bmsdna-devtools 0.34.0__tar.gz → 0.35.0__tar.gz

bmsdna_devtools-0.34.0/README.md → bmsdna_devtools-0.35.0/PKG-INFO

@@ -1,3 +1,17 @@
+Metadata-Version: 2.5
+Name: bmsdna-devtools
+Version: 0.35.0
+Summary: Shared Azure DevOps / GitHub / git / Azure Monitor developer tooling for BMS projects
+Requires-Python: >=3.14
+Requires-Dist: pgdevkit[db]>=0.7.1
+Requires-Dist: requests>=2.32.0
+Requires-Dist: rich>=13.0.0
+Requires-Dist: tomli-w>=1.0.0
+Requires-Dist: typer>=0.26.7
+Provides-Extra: lint
+Requires-Dist: sqlglot>=27.0.0; extra == 'lint'
+Description-Content-Type: text/markdown
+
 # bmsdna-devtools
 
 Shared developer tooling for BMS projects: PR build/check status and a
@@ -616,12 +630,21 @@ bdt lint backend/db/a.py b.py  # scan only these files -- e.g. from a prek/pre-c
 bdt lint --no-tooling-check    # skip the tooling-config check for this run
 ```
 
-Every `.execute()`/`.executemany()` call -- and pgdevkit's `fetch_all`/`fetch_one`/`fetch_scalar` and
+Every `.execute()`/`.executemany()` call -- and pgdevkit's `fetch_all`/`fetch_one`/`fetch_scalar`/`execute` and
 `PostgresJsonResponse`, which only accept a literal string, sqlglot expression, `psycopg.sql` or t-string -- whose SQL argument can be resolved to a
 literal or f-string/concatenation/`%`-format expression is checked (an
 unresolvable argument, e.g. a plain function parameter, is silently skipped --
 this can't false-positive on non-psycopg `.execute()` calls, or on dynamic SQL
-it can't see through):
+it can't see through).
+
+pgdevkit's helpers are matched by name (`fetch_all(...)`, `db.fetch_all(...)`, `pgdevkit.db.execute(...)`). The one
+exception is a *bare* `execute(...)`, a far too generic name: it is only checked in a file that imports it from
+`pgdevkit`/`pgdevkit.db` (`from pgdevkit.db import execute`, also aliased: `... import execute as run`; the import is
+recognised file-wide), so an unrelated `execute()` from another library, or one defined locally in a file without that
+import, is never flagged. Aliased imports of the other helpers (`fetch_all as fa`) are recognised too. Not covered: a re-export through the
+project's own module (`from app.db import execute`; call it as `db.execute(...)` or import it from `pgdevkit.db`
+instead), a subclass of `PostgresJsonResponse` under another name, and CCMT2's pre-pgdevkit
+`PostgresJsonResponse("postgres", sql)`, whose first argument is a connection source, not SQL.
 
 - **`sql-inline-too-complex`** — more than a trivial (≤4 line) query, or a
   JOIN/CTE/subquery/aggregation, inline instead of `load_sql()`/a `.sql` file.
@@ -634,6 +657,8 @@ it can't see through):
   with an f-string, `+` concatenation, the `%` operator, or `str.format()`
   instead of a psycopg t-string (3.14+), `psycopg.sql`, or bound params. For an f-string the fix is
   usually just `f"..."` -> `t"..."` (`{value}` is bound, `{name:i}` quotes an identifier).
+  A dynamic fragment may be an identifier/expression, an optional clause, or a (possibly empty) list of
+  assignments -- the statement is flagged if it parses as DML with any of these readings of its fragments.
 - **`sql-sqlglot-string-injection`** — an f-string / concatenation / `%` / `.format()` string passed to a
   sqlglot builder that parses it as SQL (`select(...)`, `.from_()`, `.where()`, `.order_by()`, `parse_one()`, ...).
   The result is a sqlglot expression, which the rules above otherwise trust, so this is the hole they'd miss.
@@ -821,7 +846,7 @@ Findings have two severities: **error** (a definite unsafe pattern, exit code 1)
 (depends on where a value comes from; listed with an instruction for an AI/human to verify, exit
 code 0 unless `--strict`).
 
-- **SQL** (Python `.execute()` / `fetch_all()` / `fetch_one()` / `fetch_scalar()` / `PostgresJsonResponse()`): f-string / `%` / concatenation / `.format()` SQL is an error.
+- **SQL** (Python `.execute()` / `fetch_all()` / `fetch_one()` / `fetch_scalar()` / `execute()` from pgdevkit / `PostgresJsonResponse()`): f-string / `%` / concatenation / `.format()` SQL is an error.
   SQL from `load_sql()`, `sql.SQL`, sqlglot (`expr.sql()`, `sqlglot.*`), `cast(LiteralString, <sqlglot expr>)` (the cast is only as safe as its argument) or
   a function in the same file annotated `-> LiteralString` is trusted; SQL from any other function
   call is a `sql-unverified-call` review item. (`bdt lint` accepts the same trusted forms but never

bmsdna_devtools-0.34.0/PKG-INFO → bmsdna_devtools-0.35.0/README.md

@@ -1,17 +1,3 @@
-Metadata-Version: 2.5
-Name: bmsdna-devtools
-Version: 0.34.0
-Summary: Shared Azure DevOps / GitHub / git / Azure Monitor developer tooling for BMS projects
-Requires-Python: >=3.14
-Requires-Dist: pgdevkit[db]>=0.7.1
-Requires-Dist: requests>=2.32.0
-Requires-Dist: rich>=13.0.0
-Requires-Dist: tomli-w>=1.0.0
-Requires-Dist: typer>=0.26.7
-Provides-Extra: lint
-Requires-Dist: sqlglot>=27.0.0; extra == 'lint'
-Description-Content-Type: text/markdown
-
 # bmsdna-devtools
 
 Shared developer tooling for BMS projects: PR build/check status and a
@@ -630,12 +616,21 @@ bdt lint backend/db/a.py b.py  # scan only these files -- e.g. from a prek/pre-c
 bdt lint --no-tooling-check    # skip the tooling-config check for this run
 ```
 
-Every `.execute()`/`.executemany()` call -- and pgdevkit's `fetch_all`/`fetch_one`/`fetch_scalar` and
+Every `.execute()`/`.executemany()` call -- and pgdevkit's `fetch_all`/`fetch_one`/`fetch_scalar`/`execute` and
 `PostgresJsonResponse`, which only accept a literal string, sqlglot expression, `psycopg.sql` or t-string -- whose SQL argument can be resolved to a
 literal or f-string/concatenation/`%`-format expression is checked (an
 unresolvable argument, e.g. a plain function parameter, is silently skipped --
 this can't false-positive on non-psycopg `.execute()` calls, or on dynamic SQL
-it can't see through):
+it can't see through).
+
+pgdevkit's helpers are matched by name (`fetch_all(...)`, `db.fetch_all(...)`, `pgdevkit.db.execute(...)`). The one
+exception is a *bare* `execute(...)`, a far too generic name: it is only checked in a file that imports it from
+`pgdevkit`/`pgdevkit.db` (`from pgdevkit.db import execute`, also aliased: `... import execute as run`; the import is
+recognised file-wide), so an unrelated `execute()` from another library, or one defined locally in a file without that
+import, is never flagged. Aliased imports of the other helpers (`fetch_all as fa`) are recognised too. Not covered: a re-export through the
+project's own module (`from app.db import execute`; call it as `db.execute(...)` or import it from `pgdevkit.db`
+instead), a subclass of `PostgresJsonResponse` under another name, and CCMT2's pre-pgdevkit
+`PostgresJsonResponse("postgres", sql)`, whose first argument is a connection source, not SQL.
 
 - **`sql-inline-too-complex`** — more than a trivial (≤4 line) query, or a
   JOIN/CTE/subquery/aggregation, inline instead of `load_sql()`/a `.sql` file.
@@ -648,6 +643,8 @@ it can't see through):
   with an f-string, `+` concatenation, the `%` operator, or `str.format()`
   instead of a psycopg t-string (3.14+), `psycopg.sql`, or bound params. For an f-string the fix is
   usually just `f"..."` -> `t"..."` (`{value}` is bound, `{name:i}` quotes an identifier).
+  A dynamic fragment may be an identifier/expression, an optional clause, or a (possibly empty) list of
+  assignments -- the statement is flagged if it parses as DML with any of these readings of its fragments.
 - **`sql-sqlglot-string-injection`** — an f-string / concatenation / `%` / `.format()` string passed to a
   sqlglot builder that parses it as SQL (`select(...)`, `.from_()`, `.where()`, `.order_by()`, `parse_one()`, ...).
   The result is a sqlglot expression, which the rules above otherwise trust, so this is the hole they'd miss.
@@ -835,7 +832,7 @@ Findings have two severities: **error** (a definite unsafe pattern, exit code 1)
 (depends on where a value comes from; listed with an instruction for an AI/human to verify, exit
 code 0 unless `--strict`).
 
-- **SQL** (Python `.execute()` / `fetch_all()` / `fetch_one()` / `fetch_scalar()` / `PostgresJsonResponse()`): f-string / `%` / concatenation / `.format()` SQL is an error.
+- **SQL** (Python `.execute()` / `fetch_all()` / `fetch_one()` / `fetch_scalar()` / `execute()` from pgdevkit / `PostgresJsonResponse()`): f-string / `%` / concatenation / `.format()` SQL is an error.
   SQL from `load_sql()`, `sql.SQL`, sqlglot (`expr.sql()`, `sqlglot.*`), `cast(LiteralString, <sqlglot expr>)` (the cast is only as safe as its argument) or
   a function in the same file annotated `-> LiteralString` is trusted; SQL from any other function
   call is a `sql-unverified-call` review item. (`bdt lint` accepts the same trusted forms but never

{bmsdna_devtools-0.34.0 → bmsdna_devtools-0.35.0}/bmsdna/devtools/cli.py

@@ -1093,7 +1093,7 @@ def lint(
     ),
 ) -> None:
     """Static checks (bmsuisse/skills#52): postgres/psycopg SQL rules on every `.execute()` call and pgdevkit
-    `fetch_all`/`fetch_one`/`fetch_scalar`/`PostgresJsonResponse` call
+    `fetch_all`/`fetch_one`/`fetch_scalar`/`execute`/`PostgresJsonResponse` call
     (must use load_sql()/a .sql file, a t-string, or psycopg.sql for anything beyond a trivial
     query; never an f-string/concatenation/`%`-formatting), pydantic-model placement under api/
     directories, hand-wired HTTP in TypeScript, and that the repo declares/configures ty, ruff, pytest and prek.

{bmsdna_devtools-0.34.0 → bmsdna_devtools-0.35.0}/bmsdna/devtools/lint_sql.py

@@ -1,5 +1,5 @@
 """AST rule engine for `bdt lint`'s postgres/psycopg checks (bmsuisse/skills#52):
-every `.execute()`/`.executemany()` call (and pgdevkit's `fetch_all`/`fetch_one`/`fetch_scalar` and
+every `.execute()`/`.executemany()` call (and pgdevkit's `fetch_all`/`fetch_one`/`fetch_scalar`/`execute` and
 `PostgresJsonResponse`) is classified by how its SQL argument was
 built, then checked against the `postgres-best-practices` skill's rules
 (../../skills/postgres-best-practices in a checkout of bmsuisse/skills).
@@ -24,6 +24,7 @@ than guessed at -- a linter that can't be sure must stay quiet, not noisy.
 from __future__ import annotations
 
 import ast
+import itertools
 import re
 import sys
 from collections.abc import Mapping
@@ -63,10 +64,18 @@ _POSITIONAL_PARAM_RE = re.compile(r"(?<!%)%s\b")
 # Placeholder substituted for a non-literal fragment (an f-string {expr}, a concatenated
 # non-constant operand, a str.format() {field}) before attempting an sqlglot parse -- padded
 # with spaces so it never merges into a neighboring identifier/keyword, and looks like an
-# ordinary identifier so the parse doesn't fail on the substitution itself.
+# ordinary identifier so the parse doesn't fail on the substitution itself (see
+# `_PROBE_SLOT_VARIANTS`/`_parse_probe_text` for the fallbacks when an identifier doesn't fit).
 _PROBE_PLACEHOLDER = " __X__ "
 _FORMAT_FIELD_RE = re.compile(r"\{[^{}]*\}")
 
+# A dynamic fragment isn't always an identifier/expression: `SET {assignments}, {extra}` where `extra` is
+# empty or `"is_approved = false,"`, or an optional `{where}` clause. When the probe with every fragment as an
+# identifier doesn't parse, each fragment is retried as "nothing" and as an assignment, all combinations
+# (only up to _MAX_PROBE_SLOTS fragments, so the number of parses stays small).
+_PROBE_SLOT_VARIANTS = (_PROBE_PLACEHOLDER, " ", " __X__ = 1 ")
+_MAX_PROBE_SLOTS = 4
+
 _MAX_RESOLVE_HOPS = 5
 
 
@@ -127,6 +136,7 @@ class _Trust:
     sqlglot_names: frozenset[str] = frozenset()
     literal_funcs: frozenset[str] = frozenset()
     sqlglot_aliases: Mapping[str, str] = field(default_factory=dict)  # local name -> name it was imported as
+    pgdevkit_sinks: frozenset[str] = frozenset()  # local names bound by `from pgdevkit[.x] import <sql-taking helper>`
 
 
 _NO_TRUST = _Trust()
@@ -185,10 +195,15 @@ def _unwrap_str_call(node: ast.Call) -> ast.expr | None:
     return None
 
 
+def _is_pgdevkit_module(module: str | None) -> bool:
+    return module is not None and (module == "pgdevkit" or module.startswith("pgdevkit."))
+
+
 def _file_trust(tree: ast.AST) -> _Trust:
     literal_funcs: set[str] = set()
     sqlglot_names: set[str] = set()
     sqlglot_aliases: dict[str, str] = {}
+    pgdevkit_sinks: set[str] = set()
     for node in ast.walk(tree):
         if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)) and node.returns is not None and _is_literal_string_ref(node.returns):
             literal_funcs.add(node.name)
@@ -197,7 +212,9 @@ def _file_trust(tree: ast.AST) -> _Trust:
         elif isinstance(node, ast.ImportFrom) and (node.module or "").split(".")[0] == "sqlglot":
             sqlglot_names.update(a.asname or a.name for a in node.names)
             sqlglot_aliases.update({a.asname or a.name: a.name for a in node.names})
-    return _Trust(frozenset(sqlglot_names), frozenset(literal_funcs), sqlglot_aliases)
+        elif isinstance(node, ast.ImportFrom) and node.level == 0 and _is_pgdevkit_module(node.module):
+            pgdevkit_sinks.update(a.asname or a.name for a in node.names if a.name in _PGDEVKIT_SQL_CALLEES)
+    return _Trust(frozenset(sqlglot_names), frozenset(literal_funcs), sqlglot_aliases, frozenset(pgdevkit_sinks))
 
 
 def _resolve_single(expr: ast.expr, lookup) -> ast.expr:
@@ -278,8 +295,47 @@ _FSTRING_FIX = (
 _GENERIC_FIX = "Use a psycopg t-string (Python 3.14+), psycopg.sql for dynamic SQL, or load_sql()/a .sql file for static SQL."
 
 
+# Keyword that must literally be in the text before a variant reading (a fragment as nothing/an assignment) may
+# count: sqlglot is lenient enough to read prose like "Update to version {v}" as an UPDATE with the fragment gone.
+_VARIANT_REQUIRED_KEYWORD: dict[type, re.Pattern[str]] = {}
+if exp is not None:
+    _VARIANT_REQUIRED_KEYWORD = {
+        exp.Select: re.compile(r"(?i)\bfrom\b"),
+        exp.Union: re.compile(r"(?i)\bfrom\b"),
+        exp.Insert: re.compile(r"(?i)\binto\b"),
+        exp.Update: re.compile(r"(?i)\bset\b"),
+        exp.Delete: re.compile(r"(?i)\bfrom\b"),
+        exp.Merge: re.compile(r"(?i)\busing\b"),
+    }
+
+
+def _parse_probe_text(text: str) -> "exp.Expression | None":
+    """`parse_sql_text` for text with `_PROBE_PLACEHOLDER` standing in for dynamic fragments: the placeholder
+    as an identifier first, then (see `_PROBE_SLOT_VARIANTS`) every fragment as nothing/an assignment -- the
+    latter only when the literal text carries the statement's own keyword (`_VARIANT_REQUIRED_KEYWORD`)."""
+    parsed = parse_sql_text(text)
+    if parsed is not None:
+        return parsed
+    parts = text.split(_PROBE_PLACEHOLDER)
+    slots = len(parts) - 1
+    if not 1 <= slots <= _MAX_PROBE_SLOTS:
+        return None
+    literal_text = " ".join(parts)
+    for combination in itertools.product(_PROBE_SLOT_VARIANTS, repeat=slots):
+        if all(c == _PROBE_PLACEHOLDER for c in combination):
+            continue  # that's `text` itself, already tried
+        candidate = "".join(a + b for a, b in itertools.zip_longest(parts, combination, fillvalue=""))
+        parsed = parse_sql_text(candidate)
+        if parsed is None:
+            continue
+        keyword = next((rx for t, rx in _VARIANT_REQUIRED_KEYWORD.items() if isinstance(parsed, t)), None)
+        if keyword is not None and keyword.search(literal_text):
+            return parsed
+    return None
+
+
 def _injection_finding(text: str, path: Path, lineno: int, rule: str, how: str) -> list[Finding]:
-    if parse_sql_text(text) is None:
+    if _parse_probe_text(text) is None:
         return []
     fix = _FSTRING_FIX if rule == "sql-fstring-injection" else _GENERIC_FIX
     return [Finding(path, lineno, rule, f"SQL built with {how} -- injection risk. {fix}")]
@@ -455,22 +511,32 @@ def _is_sql_named(name: str) -> bool:
     return lowered == "sql" or lowered.endswith("_sql")
 
 
-# pgdevkit's `fetch_all`/`fetch_one`/`fetch_scalar` and `pgdevkit.fastapi.PostgresJsonResponse` run their first
-# argument as SQL, exactly like `.execute()`, so they get the same rules (plain functions / a class, so matched by
-# bare name too). Matched by name only, so not covered: an alias (`as PJR`), a subclass under another name (the
-# documented `class AppJson(PostgresJsonResponse): expose_errors = ...`), and the pre-pgdevkit
+# pgdevkit's `fetch_all`/`fetch_one`/`fetch_scalar`/`execute` and `pgdevkit.fastapi.PostgresJsonResponse` run their
+# first argument as SQL, exactly like `.execute()`, so they get the same rules. As an attribute (`db.fetch_all(...)`,
+# `pgdevkit.db.execute(...)`) they are matched by name only, like `.execute()` itself.
+_PGDEVKIT_SQL_CALLEES = frozenset({"fetch_all", "fetch_one", "fetch_scalar", "execute", "PostgresJsonResponse"})
+# A bare `execute(...)` is far too generic a name (sqlite helpers, subprocess wrappers, ...): it counts only in a file
+# that imports it from `pgdevkit`/`pgdevkit.db` (also under an alias: `from pgdevkit.db import execute as run`; see
+# `_file_trust`). The import is tracked file-wide, so a local def/parameter named like it is not told apart. The sqlglot
+# DML gate still applies on top. The other callees are matched by bare name too, and by their pgdevkit import alias.
+# Not covered: a re-export through the project's own module (`from app.db import execute`), a subclass of
+# PostgresJsonResponse under another name (the documented `class AppJson(PostgresJsonResponse)`), and the pre-pgdevkit
 # `PostgresJsonResponse("postgres", sql, ...)` copy in CCMT2, whose first argument is a connection source -- its SQL
 # only gets checked once that call site moves to pgdevkit.
-_PGDEVKIT_SQL_CALLEES = frozenset({"fetch_all", "fetch_one", "fetch_scalar", "PostgresJsonResponse"})
+_IMPORT_GATED_BARE_CALLEES = frozenset({"execute"})
+_BARE_NAME_SQL_CALLEES = _PGDEVKIT_SQL_CALLEES - _IMPORT_GATED_BARE_CALLEES
+
+
+def _is_pgdevkit_sink_call(func: ast.expr, trust: _Trust) -> bool:
+    if isinstance(func, ast.Name):
+        return func.id in _BARE_NAME_SQL_CALLEES or func.id in trust.pgdevkit_sinks
+    return isinstance(func, ast.Attribute) and func.attr in _PGDEVKIT_SQL_CALLEES
 
 
-def _execute_query_arg(call: ast.Call) -> ast.expr | None:
+def _execute_query_arg(call: ast.Call, trust: _Trust = _NO_TRUST) -> ast.expr | None:
     func = call.func
     is_execute = isinstance(func, ast.Attribute) and func.attr in ("execute", "executemany")
-    is_fetch_helper = (isinstance(func, ast.Name) and func.id in _PGDEVKIT_SQL_CALLEES) or (
-        isinstance(func, ast.Attribute) and func.attr in _PGDEVKIT_SQL_CALLEES
-    )
-    if not (is_execute or is_fetch_helper):
+    if not (is_execute or _is_pgdevkit_sink_call(func, trust)):
         return None
     if call.args:
         return call.args[0]
@@ -634,7 +700,7 @@ class _ExecuteCallVisitor(ast.NodeVisitor):
 
     def visit_Call(self, node: ast.Call) -> None:
         self.findings.extend(_sqlglot_builder_findings(node, self.path, self.trust, self._lookup, self._sqlglot_vars))
-        query_arg = _execute_query_arg(node)
+        query_arg = _execute_query_arg(node, self.trust)
         if query_arg is not None:
             found = _check_query_arg(query_arg, self._lookup, self.path, node.lineno, self.trust, self.review)
             if isinstance(query_arg, ast.Name) and _is_sql_named(query_arg.id) and self._all_bare_strings(query_arg.id):

{bmsdna_devtools-0.34.0 → bmsdna_devtools-0.35.0}/pyproject.toml

@@ -10,7 +10,7 @@ packages = ["bmsdna"]
 
 [project]
 name = "bmsdna-devtools"
-version = "0.34.0"
+version = "0.35.0"
 description = "Shared Azure DevOps / GitHub / git / Azure Monitor developer tooling for BMS projects"
 readme = "README.md"
 requires-python = ">=3.14"  # pgdevkit>=0.7.1 requires 3.14; was >=3.11 before adding it as a dependency

{bmsdna_devtools-0.34.0 → bmsdna_devtools-0.35.0}/skills/bmsdna-devtools/SKILL.md

@@ -123,7 +123,7 @@ vendor a git submodule under that path.
 
 ## Static checks
 
-- `bdt lint [paths]` -- SQL/psycopg rules (`.execute()`, pgdevkit `fetch_*`, `PostgresJsonResponse`), pydantic-model placement, hand-wired HTTP in TypeScript, baseline tooling.
+- `bdt lint [paths]` -- SQL/psycopg rules (`.execute()`, pgdevkit `fetch_*`/`execute`, `PostgresJsonResponse`), pydantic-model placement, hand-wired HTTP in TypeScript, baseline tooling.
 - `uv run bdt dead-code` -- dead code a linter can't see, configured under `[tool.bdt.dead_code]` in pyproject.toml:
   `.sql` files no Python code loads (`sql_roots`) and FastAPI routes that neither non-generated frontend code nor a
   `url_for(...)` call uses (`[[tool.bdt.dead_code.apps]]`: app or openapi file, frontends, excludes, optional `baseline`;

{bmsdna_devtools-0.34.0 → bmsdna_devtools-0.35.0}/tests/test_find_injection.py

@@ -151,6 +151,18 @@ def test_sql_injection_is_error_and_unverified_call_is_review(tmp_path: Path) ->
     assert [f.rule for f in result.reviews] == ["sql-unverified-call"]
 
 
+def test_pgdevkit_execute_is_a_sql_sink_for_find_injection(tmp_path: Path) -> None:
+    (tmp_path / "db.py").write_text(
+        "from pgdevkit.db import execute\n\n"
+        'async def a(x):\n    await execute(f"update t set a = {x}")\n\n'
+        "async def b(x):\n    await execute(build(x))\n"
+    )
+    (tmp_path / "other.py").write_text('from lib import execute\n\ndef a(x):\n    execute(f"update t set a = {x}")\n')
+    result = _run(tmp_path)
+    assert [(f.path.name, f.rule) for f in result.errors] == [("db.py", "sql-fstring-injection")]
+    assert [(f.path.name, f.rule) for f in result.reviews] == [("db.py", "sql-unverified-call")]
+
+
 def test_tests_and_missing_paths(tmp_path: Path) -> None:
     (tmp_path / "tests").mkdir()
     (tmp_path / "tests" / "test_x.py").write_text("eval(x)\n")

{bmsdna_devtools-0.34.0 → bmsdna_devtools-0.35.0}/tests/test_lint_sql.py

@@ -608,3 +608,258 @@ def f(table):
     return PostgresJsonResponse("postgres", f"select id from dim.{table}", parameters={})
 '''
     assert _findings(source, tmp_path / "a.py") == []
+
+
+# --- pgdevkit.db.execute (bare name, gated on a pgdevkit import) ---
+
+
+def test_bare_execute_imported_from_pgdevkit_is_flagged_like_cursor_execute(tmp_path: Path) -> None:
+    # Real pattern from CCMT2's _write_rule_change.
+    source = '''
+from pgdevkit.db import execute
+
+async def f(table, rule_id):
+    await execute(f"UPDATE ccmt.{table} SET active = false WHERE id = %(id)s", {"id": rule_id})
+'''
+    findings = _findings(source, tmp_path / "a.py")
+    assert _rules(findings) == {"sql-fstring-injection"}
+    assert [f.line for f in findings] == [5]
+
+
+def test_bare_execute_flags_concat_format_percent_and_keyword_query(tmp_path: Path) -> None:
+    source = '''
+from pgdevkit.db import execute
+
+async def f(value, table):
+    await execute("delete from t where id = " + str(value))
+    await execute("delete from t where id = %s" % value)
+    await execute("delete from t where id = {}".format(value))
+    await execute(query=f"delete from {table} where id = 1", pool=None)
+'''
+    findings = _findings(source, tmp_path / "a.py")
+    assert _rules(findings) == {
+        "sql-concat-injection",
+        "sql-percent-format-injection",
+        "sql-format-injection",
+        "sql-fstring-injection",
+    }
+    assert len(findings) == 4
+
+
+def test_bare_execute_follows_a_variable_to_its_unsafe_assignment(tmp_path: Path) -> None:
+    source = '''
+from pgdevkit.db import execute
+
+async def f(table):
+    query = f"update dim.{table} set x = 1"
+    await execute(query)
+'''
+    assert _rules(_findings(source, tmp_path / "a.py")) == {"sql-fstring-injection"}
+
+
+def test_bare_execute_import_forms_gate_the_rule(tmp_path: Path) -> None:
+    bad = 'await {call}(f"update t set x = {{v}}")'
+    for i, (imp, call) in enumerate(
+        [
+            ("from pgdevkit.db import execute", "execute"),
+            ("from pgdevkit.db import execute as run", "run"),
+            ("from pgdevkit.db import fetch_all, execute", "execute"),
+            ("from pgdevkit.db.fetch import execute", "execute"),
+        ]
+    ):
+        source = f"{imp}\n\nasync def f(v):\n    {bad.format(call=call)}\n"
+        assert _rules(_findings(source, tmp_path / f"a{i}.py")) == {"sql-fstring-injection"}, imp
+
+
+def test_execute_attribute_forms_are_flagged(tmp_path: Path) -> None:
+    source = '''
+import pgdevkit
+import pgdevkit.db as db
+from pgdevkit import db as pgdb
+
+async def f(v):
+    await db.execute(f"update t set x = {v}")
+    await pgdb.execute("update t set x = " + v)
+    await pgdevkit.db.execute("update t set x = {}".format(v))
+'''
+    findings = _findings(source, tmp_path / "a.py")
+    assert _rules(findings) == {"sql-fstring-injection", "sql-concat-injection", "sql-format-injection"}
+    assert len(findings) == 3
+
+
+def test_bare_execute_accepts_literal_load_sql_sqlglot_template_and_sql_composed(tmp_path: Path) -> None:
+    source = '''
+from psycopg import sql
+from sqlglot import exp
+from pgdevkit.db import execute
+
+async def f(sql_loader, user_id, table):
+    await execute(sql_loader.load_sql("users", "deactivate"), {"id": user_id})
+    await execute(exp.delete("t").where("id = 1").sql(dialect="postgres"))
+    await execute(t"update t set x = 1 where user_id = {user_id}")
+    await execute(sql.SQL("update {} set x = 1").format(sql.Identifier(table)))
+    await execute("update t set x = 1 where user_id = %(id)s", {"id": user_id})
+'''
+    assert _findings(source, tmp_path / "a.py") == []
+
+
+def test_bare_execute_applies_inline_complexity_and_positional_rules(tmp_path: Path) -> None:
+    source = '''
+from pgdevkit.db import execute
+
+async def f():
+    await execute("insert into t (id) select id from u")
+    await execute("update t set x = 1 where id = %s", (1,))
+'''
+    assert _rules(_findings(source, tmp_path / "a.py")) == {"sql-inline-too-complex", "sql-positional-param"}
+
+
+def test_bare_execute_simple_write_is_clean_and_forbidden_join_is_flagged(tmp_path: Path) -> None:
+    source = '''
+from pgdevkit.db import execute
+
+async def f():
+    await execute("update t set x = 1 where id = %(id)s", {"id": 1})
+    await execute("delete from t using u right join v on v.id = u.id where t.id = u.id")
+'''
+    assert "sql-forbidden-join" in _rules(_findings(source, tmp_path / "a.py"))
+
+
+def test_bare_execute_is_reported_as_unverified_call_in_review_mode(tmp_path: Path) -> None:
+    source = '''
+from pgdevkit.db import execute
+
+async def f(build_query):
+    await execute(build_query("t"))
+'''
+    path = tmp_path / "a.py"
+    path.write_text(source)
+    assert check_sql_file(path) == []
+    assert _rules(check_sql_file(path, review=True)) == {"sql-unverified-call"}
+
+
+def test_bare_execute_without_a_pgdevkit_import_is_not_flagged(tmp_path: Path) -> None:
+    # `execute` is a very generic name: no pgdevkit import, no finding -- even when the text is real DML.
+    source = '''
+async def execute(sql):
+    ...
+
+async def f(table):
+    await execute(f"update {table} set x = 1")
+    await execute("update t set x = %s", (1,))
+'''
+    assert _findings(source, tmp_path / "a.py") == []
+
+
+def test_bare_execute_imported_from_another_library_is_not_flagged(tmp_path: Path) -> None:
+    source = '''
+from sqlalchemy import execute
+from mylib.db import execute as run
+from .db import execute as local_run
+from . import execute as dotted
+from pgdevkitx import execute as lookalike
+
+def f(table, name):
+    execute(f"update {table} set x = 1")
+    run(f"update {table} set x = 1")
+    local_run(f"update {table} set x = 1")
+    dotted(f"update {table} set x = 1")
+    lookalike(f"update {table} set x = 1")
+    execute(f"echo {name}")
+'''
+    assert _findings(source, tmp_path / "a.py") == []
+
+
+def test_pgdevkit_import_does_not_make_a_non_sql_execute_flagged(tmp_path: Path) -> None:
+    source = '''
+from pgdevkit.db import execute
+
+async def f(cmd, name):
+    await execute(f"echo {name}")
+    await execute(f"COPY t TO '/tmp/{name}.csv'")
+'''
+    assert _findings(source, tmp_path / "a.py") == []
+
+
+def test_pgdevkit_import_of_other_names_does_not_enable_bare_execute(tmp_path: Path) -> None:
+    source = '''
+import pgdevkit
+from pgdevkit.db import fetch_all
+from other import execute
+
+async def f(table):
+    execute(f"update {table} set x = 1")
+'''
+    assert _findings(source, tmp_path / "a.py") == []
+
+
+def test_aliased_pgdevkit_fetch_helpers_and_json_response_are_flagged(tmp_path: Path) -> None:
+    source = '''
+from pgdevkit.db import fetch_all as fa
+from pgdevkit.fastapi import PostgresJsonResponse as PJR
+
+async def f(table):
+    await fa(f"select id from {table}")
+    return PJR(f"select id from {table}")
+'''
+    findings = _findings(source, tmp_path / "a.py")
+    assert _rules(findings) == {"sql-fstring-injection"}
+    assert len(findings) == 2
+
+
+# --- dynamic fragments that aren't identifiers (probe variants) ---
+
+
+def test_fstring_with_optional_assignment_fragments_is_flagged(tmp_path: Path) -> None:
+    # CCMT2's _write_rule_change: `{is_approved_clause}` is "" or "is_approved = false," -- as an identifier probe
+    # the statement doesn't parse, as nothing/an assignment it does.
+    source = '''
+from pgdevkit.db import execute
+
+async def f(con, fields, tiers):
+    set_clause = ", ".join(f"{c} = %({c})s" for c in fields)
+    is_approved_clause = "is_approved = false," if tiers is not None else ""
+    await execute(
+        f"""
+        UPDATE editing.bonus_rules
+        SET {set_clause},
+            {is_approved_clause}
+            modified_user = %(modified_user)s
+        WHERE bonus_rule_id = %(bonus_rule_id)s
+        """,
+        {**fields, "modified_user": "x", "bonus_rule_id": 1},
+        con=con,
+    )
+'''
+    assert _rules(_findings(source, tmp_path / "a.py")) == {"sql-fstring-injection"}
+
+
+def test_fstring_with_optional_trailing_clause_fragment_is_flagged(tmp_path: Path) -> None:
+    source = '''
+async def f(cur, lock):
+    await cur.execute(f"update t set x = 1 where id = %(id)s {lock}", {"id": 1})
+'''
+    assert _rules(_findings(source, tmp_path / "a.py")) == {"sql-fstring-injection"}
+
+
+def test_probe_variants_do_not_flag_non_sql_or_non_dml_text(tmp_path: Path) -> None:
+    source = '''
+async def f(cur, a, b, c, d, e, name):
+    await cur.execute(f"{a} {b} {c} {d} {e}")
+    await cur.execute(f"update the user {name} please")
+    await cur.execute(f"COPY t TO '/tmp/{name}.csv'")
+    await cur.execute(f"set {name} {a} {b} {c} {d} {e}")
+'''
+    assert _findings(source, tmp_path / "a.py") == []
+
+
+def test_probe_variants_do_not_read_prose_as_dml(tmp_path: Path) -> None:
+    # sqlglot parses these once the fragment is dropped/turned into an assignment ("UPDATE to AS version ...").
+    source = '''
+def f(cur, v):
+    cur.execute(f"Update to version {v}")
+    cur.execute(f"Delete the file {v}")
+    cur.execute(f"Insert coin {v}")
+    cur.execute(f"Update complete, {v} rows changed")
+'''
+    assert _findings(source, tmp_path / "a.py") == []

{bmsdna_devtools-0.34.0 → bmsdna_devtools-0.35.0}/uv.lock

@@ -22,7 +22,7 @@ wheels = [
 
 [[package]]
 name = "bmsdna-devtools"
-version = "0.34.0"
+version = "0.35.0"
 source = { editable = "." }
 dependencies = [
     { name = "pgdevkit", extra = ["db"] },