chore: release 0.14.0 - and show a table-restricted key only its tables

allowed_tables now covers the schema too: GET /connections/<name>/schema and
MCP's list_tables list only the key's tables (a foreign key into another
shows as none), and table_ddl answers a forbidden table with the same 404
as a missing one. Docs and guides 16, 25 and 40 updated.

Release: version 0.14.0; CHANGELOG's Unreleased becomes 0.14.0 with
"Upgrading from 0.13"; SQLite and PostgreSQL upgrade fixtures for 0.14.0;
BACKLOG sequence updated. The legacy-JSON-import deprecation test is
SQLite-only, as the import is.

Author: AnanthaRajuC

BACKLOG.md

@@ -45,8 +45,10 @@ JWKS support.
 
 **Suggested sequence:**
 1. **0.13:** #61, #62, #69, #65, plus the #59 storage decision. (Released as 0.13.0 on 2026-10-04.)
-2. **1.0.0-rc1:** freeze; invite external users to upgrade real stores and report back.
-3. **1.0.0.**
+2. **0.14:** #64, #66, #67, #68, #71 and the how-to guides. (Released as 0.14.0 on 2026-10-04.)
+3. **#70**, the deployment-shape decision - the last item before the freeze.
+4. **1.0.0-rc1:** freeze; invite external users to upgrade real stores and report back.
+5. **1.0.0.**
 
 ## 1. Per-key API permissions
 
@@ -2039,7 +2041,7 @@ breaks its own promise.
 
 ## 65. Upgrade guarantee: every 0.x store upgrades or refuses clearly, tested in CI
 
-**Status: shipped.** PostgreSQL stores too: `<version>.postgres.tar.gz` (0.12.0, 0.13.0) are `pg_dump`
+**Status: shipped.** PostgreSQL stores too: `<version>.postgres.tar.gz` (0.12.0, 0.13.0, 0.14.0) are `pg_dump`
 output of the same estate, restored and started in the PostgreSQL CI job (`generate.py --postgres URL`). `tests/fixtures/stores/`
 holds a home built by each of 0.7.1, 0.8.0, 0.9.0, 0.10.0, 0.11.0 and 0.12.0 through its own API
 (`generate.py`); `tests/test_upgrades.py` starts the current code on each and checks connections, query versions

CHANGELOG.md

@@ -42,6 +42,24 @@ sooner, saying why. The list of what is deprecated now is `queryapigate/deprecat
 
 ## [Unreleased]
 
+## [0.14.0] - 2026-10-04
+
+The groundwork for 1.0's promise: a deprecation policy and an "experimental" label for what's outside it, a database
+support matrix with tiers, backups you can restore, Python 3.11 or newer - and all 40 how-to guides, whose writing
+found and fixed the access-control and packaging gaps listed under *Fixed*.
+
+### Upgrading from 0.13
+Read these first.
+- **Breaking: Python 3.11 or newer.** On 3.9 or 3.10, pip keeps installing 0.13.0. The Docker image is unaffected.
+- **No store migration**: the store stays at schema 5. Back up first anyway ([how](https://github.com/AnanthaRajuC/QueryAPIGate/blob/main/how-to/33-back-up-and-restore.md)).
+- **Coming from 0.9 or older?** Start 0.14 once before going further: 0.15.0 may stop importing the pre-SQLite JSON
+  files (*Deprecated*, below).
+- **Callers of `/execute_sql_from_file` or `/execute_sql_with_parameters_from_file`** should move to `/q/{name}`
+  before 0.15.0. Each process logs the first such call with the key that made it.
+- **A key with `"allowed_ips": []` now works from no address** (it used to work from any). Find any with
+  `GET /api/v1/api-keys` and set them to `null`, or to real addresses.
+- **A table-restricted key's schema shows only its tables** - a client that listed the rest no longer sees them.
+
 ### Breaking
 - **Python 3.11 or newer is required** (was 3.9). Python 3.9 reached its end of life in October 2025 and 3.10
   reaches its own this month, so neither is carried into 1.0. pip on 3.9 or 3.10 keeps installing 0.13.0, the last
@@ -84,11 +102,16 @@ sooner, saying why. The list of what is deprecated now is `queryapigate/deprecat
   /events`, `queryapigate events`), H2, JDBC and MongoDB connections, and alerts (`GET /api/v1/alerts`). Each is
   marked in its docs, with `x-experimental: true` in `/openapi.json`, with a tag in the Console (its Settings rows,
   the database-type picker, the Alerts screen), and with a warning in the log at startup while one is in use.
+
 ### Changed
 - **The one-command demo (`docker compose up`) seeds itself through the Management API** (`demo/seed.sh`) instead of
   copying the pre-SQLite JSON files that 0.14 deprecates.
 
 ### Fixed
+- **A table-restricted key sees only its tables in the schema.** `allowed_tables` refused statements on other
+  tables, but the schema browser and MCP's `list_tables` still listed every table and column on the connection, and
+  `table_ddl` showed any table's `CREATE TABLE`. Now the others are left out (and a foreign key pointing at one shows
+  as none), and `table_ddl` answers a forbidden table with the same `404` as a missing one.
 - **An empty `allowed_ips` list allows no address.** `"allowed_ips": []` on a key or role used to mean "no
   restriction" - failing open, unlike an empty `allowed_tables` or `allowed_write_ops`, which allow nothing. `null`
   is still how to say "any address"; the Console sends `null` for an empty field, as before.
@@ -1533,7 +1556,8 @@ First public release, restructured from the original single-file application.
 - JSON column order is preserved; Decimal, date and driver-specific number types serialise correctly.
 - Concurrent saves can no longer lose a version.
 
-[Unreleased]: https://github.com/AnanthaRajuC/QueryAPIGate/compare/v0.13.0...HEAD
+[Unreleased]: https://github.com/AnanthaRajuC/QueryAPIGate/compare/v0.14.0...HEAD
+[0.14.0]: https://github.com/AnanthaRajuC/QueryAPIGate/releases/tag/v0.14.0
 [0.13.0]: https://github.com/AnanthaRajuC/QueryAPIGate/releases/tag/v0.13.0
 [0.12.0]: https://github.com/AnanthaRajuC/QueryAPIGate/releases/tag/v0.12.0
 [0.11.0]: https://github.com/AnanthaRajuC/QueryAPIGate/releases/tag/v0.11.0

documentation/API.md

@@ -790,6 +790,9 @@ connections, the dialects QueryAPIGate can actually parse for this - **a table-r
 type, never silently left unrestricted.** Table names are matched case-insensitively and bare (not
 schema-qualified), the same simplification `allowed_write_ops`'s keyword list already makes; a table-valued
 function (e.g. ClickHouse's `numbers(10)`) touches no real table, so this can't meaningfully restrict one.
+The key's view of the schema follows the same list: `GET /connections/<name>/schema` and MCP's `list_tables` leave
+other tables out (a foreign key pointing at one shows as `null`), and `table_ddl` answers a forbidden table with the
+same `404` as a table that doesn't exist.
 
 Omitted (or `null`) means no restriction, exactly today's behaviour. `PATCH /api/v1/api-keys/<name>` with an
 explicit `{"allowed_tables": null}` clears an existing restriction, the same pattern the other grant fields

documentation/THREAT_MODEL.md

@@ -221,10 +221,6 @@ Being explicit about these is as important as everything above:
 - **Connection metadata (hosts, ports, usernames, database names) is visible to the admin key** -
   `GET /api/v1/connections` is admin-only, and passwords are always masked, but the rest is not treated as
   secret.
-- **`allowed_tables` limits what a statement touches, not what a key can see of the schema.** A key with a
-  `connections` grant can list every table and column on that connection (the schema browser, `table_ddl`,
-  MCP's `list_tables`) - names and structure, never rows of a forbidden table. Hide a table's existence with
-  database permissions.
 - **Names can be probed.** A saved query a key can't reach answers `403` naming its connection; a name that
   doesn't exist answers `404`. Don't put anything sensitive in query or connection names.
 - **`/metrics` is intentionally unauthenticated**, on the assumption that a metrics scraper shouldn't need

how-to/16-restrict-a-key-to-tables.md

@@ -54,7 +54,7 @@ Saved queries are checked the same way, every time they run. `orders_by_status`
 Writes are checked too: if the key also has `allow_writes`, `UPDATE`/`DELETE`/`INSERT` are allowed only on listed
 tables.
 
-## Where it isn't enforced
+## What else it covers, and where it stops
 
 - **Database types:** supported for PostgreSQL, MySQL, SQLite, DuckDB and ClickHouse - the dialects the parser
   handles. On an `h2`, `jdbc` or `mongo` connection a table-restricted key is **refused on every query** (`403`
@@ -63,10 +63,9 @@ tables.
 - **Table names, not schemas:** entries are bare names matched case-insensitively. `orders` allows `orders` in any
   schema the connection can see. If two schemas both have an `orders` table, this can't tell them apart - use a
   database user that sees only one.
-- **Structure stays visible:** `allowed_tables` limits what a statement can read or change, not what the key can
-  *see* of the schema. The schema browser (`GET /connections/shop/schema`), `table_ddl` and MCP's `list_tables` list
-  every table and column on the connection, forbidden ones included - their names and columns, never their rows. If
-  a table's existence is itself sensitive, put it out of the connection's reach with database permissions.
+- **The schema shows only the listed tables.** The schema browser (`GET /connections/shop/schema`) and MCP's
+  `list_tables` leave the others out, and a foreign key pointing at one shows as none. `table_ddl` for a forbidden
+  table answers `404` - *'salaries' is not a table on 'shop'* - exactly as for a table that doesn't exist.
 - **Table-valued functions** (ClickHouse's `numbers(10)`, DuckDB's `read_csv(...)`) touch no named table, so the
   list can't restrict them.
 

how-to/25-mcp-ad-hoc-tools.md

@@ -83,10 +83,9 @@ An agent can read the `code` and adjust - ask for different tables, drop the wri
 
 ## Keep in mind
 
-- **`list_tables` shows every table on the connection**, including ones `allowed_tables` forbids - names and columns,
-  never rows. The same is true of the saved-query tools listed from a `connections` grant: `salary_list` appears
-  above but fails with `table_not_allowed` when called. If the agent shouldn't know a table exists, keep it out of
-  the connection's reach with database permissions.
+- **`list_tables` shows only the tables `allowed_tables` permits** - for this key `customers`, `orders` and
+  `products`, not `salaries`. Saved-query tools are listed by the key's grants alone, though: `salary_list` appears
+  above, and fails with `table_not_allowed` when called. Keep a query the agent mustn't see out of its collections.
 - **Results are capped** at `QUERYAPIGATE_MCP_MAX_ROWS` rows (default 200) - see
   [Read structured MCP results properly](26-mcp-structured-results.md) for `truncated` and `page_size`.
 - **Everything is recorded.** Each `execute_sql` call is an ad-hoc run in run history with `"transport": "mcp"`, the

how-to/40-read-the-threat-model.md

@@ -77,8 +77,6 @@ with `from_claim` parameters so each user only ever sees their own rows. List th
 These are by design or not yet addressed - plan around them rather than discover them:
 
 - **The admin key has no limits** inside QueryAPIGate. Database grants are the backstop.
-- **`allowed_tables` hides rows, not structure.** A key with a `connections` grant can list every table and column on
-  that connection, forbidden ones included ([guide 16](16-restrict-a-key-to-tables.md)).
 - **Names can be probed.** A saved query a key can't reach answers `403` naming its connection; a missing name answers
   `404`.
 - **The MCP server ignores `QUERYAPIGATE_TRUST_PROXY`**, so behind a proxy it can't tell MCP callers' addresses apart.

queryapigate/__init__.py

@@ -1,5 +1,5 @@
 """QueryAPIGate - expose SQL databases as a REST API."""
-__version__ = '0.13.0'
+__version__ = '0.14.0'
 
 from .app import create_app  # noqa: E402  (app imports __version__)
 

queryapigate/app.py

@@ -855,7 +855,7 @@ def connection_schema(name):
     database = request.args.get('database') or None
     if database and not g.permission.admin:
         raise ApiError('Only the admin key may browse a different database on this connection', 403, code='admin_only')
-    return jsonify(schema.fetch_schema(name, database=database)), 200
+    return jsonify(schema.fetch_schema(name, database=database, allowed_tables=g.permission.allowed_tables)), 200
 
 
 @bp.route('/connections/<name>/table_ddl', methods=['GET'])
@@ -869,7 +869,8 @@ def connection_table_ddl(name):
     database = request.args.get('database') or None
     if database and not g.permission.admin:
         raise ApiError('Only the admin key may browse a different database on this connection', 403, code='admin_only')
-    return jsonify(schema.fetch_table_ddl(name, table, database=database)), 200
+    return jsonify(schema.fetch_table_ddl(name, table, database=database,
+                                          allowed_tables=g.permission.allowed_tables)), 200
 
 
 # --------------------------------------------------------------------------------------

queryapigate/mcp_server.py

@@ -235,7 +235,7 @@ def list_tables_tool(permission, arguments):
     if error is not None:
         return error
     try:
-        result = schema.fetch_schema(connection_name, database=database)
+        result = schema.fetch_schema(connection_name, database=database, allowed_tables=permission.allowed_tables)
     except ApiError as error:
         return _error(error.message, error.status, error.code)
     return {'content': [{'type': 'text', 'text': json.dumps(result)}], 'structuredContent': result}