fix(deploy): allow any HTTPS host on sql.demo.altinity.cloud's connec…

CHANGELOG.md

@@ -81,6 +81,19 @@ auto-generated per-PR notes; this file is the curated, human-readable history.
   adapter refactor — no user-visible behavior changes.
 
 ### Fixed
+- **`sql.demo.altinity.cloud` couldn't reach any host via "Advanced — connect to
+  another server."** The chart-default `connectSrc` bounds CSP `connect-src` to
+  a fixed 4-origin allowlist (README.md/docs/DEPLOYMENT.md's documented
+  security posture — same origins as `config.hosts`), so typing any other
+  ClickHouse host into the Advanced field was silently refused by the browser
+  with a bare "Failed to fetch" (no CSP-violation surfaced anywhere in the UI —
+  tracked separately as a UX gap, #575). This shared instance is used ad hoc
+  against arbitrary clusters, so `deploy/helm/values-demo.yaml` now overrides
+  `connectSrc: "https:"` (any HTTPS origin) instead of inheriting the fixed
+  allowlist. The chart's own default in `helm/altinity-sql-browser/values.yaml`
+  is unchanged — this only loosens the one shared demo release, trading away
+  its origin-allowlist defense-in-depth for the ability to point it at any
+  cluster.
 - **A corrupt `asb:sidePanel` decodes to the Library instead of propagating**
   (#487). The lower pane's active section was read from localStorage undecoded,
   and every reader compared `=== 'saved'`, so an unrecognized or obsolete value

deploy/helm/values-demo.yaml

@@ -5,13 +5,31 @@
 #   helm upgrade --install sql-browser helm/altinity-sql-browser \
 #     -n demo -f deploy/helm/values-demo.yaml
 #
-# connectSrc + config inherit the 4-entry public-demo defaults from values.yaml
-# (antalya + github.demo, each in demo:demo and Google-SSO modes).
+# config inherits the 4-entry public-demo defaults from values.yaml (antalya +
+# github.demo, each in demo:demo and Google-SSO modes) — those are just the
+# login-picker shortcuts. connectSrc is overridden below: this instance is
+# used ad hoc (via "Advanced — connect to another server") against ClickHouse
+# hosts that aren't known in advance, so it can't be pinned to a fixed origin
+# list the way values.yaml's chart default documents for other installs.
 
 image:
   # Pinned to the v0.6.4 release image for reproducibility.
   tag: "0.6.4"
 
+# Chart default (values.yaml) bounds connect-src to a fixed origin allowlist —
+# the security posture documented in README.md/docs/DEPLOYMENT.md and this
+# project's own blog post. This release intentionally opts out of that bound:
+# it's the shared entry point used to reach arbitrary ClickHouse clusters via
+# the "Advanced — connect to another server" field (e.g. investigating a
+# customer cluster's connectivity), so the fixed 4-origin list blocked every
+# such attempt with a bare "Failed to fetch" (no CSP-violation surfaced in the
+# UI — see the linked issue). "https:" is a CSP scheme-source: any HTTPS
+# origin is allowed, non-TLS schemes are still blocked. This trades away the
+# origin-allowlist's defense-in-depth against exfiltration if the page is ever
+# compromised (XSS/supply-chain) — deliberate for this instance, not a change
+# to the chart's secure-by-default posture for other installs.
+connectSrc: "https:"
+
 service:
   type: ClusterIP
   port: 8080