bump version to 12.2.12

This now requires setting `admin-server-config-enabled`.

CHANGELOG.md

@@ -5,6 +5,13 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 
 ## Unreleased
 
+## [12.2.12] - 2025-05-01
+
+### Fixed
+
+- #3956, Fix exposing admin server `/config` by default - @steve-chavez
+  + The above endpoint is now disabled unless the `admin-server-config-enabled` config is set to `true`
+
 ## [12.2.11] - 2025-04-21
 
 ### Fixed

docs/references/admin_server.rst

@@ -55,10 +55,12 @@ Metrics
 
 Provides :ref:`metrics`.
 
+.. _runtime_config:
+
 Runtime Configuration
 =====================
 
-Provides a ``config`` endpoint that returns the runtime :ref:`configuration`.
+Provides a ``config`` endpoint that returns the runtime :ref:`configuration`. This requires setting :ref:`admin-server-config-enabled`.
 
 .. code-block:: bash
 
@@ -72,6 +74,8 @@ Provides a ``config`` endpoint that returns the runtime :ref:`configuration`.
   db-channel-enabled = false
   ...
 
+.. _runtime_schema_cache:
+
 Runtime Schema Cache
 ====================
 

docs/references/configuration.rst

@@ -161,6 +161,30 @@ admin-server-port
 
   Specifies the port for the :ref:`admin_server`.
 
+.. _admin-server-config-enabled:
+
+admin-server-config-enabled
+---------------------------
+
+  .. danger::
+
+    The ``/config`` endpoint contains sensitive information, don't enable this if you're exposing the Admin Server publicly.
+
+    To safely enable this you can use a proxy like :ref:`nginx` to:
+
+    - Ensure ``/config`` are only available to local networks.
+    - Only expose ``/live`` and ``/ready`` to public networks.
+
+  =============== =================================
+  **Type**        Boolean
+  **Default**     False
+  **Reloadable**  N
+  **Environment** PGRST_ADMIN_SERVER_CONFIG_ENABLED
+  **In-Database** `n/a`
+  =============== =================================
+
+  Enables the admin server :ref:`runtime_config` and :ref:`runtime_schema_cache` endpoints.
+
 .. _app.settings.*:
 
 app.settings.*

postgrest.cabal

@@ -1,5 +1,5 @@
 name:               postgrest
-version:            12.2.11
+version:            12.2.12
 synopsis:           REST API for any Postgres database
 description:        Reads the schema of a PostgreSQL database and creates RESTful routes
                     for tables, views, and functions, supporting all HTTP methods that security

src/PostgREST/Admin.hs

@@ -56,8 +56,11 @@ admin appState req respond  = do
       in
       respond $ Wai.responseLBS status [] mempty
     ["config"] -> do
-      config <- AppState.getConfig appState
-      respond $ Wai.responseLBS HTTP.status200 [] (LBS.fromStrict $ encodeUtf8 $ Config.toText config)
+      config@Config.AppConfig{configAdminServerConfigEnabled} <- AppState.getConfig appState
+      if configAdminServerConfigEnabled then
+        respond $ Wai.responseLBS HTTP.status200 [] (LBS.fromStrict $ encodeUtf8 $ Config.toText config)
+      else
+        respond $ Wai.responseLBS HTTP.status404 [] mempty
     ["schema_cache"] -> do
       sCache <- AppState.getSchemaCache appState
       respond $ Wai.responseLBS HTTP.status200 [] (maybe mempty JSON.encode sCache)

src/PostgREST/CLI.hs

@@ -128,6 +128,9 @@ exampleConfigFile =
   [str|## Admin server used for checks. It's disabled by default unless a port is specified.
       |# admin-server-port = 3001
       |
+      |## Whether to enable the /config endpoint of the admin server
+      |# admin-server-config-enabled = false
+      |
       |## The database role to use when no client authentication is provided
       |# db-anon-role = "anon"
       |

src/PostgREST/Config.hs

@@ -110,6 +110,7 @@ data AppConfig = AppConfig
   , configServerUnixSocket         :: Maybe FilePath
   , configServerUnixSocketMode     :: FileMode
   , configAdminServerPort          :: Maybe Int
+  , configAdminServerConfigEnabled :: Bool
   , configRoleSettings             :: RoleSettings
   , configRoleIsoLvl               :: RoleIsolationLvl
   , configInternalSCSleep          :: Maybe Int32
@@ -180,6 +181,7 @@ toText conf =
       ,("server-unix-socket",        q . maybe mempty T.pack . configServerUnixSocket)
       ,("server-unix-socket-mode",   q . T.pack . showSocketMode)
       ,("admin-server-port",             maybe "\"\"" show . configAdminServerPort)
+      ,("admin-server-config-enabled",             T.toLower . show . configAdminServerConfigEnabled)
       ]
 
     -- quote all app.settings
@@ -286,6 +288,7 @@ parser optPath env dbSettings roleSettings roleIsolationLvl =
     <*> (fmap T.unpack <$> optString "server-unix-socket")
     <*> parseSocketFileMode "server-unix-socket-mode"
     <*> optInt "admin-server-port"
+    <*> (fromMaybe False <$> optBool "admin-server-config-enabled")
     <*> pure roleSettings
     <*> pure roleIsolationLvl
     <*> optInt "internal-schema-cache-sleep"

test/io/configs/expected/aliases.config

@@ -36,3 +36,4 @@ server-timing-enabled = false
 server-unix-socket = ""
 server-unix-socket-mode = "660"
 admin-server-port = ""
+admin-server-config-enabled = false

test/io/configs/expected/boolean-numeric.config

@@ -36,3 +36,4 @@ server-timing-enabled = false
 server-unix-socket = ""
 server-unix-socket-mode = "660"
 admin-server-port = ""
+admin-server-config-enabled = false

test/io/configs/expected/boolean-string.config

@@ -36,3 +36,4 @@ server-timing-enabled = false
 server-unix-socket = ""
 server-unix-socket-mode = "660"
 admin-server-port = ""
+admin-server-config-enabled = false

test/io/configs/expected/defaults.config

@@ -36,3 +36,4 @@ server-timing-enabled = false
 server-unix-socket = ""
 server-unix-socket-mode = "660"
 admin-server-port = ""
+admin-server-config-enabled = false

test/io/configs/expected/no-defaults-with-db-other-authenticator.config

@@ -36,5 +36,6 @@ server-timing-enabled = true
 server-unix-socket = "/tmp/pgrst_io_test.sock"
 server-unix-socket-mode = "777"
 admin-server-port = 3001
+admin-server-config-enabled = true
 app.settings.test = "test"
 app.settings.test2 = "test"

test/io/configs/expected/no-defaults-with-db.config

@@ -36,5 +36,6 @@ server-timing-enabled = false
 server-unix-socket = "/tmp/pgrst_io_test.sock"
 server-unix-socket-mode = "777"
 admin-server-port = 3001
+admin-server-config-enabled = true
 app.settings.test = "test"
 app.settings.test2 = "test"

test/io/configs/expected/no-defaults.config

@@ -36,5 +36,6 @@ server-timing-enabled = true
 server-unix-socket = "/tmp/pgrst_io_test.sock"
 server-unix-socket-mode = "777"
 admin-server-port = 3001
+admin-server-config-enabled = true
 app.settings.test = "test"
 app.settings.test2 = "test"

test/io/configs/expected/types.config

@@ -36,4 +36,5 @@ server-timing-enabled = false
 server-unix-socket = ""
 server-unix-socket-mode = "660"
 admin-server-port = ""
+admin-server-config-enabled = false
 app.settings.test = "Bool False"

test/io/configs/no-defaults-env.yaml

@@ -39,3 +39,4 @@ PGRST_SERVER_TIMING_ENABLED: true
 PGRST_SERVER_UNIX_SOCKET: /tmp/pgrst_io_test.sock
 PGRST_SERVER_UNIX_SOCKET_MODE: 777
 PGRST_ADMIN_SERVER_PORT: 3001
+PGRST_ADMIN_SERVER_CONFIG_ENABLED: true

test/io/configs/no-defaults.config

@@ -36,5 +36,6 @@ server-timing-enabled = true
 server-unix-socket = "/tmp/pgrst_io_test.sock"
 server-unix-socket-mode = "777"
 admin-server-port = 3001
+admin-server-config-enabled = true
 app.settings.test = "test"
 app.settings.test2 = "test"

test/io/test_io.py

@@ -673,6 +673,15 @@ def test_admin_config(defaultenv):
     "Should get a success response from the admin server containing current configuration"
 
     with run(env=defaultenv) as postgrest:
+        response = postgrest.admin.get("/config")
+        assert response.status_code == 404
+
+    env = {
+        **defaultenv,
+        "PGRST_ADMIN_SERVER_CONFIG_ENABLED": "true",
+    }
+
+    with run(env=env) as postgrest:
         response = postgrest.admin.get("/config")
         print(response.text)
         assert response.status_code == 200

test/spec/SpecHelper.hs

@@ -151,6 +151,7 @@ baseCfg = let secret = Just $ encodeUtf8 "reallyreallyreallyreallyverysafe" in
   , configDbTxAllowOverride         = True
   , configDbTxRollbackAll           = True
   , configAdminServerPort           = Nothing
+  , configAdminServerConfigEnabled  = False
   , configRoleSettings              = mempty
   , configRoleIsoLvl                = mempty
   , configInternalSCSleep           = Nothing