feat: set hide params to true postgres engine [DIA-86641] (#398)

Author: erikkostashuk

README.md

@@ -149,6 +149,24 @@ And define the environment variable `sqlalchemy_url` with `postgres+asyncpg` sch
 export sqlalchemy_url=postgresql+asyncpg://postgres@localhost
 ```
 
+### Hiding SQL parameters
+
+By default, `hide_parameters` is set to `True` on all engines to prevent SQL query
+parameters from appearing in error messages and logs. This helps protect sensitive data
+such as PII/PHI.
+
+To disable this (e.g. for local debugging or dev):
+
+```bash
+export sqlalchemy_hide_parameters=false
+```
+
+For named sessions:
+
+```bash
+export fastapi_sqla__read_only__sqlalchemy_hide_parameters=false
+```
+
 ## Setup the app AsyncContextManager (recommended):
 
 ```python

fastapi_sqla/async_sqla.py

@@ -1,4 +1,3 @@
-import os
 from collections.abc import AsyncGenerator
 from contextlib import asynccontextmanager
 from typing import Annotated, Union
@@ -17,7 +16,12 @@
 from starlette.types import ASGIApp, Message, Receive, Scope, Send
 
 from fastapi_sqla import aws_aurora_support, aws_rds_iam_support
-from fastapi_sqla.sqla import _DEFAULT_SESSION_KEY, Base, get_envvar_prefix
+from fastapi_sqla.sqla import (
+    _DEFAULT_SESSION_KEY,
+    Base,
+    _get_engine_config,
+    get_envvar_prefix,
+)
 
 logger = structlog.get_logger(__name__)
 
@@ -29,9 +33,8 @@ def new_async_engine(
     key: str = _DEFAULT_SESSION_KEY,
 ) -> Union[AsyncEngine, AsyncConnection]:
     envvar_prefix = get_envvar_prefix(key)
-    lowercase_environ = {k.lower(): v for k, v in os.environ.items()}
-    lowercase_environ.pop(f"{envvar_prefix}warn_20", None)
-    return async_engine_from_config(lowercase_environ, prefix=envvar_prefix)
+    config = _get_engine_config(envvar_prefix)
+    return async_engine_from_config(config, prefix=envvar_prefix)
 
 
 async def startup(key: str = _DEFAULT_SESSION_KEY):

fastapi_sqla/sqla.py

@@ -8,6 +8,7 @@
 from fastapi import Depends, Request, Response
 from fastapi.concurrency import contextmanager_in_threadpool
 from fastapi.responses import PlainTextResponse
+from pydantic import BaseModel
 from sqlalchemy import engine_from_config, text
 from sqlalchemy.engine import Connection, Engine
 from sqlalchemy.ext.declarative import DeferredReflection
@@ -38,6 +39,15 @@
 _session_factories: dict[str, sessionmaker] = {}
 
 
+class _EngineConfig(BaseModel):
+    """Engine configuration with typed defaults and bool coercion."""
+
+    hide_parameters: bool = True
+
+    class Config:
+        extra = "allow"
+
+
 class Base(DeclarativeBase, DeferredReflection):
     __abstract__ = True
 
@@ -50,11 +60,31 @@ def get_envvar_prefix(key: str) -> str:
     return envvar_prefix
 
 
+def _get_engine_config(
+    envvar_prefix: str,
+) -> dict[str, Union[str, bool]]:
+    """Build engine config dict with opinionated defaults and type coercion."""
+    lowercase_env: dict[str, Union[str, bool]] = {
+        k.lower(): v for k, v in os.environ.items()
+    }
+    lowercase_env.pop(f"{envvar_prefix}warn_20", None)
+
+    overrides = {
+        k[len(envvar_prefix) :]: v
+        for k, v in lowercase_env.items()
+        if k.startswith(envvar_prefix)
+    }
+    config = _EngineConfig(**overrides)  # type: ignore[arg-type]
+    for param, value in config.dict().items():
+        lowercase_env[f"{envvar_prefix}{param}"] = value
+
+    return lowercase_env
+
+
 def new_engine(key: str = _DEFAULT_SESSION_KEY) -> Union[Engine, Connection]:
     envvar_prefix = get_envvar_prefix(key)
-    lowercase_environ = {k.lower(): v for k, v in os.environ.items()}
-    lowercase_environ.pop(f"{envvar_prefix}warn_20", None)
-    return engine_from_config(lowercase_environ, prefix=envvar_prefix)
+    config = _get_engine_config(envvar_prefix)
+    return engine_from_config(config, prefix=envvar_prefix)
 
 
 def startup(key: str = _DEFAULT_SESSION_KEY):

tests/test_sqla_startup.py

@@ -190,3 +190,52 @@ def now():
         res = await client.get("/one")
 
     assert res.json() == 1
+
+
+def test_new_engine_hide_parameters_default(monkeypatch):
+    from fastapi_sqla.sqla import new_engine
+
+    monkeypatch.delenv("sqlalchemy_hide_parameters", raising=False)
+
+    engine_or_conn = new_engine()
+
+    assert engine_or_conn.engine.hide_parameters is True
+
+
+def test_new_engine_hide_parameters_opt_out(monkeypatch):
+    from fastapi_sqla.sqla import new_engine
+
+    monkeypatch.setenv("sqlalchemy_hide_parameters", "false")
+
+    engine_or_conn = new_engine()
+
+    assert engine_or_conn.engine.hide_parameters is False
+
+
+@mark.require_asyncpg
+@mark.sqlalchemy("1.4")
+async def test_new_async_engine_hide_parameters_default(monkeypatch, async_session_key):
+    from fastapi_sqla.async_sqla import new_async_engine
+
+    monkeypatch.delenv(
+        f"fastapi_sqla__{async_session_key}__sqlalchemy_hide_parameters",
+        raising=False,
+    )
+
+    engine_or_conn = new_async_engine(async_session_key)
+
+    assert engine_or_conn.sync_engine.hide_parameters is True
+
+
+@mark.require_asyncpg
+@mark.sqlalchemy("1.4")
+async def test_new_async_engine_hide_parameters_opt_out(monkeypatch, async_session_key):
+    from fastapi_sqla.async_sqla import new_async_engine
+
+    monkeypatch.setenv(
+        f"fastapi_sqla__{async_session_key}__sqlalchemy_hide_parameters", "false"
+    )
+
+    engine_or_conn = new_async_engine(async_session_key)
+
+    assert engine_or_conn.sync_engine.hide_parameters is False