Changes

Beta: The data service is published as a beta version. Features, configuration, and interfaces can change before the first released version.

What changes for users, operators, and programs. The data service is published as a preview and doesn't have a released version yet, so this file lists dated preview updates and the versions of the contract package Wkl.Data.Gateway.Contracts, which programs and the .NET client consume. When the contract gains something new, reference pages name the version it applies from („since contract 0.x“).

• Session context for every request: Besides wkl.person, wkl.key, and wkl.role, the service now writes, read-only and for every request, wkl.client (caller), wkl.method (sign-in method), wkl.alias, wkl.request (correlation ID as in the access log), and wkl.rules (all of the caller's rules), plus wkl.rule (the access rule that allows the resource), wkl.session (second-factor session), and wkl.person_id (the person's number in administration). Previously there were values only for a personal key and a chosen identity; now also for a service key, a Windows account, and a SQL Server login.
• Assignment by the person's number: A view that filters rows by person should compare with wkl.person_id rather than the name; the number stays the same when the person is renamed. See Row-level restriction and Restrict agents to their customers.
• Providers: Provider contract 1.8, provider for SQL Server 1.9.0. A provider for an earlier contract keeps working and doesn't write the new values.

• License: The service reads its license (a .lic file from the purchase at wvds.it) without a network and without activation, preferably from %PROGRAMDATA%\WKL\Licenses\. It checks at start and every hour and writes the result to Event Viewer (event IDs 9100 to 9109). Without a valid license it keeps working fully: a 30-day evaluation, then a notice in the log. Callers see none of it. See Store the data service's license.

• Failed update: If an update fails, the previous version runs as before: registered, with its configuration, its firewall rule, and its store. Previously it was left without configuration and registration, and the service didn't start.
• Administration store: New installations create the store as dbgwsvc.db and the log file as dbgwsvc-logs.db; previously gateway.db and gateway-logs.db. An update renames the existing files in the data folder; if the update is rolled back, the files get their former names back. A store configured elsewhere by hand (Gateway:Store:Path) keeps its name.
• Backups: backup-store --to-folder and the backup from the administration app name the copy after the store, that is dbgwsvc-<time>.db; backups with the former name stay valid.
• Helper scripts in the program folder: dbgwsvc-Erster-Administrator.cmd and dbgwsvc-Zertifikat-LetsEncrypt.cmd, previously without dbgwsvc-.
• WKL Database Update service: The program is dbgwupd.exe, previously Wkl.Data.Update.exe; commands read, for example, dbgwupd.exe status kunden. The Windows service keeps its name Wkl.Data.Update and so its account NT SERVICE\Wkl.Data.Update; that account's database logins stay valid.

• Built-in mail templates: The three built-in templates have a light header with the partner's logo (src="cid:brand") and the mark of The White Knight Labs at the bottom (src="cid:logo"); the client attaches both images. The administration store now has schema version 28: at startup, every built-in template that still has the previously shipped text gets the new one; a template that an administrator changed stays as it is.

• Request limit: The budget per caller refills continuously (RateLimit:PerCaller per WindowSeconds, by default 1,200 a minute, that is 20 a second) instead of all at once at the end of a fixed period; after a pause up to RateLimit:Burst requests are free at once (default 600). A caller that keeps working is slowed to the rate instead of being refused until the minute ends. Every 429 of the limit says in Retry-After when the next request passes; the ODBC driver from 0.8.2 on waits that long and continues reading.
• Audit: Gateway:AuditLog:Days defaults to 365 days (previously 90); that covers, for example, the six months Slovenia's ZInfV-1 requires for security logs. When the log file reaches its size, the service removes the oldest entries first; see Configuration.
• Retention and file size in the administration: the settings audit_days (1–3650 days) and log_max_megabytes (64–65,536 MB) of the Settings set take precedence over Gateway:AuditLog:Days and Gateway:Store:LogMaxMegabytes and apply without a restart; a value outside the limits is refused with a message. ServiceStatus now includes LogMaxMegabytes. The administration store moves to schema version 27; it converts itself at startup.
• GET /odata/v4 without an alias: The list of aliases comes back with 200 again; before, the service answered 400 and wrote an exception to its log.
• Program file dbgwsvc.exe: The service's program is named dbgwsvc.exe (with dbgwsvc.dll) instead of Wkl.Data.Gateway.exe; you call every command with it, for example dbgwsvc.exe init-admin. The update replaces the old file and the path in the service. The service name, service account, data folder, and event source stay Wkl.Data.Gateway.

• Connection test: For a SQL Server on the same computer, a missing login or database is now reliably reported as such (18456 or 4060), no longer as network error 233. After 233 the test tries again at once and then a third time after 250 ms; a server that is really unreachable costs 250 ms more.
• Messages: The service's messages, hints, and output now spell German umlauts and ß as such („Schlüssel“, „lässt“, „für“) instead of „ae“, „oe“, „ue“, „ss“. Programs that compare a message text should evaluate the HTTP status code or the code field, not the text. Audit values such as „geaendert“ or „geloescht“ stay unchanged.

• The OData surface honors Prefer: odata.maxpagesize=n for a read without $top: pages up to MaxTop, confirmed in Preference-Applied, next pages as before. A client that reads only keys needs a tenth of the requests. Without the header, nothing changes.

• A range of the key of an administration set, ordered by the key, is now read in the administration store. An example is ChangeLog?$filter=Id le 62030&$orderby=Id desc. Before, the service read the whole table for every window. With 62,000 entries that cost about 1.5 s per window, and the newest 1,000 entries over the ODBC driver took 3.4 s.
• Results and their order stay the same. The service answers other conditions in memory, as before.

• A query of AuditEntries with Reason ne null (refused requests only) now narrows the log file itself, like the period and the person already did. The cap of 20,000 entries per query then applies to the refusals; before, older refusals could be missing when newer served requests filled the cap (for example in a person's refusals in the administration app when the person has many requests).

• The administration set ServiceStatus names how far back the logs reach: AuditDays (retention of the access log), AuditOldestAt (oldest access kept), and SignInEventDays (retention of the sign-in events). An administration app can use them to name the span of a log page instead of writing „since the service started“.

• An entry whose key contains a slash (such as the network range 10.0.0.0/8 of a sign-in rule, or a path) can now be read, changed, and removed through its address. The slash arrives encoded as %2F; the service didn't find the entry and answered 404, which Access reported as a write conflict (error 3197). This applies to the administration and to the data interface. A value that itself contains the characters %2F stays unchanged.

• The row version (Version) of a set now covers only the values of the row itself. Numbers and names from other sets (Persons.Rules, ClientRules.Holders, Person in PersonRules, PersonalKeys and SessionTokens, DataSource and Role of the identity assignments) no longer change it. Before, deleting a person right after deleting its rules ended in Access with a write conflict (3197), and so did an edit while someone assigned a rule.

• Persons has the fields LastSignInAt and LastSignInMethod (last successful sign-in, read-only) and LeftAt (exit date, set by the administration). Dormant accounts and the time from exit to lock can be shown with them. The administration store gets schema 26.

• SessionTokens has the fields EndReason and EndedBy: how a second-factor session ended (ended in the administration, person locked, key revoked, second factor set up again or removed, expired) and who ended it. When the administration locks a person or revokes a key, their sessions end in the same step. Sessions are no longer deleted when the second factor is set up again or removed. The administration store gets schema 25 for this.

• AuditEntries has two new fields: Target names what a request addressed (path and query, such as …/Vertraege(17) or …?$filter=Nr eq 17), and AccessRule names the access rule that allowed an answered request to a table or view, with its version. ClientRules shows each rule's current version in RuleVersion. An existing log file gets the columns at startup; older entries leave them empty. See How to trace an access decision.

• The installation program and the MSI package place sbom.cdx.json in the program folder: the software bill of materials (SBOM) in CycloneDX 1.6 format, with every installed file and its checksum and the third-party components it contains. Every delivery also includes it as Wkl.Data.Gateway-<version>.sbom.cdx.json. See Installation package.

• test-connection: A refused login to a SQL Server on the same computer sometimes arrived as 233 with failure: Network („the database server couldn't be reached“), although the login or the database was missing. The test now opens without the connection pool and, after 233, a second time at once; it then reports Login (18456) or Database (4060). See Administration interface.

• The access log (audit) survives a restart: with an administration store, the service writes it to the log file once a minute and keeps it for Gateway:AuditLog:Days (default 90 days). AuditEntries reads from there; before, it held only the last 10,000 entries since start. See Gateway:AuditLog.
• Every log can be turned off; all are on by default: accesses with Gateway:AuditLog:Enabled, the change log with Gateway:Store:ChangeLog, and the sign-in and load logs, as before, with Gateway:SignInLog:Enabled and Gateway:LoadLog:Enabled.

• The installation program first opens Select language (the Windows display language is preselected) and then shows all pages and messages in German, English, or Slovenian; previously in German only. The suggested installation name follows the language; properties and command line are the same. See Install the data service.
• The MSI package contains the same three languages: dialogs in German, with TRANSFORMS=:1033 in English, with TRANSFORMS=:1060 in Slovenian. See Installation package.

• Custom statements: a column without a name (SELECT COUNT(*) …, SELECT 1 …) or with a name already taken also carries the database's name in label (empty, or the repeated name); name stays the key of the values in the rows (Column2, Nummer1). The ODBC driver thus shows the same names as ODBC Driver 18. See HTTP: native API.
• SQL Server provider 1.8.0 (requires provider contract 1.7).

• Checked statements accept the date part in DATEPART, DATEADD, DATEDIFF, DATENAME, DATETRUNC, and DATE_BUCKET (DATEPART(month, Datum), DATEADD(day, 30, Datum)). Previously, the service rejected them with 403 („Die Form 'IdentifierLiteral' …“), although the functions are allowed; they worked with ODBC Driver 18.

• hierarchyid, geography, and geometry now appear in the schema document and in every read, as a binary value with the stored bytes—the same ones ODBC Driver 18 returns. sql_variant appears as text in the form of its base type. Until now these columns were missing, and a custom statement with such a column ended in 503. See Timestamps, numbers, and names.
• OData: a comparison in $filter or a sort in $orderby on a column that SQL Server doesn't compare or sort that way (text, ntext, image, xml, spatial types, sql_variant) is rejected by the service with 400. Until now the database answered 422, and for sql_variant a silently empty result.
• Custom statements: columns names the database's type (storeType) and marks an identity column ("identity": true).

• New: the „WKL Database Update“ service with its own installation package Wkl.Data.Update-<version>.msi. It applies signed database update packages where no data service runs, by the same rules as the update module. Without connection.secret, it signs in with its own Windows account. You administer it on the server with Wkl.Data.Update.exe from an elevated command prompt; see WKL Database Update service (reference). It sends mail on the email channel through the mail server named by mail in the protected configuration, always encrypted (TLS on port 465, otherwise STARTTLS).
• The update module now accepts protected configurations that start with a byte order mark (UTF-8 with BOM, as Windows PowerShell 5.1 writes with Set-Content -Encoding UTF8); it used to leave the database out as „not valid JSON“.

• An attempt the server gives no readable answer to (503) now counts as a failed attempt of the SQL login and of its origin. When SQL Server runs on the same machine and is reached over Shared Memory or Named Pipes, the first refusal after the provider was loaded arrived as 503 instead of 401, although the server had checked the password; such attempts used to escape the limit of 5 per login and 20 per origin within one minute.
• During a real outage of the server, the service answers 429 instead of 503 after 5 attempts of one login, until the minute is over.

• When a browser sends a state-changing request (POST, PUT, PATCH, DELETE) on behalf of another website, the data service refuses it with 403 and the code FORBIDDEN. It relies on the browser's Sec-Fetch-Site header; without it, Origin must name the scheme, host, and port of the request. Until now, another website could trigger such requests with the Windows sign-in or a remembered password, which the browser sends automatically.
• Programs that aren't browsers (the ODBC driver, the .NET client, Excel, Power BI, scripts) send neither header and aren't affected.
• The body of a state-changing request must carry Content-Type: application/json (uploaded files application/octet-stream); otherwise the service answers 400 with the code BAD_REQUEST. The query options in $query as text/plain are the exception. The driver, the .NET client, and the administration application already send these types; scripts that send a body without a type (such as curl -d without -H) must add it.

• The update module applies signed database updates to the databases for which the folder `Gateway:Updates` holds a protected configuration: backward-compatible packages at once or after confirmation, breaking ones after an announcement to the running applications, as soon as no older version is still running.
• New administration commands: update-databases, update-status, update-history, confirm-update, dismiss-update, retry-update, move-update-deadline, cancel-update-notice, upload-update (database updates).
• The operating settings per database are kept in the administration store (schema version 21) and changed in the set UpdateSettings: confirmation for backward-compatible and breaking packages, lead time of the announcement, time window for open sessions.
• The module reports what becomes of a package in the event log (event IDs 4101–4106) and, if chosen, in one file per day under %ProgramData%\Wkl.Data.Gateway\logs\updates (reports); administration store schema version 22.
• If chosen, the module also reports by mail, through the service's mail settings (Gateway:Mail), to the recipients of the database (NotifyEmail, NotifyEmailTo in UpdateSettings); administration store schema version 23.
• After each backup, the module removes old backups of the same database (BackupKeepCount, BackupKeepDays in UpdateSettings) when it can reach the backup folder (backup retention); administration store schema version 24.
• setup-host (installation package) creates the folder updates in the data folder, which only Administrators and System change and the service account reads, and sets it as Gateway:Updates:Folder.

• setup-host --mode iis (installation package with GW_MODE=iis) sets AuthMode to PersonalKey. Before, Windows sign-in was enabled behind IIS as well. It applies to the connection, and IIS with Application Request Routing shares its connections to the service among users, so one person's sign-in could carry another person's request. An existing installation behind IIS loses Windows sign-in when updated; people sign in with their personal key.
• If AuthMode contains Windows and TrustedProxies names a proxy, the service logs a warning at startup.

• save-person changes only what's given for an existing person. Before, without --login the command removed the SQL Server login, and without --disabled it enabled the person again. New: --no-login, --no-rules and --enabled; without --rule, the rules stay.
• save-person refuses a rule that isn't in the administration store and lists the existing ones. Before, a typo gave the person no rights, and every later change in the administration failed with 422.
• init-admin takes only a rule that may change the administration with every one of its methods, and admin-status counts only such people as administrators.

• A value of a decimal or numeric column with more than 28 digits, up to the 38 of decimal(38, s), is read and written with every digit. Until now reading such a row failed with 503, and writing refused the value with 400; an amount with 29 digits was silently rounded to 28 when written.

• An amount that the body of a write sends in exponent notation (1.2345678901234567890E2) reaches a decimal column with all of its digits. Before, it passed through a floating-point number and was rounded to 15 significant digits (123.456789012346). Floating-point and text columns receive the same value as before; procedure arguments are still bound as float.

• test-connection opens the connection exactly once. Until now, after an error such as 4060 (database can't be opened), the database driver tried a second time on its own after 10 seconds, and the test reported what that second attempt returned. That wasn't always the server's answer: a missing database occasionally showed up as network error 233 (failure Network instead of Database). The test now reports the first answer, without the 10-second wait. Requests to the data source still retry.

• Installer 1.0.8 closed without a message after Weiter (Next) on the page Willkommen (Welcome): the German and Slovenian license texts were missing from the program. From the next installer on, all three versions are included.

• The data service's product name is now WKL Database Gateway, in every language. The installer, Apps & features, the Start menu, the Windows service's display name, the file properties, and the license, security, and manufacturer information use it.
• The technical name Wkl.Data.Gateway stays: the service name, program files, packages, folders, and event source don't change. Scripts and monitoring that use the service name keep working.

• GET /schema-state/{alias}/{product} returns the schema state of a versioned database, so the WKL Bootstrapper offers only matching application versions; sign-in with Windows, without sign-in only with Gateway:SchemaState:Anonymous. See HTTP: native API.
• X-Wkl-Application: applications report product and version; per alias, the service remembers which version last made a request. See HTTP: native API.
• The included SQL Server provider has version 1.3.0.

• Manufacturer EMSR DATA, D.O.O. File properties, package, installer, and „Programs and Features“ name the company EMSR DATA, D.O.O. instead of „The White Knight Labs“, together with contact and website. Identifiers stay the same: service name Wkl.Data.Gateway, program folder, package IDs; an update recognizes the existing installation.
• New files in the program folder. THIRD-PARTY-NOTICES.txt with the third-party components and their licenses, the notices of the .NET runtimes, SECURITY.md (reporting vulnerabilities, supported versions), and MANUFACTURER.md (manufacturer information), the last two in English, German, and Slovenian; see Installation package.
• License terms. The installer and the package show the license terms of EMSR DATA before installation; you can continue only after accepting them. They are in the program folder and in every NuGet package as LICENSE.md (binding, English), LICENSE.de.md, and LICENSE.sl.md; see Install the data service.
• All of the product's own libraries signed. Besides the program, the package, and the installer, every library of the product (Wkl.*.dll), including the providers, is now signed in a delivery.

• The administration $metadata no longer has Aggregation.ApplySupported. The administration interface rejects $apply but announced it, so the ODBC driver sent MAX, SUM, COUNT(column) and groupings (for example from DMax in Access) as requests that failed with 400. Now the driver rejects them itself; DCount("*", …) counts as before. What is counted and how to read the highest value: Counting, highest value and grouping.

• An existing win-acme orders and renews. If the machine already renews with another copy of win-acme (version 2.2.9 or later), the order uses it, and its task stays; an older version stops the order with a message. On removal, win-acme's task goes only if it starts the bundled win-acme. See Installation package.

• New „SQL Server“ step in the installer. It writes a script for the database administrators to the data folder (default), or creates the service account's login and a user per database right away, with the Windows account of the person installing. Anything that exists stays unchanged. See Install the data service.
• New command service-login for the same after the installation, plus setup-host --sql-server and the package properties GW_SQL_SERVER, GW_SQL_DATABASES, and GW_SQL_ROLES for software distribution. See Commands.

• Answers without Server: Kestrel. The service no longer names its server software. Behind IIS, an IIS setting removes the header IIS adds itself; see Run the service behind IIS or a proxy.

• RuleVersion in SignInRules. Every stored rule names the version that sign-in events and explain-sign-in name, so „rule changed since“ is visible without a further call.
• New set SignInFileRules. It shows sign-in rules that are still in the configuration file but aren't in force with an administration store (InForce = false). Described under administration.

• New conditions of a sign-in rule. Operators/ExceptOperators (network operators such as AS3320), Clients/ExceptClients (kind of program from the User-Agent, claimed by the client) and Hours/ExceptHours (time windows such as Mon-Fri 06:00-20:00); an exception takes Operators, Clients and Hours. Described under By network operator, program and time.
• Your own networks by name. From and ExceptFrom of a rule and From of an exception may name one of your own networks from Gateway:SignInLog:Networks.
• Signals with their reliability. The sign-in event also names operator, client and, per signal, trust (observed, claimed, verified) in Signals. explain-sign-in takes operator, client and at per origin.
• Administration store schema 20.

• Try a rule. A sign-in rule has a mode: Enforce (default) or Report. A rule on trial is judged at every sign-in but changes no decision; the sign-in event records what it would have done. Administration store schema 19. Described under Try a rule.
• Evaluation per rule. The new set SignInRuleReports counts, per rule on trial and version, the sign-ins it would have hit, with the number of people and origins.
• explain-sign-in shows rules on trial separately under tried.

• Deciding rule in the sign-in event. SignInEvents names, in Rules, the sign-in rules the decision was based on, with identifier and version, including a rule an exception lifted, and the administration's lower bound; Signals names country and second factor. Described under Grounds of the decision.
• Denying rule in the audit. AuditEntries names, in SignInRule, the rule that denied a request; the audit stream writes it after the reason.
• Version in explain-sign-in. The explanation names id and version for every rule, so an earlier event can be compared with the rule as it stands today.

• Providers in the administration. The set DataSources reads and writes Provider, ProviderVersion, and ProviderOptions like the configuration file (administration store schema 18). The new sets Providers and ProviderProperties show the installed provider packages and the properties each describes for its connection.
• Connection as properties. Instead of a string, DataSources takes the connection as ConnectionProperties; the provider builds and checks the string from them. When read, the properties appear without the password; a password missing on update is kept. Described under connection properties of a provider.
• Connection test with the kind of failure. On failure, test-connection names the database's number (number) and a kind independent of the server's language (failure: Login, Database, Permission, Network, Timeout, Unreadable, Configuration, Other); see connection test and service account.
• Service account. New command GET /admin/v1/service-account: the account under which data sources with Windows authentication sign in to the database, as a SQL Server on the same and on another machine sees it. The installation describes what SQL Server needs for this account.
• Provider contract 1.3. Optional description of connection properties and kind of failure of the connection test; a provider for contract 1.2 still loads. The shipped SQL Server provider has version 1.2.0.
• Setup fix: installation name. The setup program didn't pass the installation name you entered on to the installation package; the service got the suggestion „Datendienst (computer name)“ instead, and the authenticator app showed that. From setup 1.0.7, the name you enter arrives. For an existing installation, correct it in the administration with the setting installation_name (see administration); the new name applies to second factors set up afterward.

• A log file of its own. The sign-in log and the load log live in a log file next to the administration store (gateway-logs.db), limited by Gateway:Store:LogMaxMegabytes (default 4,096 MB); the oldest entries go first. At the first startup, the service moves existing logs out of the store into it (store schema 17). People are referred to there by their ID; a rename keeps the history.
• Individual events without an age limit. Gateway:SignInLog:EventDays no longer deletes anything; it only sets how far back SignInOrigins and SignInEvents read without a time condition of their own. SignInEvents reads conditions on Person, At, and Id from the log file; the limit of 20,000 applies per request to what matches.
• Sign-in rules with a memory. Ten rules compare each sign-in with the previous 90 days and store findings with a stable Id in the new set `SignInFindings`; „since the last look“ is Id gt x. Without the sign-in-events right, person, key, and comparison values stay empty.
• Reporting findings. Findings at level act appear as warnings in the service log and, with Gateway:SignInLog:Alerts:Recipients, go out by email right away; findings at level ask go out once a day as a digest. New section `Gateway:Mail`.
• Sign-in profile. New command `sign-in-profile`: what is usual for a person over 90, 180, 365, or more days.
• Stored load hints. New set LoadFindings with a stable Id, filled hourly from the hints of LoadAdvice.
• Backup. backup-store backs up the log file too (…-logs.db next to the copy of the store); the response of the HTTP command also names logFile and logBytes.

• Deleting a person with traces is refused. If a person has a personal key or a session, entries in the sign-in log or the load log, or wrote changes themselves, DELETE on Persons returns 422; the person can only be disabled (Enabled = false). This keeps the logs attributable to a person. See Retention and deletion.

• Rules by country. Sign-in rules name countries (Countries, ExceptCountries, ISO 3166-1 alpha-2 codes), for example „data access only from Germany“. The service reads the country from the geolocation database of the sign-in log. A country that can't be determined falls within the scope of the rule; exclude your own networks by their addresses. See sign-in policy.
• Exceptions with an end. Exceptions spares requests that meet all attributes at once (people, Windows groups, countries, networks) until an end in UTC—for example one person also from Thailand for two weeks. The end appears in the change log (exception-lapsed).
• Administration API. New sets SignInRuleExceptions and SignInRuleExceptionItems, new attributes country and except_country; save-sign-in-rule accepts countries, exceptCountries and exceptions; explain-sign-in names the country and the sparing exception and accepts a country per origin. New reason deniedByCountry in the sign-in log.
• Administration store schema 16. The service converts a store at first start and backs it up first.

• Load log. For each shape of request—the request without its values—the service records how often it came, how long it took in the service and in the database, how many rows and bytes it returned, and how often it failed. New sets LoadShapes, LoadHours, SlowRequests, LoadAdvice, and, only with the new load-persons right, LoadPersons. Settings under `Gateway:LoadLog`. See Investigate what loads the service and the database.
• Advice with remedies. LoadAdvice names shapes that load the database regardless of the data: whole tables without a filter, filters without an index, deep paging, expensive totals and aggregates, expensive own statements, and very frequent automatic refresh.
• Load for the manufacturer. export-load (an administration command and a server command) writes shapes, hourly figures, and advice as a JSON file, without persons, origins, or values.
• Finding a shape in SQL Server. Generated and checked statements carry the comment /* wkl:<shape identifier> */ after their first keyword, visible in the plan cache, in Query Store, and in Extended Events; the connections identify themselves as Wkl.Data.Gateway unless the connection string sets an Application Name of its own.
• Provider contract 1.2, SQL Server provider 1.1.0. The contract passes the identifier to the provider (ExecutionLimits.Marker) and reads back the last generated statement (IDataSession.LastStatementText). Both are additions; a provider for contract 1.0 or 1.1 runs unchanged, just without the marking.
• Administration store schema 15. The service upgrades an older store on first start; a backup is created as with every upgrade.

• Sign-in log. The service records every sign-in decision with its method, outcome, reason, person, and origin in the administration store and evaluates it: distribution by hour and weekday in server time, origins by named network, country, and network operator, and hints at attack patterns. New sets SignInHours, SignInOrigins, SignInEvents, SignInAdvice; the individual events require the new sign-in-events right. See Check sign-in patterns and origins.
• Geolocation database without outbound lookups. The service locates addresses with files on the server (DB-IP Lite or MaxMind GeoLite2). It downloads them itself (update-geoip, also on a schedule), accepts them from a client (upload-geoip), or on the server (import-geoip). New sets GeoIpFiles, GeoIpSource, command set-geoip-source, settings `Gateway:SignInLog`.
• „Denied“ in the service status without challenges. DeniedLastFiveMinutes included the 401 answer to a request without credentials, with which every Windows sign-in starts. A deployment with Windows sign-in therefore showed refusals all the time although nothing was refused.
• Reason unprotected. A SQL Server login, a second-factor code, or a request to the administration or self-service over an unprotected connection now carries this reason (previously none) and shows up in the sign-in log.
• Administration store schema 14. The service upgrades an older store on first start; a backup is created as with every upgrade.

• Replay protection under a renamed key header. With a custom Gateway:Security:ApiKeyHeader, the service didn't tell callers apart for Idempotency-Key: a second caller with the same Idempotency-Key, address, and body could receive another caller's stored response. Each stored response now belongs to its caller.
• Columns of unsupported types no longer accept values. sql_variant, hierarchyid, vector, and CLR types are missing from $metadata but accepted values when writing. The service now responds 400, as for an unknown field.
• SQL Server sign-in with an administration store can be set up in any order. The service starts with SqlLogin in AuthMode even before a data source accepts SQL Server logins and a mapping exists; until then, it logs a warning that points to the administration, and a sign-in with name and password ends with 401. See Set up sign-in with a SQL Server login.
• Addresses in responses behind a proxy. From a trusted proxy, the service takes X-Forwarded-Proto and X-Forwarded-Host for the absolute addresses in its responses (service document, next pages, Location, one-time links); the IIS template sets both headers. See Run the service behind IIS or a proxy.
• First administrator with a Windows account. init-admin --windows now assigns the account to the administration rule. Before, the Windows sign-in got no rights: with --no-key, the command created an administrator who couldn't sign in, and admin-status still counted that person as able to administer. Resting keys on demand no longer count there either.
• Changing the access. When setup-host runs over an existing administration store, it now says that the sign-in rules of the new access don't apply there. With no corporate networks entered, the firewall rule now admits only the local subnet instead of every network.

• A window is never larger than Limits:MaxRows (also per object). Previously, with a smaller MaxRows, an OData page ended without @odata.nextLink and without any indicator; Access, Excel, and Power BI took part of the rows for the whole result.
• Columns of types that aren't offered (spatial types, hierarchyid, sql_variant, json, vector, CLR types) are now also left out when reading without a field list and when reading back after a write. Previously, writing to a table with a geography column answered 503 although the row was saved, and the native route without a field list returned sql_variant raw. If you read these values through the native route without a field list, you no longer get them.

New: Security model and trust boundaries, Standards and specifications. Corrected: a person with a personal key and no SQL Server login also runs under the alias's login on an alias with Persons: Impersonate (no 403); the service sets wkl.person only for personal keys and chosen identities; DenyImpersonate doesn't apply to sign-in with HTTP Basic; over OData, a timestamp with an offset is converted to UTC instead of being refused; 503 after a write request means „outcome unknown“; /health/ready also answers 200 without an alias. The behavior of the service is unchanged.

Callers without the sql right can send statements to POST /api/v1/cf/{alias}/sql.json that the service checks: joins, subqueries, UNION, functions, CASE, LIKE patterns with _ and […], set-based changes, and calling a procedure—over exactly the objects and with exactly the methods their rules allow. Several statements in one batch are allowed; each is checked on its own. As a result, the queries Access sends over linked tables run through the ODBC driver even without the sql right. New in the configuration: AllowCheckedStatements per data source (default true); at startup, the administration store switches to schema version 13 and applies the default to all existing data sources. The schema document now also names the address (Store.PassThrough) to these callers. Provider contract 1.1: IDataSource.CheckStatement, capability CheckedStatements; the bundled sqlserver provider requires contract 1.1.

New at the same address: output and return parameters (outputs in request and response), all result sets (results after the first one), and describing a statement without running it ("describe": true), see Output parameters, multiple result sets, describing. Responses without these fields remain unchanged. Provider contract 1.1: capabilities StatementOutputs and StatementDescription.

The service connects databases through loadable providers. The sqlserver provider is bundled (folder providers/sqlserver/1.0.0 next to the program); responses to callers remain unchanged. New in the configuration: Provider, ProviderVersion, ProviderOptions per data source and Gateway:Providers:Path, see Service configuration (reference). Dialect: mssql still applies. If a data source lacks a capability, the service refuses the request with 400 before it contacts the database.

The administrator's guide of the administration app and the reference of the VBA class DbGwClient now belong to the documentation of the administration app (separate repository Wkl.Data.Gateway.Access). The tasks on the server—installation, first administrator, backup, master key, emergency access—are here in the new Operations section.

• Invitations by email: email templates in the MailTemplates set (three built in), an email address on the person (Email), and one-time links by email ("delivery": "mail" for issue-key and enroll-totp) that survive a restart and hold no secret; setting mail_link_hours, configuration Gateway:Store:MailLinkHours. See One-time link by email.
• A store of an older version is converted at startup (backup .v11-…bak first).

• New error kind DATABASE_UNREADABLE (503): SQL Server is reachable but can't read the alias's database (drive lost, offline, suspect, recovering). Not considered transient. Previously the response was UNAVAILABLE; a caller that doesn't know the code still reads 503.

• Error responses carry the messages from SQL Server (details: number, SQLSTATE, severity, text, released). Number, SQLSTATE, and severity always arrive, as over a direct connection; the service withholds the text (released: false) if it names an object the caller can't reach, or if, under the data source's login, it can quote a data value (such as a duplicate key or a value that's too long). See Error format.

• Filters can compare one field with another field (GatewayFilter.FieldComparison).

• New error kind TIMEOUT (504): the statement exceeded the service's time limit. Previously the response was UNAVAILABLE (503).

• A membership check may carry up to 20,000 values (previously 1,000).

• First version.