Merge branch 'main' into feat/workspaces-and-roles

Author: venkateshsakamuri-lab

CHANGELOG.md

@@ -8,6 +8,34 @@ for product tags (`vMAJOR.MINOR.PATCH`).
 
 Product releases follow a **weekly cadence** (Saturday 09:00 America/Los_Angeles). See `docs/oss-ux/RELEASE.md`.
 
+## [1.3.0] — 2026-08-24
+
+### Added
+
+- **DeepSQL Desktop** — first-ship Electron thin client (`desktop/`) with direct TLS and SSH-tunnel transports, connection profiles, OS keychain secrets, and native chrome (#73).
+- Desktop release workflow (`.github/workflows/desktop-release.yml`) for macOS / Windows / Linux installers on `desktop-v*` tags.
+- Enforceable Agent brain-note proposals with non-blocking save bubbles (#75).
+- Schema documentation dedupe / `CODE_DERIVED` compatibility initializers (`V116`) (#74, #77).
+
+### Fixed
+
+- Cross-user MCP credential leak in the Agent tab — provisioner no longer last-writer-wins across Hermes profiles; MCP tokens bind to declared client identity (#78).
+- View as Agent enforces the target user’s data policy on new Agent threads (#71).
+- Chat schema allowlist enumerates the whole statement (#70).
+- Brain endpoints require connection content authorization (#72).
+- Review queue approvals: stale pending counts, bulk `failures[]`, approval path unwedge (#74, #77).
+- Editor CSV export bounded; concurrent-run guards and cancel audit (#76).
+
+### Changed
+
+- Documented CORS loopback wildcards required for Desktop SSH tunnels (`CORS_ALLOWED_ORIGINS`).
+- `@deepsql/mcp` → `0.27.1`.
+- DeepSQL Desktop package → `1.0.0` (cut installers with `desktop-v1.0.0`).
+
+### Notes
+
+- Open follow-up: dashboard workspaces + custom roles (#80) intentionally not in this cut.
+
 ## [1.2.0] — 2026-08-19
 
 ### Added
@@ -82,6 +110,7 @@ First public OSS release.
 - Residual high-severity items tracked in `docs/oss-ux/OSS_SECURITY_REVIEW.md` (IDOR sweep, SET preamble allowlist, SSRF hardening, share-password defaults) are deferred past this cut.
 - Primary distribution path remains `docker compose up --build` (no pre-built container registry in this release).
 
+[1.3.0]: https://github.com/DeepSQLAI/deepsql/releases/tag/v1.3.0
 [1.2.0]: https://github.com/DeepSQLAI/deepsql/releases/tag/v1.2.0
 [1.1.0]: https://github.com/DeepSQLAI/deepsql/releases/tag/v1.1.0
 [1.0.0]: https://github.com/DeepSQLAI/deepsql/releases/tag/v1.0.0

CLAUDE.md

@@ -245,9 +245,8 @@ their native runners. See `desktop/README.md` for the full picture.
 ## MCP Server
 
 - `mcp/deepsql-phase1-server.js` implements a Phase 1 stdio MCP server for internal rollout.
-- It exposes read-only tools only: listing connections, fetching schema/objects, asking DeepSQL questions, executing read-only SQL, and running EXPLAIN without ANALYZE.
-- It wraps existing backend APIs, so it reuses DeepSQL chat orchestration, RAG, connection management, and guardrails instead of exposing raw DB credentials.
-- Read-only enforcement is applied in `mcp/deepsql-phase1-lib.js` before calling backend execution endpoints.
+- Schema/retrieval tools stay read-only. `execute_sql` is role-gated: developers stay read-only; admins can run DML and non-destructive DDL (`CREATE`, `ALTER`) with the same two-step confirmation as the SQL Editor. `DROP` and `TRUNCATE` stay blocked on MCP even when confirmed.
+- It wraps existing backend APIs, so it reuses DeepSQL chat orchestration, RAG, connection management, and `QueryExecutionPolicyService` instead of exposing raw DB credentials.
 - Client config examples live in `.cursor/mcp.json` and `mcp/claude_desktop_config.example.json`.
 - Usage and env vars are documented in `docs/root/MCP_PHASE1.md`.
 

README.md

@@ -15,6 +15,10 @@ control except the prompts you send to the endpoint you chose.
 📄 **[Read the whitepaper](https://deepsql.ai/whitepaper)** — the architecture and the
 reasoning behind it.
 
+📦 **Latest release: [v1.3.0](https://github.com/DeepSQLAI/deepsql/releases/tag/v1.3.0)** —
+DeepSQL Desktop first ship + Agent/Brain/Editor hardening. Notes:
+[`docs/releases/RELEASE_NOTES-v1.3.0.md`](docs/releases/RELEASE_NOTES-v1.3.0.md).
+
 ---
 
 ## Quick start

agent/SOUL.md

@@ -16,7 +16,7 @@ After the answer you may offer **one short follow-up question** (a single line)
 
 4. **Table-qualify every column** in generated SQL (`table.column`). Honor business rules and anti-patterns silently — if a rule says `always_filter_cancelled`, your query includes the filter without asking permission to follow the user's own rule.
 
-5. **Read-only by default.** Developers cannot mutate; admins can with a **two-step confirmation**. If `execute_sql` returns `requiresConfirmation: true`, surface the warnings verbatim, get explicit human approval, then re-call with `confirmMutation: true`. NEVER auto-confirm — that defeats the safety gate. Never try to work around a 403/`EDITOR_MUTATION_FORBIDDEN`; surface it.
+5. **Read-only by default.** Developers cannot mutate; admins can run DML and non-destructive DDL (`CREATE`, `ALTER`) with a **two-step confirmation**. `DROP` and `TRUNCATE` cannot be run via `execute_sql` — they stay blocked even after confirmation. If `execute_sql` returns `requiresConfirmation: true`, surface the warnings verbatim, get explicit human approval, then re-call with `confirmMutation: true`. NEVER auto-confirm — that defeats the safety gate. Never try to work around a 403/`EDITOR_MUTATION_FORBIDDEN` or an `UNSAFE_MUTATION_BLOCKED` DROP/TRUNCATE; surface it.
 
 6. **One execution tool, one analysis tool.** Use `execute_sql` to run SQL; use `analyze_query_plan` for plans. Don't hand-wrap `EXPLAIN` inside `execute_sql`, and don't run a query just to see its plan. `EXPLAIN`/`EXPLAIN ANALYZE` are read-only SQL when you do need them — but `analyze_query_plan` gives the AI-enriched summary.
 

backend/pom.xml

@@ -14,7 +14,7 @@
 
     <groupId>com.dbaagent</groupId>
     <artifactId>dba-agent-backend</artifactId>
-    <version>1.2.0</version>
+    <version>1.3.0</version>
     <name>DBA Agent Backend</name>
     <description>Backend service for DBA Agent with secure credential storage and schema analysis</description>
 

backend/src/main/java/com/dbaagent/controller/ExplainController.java

@@ -10,6 +10,7 @@
 import com.dbaagent.service.ClientContext;
 import com.dbaagent.service.CredentialService;
 import com.dbaagent.service.ExplainPlanService;
+import com.dbaagent.service.McpTokenService;
 import com.dbaagent.service.QueryExecutionContext;
 import com.dbaagent.service.QueryExecutionPolicyException;
 import com.dbaagent.service.QueryExecutionPolicyService;
@@ -19,6 +20,7 @@
 import lombok.Data;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
+import org.springframework.http.HttpHeaders;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
 import org.springframework.jdbc.BadSqlGrammarException;
@@ -38,9 +40,10 @@
  *   1. `useAnalyze=true` actually runs the underlying statement inside
  *      EXPLAIN ANALYZE — so for any mutating statement, that's a real
  *      database write. We route those through QueryExecutionPolicyService
- *      with `QueryExecutionContext.editor(...)` so the same role/WHERE/
- *      confirmation gates that protect /api/connections/{id}/query
- *      protect this path too.
+ *      with `QueryExecutionContext.forSqlSurface(...)` so MCP bearers
+ *      keep the MCP DROP/TRUNCATE block and Editor JWT callers keep the
+ *      Editor DROP TABLE block. Role, WHERE, and confirmation gates that
+ *      protect /api/connections/{id}/query protect this path too.
  *
  *   2. Every call — success, blocked, or failed — emits a SecurityEvent so
  *      audit dashboards can see CLI/MCP/Editor traffic with one filter.
@@ -71,23 +74,27 @@ public ResponseEntity<?> analyzeQuery(
     ) {
         ClientContext client = ClientContext.fromRequest(httpRequest);
         String connectionId = request.getConnectionId();
-        QueryRequest auditQueryRequest = buildAuditQueryRequest(request);
+        QueryRequest auditQueryRequest = buildAuditQueryRequest(request, httpRequest);
         ConnectionRequest connectionRequest = null;
 
         try {
             accessControlService.assertCanUseChatEditor(connectionId);
             log.info("EXPLAIN analysis requested for connection: {} (useAnalyze={})", connectionId, request.isUseAnalyze());
 
             // ANALYZE actually executes the SQL. Route the underlying
-            // statement through the same policy gate the SQL Editor uses so
-            // a developer can't bypass the mutation guard by sending
-            // useAnalyze=true with `DELETE FROM users`.
+            // statement through the same policy gate /connections/{id}/query
+            // uses so a developer can't bypass the mutation guard by sending
+            // useAnalyze=true with `DELETE FROM users`, and MCP callers keep
+            // the DROP/TRUNCATE block.
             if (request.isUseAnalyze()) {
                 connectionRequest = credentialService.getDecryptedConnection(connectionId);
                 String dbType = providerRegistry.getCanonicalName(connectionRequest.getDbType());
                 queryExecutionPolicyService.enforce(
                     auditQueryRequest,
-                    QueryExecutionContext.editor(
+                    QueryExecutionContext.forSqlSurface(
+                        McpTokenService.isMcpAuthorizationHeader(
+                            httpRequest.getHeader(HttpHeaders.AUTHORIZATION)
+                        ),
                         accessControlService.getCurrentUsername(),
                         accessControlService.isCurrentUserAdmin(),
                         Boolean.TRUE.equals(request.getMutationConfirmed())
@@ -161,10 +168,13 @@ public ResponseEntity<?> analyzeQuery(
      * Carries the user's mutationConfirmed flag through so admin-confirmed
      * ANALYZE runs aren't stuck on the confirmation gate.
      */
-    private QueryRequest buildAuditQueryRequest(ExplainRequest request) {
+    private QueryRequest buildAuditQueryRequest(ExplainRequest request, HttpServletRequest httpRequest) {
         QueryRequest qr = new QueryRequest();
         qr.setQuery(request.getQuery());
-        qr.setExecutionOrigin(QueryExecutionOrigin.EDITOR);
+        boolean mcpBearer = McpTokenService.isMcpAuthorizationHeader(
+            httpRequest.getHeader(HttpHeaders.AUTHORIZATION)
+        );
+        qr.setExecutionOrigin(mcpBearer ? QueryExecutionOrigin.MCP : QueryExecutionOrigin.EDITOR);
         qr.setMutationConfirmed(Boolean.TRUE.equals(request.getMutationConfirmed()));
         return qr;
     }

backend/src/main/java/com/dbaagent/controller/SchemaController.java

@@ -191,7 +191,12 @@ public ResponseEntity<Map<String, Object>> executeQuery(
                 return ResponseEntity.status(HttpStatus.NOT_FOUND).body(response);
             }
             accessControlService.assertCanUseChatEditor(connectionId);
-            queryRequest.setExecutionOrigin(QueryExecutionOrigin.EDITOR);
+            boolean mcpBearer = McpTokenService.isMcpAuthorizationHeader(
+                httpRequest.getHeader(HttpHeaders.AUTHORIZATION)
+            );
+            queryRequest.setExecutionOrigin(
+                mcpBearer ? QueryExecutionOrigin.MCP : QueryExecutionOrigin.EDITOR
+            );
             connectionRequest = credentialService.getDecryptedConnection(connectionId);
 
             QueryResult result = queryExecutorService.executeQuery(
@@ -438,25 +443,14 @@ public ResponseEntity<Map<String, Object>> getTableStats(
     }
 
     private QueryExecutionContext queryExecutionContext(QueryRequest queryRequest, HttpServletRequest httpRequest) {
-        String username = accessControlService.getCurrentUsername();
-        boolean admin = accessControlService.isCurrentUserAdmin();
-        if (isMcpBearer(httpRequest)) {
-            return QueryExecutionContext.mcp(username, admin);
-        }
-        return QueryExecutionContext.editor(
-            username,
-            admin,
+        return QueryExecutionContext.forSqlSurface(
+            McpTokenService.isMcpAuthorizationHeader(httpRequest.getHeader(HttpHeaders.AUTHORIZATION)),
+            accessControlService.getCurrentUsername(),
+            accessControlService.isCurrentUserAdmin(),
             Boolean.TRUE.equals(queryRequest.getMutationConfirmed())
         );
     }
 
-    private boolean isMcpBearer(HttpServletRequest httpRequest) {
-        String authorization = httpRequest.getHeader(HttpHeaders.AUTHORIZATION);
-        return authorization != null
-            && authorization.startsWith("Bearer ")
-            && authorization.substring(7).startsWith(McpTokenService.TOKEN_PREFIX);
-    }
-
     private SchemaMetadata scopedSchema(String connectionId, SchemaMetadata schema) {
         return userDataAccessPolicyService.filterSchemaMetadata(
             connectionId,

backend/src/main/java/com/dbaagent/controller/SetupController.java

@@ -6,6 +6,7 @@
 import com.dbaagent.service.SystemConfigService;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.client.RestClient;
@@ -34,6 +35,25 @@ public class SetupController {
     private final CredentialRepository credentialRepository;
     private final LlmConfigResolver llmConfigResolver;
 
+    /**
+     * Mirrors {@code security.google.enabled}. Surfaced on the public status
+     * endpoint so the login page can decide whether to offer Google sign-in —
+     * it is otherwise unauthenticated and has no way to know the server was
+     * configured for SSO. Deliberately NOT final: {@code @RequiredArgsConstructor}
+     * would pull a final field into the constructor and Spring has no bean to
+     * satisfy it.
+     */
+    @Value("${security.google.enabled:false}")
+    private boolean googleEnabled;
+
+    /**
+     * Mirrors {@code security.password.enabled}. Lets the login page hide the
+     * email/password form on SSO-only installs instead of rendering a form that
+     * always fails. Same non-final reasoning as above.
+     */
+    @Value("${security.password.enabled:true}")
+    private boolean passwordLoginEnabled;
+
     // ── GET /setup/status ─────────────────────────────────────────────────────
 
     /** Returns setup completion state. Public endpoint — no auth required. */
@@ -53,7 +73,9 @@ public SetupStatusResponse getStatus() {
                 setupComplete,
                 hasOrgInfo,
                 hasConnections,
-                hasLlmConfig
+                hasLlmConfig,
+                googleEnabled,
+                passwordLoginEnabled
         );
     }
 
@@ -278,7 +300,11 @@ public record SetupStatusResponse(
             boolean setupComplete,
             boolean hasOrganizationInfo,
             boolean hasConnections,
-            boolean hasLlmConfig
+            boolean hasLlmConfig,
+            /** Whether Google Workspace SSO is configured; drives the login page's SSO button. */
+            boolean googleEnabled,
+            /** Whether email+password sign-in is accepted; false hides the password form. */
+            boolean passwordLoginEnabled
     ) {}
 
     public record InitializeRequest(String orgName, String adminUsername, String adminEmail, String adminPassword) {}

backend/src/main/java/com/dbaagent/service/McpTokenService.java

@@ -174,6 +174,17 @@ public boolean looksLikeMcpToken(String rawToken) {
         return rawToken != null && rawToken.startsWith(TOKEN_PREFIX);
     }
 
+    /**
+     * True when the Authorization header is a DeepSQL MCP bearer token
+     * ({@code Bearer dsql_mcp_…}). JWT and other Bearer schemes return false.
+     */
+    public static boolean isMcpAuthorizationHeader(String authorization) {
+        if (authorization == null || !authorization.regionMatches(true, 0, "Bearer ", 0, 7)) {
+            return false;
+        }
+        return authorization.substring(7).startsWith(TOKEN_PREFIX);
+    }
+
     private boolean isExpired(McpToken token) {
         return token.getExpiresAt() != null && !token.getExpiresAt().isAfter(LocalDateTime.now());
     }

backend/src/main/java/com/dbaagent/service/PasswordlessAuthService.java

@@ -4,8 +4,10 @@
 import com.dbaagent.repository.*;
 import com.dbaagent.security.EncryptionService;
 import com.dbaagent.util.SecurityHashUtil;
+import jakarta.annotation.PostConstruct;
 import lombok.Builder;
 import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
@@ -25,6 +27,7 @@
 
 @Service
 @RequiredArgsConstructor
+@Slf4j
 public class PasswordlessAuthService {
     private static final SecureRandom RANDOM = new SecureRandom();
 
@@ -72,6 +75,32 @@ public class PasswordlessAuthService {
     @Value("${security.google.enabled:false}")
     private boolean googleEnabled;
 
+    /**
+     * Whether email + password sign-in is accepted at all.
+     *
+     * <p>Defaults to {@code true} so existing installs are unaffected. Set it to
+     * false on deployments that front DeepSQL with Google Workspace SSO: enabling
+     * SSO does NOT by itself close the password path, so without this flag
+     * {@code /auth/login} stays open to every local account even when every human
+     * signs in through Google.
+     *
+     * <p>Turning this off while {@code security.google.enabled} is also off leaves
+     * no way to sign in — {@link #warnIfNoAuthMethodEnabled()} shouts about that at
+     * startup rather than letting it be discovered at the login screen.
+     */
+    @Value("${security.password.enabled:true}")
+    private boolean passwordLoginEnabled;
+
+    @PostConstruct
+    void warnIfNoAuthMethodEnabled() {
+        if (!passwordLoginEnabled && !googleEnabled) {
+            log.error("security.password.enabled=false AND security.google.enabled=false — "
+                + "no sign-in method is available and nobody can log in. Enable one of them.");
+        } else if (!passwordLoginEnabled) {
+            log.info("Password sign-in is DISABLED (security.password.enabled=false); Google SSO only.");
+        }
+    }
+
     @Value("${security.google.client-id:}")
     private String googleClientId;
 
@@ -87,6 +116,23 @@ public class PasswordlessAuthService {
     @Transactional
     public AuthFlowResult loginWithPassword(String email, String password, String clientIp, String userAgent, String requestId) {
         String normalizedEmail = normalizeEmail(email);
+
+        // Checked before the rate limiter and before any credential comparison:
+        // when the password path is closed there is nothing to rate-limit and no
+        // secret to compare, and we must not leak whether the account exists.
+        if (!passwordLoginEnabled) {
+            securityEventService.log(SecurityEventService.EventRequest.builder()
+                .eventType(SecurityEventType.PASSWORD_LOGIN_FAILURE)
+                .outcome(SecurityEventOutcome.FAILURE)
+                .email(normalizedEmail)
+                .clientIp(clientIp)
+                .userAgent(userAgent)
+                .requestId(requestId)
+                .metadata(Map.of("reason", "password_login_disabled"))
+                .build());
+            return AuthFlowResult.invalid("Password sign-in is disabled. Please sign in with Google.");
+        }
+
         if (rateLimitEnabled) enforcePasswordRateLimit(normalizedEmail, clientIp);
 
         User user = normalizedEmail == null ? null : userRepository.findByEmailIgnoreCase(normalizedEmail).orElse(null);