boti-data 1.3.3__tar.gz → 1.3.5__tar.gz

{boti_data-1.3.3 → boti_data-1.3.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boti-data
-Version: 1.3.3
+Version: 1.3.5
 Summary: Data infrastructure for the Boti ecosystem
 Author: Luis Valverde
 Maintainer-email: Luis Valverde <lvalverdeb@gmail.com>

{boti_data-1.3.3 → boti_data-1.3.5}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "boti-data"
-version = "1.3.3"
+version = "1.3.5"
 description = "Data infrastructure for the Boti ecosystem"
 readme = "README.md"
 requires-python = ">=3.13"

{boti_data-1.3.3 → boti_data-1.3.5}/src/boti_data/datacube/contract.py

@@ -65,9 +65,9 @@ class DatacubeRequest(BaseModel):
     model_config = ConfigDict(extra="allow", arbitrary_types_allowed=True)
 
     filters: dict[str, Any] = Field(default_factory=dict)
-    cube: str | None = Field(default=None)
+    cube: str | None = Field(default=None, max_length=256)
     limit: int | None = Field(default=None)
-    return_type: str | None = Field(default=None)
+    return_type: str | None = Field(default=None, max_length=32)
 
 
 class DatacubeConfig(ResourceConfig):

{boti_data-1.3.3 → boti_data-1.3.5}/src/boti_data/db/partitioned_types.py

@@ -123,8 +123,8 @@ class SqlPartitionedLoadRequest(BaseModel):
     params: dict[str, Any] = Field(default_factory=dict)
     partitioned: bool = True
     partition_strategy: PartitionStrategy = "offset"
-    partition_column: str | None = None
-    order_column: str | None = None
+    partition_column: str | None = Field(default=None, max_length=256)
+    order_column: str | None = Field(default=None, max_length=256)
     chunk_size: int = Field(default=50_000, ge=1)
     single_fetch_threshold: int | None = Field(default=None, ge=0)
     limit: int | None = Field(default=None, ge=1)

{boti_data-1.3.3 → boti_data-1.3.5}/src/boti_data/db/sql_model_registry.py

@@ -9,6 +9,7 @@ from __future__ import annotations
 
 import asyncio
 import hashlib
+import logging
 import re
 import sys
 import threading
@@ -25,6 +26,8 @@ from boti_data.db.sql_model_module_injection import register_as_module_attribute
 from boti_data.db.sql_model_registry_types import DefaultBase, ModelBuildContext, RegistryConfig
 from boti_data.db.sqlalchemy_async import ensure_greenlet_available
 
+_logger = logging.getLogger(__name__)
+
 try:
     # Importing this module has the side effect of registering pgvector's
     # 'vector' type name into SQLAlchemy's Postgres dialect
@@ -34,8 +37,10 @@ try:
     # works the same as before for consumers who never touch pgvector and
     # haven't installed boti-data[pgvector].
     import pgvector.sqlalchemy  # noqa: F401
-except ImportError:
-    pass
+except ImportError as exc:
+    # Debug level only — this is an expected/best-effort probe for the
+    # overwhelming majority of consumers who never install the pgvector extra.
+    _logger.debug("pgvector.sqlalchemy not available, vector type registration skipped: %s", exc)
 
 
 class SqlModelRegistry:

{boti_data-1.3.3 → boti_data-1.3.5}/src/boti_data/enrichment/transformers.py

@@ -82,7 +82,7 @@ class RowFilter:
     async def transform(self, df: pd.DataFrame, **kwargs: Any) -> pd.DataFrame:
         for expr in self._predicates:
             _reject_dunder_expr(expr)
-            mask = df.eval(expr)
+            mask = df.eval(expr)  # nosec CWE-94 -- dunder-chain rejected above; see class docstring's Security section
             df = df.loc[mask].reset_index(drop=True)
         return df
 
@@ -116,7 +116,7 @@ class DerivedColumn:
     async def transform(self, df: pd.DataFrame, **kwargs: Any) -> pd.DataFrame:
         for name, expr in self._columns.items():
             _reject_dunder_expr(expr)
-            df[name] = df.eval(expr)
+            df[name] = df.eval(expr)  # nosec CWE-94 -- dunder-chain rejected above; see class docstring's Security section
         return df
 
 

{boti_data-1.3.3 → boti_data-1.3.5}/src/boti_data/gateway/load_request.py

@@ -17,7 +17,7 @@ class GatewayLoadRequest(BaseModel):
     model_config = ConfigDict(extra="forbid", arbitrary_types_allowed=True)
 
     # Source
-    sql: str | None = None
+    sql: str | None = Field(default=None, max_length=100_000)
     statement: Any = None
     model: Any = None
     filters: dict[str, Any] = Field(default_factory=dict)
@@ -43,13 +43,13 @@ class GatewayLoadRequest(BaseModel):
     # IN-chunking controls
     in_chunk_size: int | None = None
     in_chunk_concurrency: int | None = None
-    in_chunk_strategy: str = "auto"
+    in_chunk_strategy: str = Field(default="auto", max_length=32)
 
     # Partitioned load controls
     partitioned: bool | None = None
-    partition_strategy: str | None = None
-    partition_column: str | None = None
-    order_column: str | None = None
+    partition_strategy: str | None = Field(default=None, max_length=32)
+    partition_column: str | None = Field(default=None, max_length=256)
+    order_column: str | None = Field(default=None, max_length=256)
     chunk_size: int | None = Field(default=None, ge=1)
     single_fetch_threshold: int | None = Field(default=None, ge=0)
     max_concurrent_fetches: int | None = None

{boti_data-1.3.3 → boti_data-1.3.5}/src/boti_data/gateway/post_process.py

@@ -226,4 +226,4 @@ class PostProcessor:
         logger.info(
             f"Gateway load completed elapsed={elapsed:.2f}s metrics={describe_frame(frame)}"
         )
-        logger.info(f"Gateway load graph metrics={describe_frame(frame)}")
+        logger.info(f"Gateway load graph metrics={describe_frame(frame)}")  # nosec CWE-117 -- counts/engine-name only, never data-derived

{boti_data-1.3.3 → boti_data-1.3.5}/src/boti_data/gateway/requests.py

@@ -50,8 +50,8 @@ class DataFrameParams(BaseModel):
     fieldnames: tuple[str, ...] | None = None
     column_names: list[str] | None = None
     chunk_size: int | None = Field(default=None, ge=1)
-    index_col: str | None = None
-    datetime_index: str | None = None
+    index_col: str | None = Field(default=None, max_length=256)
+    datetime_index: str | None = Field(default=None, max_length=256)
     return_type: ReturnType = "dask"
     execution_mode: ExecutionMode = "auto"
 
@@ -133,7 +133,7 @@ class SqlLoadRequest(BaseModel):
 
     model_config = ConfigDict(extra="forbid", arbitrary_types_allowed=True)
 
-    sql: str | None = None
+    sql: str | None = Field(default=None, max_length=100_000)
     statement: Any | None = None
     model: Any | None = None
     filters: dict[str, Any] = Field(default_factory=dict)

{boti_data-1.3.3 → boti_data-1.3.5}/src/boti_data/gateway/sql_strategy_configured_async.py

@@ -52,7 +52,7 @@ async def aload_configured_execute_async_resource(
     model, stmt = await ctx.get_configured_select_async(resource, ctx.db_columns)
     t1 = perf_counter()
     if diagnostics:
-        resource.logger.info(f"Configured async select reflect_select={t1 - t0:.3f}s")
+        resource.logger.info(f"Configured async select reflect_select={t1 - t0:.3f}s")  # nosec CWE-117 -- float only
     if ctx.execution_mode == "lazy":
         t2 = perf_counter()
         partitioned_options = build_partitioned_load_options(
@@ -67,7 +67,7 @@ async def aload_configured_execute_async_resource(
         request = build_sql_partitioned_request(options_dict)
         t3 = perf_counter()
         if diagnostics:
-            resource.logger.info(f"Build partitioned request elapsed={t3 - t2:.3f}s")
+            resource.logger.info(f"Build partitioned request elapsed={t3 - t2:.3f}s")  # nosec CWE-117 -- float only
         return await run_async_partitioned_request(ctx, resource, request)
 
     df = await read_sql_async(resource, trusted_sql_request(ctx, statement=stmt, model=model))

{boti_data-1.3.3 → boti_data-1.3.5}/src/boti_data/pipelines/sinks_common.py

@@ -146,6 +146,30 @@ def _rm_recursive(fs: fsspec.AbstractFileSystem, path: str) -> None:
         fs.rm(path)
 
 
+def _rebase_staged_path(
+    fs: fsspec.AbstractFileSystem,
+    path: str,
+    staging_path: str,
+    target_root: str,
+) -> str:
+    """Rewrite *path* from the staging tree to the target tree.
+
+    ``glob()``/``find()`` on most fsspec backends (S3, memory, ...) return
+    protocol-stripped paths (``bucket/key``) even when queried with a
+    scheme-prefixed directory (``s3://bucket/key``) -- but *staging_path*/
+    *target_root* here are whatever the caller originally passed in, which
+    for a ``Datasources``-resolved destination is scheme-prefixed. A naive
+    ``path.replace(staging_path, target_root)`` then silently no-ops (no
+    substring match, string returned unchanged) instead of raising, so both
+    sides are normalized through ``_strip_protocol()`` first to guarantee the
+    replace actually matches regardless of which form *path* arrived in.
+    """
+    normalized_path = fs._strip_protocol(path)
+    normalized_staging = fs._strip_protocol(staging_path)
+    normalized_target = fs._strip_protocol(target_root)
+    return normalized_path.replace(normalized_staging, normalized_target, 1)
+
+
 def _move_staged_files(
     fs: fsspec.AbstractFileSystem,
     staged_files: Sequence[str],
@@ -165,7 +189,7 @@ def _move_staged_files(
     so the phantom entry never gets a chance to appear.
     """
     for staged_file in staged_files:
-        destination = staged_file.replace(staging_path, target_root, 1)
+        destination = _rebase_staged_path(fs, staged_file, staging_path, target_root)
         parent = destination.rsplit("/", 1)[0]
         if parent and parent != destination:
             fs.makedirs(parent, exist_ok=True)
@@ -212,7 +236,7 @@ def _write_with_staging(
             f"The newly written data is intact at {staging_path!r}."
         ) from exc
 
-    return [file.replace(staging_path, target_root, 1) for file in files]
+    return [_rebase_staged_path(fs, file, staging_path, target_root) for file in files]
 
 
 @dataclass(slots=True)

{boti_data-1.3.3 → boti_data-1.3.5}/src/boti_data.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boti-data
-Version: 1.3.3
+Version: 1.3.5
 Summary: Data infrastructure for the Boti ecosystem
 Author: Luis Valverde
 Maintainer-email: Luis Valverde <lvalverdeb@gmail.com>