environment variables (all optional):
 | `SQL2API_ALLOW_WRITES` | off | Allow `INSERT`/`UPDATE`/DDL. Otherwise only single read-only statements are accepted. |
 | `SQL2API_API_KEY` | unset | When set, every request (except `/health` and `/docs`) needs a matching `X-API-Key` header. |
 | `SQL2API_MAX_PAGE_SIZE` | `1000` | Upper limit for `page_size`. |
+| `SQL2API_CORS_ORIGINS` | unset | Websites allowed to call the API from a browser: comma-separated origins such as `https://app.example.com`, or `*`. Off by default. |
+| `SQL2API_RATE_LIMIT` | unset | Requests allowed per client address, e.g. `60/minute` (also `second`, `hour`, `day`). Off by default; a malformed value stops startup. |
+| `SQL2API_TRUST_PROXY` | `0` | Number of reverse proxies in front of the app whose `X-Forwarded-*` headers are trusted. Set it (usually `1`) behind nginx, a load balancer or a platform router, or every client looks like the proxy. |
 | `SQL2API_POOL_SIZE` | `5` | Idle connections kept per distinct connection setting. `0` turns pooling off. |
 | `SQL2API_POOL_IDLE_TIMEOUT` | `300` | Seconds an idle pooled connection is kept before it is closed. |
 | `SQL2API_QUERY_TIMEOUT` | `30` | Seconds a query may run before it is cancelled (HTTP 504). `0` disables the limit. A request can lower it with `?timeout=`, never raise it. |
@@ -160,15 +173,59 @@ SQL2API runs whatever SQL it is given against your databases, so it ships locked
 
 See [SECURITY.md](SECURITY.md) to report a vulnerability.
 
+### Calling the API from a browser
+
+Browsers refuse cross-origin JSON calls unless the server allows them. List the sites that may call the API:
+
+~~~bash
+SQL2API_API_KEY=change-me SQL2API_CORS_ORIGINS=https://app.example.com sql2api serve
+~~~
+
+Preflight checks are answered automatically, and the pagination headers (`X-Has-More` etc.) are exposed to the page's
+JavaScript. CORS only tells the *browser* which sites may call; it is not authentication, so keep the API key. Avoid
+`*` without a key: any website a visitor opens could then reach your databases through their browser (the server logs
+a warning if you start that way).
+
+### Rate limiting
+
+`SQL2API_RATE_LIMIT=60/minute` gives each client address a bucket of 60 requests that refills steadily, so short bursts
+work but the sustained rate is capped. Over the limit, requests get `429` with a `Retry-After` header, and every
+response carries `X-RateLimit-Limit` and `X-RateLimit-Remaining`. The limit is applied before the API key check, so
+guessing keys is throttled too; `/health` and CORS preflights are never counted. State is per process: with several
+workers, the effective limit is multiplied by the number of workers.
+
 ## Docker
 
+Every release is published to GitHub Container Registry for `linux/amd64` and `linux/arm64`:
+
+~~~bash
+docker run -p 5000:5000 -v "$PWD/data:/data" -e SQL2API_API_KEY=change-me ghcr.io/anantharajuc/sql2api:latest
+~~~
+
+| Tag | Contents |
+|-----|----------|
+| `X.Y.Z`, `latest` | SQL2API with the MySQL, PostgreSQL and ClickHouse drivers (SQLite is built in) |
+| `X.Y.Z-h2`, `latest-h2` | The same plus Java and the H2 driver |
+
+The container keeps `db_connections.json` and `saved_sql/` in `/data` (create a starter with
+`docker run --rm -v "$PWD/data:/data" ghcr.io/anantharajuc/sql2api sql2api init`). It runs as a non-root user under
+gunicorn with one worker (the files are protected by an in-process lock) and a health check on `/health`. Behind a
+reverse proxy or load balancer, set `SQL2API_TRUST_PROXY=1`. To build it yourself:
+`docker build -t sql2api .` (add `--build-arg WITH_H2=true` for H2).
+
+### Try it with one command
+
+[`docker-compose.yml`](docker-compose.yml) starts SQL2API in front of a PostgreSQL database seeded with sample films:
+
 ~~~bash
-docker build -t sql2api .                          # add --build-arg WITH_H2=true for H2 support
-docker run -p 5000:5000 -v "$PWD/data:/data" -e SQL2API_API_KEY=change-me sql2api
+docker compose up --build
+curl -H 'X-API-Key: demo-key' 'http://127.0.0.1:5000/q/films_by_rating?rating=PG&max_length=90'
 ~~~
 
-The container keeps `db_connections.json` and `saved_sql/` in `/data`. It runs gunicorn with a single worker
-(the files are protected by an in-process lock).
+Open <http://127.0.0.1:5000/docs>, paste `demo-key` into the box at the top, and both saved queries appear as endpoints.
+The demo listens on localhost only, mounts its configuration read-only, and reads the database password from an
+environment variable (`${DEMO_DB_PASSWORD}` in [`demo/data/db_connections.json`](demo/data/db_connections.json)).
+Clean up with `docker compose down -v`.
 
 ## API overview
 

sql2api-0.3.0.dist-info/RECORD

@@ -0,0 +1,23 @@
+sql2api/__init__.py,sha256=E0GamNI-uTZw-GcL8le7gE0DrJApGpI-v_wlIekgyN4,185
+sql2api/__main__.py,sha256=k1ocEWawweo1qCJWNFAAvyxz3tcY13dzvCenHszij30,48
+sql2api/app.py,sha256=9WGV13ZSL0LydQ-vLitm1t9wvgDSAePfVQP6y37wK74,16342
+sql2api/cli.py,sha256=-5wb3UHl1N2gFNY4ypyhOPasZQQgacf2P7XRmw3eWNo,2885
+sql2api/config.py,sha256=5Oi3GDxv0xWjVymvfAMcJ4Na4biulwpZbpPoN_i5_sE,5708
+sql2api/cors.py,sha256=lEZSZk7sQCRaKqPd6oGmbXamFGtstDVKxAO5IKO84KU,2101
+sql2api/engine.py,sha256=hys-ArxL4n3WWIsrk8hcERaLB11io_f5Wpr5x9zVBr4,1691
+sql2api/errors.py,sha256=nJddO1gAjxQZH7-IXf3Bt8ruxv3EhVw6t6viFKfluG4,264
+sql2api/formats.py,sha256=SbLDZ-yQIt7pcWXYi8WNYEmG6JNqoeeGeRwIg5XHmos,4817
+sql2api/openapi.py,sha256=iK2l4kZD-3Q9jteRyHq76Y0LnUVXLljfycNzzgqk624,13591
+sql2api/params.py,sha256=y_muqwY7ZIhBfUjTpAyw1MpvCyVCmXRrIAUYN9pmB0c,11775
+sql2api/pool.py,sha256=hIxkaVkDnjQEV_4f62yq_HtZkCEHiq_qR_fUGyHGhiA,5170
+sql2api/ratelimit.py,sha256=Cc5J8_RIpnBXmyJ5QiGinjyc47kLdOx-PN43FUBQdm8,2483
+sql2api/runners.py,sha256=ANYrGluet1HOV_Fi1IvJFZMEj1CFtjKEbQzuksqLi0g,13782
+sql2api/sqltools.py,sha256=1C1P-U-rMGHbm0mP6zZ9SkxrnGCfQgXv2aCzLgQi0Vc,5742
+sql2api/store.py,sha256=nHbt1wok8PwAHLetmZeIZeYyCfCp0NXsXNo4hErgTiE,10525
+sql2api/lib/h2-2.2.224.jar,sha256=udjxk1itqCpPbrWxdMbP4yCjdbWpy1pP5FbWI-blVJc,2614933
+sql2api-0.3.0.dist-info/licenses/LICENSE,sha256=ufgSbLEx8zM6J0kFgDoK-6NNb0gqrsFfCb-CnNbZGg0,1071
+sql2api-0.3.0.dist-info/METADATA,sha256=f_VRSImaSTefFnQU6YeVbVbQ240eijsdBbVGbMolxc8,14139
+sql2api-0.3.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+sql2api-0.3.0.dist-info/entry_points.txt,sha256=63gZjCA84qTkErE2iiuTiGS7GtdamvOqi2elEXwy_zE,45
+sql2api-0.3.0.dist-info/top_level.txt,sha256=dicWZ6j0AE1xBDKr0-qh2CkuP7Yc1CWQf_T6r8LS6ms,8
+sql2api-0.3.0.dist-info/RECORD,,

sql2api-0.2.0.dist-info/RECORD

@@ -1,20 +0,0 @@
-sql2api/__init__.py,sha256=aVq6e6s7KZt7JlbdHpxY4q_3dOZSuzf8wFrLLggZyQc,185
-sql2api/__main__.py,sha256=k1ocEWawweo1qCJWNFAAvyxz3tcY13dzvCenHszij30,48
-sql2api/app.py,sha256=AcYUNu31OJ_aW9_kbXtuYJDAJH5UW3paNuv52UgMWOs,12335
-sql2api/cli.py,sha256=1L3RYiCgnh1w_speXB4RPqxNWs5kR7kT68X9L-aqDLk,2712
-sql2api/config.py,sha256=ACMeLisww_6WmzdbIysmZjBui6QxQLWh1evv8z1l9aw,3663
-sql2api/engine.py,sha256=hys-ArxL4n3WWIsrk8hcERaLB11io_f5Wpr5x9zVBr4,1691
-sql2api/errors.py,sha256=nJddO1gAjxQZH7-IXf3Bt8ruxv3EhVw6t6viFKfluG4,264
-sql2api/formats.py,sha256=SbLDZ-yQIt7pcWXYi8WNYEmG6JNqoeeGeRwIg5XHmos,4817
-sql2api/openapi.py,sha256=O7iRvEic1L2OXAp-P3N1FXpPdpTM1w0rAEShWEcpjfk,8905
-sql2api/pool.py,sha256=hIxkaVkDnjQEV_4f62yq_HtZkCEHiq_qR_fUGyHGhiA,5170
-sql2api/runners.py,sha256=ANYrGluet1HOV_Fi1IvJFZMEj1CFtjKEbQzuksqLi0g,13782
-sql2api/sqltools.py,sha256=HPNC2hCSkBqiJ8O-WYWj7gwILnNOtyVD5A_58SG3lik,6657
-sql2api/store.py,sha256=OHLE1PU7ZrqQcPJec4jJbqNeFBDSt7TOUO8NfH7QLJg,9890
-sql2api/lib/h2-2.2.224.jar,sha256=udjxk1itqCpPbrWxdMbP4yCjdbWpy1pP5FbWI-blVJc,2614933
-sql2api-0.2.0.dist-info/licenses/LICENSE,sha256=ufgSbLEx8zM6J0kFgDoK-6NNb0gqrsFfCb-CnNbZGg0,1071
-sql2api-0.2.0.dist-info/METADATA,sha256=YgkgbcA2O-BWhcS77nr8YzltW3YB8PO9NftPfBoEQmU,10241
-sql2api-0.2.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-sql2api-0.2.0.dist-info/entry_points.txt,sha256=63gZjCA84qTkErE2iiuTiGS7GtdamvOqi2elEXwy_zE,45
-sql2api-0.2.0.dist-info/top_level.txt,sha256=dicWZ6j0AE1xBDKr0-qh2CkuP7Yc1CWQf_T6r8LS6ms,8
-sql2api-0.2.0.dist-info/RECORD,,