dirsql 0.1.5__tar.gz → 0.1.8__tar.gz

{dirsql-0.1.5 → dirsql-0.1.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dirsql
-Version: 0.1.5
+Version: 0.1.8
 Requires-Dist: pytest>=8 ; extra == 'dev'
 Requires-Dist: pytest-describe>=2 ; extra == 'dev'
 Requires-Dist: pytest-asyncio>=0.23 ; extra == 'dev'

{dirsql-0.1.5 → dirsql-0.1.8}/packages/python/tests/integration/test_dirsql.py

@@ -290,6 +290,42 @@ def describe_DirSQL():
             with pytest.raises(Exception):
                 await db.query("NOT VALID SQL")
 
+        @pytest.mark.asyncio
+        async def it_rejects_write_statements_via_query(tmp_dir):
+            """`query()` rejects non-SELECT statements so a caller can't mutate the index."""
+            with open(os.path.join(tmp_dir, "item.json"), "w") as f:
+                json.dump({"name": "apple"}, f)
+
+            db = DirSQL(
+                tmp_dir,
+                tables=[
+                    Table(
+                        ddl="CREATE TABLE items (name TEXT)",
+                        glob="*.json",
+                        extract=lambda path, content: [json.loads(content)],
+                    ),
+                ],
+            )
+            await db.ready()
+
+            for stmt in [
+                "DELETE FROM items",
+                "DROP TABLE items",
+                "INSERT INTO items (name) VALUES ('evil')",
+                "UPDATE items SET name = 'x'",
+                "CREATE TABLE evil (id TEXT)",
+                "ALTER TABLE items ADD COLUMN evil TEXT",
+                "REPLACE INTO items (name) VALUES ('x')",
+                "VACUUM",
+            ]:
+                with pytest.raises(Exception, match="(?i)read-only|writeforbidden"):
+                    await db.query(stmt)
+
+            # Index remains intact.
+            results = await db.query("SELECT name FROM items")
+            assert len(results) == 1
+            assert results[0]["name"] == "apple"
+
         @pytest.mark.asyncio
         async def it_raises_on_invalid_ddl(tmp_dir):
             """Invalid DDL raises an exception during init."""

{dirsql-0.1.5 → dirsql-0.1.8}/packages/rust/src/db.rs

@@ -12,6 +12,11 @@ pub enum DbError {
 
     #[error("DDL parse error: {0}")]
     DdlParse(String),
+
+    #[error(
+        "query() only accepts read-only statements; SQLite classified this statement as a write"
+    )]
+    WriteForbidden,
 }
 
 pub type Result<T> = std::result::Result<T, DbError>;
@@ -134,12 +139,20 @@ impl Db {
 
     /// Query the database, returning rows as a list of column-name -> value maps.
     ///
+    /// Rejects any statement that SQLite itself classifies as a write
+    /// (INSERT / UPDATE / DELETE / DROP / CREATE / ALTER / REPLACE / VACUUM /
+    /// ANALYZE / …) via `sqlite3_stmt_readonly`, surfaced here as
+    /// [`DbError::WriteForbidden`].
+    ///
     /// Internal tracking columns (`_dirsql_*`) are excluded from `SELECT *`
     /// results so they don't leak. But if the user names one explicitly in the
     /// projection (e.g. `SELECT _dirsql_file_path FROM t`), it's returned —
     /// users opt into the tracking surface by typing the column name.
     pub fn query(&self, sql: &str) -> Result<Vec<HashMap<String, Value>>> {
         let mut stmt = self.conn.prepare(sql)?;
+        if !stmt.readonly() {
+            return Err(DbError::WriteForbidden);
+        }
         let column_names: Vec<String> = stmt.column_names().iter().map(|s| s.to_string()).collect();
 
         let rows = stmt.query_map([], |row| {

{dirsql-0.1.5 → dirsql-0.1.8}/packages/rust/src/lib.rs

@@ -83,6 +83,11 @@ pub enum DirSqlError {
 
     #[error("no format for table '{0}': specify format explicitly or use a recognized extension")]
     NoFormat(String),
+
+    #[error(
+        "query() only accepts read-only statements; SQLite classified this statement as a write"
+    )]
+    WriteForbidden,
 }
 
 pub type Result<T> = std::result::Result<T, DirSqlError>;
@@ -210,13 +215,21 @@ impl DirSQL {
     }
 
     /// Run a SQL query against the in-memory database.
+    ///
+    /// Only read-only statements are accepted. Each statement is prepared on
+    /// SQLite and then classified via `sqlite3_stmt_readonly`; anything that
+    /// SQLite itself flags as a write — `INSERT`, `UPDATE`, `DELETE`, `DROP`,
+    /// `CREATE`, `ALTER`, `REPLACE`, `VACUUM`, `ANALYZE`, etc. — is rejected
+    /// with [`DirSqlError::WriteForbidden`] before any rows are produced. This
+    /// keeps the in-memory index consistent with the on-disk files that back
+    /// it: mutations only happen through the watcher/indexer pipeline.
     pub fn query(&self, sql: &str) -> Result<Vec<Row>> {
         let db = self
             .inner
             .db
             .lock()
             .map_err(|e| DirSqlError::Lock(e.to_string()))?;
-        db.query(sql).map_err(Into::into)
+        db.query(sql).map_err(map_db_error)
     }
 
     /// Lazily create the filesystem watcher. Idempotent; subsequent calls are
@@ -491,6 +504,18 @@ impl DirSQL {
     }
 }
 
+/// Translate a [`DbError`] into a [`DirSqlError`], promoting the core's
+/// structural write-rejection ([`DbError::WriteForbidden`]) into
+/// [`DirSqlError::WriteForbidden`] so callers can distinguish a rejected
+/// write from any other query error. Every other `DbError` flows through the
+/// usual [`DirSqlError::Core`] conversion.
+fn map_db_error(e: DbError) -> DirSqlError {
+    match e {
+        DbError::WriteForbidden => DirSqlError::WriteForbidden,
+        other => DirSqlError::Core(other),
+    }
+}
+
 fn error_event(table: Option<&str>, rel_path: &str, error: String) -> RowEvent {
     RowEvent::Error {
         table: table.map(str::to_string),
@@ -713,3 +738,29 @@ impl AsyncDirSQL {
         }
     }
 }
+
+#[cfg(test)]
+mod readonly_tests {
+    use super::*;
+
+    #[test]
+    fn map_db_error_promotes_write_forbidden() {
+        let err = map_db_error(DbError::WriteForbidden);
+        assert!(matches!(err, DirSqlError::WriteForbidden));
+    }
+
+    #[test]
+    fn map_db_error_leaves_sqlite_errors_as_core() {
+        let err = map_db_error(DbError::Sqlite(rusqlite::Error::SqliteFailure(
+            rusqlite::ffi::Error::new(rusqlite::ffi::SQLITE_ERROR),
+            Some("syntax error".into()),
+        )));
+        assert!(matches!(err, DirSqlError::Core(_)));
+    }
+
+    #[test]
+    fn map_db_error_leaves_schema_mismatch_as_core() {
+        let err = map_db_error(DbError::SchemaMismatch("nope".into()));
+        assert!(matches!(err, DirSqlError::Core(_)));
+    }
+}

dirsql-0.1.8/packages/rust/tests/readonly_query.rs

@@ -0,0 +1,210 @@
+//! Integration tests for the read-only enforcement on `DirSQL::query`.
+//!
+//! `query()` is the user-facing surface for running SQL over the index. It
+//! must only accept statements that SQLite itself classifies as read-only via
+//! `sqlite3_stmt_readonly`, so a caller who reaches the method (SDK user,
+//! HTTP client, etc.) cannot mutate the in-memory index via `DELETE`, `DROP`,
+//! `INSERT`, `UPDATE`, `CREATE`, `ALTER`, `REPLACE`, `VACUUM`, `ANALYZE`,
+//! etc.
+
+use dirsql::{DirSQL, DirSqlError, Table, Value};
+use std::collections::HashMap;
+use std::fs;
+use std::path::Path;
+use tempfile::TempDir;
+
+fn items_db(root: &Path) -> DirSQL {
+    fs::write(root.join("a.txt"), "apple").unwrap();
+    fs::write(root.join("b.txt"), "banana").unwrap();
+    DirSQL::new(
+        root,
+        vec![Table::new(
+            "CREATE TABLE items (name TEXT)",
+            "*.txt",
+            |_, content| {
+                vec![HashMap::from([(
+                    "name".into(),
+                    Value::Text(content.trim().to_string()),
+                )])]
+            },
+        )],
+    )
+    .unwrap()
+}
+
+#[test]
+fn it_rejects_delete_via_query() {
+    let root = TempDir::new().unwrap();
+    let db = items_db(root.path());
+
+    let err = db.query("DELETE FROM items").unwrap_err();
+    assert!(
+        matches!(err, DirSqlError::WriteForbidden),
+        "expected WriteForbidden, got {err:?}"
+    );
+
+    let rows = db.query("SELECT name FROM items").unwrap();
+    assert_eq!(rows.len(), 2);
+}
+
+#[test]
+fn it_rejects_drop_table_via_query() {
+    let root = TempDir::new().unwrap();
+    let db = items_db(root.path());
+
+    let err = db.query("DROP TABLE items").unwrap_err();
+    assert!(matches!(err, DirSqlError::WriteForbidden));
+
+    let rows = db.query("SELECT name FROM items").unwrap();
+    assert_eq!(rows.len(), 2);
+}
+
+#[test]
+fn it_rejects_insert_via_query() {
+    let root = TempDir::new().unwrap();
+    let db = items_db(root.path());
+
+    let err = db
+        .query("INSERT INTO items (name) VALUES ('evil')")
+        .unwrap_err();
+    assert!(matches!(err, DirSqlError::WriteForbidden));
+
+    let rows = db.query("SELECT name FROM items").unwrap();
+    assert_eq!(rows.len(), 2);
+}
+
+#[test]
+fn it_rejects_update_via_query() {
+    let root = TempDir::new().unwrap();
+    let db = items_db(root.path());
+
+    let err = db.query("UPDATE items SET name = 'zzz'").unwrap_err();
+    assert!(matches!(err, DirSqlError::WriteForbidden));
+
+    let rows = db.query("SELECT name FROM items ORDER BY name").unwrap();
+    assert_eq!(rows[0]["name"], Value::Text("apple".into()));
+}
+
+#[test]
+fn it_rejects_create_table_via_query() {
+    let root = TempDir::new().unwrap();
+    let db = items_db(root.path());
+
+    let err = db.query("CREATE TABLE evil (id TEXT)").unwrap_err();
+    assert!(matches!(err, DirSqlError::WriteForbidden));
+}
+
+#[test]
+fn it_rejects_alter_table_via_query() {
+    let root = TempDir::new().unwrap();
+    let db = items_db(root.path());
+
+    let err = db
+        .query("ALTER TABLE items ADD COLUMN evil TEXT")
+        .unwrap_err();
+    assert!(matches!(err, DirSqlError::WriteForbidden));
+}
+
+#[test]
+fn it_rejects_replace_via_query() {
+    let root = TempDir::new().unwrap();
+    let db = items_db(root.path());
+
+    let err = db
+        .query("REPLACE INTO items (name) VALUES ('x')")
+        .unwrap_err();
+    assert!(matches!(err, DirSqlError::WriteForbidden));
+}
+
+#[test]
+fn it_rejects_vacuum_via_query() {
+    let root = TempDir::new().unwrap();
+    let db = items_db(root.path());
+
+    let err = db.query("VACUUM").unwrap_err();
+    assert!(matches!(err, DirSqlError::WriteForbidden));
+}
+
+#[test]
+fn it_rejects_analyze_via_query() {
+    let root = TempDir::new().unwrap();
+    let db = items_db(root.path());
+
+    let err = db.query("ANALYZE").unwrap_err();
+    assert!(matches!(err, DirSqlError::WriteForbidden));
+}
+
+#[test]
+fn it_allows_select_with_leading_whitespace() {
+    let root = TempDir::new().unwrap();
+    let db = items_db(root.path());
+
+    let rows = db.query("   \n\t SELECT name FROM items").unwrap();
+    assert_eq!(rows.len(), 2);
+}
+
+#[test]
+fn it_allows_with_cte_queries() {
+    let root = TempDir::new().unwrap();
+    let db = items_db(root.path());
+
+    let rows = db
+        .query("WITH x AS (SELECT name FROM items) SELECT * FROM x")
+        .unwrap();
+    assert_eq!(rows.len(), 2);
+}
+
+#[test]
+fn it_allows_mixed_case_keywords() {
+    let root = TempDir::new().unwrap();
+    let db = items_db(root.path());
+
+    let rows = db.query("select name from items").unwrap();
+    assert_eq!(rows.len(), 2);
+}
+
+#[test]
+fn it_rejects_write_after_leading_line_comment() {
+    let root = TempDir::new().unwrap();
+    let db = items_db(root.path());
+
+    let err = db.query("-- innocent\nDELETE FROM items").unwrap_err();
+    assert!(matches!(err, DirSqlError::WriteForbidden));
+
+    let rows = db.query("SELECT name FROM items").unwrap();
+    assert_eq!(rows.len(), 2);
+}
+
+#[test]
+fn it_rejects_write_after_leading_block_comment() {
+    let root = TempDir::new().unwrap();
+    let db = items_db(root.path());
+
+    let err = db.query("/* innocent */ DROP TABLE items").unwrap_err();
+    assert!(matches!(err, DirSqlError::WriteForbidden));
+
+    let rows = db.query("SELECT name FROM items").unwrap();
+    assert_eq!(rows.len(), 2);
+}
+
+#[test]
+fn it_allows_select_after_leading_comment() {
+    let root = TempDir::new().unwrap();
+    let db = items_db(root.path());
+
+    let rows = db.query("-- heading\nSELECT name FROM items").unwrap();
+    assert_eq!(rows.len(), 2);
+}
+
+#[test]
+fn write_forbidden_error_mentions_read_only() {
+    let root = TempDir::new().unwrap();
+    let db = items_db(root.path());
+
+    let err = db.query("DELETE FROM items").unwrap_err();
+    let msg = err.to_string();
+    assert!(
+        msg.to_lowercase().contains("read-only"),
+        "error message should mention read-only, got: {msg}"
+    );
+}

{dirsql-0.1.5 → dirsql-0.1.8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "dirsql"
-version = "0.1.5"
+version = "0.1.8"
 description = "Ephemeral SQL index over a local directory"
 license = "MIT"
 requires-python = ">=3.12"