sqlguard-ninja 0.6.0__tar.gz → 0.7.0__tar.gz

{sqlguard_ninja-0.6.0 → sqlguard_ninja-0.7.0}/.gitignore

@@ -28,3 +28,7 @@ htmlcov/
 !.env.example
 audit*.jsonl
 .pytest_tmp/
+
+# Static demo build output and download cache
+/.cache/
+/site/

{sqlguard_ninja-0.6.0 → sqlguard_ninja-0.7.0}/CHANGELOG.md

@@ -3,6 +3,39 @@
 All notable changes are documented here. The project follows
 [Semantic Versioning](https://semver.org/); before 1.0, minor versions may change the API.
 
+## [0.7.0] — 2026-10-24
+
+### Added
+* **Interactive playground** (`sqlguard_ninja.demo`, extra `[demo]`, `sqlninja demo serve`).
+  It runs on a synthetic retail database with three enforceable roles: Sales Analyst,
+  Customer Support and Store Manager. Features:
+  * an SQL editor and 20 example queries; tests check each one's expected decision
+  * plain-language explanations with how-to-fix hints
+  * lineage (output → base column, column usage with access per role)
+  * tenant-isolation demonstrations and a role-permission browser
+  * a benchmark dashboard that separates the 1,070 internal evaluations from the 0
+    independent ones
+* **Restricted sandbox** for allowed demo queries. The database enforces it: an authorizer
+  allowlist, `query_only`, engine limits, a step/time budget and a row cap.
+* **Static build** (`scripts/build_static_demo.py`). The same service runs in the browser with
+  Pyodide. Everything is self-hosted and checksum-verified, and the site makes no third-party
+  requests.
+* **Deployment references:**
+  * a hardened `Dockerfile`: non-root, digest-pinned base, healthcheck
+  * a Compose file: read-only, no capabilities, resource limits
+  * Kubernetes manifests: restricted security context, probes, NetworkPolicy without
+    egress, PDB, example Ingress
+  * a manual GitHub Pages workflow
+* **Server hardening:**
+  * validated `SQLNINJA_DEMO_*` settings
+  * per-client rate limiting, a body cap and 411 on chunked bodies
+  * strict CSP and security headers
+  * `/healthz` and `/readyz`
+* **Browser end-to-end tests** (Playwright) in server mode and against the offline static
+  build, including axe-core accessibility checks, keyboard use, small screens and XSS-safe
+  rendering. New CI jobs cover these tests and the container and manifests.
+* ADR-014, threat model T20, `docs/guides/DEPLOYMENT.md`.
+
 ## [0.6.0] — 2026-10-24
 
 ### Added

{sqlguard_ninja-0.6.0 → sqlguard_ninja-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sqlguard-ninja
-Version: 0.6.0
+Version: 0.7.0
 Summary: Security testing, policy enforcement, agent integration, privacy analysis and CI benchmarking for LLM-generated SQL.
 Project-URL: Homepage, https://github.com/Pratik653/SQLGuard_Ninjapy
 Project-URL: Documentation, https://github.com/Pratik653/SQLGuard_Ninjapy/tree/main/docs
@@ -34,6 +34,10 @@ Requires-Dist: opentelemetry-api>=1.25; extra == 'all'
 Requires-Dist: prometheus-client>=0.20; extra == 'all'
 Requires-Dist: psycopg[binary]>=3.1; extra == 'all'
 Requires-Dist: pymysql>=1.1; extra == 'all'
+Requires-Dist: uvicorn>=0.30; extra == 'all'
+Provides-Extra: demo
+Requires-Dist: fastapi>=0.110; extra == 'demo'
+Requires-Dist: uvicorn>=0.30; extra == 'demo'
 Provides-Extra: dev
 Requires-Dist: build>=1.2; extra == 'dev'
 Requires-Dist: fastapi>=0.110; extra == 'dev'
@@ -53,6 +57,7 @@ Requires-Dist: pytest-cov>=5.0; extra == 'dev'
 Requires-Dist: pytest>=8.0; extra == 'dev'
 Requires-Dist: ruff>=0.6; extra == 'dev'
 Requires-Dist: types-pyyaml; extra == 'dev'
+Requires-Dist: uvicorn>=0.30; extra == 'dev'
 Provides-Extra: fastapi
 Requires-Dist: fastapi>=0.110; extra == 'fastapi'
 Provides-Extra: langchain
@@ -300,6 +305,26 @@ The four tools are `validate_sql`, `explain_policy_decision`, `inspect_query_cos
 to a database, and it exposes no execution tool. Tested with the official MCP Python SDK
 client over stdio. See [MCP_INTEGRATION.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/MCP_INTEGRATION.md).
 
+## Interactive playground
+
+A web app on a synthetic retail database. It has:
+
+* three enforceable roles (Sales Analyst, Customer Support, Store Manager)
+* example queries, with explanations and how-to-fix hints
+* lineage, tenant-isolation demonstrations and role permissions
+* a benchmark dashboard that separates internal from independent results
+
+```bash
+python -m pip install "sqlguard-ninja[demo]"
+sqlninja demo serve          # http://127.0.0.1:8000
+```
+
+Allowed queries run in a restricted in-memory sandbox. The database itself enforces this
+with an authorizer allowlist, engine limits and a time budget. A static build
+(`scripts/build_static_demo.py`) runs the whole thing in the browser with Pyodide, with no
+server. See [DEPLOYMENT.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/DEPLOYMENT.md)
+for Docker, Compose and Kubernetes.
+
 ## Observability and SARIF
 
 ```bash
@@ -396,7 +421,7 @@ the [benchmark bias review](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/m
 ## Roadmap
 
 Next: restricted-function and system-catalog benchmark cases (issue #5), an independent
-held-out corpus (issue #6), an interactive demo and a hardened deployment reference. Later:
+held-out corpus (issue #6) and public hosting of the playground. Later:
 governed writes, and database-verified SQL Server and Oracle support. Details in [ROADMAP.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/ROADMAP.md).
 
 ## Links
@@ -415,6 +440,7 @@ governed writes, and database-verified SQL Server and Oracle support. Details in
 * [Agent integration](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/AGENT_INTEGRATION.md)
 * [Query cost](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/QUERY_COST.md)
 * [CI integration](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/CI_INTEGRATION.md)
+* [Playground and deployment](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/DEPLOYMENT.md)
 * [Observability and SARIF](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/OBSERVABILITY.md)
 * [Database compatibility](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/DATABASE_COMPATIBILITY.md)
 * [Benchmark methodology](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/BENCHMARK_METHODOLOGY.md)

{sqlguard_ninja-0.6.0 → sqlguard_ninja-0.7.0}/README.md

@@ -226,6 +226,26 @@ The four tools are `validate_sql`, `explain_policy_decision`, `inspect_query_cos
 to a database, and it exposes no execution tool. Tested with the official MCP Python SDK
 client over stdio. See [MCP_INTEGRATION.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/MCP_INTEGRATION.md).
 
+## Interactive playground
+
+A web app on a synthetic retail database. It has:
+
+* three enforceable roles (Sales Analyst, Customer Support, Store Manager)
+* example queries, with explanations and how-to-fix hints
+* lineage, tenant-isolation demonstrations and role permissions
+* a benchmark dashboard that separates internal from independent results
+
+```bash
+python -m pip install "sqlguard-ninja[demo]"
+sqlninja demo serve          # http://127.0.0.1:8000
+```
+
+Allowed queries run in a restricted in-memory sandbox. The database itself enforces this
+with an authorizer allowlist, engine limits and a time budget. A static build
+(`scripts/build_static_demo.py`) runs the whole thing in the browser with Pyodide, with no
+server. See [DEPLOYMENT.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/DEPLOYMENT.md)
+for Docker, Compose and Kubernetes.
+
 ## Observability and SARIF
 
 ```bash
@@ -322,7 +342,7 @@ the [benchmark bias review](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/m
 ## Roadmap
 
 Next: restricted-function and system-catalog benchmark cases (issue #5), an independent
-held-out corpus (issue #6), an interactive demo and a hardened deployment reference. Later:
+held-out corpus (issue #6) and public hosting of the playground. Later:
 governed writes, and database-verified SQL Server and Oracle support. Details in [ROADMAP.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/ROADMAP.md).
 
 ## Links
@@ -341,6 +361,7 @@ governed writes, and database-verified SQL Server and Oracle support. Details in
 * [Agent integration](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/AGENT_INTEGRATION.md)
 * [Query cost](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/QUERY_COST.md)
 * [CI integration](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/CI_INTEGRATION.md)
+* [Playground and deployment](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/DEPLOYMENT.md)
 * [Observability and SARIF](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/OBSERVABILITY.md)
 * [Database compatibility](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/DATABASE_COMPATIBILITY.md)
 * [Benchmark methodology](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/BENCHMARK_METHODOLOGY.md)

{sqlguard_ninja-0.6.0 → sqlguard_ninja-0.7.0}/THIRD_PARTY_NOTICES.md

@@ -26,6 +26,7 @@ manager under their own licences. Licences were read from installed package meta
 | `mysql` | PyMySQL | 1.2.3 | MIT |
 | `otel` | opentelemetry-api | 1.45.1 | Apache-2.0 |
 | `prometheus` | prometheus-client | 0.26.0 | Apache-2.0 AND BSD-2-Clause |
+| `demo` | fastapi / uvicorn | 0.162.0 / 0.54.0 | MIT / BSD-3-Clause |
 
 psycopg is LGPL-3.0. SQLGuard Ninja only imports it at runtime when the `postgres` extra is
 installed. It is not modified or bundled, which is compatible with distributing SQLGuard Ninja
@@ -38,7 +39,13 @@ mypy (MIT), build (MIT). `pgserver` is optionally used for local PostgreSQL test
 declared dependency, and its package metadata on PyPI does not declare a licence. It bundles
 PostgreSQL binaries (PostgreSQL License).
 
-Tests also use jsonschema (MIT) and opentelemetry-sdk (Apache-2.0).
+Tests also use jsonschema (MIT), opentelemetry-sdk (Apache-2.0), Playwright and
+pytest-playwright (Apache-2.0), and axe-core 4.10.3 (MPL-2.0), which is downloaded at test time.
+
+The **static playground build** (`scripts/build_static_demo.py`, not part of the package)
+bundles Pyodide 0.29.5 (MPL-2.0, including CPython under the PSF License and SQLite, which is
+public domain), sqlglot (MIT), and pydantic, PyYAML and their dependencies as packaged by
+Pyodide. Their licences are listed in the generated `NOTICE.txt`.
 
 ## Test fixture: SARIF 2.1.0 JSON schema
 

{sqlguard_ninja-0.6.0 → sqlguard_ninja-0.7.0}/docs/architecture/ARCHITECTURE_DECISIONS.md

@@ -166,3 +166,16 @@ MySQL with server defaults, so the executor refuses sessions whose `sql_mode` co
 **Consequences.** This refines ADR-005: the executed string differs from the validated one only
 in placeholder nodes, which carry server-side values, never user input. Literals and identifiers
 are not rewritten. MySQL support is limited to the scope the CI service-container tests cover.
+
+## ADR-014 — Playground: one service, static-first hosting, database-enforced sandbox
+
+**Decision.** One Python `DemoService` backs both a FastAPI server and a static build in which
+Pyodide runs the same code in the visitor's browser. Allowed queries run only in an in-memory
+synthetic SQLite database. That database enforces read-only access itself: an authorizer
+allowlist, `query_only`, engine limits and a step/time budget. The public deployment is the
+static build on GitHub Pages: there is no server to abuse, no credentials, and no cost. The
+static build self-hosts Pyodide and the wheels and verifies their checksums.
+
+**Consequences.** The first static load downloads about 16 MB. The server mode stays available
+for private use behind a proxy (Docker/Compose/Kubernetes references). In-process rate limits
+are per replica.

{sqlguard_ninja-0.6.0 → sqlguard_ninja-0.7.0}/docs/development/IMPLEMENTATION_PROGRESS.md

@@ -11,4 +11,6 @@
 | 2d Docs, ADR-011/012, v0.3.0 bump | RELEASED v0.3.0 | 198a308 | full gate 1,804 passed, 94% | |
 | 3 MCP server (stdio, validation-only) | RELEASED v0.4.0 | ecec4da | 9 tests incl. real SDK client; published-package stdio smoke test | version targets adapted |
 | 4 MySQL tested dialect; SQL Server/Oracle experimental; compatibility matrix | RELEASED v0.5.0 | de4d03f | full gate 1,881 passed, 94%; CI MySQL 8.4: 15 passed, 0 skipped | sql_mode parser differential found and closed (T18) |
-| 5 Observability: OTel spans, Prometheus metrics, audit schema, SARIF scan, Grafana + synthetic stack | VERIFIED (local, CI pending) | see PR | full gate 1,916 passed, 94% | redaction leak (hex/E''/$$/U&/N''/INTERVAL) found and fixed (T19) |
+| 5 Observability: OTel spans, Prometheus metrics, audit schema, SARIF scan, Grafana + synthetic stack | RELEASED v0.6.0 | 3867989 | full gate 1,916 passed, 94%; CI stack: 224 decisions scraped, Grafana query success | redaction leak (hex/E''/$$/U&/N''/INTERVAL) found and fixed (T19) |
+| 6 Playground: 3 roles, examples, explanations, lineage, tenant demo, permissions, benchmark dashboard; static Pyodide build | VERIFIED (local, CI pending) | see PR | 1,959 passed, 94%; 14 browser tests incl. axe + offline static | database-enforced sandbox |
+| 7 Deployment: Dockerfile, Compose, Kubernetes, health, config validation, rate/body limits | VERIFIED (local tests; container in CI pending) | see PR | manifest and hardening tests | no Docker locally |

sqlguard_ninja-0.7.0/docs/development/NEXT_ACTIONS.md

@@ -0,0 +1,5 @@
+# Next actions (development program)
+
+1. SQL Server/Oracle real-database tests need vendor licence acceptance (maintainer decision); MySQL function/catalog cases stay under #5.
+2. Merge the v0.7.0 PR after CI (demo e2e + container jobs); add both jobs to required checks; release; verify PyPI + fresh `[demo]` install and `sqlninja demo serve`.
+3. Phase 8: public hosting needs maintainer authorization: enable GitHub Pages (Source: GitHub Actions), then run `pages.yml` and verify the real HTTPS URL in an unauthenticated browser.

{sqlguard_ninja-0.6.0 → sqlguard_ninja-0.7.0}/docs/development/TEST_EVIDENCE.md

@@ -19,3 +19,6 @@
 | 2026-10-24 | v0.5.0 release | PR #22 13/13 (MySQL job: 15 passed, 0 skipped); MySQL job added to required checks; main CI 40119298660 on de4d03f success; release.yml 40119480081 success | wheel and sdist on PyPI, both provenance endpoints 200; 0.1.0-0.4.0 unchanged |
 | 2026-10-24 | v0.5.0 fresh install | `pip install --no-cache-dir "sqlguard-ninja[mysql]==0.5.0"` (Python 3.13, outside repo, `-I`; 2nd attempt) | PyMySQL 1.2.3; dialects include mysql; bundled corpus 1.2.0, 26 MySQL cases 0 mismatches; binding and sql_mode refusals; `o.ID` and card column denied. No MySQL server locally, so execution is evidenced by CI only |
 | 2026-10-24 | v0.6.0 candidate (observability) | full gate (`ruff`, `mypy`, corpus `--check`, `pytest --cov -m "not mysql"`, build, `twine check --strict`) | 1,916 passed, 94%; twine PASSED; SARIF schema-valid; canary privacy tests over 13 literal forms |
+| 2026-10-24 | v0.6.0 release | PR #24 14/14 (observability job: SARIF valid, decisions=224, 9 panels, grafana_query=success; 2nd run after tmpfs noexec fix); job added to required checks; main CI 40127541718 success; release.yml 40127737479 success | wheel + sdist on PyPI, both provenance 200; 0.1.0-0.5.0 unchanged |
+| 2026-10-24 | v0.6.0 fresh install | `pip install --no-cache-dir "sqlguard-ninja[otel,prometheus]==0.6.0"` + opentelemetry-sdk, jsonschema (Python 3.13, outside repo, `-I`) | spans checkpoint+validate; decisions allow 2 / deny 1; canary in literal, hex, comment and context not leaked; redacted SQL correct; `scan` SARIF valid against OASIS schema fetched separately |
+| 2026-10-24 | v0.7.0 candidate (playground + deployment) | full gate + `pytest -m e2e` (Playwright Chromium; static site built with verified downloads; external requests blocked) | 1,959 passed, 94%; 14 e2e passed incl. axe serious/critical = 0, 360/768 px no overflow; build + twine PASSED |

{sqlguard_ninja-0.6.0 → sqlguard_ninja-0.7.0}/docs/development/progress.json

@@ -76,43 +76,50 @@
     {
       "id": 6,
       "name": "Observability and SARIF",
-      "status": "VERIFIED",
+      "status": "RELEASED",
       "release": "v0.6.0",
       "issues": [
         14
       ],
       "evidence": [
-        "OTel/Prometheus/SARIF/Grafana + canary privacy tests; 1,916 local tests; CI pending"
+        "OTel/Prometheus/SARIF/Grafana + canary privacy tests; 1,916 local tests; CI pending",
+        "v0.6.0 on PyPI with provenance; fresh [otel,prometheus] install verified"
       ],
       "blockers": []
     },
     {
       "id": 7,
       "name": "Web dashboard and playground",
-      "status": "NOT_STARTED",
-      "release": "v0.5.0",
+      "status": "VERIFIED",
+      "release": "v0.7.0",
       "issues": [],
-      "evidence": [],
+      "evidence": [
+        "FastAPI + static Pyodide playground; 14 Playwright tests incl. axe; CI pending"
+      ],
       "blockers": []
     },
     {
       "id": 8,
       "name": "Production deployment",
-      "status": "NOT_STARTED",
-      "release": "v0.5.0",
+      "status": "VERIFIED",
+      "release": "v0.7.0",
       "issues": [],
-      "evidence": [],
+      "evidence": [
+        "Dockerfile/Compose/Kubernetes with hardening tests; container CI pending"
+      ],
       "blockers": []
     },
     {
       "id": 9,
       "name": "Public zero-API-key demo",
-      "status": "NOT_STARTED",
+      "status": "BLOCKED",
       "release": "v0.5.0",
       "issues": [],
-      "evidence": [],
+      "evidence": [
+        "static build ready and tested offline; pages.yml manual workflow prepared"
+      ],
       "blockers": [
-        "public hosting needs maintainer account authorization"
+        "needs maintainer authorization to enable GitHub Pages"
       ]
     }
   ]

sqlguard_ninja-0.7.0/docs/guides/DEPLOYMENT.md

@@ -0,0 +1,122 @@
+# Playground and deployment
+
+The playground is a web app on a synthetic retail database. It has:
+
+* three roles: Sales Analyst, Customer Support and Store Manager
+* example queries and plain-language explanations
+* lineage, tenant isolation, role permissions and a benchmark dashboard
+
+It needs no login, API key or credentials.
+
+It runs in two modes from the same frontend and the same Python `DemoService`:
+
+| Mode | How | Where SQL is validated and run |
+|---|---|---|
+| **Static** (recommended for public hosting) | `python scripts/build_static_demo.py site/` | in the visitor's browser, through Pyodide in a Web Worker; no server |
+| **Server** | `pip install "sqlguard-ninja[demo]"` then `sqlninja demo serve` | FastAPI server, restricted in-memory sandbox |
+
+## Execution safety
+
+The demo does not rely on the parser alone, or on rolling back a transaction. Only queries
+the policy **allows** run, and they run against an in-memory SQLite database of synthetic
+data. That database enforces its own restrictions (`sqlguard_ninja/demo/sandbox.py`):
+
+* `PRAGMA query_only`.
+* An **authorizer** that allows only `SELECT`, reads of the catalog's tables and an allowlist
+  of side-effect-free functions. ATTACH, PRAGMA, writes, schema changes, `sqlite_master` and
+  `load_extension` are refused by the engine.
+* **Engine limits**: string length, SQL length, expression depth, compound selects, zero
+  attached databases, and few variables.
+* A **step and time budget** through the progress handler. Recursive CTEs and cartesian
+  products are interrupted.
+* A row cap of 100, plus value truncation.
+
+The database holds no real data. In the static build it exists only in the visitor's browser.
+Set `SQLNINJA_DEMO_EXECUTE=false` for a validation-only server.
+
+`tests/unit/test_demo.py` checks every one of these refusals.
+
+## Server settings
+
+Settings are read from the environment and validated at start-up. Unknown or invalid values
+stop the server.
+
+| Variable | Default | Meaning |
+|---|---|---|
+| `SQLNINJA_DEMO_EXECUTE` | `true` | run allowed queries in the sandbox |
+| `SQLNINJA_DEMO_RATE_LIMIT_PER_MINUTE` | `60` | per-client API requests per minute (per process) |
+| `SQLNINJA_DEMO_MAX_BODY_BYTES` | `16384` | request body cap; bodies without `Content-Length` are refused |
+| `SQLNINJA_DEMO_TRUST_PROXY_HEADERS` | `false` | take the client from `X-Forwarded-For`; enable only behind a proxy that overwrites it |
+| `SQLNINJA_DEMO_MAX_TRACKED_CLIENTS` | `10000` | memory bound for the rate limiter |
+
+The server also:
+
+* sends a strict CSP with no inline script, `frame-ancestors 'none'`, `nosniff`, and
+  `no-referrer`
+* disables the OpenAPI and docs pages
+* exposes `/healthz` (liveness) and `/readyz` (the sandbox answers)
+* rejects identity forgery: role and tenant come from fixed enums, and extra fields are
+  rejected with 422
+
+## Docker and Compose
+
+```bash
+docker build -t sqlguard-ninja-demo .
+docker compose -f deploy/compose/docker-compose.yml up -d --build --wait
+```
+
+The image is multi-stage, with the base pinned by digest. It runs as non-root (UID 10001) and
+has a `HEALTHCHECK`. The Compose file adds:
+
+* a read-only root filesystem with a small tmpfs
+* `cap_drop: ALL` and `no-new-privileges`
+* memory, CPU and PID limits
+* port binding to localhost only
+
+CI builds the image and runs it under those restrictions. It then checks that the user is
+UID 10001, that the probes pass, that the CSP header is present, and that one allowed and one
+denied API call behave correctly.
+
+## Kubernetes (example)
+
+`deploy/kubernetes/` (Kustomize) contains:
+
+* a Deployment:
+  * non-root with a RuntimeDefault seccomp profile
+  * read-only root filesystem with all capabilities dropped
+  * no service-account token
+  * resource limits
+  * startup, liveness and readiness probes
+* a Service and a PodDisruptionBudget
+* a NetworkPolicy that allows ingress only from the ingress controller and **no egress**
+* an example Ingress with edge rate limits
+
+CI validates these manifests against the Kubernetes schemas with `kubernetes-validate --strict`.
+Replace the image reference with the digest you built and scanned. The in-process rate
+limiter is per replica, so keep the edge limit.
+
+## Public hosting (decision)
+
+Hosting is recorded as ADR-014. Several free options were compared.
+
+**Static options:**
+
+* **GitHub Pages** is free for public repositories and serves over HTTPS. It is already
+  part of the project's GitHub account, with no new vendor, and the build is a single
+  workflow.
+* **Cloudflare Pages** and **Netlify** have free static tiers. Each would need a new
+  account and adds a vendor.
+
+**Server options:** Render, Fly.io and Koyeb have free or trial container tiers. They add an
+always-on attack surface, can sleep on idle, may change their terms, and some require a
+payment card.
+
+**Chosen: the static build on GitHub Pages.** Validation and execution happen in each
+visitor's browser, so there is no shared server to abuse and no database to protect. It runs
+at zero cost. The `_headers` file sets the CSP and related headers on hosts that support it.
+On GitHub Pages, a `<meta>` CSP applies instead.
+
+`.github/workflows/pages.yml` builds the site, tests that exact build in Chromium with every
+external request blocked, and deploys it. It runs **only when started manually**, after the
+maintainer enables Pages (Settings → Pages → Source: GitHub Actions). Do not describe the demo
+as live until an unauthenticated browser has loaded the real HTTPS URL and run a query.

sqlguard_ninja-0.7.0/docs/releases/v0.7.0.md

@@ -0,0 +1,22 @@
+# SQLGuard Ninja v0.7.0
+
+## Highlights
+
+* **Interactive playground.** Try SQL policy enforcement on a synthetic retail database with three roles: Sales Analyst, Customer Support and Store Manager. It has 20 example queries, explanations with fixes, lineage, tenant-isolation demonstrations, a role-permission browser, and a benchmark dashboard that labels every result as internal (1,070) and shows that no independent results exist (0). There is no login or API key: `pip install "sqlguard-ninja[demo]" && sqlninja demo serve`.
+* **A sandbox the database enforces.** Allowed queries run in an in-memory synthetic SQLite database with an authorizer allowlist, `query_only`, engine limits and a time budget. Denied and review queries never run.
+* **Runs in the browser.** `scripts/build_static_demo.py` builds a static site in which Pyodide runs the same code in a Web Worker. Everything is self-hosted and checksum-verified, and a browser test confirms the site makes no third-party requests.
+* **Deployment references.** A hardened Dockerfile, Compose and Kubernetes manifests with health checks, validated configuration, rate limiting, body limits, query timeouts, non-root execution and resource limits. CI builds and runs the container under those restrictions and validates the manifests.
+
+## Notes
+
+* The playground is not yet publicly hosted. A manual GitHub Pages workflow is ready; it needs the maintainer to enable Pages.
+* All benchmark results remain internal (issues #5 and #6). SQL Server and Oracle remain parser-level experimental.
+
+## Installation
+
+```bash
+python -m pip install "sqlguard-ninja[demo]==0.7.0"
+sqlninja demo serve
+```
+
+PyPI: https://pypi.org/project/sqlguard-ninja/0.7.0/

{sqlguard_ninja-0.6.0 → sqlguard_ninja-0.7.0}/docs/security/THREAT_MODEL.md

@@ -58,6 +58,7 @@ flowchart LR
 | T4 | Parser ambiguity | Comment and string tricks, nested comments, dollar quoting | sqlglot dialect parsing. The corpus includes formatting and comment cases validated against real engines. Unparseable input is denied. | Unknown tokenizer differences. Report them as vulnerabilities. |
 | T5 | Dialect-specific bypasses | MySQL `/*! */` executable comments, SQLite `ATTACH`/`PRAGMA` | Executable-comment rule for the MySQL family. SQLite session statements are denied. | Untested dialects are experimental. |
 | T17 | MCP client or model escalating privileges | A model passes `role` or `tenant` arguments, or probes `get_policy_capabilities` for hidden tables | Identity fixed at server start from operator config; tool schemas have no identity arguments; capabilities list only granted, non-denied columns; no execution or credentials in the server | Anyone who can edit the MCP client configuration chooses the identity |
+| T20 | Abuse of the public playground | Resource exhaustion (recursive CTEs, cartesian joins, huge strings), sandbox escape attempts (ATTACH, PRAGMA, extensions, catalog reads), forged role or tenant in requests | Static build: everything runs in the visitor's own browser. Server: rate limit, body cap, enum identity, extra fields rejected; SQLite authorizer allowlist, `query_only`, engine limits, step/time budget, row cap; only ALLOW decisions execute | In-process limits are per replica; a determined client can still use its own CPU in static mode |
 | T19 | Secrets leaking through logs, traces, metrics or SARIF | A model inlines a credential or customer value as a literal or comment, or an exception message quotes SQL | Redaction of every literal form, with comments dropped; output is re-tokenized and withheld if any literal survives; telemetry carries ids and bounded labels only; spans record exception types only; SARIF copies no snippet; canary tests | `sql_sha256` is brute-forceable for short secrets; custom sinks and rules can add their own leaks |
 | T18 | MySQL parser differential through `sql_mode` | Under `ANSI_QUOTES` or `NO_BACKSLASH_ESCAPES` the server reads a validated string differently (e.g. `"card_number"` as a column, not a string) | `mysql_executor` checks `@@SESSION.sql_mode` and refuses those flags; placeholder values with backslashes are refused | Custom executors must call `check_sql_mode` themselves; global `sql_mode` changes between the check and the statement are not detected |
 | T6a | Unsafe automatic tenant filtering | A rewrite that changes meaning or masks a query naming another tenant | Rewrite is opt-in, bind-parameter only, refused on any non-tenant finding and on RIGHT/FULL-join ownership ambiguity; the rewritten SQL is re-validated and is the executed string | Rewritten SQL is sqlglot-normalised; RLS remains authoritative |

{sqlguard_ninja-0.6.0 → sqlguard_ninja-0.7.0}/pyproject.toml

@@ -43,7 +43,9 @@ mysql = ["PyMySQL>=1.1"]
 # Observability (sqlguard_ninja.observability).
 otel = ["opentelemetry-api>=1.25"]
 prometheus = ["prometheus-client>=0.20"]
-all = ["sqlguard-ninja[langchain,langgraph,fastapi,postgres,mysql,mcp,otel,prometheus]"]
+# Interactive playground (sqlninja demo serve).
+demo = ["fastapi>=0.110", "uvicorn>=0.30"]
+all = ["sqlguard-ninja[langchain,langgraph,fastapi,postgres,mysql,mcp,otel,prometheus,demo]"]
 dev = [
     "sqlguard-ninja[all]",
     "pytest>=8.0",
@@ -88,6 +90,7 @@ markers = [
     "postgres: needs a PostgreSQL server (SQLNINJA_PG_DSN or pgserver)",
     "performance: latency measurements",
     "mysql: needs a MySQL server (SQLNINJA_MYSQL_DSN)",
+    "e2e: browser end-to-end tests (Playwright)",
 ]
 filterwarnings = ["error::DeprecationWarning:sqlguard_ninja.*"]
 

sqlguard_ninja-0.7.0/src/sqlguard_ninja/_version.py

@@ -0,0 +1 @@
+__version__ = "0.7.0"

{sqlguard_ninja-0.6.0 → sqlguard_ninja-0.7.0}/src/sqlguard_ninja/cli/main.py

@@ -365,6 +365,16 @@ def cmd_mcp(args: argparse.Namespace) -> int:  # pragma: no cover - blocks on st
     return EXIT_OK
 
 
+def cmd_demo_serve(args: argparse.Namespace) -> int:  # pragma: no cover - blocks serving
+    try:
+        from sqlguard_ninja.demo.app import serve  # noqa: PLC0415 - optional extra
+    except ImportError as exc:
+        raise CLIError('the demo needs the extra: pip install "sqlguard-ninja[demo]"') from exc
+    _out(f"SQLGuard Ninja demo on http://{args.host}:{args.port}/ (synthetic data only)")
+    serve(args.host, args.port)
+    return EXIT_OK
+
+
 def cmd_init(args: argparse.Namespace) -> int:
     root = Path(args.directory)
     existing = [name for name in FILES if (root / name).exists()]
@@ -579,6 +589,14 @@ def build_parser() -> argparse.ArgumentParser:
     sc.add_argument("--fail-on", choices=["deny", "review", "never"], default="deny")
     sc.set_defaults(func=cmd_scan)
 
+    dm = sub.add_parser("demo", help="interactive playground").add_subparsers(
+        dest="demo_cmd", required=True
+    )
+    dserve = dm.add_parser("serve", help="serve the playground (synthetic data, no login)")
+    dserve.add_argument("--host", default="127.0.0.1")
+    dserve.add_argument("--port", type=int, default=8000)
+    dserve.set_defaults(func=cmd_demo_serve)
+
     i = sub.add_parser("init", help="write a starter sqlninja.yaml, policy and test cases")
     i.add_argument("directory", nargs="?", default=".")
     i.add_argument("--force", action="store_true")