bump version to 12.2.12

This now requires setting `admin-server-config-enabled`.

CHANGELOG.md

@@ -5,6 +5,25 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 
 ## Unreleased
 
+## [12.2.12] - 2025-05-01
+
+### Fixed
+
+- #3956, Fix exposing admin server `/config` by default - @steve-chavez
+  + The above endpoint is now disabled unless the `admin-server-config-enabled` config is set to `true`
+
+## [12.2.11] - 2025-04-21
+
+### Fixed
+
+- #4030, Fix regression with parameter `charset=utf-8` in mediatype - @taimoorzaeem
+
+## [12.2.10] - 2025-04-18
+
+### Fixed
+
+- #3889, Fix: JWT cache purging on every request decreases performance - @mkleczek
+
 ## [12.2.9] - 2025-04-16
 
 ### Fixed

docs/references/admin_server.rst

@@ -55,10 +55,12 @@ Metrics
 
 Provides :ref:`metrics`.
 
+.. _runtime_config:
+
 Runtime Configuration
 =====================
 
-Provides a ``config`` endpoint that returns the runtime :ref:`configuration`.
+Provides a ``config`` endpoint that returns the runtime :ref:`configuration`. This requires setting :ref:`admin-server-config-enabled`.
 
 .. code-block:: bash
 
@@ -72,6 +74,8 @@ Provides a ``config`` endpoint that returns the runtime :ref:`configuration`.
   db-channel-enabled = false
   ...
 
+.. _runtime_schema_cache:
+
 Runtime Schema Cache
 ====================
 

docs/references/configuration.rst

@@ -161,6 +161,30 @@ admin-server-port
 
   Specifies the port for the :ref:`admin_server`.
 
+.. _admin-server-config-enabled:
+
+admin-server-config-enabled
+---------------------------
+
+  .. danger::
+
+    The ``/config`` endpoint contains sensitive information, don't enable this if you're exposing the Admin Server publicly.
+
+    To safely enable this you can use a proxy like :ref:`nginx` to:
+
+    - Ensure ``/config`` are only available to local networks.
+    - Only expose ``/live`` and ``/ready`` to public networks.
+
+  =============== =================================
+  **Type**        Boolean
+  **Default**     False
+  **Reloadable**  N
+  **Environment** PGRST_ADMIN_SERVER_CONFIG_ENABLED
+  **In-Database** `n/a`
+  =============== =================================
+
+  Enables the admin server :ref:`runtime_config` and :ref:`runtime_schema_cache` endpoints.
+
 .. _app.settings.*:
 
 app.settings.*

postgrest.cabal

@@ -1,5 +1,5 @@
 name:               postgrest
-version:            12.2.9
+version:            12.2.12
 synopsis:           REST API for any Postgres database
 description:        Reads the schema of a PostgreSQL database and creates RESTful routes
                     for tables, views, and functions, supporting all HTTP methods that security

src/PostgREST/Admin.hs

@@ -56,8 +56,11 @@ admin appState req respond  = do
       in
       respond $ Wai.responseLBS status [] mempty
     ["config"] -> do
-      config <- AppState.getConfig appState
-      respond $ Wai.responseLBS HTTP.status200 [] (LBS.fromStrict $ encodeUtf8 $ Config.toText config)
+      config@Config.AppConfig{configAdminServerConfigEnabled} <- AppState.getConfig appState
+      if configAdminServerConfigEnabled then
+        respond $ Wai.responseLBS HTTP.status200 [] (LBS.fromStrict $ encodeUtf8 $ Config.toText config)
+      else
+        respond $ Wai.responseLBS HTTP.status404 [] mempty
     ["schema_cache"] -> do
       sCache <- AppState.getSchemaCache appState
       respond $ Wai.responseLBS HTTP.status200 [] (maybe mempty JSON.encode sCache)

src/PostgREST/AppState.hs

@@ -5,6 +5,7 @@
 module PostgREST.AppState
   ( AppState
   , AuthResult(..)
+  , JwtCacheState(..)
   , destroy
   , getConfig
   , getSchemaCache
@@ -13,7 +14,7 @@ module PostgREST.AppState
   , getNextDelay
   , getNextListenerDelay
   , getTime
-  , getJwtCache
+  , getJwtCacheState
   , getSocketREST
   , getSocketAdmin
   , init
@@ -83,6 +84,12 @@ data AuthResult = AuthResult
   , authRole   :: BS.ByteString
   }
 
+-- | JWT Cache and IO action that triggers purging old entries from the cache
+data JwtCacheState = JwtCacheState
+  { jwtCache   :: C.Cache ByteString AuthResult
+  , purgeCache :: IO ()
+  }
+
 data AppState = AppState
   -- | Database connection pool
   { statePool              :: SQL.Pool
@@ -107,7 +114,7 @@ data AppState = AppState
   -- | Keeps track of the next delay for the listener
   , stateNextListenerDelay :: IORef Int
   -- | JWT Cache
-  , jwtCache               :: C.Cache ByteString AuthResult
+  , jwtCacheState          :: JwtCacheState
   -- | Network socket for REST API
   , stateSocketREST        :: NS.Socket
   -- | Network socket for the admin UI
@@ -139,6 +146,16 @@ init conf@AppConfig{configLogLevel, configDbPoolSize} = do
 
 initWithPool :: AppSockets -> SQL.Pool -> AppConfig -> Logger.LoggerState -> Metrics.MetricsState -> ObservationHandler -> IO AppState
 initWithPool (sock, adminSock) pool conf loggerState metricsState observer = do
+  cache <- C.newCache Nothing
+  -- purgeExpired has O(n^2) complexity
+  -- so we wrap it in debounce to make sure it:
+  -- 1) is executed asynchronously
+  -- 2) only a single purge operation is running at a time
+  debounce <- mkDebounce defaultDebounceSettings
+    -- debounceFreq is set to default 1 second
+    { debounceAction = C.purgeExpired cache
+    , debounceEdge = leadingEdge
+    }
 
   appState <- AppState pool
     <$> newIORef minimumPgVersion -- assume we're in a supported version when starting, this will be corrected on a later step
@@ -151,7 +168,7 @@ initWithPool (sock, adminSock) pool conf loggerState metricsState observer = do
     <*> myThreadId
     <*> newIORef 0
     <*> newIORef 1
-    <*> C.newCache Nothing
+    <*> pure (JwtCacheState cache debounce)
     <*> pure sock
     <*> pure adminSock
     <*> pure observer
@@ -314,8 +331,8 @@ putConfig = atomicWriteIORef . stateConf
 getTime :: AppState -> IO UTCTime
 getTime = stateGetTime
 
-getJwtCache :: AppState -> C.Cache ByteString AuthResult
-getJwtCache = jwtCache
+getJwtCacheState :: AppState -> JwtCacheState
+getJwtCacheState = jwtCacheState
 
 getSocketREST :: AppState -> NS.Socket
 getSocketREST = stateSocketREST
@@ -439,7 +456,7 @@ retryingSchemaCacheLoad appState@AppState{stateObserver=observer, stateMainThrea
 -- | Reads the in-db config and reads the config file again
 -- | We don't retry reading the in-db config after it fails immediately, because it could have user errors. We just report the error and continue.
 readInDbConfig :: Bool -> AppState -> IO ()
-readInDbConfig startingUp appState@AppState{stateObserver=observer} = do
+readInDbConfig startingUp appState@AppState{stateObserver=observer, jwtCacheState=JwtCacheState{jwtCache}} = do
   conf <- getConfig appState
   pgVer <- getPgVersion appState
   dbSettings <-
@@ -476,7 +493,7 @@ readInDbConfig startingUp appState@AppState{stateObserver=observer} = do
       if configJwtSecret conf == configJwtSecret newConf then
         pass
       else
-        C.purge (getJwtCache appState) -- atomic O(1) operation
+        C.purge jwtCache -- atomic O(1) operation
 
       if startingUp then
         pass

src/PostgREST/Auth.hs

@@ -44,8 +44,9 @@ import System.Clock            (TimeSpec (..))
 import System.IO.Unsafe        (unsafePerformIO)
 import System.TimeIt           (timeItT)
 
-import PostgREST.AppState (AppState, AuthResult (..), getConfig,
-                           getJwtCache, getTime)
+import PostgREST.AppState (AppState, AuthResult (..),
+                           JwtCacheState (..), getConfig,
+                           getJwtCacheState, getTime)
 import PostgREST.Config   (AppConfig (..), JSPath, JSPathExp (..))
 import PostgREST.Error    (Error (..))
 
@@ -131,7 +132,8 @@ middleware appState app req respond = do
 -- | Used to retrieve and insert JWT to JWT Cache
 getJWTFromCache :: AppState -> ByteString -> Int -> IO (Either Error AuthResult) -> UTCTime -> IO (Either Error AuthResult)
 getJWTFromCache appState token maxLifetime parseJwt utc = do
-  checkCache <- C.lookup (getJwtCache appState) token
+  let JwtCacheState{..} = getJwtCacheState appState
+  checkCache <- C.lookup jwtCache token
   authResult <- maybe parseJwt (pure . Right) checkCache
 
   case (authResult,checkCache) of
@@ -151,17 +153,17 @@ getJWTFromCache appState token maxLifetime parseJwt utc = do
 
       let timeSpec = getTimeSpec res maxLifetime utc
 
-      -- purge expired cache entries
-      C.purgeExpired jwtCache
-
       -- insert new cache entry
       C.insert' jwtCache timeSpec token res
 
+      -- Execute IO action to purge the cache
+      -- It is assumed this action returns immidiately
+      -- so that request processing is not blocked.
+      purgeCache
+
     _                    -> pure ()
 
   return authResult
-    where
-      jwtCache = getJwtCache appState
 
 -- Used to extract JWT exp claim and add to JWT Cache
 getTimeSpec :: AuthResult -> Int -> UTCTime -> Maybe TimeSpec

src/PostgREST/CLI.hs

@@ -128,6 +128,9 @@ exampleConfigFile =
   [str|## Admin server used for checks. It's disabled by default unless a port is specified.
       |# admin-server-port = 3001
       |
+      |## Whether to enable the /config endpoint of the admin server
+      |# admin-server-config-enabled = false
+      |
       |## The database role to use when no client authentication is provided
       |# db-anon-role = "anon"
       |

src/PostgREST/Config.hs

@@ -110,6 +110,7 @@ data AppConfig = AppConfig
   , configServerUnixSocket         :: Maybe FilePath
   , configServerUnixSocketMode     :: FileMode
   , configAdminServerPort          :: Maybe Int
+  , configAdminServerConfigEnabled :: Bool
   , configRoleSettings             :: RoleSettings
   , configRoleIsoLvl               :: RoleIsolationLvl
   , configInternalSCSleep          :: Maybe Int32
@@ -180,6 +181,7 @@ toText conf =
       ,("server-unix-socket",        q . maybe mempty T.pack . configServerUnixSocket)
       ,("server-unix-socket-mode",   q . T.pack . showSocketMode)
       ,("admin-server-port",             maybe "\"\"" show . configAdminServerPort)
+      ,("admin-server-config-enabled",             T.toLower . show . configAdminServerConfigEnabled)
       ]
 
     -- quote all app.settings
@@ -286,6 +288,7 @@ parser optPath env dbSettings roleSettings roleIsolationLvl =
     <*> (fmap T.unpack <$> optString "server-unix-socket")
     <*> parseSocketFileMode "server-unix-socket-mode"
     <*> optInt "admin-server-port"
+    <*> (fromMaybe False <$> optBool "admin-server-config-enabled")
     <*> pure roleSettings
     <*> pure roleIsolationLvl
     <*> optInt "internal-schema-cache-sleep"

src/PostgREST/MediaType.hs

@@ -183,14 +183,14 @@ decodeMediaType mt = decodeMediaType' $ decodeLatin1 mt
 -- >>> P.parse tokenizeMediaType "" "application/vnd.pgrst.plan+text; for=\"text/xml\"; options=analyze|verbose|settings|buffers|wal"
 -- Right ("application","vnd.pgrst.plan+text",[("for","text/xml"),("options","analyze|verbose|settings|buffers|wal")])
 
+-- TODO: Improve mediatype parser as per RFC 2045 https://datatracker.ietf.org/doc/html/rfc2045#section-5.1
 tokenizeMediaType :: P.Parser (Text, Text, [(Text, Text)])
 tokenizeMediaType = do
   mainType <- P.many1 (P.alphaNum <|> P.oneOf ".*")
   P.char '/'
   subType <- P.many1 (P.alphaNum <|> P.oneOf ".*+-")
   params <- P.many pSemicolonSeparatedKeyVals
-  P.optional $ P.try $ P.spaces *> P.char ';' -- ending semicolon
-  P.eof
+  P.optional $ P.try $ P.spaces *> P.char ';' -- ending semicolon, discard input after that because it has already failed or we have hit EOF
   return (T.pack mainType, T.pack subType, params)
     where
       pSemicolonSeparatedKeyVals :: P.Parser (Text, Text)
@@ -198,12 +198,12 @@ tokenizeMediaType = do
         where
           pKeyVal :: P.Parser (Text, Text)
           pKeyVal = do
-            key <- P.many1 P.alphaNum
+            key <- P.many1 (P.alphaNum <|> P.oneOf "-")
             P.spaces
             P.char '='
             P.spaces
             val <- P.try pQuoted <|> P.try pUnQuoted
             return (T.pack key, T.pack val)
               where
-                pUnQuoted = P.many1 (P.alphaNum <|> P.oneOf "|")
+                pUnQuoted = P.many1 (P.alphaNum <|> P.oneOf "|-")
                 pQuoted = P.char '\"' *> P.manyTill P.anyChar (P.char '\"')

test/io/configs/expected/aliases.config

@@ -36,3 +36,4 @@ server-timing-enabled = false
 server-unix-socket = ""
 server-unix-socket-mode = "660"
 admin-server-port = ""
+admin-server-config-enabled = false

test/io/configs/expected/boolean-numeric.config

@@ -36,3 +36,4 @@ server-timing-enabled = false
 server-unix-socket = ""
 server-unix-socket-mode = "660"
 admin-server-port = ""
+admin-server-config-enabled = false

test/io/configs/expected/boolean-string.config

@@ -36,3 +36,4 @@ server-timing-enabled = false
 server-unix-socket = ""
 server-unix-socket-mode = "660"
 admin-server-port = ""
+admin-server-config-enabled = false

test/io/configs/expected/defaults.config

@@ -36,3 +36,4 @@ server-timing-enabled = false
 server-unix-socket = ""
 server-unix-socket-mode = "660"
 admin-server-port = ""
+admin-server-config-enabled = false

test/io/configs/expected/no-defaults-with-db-other-authenticator.config

@@ -36,5 +36,6 @@ server-timing-enabled = true
 server-unix-socket = "/tmp/pgrst_io_test.sock"
 server-unix-socket-mode = "777"
 admin-server-port = 3001
+admin-server-config-enabled = true
 app.settings.test = "test"
 app.settings.test2 = "test"

test/io/configs/expected/no-defaults-with-db.config

@@ -36,5 +36,6 @@ server-timing-enabled = false
 server-unix-socket = "/tmp/pgrst_io_test.sock"
 server-unix-socket-mode = "777"
 admin-server-port = 3001
+admin-server-config-enabled = true
 app.settings.test = "test"
 app.settings.test2 = "test"

test/io/configs/expected/no-defaults.config

@@ -36,5 +36,6 @@ server-timing-enabled = true
 server-unix-socket = "/tmp/pgrst_io_test.sock"
 server-unix-socket-mode = "777"
 admin-server-port = 3001
+admin-server-config-enabled = true
 app.settings.test = "test"
 app.settings.test2 = "test"

test/io/configs/expected/types.config

@@ -36,4 +36,5 @@ server-timing-enabled = false
 server-unix-socket = ""
 server-unix-socket-mode = "660"
 admin-server-port = ""
+admin-server-config-enabled = false
 app.settings.test = "Bool False"

test/io/configs/no-defaults-env.yaml

@@ -39,3 +39,4 @@ PGRST_SERVER_TIMING_ENABLED: true
 PGRST_SERVER_UNIX_SOCKET: /tmp/pgrst_io_test.sock
 PGRST_SERVER_UNIX_SOCKET_MODE: 777
 PGRST_ADMIN_SERVER_PORT: 3001
+PGRST_ADMIN_SERVER_CONFIG_ENABLED: true

test/io/configs/no-defaults.config

@@ -36,5 +36,6 @@ server-timing-enabled = true
 server-unix-socket = "/tmp/pgrst_io_test.sock"
 server-unix-socket-mode = "777"
 admin-server-port = 3001
+admin-server-config-enabled = true
 app.settings.test = "test"
 app.settings.test2 = "test"

test/io/test_io.py

@@ -673,6 +673,15 @@ def test_admin_config(defaultenv):
     "Should get a success response from the admin server containing current configuration"
 
     with run(env=defaultenv) as postgrest:
+        response = postgrest.admin.get("/config")
+        assert response.status_code == 404
+
+    env = {
+        **defaultenv,
+        "PGRST_ADMIN_SERVER_CONFIG_ENABLED": "true",
+    }
+
+    with run(env=env) as postgrest:
         response = postgrest.admin.get("/config")
         print(response.text)
         assert response.status_code == 200

test/spec/Feature/Query/CustomMediaSpec.hs

@@ -382,3 +382,24 @@ spec = describe "custom media types" $ do
       `shouldRespondWith`
       [json| {"code":"PGRST107","details":null,"hint":null,"message":"None of these media types are available: undefined"} |]
       { matchStatus = 406 }
+
+  context "media type parser allowed characters" $ do
+    it "regression test allowing charset=utf-8" $
+      request methodPost "/rpc/overloaded_default"
+        [("Content-Type", "application/json; charset=utf-8")]
+        [json|{"must_param":1}|]
+        `shouldRespondWith`
+        [json|{"val":1}|]
+        { matchStatus = 200
+        , matchHeaders = ["Content-Type" <:> "application/json; charset=utf-8"]
+        }
+
+    it "handle unrecognized parameters leniently" $ do
+      request methodPost "/rpc/overloaded_default"
+        [("Content-Type", "application/json; $$ unrecognized-chars=ignored $$")]
+        [json|{"must_param":1}|]
+        `shouldRespondWith`
+        [json|{"val":1}|]
+        { matchStatus = 200
+        , matchHeaders = ["Content-Type" <:> "application/json; charset=utf-8"]
+        }

test/spec/SpecHelper.hs

@@ -151,6 +151,7 @@ baseCfg = let secret = Just $ encodeUtf8 "reallyreallyreallyreallyverysafe" in
   , configDbTxAllowOverride         = True
   , configDbTxRollbackAll           = True
   , configAdminServerPort           = Nothing
+  , configAdminServerConfigEnabled  = False
   , configRoleSettings              = mempty
   , configRoleIsoLvl                = mempty
   , configInternalSCSleep           = Nothing