Block query results API when public URLs are disabled

[shunki-fujita]

Close: #7678

QueryResultResource did not check disable_public_urls, allowing API key holders to retrieve query results even after the setting was enabled. This adds the same guard used in PublicDashboardResource.

What type of PR is this?

• Refactor
• Feature
• Bug Fix
• New Query Runner (Data Source)
• New Alert Destination
• Other

Description

How is this tested?

• Unit tests (pytest, jest)
• E2E Tests (Cypress)
• Manually
• N/A

• REDASH_DISABLE_PUBLIC_URLS=false

$ curl -s "http://localhost:5000/api/queries/1/results?api_key=<api key>"
{"query_result": {"id": 3, "query_hash": "c65c5f7abb67917dd98fedad6f6d850f", "query": "SELECT * FROM t LIMIT 1000", "data": {"columns": [{"name": "id", "friendly_name": "id", "type": "integer"}, {"name": "name", "friendly_name": "name", "type": "string"}], "rows": [{"id": 1, "name": "hello"}, {"id": 2, "name": "redash"}]}, "data_source_id": 1, "runtime": 0.010477542877197266, "retrieved_at": "2026-03-27T09:24:34.266Z"}}

• REDASH_DISABLE_PUBLIC_URLS=true

$ curl -s "http://localhost:5000/api/queries/1/results?api_key=<api key>"
{"message": "Public URLs are disabled."}

Related Tickets & Documents

Mobile & Desktop Screenshots/Recordings (if there are UI changes)

[cubic-dev-ai]

No issues found across 1 file